fix: opt out of the SSH hardening inherited from napalm-linux

OpenMediaVault generates sshd_config from its own database; a drop-in
netOrk wrote would be dropped by the next apply of the SSH settings
without a word. harden_ssh_server = None makes netOrk's capability probe
answer no.

Requires napalm-linux 0.5.0; bumps to 0.1.1. NetOrk/netork#1027

.github/workflows/ci.yml

@@ -0,0 +1,50 @@
+name: CI
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: ["**"]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+
+      - name: Install package with dev extras
+        run: |
+          python -m pip install --upgrade pip
+          # napalm-device-types lives in git.netork.io/NAPALM, not on PyPI: without this
+          # pip looks there, finds an unrelated 0.1.0 and the job dies before any test.
+          python -m pip install "napalm-device-types @ git+https://git.netork.io/NAPALM/napalm-device-types.git"
+          # napalm-linux, which this driver builds on, is not on PyPI either.
+          python -m pip install "napalm-linux @ git+https://git.netork.io/NAPALM/napalm-linux.git"
+          python -m pip install -e ".[dev]"
+
+      - name: Run unit tests
+        run: |
+          python -m pytest -q --tb=short
+
+      - name: Build wheel and sdist
+        run: |
+          python -m pip install build
+          python -m build
+
+      - name: Upload dist artifacts
+        # v4 refuses to run on Gitea ("not currently supported on GHES").
+        uses: actions/upload-artifact@v3
+        with:
+          name: dist-${{ matrix.python-version }}
+          path: dist/*

napalm_openmediavault/openmediavault.py

@@ -65,6 +65,11 @@ class OpenMediaVaultDriver(StorageDriver, LinuxDriver):
         FingerprintRule("openmediavault", weight=9.0, mandatory=True),
     ]
 
+    #: OMV generates sshd_config from its own database; a drop-in netOrk wrote
+    #: would be dropped on the next apply of the SSH settings. Inherited from
+    #: napalm-linux, so opted out here (NetOrk/netork#1027).
+    harden_ssh_server = None  # type: ignore[assignment]
+
     # ── Facts override ─────────────────────────────────────────────────────────
 
     def get_facts(self) -> dict[str, Any]:

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "napalm-openmediavault"
-version = "0.1.0"
+version = "0.1.1"
 description = "NAPALM driver for OpenMediaVault NAS (SSH)"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -25,9 +25,12 @@ classifiers = [
 dependencies = [
     "napalm>=4.0",
     "napalm-device-types>=0.3.0",
-    "napalm-linux>=0.1.0",
+    "napalm-linux>=0.5.0",
 ]
 
+[project.optional-dependencies]
+dev = ["pytest"]
+
 [project.entry-points."napalm.drivers"]
 openmediavault = "napalm_openmediavault:OpenMediaVaultDriver"
 

tests/test_ssh_hardening_opt_out.py

@@ -0,0 +1,16 @@
+"""OpenMediaVault writes sshd_config itself, from its own database.
+
+The Linux driver offers to harden the SSH server by writing a drop-in under
+/etc/ssh/sshd_config.d (NetOrk/netork#1027). On OMV the next apply of the SSH
+settings (``omv-salt deploy run ssh``) would regenerate the configuration and
+take the change back without a word, so this driver opts out: netOrk's
+capability probe asks ``callable(harden_ssh_server)``.
+"""
+
+from __future__ import annotations
+
+from napalm_openmediavault.openmediavault import OpenMediaVaultDriver
+
+
+def test_does_not_offer_ssh_hardening():
+    assert not callable(getattr(OpenMediaVaultDriver, "harden_ssh_server", None))