testprogs/blackbox/test_kpasswd_heimdal.sh

   1 #!/bin/sh
   2 # Blackbox tests for chainging passwords with kinit and kpasswd
   3 #
   4 # Copyright (C) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
   5 # Copyright (C) 2006-2008 Andrew Bartlett <abartlet@samba.org>
   6 # Copyright (C) 2016      Andreas Schneider <asn@samba.org>
   7
   8 if [ $# -lt 6 ]; then
   9 cat <<EOF
  10 Usage: test_passwords.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX SMBCLIENT
  11 EOF
  12 exit 1;
  13 fi
  14
  15 SERVER=$1
  16 USERNAME=$2
  17 PASSWORD=$3
  18 REALM=$4
  19 DOMAIN=$5
  20 PREFIX=$6
  21 shift 6
  22 failed=0
  23
  24 samba_bindir="$BINDIR"
  25
  26 smbclient="$samba_bindir/smbclient"
  27 samba_kinit=$samba_bindir/samba4kinit
  28 samba_kpasswd=$samba_bindir/samba4kpasswd
  29
  30 samba_tool="$samba_bindir/samba-tool"
  31 net_tool="$samba_bindir/net"
  32 texpect="$samba_bindir/texpect"
  33
  34 newuser="$samba_tool user create"
  35 SMB_UNC="//$SERVER/tmp"
  36
  37 . `dirname $0`/subunit.sh
  38 . `dirname $0`/common_test_fns.inc
  39
  40 do_kinit() {
  41         principal="$1"
  42         password="$2"
  43         shift
  44         shift
  45         kerberos_kinit "$samba_kinit" "$principal" "$password" $@
  46 }
  47
  48 UID_WRAPPER_ROOT=1
  49 export UID_WRAPPER_ROOT
  50
  51 CONFIG="--configfile=$PREFIX/etc/smb.conf"
  52 export CONFIG
  53
  54 testit "reset password policies beside of minimum password age of 0 days" \
  55         $VALGRIND $PYTHON $samba_tool domain passwordsettings set $CONFIG --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=0 --max-pwd-age=default || failed=`expr $failed + 1`
  56
  57 TEST_USERNAME="$(mktemp -u alice-XXXXXX)"
  58 TEST_PRINCIPAL="$TEST_USERNAME@$REALM"
  59 TEST_PASSWORD="testPaSS@00%"
  60 TEST_PASSWORD_NEW="testPaSS@01%"
  61 TEST_PASSWORD_SHORT="secret"
  62 TEST_PASSWORD_WEAK="Supersecret"
  63
  64 testit "create user locally" \
  65         $VALGRIND $PYTHON $newuser $CONFIG $TEST_USERNAME $TEST_PASSWORD || failed=`expr $failed + 1`
  66
  67 KRB5CCNAME="$PREFIX/tmpuserccache"
  68 export KRB5CCNAME
  69
  70 testit "kinit with user password" \
  71         do_kinit $TEST_PRINCIPAL $TEST_PASSWORD || failed=`expr $failed + 1`
  72
  73 test_smbclient "Test login with user kerberos ccache" \
  74         "ls" "$SMB_UNC" --use-kerberos=required || failed=`expr $failed + 1`
  75
  76 testit "change user password with 'samba-tool user password' (unforced)" \
  77         $VALGRIND $PYTHON $samba_tool user password -W$DOMAIN -U$TEST_USERNAME%$TEST_PASSWORD --use-kerberos=off --newpassword=$TEST_PASSWORD_NEW || failed=`expr $failed + 1`
  78
  79 TEST_PASSWORD_OLD=$TEST_PASSWORD
  80 TEST_PASSWORD=$TEST_PASSWORD_NEW
  81 TEST_PASSWORD_NEW="testPaSS@02%"
  82
  83 testit "kinit with user password" \
  84         do_kinit $TEST_PRINCIPAL $TEST_PASSWORD || failed=`expr $failed + 1`
  85
  86 test_smbclient "Test login with user kerberos ccache" \
  87         "ls" "$SMB_UNC" --use-kerberos=required || failed=`expr $failed + 1`
  88
  89 ###########################################################
  90 ### check that a short password is rejected
  91 ###########################################################
  92
  93 cat > $PREFIX/tmpkpasswdscript <<EOF
  94 expect Password
  95 password ${TEST_PASSWORD}\n
  96 expect New password
  97 send ${TEST_PASSWORD_SHORT}\n
  98 expect Verify password
  99 send ${TEST_PASSWORD_SHORT}\n
 100 expect Password too short
 101 EOF
 102
 103 testit "kpasswd check short user password" \
 104         $texpect $PREFIX/tmpkpasswdscript $samba_kpasswd $TEST_PRINCIPAL || failed=`expr $failed + 1`
 105
 106 ###########################################################
 107 ### check that a weak password is rejected
 108 ###########################################################
 109
 110 echo "check that a short password is rejected"
 111 cat > $PREFIX/tmpkpasswdscript <<EOF
 112 expect Password
 113 password ${TEST_PASSWORD}\n
 114 expect New password
 115 send $TEST_PASSWORD_WEAK\n
 116 expect Verify password
 117 send $TEST_PASSWORD_WEAK\n
 118 expect Password does not meet complexity requirements
 119 EOF
 120
 121 testit "kpasswd check weak user password" \
