2 # Blackbox tests for different password settings
4 # Copyright (c) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
5 # Copyright (c) 2006-2008 Andrew Bartlett <abartlet@samba.org>
6 # Copyright (c) 2016 Andreas Schneider <asn@samba.org>
10 Usage: test_passwords_settings.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX
24 samba_bindir="$BINDIR"
27 if test -x $samba_bindir/samba4kinit; then
28 samba_kinit=$samba_bindir/samba4kinit
31 smbclient="$samba_bindir/smbclient"
32 samba_tool="$samba_bindir/samba-tool"
33 smbpasswd="$samba_bindir/smbpasswd"
34 texpect="$samba_bindir/texpect"
36 newuser="$samba_tool user create"
37 SMB_UNC="//$SERVER/tmp"
39 . `dirname $0`/subunit.sh
40 . `dirname $0`/common_test_fns.inc
47 if test -x $samba_bindir/samba4kinit; then
48 echo $password > $PREFIX/tmpuserpassfile
49 $samba_kinit --password-file=$PREFIX/tmpuserpassfile $principal $@
51 echo $password | $samba_kinit $principal $@
56 export UID_WRAPPER_ROOT
58 CONFIG="--configfile=$PREFIX/etc/smb.conf"
61 testit "reset password policies beside of minimum password age of 0 days" \
62 $VALGRIND $samba_tool domain passwordsettings $CONFIG set --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=0 --max-pwd-age=default || failed=`expr $failed + 1`
64 TEST_USERNAME="$(mktemp -u alice-XXXXXX)"
65 TEST_PASSWORD="testPaSS@00%"
66 TEST_PASSWORD_NEW="testPaSS@01%"
67 TEST_PASSWORD_SHORT="secret"
68 TEST_PASSWORD_WEAK="Supersecret"
69 TEST_PRINCIPAL="$TEST_USERNAME@$REALM"
71 testit "create user locally" \
72 $VALGRIND $newuser $CONFIG $TEST_USERNAME $TEST_PASSWORD || failed=`expr $failed + 1`
74 ###########################################################
75 ### Test normal operation as user
76 ###########################################################
78 KRB5CCNAME="$PREFIX/tmpuserccache"
81 testit "kinit with user password" \
82 do_kinit $TEST_PRINCIPAL $TEST_PASSWORD || failed=`expr $failed + 1`
84 test_smbclient "Test login with user kerberos ccache" \
85 "ls" "$SMB_UNC" -k yes || failed=`expr $failed + 1`
87 ###########################################################
88 ### Change the users password
89 ###########################################################
91 testit "change user password with 'samba-tool user password' (unforced)" \
92 $VALGRIND $samba_tool user password -W$DOMAIN -U$TEST_USERNAME%$TEST_PASSWORD -k no --newpassword=$TEST_PASSWORD_NEW || failed=`expr $failed + 1`
94 TEST_PASSWORD_OLD=$TEST_PASSWORD
95 TEST_PASSWORD=$TEST_PASSWORD_NEW
96 TEST_PASSWORD_NEW="testPaSS@02%"
98 testit "kinit with user password" \
99 do_kinit $TEST_PRINCIPAL $TEST_PASSWORD || failed=`expr $failed + 1`
101 test_smbclient "Test login with user kerberos ccache" \
102 "ls" "$SMB_UNC" -k yes || failed=`expr $failed + 1`
105 # These tests demonstrate that a credential cache in the environment does not
106 # override a username/password, even an incorrect one, on the command line
109 testit_expect_failure "Test login with user kerberos ccache, but wrong password specified" \
110 $VALGRIND $smbclient //$SERVER/tmp -c 'ls' -k yes -U$TEST_PRINCIPAL%invalidpass && failed=`expr $failed + 1`
111 testit_expect_failure "Test login with user kerberos ccache, but old password specified" \
112 $VALGRIND $smbclient //$SERVER/tmp -c 'ls' -k yes -U$TEST_PRINCIPAL%$TEST_PASSWORD_OLD && failed=`expr $failed + 1`
114 ###########################################################
115 ### Set the password with smbpasswd
116 ###########################################################
118 cat > $PREFIX/tmpsmbpasswdscript <<EOF
119 expect New SMB password:
120 send ${TEST_PASSWORD_NEW}\n
121 expect Retype new SMB password:
122 send ${TEST_PASSWORD_NEW}\n
125 testit "set user password with smbpasswd" \
126 $texpect $PREFIX/tmpsmbpasswdscript $smbpasswd -L -c $PREFIX/etc/smb.conf $TEST_USERNAME || failed=`expr $failed + 1`
128 TEST_PASSWORD=$TEST_PASSWORD_NEW
129 TEST_PASSWORD_NEW="testPaSS@03%"
131 test_smbclient "Test login with user (ntlm)" \
