feat(v2): complete v2 reimplementation

2026-07-31 13:33:39 +02:00
parent 396219e776
commit bd107d6a30
137 changed files with 20737 additions and 155 deletions
@@ -0,0 +1,18 @@
+FROM debian:12-slim
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y openssh-server \
+    && rm -rf /var/lib/apt/lists/* \
+    && (getent group backup >/dev/null || groupadd --system backup) \
+    && (id backup >/dev/null 2>&1 || useradd --system --gid backup --home-dir /home/backup --shell /usr/sbin/nologin backup) \
+    && install -d -o root -g root -m 0755 /home/backup \
+    && install -d -o backup -g backup -m 0700 /home/backup/.ssh \
+    && install -d -o backup -g backup -m 0755 /home/backup/data \
+    && install -d -o root -g root -m 0755 /run/sshd
+
+COPY sshd_config /etc/ssh/sshd_config
+COPY entrypoint.sh /usr/local/bin/fixture-sshd
+RUN chmod 0755 /usr/local/bin/fixture-sshd
+
+EXPOSE 2222
+CMD ["/usr/local/bin/fixture-sshd"]
@@ -0,0 +1,10 @@
+#!/bin/sh
+set -eu
+
+# The ephemeral host key is bind-mounted from the test host and can therefore
+# have an untrusted numeric owner. Copy it into the root-owned tmpfs before
+# sshd checks host-key ownership and permissions.
+install -o root -g root -m 0600 /fixture/host/ssh_host_ed25519_key /run/sshd/ssh_host_ed25519_key
+# Authorized keys are public material; root ownership prevents fixture-user mutation.
+install -o root -g root -m 0644 /fixture/authorized_keys /run/sshd/authorized_keys
+exec /usr/sbin/sshd -D -e -f /etc/ssh/sshd_config
@@ -0,0 +1,28 @@
+Port 2222
+ListenAddress 0.0.0.0
+HostKey /run/sshd/ssh_host_ed25519_key
+PidFile /run/sshd/sshd.pid
+AuthorizedKeysFile /run/sshd/authorized_keys
+UsePAM no
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+ChallengeResponseAuthentication no
+PermitRootLogin no
+PermitEmptyPasswords no
+PubkeyAuthentication yes
+PermitUserEnvironment no
+AllowTcpForwarding no
+X11Forwarding no
+PermitTunnel no
+PermitTTY no
+GatewayPorts no
+AllowAgentForwarding no
+LogLevel VERBOSE
+Subsystem sftp internal-sftp
+
+Match User backup
+    ChrootDirectory /home/backup
+    ForceCommand internal-sftp
+    AllowTcpForwarding no
+    X11Forwarding no
+    PermitTTY no