testprogs/blackbox/test_passwords.sh

   1 #!/bin/sh
   2 # Blackbox tests for kinit and kerberos integration with smbclient etc
   3 # Copyright (C) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Copyright (C) 2006-2008 Andrew Bartlett <abartlet@samba.org>
   5
   6 if [ $# -lt 5 ]; then
   7 cat <<EOF
   8 Usage: test_passwords.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX SMBCLIENT
   9 EOF
  10 exit 1;
  11 fi
  12
  13 SERVER=$1
  14 USERNAME=$2
  15 PASSWORD=$3
  16 REALM=$4
  17 DOMAIN=$5
  18 PREFIX=$6
  19 smbclient=$7
  20 shift 7
  21 failed=0
  22
  23 samba4bindir="$BINDIR"
  24 samba4kinit="$samba4bindir/samba4kinit"
  25 samba_tool="$samba4bindir/samba-tool"
  26 smbpasswd="$samba4bindir/smbpasswd"
  27 rkpty="$samba4bindir/rkpty"
  28 samba4kpasswd="$samba4bindir/samba4kpasswd"
  29 newuser="$samba_tool user create"
  30
  31 . `dirname $0`/subunit.sh
  32
  33 test_smbclient() {
  34         name="$1"
  35         cmd="$2"
  36         shift
  37         shift
  38         echo "test: $name"
  39         $VALGRIND $smbclient //$SERVER/tmp -c "$cmd" $@
  40         status=$?
  41         if [ x$status = x0 ]; then
  42                 echo "success: $name"
  43         else
  44                 echo "failure: $name"
  45         fi
  46         return $status
  47 }
  48
  49 UID_WRAPPER_ROOT=1
  50 export UID_WRAPPER_ROOT
  51
  52 CONFIG="--configfile=$PREFIX/dc/etc/smb.conf"
  53 export CONFIG
  54
  55 testit "reset password policies beside of minimum password age of 0 days" $VALGRIND $samba_tool domain passwordsettings $CONFIG set --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=0 --max-pwd-age=default || failed=`expr $failed + 1`
  56
  57 USERPASS=testPaSS@00%
  58
  59 testit "create user locally" $VALGRIND $newuser $CONFIG nettestuser $USERPASS $@ || failed=`expr $failed + 1`
  60
  61 KRB5CCNAME="$PREFIX/tmpuserccache"
  62 export KRB5CCNAME
  63
  64 echo $USERPASS > $PREFIX/tmpuserpassfile
  65
  66 testit "kinit with user password" $samba4kinit --password-file=$PREFIX/tmpuserpassfile --request-pac nettestuser@$REALM   || failed=`expr $failed + 1`
  67
  68 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
  69
  70 NEWUSERPASS=testPaSS@01%
  71 testit "change user password with 'samba-tool user password' (unforced)" $VALGRIND $samba_tool user password -W$DOMAIN -U$DOMAIN/nettestuser%$USERPASS  -k no --newpassword=$NEWUSERPASS $@ || failed=`expr $failed + 1`
  72
  73 echo $NEWUSERPASS > ./tmpuserpassfile
  74 testit "kinit with user password" $samba4kinit --password-file=./tmpuserpassfile --request-pac nettestuser@$REALM   || failed=`expr $failed + 1`
  75
  76 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
  77
  78 #
  79 # These tests demonstrate that a credential cache in the environment does not
  80 # override a username/password, even an incorrect one, on the command line
  81 #
  82
  83 testit_expect_failure  "Test login with user kerberos ccache, but wrong password specified" $VALGRIND $smbclient //$SERVER/tmp -c 'ls' -k yes -Unettestuser@$REALM%wrongpass && failed=`expr $failed + 1`
  84 testit_expect_failure  "Test login with user kerberos ccache, but old password specified" $VALGRIND $smbclient //$SERVER/tmp -c 'ls' -k yes -Unettestuser@$REALM%$USERPASS && failed=`expr $failed + 1`
  85
  86
  87 USERPASS=$NEWUSERPASS
  88 WEAKPASS=testpass1
  89 NEWUSERPASS=testPaSS@02%
  90
  91 # password mismatch check doesn't work yet (kpasswd bug, reported to Love)
