Ssh Access Control

Test suite for validating SSH access control options

SSH User Deny

Description

Check that enforcing a user denial will work as expected. Test_user is set to be denied through SSH connection, then a connection through this user is tried expecting failure to connect. Admin user that hasn’t been denied is also tested to confirm unchanged behavior in this case.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.20/24
set service ssh access-control deny user test_user
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user test_user authentication encrypted-password '$6$kdLrBslXqWLsDmNx$EaLRtLSG6kK8YokTEuYAHaskv5SESw98j/yva/yGBUr0RKdAHmiw7kGaYiZIVs/ybu4yd2zxtk2jRty7lccne/'

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.215.168.21/24
set service ssh
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping the IP address 10.215.168.20 from DUT1:

admin@DUT1$ ping 10.215.168.20 count 1 size 56 timeout 1

Step 4: Initiate an SSH connection from DUT1 to IP address 10.215.168.20 using user test_user which is expected to fail:

admin@DUT1$ ssh test_user@10.215.168.20 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 5: Initiate an SSH connection from DUT1 to IP address 10.215.168.20 using user admin:

admin@DUT1$ ssh admin@10.215.168.20 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

SSH User Allow

Description

Check that allowing a user will only let that user connect to the device. Test_user is set to be unallowed through SSH connection, then a connection through this user is tried expecting to connect unsuccessfully. The next step will try a SSH connection through Admin which is the allowed user, then the connection is succesfull.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.20/24
set service ssh access-control allow user admin
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user test_user authentication encrypted-password '$6$Np8aUXCx28j1YtZG$UZwyD9EQxZN6Ka5AknS3HWy9Ek3KP9PUHWNVRuNazr1YrD4Q8T6YvYyu/l6P02aRcR5HnKPOlMeaAtuEtHux1/'

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.215.168.21/24
set service ssh
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping the IP address 10.215.168.20 from DUT1:

admin@DUT1$ ping 10.215.168.20 count 1 size 56 timeout 1

Step 4: Initiate an SSH connection from DUT1 to IP address 10.215.168.20 using user test_user which is expected to fail:

admin@DUT1$ ssh test_user@10.215.168.20 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 5: Initiate an SSH connection from DUT1 to IP address 10.215.168.20 using user admin:

admin@DUT1$ ssh admin@10.215.168.20 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

SSH Role Deny

Description

Check that enforcing a role denial will work as expected. Test_user and test_role are created and then the role is assigned to the user. The role is set to be unallowed through SSH connection, then a connection through this user is tried expecting a failure. The admin user is also tried to ensure that users that haven’t been denied can still access the router.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.20/24
set service ssh access-control deny role test_role
set system login role test_role level 14
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user test_user authentication encrypted-password '$6$FC.g01abWtT6Fr0k$5hqvyZvl/99ZJWItkFpcNxDQTaFne9.YWlJkuHUyE3FZsaSpdeAL.Se9UNiJSvrdJvKbV2ScCHSqGOH2twlF00'
set system login user test_user role test_role

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.215.168.21/24
set service ssh
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping the IP address 10.215.168.20 from DUT1:

admin@DUT1$ ping 10.215.168.20 count 1 size 56 timeout 1

Step 4: Initiate an SSH connection from DUT1 to IP address 10.215.168.20 using user test_user which is expected to fail:

admin@DUT1$ ssh test_user@10.215.168.20 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 5: Initiate an SSH connection from DUT1 to IP address 10.215.168.20 using user admin:

admin@DUT1$ ssh admin@10.215.168.20 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

SSH Role Allow

Description

Check that enforcing a role permission will work as expected. Two users and two roles are created. The roles are assigned to each of the users. Test_role is then allowed and an SSH connection is tried with the test_user assigned that role, expecting to succeed. Test_user2 is tried to ensure the deny by default behavior once an allow is set.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.20/24
set service ssh access-control allow role test_role
set system login role test_role level 14
set system login role test_role2 level 13
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user test_user authentication encrypted-password '$6$tHdnkzYa7lz/X0US$1O5QHWpfxBca1oRTKrmPQNWaJeR6N0WlH5jxkXUCOhZHYOoXBS4ehZtYvGu7M6Lh1sROHHqhh8fnrHM0/wlqx1'
set system login user test_user role test_role
set system login user test_user2 authentication encrypted-password '$6$vkbakRw4Hs/CRJBA$n9hQGXAIqo/1PsCsIIi/mmBp6Nr2IQc.Qkds04RuxnmZqRxzwet7iZWa0JsMKLyHDaLjTq1PYDW/GMV/7Cefd0'
set system login user test_user2 role test_role2

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.215.168.21/24
set service ssh
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping the IP address 10.215.168.20 from DUT1:

admin@DUT1$ ping 10.215.168.20 count 1 size 56 timeout 1

Step 4: Initiate an SSH connection from DUT1 to IP address 10.215.168.20 using user test_user:

admin@DUT1$ ssh test_user@10.215.168.20 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 5: Initiate an SSH connection from DUT1 to IP address 10.215.168.20 using user test_user2 which is expected to fail:

admin@DUT1$ ssh test_user2@10.215.168.20 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null