 122         $texpect $PREFIX/tmpkpasswdscript $samba_kpasswd $TEST_PRINCIPAL || failed=`expr $failed + 1`
 123
 124 ###########################################################
 125 ### check that a strong password is accepted
 126 ###########################################################
 127
 128 cat > $PREFIX/tmpkpasswdscript <<EOF
 129 expect Password
 130 password ${TEST_PASSWORD}\n
 131 expect New password
 132 send ${TEST_PASSWORD_NEW}\n
 133 expect Verify password
 134 send ${TEST_PASSWORD_NEW}\n
 135 expect Success
 136 EOF
 137
 138 testit "kpasswd change user password" \
 139         $texpect $PREFIX/tmpkpasswdscript $samba_kpasswd $TEST_PRINCIPAL || failed=`expr $failed + 1`
 140
 141 TEST_PASSWORD=$TEST_PASSWORD_NEW
 142 TEST_PASSWORD_NEW="testPaSS@03%"
 143
 144 ###########################################################
 145 ### Force password change at login
 146 ###########################################################
 147
 148 testit "set password on user locally" \
 149         $VALGRIND $PYTHON $samba_tool user setpassword $TEST_USERNAME $CONFIG --newpassword=$TEST_PASSWORD_NEW --must-change-at-next-login || failed=`expr $failed + 1`
 150
 151 TEST_PASSWORD=$TEST_PASSWORD_NEW
 152 TEST_PASSWORD_NEW="testPaSS@04%"
 153
 154 rm -f $PREFIX/tmpuserccache
 155
 156 cat > $PREFIX/tmpkinitscript <<EOF
 157 expect Password
 158 password ${TEST_PASSWORD}\n
 159 expect Changing password
 160 expect New password
 161 send ${TEST_PASSWORD_NEW}\n
 162 expect Repeat new password
 163 send ${TEST_PASSWORD_NEW}\n
 164 expect Success
 165 EOF
 166
 167 testit "kinit and change user password" \
 168         $texpect $PREFIX/tmpkinitscript $samba_kinit $TEST_PRINCIPAL || failed=`expr $failed + 1`
 169
 170 TEST_PASSWORD=$TEST_PASSWORD_NEW
 171 TEST_PASSWORD_NEW="testPaSS@07%"
 172
 173 test_smbclient "Test login with user (kerberos)" \
 174         "ls" "$SMB_UNC" -k yes -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=`expr $failed + 1`
 175
 176 ###########################################################
 177 ### Test kpasswd service via 'net ads password'
 178 ###########################################################
 179
 180 # NOTE: This works with heimdal because the krb5_set_password function tries
 181 # set_password call first and falls back to change_password if it doesn't
 182 # succeed.
 183 testit "change user password with 'net ads password', admin: $DOMAIN/$TEST_USERNAME, target: $TEST_PRINCIPAL" \
 184         $VALGRIND $net_tool ads password -W$DOMAIN -U$TEST_PRINCIPAL%$TEST_PASSWORD $TEST_PRINCIPAL "$TEST_PASSWORD_NEW" || failed=`expr $failed + 1`
 185
 186 TEST_PASSWORD=$TEST_PASSWORD_NEW
 187 TEST_PASSWORD_NEW="testPaSS@08%"
 188
 189 test_smbclient "Test login with smbclient (ntlm)" \
 190         "ls" "$SMB_UNC" -k no -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=`expr $failed + 1`
 191
 192 ###########################################################
 193 ### Test kpasswd service via 'net ads password' as admin
 194 ###########################################################
 195
 196 testit "set user password with 'net ads password', admin: $DOMAIN/$USERNAME, target: $TEST_PRINCIPAL" \
 197         $VALGRIND $net_tool ads password -W$DOMAIN -U$USERNAME@$REALM%$PASSWORD $TEST_PRINCIPAL "$TEST_PASSWORD_NEW" || failed=`expr $failed + 1`
 198
 199 TEST_PASSWORD=$TEST_PASSWORD_NEW
 200 TEST_PASSWORD_NEW="testPaSS@07%"
 201
 202 test_smbclient "Test login with smbclient (ntlm)" \
 203         "ls" "$SMB_UNC" -k no -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=`expr $failed + 1`
 204
 205 ###########################################################
 206 ### Cleanup
 207 ###########################################################
 208
 209 testit "reset password policies" \
 210         $VALGRIND $PYTHON $samba_tool domain passwordsettings set $CONFIG --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=default --max-pwd-age=default || failed=`expr $failed + 1`
 211
 212 testit "delete user" \
 213         $VALGRIND $PYTHON $samba_tool user delete $TEST_USERNAME -U"$USERNAME%$PASSWORD" $CONFIG -k no  || failed=`expr $failed + 1`
 214
 215 rm -f $PREFIX/tmpuserccache $PREFIX/tmpkpasswdscript $PREFIX/tmpkinitscript
 216 exit $failed