#!/usr/bin/expect --
# test_pamcmds.expect - test script to check output of PAM commands
#
# Copyright (C) 2011, 2012, 2013 Arthur de Jong
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301 USA
# basic configuration
set timeout 5
log_file -a -noappend test_pamcmds.log
log_user 0
# basic error handling
proc abort {} {
global expect_out
send_user "\n\ntest_pamcmds.expect: ERROR found:\n"
send_user "$expect_out(buffer)\n"
exit 1
}
# function for resetting the password
proc reset_password {} {
global expect_out
send_user "test_pamcmds.expect: resetting passwd...\n"
spawn passwd vsefcovic
expect {
"LDAP administrator password" { send "test\r"; exp_continue }
-regexp "(New|Retype new)( UNIX)? password:" { send "test\r"; exp_continue }
"password updated successfully" {}
"passwd: all authentication tokens updated successfully." {}
"Invalid credentials" abort
"Authentication token manipulation error" abort
"passwd: Sorry, `passwd' can only change passwords for local or NIS users." {
send_user "test_pamcmds.expect: passwd not using PAM\n"
exit 77
}
default abort
}
#close
}
# find source directory
if { ! [info exists ::env(srcdir) ] } {
set env(srcdir) "."
}
# ensure that we are running as root
if { [exec id -u] != "0" } {
send_user "test_pamcmds.expect: not running as root\n"
exit 77
}
# ensure that we are running in the test environment
spawn $env(srcdir)/testenv.sh check
expect eof
catch wait result
if { [lindex $result 3] } {
send_user "test_pamcmds.expect: not running in test environment\n"
exit 77
}
# ensure that a correct password is set
reset_password
# start a shell as nobody
send_user "test_pamcmds.expect: start shell...\n"
spawn su - nobody -s /bin/sh
expect "\$ "
# function to do login, expecting OK result
proc test_login_ok {uid passwd} {
send "su - $uid -s /bin/sh\r"
expect "Password:"
send "$passwd\r"
expect {
"su: warning: cannot change directory" { exp_continue }
"\$ " {}
"su: incorrect password" abort
default abort
}
# test whether we are really logged in
send "id\r"
expect {
-regexp "uid=\[0-9\]*\\($uid\\)" {}
"\$ " abort
default abort
}
expect "\$ "
}
# function to do login, expecting FAIL result
proc test_login_authfail {uid passwd} {
send "su - $uid -s /bin/sh\r"
expect "Password:"
send "$passwd\r"
expect {
"su: Authentication failure" {}
"su: incorrect password" {}
"\$ " abort
default abort
}
expect "\$ "
}
# function to do login, expecting FAIL result
proc test_login_unknown {uid passwd} {
send "su - $uid -s /bin/sh\r"
expect {
"Password:" { send "$passwd\r"; exp_continue }
"Unknown id" {}
"No passwd entry for user" {}
"user $uid does not exist" {}
"\$ " abort
default abort
}
expect "\$ "
}
# test incorrect password
send_user "test_pamcmds.expect: testing incorrect password...\n"
test_login_authfail vsefcovic wrongpassword
# test correct password
send_user "test_pamcmds.expect: testing correct password...\n"
test_login_ok vsefcovic test
# change password using incorrect old password
send_user "test_pamcmds.expect: testing password change with incorrect password...\n"
send "passwd\r"
expect {
-nocase "password:" { send "wrongpassword\r" }
"\$ " abort
default abort
}
expect {
-regexp "(New|Retype new)( UNIX)? password:" { send "DuhevOlNoz5\r"; exp_continue }
"password changed" abort
"all authentication tokens updated successfully." abort
"Invalid credentials" {}
"Authentication token manipulation error" {}
"\$ " abort
}
expect "\$ "
# change the password using the correct old password
send_user "test_pamcmds.expect: testing password change with correct password...\n"
send "passwd\r"
expect {
-nocase "password:" { send "test\r" }
"\$ " abort
default abort
}
expect {
-regexp "(New|Retype new)( UNIX)? password:" { send "DuhevOlNoz5\r"; exp_continue }
"password updated successfully" {}
"all authentication tokens updated successfully." {}
"Invalid credentials" abort
"Authentication token manipulation error" abort
"\$ " abort
}
expect "\$ "
# exist shell (back to nobody)
send "exit\r"
expect "\$ "
# logging in with the old password should fail now
send_user "test_pamcmds.expect: testing old password...\n"
test_login_authfail vsefcovic test
# test correct password
send_user "test_pamcmds.expect: testing new password...\n"
test_login_ok vsefcovic DuhevOlNoz5
# test invalid username
send_user "test_pamcmds.expect: testing with unknown username...\n"
test_login_unknown foo anypassword
# test login as root with incorrect password
send_user "test_pamcmds.expect: testing with root...\n"
test_login_authfail root anypassword
# test login as nobody with incorrect password
send_user "test_pamcmds.expect: testing with nobody...\n"
test_login_authfail nobody anypassword
# close the shell (first log off vsefcovic)
send "exit\r"
expect "\$ "
send "exit\r"
expect {
eof {}
"\$ " abort
timeout abort
}
# ensure that a correct password is set
reset_password
send_user "test_pamcmds.expect: everyting OK\n"
exit 0