testprogs/blackbox/test_password_settings.sh

   1 #!/bin/sh
   2 # Blackbox tests for different password settings
   3 #
   4 # Copyright (c) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
   5 # Copyright (c) 2006-2008 Andrew Bartlett <abartlet@samba.org>
   6 # Copyright (c) 2016      Andreas Schneider <asn@samba.org>
   7
   8 if [ $# -lt 6 ]; then
   9 cat <<EOF
  10 Usage: test_passwords_settings.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX
  11 EOF
  12 exit 1;
  13 fi
  14
  15 SERVER=$1
  16 USERNAME=$2
  17 PASSWORD=$3
  18 REALM=$4
  19 DOMAIN=$5
  20 PREFIX=$6
  21 shift 6
  22 failed=0
  23
  24 samba_bindir="$BINDIR"
  25
  26 samba_kinit=kinit
  27 if test -x $samba_bindir/samba4kinit; then
  28         samba_kinit=$samba_bindir/samba4kinit
  29 fi
  30
  31 smbclient="$samba_bindir/smbclient"
  32 samba_tool="$samba_bindir/samba-tool"
  33 smbpasswd="$samba_bindir/smbpasswd"
  34 texpect="$samba_bindir/texpect"
  35
  36 newuser="$samba_tool user create"
  37 SMB_UNC="//$SERVER/tmp"
  38
  39 . `dirname $0`/subunit.sh
  40 . `dirname $0`/common_test_fns.inc
  41
  42 do_kinit() {
  43         principal="$1"
  44         password="$2"
  45         shift
  46         shift
  47         if test -x $samba_bindir/samba4kinit; then
  48                 echo $password > $PREFIX/tmpuserpassfile
  49                 $samba_kinit --password-file=$PREFIX/tmpuserpassfile $principal $@
  50         else
  51                 echo $password | $samba_kinit $principal $@
  52         fi
  53 }
  54
  55 test_smbpasswd()
  56 {
  57         user=$1
  58         newpass=$2
  59
  60         tmpfile=$PREFIX/smbpasswd_change_password_script
  61         cat > $tmpfile <<EOF
  62 expect New SMB password:
  63 send ${newpass}\n
  64 expect Retype new SMB password:
  65 send ${newpass}\n
  66 EOF
  67
  68         cmd='UID_WRAPPER_INITIAL_RUID=0 UID_WRAPPER_INITIAL_EUID=0 $texpect $tmpfile $smbpasswd -L -c $PREFIX/etc/smb.conf $user'
  69         eval echo "$cmd"
  70         out=$(eval $cmd)
  71         ret=$?
  72         rm -f $tmpfile
  73
  74         if [ $ret -ne 0 ]; then
  75                 echo "Failed to change user password $user"
  76                 return 1
  77         fi
  78 }
  79
  80 UID_WRAPPER_ROOT=1
  81 export UID_WRAPPER_ROOT
  82
  83 CONFIG="--configfile=$PREFIX/etc/smb.conf"
  84 export CONFIG
  85
  86 testit "reset password policies beside of minimum password age of 0 days" \
  87         $VALGRIND $PYTHON $samba_tool domain passwordsettings set $CONFIG --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=0 --max-pwd-age=default || failed=`expr $failed + 1`
  88
  89 TEST_USERNAME="$(mktemp -u alice-XXXXXX)"
  90 TEST_PASSWORD="testPaSS@00%"
  91 TEST_PASSWORD_NEW="testPaSS@01%"
  92 TEST_PASSWORD_NON_ASCII="Täst123"
  93 TEST_PASSWORD_SHORT="secret"
  94 TEST_PASSWORD_WEAK="Supersecret"
  95 TEST_PRINCIPAL="$TEST_USERNAME@$REALM"
  96
  97 testit "create user locally" \
  98         $VALGRIND $PYTHON $newuser $CONFIG $TEST_USERNAME $TEST_PASSWORD || failed=`expr $failed + 1`
  99
 100 ###########################################################
 101 ### Test normal operation as user
 102 ###########################################################
 103
 104 KRB5CCNAME_PATH="$PREFIX/test_password_settings_krb5ccache"
 105 rm -f $KRB5CCNAME_PATH
 106
 107 KRB5CCNAME="FILE:$KRB5CCNAME_PATH"
 108 export KRB5CCNAME
 109
 110 testit "kinit with user password" \
 111         do_kinit $TEST_PRINCIPAL $TEST_PASSWORD || failed=`expr $failed + 1`
 112
 113 test_smbclient "Test login with user kerberos ccache" \
 114         "ls" "$SMB_UNC" -k yes || failed=`expr $failed + 1`
 115
