2 Samba Unix/Linux SMB client library
3 Distributed SMB/CIFS Server Management Utility
4 Copyright (C) 2001 Andrew Bartlett (abartlet@samba.org)
5 Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
6 Copyright (C) 2004,2008 Guenther Deschner (gd@samba.org)
7 Copyright (C) 2005 Jeremy Allison (jra@samba.org)
8 Copyright (C) 2006 Jelmer Vernooij (jelmer@samba.org)
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>. */
24 #include "utils/net.h"
25 #include "rpc_client/cli_pipe.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../librpc/gen_ndr/ndr_samr_c.h"
28 #include "rpc_client/cli_samr.h"
29 #include "rpc_client/init_samr.h"
30 #include "../librpc/gen_ndr/ndr_lsa_c.h"
31 #include "rpc_client/cli_lsarpc.h"
32 #include "../librpc/gen_ndr/ndr_netlogon_c.h"
33 #include "../librpc/gen_ndr/ndr_srvsvc_c.h"
34 #include "../librpc/gen_ndr/ndr_spoolss.h"
35 #include "../librpc/gen_ndr/ndr_initshutdown_c.h"
36 #include "../librpc/gen_ndr/ndr_winreg_c.h"
38 #include "lib/netapi/netapi.h"
39 #include "lib/netapi/netapi_net.h"
40 #include "rpc_client/init_lsa.h"
41 #include "../libcli/security/security.h"
42 #include "libsmb/libsmb.h"
43 #include "libsmb/clirap.h"
44 #include "nsswitch/libwbclient/wbclient.h"
46 #include "../libcli/smb/smbXcli_base.h"
48 static int net_mode_share
;
49 static NTSTATUS
sync_files(struct copy_clistate
*cp_clistate
, const char *mask
);
54 * @brief RPC based subcommands for the 'net' utility.
56 * This file should contain much of the functionality that used to
57 * be found in rpcclient, execpt that the commands should change
58 * less often, and the fucntionality should be sane (the user is not
59 * expected to know a rid/sid before they conduct an operation etc.)
61 * @todo Perhaps eventually these should be split out into a number
62 * of files, as this could get quite big.
67 * Many of the RPC functions need the domain sid. This function gets
68 * it at the start of every run
70 * @param cli A cli_state already connected to the remote machine
72 * @return The Domain SID of the remote machine.
75 NTSTATUS
net_get_remote_domain_sid(struct cli_state
*cli
, TALLOC_CTX
*mem_ctx
,
76 struct dom_sid
**domain_sid
,
77 const char **domain_name
)
79 struct rpc_pipe_client
*lsa_pipe
= NULL
;
80 struct policy_handle pol
;
81 NTSTATUS status
, result
;
82 union lsa_PolicyInformation
*info
= NULL
;
83 struct dcerpc_binding_handle
*b
;
85 status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
87 if (!NT_STATUS_IS_OK(status
)) {
88 d_fprintf(stderr
, _("Could not initialise lsa pipe\n"));
92 b
= lsa_pipe
->binding_handle
;
94 status
= rpccli_lsa_open_policy(lsa_pipe
, mem_ctx
, false,
95 SEC_FLAG_MAXIMUM_ALLOWED
,
97 if (!NT_STATUS_IS_OK(status
)) {
98 d_fprintf(stderr
, "open_policy %s: %s\n",
104 status
= dcerpc_lsa_QueryInfoPolicy(b
, mem_ctx
,
106 LSA_POLICY_INFO_ACCOUNT_DOMAIN
,
109 if (!NT_STATUS_IS_OK(status
)) {
110 d_fprintf(stderr
, "lsaquery %s: %s\n",
115 if (!NT_STATUS_IS_OK(result
)) {
116 d_fprintf(stderr
, "lsaquery %s: %s\n",
122 *domain_name
= info
->account_domain
.name
.string
;
123 *domain_sid
= info
->account_domain
.sid
;
125 dcerpc_lsa_Close(b
, mem_ctx
, &pol
, &result
);
126 TALLOC_FREE(lsa_pipe
);
132 * Run a single RPC command, from start to finish.
134 * @param pipe_name the pipe to connect to (usually a PIPE_ constant)
135 * @param conn_flag a NET_FLAG_ combination. Passed to
136 * net_make_ipc_connection.
137 * @param argc Standard main() style argc.
138 * @param argv Standard main() style argv. Initial components are already
140 * @return A shell status integer (0 for success).
143 int run_rpc_command(struct net_context
*c
,
144 struct cli_state
*cli_arg
,
145 const struct ndr_interface_table
*table
,
151 struct cli_state
*cli
= NULL
;
152 struct rpc_pipe_client
*pipe_hnd
= NULL
;
155 struct dom_sid
*domain_sid
;
156 const char *domain_name
;
159 /* make use of cli_state handed over as an argument, if possible */
161 nt_status
= net_make_ipc_connection(c
, conn_flags
, &cli
);
162 if (!NT_STATUS_IS_OK(nt_status
)) {
163 DEBUG(1, ("failed to make ipc connection: %s\n",
164 nt_errstr(nt_status
)));
177 if (!(mem_ctx
= talloc_init("run_rpc_command"))) {
178 DEBUG(0, ("talloc_init() failed\n"));
182 nt_status
= net_get_remote_domain_sid(cli
, mem_ctx
, &domain_sid
,
184 if (!NT_STATUS_IS_OK(nt_status
)) {
188 if (!(conn_flags
& NET_FLAGS_NO_PIPE
)) {
189 if (lp_client_schannel()
190 && (ndr_syntax_id_equal(&table
->syntax_id
,
191 &ndr_table_netlogon
.syntax_id
))) {
192 /* Always try and create an schannel netlogon pipe. */
193 nt_status
= cli_rpc_pipe_open_schannel(
194 cli
, &table
->syntax_id
, NCACN_NP
,
195 DCERPC_AUTH_LEVEL_PRIVACY
, domain_name
,
197 if (!NT_STATUS_IS_OK(nt_status
)) {
198 DEBUG(0, ("Could not initialise schannel netlogon pipe. Error was %s\n",
199 nt_errstr(nt_status
) ));
203 if (conn_flags
& NET_FLAGS_SEAL
) {
204 nt_status
= cli_rpc_pipe_open_generic_auth(
206 (conn_flags
& NET_FLAGS_TCP
) ?
207 NCACN_IP_TCP
: NCACN_NP
,
208 DCERPC_AUTH_TYPE_NTLMSSP
,
209 DCERPC_AUTH_LEVEL_PRIVACY
,
210 smbXcli_conn_remote_name(cli
->conn
),
211 lp_workgroup(), c
->opt_user_name
,
212 c
->opt_password
, &pipe_hnd
);
214 nt_status
= cli_rpc_pipe_open_noauth(
215 cli
, &table
->syntax_id
,
218 if (!NT_STATUS_IS_OK(nt_status
)) {
219 DEBUG(0, ("Could not initialise pipe %s. Error was %s\n",
221 nt_errstr(nt_status
) ));
227 nt_status
= fn(c
, domain_sid
, domain_name
, cli
, pipe_hnd
, mem_ctx
, argc
, argv
);
229 if (!NT_STATUS_IS_OK(nt_status
)) {
230 DEBUG(1, ("rpc command function failed! (%s)\n", nt_errstr(nt_status
)));
233 DEBUG(5, ("rpc command function succedded\n"));
236 if (!(conn_flags
& NET_FLAGS_NO_PIPE
)) {
238 TALLOC_FREE(pipe_hnd
);
243 /* close the connection only if it was opened here */
248 talloc_destroy(mem_ctx
);
253 * Force a change of the trust acccount password.
255 * All parameters are provided by the run_rpc_command function, except for
256 * argc, argv which are passed through.
258 * @param domain_sid The domain sid acquired from the remote server.
259 * @param cli A cli_state connected to the server.
260 * @param mem_ctx Talloc context, destroyed on completion of the function.
261 * @param argc Standard main() style argc.
262 * @param argv Standard main() style argv. Initial components are already
265 * @return Normal NTSTATUS return.
268 static NTSTATUS
rpc_changetrustpw_internals(struct net_context
*c
,
269 const struct dom_sid
*domain_sid
,
270 const char *domain_name
,
271 struct cli_state
*cli
,
272 struct rpc_pipe_client
*pipe_hnd
,
279 status
= trust_pw_find_change_and_store_it(pipe_hnd
, mem_ctx
, c
->opt_target_workgroup
);
280 if (!NT_STATUS_IS_OK(status
)) {
281 d_fprintf(stderr
, _("Failed to change machine account password: %s\n"),
290 * Force a change of the trust acccount password.
292 * @param argc Standard main() style argc.
293 * @param argv Standard main() style argv. Initial components are already
296 * @return A shell status integer (0 for success).
299 int net_rpc_changetrustpw(struct net_context
*c
, int argc
, const char **argv
)
301 if (c
->display_usage
) {
303 "net rpc changetrustpw\n"
306 _("Change the machine trust password"));
310 return run_rpc_command(c
, NULL
, &ndr_table_netlogon
,
311 NET_FLAGS_ANONYMOUS
| NET_FLAGS_PDC
,
312 rpc_changetrustpw_internals
,
317 * Join a domain, the old way.
319 * This uses 'machinename' as the inital password, and changes it.
321 * The password should be created with 'server manager' or equiv first.
323 * All parameters are provided by the run_rpc_command function, except for
324 * argc, argv which are passed through.
326 * @param domain_sid The domain sid acquired from the remote server.
327 * @param cli A cli_state connected to the server.
328 * @param mem_ctx Talloc context, destroyed on completion of the function.
329 * @param argc Standard main() style argc.
330 * @param argv Standard main() style argv. Initial components are already
333 * @return Normal NTSTATUS return.
336 static NTSTATUS
rpc_oldjoin_internals(struct net_context
*c
,
337 const struct dom_sid
*domain_sid
,
338 const char *domain_name
,
339 struct cli_state
*cli
,
340 struct rpc_pipe_client
*pipe_hnd
,
346 fstring trust_passwd
;
347 unsigned char orig_trust_passwd_hash
[16];
349 enum netr_SchannelType sec_channel_type
;
351 result
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_netlogon
.syntax_id
,
353 if (!NT_STATUS_IS_OK(result
)) {
354 DEBUG(0,("rpc_oldjoin_internals: netlogon pipe open to machine %s failed. "
356 smbXcli_conn_remote_name(cli
->conn
),
357 nt_errstr(result
) ));
362 check what type of join - if the user want's to join as
363 a BDC, the server must agree that we are a BDC.
366 sec_channel_type
= get_sec_channel_type(argv
[0]);
368 sec_channel_type
= get_sec_channel_type(NULL
);
371 fstrcpy(trust_passwd
, lp_netbios_name());
372 strlower_m(trust_passwd
);
375 * Machine names can be 15 characters, but the max length on
376 * a password is 14. --jerry
379 trust_passwd
[14] = '\0';
381 E_md4hash(trust_passwd
, orig_trust_passwd_hash
);
383 result
= trust_pw_change_and_store_it(pipe_hnd
, mem_ctx
, c
->opt_target_workgroup
,
385 orig_trust_passwd_hash
,
388 if (NT_STATUS_IS_OK(result
))
389 printf(_("Joined domain %s.\n"), c
->opt_target_workgroup
);
392 if (!secrets_store_domain_sid(c
->opt_target_workgroup
, domain_sid
)) {
393 DEBUG(0, ("error storing domain sid for %s\n", c
->opt_target_workgroup
));
394 result
= NT_STATUS_UNSUCCESSFUL
;
401 * Join a domain, the old way.
