#!/bin/sh
# With UsePAM=no, sshd verifies the password itself via crypt().
# Built without libcrypt, valid logins fail as if the password were wrong.
set -e

TESTUSER=nopamtest
TESTPASS=Passw0rd-nopam
PORT=2022
WORKDIR=$(mktemp -d)

cleanup() {
    [ -f "$WORKDIR/sshd.pid" ] && kill "$(cat "$WORKDIR/sshd.pid")" 2>/dev/null || true
    userdel -r "$TESTUSER" 2>/dev/null || true
    rm -rf "$WORKDIR"
}
trap cleanup EXIT

useradd -m -s /bin/sh "$TESTUSER"
echo "$TESTUSER:$TESTPASS" | chpasswd

ssh-keygen -q -t ed25519 -f "$WORKDIR/hostkey" -N ""
cat > "$WORKDIR/sshd_config" <<EOF
Port $PORT
ListenAddress 127.0.0.1
HostKey $WORKDIR/hostkey
PidFile $WORKDIR/sshd.pid
UsePAM no
PasswordAuthentication yes
KbdInteractiveAuthentication no
PubkeyAuthentication no
EOF

/usr/sbin/sshd -f "$WORKDIR/sshd_config"

sshpass -p "$TESTPASS" \
    ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
        -o PreferredAuthentications=password \
        -p "$PORT" "$TESTUSER@127.0.0.1" true

echo "PASS: UsePAM=no password authentication succeeded"