132 "ls" "$SMB_UNC" -k no -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=`expr $failed + 1`
134 testit "set password on user locally" $VALGRIND $samba_tool user setpassword $TEST_USERNAME $CONFIG --newpassword=$TEST_PASSWORD_NEW --must-change-at-next-login || failed=`expr $failed + 1`
136 TEST_PASSWORD=$TEST_PASSWORD_NEW
137 TEST_PASSWORD_NEW="testPaSS@04%"
139 test_smbclient_expect_failure "Test login with user (NT_STATUS_PASSWORD_MUST_CHANGE)" \
140 "ls" "$SMB_UNC" -k no -U$TEST_PRINCIPAL%$TEST_PASSWORD && failed=`expr $failed + 1`
142 testit "change user password with 'samba-tool user password' (after must change flag set)" \
143 $VALGRIND $samba_tool user password -W$DOMAIN -U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD -k no --newpassword=$TEST_PASSWORD_NEW || failed=`expr $failed + 1`
145 TEST_PASSWORD=$TEST_PASSWORD_NEW
146 TEST_PASSWORD_NEW="testPaSS@05%"
148 test_smbclient "Test login with user kerberos" 'ls' "$SMB_UNC" -k yes -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=`expr $failed + 1`
150 cat > $PREFIX/tmpsmbpasswdscript <<EOF
151 expect Old SMB password:
152 password ${TEST_PASSWORD}\n
153 expect New SMB password:
154 send ${TEST_PASSWORD_NEW}\n
155 expect Retype new SMB password:
156 send ${TEST_PASSWORD_NEW}\n
159 testit "change user password with smbpasswd (after must change flag set)" \
160 $texpect $PREFIX/tmpsmbpasswdscript $smbpasswd -r $SERVER -c $PREFIX/etc/smb.conf -U $TEST_USERNAME || failed=`expr $failed + 1`
162 TEST_PASSWORD=$TEST_PASSWORD_NEW
163 TEST_PASSWORD_NEW="testPaSS@06%"
165 test_smbclient "Test login with user kerberos" \
166 "ls" "$SMB_UNC" -k yes -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=`expr $failed + 1`
168 testit_expect_failure "try to set a non-complex password (command should not succeed)" \
169 $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_WEAK" && failed=`expr $failed + 1`
171 testit "allow non-complex passwords" \
172 $VALGRIND $samba_tool domain passwordsettings set $CONFIG --complexity=off || failed=`expr $failed + 1`
174 testit "try to set a non-complex password (command should succeed)" \
175 $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_WEAK" || failed=`expr $failed + 1`
177 TEST_PASSWORD=$TEST_PASSWORD_WEAK
179 test_smbclient "test login with non-complex password" \
180 "ls" "$SMB_UNC" -k no -U$TEST_PRINCIPAL%$TEST_PASSWORD || failed=`expr $failed + 1`
182 testit_expect_failure "try to set a short password (command should not succeed)" \
183 $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_SHORT" && failed=`expr $failed + 1`
185 testit "allow short passwords (length 1)" \
186 $VALGRIND $samba_tool domain passwordsettings $CONFIG set --min-pwd-length=1 || failed=`expr $failed + 1`
188 testit "try to set a short password (command should succeed)" \
189 $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_SHORT" || failed=`expr $failed + 1`
191 TEST_PASSWORD=$TEST_PASSWORD_SHORT
192 TEST_PASSWORD_NEW="testPaSS@07%"
194 testit "require minimum password age of 1 day" \
195 $VALGRIND $samba_tool domain passwordsettings $CONFIG set --min-pwd-age=1 || failed=`expr $failed + 1`
197 testit "show password settings" \
198 $VALGRIND $samba_tool domain passwordsettings $CONFIG show || failed=`expr $failed + 1`
200 testit_expect_failure "try to change password too quickly (command should not succeed)" \
201 $VALGRIND $samba_tool user password -W$DOMAIN "-U$DOMAIN/$TEST_USERNAME%$TEST_PASSWORD" -k no --newpassword="$TEST_PASSWORD_NEW" && failed=`expr $failed + 1`
203 testit "reset password policies" \
204 $VALGRIND $samba_tool domain passwordsettings $CONFIG set --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=default --max-pwd-age=default || failed=`expr $failed + 1`
206 testit "delete user $TEST_USERNAME" \
207 $VALGRIND $samba_tool user delete $TEST_USERNAME -U"$USERNAME%$PASSWORD" $CONFIG -k no || failed=`expr $failed + 1`
209 rm -f $PREFIX/tmpuserpassfile $PREFIX/tmpsmbpasswdscript $PREFIX/tmpuserccache