403 * @param argc Standard main() style argc.
404 * @param argv Standard main() style argv. Initial components are already
407 * @return A shell status integer (0 for success).
410 static int net_rpc_perform_oldjoin(struct net_context
*c
, int argc
, const char **argv
)
412 return run_rpc_command(c
, NULL
, &ndr_table_netlogon
,
413 NET_FLAGS_NO_PIPE
| NET_FLAGS_ANONYMOUS
| NET_FLAGS_PDC
,
414 rpc_oldjoin_internals
,
419 * Join a domain, the old way. This function exists to allow
420 * the message to be displayed when oldjoin was explicitly
421 * requested, but not when it was implied by "net rpc join".
423 * @param argc Standard main() style argc.
424 * @param argv Standard main() style argv. Initial components are already
427 * @return A shell status integer (0 for success).
430 static int net_rpc_oldjoin(struct net_context
*c
, int argc
, const char **argv
)
434 if (c
->display_usage
) {
439 _("Join a domain the old way"));
443 rc
= net_rpc_perform_oldjoin(c
, argc
, argv
);
446 d_fprintf(stderr
, _("Failed to join domain\n"));
453 * 'net rpc join' entrypoint.
454 * @param argc Standard main() style argc.
455 * @param argv Standard main() style argv. Initial components are already
458 * Main 'net_rpc_join()' (where the admin username/password is used) is
460 * Try to just change the password, but if that doesn't work, use/prompt
461 * for a username/password.
464 int net_rpc_join(struct net_context
*c
, int argc
, const char **argv
)
466 if (c
->display_usage
) {
469 _("net rpc join -U <username>[%%password] <type>\n"
471 " username\tName of the admin user"
472 " password\tPassword of the admin user, will "
473 "prompt if not specified\n"
474 " type\tCan be one of the following:\n"
475 "\t\tMEMBER\tJoin as member server (default)\n"
476 "\t\tBDC\tJoin as BDC\n"
477 "\t\tPDC\tJoin as PDC\n"));
481 if (lp_server_role() == ROLE_STANDALONE
) {
482 d_printf(_("cannot join as standalone machine\n"));
486 if (strlen(lp_netbios_name()) > 15) {
487 d_printf(_("Our netbios name can be at most 15 chars long, "
488 "\"%s\" is %u chars long\n"),
489 lp_netbios_name(), (unsigned int)strlen(lp_netbios_name()));
493 if ((net_rpc_perform_oldjoin(c
, argc
, argv
) == 0))
496 return net_rpc_join_newstyle(c
, argc
, argv
);
500 * display info about a rpc domain
502 * All parameters are provided by the run_rpc_command function, except for
503 * argc, argv which are passed through.
505 * @param domain_sid The domain sid acquired from the remote server
506 * @param cli A cli_state connected to the server.
507 * @param mem_ctx Talloc context, destroyed on completion of the function.
508 * @param argc Standard main() style argc.
509 * @param argv Standard main() style argv. Initial components are already
512 * @return Normal NTSTATUS return.
515 NTSTATUS
rpc_info_internals(struct net_context
*c
,
516 const struct dom_sid
*domain_sid
,
517 const char *domain_name
,
518 struct cli_state
*cli
,
519 struct rpc_pipe_client
*pipe_hnd
,
524 struct policy_handle connect_pol
, domain_pol
;
525 NTSTATUS status
, result
;
526 union samr_DomainInfo
*info
= NULL
;
528 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
530 sid_to_fstring(sid_str
, domain_sid
);
532 /* Get sam policy handle */
533 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
535 MAXIMUM_ALLOWED_ACCESS
,
538 if (!NT_STATUS_IS_OK(status
)) {
539 d_fprintf(stderr
, _("Could not connect to SAM: %s\n"),
544 if (!NT_STATUS_IS_OK(result
)) {
546 d_fprintf(stderr
, _("Could not connect to SAM: %s\n"),
551 /* Get domain policy handle */
552 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
554 MAXIMUM_ALLOWED_ACCESS
,
555 discard_const_p(struct dom_sid2
, domain_sid
),
558 if (!NT_STATUS_IS_OK(status
)) {
559 d_fprintf(stderr
, _("Could not open domain: %s\n"),
563 if (!NT_STATUS_IS_OK(result
)) {
565 d_fprintf(stderr
, _("Could not open domain: %s\n"),
570 status
= dcerpc_samr_QueryDomainInfo(b
, mem_ctx
,
575 if (!NT_STATUS_IS_OK(status
)) {
579 if (NT_STATUS_IS_OK(result
)) {
580 d_printf(_("Domain Name: %s\n"),
581 info
->general
.domain_name
.string
);
582 d_printf(_("Domain SID: %s\n"), sid_str
);
583 d_printf(_("Sequence number: %llu\n"),
584 (unsigned long long)info
->general
.sequence_num
);
585 d_printf(_("Num users: %u\n"), info
->general
.num_users
);
586 d_printf(_("Num domain groups: %u\n"),info
->general
.num_groups
);
587 d_printf(_("Num local groups: %u\n"),info
->general
.num_aliases
);
595 * 'net rpc info' entrypoint.
596 * @param argc Standard main() style argc.
597 * @param argv Standard main() style argv. Initial components are already
601 int net_rpc_info(struct net_context
*c
, int argc
, const char **argv
)
603 if (c
->display_usage
) {
608 _("Display information about the domain"));
612 return run_rpc_command(c
, NULL
, &ndr_table_samr
,
613 NET_FLAGS_PDC
, rpc_info_internals
,
618 * Fetch domain SID into the local secrets.tdb.
620 * All parameters are provided by the run_rpc_command function, except for
621 * argc, argv which are passed through.
623 * @param domain_sid The domain sid acquired from the remote server.
624 * @param cli A cli_state connected to the server.
625 * @param mem_ctx Talloc context, destroyed on completion of the function.
626 * @param argc Standard main() style argc.
627 * @param argv Standard main() style argv. Initial components are already
630 * @return Normal NTSTATUS return.
633 static NTSTATUS
rpc_getsid_internals(struct net_context
*c
,
634 const struct dom_sid
*domain_sid
,
635 const char *domain_name
,
636 struct cli_state
*cli
,
637 struct rpc_pipe_client
*pipe_hnd
,
644 sid_to_fstring(sid_str
, domain_sid
);
645 d_printf(_("Storing SID %s for Domain %s in secrets.tdb\n"),
646 sid_str
, domain_name
);
648 if (!secrets_store_domain_sid(domain_name
, domain_sid
)) {
649 DEBUG(0,("Can't store domain SID\n"));
650 return NT_STATUS_UNSUCCESSFUL
;
657 * 'net rpc getsid' entrypoint.
658 * @param argc Standard main() style argc.
659 * @param argv Standard main() style argv. Initial components are already
663 int net_rpc_getsid(struct net_context
*c
, int argc
, const char **argv
)
665 int conn_flags
= NET_FLAGS_PDC
;
667 if (!c
->opt_user_specified
) {
668 conn_flags
|= NET_FLAGS_ANONYMOUS
;
671 if (c
->display_usage
) {
676 _("Fetch domain SID into local secrets.tdb"));
680 return run_rpc_command(c
, NULL
, &ndr_table_samr
,
682 rpc_getsid_internals
,
686 /****************************************************************************/
689 * Basic usage function for 'net rpc user'.
690 * @param argc Standard main() style argc.
691 * @param argv Standard main() style argv. Initial components are already
695 static int rpc_user_usage(struct net_context
*c
, int argc
, const char **argv
)
697 return net_user_usage(c
, argc
, argv
);
701 * Add a new user to a remote RPC server.
703 * @param argc Standard main() style argc.
704 * @param argv Standard main() style argv. Initial components are already
707 * @return A shell status integer (0 for success).
710 static int rpc_user_add(struct net_context
*c
, int argc
, const char **argv
)
712 NET_API_STATUS status
;
713 struct USER_INFO_1 info1
;
714 uint32_t parm_error
= 0;
716 if (argc
< 1 || c
->display_usage
) {
717 rpc_user_usage(c
, argc
, argv
);
723 info1
.usri1_name
= argv
[0];
725 info1
.usri1_password
= argv
[1];
728 status
= NetUserAdd(c
->opt_host
, 1, (uint8_t *)&info1
, &parm_error
);
731 d_fprintf(stderr
,_("Failed to add user '%s' with error: %s.\n"),
732 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
736 d_printf(_("Added user '%s'.\n"), argv
[0]);
743 * Rename a user on a remote RPC server.
745 * @param argc Standard main() style argc.
746 * @param argv Standard main() style argv. Initial components are already
749 * @return A shell status integer (0 for success).
752 static int rpc_user_rename(struct net_context
*c
, int argc
, const char **argv
)
754 NET_API_STATUS status
;
755 struct USER_INFO_0 u0
;
756 uint32_t parm_err
= 0;
758 if (argc
!= 2 || c
->display_usage
) {
759 rpc_user_usage(c
, argc
, argv
);
763 u0
.usri0_name
= argv
[1];
765 status
= NetUserSetInfo(c
->opt_host
, argv
[0],
766 0, (uint8_t *)&u0
, &parm_err
);
769 _("Failed to rename user from %s to %s - %s\n"),
771 libnetapi_get_error_string(c
->netapi_ctx
, status
));
773 d_printf(_("Renamed user from %s to %s\n"), argv
[0], argv
[1]);
780 * Set a user's primary group
782 * @param argc Standard main() style argc.
783 * @param argv Standard main() style argv. Initial components are already
786 * @return A shell status integer (0 for success).
789 static int rpc_user_setprimarygroup(struct net_context
*c
, int argc
,
792 NET_API_STATUS status
;
794 struct GROUP_INFO_2
*g2
;
795 struct USER_INFO_1051 u1051
;
796 uint32_t parm_err
= 0;
798 if (argc
!= 2 || c
->display_usage
) {
799 rpc_user_usage(c
, argc
, argv
);
803 status
= NetGroupGetInfo(c
->opt_host
, argv
[1], 2, &buffer
);
805 d_fprintf(stderr
, _("Failed to find group name %s -- %s\n"),
807 libnetapi_get_error_string(c
->netapi_ctx
, status
));
810 g2
= (struct GROUP_INFO_2
*)buffer
;
812 u1051
.usri1051_primary_group_id
= g2
->grpi2_group_id
;
814 NetApiBufferFree(buffer
);
816 status
= NetUserSetInfo(c
->opt_host
, argv
[0], 1051,
817 (uint8_t *)&u1051
, &parm_err
);
820 _("Failed to set user's primary group %s to %s - "
821 "%s\n"), argv
[0], argv
[1],
822 libnetapi_get_error_string(c
->netapi_ctx
, status
));
824 d_printf(_("Set primary group of user %s to %s\n"), argv
[0],
831 * Delete a user from a remote RPC server.
833 * @param argc Standard main() style argc.
834 * @param argv Standard main() style argv. Initial components are already
837 * @return A shell status integer (0 for success).
840 static int rpc_user_delete(struct net_context
*c
, int argc
, const char **argv
)
842 NET_API_STATUS status
;
844 if (argc
< 1 || c
->display_usage
) {
845 rpc_user_usage(c
, argc
, argv
);
849 status
= NetUserDel(c
->opt_host
, argv
[0]);
852 d_fprintf(stderr
, _("Failed to delete user '%s' with: %s.\n"),
854 libnetapi_get_error_string(c
->netapi_ctx
, status
));
857 d_printf(_("Deleted user '%s'.\n"), argv
[0]);
864 * Set a user's password on a remote RPC server.
