ochenstarik-server-monitor-manager.sh

@@ -196,8 +196,10 @@ create_monitor_user() {
 
   install -d -m 0755 -o root -g root /etc/ssh/sshd_config.d
   cat > "$MONITOR_SSH_CONFIG" <<'EOF'
-# Required by the restricted Server Monitor Manager identity.
-PubkeyAuthentication yes
+# Required by the restricted Server Monitor Manager identity only.
+Match User ochenstarik-monitor
+    PubkeyAuthentication yes
+Match all
 EOF
   chown root:root "$MONITOR_SSH_CONFIG"
   chmod 0644 "$MONITOR_SSH_CONFIG"
@@ -205,7 +207,8 @@ EOF
 
 verify_sshd() {
   sshd -t
-  sshd -T | grep -qi '^pubkeyauthentication yes$' \
+  sshd -T -C "user=${MONITOR_USER},host=localhost,addr=127.0.0.1" \
+    | grep -qi '^pubkeyauthentication yes$' \
     || die "В sshd отключена аутентификация по публичному ключу"
 }
 

tests/e2e/test-monitor-manager-wireguard-nftables.sh

@@ -70,11 +70,11 @@ ip netns exec "$target" wg set smm0 \
 ip -n "$hub" address add 10.77.0.1/24 dev smm0
 ip -n "$source" address add 10.77.0.2/32 dev smm0
 ip -n "$target" address add 10.77.0.3/32 dev smm0
-ip -n "$source" route add 10.77.0.0/24 dev smm0
-ip -n "$target" route add 10.77.0.0/24 dev smm0
 for namespace in "$hub" "$source" "$target"; do
   ip -n "$namespace" link set smm0 up
 done
+ip -n "$source" route add 10.77.0.0/24 dev smm0
+ip -n "$target" route add 10.77.0.0/24 dev smm0
 ip netns exec "$hub" sysctl -q -w net.ipv4.ip_forward=1
 
 helper="$temporary/ochenstarik-smm-hub"