2 # Blackbox tests for different password settings
4 # Copyright (c) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
5 # Copyright (c) 2006-2008 Andrew Bartlett <abartlet@samba.org>
6 # Copyright (c) 2016 Andreas Schneider <asn@samba.org>
10 Usage: test_passwords_settings.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX
24 samba_bindir="$BINDIR"
27 if test -x $samba_bindir/samba4kinit; then
28 samba_kinit=$samba_bindir/samba4kinit
31 smbclient="$samba_bindir/smbclient"
32 samba_tool="$samba_bindir/samba-tool"
33 smbpasswd="$samba_bindir/smbpasswd"
34 texpect="$samba_bindir/texpect"
36 newuser="$samba_tool user create"
37 SMB_UNC="//$SERVER/tmp"
39 . `dirname $0`/subunit.sh
40 . `dirname $0`/common_test_fns.inc
47 if test -x $samba_bindir/samba4kinit; then
48 echo $password > $PREFIX/tmpuserpassfile
49 $samba_kinit --password-file=$PREFIX/tmpuserpassfile $principal $@
51 echo $password | $samba_kinit $principal $@
56 export UID_WRAPPER_ROOT
58 CONFIG="--configfile=$PREFIX/etc/smb.conf"
61 testit "reset password policies beside of minimum password age of 0 days" \
62 $VALGRIND $PYTHON $samba_tool domain passwordsettings set $CONFIG --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=0 --max-pwd-age=default || failed=`expr $failed + 1`
64 TEST_USERNAME="$(mktemp -u alice-XXXXXX)"
65 TEST_PASSWORD="testPaSS@00%"
66 TEST_PASSWORD_NEW="testPaSS@01%"
67 TEST_PASSWORD_NON_ASCII="Täst123"
68 TEST_PASSWORD_SHORT="secret"
69 TEST_PASSWORD_WEAK="Supersecret"
70 TEST_PRINCIPAL="$TEST_USERNAME@$REALM"
72 testit "create user locally" \
73 $VALGRIND $PYTHON $newuser $CONFIG $TEST_USERNAME $TEST_PASSWORD || failed=`expr $failed + 1`
75 ###########################################################
76 ### Test normal operation as user
77 ###########################################################
79 KRB5CCNAME_PATH="$PREFIX/test_password_settings_krb5ccache"
80 rm -f $KRB5CCNAME_PATH
82 KRB5CCNAME="FILE:$KRB5CCNAME_PATH"
85 testit "kinit with user password" \
86 do_kinit $TEST_PRINCIPAL $TEST_PASSWORD || failed=`expr $failed + 1`
88 test_smbclient "Test login with user kerberos ccache" \
89 "ls" "$SMB_UNC" -k yes || failed=`expr $failed + 1`
91 rm -f $KRB5CCNAME_PATH
93 ###########################################################
94 ### Change the users password
95 ###########################################################
97 testit "change user password with 'samba-tool user password' (unforced)" \
98 $VALGRIND $PYTHON $samba_tool user password -W$DOMAIN -U$TEST_USERNAME%$TEST_PASSWORD -k no --newpassword=$TEST_PASSWORD_NEW || failed=`expr $failed + 1`
100 TEST_PASSWORD_OLD=$TEST_PASSWORD
101 TEST_PASSWORD=$TEST_PASSWORD_NEW
102 TEST_PASSWORD_NEW="testPaSS@02%"
104 testit "kinit with user password" \
105 do_kinit $TEST_PRINCIPAL $TEST_PASSWORD || failed=`expr $failed + 1`
107 test_smbclient "Test login with user kerberos ccache" \
108 "ls" "$SMB_UNC" -k yes || failed=`expr $failed + 1`
110 ###########################################################
111 ### Change the users password
112 ###########################################################
114 testit "change user (non-ascii) password with 'samba-tool user password' (unforced)" \
115 $VALGRIND $PYTHON $samba_tool user password -W$DOMAIN -U$TEST_USERNAME%$TEST_PASSWORD -k no --newpassword=$TEST_PASSWORD_NON_ASCII || failed=`expr $failed + 1`
117 TEST_PASSWORD_OLD=$TEST_PASSWORD_NEW
118 TEST_PASSWORD=$TEST_PASSWORD_NON_ASCII
120 testit "kinit with user password" \
121 do_kinit $TEST_PRINCIPAL $TEST_PASSWORD || failed=`expr $failed + 1`
123 test_smbclient "Test login with user kerberos ccache" \
124 "ls" "$SMB_UNC" -k yes || failed=`expr $failed + 1`
127 # These tests demonstrate that a credential cache in the environment does not
128 # override a username/password, even an incorrect one, on the command line
131 testit_expect_failure "Test login with user kerberos ccache, but wrong password specified" \
132 $VALGRIND $smbclient //$SERVER/tmp -c 'ls' -k yes -U$TEST_PRINCIPAL%invalidpass && failed=`expr $failed + 1`
135 # This test works now. We fail to get a ticket with the password, but fallback to ntlmssp which picks up the old ticket
136 # and logs in with it.
