testprogs/blackbox/test_passwords.sh

   1 #!/bin/sh
   2 # Blackbox tests for kinit and kerberos integration with smbclient etc
   3 # Copyright (C) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Copyright (C) 2006-2008 Andrew Bartlett <abartlet@samba.org>
   5
   6 if [ $# -lt 5 ]; then
   7 cat <<EOF
   8 Usage: test_passwords.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX
   9 EOF
  10 exit 1;
  11 fi
  12
  13 SERVER=$1
  14 USERNAME=$2
  15 PASSWORD=$3
  16 REALM=$4
  17 DOMAIN=$5
  18 PREFIX=$6
  19 shift 6
  20 failed=0
  21
  22 samba4bindir="$BUILDDIR/bin"
  23 smbclient="$samba4bindir/smbclient$EXEEXT"
  24 samba4kinit="$samba4bindir/samba4kinit$EXEEXT"
  25 net="$samba4bindir/net$EXEEXT"
  26 rkpty="$samba4bindir/rkpty$EXEEXT"
  27 samba4kpasswd="$samba4bindir/samba4kpasswd$EXEEXT"
  28 newuser="$net newuser"
  29
  30 . `dirname $0`/subunit.sh
  31
  32 test_smbclient() {
  33         name="$1"
  34         cmd="$2"
  35         shift
  36         shift
  37         echo "test: $name"
  38         $VALGRIND $smbclient //$SERVER/tmp -c "$cmd" -W "$DOMAIN" $@
  39         status=$?
  40         if [ x$status = x0 ]; then
  41                 echo "success: $name"
  42         else
  43                 echo "failure: $name"
  44         fi
  45         return $status
  46 }
  47
  48 CONFIG="--configfile=$PREFIX/dc/etc/smb.conf"
  49 export CONFIG
  50
  51 USERPASS=testPaSS@01%
  52
  53 testit "create user locally" $VALGRIND $newuser $CONFIG nettestuser $USERPASS $@ || failed=`expr $failed + 1`
  54
  55 KRB5CCNAME="$PREFIX/tmpuserccache"
  56 export KRB5CCNAME
  57
  58 echo $USERPASS > $PREFIX/tmpuserpassfile
  59
  60 testit "kinit with user password" $samba4kinit --password-file=$PREFIX/tmpuserpassfile --request-pac nettestuser@$REALM   || failed=`expr $failed + 1`
  61
  62 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
  63
  64 NEWUSERPASS=testPaSS@02%
  65 testit "change user password with 'net password change' (unforced)" $VALGRIND $net password change -W$DOMAIN -U$DOMAIN/nettestuser%$USERPASS  -k no $NEWUSERPASS $@ || failed=`expr $failed + 1`
  66
  67 echo $NEWUSERPASS > ./tmpuserpassfile
  68 testit "kinit with user password" $samba4kinit --password-file=./tmpuserpassfile --request-pac nettestuser@$REALM   || failed=`expr $failed + 1`
  69
  70 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
  71
  72
  73 USERPASS=$NEWUSERPASS
  74 NEWUSERPASS=testPaSS@03%
  75
  76 cat > ./tmpkpasswdscript <<EOF
  77 expect Password
  78 password ${USERPASS}\n
  79 expect New password
  80 send ${NEWUSERPASS}\n
  81 expect New password
  82 send ${NEWUSERPASS}\n
  83 expect Success
  84 EOF
  85
  86 testit "change user password with kpasswd" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
  87
  88 test_smbclient "Test login with user kerberos (unforced)" 'ls' -k yes -Unettestuser@$REALM%$NEWUSERPASS || failed=`expr $failed + 1`
  89
  90
  91 NEWUSERPASS=testPaSS@04%
  92 testit "set password on user locally" $VALGRIND $net setpassword $CONFIG nettestuser --newpassword=$NEWUSERPASS --must-change-at-next-login $@ || failed=`expr $failed + 1`
  93 USERPASS=$NEWUSERPASS
  94
  95 NEWUSERPASS=testPaSS@05%
  96 testit "change user password with 'net password change' (after must change flag set)" $VALGRIND $net password change -W$DOMAIN -U$DOMAIN/nettestuser%$USERPASS -k no $NEWUSERPASS $@ || failed=`expr $failed + 1`
