testprogs/blackbox/test_passwords.sh

   1 #!/bin/sh
   2 # Blackbox tests for kinit and kerberos integration with smbclient etc
   3 # Copyright (C) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Copyright (C) 2006-2008 Andrew Bartlett <abartlet@samba.org>
   5
   6 if [ $# -lt 5 ]; then
   7 cat <<EOF
   8 Usage: test_passwords.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX
   9 EOF
  10 exit 1;
  11 fi
  12
  13 SERVER=$1
  14 USERNAME=$2
  15 PASSWORD=$3
  16 REALM=$4
  17 DOMAIN=$5
  18 PREFIX=$6
  19 shift 6
  20 failed=0
  21
  22 samba4bindir="$BINDIR"
  23 smbclient="$samba4bindir/smbclient$EXEEXT"
  24 samba4kinit="$samba4bindir/samba4kinit$EXEEXT"
  25 samba_tool="$samba4bindir/samba-tool$EXEEXT"
  26 rkpty="$samba4bindir/rkpty$EXEEXT"
  27 samba4kpasswd="$samba4bindir/samba4kpasswd$EXEEXT"
  28 newuser="$samba_tool newuser"
  29
  30 . `dirname $0`/subunit.sh
  31
  32 test_smbclient() {
  33         name="$1"
  34         cmd="$2"
  35         shift
  36         shift
  37         echo "test: $name"
  38         $VALGRIND $smbclient //$SERVER/tmp -c "$cmd" -W "$DOMAIN" $@
  39         status=$?
  40         if [ x$status = x0 ]; then
  41                 echo "success: $name"
  42         else
  43                 echo "failure: $name"
  44         fi
  45         return $status
  46 }
  47
  48 CONFIG="--configfile=$PREFIX/dc/etc/smb.conf"
  49 export CONFIG
  50
  51 testit "reset password policies beside of minimum password age of 0 days" $VALGRIND $samba_tool domain passwordsettings $CONFIG set --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=0 --max-pwd-age=default || failed=`expr $failed + 1`
  52
  53 USERPASS=testPaSS@01%
  54
  55 testit "create user locally" $VALGRIND $newuser $CONFIG nettestuser $USERPASS $@ || failed=`expr $failed + 1`
  56
  57 KRB5CCNAME="$PREFIX/tmpuserccache"
  58 export KRB5CCNAME
  59
  60 echo $USERPASS > $PREFIX/tmpuserpassfile
  61
  62 testit "kinit with user password" $samba4kinit --password-file=$PREFIX/tmpuserpassfile --request-pac nettestuser@$REALM   || failed=`expr $failed + 1`
  63
  64 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
  65
  66 NEWUSERPASS=testPaSS@02%
  67 testit "change user password with 'samba-tool password change' (unforced)" $VALGRIND $samba_tool password change -W$DOMAIN -U$DOMAIN/nettestuser%$USERPASS  -k no $NEWUSERPASS $@ || failed=`expr $failed + 1`
  68
  69 echo $NEWUSERPASS > ./tmpuserpassfile
  70 testit "kinit with user password" $samba4kinit --password-file=./tmpuserpassfile --request-pac nettestuser@$REALM   || failed=`expr $failed + 1`
  71
  72 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
  73
  74
  75 USERPASS=$NEWUSERPASS
  76 WEAKPASS=testpass1
  77 NEWUSERPASS=testPaSS@03%
  78
  79 # password mismatch check doesn't work yet (kpasswd bug, reported to Love)
  80 #echo "check that password mismatch gives the right error"
  81 #cat > ./tmpkpasswdscript <<EOF
  82 #expect Password
  83 #password ${USERPASS}\n
  84 #expect New password
  85 #send ${WEAKPASS}\n
  86 #expect New password
  87 #send ${NEWUSERPASS}\n
  88 #expect password mismatch
  89 #EOF
  90 #
  91 #testit "change user password with kpasswd" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
  92
  93
  94 echo "check that a weak password is rejected"
  95 cat > ./tmpkpasswdscript <<EOF
  96 expect Password
  97 password ${USERPASS}\n
  98 expect New password
  99 send ${WEAKPASS}\n
 100 expect New password
 101 send ${WEAKPASS}\n
 102 expect Password does not meet complexity requirements
 103 EOF
 104
 105 testit "change to weak user password with kpasswd" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 106
 107 echo "check that a short password is rejected"
 108 cat > ./tmpkpasswdscript <<EOF
 109 expect Password
 110 password ${USERPASS}\n
 111 expect New password
 112 send xx1\n
 113 expect New password
 114 send xx1\n
 115 expect Password too short
 116 EOF
 117
 118 testit "change to short user password with kpasswd" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 119
 120
 121 echo "check that a strong new password is accepted"
 122 cat > ./tmpkpasswdscript <<EOF
 123 expect Password
 124 password ${USERPASS}\n