  92 #echo "check that password mismatch gives the right error"
  93 #cat > ./tmpkpasswdscript <<EOF
  94 #expect Password
  95 #password ${USERPASS}\n
  96 #expect New password
  97 #send ${WEAKPASS}\n
  98 #expect New password
  99 #send ${NEWUSERPASS}\n
 100 #expect password mismatch
 101 #EOF
 102 #
 103 #testit "change user password with kpasswd" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 104
 105
 106 echo "check that a weak password is rejected"
 107 cat > ./tmpkpasswdscript <<EOF
 108 expect Password
 109 password ${USERPASS}\n
 110 expect New password
 111 send ${WEAKPASS}\n
 112 expect New password
 113 send ${WEAKPASS}\n
 114 expect Password does not meet complexity requirements
 115 EOF
 116
 117 testit "change to weak user password with kpasswd" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 118
 119 echo "check that a short password is rejected"
 120 cat > ./tmpkpasswdscript <<EOF
 121 expect Password
 122 password ${USERPASS}\n
 123 expect New password
 124 send xx1\n
 125 expect New password
 126 send xx1\n
 127 expect Password too short
 128 EOF
 129
 130 testit "change to short user password with kpasswd" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 131
 132
 133 echo "check that a strong new password is accepted"
 134 cat > ./tmpkpasswdscript <<EOF
 135 expect Password
 136 password ${USERPASS}\n
 137 expect New password
 138 send ${NEWUSERPASS}\n
 139 expect New password
 140 send ${NEWUSERPASS}\n
 141 expect Success
 142 EOF
 143
 144 testit "change user password with kpasswd" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 145
 146 test_smbclient "Test login with user kerberos (unforced)" 'ls' -k yes -Unettestuser@$REALM%$NEWUSERPASS || failed=`expr $failed + 1`
 147
 148 NEWUSERPASS=testPaSS@03%
 149
 150 echo "set password with smbpasswd"
 151 cat > ./tmpsmbpasswdscript <<EOF
 152 expect New SMB password:
 153 send ${NEWUSERPASS}\n
 154 expect Retype new SMB password:
 155 send ${NEWUSERPASS}\n
 156 EOF
 157
 158 testit "set user password with smbpasswd" $rkpty ./tmpsmbpasswdscript $smbpasswd -L -c $PREFIX/dc/etc/smb.conf nettestuser || failed=`expr $failed + 1`
 159 USERPASS=$NEWUSERPASS
 160
 161 test_smbclient "Test login with user (ntlm)" 'ls' -k no -Unettestuser@$REALM%$NEWUSERPASS || failed=`expr $failed + 1`
 162
 163
 164 NEWUSERPASS=testPaSS@04%
 165 testit "set password on user locally" $VALGRIND $samba_tool user setpassword nettestuser $CONFIG --newpassword=$NEWUSERPASS --must-change-at-next-login $@ || failed=`expr $failed + 1`
 166 USERPASS=$NEWUSERPASS
 167
 168 NEWUSERPASS=testPaSS@05%
 169 testit "change user password with 'samba-tool user password' (after must change flag set)" $VALGRIND $samba_tool user password -W$DOMAIN -U$DOMAIN/nettestuser%$USERPASS -k no --newpassword=$NEWUSERPASS $@ || failed=`expr $failed + 1`
 170 USERPASS=$NEWUSERPASS
 171
 172 NEWUSERPASS=testPaSS@06%
 173 testit "set password on user locally" $VALGRIND $samba_tool user setpassword $CONFIG nettestuser --newpassword=$NEWUSERPASS --must-change-at-next-login $@ || failed=`expr $failed + 1`
 174 USERPASS=$NEWUSERPASS
 175
 176 NEWUSERPASS=testPaSS@07%
 177
 178 cat > ./tmpkpasswdscript <<EOF
 179 expect Password
 180 password ${USERPASS}\n
 181 expect New password
 182 send ${NEWUSERPASS}\n
 183 expect New password
 184 send ${NEWUSERPASS}\n
 185 expect Success
 186 EOF
 187
 188 testit "change user password with kpasswd (after must change flag set)" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 189 USERPASS=$NEWUSERPASS
