1 # Tests basic behaviour when NTLM is disabled
3 # Copyright (C) Catalyst IT Ltd. 2017
5 # This program is free software; you can redistribute it and/or modify
6 # it under the terms of the GNU General Public License as published by
7 # the Free Software Foundation; either version 3 of the License, or
8 # (at your option) any later version.
10 # This program is distributed in the hope that it will be useful,
11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 # GNU General Public License for more details.
15 # You should have received a copy of the GNU General Public License
16 # along with this program. If not, see <http://www.gnu.org/licenses/>.
18 from samba.tests import TestCase
22 from samba.credentials import Credentials, DONT_USE_KERBEROS, MUST_USE_KERBEROS
24 from samba import NTSTATUSError, ntstatus
27 from samba import credentials
28 from samba.dcerpc import srvsvc, samr, lsa
31 Tests behaviour when NTLM is disabled
34 class NtlmDisabledTests(TestCase):
37 super(NtlmDisabledTests, self).setUp()
39 self.lp = self.get_loadparm()
40 self.server = os.getenv("SERVER")
42 self.creds = Credentials()
43 self.creds.guess(self.lp)
44 self.creds.set_username(os.getenv("USERNAME"))
45 self.creds.set_domain(self.server)
46 self.creds.set_password(os.getenv("PASSWORD"))
47 self.creds.set_kerberos_state(DONT_USE_KERBEROS)
50 super(NtlmDisabledTests, self).tearDown()
52 def test_ntlm_connection(self):
54 conn = srvsvc.srvsvc("ncacn_np:%s[smb2,ntlm]" % self.server, self.lp, self.creds)
56 self.assertIsNotNone(conn)
57 except NTSTATUSError as e:
58 # NTLM might be blocked on this server
59 enum = ctypes.c_uint32(e[0]).value
60 if enum == ntstatus.NT_STATUS_NTLM_BLOCKED:
61 self.fail("NTLM is disabled on this server")
65 def test_samr_change_password(self):
66 self.creds.set_kerberos_state(MUST_USE_KERBEROS)
67 conn = samr.samr("ncacn_np:%s[krb5,seal,smb2]" % os.getenv("SERVER"))
69 # we want to check whether this gets rejected outright because NTLM is
70 # disabled, so we don't actually need to encrypt a valid password here
72 server.string = self.server
73 username = lsa.String()
74 username.string = os.getenv("USERNAME")
77 conn.ChangePasswordUser2(server, username, None, None, True, None, None)
78 except NTSTATUSError as e:
79 # changing passwords should be rejected when NTLM is disabled
80 enum = ctypes.c_uint32(e[0]).value
81 if enum == ntstatus.NT_STATUS_NTLM_BLOCKED:
82 self.fail("NTLM is disabled on this server")
83 elif enum == ntstatus.NT_STATUS_WRONG_PASSWORD:
84 # expected error case when NTLM is enabled