137 #testit_expect_failure "Test login with user kerberos ccache, but old password specified" \
138 # $VALGRIND $smbclient //$SERVER/tmp -c 'ls' -k yes -U$TEST_PRINCIPAL%$TEST_PASSWORD_OLD && failed=`expr $failed + 1`
140 rm -f $KRB5CCNAME_PATH
142 ###########################################################
143 ### Set the password with smbpasswd
144 ###########################################################
146 cat > $PREFIX/tmpsmbpasswdscript <<EOF
147 expect New SMB password:
148 send ${TEST_PASSWORD_NEW}\n
149 expect Retype new SMB password:
150 send ${TEST_PASSWORD_NEW}\n
153 testit "set user password with smbpasswd" \
154 $texpect $PREFIX/tmpsmbpasswdscript $smbpasswd -L -c $PREFIX/etc/smb.conf $TEST_USERNAME || failed=`expr $failed + 1`
156 TEST_PASSWORD=$TEST_PASSWORD_NEW
157 TEST_PASSWORD_NEW="testPaSS@03%"
159 test_smbclient "Test login with user (ntlm)" \
160 "ls" "$SMB_UNC" -k no -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=`expr $failed + 1`
162 testit "set password on user locally" $VALGRIND $PYTHON $samba_tool user setpassword $TEST_USERNAME $CONFIG --newpassword=$TEST_PASSWORD_NEW --must-change-at-next-login || failed=`expr $failed + 1`
164 TEST_PASSWORD=$TEST_PASSWORD_NEW
165 TEST_PASSWORD_NEW="testPaSS@04%"
167 test_smbclient_expect_failure "Test login with user (NT_STATUS_PASSWORD_MUST_CHANGE)" \
168 "ls" "$SMB_UNC" -k no -U$TEST_PRINCIPAL%$TEST_PASSWORD && failed=`expr $failed + 1`
170 testit "change user password with 'samba-tool user password' (after must change flag set)" \
171 $VALGRIND $PYTHON $samba_tool user password -W$DOMAIN -U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD -k no --newpassword=$TEST_PASSWORD_NEW || failed=`expr $failed + 1`
173 TEST_PASSWORD=$TEST_PASSWORD_NEW
174 TEST_PASSWORD_NEW="testPaSS@05%"
176 test_smbclient "Test login with user kerberos" 'ls' "$SMB_UNC" -k yes -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=`expr $failed + 1`
178 rm -f $KRB5CCNAME_PATH
180 cat > $PREFIX/tmpsmbpasswdscript <<EOF
181 expect Old SMB password:
182 password ${TEST_PASSWORD}\n
183 expect New SMB password:
184 send ${TEST_PASSWORD_NEW}\n
185 expect Retype new SMB password:
186 send ${TEST_PASSWORD_NEW}\n
189 testit "change user password with smbpasswd (after must change flag set)" \
190 $texpect $PREFIX/tmpsmbpasswdscript $smbpasswd -r $SERVER -c $PREFIX/etc/smb.conf -U $TEST_USERNAME || failed=`expr $failed + 1`
192 TEST_PASSWORD=$TEST_PASSWORD_NEW
193 TEST_PASSWORD_NEW="testPaSS@06%"
195 test_smbclient "Test login with user kerberos" \
196 "ls" "$SMB_UNC" -k yes -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=`expr $failed + 1`
198 rm -f $KRB5CCNAME_PATH
200 testit_expect_failure "try to set a non-complex password (command should not succeed)" \
201 $VALGRIND $PYTHON $samba_tool user password -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_WEAK" && failed=`expr $failed + 1`
203 testit "allow non-complex passwords" \
204 $VALGRIND $PYTHON $samba_tool domain passwordsettings set $CONFIG --complexity=off || failed=`expr $failed + 1`
206 testit "try to set a non-complex password (command should succeed)" \
207 $VALGRIND $PYTHON $samba_tool user password -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_WEAK" || failed=`expr $failed + 1`
209 TEST_PASSWORD=$TEST_PASSWORD_WEAK
211 test_smbclient "test login with non-complex password" \
212 "ls" "$SMB_UNC" -k no -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=`expr $failed + 1`
214 testit_expect_failure "try to set a short password (command should not succeed)" \
215 $VALGRIND $PYTHON $samba_tool user password -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_SHORT" && failed=`expr $failed + 1`
217 testit "allow short passwords (length 1)" \
218 $VALGRIND $PYTHON $samba_tool domain passwordsettings set $CONFIG --min-pwd-length=1 || failed=`expr $failed + 1`
220 testit "try to set a short password (command should succeed)" \
221 $VALGRIND $PYTHON $samba_tool user password -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_SHORT" || failed=`expr $failed + 1`
223 TEST_PASSWORD=$TEST_PASSWORD_SHORT
224 TEST_PASSWORD_NEW="testPaSS@07%"
226 testit "require minimum password age of 1 day" \
227 $VALGRIND $PYTHON $samba_tool domain passwordsettings set $CONFIG --min-pwd-age=1 || failed=`expr $failed + 1`
229 testit "show password settings" \
230 $VALGRIND $PYTHON $samba_tool domain passwordsettings show $CONFIG || failed=`expr $failed + 1`
232 testit_expect_failure "try to change password too quickly (command should not succeed)" \
233 $VALGRIND $PYTHON $samba_tool user password -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_NEW" && failed=`expr $failed + 1`
235 testit "reset password policies" \
236 $VALGRIND $PYTHON $samba_tool domain passwordsettings set $CONFIG --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=default --max-pwd-age=default || failed=`expr $failed + 1`
238 testit "delete user $TEST_USERNAME" \
239 $VALGRIND $PYTHON $samba_tool user delete $TEST_USERNAME -U"$USERNAME%$PASSWORD" $CONFIG -k no || failed=`expr $failed + 1`
241 rm -f $PREFIX/tmpuserpassfile $PREFIX/tmpsmbpasswdscript
242 rm -f $KRB5CCNAME_PATH