2 # Blackbox tests for different password settings
4 # Copyright (c) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
5 # Copyright (c) 2006-2008 Andrew Bartlett <abartlet@samba.org>
6 # Copyright (c) 2016 Andreas Schneider <asn@samba.org>
10 Usage: test_passwords_settings.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX
24 samba_bindir
="$BINDIR"
27 if test -x $samba_bindir/samba4kinit
; then
28 samba_kinit
=$samba_bindir/samba4kinit
31 smbclient
="$samba_bindir/smbclient"
32 samba_tool
="$samba_bindir/samba-tool"
33 smbpasswd
="$samba_bindir/smbpasswd"
34 texpect
="$samba_bindir/texpect"
36 newuser
="$samba_tool user create"
37 SMB_UNC
="//$SERVER/tmp"
39 .
`dirname $0`/subunit.sh
40 .
`dirname $0`/common_test_fns.inc
47 if test -x $samba_bindir/samba4kinit
; then
48 echo $password > $PREFIX/tmpuserpassfile
49 $samba_kinit --password-file=$PREFIX/tmpuserpassfile
$principal $@
51 echo $password |
$samba_kinit $principal $@
56 export UID_WRAPPER_ROOT
58 CONFIG
="--configfile=$PREFIX/etc/smb.conf"
61 testit
"reset password policies beside of minimum password age of 0 days" \
62 $VALGRIND $samba_tool domain passwordsettings
set $CONFIG --complexity=default
--history-length=default
--min-pwd-length=default
--min-pwd-age=0 --max-pwd-age=default || failed
=`expr $failed + 1`
64 TEST_USERNAME
="$(mktemp -u alice-XXXXXX)"
65 TEST_PASSWORD
="testPaSS@00%"
66 TEST_PASSWORD_NEW
="testPaSS@01%"
67 TEST_PASSWORD_NON_ASCII
="Täst123"
68 TEST_PASSWORD_SHORT
="secret"
69 TEST_PASSWORD_WEAK
="Supersecret"
70 TEST_PRINCIPAL
="$TEST_USERNAME@$REALM"
72 testit
"create user locally" \
73 $VALGRIND $newuser $CONFIG $TEST_USERNAME $TEST_PASSWORD || failed
=`expr $failed + 1`
75 ###########################################################
76 ### Test normal operation as user
77 ###########################################################
79 KRB5CCNAME_PATH
="$PREFIX/test_password_settings_krb5ccache"
80 rm -f $KRB5CCNAME_PATH
82 KRB5CCNAME
="FILE:$KRB5CCNAME_PATH"
85 testit
"kinit with user password" \
86 do_kinit
$TEST_PRINCIPAL $TEST_PASSWORD || failed
=`expr $failed + 1`
88 test_smbclient
"Test login with user kerberos ccache" \
89 "ls" "$SMB_UNC" -k yes || failed
=`expr $failed + 1`
91 rm -f $KRB5CCNAME_PATH
93 ###########################################################
94 ### Change the users password
95 ###########################################################
97 testit
"change user password with 'samba-tool user password' (unforced)" \
98 $VALGRIND $samba_tool user password
-W$DOMAIN -U$TEST_USERNAME%$TEST_PASSWORD -k no
--newpassword=$TEST_PASSWORD_NEW || failed
=`expr $failed + 1`
100 TEST_PASSWORD_OLD
=$TEST_PASSWORD
101 TEST_PASSWORD
=$TEST_PASSWORD_NEW
102 TEST_PASSWORD_NEW
="testPaSS@02%"
104 testit
"kinit with user password" \
105 do_kinit
$TEST_PRINCIPAL $TEST_PASSWORD || failed
=`expr $failed + 1`
107 test_smbclient
"Test login with user kerberos ccache" \
108 "ls" "$SMB_UNC" -k yes || failed
=`expr $failed + 1`
110 ###########################################################
111 ### Change the users password
112 ###########################################################