 125 expect New password
 126 send ${NEWUSERPASS}\n
 127 expect New password
 128 send ${NEWUSERPASS}\n
 129 expect Success
 130 EOF
 131
 132 testit "change user password with kpasswd" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 133
 134 test_smbclient "Test login with user kerberos (unforced)" 'ls' -k yes -Unettestuser@$REALM%$NEWUSERPASS || failed=`expr $failed + 1`
 135
 136
 137 NEWUSERPASS=testPaSS@04%
 138 testit "set password on user locally" $VALGRIND $samba_tool user setpassword $CONFIG nettestuser --newpassword=$NEWUSERPASS --must-change-at-next-login $@ || failed=`expr $failed + 1`
 139 USERPASS=$NEWUSERPASS
 140
 141 NEWUSERPASS=testPaSS@05%
 142 testit "change user password with 'samba-tool password change' (after must change flag set)" $VALGRIND $samba_tool password change -W$DOMAIN -U$DOMAIN/nettestuser%$USERPASS -k no $NEWUSERPASS $@ || failed=`expr $failed + 1`
 143 USERPASS=$NEWUSERPASS
 144
 145 NEWUSERPASS=testPaSS@06%
 146 testit "set password on user locally" $VALGRIND $samba_tool user setpassword $CONFIG nettestuser --newpassword=$NEWUSERPASS --must-change-at-next-login $@ || failed=`expr $failed + 1`
 147 USERPASS=$NEWUSERPASS
 148
 149 NEWUSERPASS=testPaSS@07%
 150
 151 cat > ./tmpkpasswdscript <<EOF
 152 expect Password
 153 password ${USERPASS}\n
 154 expect New password
 155 send ${NEWUSERPASS}\n
 156 expect New password
 157 send ${NEWUSERPASS}\n
 158 expect Success
 159 EOF
 160
 161 testit "change user password with kpasswd (after must change flag set)" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 162 USERPASS=$NEWUSERPASS
 163
 164 test_smbclient "Test login with user kerberos" 'ls' -k yes -Unettestuser@$REALM%$NEWUSERPASS || failed=`expr $failed + 1`
 165
 166 NEWUSERPASS=abcdefg
 167 testit_expect_failure "try to set a non-complex password (command should not succeed)" $VALGRIND $samba_tool password change -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no "$NEWUSERPASS" $@ && failed=`expr $failed + 1`
 168
 169 testit "allow non-complex passwords" $VALGRIND $samba_tool domain passwordsettings set $CONFIG --complexity=off || failed=`expr $failed + 1`
 170
 171 testit "try to set a non-complex password (command should succeed)" $VALGRIND $samba_tool password change -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no "$NEWUSERPASS" $@ || failed=`expr $failed + 1`
 172 USERPASS=$NEWUSERPASS
 173
 174 test_smbclient "test login with non-complex password" 'ls' -k no -Unettestuser@$REALM%$USERPASS || failed=`expr $failed + 1`
 175
 176 NEWUSERPASS=abc
 177 testit_expect_failure "try to set a short password (command should not succeed)" $VALGRIND $samba_tool password change -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no "$NEWUSERPASS" $@ && failed=`expr $failed + 1`
 178
 179 testit "allow short passwords (length 1)" $VALGRIND $samba_tool domain passwordsettings $CONFIG set --min-pwd-length=1 || failed=`expr $failed + 1`
 180
 181 testit "try to set a short password (command should succeed)" $VALGRIND $samba_tool password change -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no "$NEWUSERPASS" $@ || failed=`expr $failed + 1`
 182 USERPASS="$NEWUSERPASS"
 183
 184 testit "require minimum password age of 1 day" $VALGRIND $samba_tool domain passwordsettings $CONFIG set --min-pwd-age=1 || failed=`expr $failed + 1`
 185
 186 testit "show password settings" $VALGRIND $samba_tool domain passwordsettings $CONFIG show || failed=`expr $failed + 1`
 187
 188 NEWUSERPASS="testPaSS@08%"
 189 testit_expect_failure "try to change password too quickly (command should not succeed)" $VALGRIND $samba_tool password change -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no "$NEWUSERPASS" $@ && failed=`expr $failed + 1`
 190
 191 testit "reset password policies" $VALGRIND $samba_tool domain passwordsettings $CONFIG set --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=default --max-pwd-age=default || failed=`expr $failed + 1`
 192
 193 testit "del user" $VALGRIND $samba_tool user delete nettestuser -U"$USERNAME%$PASSWORD" -k no $@ || failed=`expr $failed + 1`
 194
 195 rm -f tmpccfile tmppassfile tmpuserpassfile tmpuserccache tmpkpasswdscript
 196 exit $failed