[SCM] Samba Shared Repository - branch master updated
Matthieu Patou
mat at samba.org
Sat Jul 17 07:56:37 MDT 2010
The branch, master has been updated
via e461e29... s4 unittests: add blackblox test for ktpass
via 5a8c77f... s4: create a simple version of ktpass
from feb2190... s3-build: add LIBNDR_XATTR_OBJ.
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit e461e29cd9a81d4a74fcd489c2c7b693b49f41d4
Author: Matthieu Patou <mat at matws.net>
Date: Mon Jul 12 00:07:20 2010 +0400
s4 unittests: add blackblox test for ktpass
commit 5a8c77f97b30ab2c81f7170a12dddb4ab9972414
Author: Matthieu Patou <mat at matws.net>
Date: Mon Jun 28 21:38:35 2010 +0400
s4: create a simple version of ktpass
This script is intended to be a replacement for the ktutil of Windows.
It's use is for exporting keytab that will be used for kerberized
services.
-----------------------------------------------------------------------
Summary of changes:
source4/scripting/bin/ktpass.sh | 93 +++++++++++++++++++++++++++++++++++++
source4/selftest/tests.sh | 1 +
testprogs/blackbox/test_ktpass.sh | 37 +++++++++++++++
3 files changed, 131 insertions(+), 0 deletions(-)
create mode 100755 source4/scripting/bin/ktpass.sh
create mode 100755 testprogs/blackbox/test_ktpass.sh
Changeset truncated at 500 lines:
diff --git a/source4/scripting/bin/ktpass.sh b/source4/scripting/bin/ktpass.sh
new file mode 100755
index 0000000..92b1976
--- /dev/null
+++ b/source4/scripting/bin/ktpass.sh
@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# vim: expandtab
+#
+# Copyright (C) Matthieu Patou <mat at matws.net> 2010
+#
+#
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+name="ktpass.sh"
+TEMP=`getopt -o h --long princ:,pass:,out:,host:,ptype:,enc:,path-to-ldbsearch: \
+ -n "$name" -- "$@"`
+eval set -- "$TEMP"
+
+function usage {
+ echo -ne "$name --out <keytabfile> --princ <principal> --pass <password>|*\n"
+ echo -ne " [--host hostname] [--enc <encryption>]\n"
+ echo -ne " [--ptype <type>] [--path-to-ldbsearch <path>]\n"
+ echo -ne "\nEncoding should be one of:\n"
+ echo -ne " * des-cbc-crc\n"
+ echo -ne " * des-cbc-md5\n"
+ echo -ne " * rc4-hmac (default)\n"
+ echo -ne " * aes128-cts\n"
+ echo -ne " * aes256-cts\n"
+ exit 0
+}
+while true ; do
+ case "$1" in
+ --out) outfile=$2 ; shift 2 ;;
+ --princ) princ=$2 ; shift 2 ;;
+ --pass) pass=$2 ; shift 2 ;;
+ --host) host=$2 ; shift 2 ;;
+ --ptype) shift 2 ;;
+ --enc) enc=$2; shift 2;;
+ --path-to-ldbsearch) path="$2/"; shift 2;;
+ -h) usage;;
+ --) shift ; break ;;
+ *) echo "Internal error!" ; exit 1 ;;
+ esac
+done
+#RC4-HMAC-NT|AES256-SHA1|AES128-SHA
+if [ -z "$enc" ]; then
+ enc="rc4-hmac"
+fi
+if [ -z "$path" ]; then
+ path=`dirname $0`/../bin/
+fi
+if [ -z "$outfile" -o -z "$princ" -o -z "$pass" ]; then
+ echo "At least one mandatory parameter (--out, --princ, --pass) was not specified"
+ usage
+fi
+if [ -z $host ]; then
+ host=`hostname`
+fi
+kvno=`${path}ldbsearch -H ldap://$host "(|(samaccountname=$princ)(serviceprincipalname=$princ))" msds-keyversionnumber -k 1 -N 2>/dev/null| grep -i msds-keyversionnumber`
+if [ "$kvno" == "" ]; then
+ echo -ne "Unable to find kvno for principal $princ\n"
+ echo -ne " check that you are authentified with kerberos\n"
+ exit 1
+else
+ kvno=`echo $kvno | sed 's/^.*: //'`
+fi
+
+if [ "$pass" == "*" ]; then
+ echo -n "Enter password for $princ: "
+ stty -echo
+ read pass
+ stty echo
+ echo ""
+fi
+
