You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
127 lines
3.2 KiB
127 lines
3.2 KiB
12 months ago
|
#!/bin/bash
|
||
|
|
# Author: Iain Douglas <centos@1n6.org.uk>
|
||
|
|
#
|
||
|
|
|
||
|
|
function ExitFail
|
||
|
|
{
|
||
|
|
t_Log "FAIL"
|
||
|
|
exit $FAIL
|
||
|
|
}
|
||
|
|
#
|
||
|
|
# Test the command line options for passwd that are restricted to root.
|
||
|
|
#
|
||
|
|
|
||
|
|
t_Log "Running $0 - Check root only actions"
|
||
|
|
t_Log "Create test user passtest"
|
||
|
|
userdel -rf passtest; useradd passtest && echo passtest | passwd --stdin passtest &>/dev/null
|
||
|
|
t_CheckExitStatus $?
|
||
|
|
|
||
|
|
# Check that passwd -l locks the password - the field in /etc/shadow has
|
||
|
|
# a ! prepended
|
||
|
|
t_Log "Check account can be locked"
|
||
|
|
passwd -l passtest &>/dev/null
|
||
|
|
|
||
|
|
if [ $? -eq "0" ]
|
||
|
|
then
|
||
|
|
getent shadow passtest | cut -f2 -d: | grep '^!' &>/dev/null
|
||
|
|
t_CheckExitStatus $?
|
||
|
|
else
|
||
|
|
ExitFail
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Check that passwd -u will unlock the account - removes the ! from the
|
||
|
|
# start of the password field in /etc/shadow
|
||
|
|
t_Log "Check account can be unlocked"
|
||
|
|
passwd -u passtest &>/dev/null
|
||
|
|
|
||
|
|
if [ $? -eq "0" ]
|
||
|
|
then
|
||
|
|
getent shadow passtest | cut -f2 -d: | grep -v '^!' &>/dev/null
|
||
|
|
t_CheckExitStatus $?
|
||
|
|
else
|
||
|
|
ExitFail
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Check that passwd -e expires an account. Field 3 of /etc/shadow is set to 0
|
||
|
|
t_Log "Check password can be expired"
|
||
|
|
if [ $centos_ver == '5' ]
|
||
|
|
then
|
||
|
|
t_Log 'This is a C5 system - option -e does not exist - skipping'
|
||
|
|
else
|
||
|
|
passwd -e passtest &>/dev/null
|
||
|
|
if [ $? -eq "0" ]
|
||
|
|
then
|
||
|
|
getent shadow passtest | cut -f3 -d: | grep '^0' &>/dev/null
|
||
|
|
t_CheckExitStatus $?
|
||
|
|
echo passtest | passwd --stdin passtest &>/dev/null
|
||
|
|
else
|
||
|
|
ExitFail
|
||
|
|
fi
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Check that passwd -n, -x, -w -i set the mindays, maxdays, warndays and
|
||
|
|
# inactive fields (4-7) in /etc/shadow
|
||
|
|
t_Log "Check password aging data can be set"
|
||
|
|
passwd -n 11 -x 22 -w 33 -i 44 passtest &>/dev/null
|
||
|
|
|
||
|
|
if [ $? -eq "0" ]
|
||
|
|
then
|
||
|
|
getent shadow passtest | cut -f4-7 -d: | grep '^11:22:33:44' &>/dev/null
|
||
|
|
t_CheckExitStatus $?
|
||
|
|
else
|
||
|
|
ExitFail
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Check that passwd -d deletes the password - the field in /etc/shadow is
|
||
|
|
# cleared
|
||
|
|
t_Log "Check password can be deleted"
|
||
|
|
passwd -d passtest &>/dev/null
|
||
|
|
|
||
|
|
if [ $? -eq "0" ]
|
||
|
|
then
|
||
|
|
password=$(getent shadow passtest | cut -f2 -d:)
|
||
|
|
if [ -z "${password}" ]
|
||
|
|
then
|
||
|
|
t_Log "PASS"
|
||
|
|
else
|
||
|
|
ExitFail
|
||
|
|
fi
|
||
|
|
else
|
||
|
|
ExitFail
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Passwd won't, without being forced, unlock an account with a blank password
|
||
|
|
# so check this is the case.
|
||
|
|
t_Log "Check blank password cannot be unlocked"
|
||
|
|
passwd -l passtest &>/dev/null
|
||
|
|
passwd -u passtest &>/dev/null
|
||
|
|
|
||
|
|
if [ $? -ne "0" ]
|
||
|
|
then
|
||
|
|
t_Log PASS
|
||
|
|
else
|
||
|
|
ExitFail
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Force passwd to unlock an account with a blank password passwd -uf.
|
||
|
|
t_Log "Check blank password can be force unlocked"
|
||
|
|
passwd -uf passtest &>/dev/null
|
||
|
|
t_CheckExitStatus $?
|
||
|
|
|
||
|
|
# Check the output of passwd -S at this point it should be
|
||
|
|
# passtest NP YYYY-MM-DD 11 22 33 44 (Empty password.)
|
||
|
|
# It's possible that this will run on a different side of midnight to earlier
|
||
|
|
# commands so if checking the output for today fails check yesterday too
|
||
|
|
t_Log "Check output of passwd -S"
|
||
|
|
|
||
|
|
expected="passtest NP "$(date +'%F')" 11 22 33 44 (Empty password.)"
|
||
|
|
passwd -S passtest | grep "$expected" &>/dev/null
|
||
|
|
if [ $? -eq "0" ]
|
||
|
|
then
|
||
|
|
t_Log "PASS"
|
||
|
|
else
|
||
|
|
expected="passtest NP "$(date +'%F' -d yesterday)" 11 22 33 44 (Empty password.)"
|
||
|
|
passwd -S passtest | grep "$expected" &>/dev/null
|
||
|
|
t_CheckExitStatus $?
|
||
|
|
fi
|