866 * @param argc Standard main() style argc.
867 * @param argv Standard main() style argv. Initial components are already
870 * @return A shell status integer (0 for success).
873 static int rpc_user_password(struct net_context
*c
, int argc
, const char **argv
)
875 NET_API_STATUS status
;
877 struct USER_INFO_1003 u1003
;
878 uint32_t parm_err
= 0;
881 if (argc
< 1 || c
->display_usage
) {
882 rpc_user_usage(c
, argc
, argv
);
887 u1003
.usri1003_password
= argv
[1];
889 ret
= asprintf(&prompt
, _("Enter new password for %s:"),
894 u1003
.usri1003_password
= talloc_strdup(c
, getpass(prompt
));
896 if (u1003
.usri1003_password
== NULL
) {
901 status
= NetUserSetInfo(c
->opt_host
, argv
[0], 1003, (uint8_t *)&u1003
, &parm_err
);
903 /* Display results */
906 _("Failed to set password for '%s' with error: %s.\n"),
907 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
916 * List a user's groups from a remote RPC server.
918 * @param argc Standard main() style argc.
919 * @param argv Standard main() style argv. Initial components are already
922 * @return A shell status integer (0 for success)
925 static int rpc_user_info(struct net_context
*c
, int argc
, const char **argv
)
928 NET_API_STATUS status
;
929 struct GROUP_USERS_INFO_0
*u0
= NULL
;
930 uint32_t entries_read
= 0;
931 uint32_t total_entries
= 0;
935 if (argc
< 1 || c
->display_usage
) {
936 rpc_user_usage(c
, argc
, argv
);
940 status
= NetUserGetGroups(c
->opt_host
,
943 (uint8_t **)(void *)&u0
,
949 _("Failed to get groups for '%s' with error: %s.\n"),
950 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
955 for (i
=0; i
< entries_read
; i
++) {
956 printf("%s\n", u0
->grui0_name
);
964 * List users on a remote RPC server.
966 * All parameters are provided by the run_rpc_command function, except for
967 * argc, argv which are passed through.
969 * @param domain_sid The domain sid acquired from the remote server.
970 * @param cli A cli_state connected to the server.
971 * @param mem_ctx Talloc context, destroyed on completion of the function.
972 * @param argc Standard main() style argc.
973 * @param argv Standard main() style argv. Initial components are already
976 * @return Normal NTSTATUS return.
979 static int rpc_user_list(struct net_context
*c
, int argc
, const char **argv
)
981 NET_API_STATUS status
;
982 uint32_t start_idx
=0, num_entries
, i
, loop_count
= 0;
983 struct NET_DISPLAY_USER
*info
= NULL
;
986 /* Query domain users */
987 if (c
->opt_long_list_entries
)
988 d_printf(_("\nUser name Comment"
989 "\n-----------------------------\n"));
991 uint32_t max_entries
, max_size
;
993 dcerpc_get_query_dispinfo_params(
994 loop_count
, &max_entries
, &max_size
);
996 status
= NetQueryDisplayInformation(c
->opt_host
,
1003 if (status
!= 0 && status
!= ERROR_MORE_DATA
) {
1007 info
= (struct NET_DISPLAY_USER
*)buffer
;
1009 for (i
= 0; i
< num_entries
; i
++) {
1011 if (c
->opt_long_list_entries
)
1012 printf("%-21.21s %s\n", info
->usri1_name
,
1013 info
->usri1_comment
);
1015 printf("%s\n", info
->usri1_name
);
1019 NetApiBufferFree(buffer
);
1022 start_idx
+= num_entries
;
1024 } while (status
== ERROR_MORE_DATA
);
1030 * 'net rpc user' entrypoint.
1031 * @param argc Standard main() style argc.
1032 * @param argv Standard main() style argv. Initial components are already
1036 int net_rpc_user(struct net_context
*c
, int argc
, const char **argv
)
1038 NET_API_STATUS status
;
1040 struct functable func
[] = {
1045 N_("Add specified user"),
1046 N_("net rpc user add\n"
1047 " Add specified user")
1053 N_("List domain groups of user"),
1054 N_("net rpc user info\n"
1055 " List domain groups of user")
1061 N_("Remove specified user"),
1062 N_("net rpc user delete\n"
1063 " Remove specified user")
1069 N_("Change user password"),
1070 N_("net rpc user password\n"
1071 " Change user password")
1077 N_("Rename specified user"),
1078 N_("net rpc user rename\n"
1079 " Rename specified user")
1083 rpc_user_setprimarygroup
,
1085 "Set a user's primary group",
1086 "net rpc user setprimarygroup\n"
1087 " Set a user's primary group"
1089 {NULL
, NULL
, 0, NULL
, NULL
}
1092 status
= libnetapi_net_init(&c
->netapi_ctx
);
1096 libnetapi_set_username(c
->netapi_ctx
, c
->opt_user_name
);
1097 libnetapi_set_password(c
->netapi_ctx
, c
->opt_password
);
1098 if (c
->opt_kerberos
) {
1099 libnetapi_set_use_kerberos(c
->netapi_ctx
);
1103 if (c
->display_usage
) {
1108 _("List all users"));
1109 net_display_usage_from_functable(func
);
1113 return rpc_user_list(c
, argc
, argv
);
1116 return net_run_function(c
, argc
, argv
, "net rpc user", func
);
1119 static NTSTATUS
rpc_sh_user_list(struct net_context
*c
,
1120 TALLOC_CTX
*mem_ctx
,
1121 struct rpc_sh_ctx
*ctx
,
1122 struct rpc_pipe_client
*pipe_hnd
,
1123 int argc
, const char **argv
)
1125 return werror_to_ntstatus(W_ERROR(rpc_user_list(c
, argc
, argv
)));
1128 static NTSTATUS
rpc_sh_user_info(struct net_context
*c
,
1129 TALLOC_CTX
*mem_ctx
,
1130 struct rpc_sh_ctx
*ctx
,
1131 struct rpc_pipe_client
*pipe_hnd
,
1132 int argc
, const char **argv
)
1134 return werror_to_ntstatus(W_ERROR(rpc_user_info(c
, argc
, argv
)));
1137 static NTSTATUS
rpc_sh_handle_user(struct net_context
*c
,
1138 TALLOC_CTX
*mem_ctx
,
1139 struct rpc_sh_ctx
*ctx
,
1140 struct rpc_pipe_client
*pipe_hnd
,
1141 int argc
, const char **argv
,
1143 struct net_context
*c
,
1144 TALLOC_CTX
*mem_ctx
,
1145 struct rpc_sh_ctx
*ctx
,
1146 struct rpc_pipe_client
*pipe_hnd
,
1147 struct policy_handle
*user_hnd
,
1148 int argc
, const char **argv
))
1150 struct policy_handle connect_pol
, domain_pol
, user_pol
;
1151 NTSTATUS status
, result
;
1154 enum lsa_SidType type
;
1155 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
1158 d_fprintf(stderr
, "%s %s <username>\n", _("Usage:"),
1160 return NT_STATUS_INVALID_PARAMETER
;
1163 ZERO_STRUCT(connect_pol
);
1164 ZERO_STRUCT(domain_pol
);
1165 ZERO_STRUCT(user_pol
);
1167 status
= net_rpc_lookup_name(c
, mem_ctx
, rpc_pipe_np_smb_conn(pipe_hnd
),
1168 argv
[0], NULL
, NULL
, &sid
, &type
);
1169 if (!NT_STATUS_IS_OK(status
)) {
1170 d_fprintf(stderr
, _("Could not lookup %s: %s\n"), argv
[0],
1175 if (type
!= SID_NAME_USER
) {
1176 d_fprintf(stderr
, _("%s is a %s, not a user\n"), argv
[0],
1177 sid_type_lookup(type
));
1178 status
= NT_STATUS_NO_SUCH_USER
;
1182 if (!sid_peek_check_rid(ctx
->domain_sid
, &sid
, &rid
)) {
1183 d_fprintf(stderr
, _("%s is not in our domain\n"), argv
[0]);
1184 status
= NT_STATUS_NO_SUCH_USER
;
1188 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
1190 MAXIMUM_ALLOWED_ACCESS
,
1193 if (!NT_STATUS_IS_OK(status
)) {
1196 if (!NT_STATUS_IS_OK(result
)) {
1201 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
1203 MAXIMUM_ALLOWED_ACCESS
,
1207 if (!NT_STATUS_IS_OK(status
)) {
1210 if (!NT_STATUS_IS_OK(result
)) {
1215 status
= dcerpc_samr_OpenUser(b
, mem_ctx
,
1217 MAXIMUM_ALLOWED_ACCESS
,
1221 if (!NT_STATUS_IS_OK(status
)) {
1224 if (!NT_STATUS_IS_OK(result
)) {
1229 status
= fn(c
, mem_ctx
, ctx
, pipe_hnd
, &user_pol
, argc
-1, argv
+1);
1232 if (is_valid_policy_hnd(&user_pol
)) {
1233 dcerpc_samr_Close(b
, mem_ctx
, &user_pol
, &result
);
1235 if (is_valid_policy_hnd(&domain_pol
)) {
1236 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
1238 if (is_valid_policy_hnd(&connect_pol
)) {
1239 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
1244 static NTSTATUS
rpc_sh_user_show_internals(struct net_context
*c
,
1245 TALLOC_CTX
*mem_ctx
,
1246 struct rpc_sh_ctx
*ctx
,
1247 struct rpc_pipe_client
*pipe_hnd
,
1248 struct policy_handle
*user_hnd
,
1249 int argc
, const char **argv
)
1251 NTSTATUS status
, result
;
1252 union samr_UserInfo
*info
= NULL
;
1253 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
1256 d_fprintf(stderr
, "%s %s show <username>\n", _("Usage:"),
1258 return NT_STATUS_INVALID_PARAMETER
;
1261 status
= dcerpc_samr_QueryUserInfo(b
, mem_ctx
,
1266 if (!NT_STATUS_IS_OK(status
