testprogs/blackbox/test_passwords.sh

   1 #!/bin/sh
   2 # Blackbox tests for kinit and kerberos integration with smbclient etc
   3 # Copyright (C) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Copyright (C) 2006-2008 Andrew Bartlett <abartlet@samba.org>
   5
   6 if [ $# -lt 5 ]; then
   7 cat <<EOF
   8 Usage: test_passwords.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX SMBCLIENT
   9 EOF
  10 exit 1;
  11 fi
  12
  13 SERVER=$1
  14 USERNAME=$2
  15 PASSWORD=$3
  16 REALM=$4
  17 DOMAIN=$5
  18 PREFIX=$6
  19 smbclient=$7
  20 shift 7
  21 failed=0
  22
  23 samba4bindir="$BINDIR"
  24 samba4kinit=kinit
  25 if test -x $BINDIR/samba4kinit; then
  26         samba4kinit=$BINDIR/samba4kinit
  27 fi
  28
  29 samba_tool="$samba4bindir/samba-tool"
  30 smbpasswd="$samba4bindir/smbpasswd"
  31 texpect="$samba4bindir/texpect"
  32 samba4kpasswd=kpasswd
  33 if test -x $BINDIR/samba4kpasswd; then
  34         samba4kpasswd=$BINDIR/samba4kpasswd
  35 fi
  36
  37 newuser="$samba_tool user create"
  38
  39 . `dirname $0`/subunit.sh
  40
  41 test_smbclient() {
  42         name="$1"
  43         cmd="$2"
  44         shift
  45         shift
  46         echo "test: $name"
  47         $VALGRIND $smbclient //$SERVER/tmp -c "$cmd" $@
  48         status=$?
  49         if [ x$status = x0 ]; then
  50                 echo "success: $name"
  51         else
  52                 echo "failure: $name"
  53         fi
  54         return $status
  55 }
  56
  57 do_kinit() {
  58         file="$1"
  59         password="$2"
  60         shift
  61         shift
  62         if test -x $BINDIR/samba4kinit; then
  63                 $samba4kinit --password-file=$file --request-pac $@
  64         else
  65                 echo $password | $samba4kinit $@
  66         fi
  67 }
  68
  69 UID_WRAPPER_ROOT=1
  70 export UID_WRAPPER_ROOT
  71
  72 CONFIG="--configfile=$PREFIX/dc/etc/smb.conf"
  73 export CONFIG
  74
  75 testit "reset password policies beside of minimum password age of 0 days" $VALGRIND $samba_tool domain passwordsettings $CONFIG set --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=0 --max-pwd-age=default || failed=`expr $failed + 1`
  76
  77 USERPASS=testPaSS@00%
  78
  79 testit "create user locally" $VALGRIND $newuser $CONFIG nettestuser $USERPASS $@ || failed=`expr $failed + 1`
  80
  81 KRB5CCNAME="$PREFIX/tmpuserccache"
  82 export KRB5CCNAME
  83
  84 echo $USERPASS > $PREFIX/tmpuserpassfile
  85
  86 testit "kinit with user password" do_kinit $PREFIX/tmpuserpassfile $USERPASS nettestuser@$REALM   || failed=`expr $failed + 1`
  87
  88 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
  89
  90 NEWUSERPASS=testPaSS@01%
  91 testit "change user password with 'samba-tool user password' (unforced)" $VALGRIND $samba_tool user password -W$DOMAIN -U$DOMAIN/nettestuser%$USERPASS  -k no --newpassword=$NEWUSERPASS $@ || failed=`expr $failed + 1`
  92
  93 echo $NEWUSERPASS > ./tmpuserpassfile
  94 testit "kinit with user password" do_kinit ./tmpuserpassfile $NEWUSERPASS nettestuser@$REALM   || failed=`expr $failed + 1`
  95
  96 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
  97
  98 #
  99 # These tests demonstrate that a credential cache in the environment does not
 100 # override a username/password, even an incorrect one, on the command line
 101 #
 102
 103 testit_expect_failure  "Test login with user kerberos ccache, but wrong password specified" $VALGRIND $smbclient //$SERVER/tmp -c 'ls' -k yes -Unettestuser@$REALM%wrongpass && failed=`expr $failed + 1`