 190
 191 test_smbclient "Test login with user kerberos" 'ls' -k yes -Unettestuser@$REALM%$NEWUSERPASS || failed=`expr $failed + 1`
 192
 193 NEWUSERPASS=testPaSS@08%
 194 testit "set password on user locally" $VALGRIND $samba_tool user setpassword $CONFIG nettestuser --newpassword=$NEWUSERPASS --must-change-at-next-login $@ || failed=`expr $failed + 1`
 195 USERPASS=$NEWUSERPASS
 196
 197 NEWUSERPASS=testPaSS@09%
 198
 199 cat > ./tmpsmbpasswdscript <<EOF
 200 expect Old SMB password:
 201 password ${USERPASS}\n
 202 expect New SMB password:
 203 send ${NEWUSERPASS}\n
 204 expect Retype new SMB password:
 205 send ${NEWUSERPASS}\n
 206 EOF
 207
 208 testit "change user password with smbpasswd (after must change flag set)" $rkpty ./tmpsmbpasswdscript $smbpasswd -r $SERVER  -c $PREFIX/dc/etc/smb.conf -U nettestuser || failed=`expr $failed + 1`
 209
 210 USERPASS=$NEWUSERPASS
 211
 212 test_smbclient "Test login with user kerberos" 'ls' -k yes -Unettestuser@$REALM%$NEWUSERPASS || failed=`expr $failed + 1`
 213
 214 NEWUSERPASS=abcdefg
 215 testit_expect_failure "try to set a non-complex password (command should not succeed)" $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no --newpassword="$NEWUSERPASS" $@ && failed=`expr $failed + 1`
 216
 217 testit "allow non-complex passwords" $VALGRIND $samba_tool domain passwordsettings set $CONFIG --complexity=off || failed=`expr $failed + 1`
 218
 219 testit "try to set a non-complex password (command should succeed)" $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no --newpassword="$NEWUSERPASS" $@ || failed=`expr $failed + 1`
 220 USERPASS=$NEWUSERPASS
 221
 222 test_smbclient "test login with non-complex password" 'ls' -k no -Unettestuser@$REALM%$USERPASS || failed=`expr $failed + 1`
 223
 224 NEWUSERPASS=abc
 225 testit_expect_failure "try to set a short password (command should not succeed)" $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no --newpassword="$NEWUSERPASS" $@ && failed=`expr $failed + 1`
 226
 227 testit "allow short passwords (length 1)" $VALGRIND $samba_tool domain passwordsettings $CONFIG set --min-pwd-length=1 || failed=`expr $failed + 1`
 228
 229 testit "try to set a short password (command should succeed)" $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no --newpassword="$NEWUSERPASS" $@ || failed=`expr $failed + 1`
 230 USERPASS="$NEWUSERPASS"
 231
 232 testit "require minimum password age of 1 day" $VALGRIND $samba_tool domain passwordsettings $CONFIG set --min-pwd-age=1 || failed=`expr $failed + 1`
 233
 234 testit "show password settings" $VALGRIND $samba_tool domain passwordsettings $CONFIG show || failed=`expr $failed + 1`
 235
 236 NEWUSERPASS="testPaSS@08%"
 237 testit_expect_failure "try to change password too quickly (command should not succeed)" $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/nettestuser%$USERPASS" -k no --newpassword="$NEWUSERPASS" $@ && failed=`expr $failed + 1`
 238
 239 testit "reset password policies" $VALGRIND $samba_tool domain passwordsettings $CONFIG set --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=default --max-pwd-age=default || failed=`expr $failed + 1`
 240
 241 testit "del user" $VALGRIND $samba_tool user delete nettestuser -U"$USERNAME%$PASSWORD" $CONFIG -k no $@ || failed=`expr $failed + 1`
 242
 243 rm -f tmpccfile tmppassfile tmpuserpassfile tmpuserccache tmpkpasswdscript tmpsmbpasswdscript
 244 exit $failed