)) {
1269 if (!NT_STATUS_IS_OK(result
)) {
1273 d_printf(_("user rid: %d, group rid: %d\n"),
1275 info
->info21
.primary_gid
);
1280 static NTSTATUS
rpc_sh_user_show(struct net_context
*c
,
1281 TALLOC_CTX
*mem_ctx
,
1282 struct rpc_sh_ctx
*ctx
,
1283 struct rpc_pipe_client
*pipe_hnd
,
1284 int argc
, const char **argv
)
1286 return rpc_sh_handle_user(c
, mem_ctx
, ctx
, pipe_hnd
, argc
, argv
,
1287 rpc_sh_user_show_internals
);
1290 #define FETCHSTR(name, rec) \
1291 do { if (strequal(ctx->thiscmd, name)) { \
1292 oldval = talloc_strdup(mem_ctx, info->info21.rec.string); } \
1295 #define SETSTR(name, rec, flag) \
1296 do { if (strequal(ctx->thiscmd, name)) { \
1297 init_lsa_String(&(info->info21.rec), argv[0]); \
1298 info->info21.fields_present |= SAMR_FIELD_##flag; } \
1301 static NTSTATUS
rpc_sh_user_str_edit_internals(struct net_context
*c
,
1302 TALLOC_CTX
*mem_ctx
,
1303 struct rpc_sh_ctx
*ctx
,
1304 struct rpc_pipe_client
*pipe_hnd
,
1305 struct policy_handle
*user_hnd
,
1306 int argc
, const char **argv
)
1308 NTSTATUS status
, result
;
1309 const char *username
;
1310 const char *oldval
= "";
1311 union samr_UserInfo
*info
= NULL
;
1312 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
1315 d_fprintf(stderr
, "%s %s <username> [new value|NULL]\n",
1316 _("Usage:"), ctx
->whoami
);
1317 return NT_STATUS_INVALID_PARAMETER
;
1320 status
= dcerpc_samr_QueryUserInfo(b
, mem_ctx
,
1325 if (!NT_STATUS_IS_OK(status
)) {
1328 if (!NT_STATUS_IS_OK(result
)) {
1332 username
= talloc_strdup(mem_ctx
, info
->info21
.account_name
.string
);
1334 FETCHSTR("fullname", full_name
);
1335 FETCHSTR("homedir", home_directory
);
1336 FETCHSTR("homedrive", home_drive
);
1337 FETCHSTR("logonscript", logon_script
);
1338 FETCHSTR("profilepath", profile_path
);
1339 FETCHSTR("description", description
);
1342 d_printf(_("%s's %s: [%s]\n"), username
, ctx
->thiscmd
, oldval
);
1346 if (strcmp(argv
[0], "NULL") == 0) {
1350 ZERO_STRUCT(info
->info21
);
1352 SETSTR("fullname", full_name
, FULL_NAME
);
1353 SETSTR("homedir", home_directory
, HOME_DIRECTORY
);
1354 SETSTR("homedrive", home_drive
, HOME_DRIVE
);
1355 SETSTR("logonscript", logon_script
, LOGON_SCRIPT
);
1356 SETSTR("profilepath", profile_path
, PROFILE_PATH
);
1357 SETSTR("description", description
, DESCRIPTION
);
1359 status
= dcerpc_samr_SetUserInfo(b
, mem_ctx
,
1364 if (!NT_STATUS_IS_OK(status
)) {
1370 d_printf(_("Set %s's %s from [%s] to [%s]\n"), username
,
1371 ctx
->thiscmd
, oldval
, argv
[0]);
1378 #define HANDLEFLG(name, rec) \
1379 do { if (strequal(ctx->thiscmd, name)) { \
1380 oldval = (oldflags & ACB_##rec) ? "yes" : "no"; \
1382 newflags = oldflags | ACB_##rec; \
1384 newflags = oldflags & ~ACB_##rec; \
1387 static NTSTATUS
rpc_sh_user_str_edit(struct net_context
*c
,
1388 TALLOC_CTX
*mem_ctx
,
1389 struct rpc_sh_ctx
*ctx
,
1390 struct rpc_pipe_client
*pipe_hnd
,
1391 int argc
, const char **argv
)
1393 return rpc_sh_handle_user(c
, mem_ctx
, ctx
, pipe_hnd
, argc
, argv
,
1394 rpc_sh_user_str_edit_internals
);
1397 static NTSTATUS
rpc_sh_user_flag_edit_internals(struct net_context
*c
,
1398 TALLOC_CTX
*mem_ctx
,
1399 struct rpc_sh_ctx
*ctx
,
1400 struct rpc_pipe_client
*pipe_hnd
,
1401 struct policy_handle
*user_hnd
,
1402 int argc
, const char **argv
)
1404 NTSTATUS status
, result
;
1405 const char *username
;
1406 const char *oldval
= "unknown";
1407 uint32 oldflags
, newflags
;
1409 union samr_UserInfo
*info
= NULL
;
1410 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
1413 ((argc
== 1) && !strequal(argv
[0], "yes") &&
1414 !strequal(argv
[0], "no"))) {
1415 /* TRANSATORS: The yes|no here are program keywords. Please do
1417 d_fprintf(stderr
, _("Usage: %s <username> [yes|no]\n"),
1419 return NT_STATUS_INVALID_PARAMETER
;
1422 newval
= strequal(argv
[0], "yes");
1424 status
= dcerpc_samr_QueryUserInfo(b
, mem_ctx
,
1429 if (!NT_STATUS_IS_OK(status
)) {
1432 if (!NT_STATUS_IS_OK(result
)) {
1436 username
= talloc_strdup(mem_ctx
, info
->info21
.account_name
.string
);
1437 oldflags
= info
->info21
.acct_flags
;
1438 newflags
= info
->info21
.acct_flags
;
1440 HANDLEFLG("disabled", DISABLED
);
1441 HANDLEFLG("pwnotreq", PWNOTREQ
);
1442 HANDLEFLG("autolock", AUTOLOCK
);
1443 HANDLEFLG("pwnoexp", PWNOEXP
);
1446 d_printf(_("%s's %s flag: %s\n"), username
, ctx
->thiscmd
,
1451 ZERO_STRUCT(info
->info21
);
1453 info
->info21
.acct_flags
= newflags
;
1454 info
->info21
.fields_present
= SAMR_FIELD_ACCT_FLAGS
;
1456 status
= dcerpc_samr_SetUserInfo(b
, mem_ctx
,
1461 if (!NT_STATUS_IS_OK(status
)) {
1465 if (NT_STATUS_IS_OK(result
)) {
1466 d_printf(_("Set %s's %s flag from [%s] to [%s]\n"), username
,
1467 ctx
->thiscmd
, oldval
, argv
[0]);
1475 static NTSTATUS
rpc_sh_user_flag_edit(struct net_context
*c
,
1476 TALLOC_CTX
*mem_ctx
,
1477 struct rpc_sh_ctx
*ctx
,
1478 struct rpc_pipe_client
*pipe_hnd
,
1479 int argc
, const char **argv
)
1481 return rpc_sh_handle_user(c
, mem_ctx
, ctx
, pipe_hnd
, argc
, argv
,
1482 rpc_sh_user_flag_edit_internals
);
1485 struct rpc_sh_cmd
*net_rpc_user_edit_cmds(struct net_context
*c
,
1486 TALLOC_CTX
*mem_ctx
,
1487 struct rpc_sh_ctx
*ctx
)
1489 static struct rpc_sh_cmd cmds
[] = {
1491 { "fullname", NULL
, &ndr_table_samr
, rpc_sh_user_str_edit
,
1492 N_("Show/Set a user's full name") },
1494 { "homedir", NULL
, &ndr_table_samr
, rpc_sh_user_str_edit
,
1495 N_("Show/Set a user's home directory") },
1497 { "homedrive", NULL
, &ndr_table_samr
, rpc_sh_user_str_edit
,
1498 N_("Show/Set a user's home drive") },
1500 { "logonscript", NULL
, &ndr_table_samr
, rpc_sh_user_str_edit
,
1501 N_("Show/Set a user's logon script") },
1503 { "profilepath", NULL
, &ndr_table_samr
, rpc_sh_user_str_edit
,
1504 N_("Show/Set a user's profile path") },
1506 { "description", NULL
, &ndr_table_samr
, rpc_sh_user_str_edit
,
1507 N_("Show/Set a user's description") },
1509 { "disabled", NULL
, &ndr_table_samr
, rpc_sh_user_flag_edit
,
1510 N_("Show/Set whether a user is disabled") },
1512 { "autolock", NULL
, &ndr_table_samr
, rpc_sh_user_flag_edit
,
1513 N_("Show/Set whether a user locked out") },
1515 { "pwnotreq", NULL
, &ndr_table_samr
, rpc_sh_user_flag_edit
,
1516 N_("Show/Set whether a user does not need a password") },
1518 { "pwnoexp", NULL
, &ndr_table_samr
, rpc_sh_user_flag_edit
,
1519 N_("Show/Set whether a user's password does not expire") },
1521 { NULL
, NULL
, 0, NULL
, NULL
}
1527 struct rpc_sh_cmd
*net_rpc_user_cmds(struct net_context
*c
,
1528 TALLOC_CTX
*mem_ctx
,
1529 struct rpc_sh_ctx
*ctx
)
1531 static struct rpc_sh_cmd cmds
[] = {
1533 { "list", NULL
, &ndr_table_samr
, rpc_sh_user_list
,
1534 N_("List available users") },
1536 { "info", NULL
, &ndr_table_samr
, rpc_sh_user_info
,
1537 N_("List the domain groups a user is member of") },
1539 { "show", NULL
, &ndr_table_samr
, rpc_sh_user_show
,
1540 N_("Show info about a user") },
1542 { "edit", net_rpc_user_edit_cmds
, 0, NULL
,
1543 N_("Show/Modify a user's fields") },
1545 { NULL
, NULL
, 0, NULL
, NULL
}
1551 /****************************************************************************/
1554 * Basic usage function for 'net rpc group'.
1555 * @param argc Standard main() style argc.
1556 * @param argv Standard main() style argv. Initial components are already
1560 static int rpc_group_usage(struct net_context
*c
, int argc
, const char **argv
)
1562 return net_group_usage(c
, argc
, argv
);
1566 * Delete group on a remote RPC server.
1568 * All parameters are provided by the run_rpc_command function, except for
1569 * argc, argv which are passed through.
1571 * @param domain_sid The domain sid acquired from the remote server.
1572 * @param cli A cli_state connected to the server.
1573 * @param mem_ctx Talloc context, destroyed on completion of the function.
1574 * @param argc Standard main() style argc.
1575 * @param argv Standard main() style argv. Initial components are already
1578 * @return Normal NTSTATUS return.
