testprogs/blackbox/test_password_settings.sh

   1 #!/bin/sh
   2 # Blackbox tests for different password settings
   3 #
   4 # Copyright (c) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
   5 # Copyright (c) 2006-2008 Andrew Bartlett <abartlet@samba.org>
   6 # Copyright (c) 2016      Andreas Schneider <asn@samba.org>
   7
   8 if [ $# -lt 7 ]; then
   9         cat <<EOF
  10 Usage: test_passwords_settings.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX CONFIGURATION
  11 EOF
  12         exit 1
  13 fi
  14
  15 SERVER=$1
  16 USERNAME=$2
  17 PASSWORD=$3
  18 REALM=$4
  19 DOMAIN=$5
  20 PREFIX=$6
  21 CONFIGURATION=${7}
  22 shift 7
  23 failed=0
  24
  25 samba_bindir="$BINDIR"
  26
  27 smbclient="$samba_bindir/smbclient"
  28 samba_tool="$samba_bindir/samba-tool"
  29 smbpasswd="$samba_bindir/smbpasswd"
  30 texpect="$samba_bindir/texpect"
  31
  32 newuser="$samba_tool user create"
  33 SMB_UNC="//$SERVER/tmp"
  34
  35 . $(dirname $0)/subunit.sh
  36 . $(dirname $0)/common_test_fns.inc
  37
  38 samba_kinit=$(system_or_builddir_binary kinit "${BINDIR}" samba4kinit)
  39
  40 do_kinit()
  41 {
  42         principal="$1"
  43         password="$2"
  44         shift
  45         shift
  46         kerberos_kinit "$samba_kinit" "$principal" "$password" "$@"
  47 }
  48
  49 test_smbpasswd()
  50 {
  51         user=$1
  52         newpass=$2
  53         _config="$(echo "${CONFIGURATION}" | cut -d '=' -f 2)"
  54
  55         tmpfile=$PREFIX/smbpasswd_change_password_script
  56         cat >$tmpfile <<EOF
  57 expect New SMB password:
  58 send ${newpass}\n
  59 expect Retype new SMB password:
  60 send ${newpass}\n
  61 EOF
  62
  63         cmd='UID_WRAPPER_INITIAL_RUID=0 UID_WRAPPER_INITIAL_EUID=0 $texpect $tmpfile $smbpasswd -L -c ${_config} $user'
  64         eval echo "$cmd"
  65         out=$(eval $cmd)
  66         ret=$?
  67         rm -f $tmpfile
  68
  69         if [ $ret -ne 0 ]; then
  70                 echo "Failed to change user password $user"
  71                 return 1
  72         fi
  73 }
  74
  75 testit "reset password policies beside of minimum password age of 0 days" \
  76         $VALGRIND $PYTHON $samba_tool domain passwordsettings set \
  77         "${CONFIGURATION}" --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=0 --max-pwd-age=default || failed=$(expr $failed + 1)
  78
  79 TEST_USERNAME="$(mktemp -u alice-XXXXXX)"
  80 TEST_PASSWORD="testPaSS@00%"
  81 TEST_PASSWORD_NEW="testPaSS@01%"
  82 TEST_PASSWORD_NON_ASCII="Täst123"
  83 TEST_PASSWORD_SHORT="secret"
  84 TEST_PASSWORD_WEAK="Supersecret"
  85 TEST_PRINCIPAL="$TEST_USERNAME@$REALM"
  86
  87 testit "create user locally" \
  88         $VALGRIND $PYTHON $newuser $TEST_USERNAME $TEST_PASSWORD \
  89         "${CONFIGURATION}" || failed=$(expr $failed + 1)
  90
  91 ###########################################################
  92 ### Test normal operation as user
  93 ###########################################################
  94
  95 KRB5CCNAME_PATH="$PREFIX/test_password_settings_krb5ccache"
  96 rm -f $KRB5CCNAME_PATH
  97
  98 KRB5CCNAME="FILE:$KRB5CCNAME_PATH"
  99 export KRB5CCNAME
 100
 101 testit "kinit with user password" \
 102         do_kinit $TEST_PRINCIPAL $TEST_PASSWORD || failed=$(expr $failed + 1)
 103
 104 test_smbclient "Test login with user kerberos ccache" \
 105         "ls" "$SMB_UNC" --use-krb5-ccache=$KRB5CCNAME || failed=$(expr $failed + 1)
 106
 107 rm -f $KRB5CCNAME_PATH
 108
 109 ###########################################################
 110 ### Change the users password
 111 ###########################################################
 112
 113 testit "change user password with 'samba-tool user password' (unforced)" \
