1*644b4646SEd Maste# $OpenBSD: password.sh,v 1.2 2025/06/29 08:20:21 dtucker Exp $ 2*644b4646SEd Maste# Placed in the Public Domain. 3*644b4646SEd Maste# 4*644b4646SEd Maste# This tests standard "password" authentication. It does not run by default, 5*644b4646SEd Maste# and needs to be enabled by putting the password of the user running the tests 6*644b4646SEd Maste# into ${OBJ}/password. Since this obviously puts the password at risk it is 7*644b4646SEd Maste# recommended to do this on a throwaway VM by setting a random password 8*644b4646SEd Maste# (and randomizing it again after the test, if you can't immediately dispose 9*644b4646SEd Maste# of the VM). 10*644b4646SEd Maste 11*644b4646SEd Mastetid="password" 12*644b4646SEd Maste 13*644b4646SEd Masteif [ -z "$SUDO" -o ! -f ${OBJ}/password ]; then 14*644b4646SEd Maste skip "Password auth requires SUDO and password file." 15*644b4646SEd Mastefi 16*644b4646SEd Maste 17*644b4646SEd Maste# Enable password auth 18*644b4646SEd Masteecho "PasswordAuthentication yes" >>sshd_proxy 19*644b4646SEd Maste 20*644b4646SEd Maste# Create askpass script to replay a series of password responses. 21*644b4646SEd Maste# Keep a counter of the number of times it has been called and 22*644b4646SEd Maste# reply with the next line of the replypass file. 23*644b4646SEd Mastecat >${OBJ}/replypass.sh <<EOD 24*644b4646SEd Maste#!/bin/sh 25*644b4646SEd Masten=\`cat ${OBJ}/replypass.N\` 26*644b4646SEd Masteawk "NR==\$n" ${OBJ}/replypass 27*644b4646SEd Masteecho \$(( \$n + 1 )) >${OBJ}/replypass.N 28*644b4646SEd MasteEOD 29*644b4646SEd Mastechmod 700 ${OBJ}/replypass.sh 30*644b4646SEd Maste 31*644b4646SEd MasteSSH_ASKPASS=${OBJ}/replypass.sh 32*644b4646SEd MasteSSH_ASKPASS_REQUIRE=force 33*644b4646SEd Masteexport SSH_ASKPASS SSH_ASKPASS_REQUIRE 34*644b4646SEd Maste 35*644b4646SEd Masteopts="-oPasswordAuthentication=yes -oPreferredAuthentications=password" 36*644b4646SEd Masteopts="-oBatchMode=no $opts" 37*644b4646SEd Maste 38*644b4646SEd Mastetrace plain password 39*644b4646SEd Mastecat ${OBJ}/password >${OBJ}/replypass 40*644b4646SEd Masteecho 1 >${OBJ}/replypass.N 41*644b4646SEd Maste${SSH} $opts -F $OBJ/ssh_proxy somehost true 42*644b4646SEd Masteif [ $? -ne 0 ]; then 43*644b4646SEd Maste fail "ssh password failed" 44*644b4646SEd Mastefi 45*644b4646SEd Maste 46*644b4646SEd Mastetrace 2-round password 47*644b4646SEd Maste(echo; cat ${OBJ}/password) >${OBJ}/replypass 48*644b4646SEd Masteecho 1 >${OBJ}/replypass.N 49*644b4646SEd Maste${SSH} $opts -F $OBJ/ssh_proxy somehost true 50*644b4646SEd Masteif [ $? -ne 0 ]; then 51*644b4646SEd Maste fail "ssh 2-round password failed" 52*644b4646SEd Mastefi 53*644b4646SEd Maste 54*644b4646SEd Mastetrace empty password 55*644b4646SEd Masteecho >${OBJ}/replypass 56*644b4646SEd Masteecho 1 >${OBJ}/replypass.N 57*644b4646SEd Maste${SSH} $opts -F $OBJ/ssh_proxy somehost true 58*644b4646SEd Masteif [ $? -eq 0 ]; then 59*644b4646SEd Maste fail "ssh password failed" 60*644b4646SEd Mastefi 61