+ktutil >/dev/null <<EOF
+add_entry -password -p $princ -k $kvno -e $enc
+$pass
+wkt $outfile
+EOF
+
+if [ $? -eq 0 ]; then
+ echo "Keytab file $outfile created with success"
+else
+ echo "Error while creating the keytab file $outfile"
+fi
diff --git a/source4/selftest/tests.sh b/source4/selftest/tests.sh
index 52d1d39..1dd507e 100755
--- a/source4/selftest/tests.sh
+++ b/source4/selftest/tests.sh
@@ -368,6 +368,7 @@ plantestsuite "blackbox.pkinit" dc:local $bbdir/test_pkinit.sh "\$SERVER" "\$USE
plantestsuite "blackbox.kinit" dc:local $bbdir/test_kinit.sh "\$SERVER" "\$USERNAME" "\$PASSWORD" "\$REALM" "\$DOMAIN" "$PREFIX" aes256-cts-hmac-sha1-96 $CONFIGURATION
plantestsuite "blackbox.kinit" fl2000dc:local $bbdir/test_kinit.sh "\$SERVER" "\$USERNAME" "\$PASSWORD" "\$REALM" "\$DOMAIN" "$PREFIX" arcfour-hmac-md5 $CONFIGURATION
plantestsuite "blackbox.kinit" fl2008r2dc:local $bbdir/test_kinit.sh "\$SERVER" "\$USERNAME" "\$PASSWORD" "\$REALM" "\$DOMAIN" "$PREFIX" aes256-cts-hmac-sha1-96 $CONFIGURATION
+plantestsuite "blackbox.ktpass" dc $bbdir/test_ktpass.sh $PREFIX
plantestsuite "blackbox.passwords" dc:local $bbdir/test_passwords.sh "\$SERVER" "\$USERNAME" "\$PASSWORD" "\$REALM" "\$DOMAIN" "$PREFIX"
plantestsuite "blackbox.export.keytab" dc:local $bbdir/test_export_keytab.sh "\$SERVER" "\$USERNAME" "\$REALM" "\$DOMAIN" "$PREFIX"
plantestsuite "blackbox.cifsdd" dc $samba4srcdir/client/tests/test_cifsdd.sh "\$SERVER" "\$USERNAME" "\$PASSWORD" "\$DOMAIN"
diff --git a/testprogs/blackbox/test_ktpass.sh b/testprogs/blackbox/test_ktpass.sh
new file mode 100755
index 0000000..b106d50
--- /dev/null
+++ b/testprogs/blackbox/test_ktpass.sh
@@ -0,0 +1,37 @@
+#!/bin/sh
+
+if [ $# -lt 1 ]; then
+cat <<EOF
+Usage: blackbox_newuser.sh PREFIX
+EOF
+exit 1;
+fi
+
+PREFIX="$1"
+shift 1
+
+. `dirname $0`/subunit.sh
+
+
+net="$BUILDDIR/bin/net"
+samba4bindir="$BUILDDIR/bin"
+samba4kinit="$samba4bindir/samba4kinit$EXEEXT"
+CONFIG="--configfile=$PREFIX/dc/etc/smb.conf"
+
+#two test for creating new user
+#newuser account is created with cn=Given Name Initials. Surname
+#newuser1 account is created using cn=username
+testit "newuser" $net newuser $CONFIG --given-name="User" --surname="Tester" --initials="T" --profile-path="\\\\myserver\\my\\profile" --script-path="\\\\myserver\\my\\script" --home-directory="\\\\myserver\\my\\homedir" --job-title="Tester" --department="Testing" --company="Samba.org" --description="Description" --mail-address="tester at samba.org" --internet-address="http://samba.org" --telephone-number="001122334455" --physical-delivery-office="101" --home-drive="H:" testuser testp at ssw0Rd|| failed=`expr $failed + 1`
+
+KRB5CCNAME="$PREFIX/tmpccache"
+export KRB5CCNAME
+echo "testp at ssw0Rd" >$PREFIX/tmppassfile
+testit "kinit with passwd" $samba4kinit -e arcfour-hmac-md5 --password-file=$PREFIX/tmppassfile testuser at SAMBA.EXAMPLE.COM || failed=`expr $failed + 1`
+testit "ktpass" $BUILDDIR/scripting/bin/ktpass.sh --host LOCALDC --out $PREFIX/testuser.kt --princ testuser --pass "testp at ssw0Rd" --path-to-ldbsearch=$BUILDDIR/bin|| failed=`expr $failed + 1`
+
+rm -f $KRB5CCNAME
+
+testit "kinit with keytab" $samba4kinit -e arcfour-hmac-md5 --use-keytab -t $PREFIX/testuser.kt testuser at SAMBA.EXAMPLE.COM || failed=`expr $failed + 1`
+
+rm -f $PREFIX/tmpccache $PREFIX/testuser.kt
+exit $failed
--
Samba Shared Repository
More information about the samba-cvs
mailing list