diff --git a/napalm_openmediavault/openmediavault.py b/napalm_openmediavault/openmediavault.py index 5f417a5..bff2d29 100644 --- a/napalm_openmediavault/openmediavault.py +++ b/napalm_openmediavault/openmediavault.py @@ -65,6 +65,11 @@ class OpenMediaVaultDriver(StorageDriver, LinuxDriver): FingerprintRule("openmediavault", weight=9.0, mandatory=True), ] + #: OMV generates sshd_config from its own database; a drop-in netOrk wrote + #: would be dropped on the next apply of the SSH settings. Inherited from + #: napalm-linux, so opted out here (NetOrk/netork#1027). + harden_ssh_server = None # type: ignore[assignment] + # ── Facts override ───────────────────────────────────────────────────────── def get_facts(self) -> dict[str, Any]: diff --git a/pyproject.toml b/pyproject.toml index b849a01..417bb11 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta" [project] name = "napalm-openmediavault" -version = "0.1.0" +version = "0.1.1" description = "NAPALM driver for OpenMediaVault NAS (SSH)" readme = "README.md" requires-python = ">=3.9" @@ -25,7 +25,7 @@ classifiers = [ dependencies = [ "napalm>=4.0", "napalm-device-types>=0.3.0", - "napalm-linux>=0.1.0", + "napalm-linux>=0.5.0", ] [project.optional-dependencies] diff --git a/tests/test_ssh_hardening_opt_out.py b/tests/test_ssh_hardening_opt_out.py new file mode 100644 index 0000000..5618458 --- /dev/null +++ b/tests/test_ssh_hardening_opt_out.py @@ -0,0 +1,16 @@ +"""OpenMediaVault writes sshd_config itself, from its own database. + +The Linux driver offers to harden the SSH server by writing a drop-in under +/etc/ssh/sshd_config.d (NetOrk/netork#1027). On OMV the next apply of the SSH +settings (``omv-salt deploy run ssh``) would regenerate the configuration and +take the change back without a word, so this driver opts out: netOrk's +capability probe asks ``callable(harden_ssh_server)``. +""" + +from __future__ import annotations + +from napalm_openmediavault.openmediavault import OpenMediaVaultDriver + + +def test_does_not_offer_ssh_hardening(): + assert not callable(getattr(OpenMediaVaultDriver, "harden_ssh_server", None))