33 lines
2.0 KiB
Bash
33 lines
2.0 KiB
Bash
sh_field() { getent shadow "$1" | cut -d: -f"$2"; }
|
|
# try PASSWORD: root's chpasswd sets it for pwtest.
|
|
try() { echo "pwtest:$1" | chpasswd >/dev/null 2>&1; }
|
|
NEXT_END=$(( $(date -ud "$(( $(date +%Y) + 1 ))-12-31" +%s) / 86400 ))
|
|
new_user_max() {
|
|
local u=lecheck$$ m
|
|
useradd -M -s /usr/sbin/nologin "$u" >/dev/null 2>&1 || return 1
|
|
m=$(sh_field "$u" 5)
|
|
userdel "$u" >/dev/null 2>&1
|
|
[ "$m" = 120 ]
|
|
}
|
|
|
|
task 1 "pam_pwquality: 10 characters, a digit and an uppercase letter, for root too"
|
|
need "libpam-pwquality is installed" 'pkg_installed libpam-pwquality'
|
|
need "/etc/pam.d/common-password uses pam_pwquality" 'grep -Eq "^[[:space:]]*password[[:space:]].*pam_pwquality\.so" /etc/pam.d/common-password'
|
|
need "even root can't set xq7#lvm-pztw (no uppercase letter)" '! try "xq7#lvm-pztw"'
|
|
need "even root can't set Xq#Lvm-PzTw (no digit)" '! try "Xq#Lvm-PzTw"'
|
|
need "even root can't set Xq7#Lvm2Z (only 9 characters)" '! try "Xq7#Lvm2Z"'
|
|
need "echo pwtest:lowercase12 | chpasswd fails" '! try lowercase12'
|
|
need "echo pwtest:Kettle7-Harbor | chpasswd succeeds" 'try Kettle7-Harbor'
|
|
|
|
task 2 "alice: maximum 60, warning 10, account expires Dec 31 next year, change at next login"
|
|
need "alice's maximum password age is 60 days" '[ "$(sh_field alice 5)" = 60 ]'
|
|
need "alice is warned 10 days before" '[ "$(sh_field alice 6)" = 10 ]'
|
|
need "alice's account expires on the last day of next year" '[ "$(sh_field alice 8)" = "$NEXT_END" ]'
|
|
need "alice must change her password at next login" '[ "$(sh_field alice 3)" = 0 ]'
|
|
|
|
task 3 "New accounts' passwords expire after 120 days; existing users unchanged"
|
|
need "/etc/login.defs sets PASS_MAX_DAYS 120" '[ "$(awk "\$1 == \"PASS_MAX_DAYS\" {v = \$2} END {print v}" /etc/login.defs)" = 120 ]'
|
|
need "a new account gets maximum 120" new_user_max
|
|
need "existing users are unchanged: root's and pwtest's maximum are as before" '[ "$(sh_field root 5)" = "$(cat "$LAB_STATE/max-root")" ] && [ "$(sh_field pwtest 5)" = "$(cat "$LAB_STATE/max-pwtest")" ]'
|
|
need "alice's maximum isn't 120" '[ "$(sh_field alice 5)" != 120 ]'
|