 104 testit_expect_failure  "Test login with user kerberos ccache, but old password specified" $VALGRIND $smbclient //$SERVER/tmp -c 'ls' -k yes -Unettestuser@$REALM%$USERPASS && failed=`expr $failed + 1`
 105
 106
 107 USERPASS=$NEWUSERPASS
 108 WEAKPASS=testpass1
 109 NEWUSERPASS=testPaSS@02%
 110
 111 # password mismatch check doesn't work yet (kpasswd bug, reported to Love)
 112 #echo "check that password mismatch gives the right error"
 113 #cat > ./tmpkpasswdscript <<EOF
 114 #expect Password
 115 #password ${USERPASS}\n
 116 #expect New password
 117 #send ${WEAKPASS}\n
 118 #expect New password
 119 #send ${NEWUSERPASS}\n
 120 #expect password mismatch
 121 #EOF
 122 #
 123 #testit "change user password with kpasswd" $texpect ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 124
 125
 126 echo "check that a weak password is rejected"
 127 cat > ./tmpkpasswdscript <<EOF
 128 expect Password
 129 password ${USERPASS}\n
 130 expect New password
 131 send ${WEAKPASS}\n
 132 expect New password
 133 send ${WEAKPASS}\n
 134 expect Password does not meet complexity requirements
 135 EOF
 136
 137 testit "change to weak user password with kpasswd" $texpect ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 138
 139 echo "check that a short password is rejected"
 140 cat > ./tmpkpasswdscript <<EOF
 141 expect Password
 142 password ${USERPASS}\n
 143 expect New password
 144 send xx1\n
 145 expect New password
 146 send xx1\n
 147 expect Password too short
 148 EOF
 149
 150 testit "change to short user password with kpasswd" $texpect ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 151
 152
 153 echo "check that a strong new password is accepted"
 154 cat > ./tmpkpasswdscript <<EOF
 155 expect Password
 156 password ${USERPASS}\n
 157 expect New password
 158 send ${NEWUSERPASS}\n
 159 expect New password
 160 send ${NEWUSERPASS}\n
 161 expect Success
 162 EOF
 163
 164 testit "change user password with kpasswd" $texpect ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 165
 166 test_smbclient "Test login with user kerberos (unforced)" 'ls' -k yes -Unettestuser@$REALM%$NEWUSERPASS || failed=`expr $failed + 1`
 167
 168 NEWUSERPASS=testPaSS@03%
 169
 170 echo "set password with smbpasswd"
 171 cat > ./tmpsmbpasswdscript <<EOF
 172 expect New SMB password:
 173 send ${NEWUSERPASS}\n
 174 expect Retype new SMB password:
 175 send ${NEWUSERPASS}\n
 176 EOF
 177
 178 testit "set user password with smbpasswd" $texpect ./tmpsmbpasswdscript $smbpasswd -L -c $PREFIX/dc/etc/smb.conf nettestuser || failed=`expr $failed + 1`
 179 USERPASS=$NEWUSERPASS
 180
 181 test_smbclient "Test login with user (ntlm)" 'ls' -k no -Unettestuser@$REALM%$NEWUSERPASS || failed=`expr $failed + 1`
 182
 183
 184 NEWUSERPASS=testPaSS@04%
 185 testit "set password on user locally" $VALGRIND $samba_tool user setpassword nettestuser $CONFIG --newpassword=$NEWUSERPASS --must-change-at-next-login $@ || failed=`expr $failed + 1`
 186 USERPASS=$NEWUSERPASS
 187
 188 NEWUSERPASS=testPaSS@05%
 189 testit "change user password with 'samba-tool user password' (after must change flag set)" $VALGRIND $samba_tool user password -W$DOMAIN -U$DOMAIN/nettestuser%$USERPASS -k no --newpassword=$NEWUSERPASS $@ || failed=`expr $failed + 1`
 190 USERPASS=$NEWUSERPASS
 191
 192 NEWUSERPASS=testPaSS@06%
 193 testit "set password on user locally" $VALGRIND $samba_tool user setpassword $CONFIG nettestuser --newpassword=$NEWUSERPASS --must-change-at-next-login $@ || failed=`expr $failed + 1`
 194 USERPASS=$NEWUSERPASS
 195
 196 NEWUSERPASS=testPaSS@07%
 197
 198 cat > ./tmpkpasswdscript <<EOF
 199 expect Password
 200 password ${USERPASS}\n
 201 expect New password
 202 send ${NEWUSERPASS}\n
