1 # Tests basic behaviour when NTLM is disabled
3 # Copyright (C) Catalyst IT Ltd. 2017
5 # This program is free software; you can redistribute it and/or modify
6 # it under the terms of the GNU General Public License as published by
7 # the Free Software Foundation; either version 3 of the License, or
8 # (at your option) any later version.
10 # This program is distributed in the hope that it will be useful,
11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 # GNU General Public License for more details.
15 # You should have received a copy of the GNU General Public License
16 # along with this program. If not, see <http://www.gnu.org/licenses/>.
18 from samba.tests import TestCase
22 from samba.credentials import Credentials, DONT_USE_KERBEROS, MUST_USE_KERBEROS
24 from samba import NTSTATUSError, ntstatus
27 from samba import credentials
28 from samba.dcerpc import srvsvc, samr, lsa
31 Tests behaviour when NTLM is disabled
35 class NtlmDisabledTests(TestCase):
38 super(NtlmDisabledTests, self).setUp()
40 self.lp = self.get_loadparm()
41 self.server = os.getenv("SERVER")
43 self.creds = Credentials()
44 self.creds.guess(self.lp)
45 self.creds.set_username(os.getenv("USERNAME"))
46 self.creds.set_domain(self.server)
47 self.creds.set_password(os.getenv("PASSWORD"))
48 self.creds.set_kerberos_state(DONT_USE_KERBEROS)
51 super(NtlmDisabledTests, self).tearDown()
53 def test_ntlm_connection(self):
55 conn = srvsvc.srvsvc("ncacn_np:%s[smb2,ntlm]" % self.server, self.lp, self.creds)
57 self.assertIsNotNone(conn)
58 except NTSTATUSError as e:
59 # NTLM might be blocked on this server
60 enum = ctypes.c_uint32(e.args[0]).value
61 if enum == ntstatus.NT_STATUS_NTLM_BLOCKED:
62 self.fail("NTLM is disabled on this server")
66 def test_samr_change_password(self):
67 self.creds.set_kerberos_state(MUST_USE_KERBEROS)
68 conn = samr.samr("ncacn_np:%s[krb5,seal,smb2]" % os.getenv("SERVER"))
70 # we want to check whether this gets rejected outright because NTLM is
71 # disabled, so we don't actually need to encrypt a valid password here
73 server.string = self.server
74 username = lsa.String()
75 username.string = os.getenv("USERNAME")
78 conn.ChangePasswordUser2(server, username, None, None, True, None, None)
79 except NTSTATUSError as e:
80 # changing passwords should be rejected when NTLM is disabled
81 enum = ctypes.c_uint32(e.args[0]).value
82 if enum == ntstatus.NT_STATUS_NTLM_BLOCKED:
83 self.fail("NTLM is disabled on this server")
84 elif enum == ntstatus.NT_STATUS_WRONG_PASSWORD:
85 # expected error case when NTLM is enabled