114 testit
"change user (non-ascii) password with 'samba-tool user password' (unforced)" \
115 $VALGRIND $samba_tool user password
-W$DOMAIN -U$TEST_USERNAME%$TEST_PASSWORD -k no
--newpassword=$TEST_PASSWORD_NON_ASCII || failed
=`expr $failed + 1`
117 TEST_PASSWORD_OLD
=$TEST_PASSWORD_NEW
118 TEST_PASSWORD
=$TEST_PASSWORD_NON_ASCII
120 testit
"kinit with user password" \
121 do_kinit
$TEST_PRINCIPAL $TEST_PASSWORD || failed
=`expr $failed + 1`
123 test_smbclient
"Test login with user kerberos ccache" \
124 "ls" "$SMB_UNC" -k yes || failed
=`expr $failed + 1`
127 # These tests demonstrate that a credential cache in the environment does not
128 # override a username/password, even an incorrect one, on the command line
131 testit_expect_failure
"Test login with user kerberos ccache, but wrong password specified" \
132 $VALGRIND $smbclient //$SERVER/tmp
-c 'ls' -k yes -U$TEST_PRINCIPAL%invalidpass
&& failed
=`expr $failed + 1`
133 testit_expect_failure
"Test login with user kerberos ccache, but old password specified" \
134 $VALGRIND $smbclient //$SERVER/tmp
-c 'ls' -k yes -U$TEST_PRINCIPAL%$TEST_PASSWORD_OLD && failed
=`expr $failed + 1`
136 rm -f $KRB5CCNAME_PATH
138 ###########################################################
139 ### Set the password with smbpasswd
140 ###########################################################
142 cat > $PREFIX/tmpsmbpasswdscript
<<EOF
143 expect New SMB password:
144 send ${TEST_PASSWORD_NEW}\n
145 expect Retype new SMB password:
146 send ${TEST_PASSWORD_NEW}\n
149 testit
"set user password with smbpasswd" \
150 $texpect $PREFIX/tmpsmbpasswdscript
$smbpasswd -L -c $PREFIX/etc
/smb.conf
$TEST_USERNAME || failed
=`expr $failed + 1`
152 TEST_PASSWORD
=$TEST_PASSWORD_NEW
153 TEST_PASSWORD_NEW
="testPaSS@03%"
155 test_smbclient
"Test login with user (ntlm)" \
156 "ls" "$SMB_UNC" -k no
-U$TEST_PRINCIPAL%$TEST_PASSWORD || failed
=`expr $failed + 1`
158 testit
"set password on user locally" $VALGRIND $samba_tool user setpassword
$TEST_USERNAME $CONFIG --newpassword=$TEST_PASSWORD_NEW --must-change-at-next-login || failed
=`expr $failed + 1`
160 TEST_PASSWORD
=$TEST_PASSWORD_NEW
161 TEST_PASSWORD_NEW
="testPaSS@04%"
163 test_smbclient_expect_failure
"Test login with user (NT_STATUS_PASSWORD_MUST_CHANGE)" \
164 "ls" "$SMB_UNC" -k no
-U$TEST_PRINCIPAL%$TEST_PASSWORD && failed
=`expr $failed + 1`
166 testit
"change user password with 'samba-tool user password' (after must change flag set)" \
167 $VALGRIND $samba_tool user password
-W$DOMAIN -U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD -k no
--newpassword=$TEST_PASSWORD_NEW || failed
=`expr $failed + 1`
169 TEST_PASSWORD
=$TEST_PASSWORD_NEW
170 TEST_PASSWORD_NEW
="testPaSS@05%"
172 test_smbclient
"Test login with user kerberos" 'ls' "$SMB_UNC" -k yes -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed
=`expr $failed + 1`
174 rm -f $KRB5CCNAME_PATH
176 cat > $PREFIX/tmpsmbpasswdscript
<<EOF
177 expect Old SMB password:
178 password ${TEST_PASSWORD}\n
179 expect New SMB password:
180 send ${TEST_PASSWORD_NEW}\n
181 expect Retype new SMB password:
182 send ${TEST_PASSWORD_NEW}\n
185 testit
"change user password with smbpasswd (after must change flag set)" \
186 $texpect $PREFIX/tmpsmbpasswdscript
$smbpasswd -r $SERVER -c $PREFIX/etc
/smb.conf
-U $TEST_USERNAME || failed
=`expr $failed + 1`
188 TEST_PASSWORD
=$TEST_PASSWORD_NEW
189 TEST_PASSWORD_NEW
="testPaSS@06%"
191 test_smbclient
"Test login with user kerberos" \
192 "ls" "$SMB_UNC" -k yes -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed
=`expr $failed + 1`
194 rm -f $KRB5CCNAME_PATH
196 testit_expect_failure
"try to set a non-complex password (command should not succeed)" \
197 $VALGRIND $samba_tool user password
-W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no
--newpassword="$TEST_PASSWORD_WEAK" && failed
=`expr $failed + 1`
199 testit
"allow non-complex passwords" \
200 $VALGRIND $samba_tool domain passwordsettings
set $CONFIG --complexity=off || failed
=`expr $failed + 1`
202 testit
"try to set a non-complex password (command should succeed)" \
203 $VALGRIND $samba_tool user password
-W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no
--newpassword="$TEST_PASSWORD_WEAK" || failed
=`expr $failed + 1`
205 TEST_PASSWORD
=$TEST_PASSWORD_WEAK
207 test_smbclient
"test login with non-complex password" \
208 "ls" "$SMB_UNC" -k no
-U$TEST_PRINCIPAL%$TEST_PASSWORD || failed
=`expr $failed + 1`
210 testit_expect_failure
"try to set a short password (command should not succeed)" \
211 $VALGRIND $samba_tool user password
-W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no
--newpassword="$TEST_PASSWORD_SHORT" && failed
=`expr $failed + 1`
213 testit
"allow short passwords (length 1)" \
214 $VALGRIND $samba_tool domain passwordsettings
set $CONFIG --min-pwd-length=1 || failed
=`expr $failed + 1`
216 testit
"try to set a short password (command should succeed)" \
217 $VALGRIND $samba_tool user password
-W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no
--newpassword="$TEST_PASSWORD_SHORT" || failed
=`expr $failed + 1`
219 TEST_PASSWORD
=$TEST_PASSWORD_SHORT
220 TEST_PASSWORD_NEW
="testPaSS@07%"
222 testit
"require minimum password age of 1 day" \
223 $VALGRIND $samba_tool domain passwordsettings
set $CONFIG --min-pwd-age=1 || failed
=`expr $failed + 1`
225 testit
"show password settings" \
226 $VALGRIND $samba_tool domain passwordsettings show
$CONFIG || failed
=`expr $failed + 1`
228 testit_expect_failure
"try to change password too quickly (command should not succeed)" \
229 $VALGRIND $samba_tool user password
-W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no
--newpassword="$TEST_PASSWORD_NEW" && failed
=`expr $failed + 1`
231 testit
"reset password policies" \
232 $VALGRIND $samba_tool domain passwordsettings
set $CONFIG --complexity=default
--history-length=default
--min-pwd-length=default
--min-pwd-age=default
--max-pwd-age=default || failed
=`expr $failed + 1`
234 testit
"delete user $TEST_USERNAME" \
235 $VALGRIND $samba_tool user delete
$TEST_USERNAME -U"$USERNAME%$PASSWORD" $CONFIG -k no || failed
=`expr $failed + 1`
237 rm -f $PREFIX/tmpuserpassfile
$PREFIX/tmpsmbpasswdscript
238 rm -f $KRB5CCNAME_PATH