1581 static NTSTATUS
rpc_group_delete_internals(struct net_context
*c
,
1582 const struct dom_sid
*domain_sid
,
1583 const char *domain_name
,
1584 struct cli_state
*cli
,
1585 struct rpc_pipe_client
*pipe_hnd
,
1586 TALLOC_CTX
*mem_ctx
,
1590 struct policy_handle connect_pol
, domain_pol
, group_pol
, user_pol
;
1591 bool group_is_primary
= false;
1592 NTSTATUS status
, result
;
1594 struct samr_RidAttrArray
*rids
= NULL
;
1597 /* struct samr_RidWithAttribute *user_gids; */
1598 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
1600 struct samr_Ids group_rids
, name_types
;
1601 struct lsa_String lsa_acct_name
;
1602 union samr_UserInfo
*info
= NULL
;
1604 if (argc
< 1 || c
->display_usage
) {
1605 rpc_group_usage(c
, argc
,argv
);
1606 return NT_STATUS_OK
; /* ok? */
1609 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
1611 MAXIMUM_ALLOWED_ACCESS
,
1614 if (!NT_STATUS_IS_OK(status
)) {
1615 d_fprintf(stderr
, _("Request samr_Connect2 failed\n"));
1619 if (!NT_STATUS_IS_OK(result
)) {
1621 d_fprintf(stderr
, _("Request samr_Connect2 failed\n"));
1625 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
1627 MAXIMUM_ALLOWED_ACCESS
,
1628 discard_const_p(struct dom_sid2
, domain_sid
),
1631 if (!NT_STATUS_IS_OK(status
)) {
1632 d_fprintf(stderr
, _("Request open_domain failed\n"));
1636 if (!NT_STATUS_IS_OK(result
)) {
1638 d_fprintf(stderr
, _("Request open_domain failed\n"));
1642 init_lsa_String(&lsa_acct_name
, argv
[0]);
1644 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
1651 if (!NT_STATUS_IS_OK(status
)) {
1652 d_fprintf(stderr
, _("Lookup of '%s' failed\n"),argv
[0]);
1656 if (!NT_STATUS_IS_OK(result
)) {
1658 d_fprintf(stderr
, _("Lookup of '%s' failed\n"),argv
[0]);
1661 if (group_rids
.count
!= 1) {
1662 status
= NT_STATUS_INVALID_NETWORK_RESPONSE
;
1665 if (name_types
.count
!= 1) {
1666 status
= NT_STATUS_INVALID_NETWORK_RESPONSE
;
1670 switch (name_types
.ids
[0])
1672 case SID_NAME_DOM_GRP
:
1673 status
= dcerpc_samr_OpenGroup(b
, mem_ctx
,
1675 MAXIMUM_ALLOWED_ACCESS
,
1679 if (!NT_STATUS_IS_OK(status
)) {
1680 d_fprintf(stderr
, _("Request open_group failed"));
1684 if (!NT_STATUS_IS_OK(result
)) {
1686 d_fprintf(stderr
, _("Request open_group failed"));
1690 group_rid
= group_rids
.ids
[0];
1692 status
= dcerpc_samr_QueryGroupMember(b
, mem_ctx
,
1696 if (!NT_STATUS_IS_OK(status
)) {
1698 _("Unable to query group members of %s"),
1703 if (!NT_STATUS_IS_OK(result
)) {
1706 _("Unable to query group members of %s"),
1711 if (c
->opt_verbose
) {
1713 _("Domain Group %s (rid: %d) has %d members\n"),
1714 argv
[0],group_rid
, rids
->count
);
1717 /* Check if group is anyone's primary group */
1718 for (i
= 0; i
< rids
->count
; i
++)
1720 status
= dcerpc_samr_OpenUser(b
, mem_ctx
,
1722 MAXIMUM_ALLOWED_ACCESS
,
1726 if (!NT_STATUS_IS_OK(status
)) {
1728 _("Unable to open group member %d\n"),
1733 if (!NT_STATUS_IS_OK(result
)) {
1736 _("Unable to open group member %d\n"),
1741 status
= dcerpc_samr_QueryUserInfo(b
, mem_ctx
,
1746 if (!NT_STATUS_IS_OK(status
)) {
1748 _("Unable to lookup userinfo for group "
1754 if (!NT_STATUS_IS_OK(result
)) {
1757 _("Unable to lookup userinfo for group "
1763 if (info
->info21
.primary_gid
== group_rid
) {
1764 if (c
->opt_verbose
) {
1765 d_printf(_("Group is primary group "
1767 info
->info21
.account_name
.string
);
1769 group_is_primary
= true;
1772 dcerpc_samr_Close(b
, mem_ctx
, &user_pol
, &result
);
1775 if (group_is_primary
) {
1776 d_fprintf(stderr
, _("Unable to delete group because "
1777 "some of it's members have it as primary "
1779 status
= NT_STATUS_MEMBERS_PRIMARY_GROUP
;
1783 /* remove all group members */
1784 for (i
= 0; i
< rids
->count
; i
++)
1787 d_printf(_("Remove group member %d..."),
1789 status
= dcerpc_samr_DeleteGroupMember(b
, mem_ctx
,
1793 if (!NT_STATUS_IS_OK(status
)) {
1797 if (NT_STATUS_IS_OK(result
)) {
1799 d_printf(_("ok\n"));
1802 d_printf("%s\n", _("failed"));
1807 status
= dcerpc_samr_DeleteDomainGroup(b
, mem_ctx
,
1810 if (!NT_STATUS_IS_OK(status
)) {
1817 /* removing a local group is easier... */
1818 case SID_NAME_ALIAS
:
1819 status
= dcerpc_samr_OpenAlias(b
, mem_ctx
,
1821 MAXIMUM_ALLOWED_ACCESS
,
1825 if (!NT_STATUS_IS_OK(status
)) {
1826 d_fprintf(stderr
, _("Request open_alias failed\n"));
1829 if (!NT_STATUS_IS_OK(result
)) {
1831 d_fprintf(stderr
, _("Request open_alias failed\n"));
1835 status
= dcerpc_samr_DeleteDomAlias(b
, mem_ctx
,
1838 if (!NT_STATUS_IS_OK(status
)) {
1846 d_fprintf(stderr
, _("%s is of type %s. This command is only "
1847 "for deleting local or global groups\n"),
1848 argv
[0],sid_type_lookup(name_types
.ids
[0]));
1849 status
= NT_STATUS_UNSUCCESSFUL
;
1853 if (NT_STATUS_IS_OK(status
)) {
1855 d_printf(_("Deleted %s '%s'\n"),
1856 sid_type_lookup(name_types
.ids
[0]), argv
[0]);
1858 d_fprintf(stderr
, _("Deleting of %s failed: %s\n"), argv
[0],
1859 get_friendly_nt_error_msg(status
));
1867 static int rpc_group_delete(struct net_context
*c
, int argc
, const char **argv
)
1869 return run_rpc_command(c
, NULL
, &ndr_table_samr
, 0,
1870 rpc_group_delete_internals
, argc
,argv
);
1873 static int rpc_group_add_internals(struct net_context
*c
, int argc
, const char **argv
)
1875 NET_API_STATUS status
;
1876 struct GROUP_INFO_1 info1
;
1877 uint32_t parm_error
= 0;
1879 if (argc
!= 1 || c
->display_usage
) {
1880 rpc_group_usage(c
, argc
, argv
);
1886 info1
.grpi1_name
= argv
[0];
1887 if (c
->opt_comment
&& strlen(c
->opt_comment
) > 0) {
1888 info1
.grpi1_comment
= c
->opt_comment
;
1891 status
= NetGroupAdd(c
->opt_host
, 1, (uint8_t *)&info1
, &parm_error
);
1895 _("Failed to add group '%s' with error: %s.\n"),
1896 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
1900 d_printf(_("Added group '%s'.\n"), argv
[0]);
1906 static int rpc_alias_add_internals(struct net_context
*c
, int argc
, const char **argv
)
1908 NET_API_STATUS status
;
1909 struct LOCALGROUP_INFO_1 info1
;
1910 uint32_t parm_error
= 0;
1912 if (argc
!= 1 || c
->display_usage
) {
1913 rpc_group_usage(c
, argc
, argv
);
1919 info1
.lgrpi1_name
= argv
[0];
1920 if (c
->opt_comment
&& strlen(c
->opt_comment
) > 0) {
1921 info1
.lgrpi1_comment
= c
->opt_comment
;
1924 status
= NetLocalGroupAdd(c
->opt_host
, 1, (uint8_t *)&info1
, &parm_error
);
1928 _("Failed to add alias '%s' with error: %s.\n"),
1929 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
1933 d_printf(_("Added alias '%s'.\n"), argv
[0]);
1939 static int rpc_group_add(struct net_context
*c
, int argc
, const char **argv
)
1941 if (c
->opt_localgroup
)
1942 return rpc_alias_add_internals(c
, argc
, argv
);
1944 return rpc_group_add_internals(c
, argc
, argv
);
1947 static NTSTATUS
get_sid_from_name(struct cli_state
*cli
,
1948 TALLOC_CTX
*mem_ctx
,
1950 struct dom_sid
*sid
,
1951 enum lsa_SidType
*type
)
1953 struct dom_sid
*sids
= NULL
;
1954 enum lsa_SidType
*types
= NULL
;
1955 struct rpc_pipe_client
*pipe_hnd
= NULL
;
1956 struct policy_handle lsa_pol
;
1957 NTSTATUS status
, result
;
1958 struct dcerpc_binding_handle
*b
;
1960 status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
1962 if (!NT_STATUS_IS_OK(status
)) {
1966 b
= pipe_hnd
->binding_handle
;
1968 status
= rpccli_lsa_open_policy(pipe_hnd
, mem_ctx
, false,
1969 SEC_FLAG_MAXIMUM_ALLOWED
, &lsa_pol
);
1971 if (!NT_STATUS_IS_OK(status
)) {
1975 status
= rpccli_lsa_lookup_names(pipe_hnd
, mem_ctx
, &lsa_pol
, 1,
1976 &name
, NULL
, 1, &sids
, &types
);
1978 if (NT_STATUS_IS_OK(status
)) {
1979 sid_copy(sid
, &sids
[0]);
1983 dcerpc_lsa_Close(b
, mem_ctx
, &lsa_pol
, &result
);
1987 TALLOC_FREE(pipe_hnd
);
1990 if (!NT_STATUS_IS_OK(status
) && (strncasecmp_m(name
, "S-", 2) == 0)) {
1992 /* Try as S-1-5-whatever */
1994 struct dom_sid tmp_sid
;
1996 if (string_to_sid(&tmp_sid
, name
)) {
1997 sid_copy(sid
, &tmp_sid
);
1998 *type
= SID_NAME_UNKNOWN
;
1999 status
= NT_STATUS_OK
;
2006 static NTSTATUS
rpc_add_groupmem(struct rpc_pipe_client
*pipe_hnd
,
2007 TALLOC_CTX
*mem_ctx
,
2008 const struct dom_sid
*group_sid
,
2011 struct policy_handle connect_pol
, domain_pol
;
2012 NTSTATUS status
, result
;
2014 struct policy_handle group_pol
;
2015 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
2017 struct samr_Ids rids
, rid_types
;
2018 struct lsa_String lsa_acct_name
;
2022 sid_copy(&sid
, group_sid
);
2024 if (!sid_split_rid(&sid
, &group_rid
)) {
2025 return NT_STATUS_UNSUCCESSFUL
;
2028 /* Get sam policy handle */
2029 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
2031 MAXIMUM_ALLOWED_ACCESS
,
2034 if (!NT_STATUS_IS_OK(status
)) {
2037 if (!NT_STATUS_IS_OK(result
)) {
2041 /* Get domain policy handle */
2042 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2044 MAXIMUM_ALLOWED_ACCESS
,
2048 if (!NT_STATUS_IS_OK(status
)) {
2051 if (!NT_STATUS_IS_OK(result
)) {
2055 init_lsa_String(&lsa_acct_name
, member
);
2057 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
2064 if (!NT_STATUS_IS_OK(status
)) {
2065 d_fprintf(stderr
, _("Could not lookup up group member %s\n"),
2070 if (!NT_STATUS_IS_OK(result
)) {
