testprogs/blackbox/test_passwords.sh

   1 #!/bin/sh
   2 # Blackbox tests for kinit and kerberos integration with smbclient etc
   3 # Copyright (C) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Copyright (C) 2006-2008 Andrew Bartlett <abartlet@samba.org>
   5
   6 if [ $# -lt 5 ]; then
   7 cat <<EOF
   8 Usage: test_passwords.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX SMBCLIENT
   9 EOF
  10 exit 1;
  11 fi
  12
  13 SERVER=$1
  14 USERNAME=$2
  15 PASSWORD=$3
  16 REALM=$4
  17 DOMAIN=$5
  18 PREFIX=$6
  19 smbclient=$7
  20 shift 7
  21 failed=0
  22
  23 samba4bindir="$BINDIR"
  24 samba4kinit="$samba4bindir/samba4kinit"
  25 samba_tool="$samba4bindir/samba-tool"
  26 smbpasswd="$samba4bindir/smbpasswd"
  27 rkpty="$samba4bindir/rkpty"
  28 samba4kpasswd="$samba4bindir/samba4kpasswd"
  29 newuser="$samba_tool user create"
  30
  31 . `dirname $0`/subunit.sh
  32
  33 test_smbclient() {
  34         name="$1"
  35         cmd="$2"
  36         shift
  37         shift
  38         echo "test: $name"
  39         $VALGRIND $smbclient //$SERVER/tmp -c "$cmd" $@
  40         status=$?
  41         if [ x$status = x0 ]; then
  42                 echo "success: $name"
  43         else
  44                 echo "failure: $name"
  45         fi
  46         return $status
  47 }
  48
  49 CONFIG="--configfile=$PREFIX/dc/etc/smb.conf"
  50 export CONFIG
  51
  52 testit "reset password policies beside of minimum password age of 0 days" $VALGRIND $samba_tool domain passwordsettings $CONFIG set --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=0 --max-pwd-age=default || failed=`expr $failed + 1`
  53
  54 USERPASS=testPaSS@00%
  55
  56 testit "create user locally" $VALGRIND $newuser $CONFIG nettestuser $USERPASS $@ || failed=`expr $failed + 1`
  57
  58 KRB5CCNAME="$PREFIX/tmpuserccache"
  59 export KRB5CCNAME
  60
  61 echo $USERPASS > $PREFIX/tmpuserpassfile
  62
  63 testit "kinit with user password" $samba4kinit --password-file=$PREFIX/tmpuserpassfile --request-pac nettestuser@$REALM   || failed=`expr $failed + 1`
  64
  65 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
  66
  67 NEWUSERPASS=testPaSS@01%
  68 testit "change user password with 'samba-tool user password' (unforced)" $VALGRIND $samba_tool user password -W$DOMAIN -U$DOMAIN/nettestuser%$USERPASS  -k no --newpassword=$NEWUSERPASS $@ || failed=`expr $failed + 1`
  69
  70 echo $NEWUSERPASS > ./tmpuserpassfile
  71 testit "kinit with user password" $samba4kinit --password-file=./tmpuserpassfile --request-pac nettestuser@$REALM   || failed=`expr $failed + 1`
  72
  73 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
  74
  75 #
  76 # These tests demonstrate that a credential cache in the environment does not
  77 # override a username/password, even an incorrect one, on the command line
  78 #
  79
  80 testit_expect_failure  "Test login with user kerberos ccache, but wrong password specified" $VALGRIND $smbclient //$SERVER/tmp -c 'ls' -k yes -Unettestuser@$REALM%wrongpass && failed=`expr $failed + 1`
  81 testit_expect_failure  "Test login with user kerberos ccache, but old password specified" $VALGRIND $smbclient //$SERVER/tmp -c 'ls' -k yes -Unettestuser@$REALM%$USERPASS && failed=`expr $failed + 1`
  82
  83
  84 USERPASS=$NEWUSERPASS
  85 WEAKPASS=testpass1
  86 NEWUSERPASS=testPaSS@02%
  87
  88 # password mismatch check doesn't work yet (kpasswd bug, reported to Love)