 116 rm -f $KRB5CCNAME_PATH
 117
 118 ###########################################################
 119 ### Change the users password
 120 ###########################################################
 121
 122 testit "change user password with 'samba-tool user password' (unforced)" \
 123         $VALGRIND $PYTHON $samba_tool user password -W$DOMAIN -U$TEST_USERNAME%$TEST_PASSWORD -k no --newpassword=$TEST_PASSWORD_NEW || failed=`expr $failed + 1`
 124
 125 TEST_PASSWORD_OLD=$TEST_PASSWORD
 126 TEST_PASSWORD=$TEST_PASSWORD_NEW
 127 TEST_PASSWORD_NEW="testPaSS@02%"
 128
 129 testit "kinit with user password" \
 130         do_kinit $TEST_PRINCIPAL $TEST_PASSWORD || failed=`expr $failed + 1`
 131
 132 test_smbclient "Test login with user kerberos ccache" \
 133         "ls" "$SMB_UNC" -k yes || failed=`expr $failed + 1`
 134
 135 ###########################################################
 136 ### Change the users password
 137 ###########################################################
 138
 139 testit "change user (non-ascii) password with 'samba-tool user password' (unforced)" \
 140         $VALGRIND $PYTHON $samba_tool user password -W$DOMAIN -U$TEST_USERNAME%$TEST_PASSWORD -k no --newpassword=$TEST_PASSWORD_NON_ASCII || failed=`expr $failed + 1`
 141
 142 TEST_PASSWORD_OLD=$TEST_PASSWORD_NEW
 143 TEST_PASSWORD=$TEST_PASSWORD_NON_ASCII
 144
 145 testit "kinit with user password" \
 146         do_kinit $TEST_PRINCIPAL $TEST_PASSWORD || failed=`expr $failed + 1`
 147
 148 test_smbclient "Test login with user kerberos ccache" \
 149         "ls" "$SMB_UNC" -k yes || failed=`expr $failed + 1`
 150
 151 #
 152 # These tests demonstrate that a credential cache in the environment does not
 153 # override a username/password, even an incorrect one, on the command line
 154 #
 155
 156 testit_expect_failure "Test login with user kerberos ccache, but wrong password specified" \
 157         $VALGRIND $smbclient //$SERVER/tmp -c 'ls' -k yes -U$TEST_PRINCIPAL%invalidpass && failed=`expr $failed + 1`
 158 testit_expect_failure "Test login with user kerberos ccache, but old password specified" \
 159         $VALGRIND $smbclient //$SERVER/tmp -c 'ls' -k yes -U$TEST_PRINCIPAL%$TEST_PASSWORD_OLD && failed=`expr $failed + 1`
 160
 161 rm -f $KRB5CCNAME_PATH
 162
 163 ###########################################################
 164 ### Set the password with smbpasswd
 165 ###########################################################
 166
 167 testit "set user password with smbpasswd" \
 168         test_smbpasswd $TEST_USERNAME $TEST_PASSWORD_NEW \
 169         || failed=$(expr $failed + 1)
 170
 171 TEST_PASSWORD=$TEST_PASSWORD_NEW
 172 TEST_PASSWORD_NEW="testPaSS@03%"
 173
 174 test_smbclient "Test login with user (ntlm)" \
 175         "ls" "$SMB_UNC" -k no -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=`expr $failed + 1`
 176
 177 testit "set password on user locally" $VALGRIND $PYTHON $samba_tool user setpassword $TEST_USERNAME $CONFIG --newpassword=$TEST_PASSWORD_NEW --must-change-at-next-login || failed=`expr $failed + 1`
 178
 179 TEST_PASSWORD=$TEST_PASSWORD_NEW
 180 TEST_PASSWORD_NEW="testPaSS@04%"
 181
 182 test_smbclient_expect_failure "Test login with user (NT_STATUS_PASSWORD_MUST_CHANGE)" \
 183         "ls" "$SMB_UNC" -k no -U$TEST_PRINCIPAL%$TEST_PASSWORD && failed=`expr $failed + 1`
 184
 185 testit "change user password with 'samba-tool user password' (after must change flag set)" \
 186         $VALGRIND $PYTHON $samba_tool user password -W$DOMAIN -U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD -k no --newpassword=$TEST_PASSWORD_NEW || failed=`expr $failed + 1`
 187
 188 TEST_PASSWORD=$TEST_PASSWORD_NEW