2072 d_fprintf(stderr
, _("Could not lookup up group member %s\n"),
2076 if (rids
.count
!= 1) {
2077 status
= NT_STATUS_INVALID_NETWORK_RESPONSE
;
2080 if (rid_types
.count
!= 1) {
2081 status
= NT_STATUS_INVALID_NETWORK_RESPONSE
;
2085 status
= dcerpc_samr_OpenGroup(b
, mem_ctx
,
2087 MAXIMUM_ALLOWED_ACCESS
,
2091 if (!NT_STATUS_IS_OK(status
)) {
2095 if (!NT_STATUS_IS_OK(result
)) {
2100 status
= dcerpc_samr_AddGroupMember(b
, mem_ctx
,
2103 0x0005, /* unknown flags */
2105 if (!NT_STATUS_IS_OK(status
)) {
2112 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2116 static NTSTATUS
rpc_add_aliasmem(struct rpc_pipe_client
*pipe_hnd
,
2117 TALLOC_CTX
*mem_ctx
,
2118 const struct dom_sid
*alias_sid
,
2121 struct policy_handle connect_pol
, domain_pol
;
2122 NTSTATUS status
, result
;
2124 struct policy_handle alias_pol
;
2125 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
2127 struct dom_sid member_sid
;
2128 enum lsa_SidType member_type
;
2132 sid_copy(&sid
, alias_sid
);
2134 if (!sid_split_rid(&sid
, &alias_rid
)) {
2135 return NT_STATUS_UNSUCCESSFUL
;
2138 result
= get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd
), mem_ctx
,
2139 member
, &member_sid
, &member_type
);
2141 if (!NT_STATUS_IS_OK(result
)) {
2142 d_fprintf(stderr
, _("Could not lookup up group member %s\n"),
2147 /* Get sam policy handle */
2148 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
2150 MAXIMUM_ALLOWED_ACCESS
,
2153 if (!NT_STATUS_IS_OK(status
)) {
2156 if (!NT_STATUS_IS_OK(result
)) {
2161 /* Get domain policy handle */
2162 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2164 MAXIMUM_ALLOWED_ACCESS
,
2168 if (!NT_STATUS_IS_OK(status
)) {
2171 if (!NT_STATUS_IS_OK(result
)) {
2176 status
= dcerpc_samr_OpenAlias(b
, mem_ctx
,
2178 MAXIMUM_ALLOWED_ACCESS
,
2182 if (!NT_STATUS_IS_OK(status
)) {
2185 if (!NT_STATUS_IS_OK(result
)) {
2189 status
= dcerpc_samr_AddAliasMember(b
, mem_ctx
,
2193 if (!NT_STATUS_IS_OK(status
)) {
2200 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2204 static NTSTATUS
rpc_group_addmem_internals(struct net_context
*c
,
2205 const struct dom_sid
*domain_sid
,
2206 const char *domain_name
,
2207 struct cli_state
*cli
,
2208 struct rpc_pipe_client
*pipe_hnd
,
2209 TALLOC_CTX
*mem_ctx
,
2213 struct dom_sid group_sid
;
2214 enum lsa_SidType group_type
;
2216 if (argc
!= 2 || c
->display_usage
) {
2219 _("net rpc group addmem <group> <member>\n"
2220 " Add a member to a group\n"
2221 " group\tGroup to add member to\n"
2222 " member\tMember to add to group\n"));
2223 return NT_STATUS_UNSUCCESSFUL
;
2226 if (!NT_STATUS_IS_OK(get_sid_from_name(cli
, mem_ctx
, argv
[0],
2227 &group_sid
, &group_type
))) {
2228 d_fprintf(stderr
, _("Could not lookup group name %s\n"),
2230 return NT_STATUS_UNSUCCESSFUL
;
2233 if (group_type
== SID_NAME_DOM_GRP
) {
2234 NTSTATUS result
= rpc_add_groupmem(pipe_hnd
, mem_ctx
,
2235 &group_sid
, argv
[1]);
2237 if (!NT_STATUS_IS_OK(result
)) {
2238 d_fprintf(stderr
, _("Could not add %s to %s: %s\n"),
2239 argv
[1], argv
[0], nt_errstr(result
));
2244 if (group_type
== SID_NAME_ALIAS
) {
2245 NTSTATUS result
= rpc_add_aliasmem(pipe_hnd
, mem_ctx
,
2246 &group_sid
, argv
[1]);
2248 if (!NT_STATUS_IS_OK(result
)) {
2249 d_fprintf(stderr
, _("Could not add %s to %s: %s\n"),
2250 argv
[1], argv
[0], nt_errstr(result
));
2255 d_fprintf(stderr
, _("Can only add members to global or local groups "
2256 "which %s is not\n"), argv
[0]);
2258 return NT_STATUS_UNSUCCESSFUL
;
2261 static int rpc_group_addmem(struct net_context
*c
, int argc
, const char **argv
)
2263 return run_rpc_command(c
, NULL
, &ndr_table_samr
, 0,
2264 rpc_group_addmem_internals
,
2268 static NTSTATUS
rpc_del_groupmem(struct net_context
*c
,
2269 struct rpc_pipe_client
*pipe_hnd
,
2270 TALLOC_CTX
*mem_ctx
,
2271 const struct dom_sid
*group_sid
,
2274 struct policy_handle connect_pol
, domain_pol
;
2275 NTSTATUS status
, result
;
2277 struct policy_handle group_pol
;
2278 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
2280 struct samr_Ids rids
, rid_types
;
2281 struct lsa_String lsa_acct_name
;
2285 sid_copy(&sid
, group_sid
);
2287 if (!sid_split_rid(&sid
, &group_rid
))
2288 return NT_STATUS_UNSUCCESSFUL
;
2290 /* Get sam policy handle */
2291 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
2293 MAXIMUM_ALLOWED_ACCESS
,
2296 if (!NT_STATUS_IS_OK(status
)) {
2299 if (!NT_STATUS_IS_OK(result
)) {
2304 /* Get domain policy handle */
2305 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2307 MAXIMUM_ALLOWED_ACCESS
,
2311 if (!NT_STATUS_IS_OK(status
)) {
2314 if (!NT_STATUS_IS_OK(result
)) {
2318 init_lsa_String(&lsa_acct_name
, member
);
2320 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
2327 if (!NT_STATUS_IS_OK(status
)) {
2328 d_fprintf(stderr
, _("Could not lookup up group member %s\n"),
2333 if (!NT_STATUS_IS_OK(result
)) {
2335 d_fprintf(stderr
, _("Could not lookup up group member %s\n"),
2339 if (rids
.count
!= 1) {
2340 status
= NT_STATUS_INVALID_NETWORK_RESPONSE
;
2343 if (rid_types
.count
!= 1) {
2344 status
= NT_STATUS_INVALID_NETWORK_RESPONSE
;
2348 status
= dcerpc_samr_OpenGroup(b
, mem_ctx
,
2350 MAXIMUM_ALLOWED_ACCESS
,
2354 if (!NT_STATUS_IS_OK(status
)) {
2357 if (!NT_STATUS_IS_OK(result
)) {
2362 status
= dcerpc_samr_DeleteGroupMember(b
, mem_ctx
,
2366 if (!NT_STATUS_IS_OK(status
)) {
2372 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2376 static NTSTATUS
rpc_del_aliasmem(struct rpc_pipe_client
*pipe_hnd
,
2377 TALLOC_CTX
*mem_ctx
,
2378 const struct dom_sid
*alias_sid
,
2381 struct policy_handle connect_pol
, domain_pol
;
2382 NTSTATUS status
, result
;
2384 struct policy_handle alias_pol
;
2385 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
2387 struct dom_sid member_sid
;
2388 enum lsa_SidType member_type
;
2392 sid_copy(&sid
, alias_sid
);
2394 if (!sid_split_rid(&sid
, &alias_rid
))
2395 return NT_STATUS_UNSUCCESSFUL
;
2397 result
= get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd
), mem_ctx
,
2398 member
, &member_sid
, &member_type
);
2400 if (!NT_STATUS_IS_OK(result
)) {
2401 d_fprintf(stderr
, _("Could not lookup up group member %s\n"),
2406 /* Get sam policy handle */
2407 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
2409 MAXIMUM_ALLOWED_ACCESS
,
2412 if (!NT_STATUS_IS_OK(status
)) {
2415 if (!NT_STATUS_IS_OK(result
)) {
2420 /* Get domain policy handle */
2421 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2423 MAXIMUM_ALLOWED_ACCESS
,
2427 if (!NT_STATUS_IS_OK(status
)) {
2430 if (!NT_STATUS_IS_OK(result
)) {
2435 status
= dcerpc_samr_OpenAlias(b
, mem_ctx
,
2437 MAXIMUM_ALLOWED_ACCESS
,
2441 if (!NT_STATUS_IS_OK(status
)) {
2445 if (!NT_STATUS_IS_OK(result
)) {
2449 status
= dcerpc_samr_DeleteAliasMember(b
, mem_ctx
,
2454 if (!NT_STATUS_IS_OK(status
)) {
2461 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2465 static NTSTATUS
rpc_group_delmem_internals(struct net_context
*c
,
2466 const struct dom_sid
*domain_sid
,
2467 const char *domain_name
,
2468 struct cli_state
*cli
,
2469 struct rpc_pipe_client
*pipe_hnd
,
2470 TALLOC_CTX
*mem_ctx
,
2474 struct dom_sid group_sid
;
2475 enum lsa_SidType group_type
;
2477 if (argc
!= 2 || c
->display_usage
) {
2480 _("net rpc group delmem <group> <member>\n"
2481 " Delete a member from a group\n"
2482 " group\tGroup to delete member from\n"
2483 " member\tMember to delete from group\n"));
2484 return NT_STATUS_UNSUCCESSFUL
;
2487 if (!NT_STATUS_IS_OK(get_sid_from_name(cli
, mem_ctx
, argv
[0],
2488 &group_sid
, &group_type
))) {
2489 d_fprintf(stderr
, _("Could not lookup group name %s\n"),
2491 return NT_STATUS_UNSUCCESSFUL
;
2494 if (group_type
== SID_NAME_DOM_GRP
) {
2495 NTSTATUS result
= rpc_del_groupmem(c
, pipe_hnd
, mem_ctx
,
2496 &group_sid
, argv
[1]);
2498 if (!NT_STATUS_IS_OK(result
)) {
2499 d_fprintf(stderr
, _("Could not del %s from %s: %s\n"),
2500 argv
[1], argv
[0], nt_errstr(result
));
2505 if (group_type
== SID_NAME_ALIAS
) {
2506 NTSTATUS result
= rpc_del_aliasmem(pipe_hnd
, mem_ctx
,
2507 &group_sid
, argv
[1]);
2509 if (!NT_STATUS_IS_OK(result
)) {
2510 d_fprintf(stderr
, _("Could not del %s from %s: %s\n"),
2511 argv
[1], argv
[0], nt_errstr(result
));
2516 d_fprintf(stderr
, _("Can only delete members from global or local "
2517 "groups which %s is not\n"), argv
[0]);
2519 return NT_STATUS_UNSUCCESSFUL
;
2522 static int rpc_group_delmem(struct net_context
*c
, int argc
, const char **argv
)
2524 return run_rpc_command(c
, NULL
, &ndr_table_samr
, 0,
2525 rpc_group_delmem_internals
,
2530 * List groups on a remote RPC server.
2532 * All parameters are provided by the run_rpc_command function, except for
2533 * argc, argv which are passes through.
2535 * @param domain_sid The domain sid acquired from the remote server.
2536 * @param cli A cli_state connected to the server.
2537 * @param mem_ctx Talloc context, destroyed on completion of the function.
2538 * @param argc Standard main() style argc.
2539 * @param argv Standard main() style argv. Initial components are already
2542 * @return Normal NTSTATUS return.
