5cd5332397
This commit adds: - Database migrations for app_delta fingerprints and client certificates - Scripts for certificate generation and fingerprint backfilling - Comprehensive security audit reports and findings tracking - Implementation documentation for certificate authentication - Test utilities for certificate renewal and fingerprinting - GE-ENFORCE collector fix documentation Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
46 lines
1.7 KiB
Bash
46 lines
1.7 KiB
Bash
#!/bin/bash
|
|
echo "=== Certificate Renewal Security Tests ==="
|
|
echo ""
|
|
|
|
API_KEY="shopdb_pat_b4a3fe2a01abc6bc1cb685280e65a8c35d52ec43"
|
|
BASE_URL="https://localhost:5001"
|
|
|
|
echo "Test 1: Hostname Validation - Empty hostname"
|
|
curl -k -X POST "$BASE_URL/api/endpoints/certificate/renew" \
|
|
-H "X-API-Key: $API_KEY" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"hostname":""}' \
|
|
-s -w "\nStatus: %{http_code}\n\n" | grep -E "error|Status"
|
|
|
|
echo "Test 2: Hostname Validation - SQL injection attempt"
|
|
curl -k -X POST "$BASE_URL/api/endpoints/certificate/renew" \
|
|
-H "X-API-Key: $API_KEY" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"hostname":"test;DROP TABLE"}' \
|
|
-s -w "\nStatus: %{http_code}\n\n" | grep -E "error|Status"
|
|
|
|
echo "Test 3: Hostname Validation - Path traversal"
|
|
curl -k -X POST "$BASE_URL/api/endpoints/certificate/renew" \
|
|
-H "X-API-Key: $API_KEY" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"hostname":"../../etc/passwd"}' \
|
|
-s -w "\nStatus: %{http_code}\n\n" | grep -E "error|Status"
|
|
|
|
echo "Test 4: Hostname Validation - Too long (65 chars)"
|
|
curl -k -X POST "$BASE_URL/api/endpoints/certificate/renew" \
|
|
-H "X-API-Key: $API_KEY" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"hostname":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"}' \
|
|
-s -w "\nStatus: %{http_code}\n\n" | grep -E "error|Status"
|
|
|
|
echo "Test 5: Valid hostname (should work or rate limit)"
|
|
curl -k -X POST "$BASE_URL/api/endpoints/certificate/renew" \
|
|
-H "X-API-Key: $API_KEY" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"hostname":"DESKTOP-HF1K9M4"}' \
|
|
-s -w "\nStatus: %{http_code}\n" | head -20
|
|
|
|
echo ""
|
|
echo "=== Check Agent Cert Authentication ==="
|
|
docker-compose logs --tail=500 api 2>&1 | grep "Authenticated asset 2528" | tail -3
|