  97 USERPASS=$NEWUSERPASS
  98
  99 NEWUSERPASS=testPaSS@06%
 100 testit "set password on user locally" $VALGRIND $net setpassword $CONFIG nettestuser --newpassword=$NEWUSERPASS --must-change-at-next-login $@ || failed=`expr $failed + 1`
 101 USERPASS=$NEWUSERPASS
 102
 103 NEWUSERPASS=testPaSS@07%
 104
 105 cat > ./tmpkpasswdscript <<EOF
 106 expect Password
 107 password ${USERPASS}\n
 108 expect New password
 109 send ${NEWUSERPASS}\n
 110 expect New password
 111 send ${NEWUSERPASS}\n
 112 expect Success
 113 EOF
 114
 115 testit "change user password with kpasswd (after must change flag set)" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 116 USERPASS=$NEWUSERPASS
 117
 118 test_smbclient "Test login with user kerberos" 'ls' -k yes -Unettestuser@$REALM%$NEWUSERPASS || failed=`expr $failed + 1`
 119
 120 testit "reset password policies" $VALGRIND $net pwsettings set $CONFIG --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=default --max-pwd-age=default || failed=`expr $failed + 1`
 121
 122 NEWUSERPASS=abcdefg
 123 testit_expect_failure "try to set a non-complex password (command should not succeed)" $VALGRIND $net password change -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no "$NEWUSERPASS" $@ && failed=`expr $failed + 1`
 124
 125 testit "allow non-complex passwords" $VALGRIND $net pwsettings set $CONFIG --complexity=off || failed=`expr $failed + 1`
 126
 127 testit "try to set a non-complex password (command should succeed)" $VALGRIND $net password change -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no "$NEWUSERPASS" $@ || failed=`expr $failed + 1`
 128 USERPASS=$NEWUSERPASS
 129
 130 test_smbclient "test login with non-complex password" 'ls' -k no -Unettestuser@$REALM%$USERPASS || failed=`expr $failed + 1`
 131
 132 NEWUSERPASS=abc
 133 testit_expect_failure "try to set a short password (command should not succeed)" $VALGRIND $net password change -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no "$NEWUSERPASS" $@ && failed=`expr $failed + 1`
 134
 135 testit "allow short passwords (length 1)" $VALGRIND $net pwsettings $CONFIG set --min-pwd-length=1 || failed=`expr $failed + 1`
 136
 137 testit "try to set a short password (command should succeed)" $VALGRIND $net password change -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no "$NEWUSERPASS" $@ || failed=`expr $failed + 1`
 138 USERPASS="$NEWUSERPASS"
 139
 140 testit "require minimum password age of 1 day" $VALGRIND $net pwsettings $CONFIG set --min-pwd-age=1 || failed=`expr $failed + 1`
 141
 142 testit "show password settings" $VALGRIND $net pwsettings $CONFIG show || failed=`expr $failed + 1`
 143
 144 NEWUSERPASS="testPaSS@08%"
 145 testit_expect_failure "try to change password too quickly (command should not succeed)" $VALGRIND $net password change -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no "$NEWUSERPASS" $@ && failed=`expr $failed + 1`
 146
 147 testit "reset password policies" $VALGRIND $net pwsettings $CONFIG set --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=default --max-pwd-age=default || failed=`expr $failed + 1`
 148
 149 testit "del user" $VALGRIND $net user delete nettestuser -U"$USERNAME%$PASSWORD" -k no $@ || failed=`expr $failed + 1`
 150
 151 rm -f tmpccfile tmppassfile tmpuserpassfile tmpuserccache tmpkpasswdscript
 152 exit $failed