diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 17:43:08 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 17:43:08 +0000 |
commit | f450ba4056f3af0d17aeb1e5534619ce2231b63d (patch) | |
tree | 22ac78ea73d361fe6af5cafc06a338dc03c1745a /debian/tests/sssd-gdm-smartcard-pam-auth-tester.sh | |
parent | Adding upstream version 43.0. (diff) | |
download | gdm3-debian.tar.xz gdm3-debian.zip |
Adding debian version 43.0-3.debian/43.0-3debian
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rw-r--r-- | debian/tests/sssd-gdm-smartcard-pam-auth-tester.sh | 256 |
1 files changed, 256 insertions, 0 deletions
diff --git a/debian/tests/sssd-gdm-smartcard-pam-auth-tester.sh b/debian/tests/sssd-gdm-smartcard-pam-auth-tester.sh new file mode 100644 index 0000000..0745ad4 --- /dev/null +++ b/debian/tests/sssd-gdm-smartcard-pam-auth-tester.sh @@ -0,0 +1,256 @@ +#!/usr/bin/env bash +# Copyright 2023 - Marco Trevisan +# Released under the GPLv3 terms +# +# A simple tool to simulate PAM authentication using GDM smartcard settings +# +# To be used with https://gist.github.com/3v1n0/287d02ca8e03936f1c7bba992173d47a +set -xe + +required_tools=( + gdm3 # debian package: gdm3 + pamtester # debian package: pamtester + softhsm2-util # debian package: softhsm2 + sssd # debian package: sssd +) + +if [[ ! -v OFFLINE_MODE ]]; then + required_tools+=( + wget # debian package: wget + ) +fi + +if [ "$(id -u)" != 0 ] || [ -z "$SUDO_USER" ]; then + echo "This tool requires sudo!" + exit 2 +fi + +for cmd in "${required_tools[@]}"; do + if ! command -v "$cmd" > /dev/null; then + echo "Tool $cmd missing" + exit 1 + fi +done + +PIN=${PIN:-123456} +GDM_USER=${GDM_USER:-gdm} +tmpdir=${TEST_TMPDIR:-$(mktemp -d -t "sssd-softhsm2-gdm-certs-XXXXXX")} +backupsdir= + +alternative_pam_configs=( + /etc/pam.d/gdm-smartcard-sssd-exclusive + /etc/pam.d/gdm-smartcard-sssd-or-password +) + +declare -a restore_paths +declare -a delete_paths + +function restore_changes() { + for path in "${restore_paths[@]}"; do + local original_path + original_path="/$(realpath --strip --relative-base="$backupsdir" "$path")" + rm "$original_path" && mv "$path" "$original_path" || true + done + + for path in "${delete_paths[@]}"; do + rm -f "$path" + #find "$(dirname "$path")" -empty -delete || true + done + + update-alternatives --auto gdm-smartcard + + if [ -e /etc/sssd/sssd.conf ]; then + chmod 600 /etc/sssd/sssd.conf || return 1 + systemctl restart sssd || true + else + systemctl stop sssd || true + fi + + if [ -e /etc/softhsm/softhsm2.conf ]; then + chmod 600 /etc/softhsm/softhsm2.conf || return 1 + fi + + rm -rf "$tmpdir" +} + +function backup_file() { + if [ -z "$backupsdir" ]; then + backupsdir=$(mktemp -d -t "sssd-softhsm2-gdm-backups-XXXXXX") + fi + + if [ -e "$1" ]; then + local back_dir="$backupsdir/$(dirname "$1")" + local back_path="$back_dir/$(basename "$1")" + [ ! -e "$back_path" ] || return 1 + + mkdir -p "$back_dir" || return 1 + cp -a "$1" "$back_path" || return 1 + + restore_paths+=("$back_path") + else + delete_paths+=("$1") + fi +} + +function handle_exit() { + exit_code=$? + + restore_changes || return 1 + + if [ $exit_code = 0 ]; then + rm -rf "$backupsdir" + set +x + echo "Script completed successfully!" + else + set +x + echo "Script failed, check the log!" + echo " Backup preserved at $backupsdir" + echo " PAM Log: /var/log/auth.log" + echo " SSSD PAM Log: /var/log/sssd/sssd_pam.log" + echo " SSSD p11_child Log: /var/log/sssd/p11_child.log" + fi +} + +trap 'handle_exit' EXIT + +tester="$(dirname "$0")"/sssd-softhism2-certificates-tests.sh +if [ ! -e "$tester" ]; then + echo "Required $tester missing, we're downloading it..." + tester="$tmpdir/sssd-softhism2-certificates-tests.sh" + wget -q -c https://gist.github.com/3v1n0/287d02ca8e03936f1c7bba992173d47a/raw/sssd-softhism2-certificates-tests.sh \ + -O "$tester" + [ -e "$tester" ] || exit 1 +fi + +export PIN TEST_TMPDIR="$tmpdir" GENERATE_SMART_CARDS=1 KEEP_TEMPORARY_FILES=1 NO_SSSD_TESTS=1 +bash "$tester" + +find "$tmpdir" -type d -exec chmod 777 {} \; +find "$tmpdir" -type f -exec chmod 666 {} \; + +backup_file /etc/passwd +backup_file /etc/shadow + +# Ensure that the test user has a non-trivial password. If it had a blank +# password, then /etc/pam.d/gdm-smartcard-sssd-or-password would always +# authenticate successfully +if pamtester -v gdm-password "$SUDO_USER" authenticate; then + ( echo -n "$SUDO_USER:"; cat /proc/sys/kernel/random/uuid ) | chpasswd +fi +# Same, but for root +if pamtester -v gdm-password root authenticate; then + ( echo -n "root:"; cat /proc/sys/kernel/random/uuid ) | chpasswd +fi + +backup_file /etc/sssd/sssd.conf +rm -f /etc/sssd/sssd.conf + +user_home="$(runuser -u "$SUDO_USER" -- sh -c 'echo ~')" +mkdir -p "$user_home" +chown "$SUDO_USER:$SUDO_USER" "$user_home" + +gdm_home="$(runuser -u "$GDM_USER" -- sh -c 'echo ~')" +mkdir -p "$gdm_home" +chown "$GDM_USER:$GDM_USER" "$gdm_home" + +user_config="$(runuser -u "$SUDO_USER" -- sh -c 'echo ${XDG_CONFIG_HOME:-~/.config}')" +gdm_config="$(runuser -u "$GDM_USER" -- sh -c 'echo ${XDG_CONFIG_HOME:-~/.config}')" +system_config="/etc" + +softhsm2_conf_paths=( + "$SUDO_USER:$user_config/softhsm2/softhsm2.conf" + "$GDM_USER:$gdm_config/softhsm2/softhsm2.conf" + "root:$system_config/softhsm/softhsm2.conf" +) + +for path_pair in "${softhsm2_conf_paths[@]}"; do + IFS=":" read -r -a path <<< "${path_pair}" + path="${path[1]}" + backup_file "$path" + rm -f "$path" +done + +function test_authentication() { + certificate_config="$1" + ca_db="$2" + verification_options="$3" + + mkdir -p -m 700 /etc/sssd + + cat <<EOF > /etc/sssd/sssd.conf || return 2 +[sssd] +enable_files_domain = True +services = pam +#certificate_verification = $verification_options + +[certmap/implicit_files/$SUDO_USER] +matchrule = <SUBJECT>.*Test Organization.* + +[pam] +pam_cert_db_path = $ca_db +pam_cert_verification = $verification_options +pam_cert_auth = True +pam_verbosity = 10 +debug_level = 10 +EOF + + chmod 600 /etc/sssd/sssd.conf || return 2 + + for path_pair in "${softhsm2_conf_paths[@]}"; do + IFS=":" read -r -a path <<< "${path_pair}" + user="${path[0]}" + path="${path[1]}" + + runuser -u "$user" -- mkdir -p "$(dirname "$path")" || return 2 + runuser -u "$user" -- ln -sf "$certificate_config" "$path" || return 2 + runuser -u "$user" -- softhsm2-util --show-slots | grep "Test Organization" \ + || return 2 + done + + systemctl restart sssd || return 2 + + for alternative in "${alternative_pam_configs[@]}"; do + sudo update-alternatives --set gdm-smartcard "$alternative" + + echo -n -e "$PIN" | runuser -u "$SUDO_USER" -- \ + pamtester -v gdm-smartcard "$SUDO_USER" authenticate || return 2 + echo -n -e "$PIN" | runuser -u "$SUDO_USER" -- \ + pamtester -v gdm-smartcard "" authenticate || return 2 + + if echo -n -e "wrong${PIN}" | runuser -u "$SUDO_USER" -- \ + pamtester -v gdm-smartcard "$SUDO_USER" authenticate; then + echo "Unexpected pass!" + return 2 + fi + + if echo -n -e "wrong${PIN}" | runuser -u "$SUDO_USER" -- \ + pamtester -v gdm-smartcard "" authenticate; then + echo "Unexpected pass!" + return 2 + fi + + if echo -n -e "$PIN" | pamtester -v gdm-smartcard root authenticate; then + echo "Unexpected pass!" + return 2 + fi + + if [[ -v WAIT ]]; then + echo "Press any key and enter to continue" + systemctl restart gdm3 + read + fi + done +} + +test_authentication \ + "$tmpdir/softhsm2-test-root-CA-trusted-certificate-0001.conf" \ + "$tmpdir/test-full-chain-CA.pem" + +test_authentication \ + "$tmpdir/softhsm2-test-sub-intermediate-CA-trusted-certificate-0001.conf" \ + "$tmpdir/test-full-chain-CA.pem" + +test_authentication \ + "$tmpdir/softhsm2-test-sub-intermediate-CA-trusted-certificate-0001.conf" \ + "$tmpdir/test-sub-intermediate-CA.pem" \ + "partial_chain" |