action #120459
Updated by tjyrinki_suse over 1 year ago
## Observation
The test is based on two machines, client (admin interface) and server (remote server)
The idea is that a remote server with encrypted disk can be rebooted and then the password to decrypt entered via ssh.
The test somewhat 'works' (worked) with some (unnoticed flaws):
* The server is setup with a 'strange' partition layout: /boot encrypted, but / is not
As a consequence, before the ssh server is even reachable, an admin needed to locally unlock the /boot encryption (making dracut-ssh completely useless, as an admin was already local to the system anyway)
This has now popped up as an error on openQA as recent grub forwards the key it receives to decrypt itself to the partitions - which in this case it 'auto-unlocks' during the boot process, making dracut-ssh not having anything to do (tried to unlock /boot again)
IMHO, the partitioning layout it inversed: / should be encrypted, /boot decrypted
openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-luks1_decrypt_ssh_server@64bit fails in
[unlock_via_ssh_server](https://openqa.opensuse.org/tests/2878310/modules/unlock_via_ssh_server/steps/24)
## Test suite description
Maintainer: QE Security
Fails since (at least) Build [20221114](https://openqa.opensuse.org/tests/2877890)
Last good: [20221109](https://openqa.opensuse.org/tests/2865135) (or more recent)
## Further details
Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensuse&flavor=DVD&machine=64bit&test=luks1_decrypt_ssh_server&version=Tumbleweed)
---
This test uses HDD Created by test suite create_hdd_gnome_encrypt_separate_boot using YAML schedule/security/autoyast_btrfs_luks1_separate_boot.yaml, which refers to autoyast_sle15/autoyast_btrfs_luks1_separate_boot.xml, and the test itself uses YAML schedule/security/luks1_decrypt_ssh_server.yaml.
Internal discussion that resulted in filing this ticket https://suse.slack.com/archives/C02CANHLANP/p1668499778430149
Related bug report https://bugzilla.suse.com/show_bug.cgi?id=1141868
## Acceptance Criteria
1. Restructure create_hdd_gnome_encrypt_separate_boot to create a qcow2 with unencrypted boot and encrypted /, accepting passphrase for / over SSH server started in initrd from /boot
1. Update the maintainer of the test to be QE Security