  89 #echo "check that password mismatch gives the right error"
  90 #cat > ./tmpkpasswdscript <<EOF
  91 #expect Password
  92 #password ${USERPASS}\n
  93 #expect New password
  94 #send ${WEAKPASS}\n
  95 #expect New password
  96 #send ${NEWUSERPASS}\n
  97 #expect password mismatch
  98 #EOF
  99 #
 100 #testit "change user password with kpasswd" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 101
 102
 103 echo "check that a weak password is rejected"
 104 cat > ./tmpkpasswdscript <<EOF
 105 expect Password
 106 password ${USERPASS}\n
 107 expect New password
 108 send ${WEAKPASS}\n
 109 expect New password
 110 send ${WEAKPASS}\n
 111 expect Password does not meet complexity requirements
 112 EOF
 113
 114 testit "change to weak user password with kpasswd" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 115
 116 echo "check that a short password is rejected"
 117 cat > ./tmpkpasswdscript <<EOF
 118 expect Password
 119 password ${USERPASS}\n
 120 expect New password
 121 send xx1\n
 122 expect New password
 123 send xx1\n
 124 expect Password too short
 125 EOF
 126
 127 testit "change to short user password with kpasswd" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 128
 129
 130 echo "check that a strong new password is accepted"
 131 cat > ./tmpkpasswdscript <<EOF
 132 expect Password
 133 password ${USERPASS}\n
 134 expect New password
 135 send ${NEWUSERPASS}\n
 136 expect New password
 137 send ${NEWUSERPASS}\n
 138 expect Success
 139 EOF
 140
 141 testit "change user password with kpasswd" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 142
 143 test_smbclient "Test login with user kerberos (unforced)" 'ls' -k yes -Unettestuser@$REALM%$NEWUSERPASS || failed=`expr $failed + 1`
 144
 145 NEWUSERPASS=testPaSS@03%
 146
 147 echo "set password with smbpasswd"
 148 cat > ./tmpsmbpasswdscript <<EOF
 149 expect New SMB password:
 150 send ${NEWUSERPASS}\n
 151 expect Retype new SMB password:
 152 send ${NEWUSERPASS}\n
 153 EOF
 154
 155 testit "set user password with smbpasswd" $rkpty ./tmpsmbpasswdscript $smbpasswd -L -c $PREFIX/dc/etc/smb.conf nettestuser || failed=`expr $failed + 1`
 156 USERPASS=$NEWUSERPASS
 157
 158 test_smbclient "Test login with user (ntlm)" 'ls' -k no -Unettestuser@$REALM%$NEWUSERPASS || failed=`expr $failed + 1`
 159
 160
 161 NEWUSERPASS=testPaSS@04%
 162 testit "set password on user locally" $VALGRIND $samba_tool user setpassword nettestuser $CONFIG --newpassword=$NEWUSERPASS --must-change-at-next-login $@ || failed=`expr $failed + 1`
 163 USERPASS=$NEWUSERPASS
 164
 165 NEWUSERPASS=testPaSS@05%
 166 testit "change user password with 'samba-tool user password' (after must change flag set)" $VALGRIND $samba_tool user password -W$DOMAIN -U$DOMAIN/nettestuser%$USERPASS -k no --newpassword=$NEWUSERPASS $@ || failed=`expr $failed + 1`
 167 USERPASS=$NEWUSERPASS
 168
 169 NEWUSERPASS=testPaSS@06%
 170 testit "set password on user locally" $VALGRIND $samba_tool user setpassword $CONFIG nettestuser --newpassword=$NEWUSERPASS --must-change-at-next-login $@ || failed=`expr $failed + 1`
 171 USERPASS=$NEWUSERPASS
 172
 173 NEWUSERPASS=testPaSS@07%
 174
 175 cat > ./tmpkpasswdscript <<EOF
 176 expect Password
 177 password ${USERPASS}\n
 178 expect New password
 179 send ${NEWUSERPASS}\n
 180 expect New password
 181 send ${NEWUSERPASS}\n
 182 expect Success
 183 EOF
 184
 185 testit "change user password with kpasswd (after must change flag set)" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 186 USERPASS=$NEWUSERPASS
