1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
|
#!/usr/bin/expect --
# test_pamcmds.expect - test script to check output of PAM commands
#
# Copyright (C) 2011, 2012, 2013 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
# basic configuration
set timeout 5
log_file -a -noappend test_pamcmds.log
log_user 0
# basic error handling
proc abort {} {
global expect_out
send_user "\n\ntest_pamcmds.expect: ERROR found:\n"
send_user "$expect_out(buffer)\n"
exit 1
}
# function for resetting the password
proc reset_password {} {
global expect_out
send_user "test_pamcmds.expect: resetting passwd...\n"
spawn passwd vsefcovic
expect {
"LDAP administrator password" { send "test\r"; exp_continue }
-regexp "(New|Retype new)( UNIX)? password:" { send "test\r"; exp_continue }
"password updated successfully" {}
"passwd: all authentication tokens updated successfully." {}
"Invalid credentials" abort
"Authentication token manipulation error" abort
"passwd: Sorry, `passwd' can only change passwords for local or NIS users." {
send_user "test_pamcmds.expect: passwd not using PAM\n"
exit 77
}
default abort
}
#close
}
# find source directory
if { ! [info exists ::env(srcdir) ] } {
set env(srcdir) "."
}
# ensure that we are running as root
if { [exec id -u] != "0" } {
send_user "test_pamcmds.expect: not running as root\n"
exit 77
}
# ensure that we are running in the test environment
spawn $env(srcdir)/testenv.sh check
expect eof
catch wait result
if { [lindex $result 3] } {
send_user "test_pamcmds.expect: not running in test environment\n"
exit 77
}
# ensure that a correct password is set
reset_password
# start a shell as nobody
send_user "test_pamcmds.expect: start shell...\n"
spawn su - nobody -s /bin/sh
expect "\$ "
# function to do login, expecting OK result
proc test_login_ok {uid passwd} {
send "su - $uid -s /bin/sh\r"
expect "Password:"
send "$passwd\r"
expect {
"su: warning: cannot change directory" { exp_continue }
"\$ " {}
"su: incorrect password" abort
default abort
}
# test whether we are really logged in
send "id\r"
expect {
-regexp "uid=\[0-9\]*\\($uid\\)" {}
"\$ " abort
default abort
}
expect "\$ "
}
# function to do login, expecting FAIL result
proc test_login_authfail {uid passwd} {
send "su - $uid -s /bin/sh\r"
expect "Password:"
send "$passwd\r"
expect {
"su: Authentication failure" {}
"su: incorrect password" {}
"\$ " abort
default abort
}
expect "\$ "
}
# function to do login, expecting FAIL result
proc test_login_unknown {uid passwd} {
send "su - $uid -s /bin/sh\r"
expect {
"Password:" { send "$passwd\r"; exp_continue }
"Unknown id" {}
"No passwd entry for user" {}
"user $uid does not exist" {}
"\$ " abort
default abort
}
expect "\$ "
}
# test incorrect password
send_user "test_pamcmds.expect: testing incorrect password...\n"
test_login_authfail vsefcovic wrongpassword
# test correct password
send_user "test_pamcmds.expect: testing correct password...\n"
test_login_ok vsefcovic test
# change password using incorrect old password
send_user "test_pamcmds.expect: testing password change with incorrect password...\n"
send "passwd\r"
expect {
-nocase "password:" { send "wrongpassword\r" }
"\$ " abort
default abort
}
expect {
-regexp "(New|Retype new)( UNIX)? password:" { send "DuhevOlNoz5\r"; exp_continue }
"password changed" abort
"all authentication tokens updated successfully." abort
"Invalid credentials" {}
"Authentication token manipulation error" {}
"\$ " abort
}
expect "\$ "
# change the password using the correct old password
send_user "test_pamcmds.expect: testing password change with correct password...\n"
send "passwd\r"
expect {
-nocase "password:" { send "test\r" }
"\$ " abort
default abort
}
expect {
-regexp "(New|Retype new)( UNIX)? password:" { send "DuhevOlNoz5\r"; exp_continue }
"password updated successfully" {}
"all authentication tokens updated successfully." {}
"Invalid credentials" abort
"Authentication token manipulation error" abort
"\$ " abort
}
expect "\$ "
# exist shell (back to nobody)
send "exit\r"
expect "\$ "
# logging in with the old password should fail now
send_user "test_pamcmds.expect: testing old password...\n"
test_login_authfail vsefcovic test
# test correct password
send_user "test_pamcmds.expect: testing new password...\n"
test_login_ok vsefcovic DuhevOlNoz5
# test invalid username
send_user "test_pamcmds.expect: testing with unknown username...\n"
test_login_unknown foo anypassword
# test login as root with incorrect password
send_user "test_pamcmds.expect: testing with root...\n"
test_login_authfail root anypassword
# test login as nobody with incorrect password
send_user "test_pamcmds.expect: testing with nobody...\n"
test_login_authfail nobody anypassword
# close the shell (first log off vsefcovic)
send "exit\r"
expect "\$ "
send "exit\r"
expect {
eof {}
"\$ " abort
timeout abort
}
# ensure that a correct password is set
reset_password
send_user "test_pamcmds.expect: everyting OK\n"
exit 0
|