 203 expect New password
 204 send ${NEWUSERPASS}\n
 205 expect Success
 206 EOF
 207
 208 testit "change user password with kpasswd (after must change flag set)" $texpect ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 209 USERPASS=$NEWUSERPASS
 210
 211 test_smbclient "Test login with user kerberos" 'ls' -k yes -Unettestuser@$REALM%$NEWUSERPASS || failed=`expr $failed + 1`
 212
 213 NEWUSERPASS=testPaSS@08%
 214 testit "set password on user locally" $VALGRIND $samba_tool user setpassword $CONFIG nettestuser --newpassword=$NEWUSERPASS --must-change-at-next-login $@ || failed=`expr $failed + 1`
 215 USERPASS=$NEWUSERPASS
 216
 217 NEWUSERPASS=testPaSS@09%
 218
 219 cat > ./tmpsmbpasswdscript <<EOF
 220 expect Old SMB password:
 221 password ${USERPASS}\n
 222 expect New SMB password:
 223 send ${NEWUSERPASS}\n
 224 expect Retype new SMB password:
 225 send ${NEWUSERPASS}\n
 226 EOF
 227
 228 testit "change user password with smbpasswd (after must change flag set)" $texpect ./tmpsmbpasswdscript $smbpasswd -r $SERVER  -c $PREFIX/dc/etc/smb.conf -U nettestuser || failed=`expr $failed + 1`
 229
 230 USERPASS=$NEWUSERPASS
 231
 232 test_smbclient "Test login with user kerberos" 'ls' -k yes -Unettestuser@$REALM%$NEWUSERPASS || failed=`expr $failed + 1`
 233
 234 NEWUSERPASS=abcdefg
 235 testit_expect_failure "try to set a non-complex password (command should not succeed)" $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no --newpassword="$NEWUSERPASS" $@ && failed=`expr $failed + 1`
 236
 237 testit "allow non-complex passwords" $VALGRIND $samba_tool domain passwordsettings set $CONFIG --complexity=off || failed=`expr $failed + 1`
 238
 239 testit "try to set a non-complex password (command should succeed)" $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no --newpassword="$NEWUSERPASS" $@ || failed=`expr $failed + 1`
 240 USERPASS=$NEWUSERPASS
 241
 242 test_smbclient "test login with non-complex password" 'ls' -k no -Unettestuser@$REALM%$USERPASS || failed=`expr $failed + 1`
 243
 244 NEWUSERPASS=abc
 245 testit_expect_failure "try to set a short password (command should not succeed)" $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no --newpassword="$NEWUSERPASS" $@ && failed=`expr $failed + 1`
 246
 247 testit "allow short passwords (length 1)" $VALGRIND $samba_tool domain passwordsettings $CONFIG set --min-pwd-length=1 || failed=`expr $failed + 1`
 248
 249 testit "try to set a short password (command should succeed)" $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no --newpassword="$NEWUSERPASS" $@ || failed=`expr $failed + 1`
 250 USERPASS="$NEWUSERPASS"
 251
 252 testit "require minimum password age of 1 day" $VALGRIND $samba_tool domain passwordsettings $CONFIG set --min-pwd-age=1 || failed=`expr $failed + 1`
 253
 254 testit "show password settings" $VALGRIND $samba_tool domain passwordsettings $CONFIG show || failed=`expr $failed + 1`
 255
 256 NEWUSERPASS="testPaSS@08%"
 257 testit_expect_failure "try to change password too quickly (command should not succeed)" $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no --newpassword="$NEWUSERPASS" $@ && failed=`expr $failed + 1`
 258
 259 testit "reset password policies" $VALGRIND $samba_tool domain passwordsettings $CONFIG set --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=default --max-pwd-age=default || failed=`expr $failed + 1`
 260
 261 testit "del user" $VALGRIND $samba_tool user delete nettestuser -U"$USERNAME%$PASSWORD" $CONFIG -k no $@ || failed=`expr $failed + 1`
 262
 263 rm -f tmpccfile tmppassfile tmpuserpassfile tmpuserccache tmpkpasswdscript tmpsmbpasswdscript
 264 exit $failed