From 01bb8790d4feb2879956d58b51e31516d9df655d Mon Sep 17 00:00:00 2001
From: Marcelo Santos <117441129+marcelo-m7@users.noreply.github.com>
Date: Sun, 31 Aug 2025 11:43:37 +0100
Subject: [PATCH 1/2] backup sshd_config before edits

---
 modules/base/base.sh    |  1 +
 tests/modules_base.bats | 30 ++++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 tests/modules_base.bats

diff --git a/modules/base/base.sh b/modules/base/base.sh
index d742898..093326e 100755
--- a/modules/base/base.sh
+++ b/modules/base/base.sh
@@ -10,6 +10,7 @@ run_base() {
   fi
 
   if [[ -f /etc/ssh/sshd_config ]]; then
+    backup_file /etc/ssh/sshd_config
     sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config || true
     sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config || true
     systemctl reload ssh || systemctl reload sshd || true
diff --git a/tests/modules_base.bats b/tests/modules_base.bats
new file mode 100644
index 0000000..5217013
--- /dev/null
+++ b/tests/modules_base.bats
@@ -0,0 +1,30 @@
+#!/usr/bin/env bats
+
+setup() { cd "$BATS_TEST_DIRNAME/.."; }
+
+teardown() {
+  rm -f /etc/ssh/sshd_config /etc/ssh/sshd_config.bak.mona.*
+}
+
+@test "run_base does not overwrite sshd_config backup" {
+  echo 'PasswordAuthentication yes' >/etc/ssh/sshd_config
+  rm -f /etc/ssh/sshd_config.bak.mona.*
+
+  for cmd in timedatectl systemctl ufw; do
+    printf '#!/usr/bin/env bash\nexit 0\n' >"$BATS_TEST_TMPDIR/$cmd"
+    chmod +x "$BATS_TEST_TMPDIR/$cmd"
+  done
+
+  run bash -lc "export PATH='$BATS_TEST_TMPDIR':\$PATH; export MONA_DIR=$(pwd); . modules/base/base.sh; run_base"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"[mona] backup:"* ]]
+  first_backup=$(ls /etc/ssh/sshd_config.bak.mona.*)
+
+  sleep 1
+
+  run bash -lc "export PATH='$BATS_TEST_TMPDIR':\$PATH; export MONA_DIR=$(pwd); . modules/base/base.sh; run_base"
+  [ "$status" -eq 0 ]
+  backups=(/etc/ssh/sshd_config.bak.mona.*)
+  [ -f "$first_backup" ]
+  [ "${#backups[@]}" -eq 2 ]
+}

From f6c99a3050a9663980dc0ad3352de8ab5118aaee Mon Sep 17 00:00:00 2001
From: Marcelo Santos <117441129+marcelo-m7@users.noreply.github.com>
Date: Sun, 31 Aug 2025 11:52:05 +0100
Subject: [PATCH 2/2] test: isolate sshd backup

---
 modules/base/base.sh    | 10 ++++++----
 tests/modules_base.bats | 19 +++++++++----------
 2 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/modules/base/base.sh b/modules/base/base.sh
index 093326e..e7d546e 100755
--- a/modules/base/base.sh
+++ b/modules/base/base.sh
@@ -9,10 +9,12 @@ run_base() {
     timedatectl set-timezone Europe/Lisbon || true
   fi
 
-  if [[ -f /etc/ssh/sshd_config ]]; then
-    backup_file /etc/ssh/sshd_config
-    sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config || true
-    sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config || true
+  local sshd_config="${SSHD_CONFIG:-/etc/ssh/sshd_config}"
+
+  if [[ -f "$sshd_config" ]]; then
+    backup_file "$sshd_config"
+    sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' "$sshd_config" || true
+    sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' "$sshd_config" || true
     systemctl reload ssh || systemctl reload sshd || true
   fi
 
diff --git a/tests/modules_base.bats b/tests/modules_base.bats
index 5217013..006208c 100644
--- a/tests/modules_base.bats
+++ b/tests/modules_base.bats
@@ -2,29 +2,28 @@
 
 setup() { cd "$BATS_TEST_DIRNAME/.."; }
 
-teardown() {
-  rm -f /etc/ssh/sshd_config /etc/ssh/sshd_config.bak.mona.*
-}
-
 @test "run_base does not overwrite sshd_config backup" {
-  echo 'PasswordAuthentication yes' >/etc/ssh/sshd_config
-  rm -f /etc/ssh/sshd_config.bak.mona.*
+  sshd_dir="$BATS_TEST_TMPDIR/etc/ssh"
+  mkdir -p "$sshd_dir"
+  sshd_config="$sshd_dir/sshd_config"
+  echo 'PasswordAuthentication yes' >"$sshd_config"
+  rm -f "$sshd_dir"/sshd_config.bak.mona.*
 
   for cmd in timedatectl systemctl ufw; do
     printf '#!/usr/bin/env bash\nexit 0\n' >"$BATS_TEST_TMPDIR/$cmd"
     chmod +x "$BATS_TEST_TMPDIR/$cmd"
   done
 
-  run bash -lc "export PATH='$BATS_TEST_TMPDIR':\$PATH; export MONA_DIR=$(pwd); . modules/base/base.sh; run_base"
+  run bash -lc "export PATH='$BATS_TEST_TMPDIR':\$PATH; export MONA_DIR=$(pwd); export SSHD_CONFIG=$sshd_config; . modules/base/base.sh; run_base"
   [ "$status" -eq 0 ]
   [[ "$output" == *"[mona] backup:"* ]]
-  first_backup=$(ls /etc/ssh/sshd_config.bak.mona.*)
+  first_backup=$(ls "$sshd_dir"/sshd_config.bak.mona.*)
 
   sleep 1
 
-  run bash -lc "export PATH='$BATS_TEST_TMPDIR':\$PATH; export MONA_DIR=$(pwd); . modules/base/base.sh; run_base"
+  run bash -lc "export PATH='$BATS_TEST_TMPDIR':\$PATH; export MONA_DIR=$(pwd); export SSHD_CONFIG=$sshd_config; . modules/base/base.sh; run_base"
   [ "$status" -eq 0 ]
-  backups=(/etc/ssh/sshd_config.bak.mona.*)
+  backups=("$sshd_dir"/sshd_config.bak.mona.*)
   [ -f "$first_backup" ]
   [ "${#backups[@]}" -eq 2 ]
 }