 189 TEST_PASSWORD_NEW="testPaSS@05%"
 190
 191 test_smbclient "Test login with user kerberos" 'ls' "$SMB_UNC" -k yes -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=`expr $failed + 1`
 192
 193 rm -f $KRB5CCNAME_PATH
 194
 195 cat > $PREFIX/tmpsmbpasswdscript <<EOF
 196 expect Old SMB password:
 197 password ${TEST_PASSWORD}\n
 198 expect New SMB password:
 199 send ${TEST_PASSWORD_NEW}\n
 200 expect Retype new SMB password:
 201 send ${TEST_PASSWORD_NEW}\n
 202 EOF
 203
 204 testit "change user password with smbpasswd (after must change flag set)" \
 205         $texpect $PREFIX/tmpsmbpasswdscript $smbpasswd -r $SERVER  -c $PREFIX/etc/smb.conf -U $TEST_USERNAME || failed=`expr $failed + 1`
 206
 207 TEST_PASSWORD=$TEST_PASSWORD_NEW
 208 TEST_PASSWORD_NEW="testPaSS@06%"
 209
 210 test_smbclient "Test login with user kerberos" \
 211         "ls" "$SMB_UNC" -k yes -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=`expr $failed + 1`
 212
 213 rm -f $KRB5CCNAME_PATH
 214
 215 testit_expect_failure "try to set a non-complex password (command should not succeed)" \
 216         $VALGRIND $PYTHON $samba_tool user password -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_WEAK" && failed=`expr $failed + 1`
 217
 218 testit "allow non-complex passwords" \
 219         $VALGRIND $PYTHON $samba_tool domain passwordsettings set $CONFIG --complexity=off || failed=`expr $failed + 1`
 220
 221 testit "try to set a non-complex password (command should succeed)" \
 222         $VALGRIND $PYTHON $samba_tool user password -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_WEAK" || failed=`expr $failed + 1`
 223
 224 TEST_PASSWORD=$TEST_PASSWORD_WEAK
 225
 226 test_smbclient "test login with non-complex password" \
 227         "ls" "$SMB_UNC" -k no -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=`expr $failed + 1`
 228
 229 testit_expect_failure "try to set a short password (command should not succeed)" \
 230         $VALGRIND $PYTHON $samba_tool user password -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_SHORT" && failed=`expr $failed + 1`
 231
 232 testit "allow short passwords (length 1)" \
 233         $VALGRIND $PYTHON $samba_tool domain passwordsettings set $CONFIG --min-pwd-length=1 || failed=`expr $failed + 1`
 234
 235 testit "try to set a short password (command should succeed)" \
 236         $VALGRIND $PYTHON $samba_tool user password -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_SHORT" || failed=`expr $failed + 1`
 237
 238 TEST_PASSWORD=$TEST_PASSWORD_SHORT
 239 TEST_PASSWORD_NEW="testPaSS@07%"
 240
 241 testit "require minimum password age of 1 day" \
 242         $VALGRIND $PYTHON $samba_tool domain passwordsettings set $CONFIG --min-pwd-age=1 || failed=`expr $failed + 1`
 243
 244 testit "show password settings" \
 245         $VALGRIND $PYTHON $samba_tool domain passwordsettings show $CONFIG || failed=`expr $failed + 1`
 246
 247 testit_expect_failure "try to change password too quickly (command should not succeed)" \
 248         $VALGRIND $PYTHON $samba_tool user password -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_NEW"  && failed=`expr $failed + 1`
 249
 250 testit "reset password policies" \
 251         $VALGRIND $PYTHON $samba_tool domain passwordsettings set $CONFIG --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=default --max-pwd-age=default || failed=`expr $failed + 1`
 252
 253 testit "delete user $TEST_USERNAME" \
 254         $VALGRIND $PYTHON $samba_tool user delete $TEST_USERNAME -U"$USERNAME%$PASSWORD" $CONFIG -k no  || failed=`expr $failed + 1`
 255
 256 rm -f $PREFIX/tmpuserpassfile $PREFIX/tmpsmbpasswdscript
 257 rm -f $KRB5CCNAME_PATH
 258
 259 exit $failed