2545 static NTSTATUS
rpc_group_list_internals(struct net_context
*c
,
2546 const struct dom_sid
*domain_sid
,
2547 const char *domain_name
,
2548 struct cli_state
*cli
,
2549 struct rpc_pipe_client
*pipe_hnd
,
2550 TALLOC_CTX
*mem_ctx
,
2554 struct policy_handle connect_pol
, domain_pol
;
2555 NTSTATUS status
, result
;
2556 uint32 start_idx
=0, max_entries
=250, num_entries
, i
, loop_count
= 0;
2557 struct samr_SamArray
*groups
= NULL
;
2558 bool global
= false;
2560 bool builtin
= false;
2561 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
2563 if (c
->display_usage
) {
2566 _("net rpc group list [global] [local] [builtin]\n"
2567 " List groups on RPC server\n"
2568 " global\tList global groups\n"
2569 " local\tList local groups\n"
2570 " builtin\tList builtin groups\n"
2571 " If none of global, local or builtin is "
2572 "specified, all three options are considered "
2574 return NT_STATUS_OK
;
2583 for (i
=0; i
<argc
; i
++) {
2584 if (strequal(argv
[i
], "global"))
2587 if (strequal(argv
[i
], "local"))
2590 if (strequal(argv
[i
], "builtin"))
2594 /* Get sam policy handle */
2596 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
2598 MAXIMUM_ALLOWED_ACCESS
,
2601 if (!NT_STATUS_IS_OK(status
)) {
2604 if (!NT_STATUS_IS_OK(result
)) {
2609 /* Get domain policy handle */
2611 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2613 MAXIMUM_ALLOWED_ACCESS
,
2614 discard_const_p(struct dom_sid2
, domain_sid
),
2617 if (!NT_STATUS_IS_OK(status
)) {
2620 if (!NT_STATUS_IS_OK(result
)) {
2625 /* Query domain groups */
2626 if (c
->opt_long_list_entries
)
2627 d_printf(_("\nGroup name Comment"
2628 "\n-----------------------------\n"));
2630 uint32_t max_size
, total_size
, returned_size
;
2631 union samr_DispInfo info
;
2635 dcerpc_get_query_dispinfo_params(
2636 loop_count
, &max_entries
, &max_size
);
2638 status
= dcerpc_samr_QueryDisplayInfo(b
, mem_ctx
,
2648 if (!NT_STATUS_IS_OK(status
)) {
2651 num_entries
= info
.info3
.count
;
2652 start_idx
+= info
.info3
.count
;
2654 if (!NT_STATUS_IS_OK(result
) &&
2655 !NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
))
2658 for (i
= 0; i
< num_entries
; i
++) {
2660 const char *group
= NULL
;
2661 const char *desc
= NULL
;
2663 group
= info
.info3
.entries
[i
].account_name
.string
;
2664 desc
= info
.info3
.entries
[i
].description
.string
;
2666 if (c
->opt_long_list_entries
)
2667 printf("%-21.21s %-50.50s\n",
2670 printf("%s\n", group
);
2672 } while (NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
2673 /* query domain aliases */
2678 status
= dcerpc_samr_EnumDomainAliases(b
, mem_ctx
,
2685 if (!NT_STATUS_IS_OK(status
)) {
2688 if (!NT_STATUS_IS_OK(result
) &&
2689 !NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
))
2692 for (i
= 0; i
< num_entries
; i
++) {
2694 const char *description
= NULL
;
2696 if (c
->opt_long_list_entries
) {
2698 struct policy_handle alias_pol
;
2699 union samr_AliasInfo
*info
= NULL
;
2702 status
= dcerpc_samr_OpenAlias(b
, mem_ctx
,
2705 groups
->entries
[i
].idx
,
2708 if (NT_STATUS_IS_OK(status
) && NT_STATUS_IS_OK(_result
)) {
2709 status
= dcerpc_samr_QueryAliasInfo(b
, mem_ctx
,
2714 if (NT_STATUS_IS_OK(status
) && NT_STATUS_IS_OK(_result
)) {
2715 status
= dcerpc_samr_Close(b
, mem_ctx
,
2718 if (NT_STATUS_IS_OK(status
) && NT_STATUS_IS_OK(_result
)) {
2719 description
= info
->description
.string
;
2725 if (description
!= NULL
) {
2726 printf("%-21.21s %-50.50s\n",
2727 groups
->entries
[i
].name
.string
,
2730 printf("%s\n", groups
->entries
[i
].name
.string
);
2733 } while (NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
2734 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
2735 /* Get builtin policy handle */
2737 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2739 MAXIMUM_ALLOWED_ACCESS
,
2740 discard_const_p(struct dom_sid2
, &global_sid_Builtin
),
2743 if (!NT_STATUS_IS_OK(status
)) {
2746 if (!NT_STATUS_IS_OK(result
)) {
2751 /* query builtin aliases */
2754 if (!builtin
) break;
2756 status
= dcerpc_samr_EnumDomainAliases(b
, mem_ctx
,
2763 if (!NT_STATUS_IS_OK(status
)) {
2766 if (!NT_STATUS_IS_OK(result
) &&
2767 !NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
)) {
2772 for (i
= 0; i
< num_entries
; i
++) {
2774 const char *description
= NULL
;
2776 if (c
->opt_long_list_entries
) {
2778 struct policy_handle alias_pol
;
2779 union samr_AliasInfo
*info
= NULL
;
2782 status
= dcerpc_samr_OpenAlias(b
, mem_ctx
,
2785 groups
->entries
[i
].idx
,
2788 if (NT_STATUS_IS_OK(status
) && NT_STATUS_IS_OK(_result
)) {
2789 status
= dcerpc_samr_QueryAliasInfo(b
, mem_ctx
,
2794 if (NT_STATUS_IS_OK(status
) && NT_STATUS_IS_OK(_result
)) {
2795 status
= dcerpc_samr_Close(b
, mem_ctx
,
2798 if (NT_STATUS_IS_OK(status
) && NT_STATUS_IS_OK(_result
)) {
2799 description
= info
->description
.string
;
2805 if (description
!= NULL
) {
2806 printf("%-21.21s %-50.50s\n",
2807 groups
->entries
[i
].name
.string
,
2810 printf("%s\n", groups
->entries
[i
].name
.string
);
2813 } while (NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
2821 static int rpc_group_list(struct net_context
*c
, int argc
, const char **argv
)
2823 return run_rpc_command(c
, NULL
, &ndr_table_samr
, 0,
2824 rpc_group_list_internals
,
2828 static NTSTATUS
rpc_list_group_members(struct net_context
*c
,
2829 struct rpc_pipe_client
*pipe_hnd
,
2830 TALLOC_CTX
*mem_ctx
,
2831 const char *domain_name
,
2832 const struct dom_sid
*domain_sid
,
2833 struct policy_handle
*domain_pol
,
2836 NTSTATUS result
, status
;
2837 struct policy_handle group_pol
;
2838 uint32 num_members
, *group_rids
;
2840 struct samr_RidAttrArray
*rids
= NULL
;
2841 struct lsa_Strings names
;
2842 struct samr_Ids types
;
2843 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
2846 sid_to_fstring(sid_str
, domain_sid
);
2848 status
= dcerpc_samr_OpenGroup(b
, mem_ctx
,
2850 MAXIMUM_ALLOWED_ACCESS
,
2854 if (!NT_STATUS_IS_OK(status
)) {
2857 if (!NT_STATUS_IS_OK(result
)) {
2861 status
= dcerpc_samr_QueryGroupMember(b
, mem_ctx
,
2865 if (!NT_STATUS_IS_OK(status
)) {
2868 if (!NT_STATUS_IS_OK(result
)) {
2872 num_members
= rids
->count
;
2873 group_rids
= rids
->rids
;
2875 while (num_members
> 0) {
2876 int this_time
= 512;
2878 if (num_members
< this_time
)
2879 this_time
= num_members
;
2881 status
= dcerpc_samr_LookupRids(b
, mem_ctx
,
2888 if (!NT_STATUS_IS_OK(status
)) {
2891 if (!NT_STATUS_IS_OK(result
)) {
2894 if (names
.count
!= this_time
) {
2895 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
2897 if (types
.count
!= this_time
) {
2898 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
2900 /* We only have users as members, but make the output
2901 the same as the output of alias members */
2903 for (i
= 0; i
< this_time
; i
++) {
2905 if (c
->opt_long_list_entries
) {
2906 printf("%s-%d %s\\%s %d\n", sid_str
,
2907 group_rids
[i
], domain_name
,
2908 names
.names
[i
].string
,
2911 printf("%s\\%s\n", domain_name
,
2912 names
.names
[i
].string
);
2916 num_members
-= this_time
;
2920 return NT_STATUS_OK
;
2923 static NTSTATUS
rpc_list_alias_members(struct net_context
*c
,
2924 struct rpc_pipe_client
*pipe_hnd
,
2925 TALLOC_CTX
*mem_ctx
,
2926 struct policy_handle
*domain_pol
,
2929 NTSTATUS result
, status
;
2930 struct rpc_pipe_client
*lsa_pipe
;
2931 struct policy_handle alias_pol
, lsa_pol
;
2933 struct dom_sid
*alias_sids
;
2936 enum lsa_SidType
*types
;
2938 struct lsa_SidArray sid_array
;
2939 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
2941 status
= dcerpc_samr_OpenAlias(b
, mem_ctx
,
2943 MAXIMUM_ALLOWED_ACCESS
,
2947 if (!NT_STATUS_IS_OK(status
)) {
2950 if (!NT_STATUS_IS_OK(result
)) {
2954 status
= dcerpc_samr_GetMembersInAlias(b
, mem_ctx
,
2958 if (!NT_STATUS_IS_OK(status
)) {
2959 d_fprintf(stderr
, _("Couldn't list alias members\n"));
2962 if (!NT_STATUS_IS_OK(result
)) {
2963 d_fprintf(stderr
, _("Couldn't list alias members\n"));
2967 num_members
= sid_array
.num_sids
;
2969 if (num_members
== 0) {
2970 return NT_STATUS_OK
;
2973 result
= cli_rpc_pipe_open_noauth(rpc_pipe_np_smb_conn(pipe_hnd
),
2974 &ndr_table_lsarpc
.syntax_id
,
2976 if (!NT_STATUS_IS_OK(result
)) {
2977 d_fprintf(stderr
, _("Couldn't open LSA pipe. Error was %s\n"),
2978 nt_errstr(result
) );
2982 result
= rpccli_lsa_open_policy(lsa_pipe
, mem_ctx
, true,
2983 SEC_FLAG_MAXIMUM_ALLOWED
, &lsa_pol
);
2985 if (!NT_STATUS_IS_OK(result
)) {
2986 d_fprintf(stderr
, _("Couldn't open LSA policy handle\n"));
2987 TALLOC_FREE(lsa_pipe
);
2991 alias_sids
= talloc_zero_array(mem_ctx
, struct dom_sid
, num_members
);
2993 d_fprintf(stderr
, _("Out of memory\n"));
2994 TALLOC_FREE(lsa_pipe
);
2995 return NT_STATUS_NO_MEMORY
;
2998 for (i
=0; i
<num_members
; i
++) {
2999 sid_copy(&alias_sids
[i
], sid_array
.sids
[i
].sid
);
3002 result
= rpccli_lsa_lookup_sids(lsa_pipe
, mem_ctx
, &lsa_pol
,
3003 num_members
, alias_sids
,
3004 &domains
, &names
, &types
);
3006 if (!NT_STATUS_IS_OK(result
) &&
3007 !NT_STATUS_EQUAL(result
, STATUS_SOME_UNMAPPED
)) {
3008 d_fprintf(stderr
, _("Couldn't lookup SIDs\n"));
3009 TALLOC_FREE(lsa_pipe
);
3013 for (i
= 0; i
< num_members
; i
++) {
3015 sid_to_fstring(sid_str
, &alias_sids
[i
]);
3017 if (c
->opt_long_list_entries
) {
3018 printf("%s %s\\%s %d\n", sid_str
,
3019 domains
[i
] ? domains
[i
] : _("*unknown*"),
3020 names
[i
] ? names