 187
 188 test_smbclient "Test login with user kerberos" 'ls' -k yes -Unettestuser@$REALM%$NEWUSERPASS || failed=`expr $failed + 1`
 189
 190 NEWUSERPASS=testPaSS@08%
 191 testit "set password on user locally" $VALGRIND $samba_tool user setpassword $CONFIG nettestuser --newpassword=$NEWUSERPASS --must-change-at-next-login $@ || failed=`expr $failed + 1`
 192 USERPASS=$NEWUSERPASS
 193
 194 NEWUSERPASS=testPaSS@09%
 195
 196 cat > ./tmpsmbpasswdscript <<EOF
 197 expect Old SMB password:
 198 password ${USERPASS}\n
 199 expect New SMB password:
 200 send ${NEWUSERPASS}\n
 201 expect Retype new SMB password:
 202 send ${NEWUSERPASS}\n
 203 EOF
 204
 205 testit "change user password with smbpasswd (after must change flag set)" $rkpty ./tmpsmbpasswdscript $smbpasswd -r $SERVER  -c $PREFIX/dc/etc/smb.conf -U nettestuser || failed=`expr $failed + 1`
 206
 207 USERPASS=$NEWUSERPASS
 208
 209 test_smbclient "Test login with user kerberos" 'ls' -k yes -Unettestuser@$REALM%$NEWUSERPASS || failed=`expr $failed + 1`
 210
 211 NEWUSERPASS=abcdefg
 212 testit_expect_failure "try to set a non-complex password (command should not succeed)" $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no --newpassword="$NEWUSERPASS" $@ && failed=`expr $failed + 1`
 213
 214 testit "allow non-complex passwords" $VALGRIND $samba_tool domain passwordsettings set $CONFIG --complexity=off || failed=`expr $failed + 1`
 215
 216 testit "try to set a non-complex password (command should succeed)" $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no --newpassword="$NEWUSERPASS" $@ || failed=`expr $failed + 1`
 217 USERPASS=$NEWUSERPASS
 218
 219 test_smbclient "test login with non-complex password" 'ls' -k no -Unettestuser@$REALM%$USERPASS || failed=`expr $failed + 1`
 220
 221 NEWUSERPASS=abc
 222 testit_expect_failure "try to set a short password (command should not succeed)" $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no --newpassword="$NEWUSERPASS" $@ && failed=`expr $failed + 1`
 223
 224 testit "allow short passwords (length 1)" $VALGRIND $samba_tool domain passwordsettings $CONFIG set --min-pwd-length=1 || failed=`expr $failed + 1`
 225
 226 testit "try to set a short password (command should succeed)" $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no --newpassword="$NEWUSERPASS" $@ || failed=`expr $failed + 1`
 227 USERPASS="$NEWUSERPASS"
 228
 229 testit "require minimum password age of 1 day" $VALGRIND $samba_tool domain passwordsettings $CONFIG set --min-pwd-age=1 || failed=`expr $failed + 1`
 230
 231 testit "show password settings" $VALGRIND $samba_tool domain passwordsettings $CONFIG show || failed=`expr $failed + 1`
 232
 233 NEWUSERPASS="testPaSS@08%"
 234 testit_expect_failure "try to change password too quickly (command should not succeed)" $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no --newpassword="$NEWUSERPASS" $@ && failed=`expr $failed + 1`
 235
 236 testit "reset password policies" $VALGRIND $samba_tool domain passwordsettings $CONFIG set --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=default --max-pwd-age=default || failed=`expr $failed + 1`
 237
 238 testit "del user" $VALGRIND $samba_tool user delete nettestuser -U"$USERNAME%$PASSWORD" $CONFIG -k no $@ || failed=`expr $failed + 1`
 239
 240 rm -f tmpccfile tmppassfile tmpuserpassfile tmpuserccache tmpkpasswdscript tmpsmbpasswdscript
 241 exit $failed