da73bbd73c
* The ssh key may be created manually prior the task execution with a passphrase. And the task will be executed on the same key. * The ssh key may be broken and not usable. The module will check the private key and if the key is password protected or broken, it will be overridden. The check of the ssh key performed by retrieve the public key from the private key. Set the "self.force" check before the "isPrivateKeyValid" check. In case of any issue with the "isPrivateKeyValid" function, the user will be able to force the regeneration of the key with the "force: yes" argument.
119 lines
3.3 KiB
YAML
119 lines
3.3 KiB
YAML
---
|
|
- name: Log privatekey1 return values
|
|
debug:
|
|
var: privatekey1_result
|
|
|
|
- name: Validate privatekey1 return fingerprint
|
|
assert:
|
|
that:
|
|
- privatekey1_result["fingerprint"] is string
|
|
- privatekey1_result["fingerprint"].startswith("SHA256:")
|
|
# only distro old enough that it still gives md5 with no prefix
|
|
when: ansible_distribution != 'CentOS' and ansible_distribution_major_version != '6'
|
|
|
|
- name: Validate privatekey1 return public_key
|
|
assert:
|
|
that:
|
|
- privatekey1_result["public_key"] is string
|
|
- privatekey1_result["public_key"].startswith("ssh-rsa ")
|
|
|
|
- name: Validate privatekey1 return size value
|
|
assert:
|
|
that:
|
|
- privatekey1_result["size"]|type_debug == 'int'
|
|
- privatekey1_result["size"] == 4096
|
|
|
|
- name: Validate privatekey1 return key type
|
|
assert:
|
|
that:
|
|
- privatekey1_result["type"] is string
|
|
- privatekey1_result["type"] == "rsa"
|
|
|
|
- name: Validate privatekey1 (test - RSA key with size 4096 bits)
|
|
shell: "ssh-keygen -lf {{ output_dir }}/privatekey1 | grep -o -E '^[0-9]+'"
|
|
register: privatekey1
|
|
|
|
- name: Validate privatekey1 (assert - RSA key with size 4096 bits)
|
|
assert:
|
|
that:
|
|
- privatekey1.stdout == '4096'
|
|
|
|
- name: Validate privatekey1 idempotence
|
|
assert:
|
|
that:
|
|
- privatekey1_idem_result is not changed
|
|
|
|
|
|
- name: Validate privatekey2 (test - RSA key with size 2048 bits)
|
|
shell: "ssh-keygen -lf {{ output_dir }}/privatekey2 | grep -o -E '^[0-9]+'"
|
|
register: privatekey2
|
|
|
|
- name: Validate privatekey2 (assert - RSA key with size 2048 bits)
|
|
assert:
|
|
that:
|
|
- privatekey2.stdout == '2048'
|
|
|
|
|
|
- name: Validate privatekey3 (test - DSA key with size 1024 bits)
|
|
shell: "ssh-keygen -lf {{ output_dir }}/privatekey3 | grep -o -E '^[0-9]+'"
|
|
register: privatekey3
|
|
|
|
- name: Validate privatekey3 (assert - DSA key with size 4096 bits)
|
|
assert:
|
|
that:
|
|
- privatekey3.stdout == '1024'
|
|
|
|
|
|
- name: Validate privatekey4 (test - Ensure key has been removed)
|
|
stat:
|
|
path: '{{ output_dir }}/privatekey4'
|
|
register: privatekey4
|
|
|
|
- name: Validate privatekey4 (assert - Ensure key has been removed)
|
|
assert:
|
|
that:
|
|
- privatekey4.stat.exists == False
|
|
|
|
|
|
- name: Validate privatekey5 (assert - Public key module output equal to the public key on host)
|
|
assert:
|
|
that:
|
|
- "publickey_gen.public_key == lookup('file', output_dir ~ '/privatekey5.pub').strip('\n')"
|
|
|
|
- name: Verify that privatekey6 will be regenerated via force
|
|
assert:
|
|
that:
|
|
- output_regenerated_via_force is changed
|
|
|
|
|
|
- name: Verify that broken key will be regenerated
|
|
assert:
|
|
that:
|
|
- output_broken is changed
|
|
|
|
|
|
- name: Verify that read-only key will be regenerated
|
|
assert:
|
|
that:
|
|
- output_read_only is changed
|
|
|
|
|
|
- name: Validate privatekey7 (assert - Public key remains the same after comment change)
|
|
assert:
|
|
that:
|
|
- privatekey7_result.public_key == privatekey7_modified_result.public_key
|
|
|
|
- name: Validate privatekey7 comment on creation
|
|
assert:
|
|
that:
|
|
- privatekey7_result.comment == 'test@privatekey7'
|
|
|
|
- name: Validate privatekey7 comment update
|
|
assert:
|
|
that:
|
|
- privatekey7_modified_result.comment == 'test_modified@privatekey7'
|
|
|
|
- name: Check that password protected key has been regenerated
|
|
assert:
|
|
that:
|
|
- privatekey8_result is changed
|