 114         $VALGRIND $PYTHON $samba_tool user password "${CONFIGURATION}" -W$DOMAIN -U$TEST_USERNAME%$TEST_PASSWORD -k no --newpassword=$TEST_PASSWORD_NEW || failed=$(expr $failed + 1)
 115
 116 TEST_PASSWORD_OLD=$TEST_PASSWORD
 117 TEST_PASSWORD=$TEST_PASSWORD_NEW
 118 TEST_PASSWORD_NEW="testPaSS@02%"
 119
 120 testit "kinit with user password" \
 121         do_kinit $TEST_PRINCIPAL $TEST_PASSWORD || failed=$(expr $failed + 1)
 122
 123 test_smbclient "Test login with user kerberos ccache" \
 124         "ls" "$SMB_UNC" --use-krb5-ccache=$KRB5CCNAME || failed=$(expr $failed + 1)
 125
 126 ###########################################################
 127 ### Change the users password
 128 ###########################################################
 129
 130 testit "change user (non-ascii) password with 'samba-tool user password' (unforced)" \
 131         $VALGRIND $PYTHON $samba_tool user password "${CONFIGURATION}" -W$DOMAIN -U$TEST_USERNAME%$TEST_PASSWORD -k no --newpassword=$TEST_PASSWORD_NON_ASCII || failed=$(expr $failed + 1)
 132
 133 TEST_PASSWORD_OLD=$TEST_PASSWORD_NEW
 134 TEST_PASSWORD=$TEST_PASSWORD_NON_ASCII
 135
 136 testit "kinit with user password" \
 137         do_kinit $TEST_PRINCIPAL $TEST_PASSWORD || failed=$(expr $failed + 1)
 138
 139 test_smbclient "Test login with user kerberos ccache" \
 140         "ls" "$SMB_UNC" --use-krb5-ccache=$KRB5CCNAME || failed=$(expr $failed + 1)
 141
 142 #
 143 # These tests demonstrate that a credential cache in the environment does not
 144 # override a username/password, even an incorrect one, on the command line
 145 #
 146
 147 testit_expect_failure "Test login with user kerberos ccache, but wrong password specified" \
 148         $VALGRIND $smbclient //$SERVER/tmp -c 'ls' --use-krb5-ccache=$KRB5CCNAME -U$TEST_PRINCIPAL%invalidpass || failed=$(expr $failed + 1)
 149 testit_expect_failure "Test login with user kerberos ccache, but old password specified" \
 150         $VALGRIND $smbclient //$SERVER/tmp -c 'ls' --use-krb5-ccache=$KRB5CCNAME -U$TEST_PRINCIPAL%$TEST_PASSWORD_OLD || failed=$(expr $failed + 1)
 151
 152 rm -f $KRB5CCNAME_PATH
 153
 154 ###########################################################
 155 ### Set the password with smbpasswd
 156 ###########################################################
 157
 158 testit "set user password with smbpasswd" \
 159         test_smbpasswd $TEST_USERNAME $TEST_PASSWORD_NEW ||
 160         failed=$(expr $failed + 1)
 161
 162 TEST_PASSWORD=$TEST_PASSWORD_NEW
 163 TEST_PASSWORD_NEW="testPaSS@03%"
 164
 165 test_smbclient "Test login with user (ntlm)" \
 166         "ls" "$SMB_UNC" --use-kerberos=disabled -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=$(expr $failed + 1)
 167
 168 testit "set password on user locally" $VALGRIND $PYTHON $samba_tool user setpassword $TEST_USERNAME "${CONFIGURATION}" --newpassword=$TEST_PASSWORD_NEW --must-change-at-next-login || failed=$(expr $failed + 1)
 169
 170 TEST_PASSWORD=$TEST_PASSWORD_NEW
 171 TEST_PASSWORD_NEW="testPaSS@04%"
 172
 173 test_smbclient_expect_failure "Test login with user (NT_STATUS_PASSWORD_MUST_CHANGE)" \
 174         "ls" "$SMB_UNC" --use-kerberos=disabled -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=$(expr $failed + 1)
 175
 176 testit "change user password with 'samba-tool user password' (after must change flag set)" \
 177         $VALGRIND $PYTHON $samba_tool user password "${CONFIGURATION}" -W$DOMAIN -U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD -k no --newpassword=$TEST_PASSWORD_NEW || failed=$(expr $failed + 1)
 178
 179 TEST_PASSWORD=$TEST_PASSWORD_NEW
 180 TEST_PASSWORD_NEW="testPaSS@05%"
 181
 182 test_smbclient "Test login with user kerberos" 'ls' "$SMB_UNC" --use-kerberos=required -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=$(expr $failed + 1)
 183
 184 rm -f $KRB5CCNAME_PATH
 185
 186 cat >$PREFIX/tmpsmbpasswdscript <<EOF
 187 expect Old SMB password:
 188 password ${TEST_PASSWORD}\n
 189 expect New SMB password:
 190 send ${TEST_PASSWORD_NEW}\n
 191 expect Retype new SMB password:
 192 send ${TEST_PASSWORD_NEW}\n
 193 EOF
 194
 195 config="$(echo "${CONFIGURATION}" | cut -d '=' -f 2)"
 196 testit "change user password with smbpasswd (after must change flag set)" \
 197         $texpect $PREFIX/tmpsmbpasswdscript $smbpasswd -r $SERVER -c ${config} -U $TEST_USERNAME || failed=$(expr $failed + 1)
 198
 199 TEST_PASSWORD=$TEST_PASSWORD_NEW
 200 TEST_PASSWORD_NEW="testPaSS@06%"
 201
 202 test_smbclient "Test login with user kerberos" \
 203         "ls" "$SMB_UNC" --use-kerberos=required -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=$(expr $failed + 1)
 204
 205 rm -f $KRB5CCNAME_PATH
 206
 207 testit_expect_failure "try to set a non-complex password (command should not succeed)" \
 208         $VALGRIND $PYTHON $samba_tool user password "${CONFIGURATION}" -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_WEAK" || failed=$(expr $failed + 1)
 209
 210 testit "allow non-complex passwords" \
 211         $VALGRIND $PYTHON $samba_tool domain passwordsettings set "${CONFIGURATION}" --complexity=off || failed=$(expr $failed + 1)
 212
 213 testit "try to set a non-complex password (command should succeed)" \
 214         $VALGRIND $PYTHON $samba_tool user password "${CONFIGURATION}" -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_WEAK" || failed=$(expr $failed + 1)
 215
 216 TEST_PASSWORD=$TEST_PASSWORD_WEAK
 217
 218 test_smbclient "test login with non-complex password" \
 219         "ls" "$SMB_UNC" --use-kerberos=disabled -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=$(expr $failed + 1)
 220
 221 testit_expect_failure "try to set a short password (command should not succeed)" \
 222         $VALGRIND $PYTHON $samba_tool user password "${CONFIGURATION}" -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_SHORT" || failed=$(expr $failed + 1)
 223
 224 testit "allow short passwords (length 1)" \
 225         $VALGRIND $PYTHON $samba_tool domain passwordsettings set "${CONFIGURATION}" --min-pwd-length=1 || failed=$(expr $failed + 1)
 226
 227 testit "try to set a short password (command should succeed)" \
 228         $VALGRIND $PYTHON $samba_tool user password "${CONFIGURATION}" -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_SHORT" || failed=$(expr $failed + 1)
 229
 230 TEST_PASSWORD=$TEST_PASSWORD_SHORT
 231 TEST_PASSWORD_NEW="testPaSS@07%"
 232
 233 testit "require minimum password age of 1 day" \
 234         $VALGRIND $PYTHON $samba_tool domain passwordsettings set "${CONFIGURATION}" --min-pwd-age=1 || failed=$(expr $failed + 1)
 235
 236 testit "show password settings" \
 237         $VALGRIND $PYTHON $samba_tool domain passwordsettings show "${CONFIGURATION}" || failed=$(expr $failed + 1)
 238
 239 testit_expect_failure "try to change password too quickly (command should not succeed)" \
 240         $VALGRIND $PYTHON $samba_tool user password "${CONFIGURATION}" -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_NEW" || failed=$(expr $failed + 1)
 241
 242 testit "reset password policies" \
 243         $VALGRIND $PYTHON $samba_tool domain passwordsettings set "${CONFIGURATION}" --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=default --max-pwd-age=default || failed=$(expr $failed + 1)
 244
 245 testit "delete user $TEST_USERNAME" \
 246         $VALGRIND $PYTHON $samba_tool user delete $TEST_USERNAME -U"$USERNAME%$PASSWORD" "${CONFIGURATION}" -k no || failed=$(expr $failed + 1)
 247
 248 rm -f $PREFIX/tmpuserpassfile $PREFIX/tmpsmbpasswdscript
 249 rm -f $KRB5CCNAME_PATH
 250
 251 exit $failed