[i
] : _("*unknown*"), types
[i
]);
3023 printf("%s\\%s\n", domains
[i
], names
[i
]);
3025 printf("%s\n", sid_str
);
3029 TALLOC_FREE(lsa_pipe
);
3030 return NT_STATUS_OK
;
3033 static NTSTATUS
rpc_group_members_internals(struct net_context
*c
,
3034 const struct dom_sid
*domain_sid
,
3035 const char *domain_name
,
3036 struct cli_state
*cli
,
3037 struct rpc_pipe_client
*pipe_hnd
,
3038 TALLOC_CTX
*mem_ctx
,
3042 NTSTATUS result
, status
;
3043 struct policy_handle connect_pol
, domain_pol
;
3044 struct samr_Ids rids
, rid_types
;
3045 struct lsa_String lsa_acct_name
;
3046 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
3048 /* Get sam policy handle */
3050 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
3052 MAXIMUM_ALLOWED_ACCESS
,
3055 if (!NT_STATUS_IS_OK(status
)) {
3058 if (!NT_STATUS_IS_OK(result
)) {
3062 /* Get domain policy handle */
3064 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
3066 MAXIMUM_ALLOWED_ACCESS
,
3067 discard_const_p(struct dom_sid2
, domain_sid
),
3070 if (!NT_STATUS_IS_OK(status
)) {
3073 if (!NT_STATUS_IS_OK(result
)) {
3077 init_lsa_String(&lsa_acct_name
, argv
[0]); /* sure? */
3079 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
3086 if (!NT_STATUS_IS_OK(status
)) {
3090 if (!NT_STATUS_IS_OK(result
)) {
3092 /* Ok, did not find it in the global sam, try with builtin */
3094 struct dom_sid sid_Builtin
;
3096 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
3098 sid_copy(&sid_Builtin
, &global_sid_Builtin
);
3100 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
3102 MAXIMUM_ALLOWED_ACCESS
,
3106 if (!NT_STATUS_IS_OK(status
)) {
3109 if (!NT_STATUS_IS_OK(result
)) {
3110 d_fprintf(stderr
, _("Couldn't find group %s\n"),
3115 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
3122 if (!NT_STATUS_IS_OK(status
)) {
3125 if (!NT_STATUS_IS_OK(result
)) {
3126 d_fprintf(stderr
, _("Couldn't find group %s\n"),
3132 if (rids
.count
!= 1) {
3133 d_fprintf(stderr
, _("Couldn't find group %s\n"),
3135 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
3137 if (rid_types
.count
!= 1) {
3138 d_fprintf(stderr
, _("Couldn't find group %s\n"),
3140 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
3144 if (rid_types
.ids
[0] == SID_NAME_DOM_GRP
) {
3145 return rpc_list_group_members(c
, pipe_hnd
, mem_ctx
, domain_name
,
3146 domain_sid
, &domain_pol
,
3150 if (rid_types
.ids
[0] == SID_NAME_ALIAS
) {
3151 return rpc_list_alias_members(c
, pipe_hnd
, mem_ctx
, &domain_pol
,
3155 return NT_STATUS_NO_SUCH_GROUP
;
3158 static int rpc_group_members(struct net_context
*c
, int argc
, const char **argv
)
3160 if (argc
!= 1 || c
->display_usage
) {
3161 return rpc_group_usage(c
, argc
, argv
);
3164 return run_rpc_command(c
, NULL
, &ndr_table_samr
, 0,
3165 rpc_group_members_internals
,
3169 static int rpc_group_rename_internals(struct net_context
*c
, int argc
, const char **argv
)
3171 NET_API_STATUS status
;
3172 struct GROUP_INFO_0 g0
;
3176 d_printf(_("Usage:\n"));
3177 d_printf("net rpc group rename group newname\n");
3181 g0
.grpi0_name
= argv
[1];
3183 status
= NetGroupSetInfo(c
->opt_host
,
3190 d_fprintf(stderr
, _("Renaming group %s failed with: %s\n"),
3191 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
3199 static int rpc_group_rename(struct net_context
*c
, int argc
, const char **argv
)
3201 if (argc
!= 2 || c
->display_usage
) {
3202 return rpc_group_usage(c
, argc
, argv
);
3205 return rpc_group_rename_internals(c
, argc
, argv
);
3209 * 'net rpc group' entrypoint.
3210 * @param argc Standard main() style argc.
3211 * @param argv Standard main() style argv. Initial components are already
3215 int net_rpc_group(struct net_context
*c
, int argc
, const char **argv
)
3217 NET_API_STATUS status
;
3219 struct functable func
[] = {
3224 N_("Create specified group"),
3225 N_("net rpc group add\n"
3226 " Create specified group")
3232 N_("Delete specified group"),
3233 N_("net rpc group delete\n"
3234 " Delete specified group")
3240 N_("Add member to group"),
3241 N_("net rpc group addmem\n"
3242 " Add member to group")
3248 N_("Remove member from group"),
3249 N_("net rpc group delmem\n"
3250 " Remove member from group")
3257 N_("net rpc group list\n"
3264 N_("List group members"),
3265 N_("net rpc group members\n"
3266 " List group members")
3273 N_("net rpc group rename\n"
3276 {NULL
, NULL
, 0, NULL
, NULL
}
3279 status
= libnetapi_net_init(&c
->netapi_ctx
);
3283 libnetapi_set_username(c
->netapi_ctx
, c
->opt_user_name
);
3284 libnetapi_set_password(c
->netapi_ctx
, c
->opt_password
);
3285 if (c
->opt_kerberos
) {
3286 libnetapi_set_use_kerberos(c
->netapi_ctx
);
3290 if (c
->display_usage
) {
3291 d_printf(_("Usage:\n"));
3292 d_printf(_("net rpc group\n"
3293 " Alias for net rpc group list global "
3294 "local builtin\n"));
3295 net_display_usage_from_functable(func
);
3299 return run_rpc_command(c
, NULL
, &ndr_table_samr
, 0,
3300 rpc_group_list_internals
,
3304 return net_run_function(c
, argc
, argv
, "net rpc group", func
);
3307 /****************************************************************************/
3309 static int rpc_share_usage(struct net_context
*c
, int argc
, const char **argv
)
3311 return net_share_usage(c
, argc
, argv
);
3315 * Add a share on a remote RPC server.
3317 * @param argc Standard main() style argc.
3318 * @param argv Standard main() style argv. Initial components are already
3321 * @return A shell status integer (0 for success).
3324 static int rpc_share_add(struct net_context
*c
, int argc
, const char **argv
)
3326 NET_API_STATUS status
;
3329 uint32 type
= STYPE_DISKTREE
; /* only allow disk shares to be added */
3330 uint32 num_users
=0, perms
=0;
3331 char *password
=NULL
; /* don't allow a share password */
3332 struct SHARE_INFO_2 i2
;
3333 uint32_t parm_error
= 0;
3335 if ((argc
< 1) || !strchr(argv
[0], '=') || c
->display_usage
) {
3336 return rpc_share_usage(c
, argc
, argv
);
3339 if ((sharename
= talloc_strdup(c
, argv
[0])) == NULL
) {
3343 path
= strchr(sharename
, '=');
3350 i2
.shi2_netname
= sharename
;
3351 i2
.shi2_type
= type
;
3352 i2
.shi2_remark
= c
->opt_comment
;
3353 i2
.shi2_permissions
= perms
;
3354 i2
.shi2_max_uses
= c
->opt_maxusers
;
3355 i2
.shi2_current_uses
= num_users
;
3356 i2
.shi2_path
= path
;
3357 i2
.shi2_passwd
= password
;
3359 status
= NetShareAdd(c
->opt_host
,
3364 printf(_("NetShareAdd failed with: %s\n"),
3365 libnetapi_get_error_string(c
->netapi_ctx
, status
));
3372 * Delete a share on a remote RPC server.
3374 * @param domain_sid The domain sid acquired from the remote server.
3375 * @param argc Standard main() style argc.
3376 * @param argv Standard main() style argv. Initial components are already
3379 * @return A shell status integer (0 for success).
3381 static int rpc_share_delete(struct net_context
*c
, int argc
, const char **argv
)
3383 if (argc
< 1 || c
->display_usage
) {
3384 return rpc_share_usage(c
, argc
, argv
);
3387 return NetShareDel(c
->opt_host
, argv
[0], 0);
3391 * Formatted print of share info
3393 * @param r pointer to SHARE_INFO_1 to format
3396 static void display_share_info_1(struct net_context
*c
,
3397 struct SHARE_INFO_1
*r
)
3399 if (c
->opt_long_list_entries
) {
3400 d_printf("%-12s %-8.8s %-50s\n",
3402 net_share_type_str(r
->shi1_type
& ~(STYPE_TEMPORARY
|STYPE_HIDDEN
)),
3405 d_printf("%s\n", r
->shi1_netname
);
3409 static WERROR
get_share_info(struct net_context
*c
,
3410 struct rpc_pipe_client
*pipe_hnd
,
3411 TALLOC_CTX
*mem_ctx
,
3415 struct srvsvc_NetShareInfoCtr
*info_ctr
)
3419 union srvsvc_NetShareInfo info
;
3420 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
3422 /* no specific share requested, enumerate all */
3425 uint32_t preferred_len
= 0xffffffff;
3426 uint32_t total_entries
= 0;
3427 uint32_t resume_handle
= 0;
3429 info_ctr
->level
= level
;
3431 status
= dcerpc_srvsvc_NetShareEnumAll(b
, mem_ctx
,
3438 if (!NT_STATUS_IS_OK(status
)) {
3439 return ntstatus_to_werror(status
);
3444 /* request just one share */
3445 status
= dcerpc_srvsvc_NetShareGetInfo(b
, mem_ctx
,
3452 if (!NT_STATUS_IS_OK(status
)) {
3453 result
= ntstatus_to_werror(status
);
3457 if (!W_ERROR_IS_OK(result
)) {
3462 ZERO_STRUCTP(info_ctr
);
3464 info_ctr
->level
= level
;
3469 struct srvsvc_NetShareCtr1
*ctr1
;
3471 ctr1
= talloc_zero(mem_ctx
, struct srvsvc_NetShareCtr1
);
3472 W_ERROR_HAVE_NO_MEMORY(ctr1
);
3475 ctr1
->array
= info
.info1
;
3477 info_ctr
->ctr
.ctr1
= ctr1
;
3483 struct srvsvc_NetShareCtr2
*ctr2
;
3485 ctr2
= talloc_zero(mem_ctx
, struct srvsvc_NetShareCtr2
);
3486 W_ERROR_HAVE_NO_MEMORY(ctr2
);
3489 ctr2
->array
= info
.info2
;
3491 info_ctr
->ctr
.ctr2
= ctr2
;
3497 struct srvsvc_NetShareCtr502
*ctr502
;
3499 ctr502
= talloc_zero(mem_ctx
, struct srvsvc_NetShareCtr502
);
3500 W_ERROR_HAVE_NO_MEMORY(ctr502
);
3503 ctr502
->array
= info
.info502
;
3505 info_ctr
->ctr
.ctr502
= ctr502
;
3515 * 'net rpc share list' entrypoint.
3516 * @param argc Standard main() style argc.
3517 * @param argv Standard main() style argv. Initial components are already
3520 static int rpc_share_list(struct net_context
*c
, int argc
, const char **argv
)
3522 NET_API_STATUS status
;
3523 struct SHARE_INFO_1
*i1
= NULL
;
3524 uint32_t entries_read
= 0;
3525 uint32_t total_entries
= 0;
3526 uint32_t resume_handle
= 0;
3527 uint32_t i
, level
= 1;
3529 if (c
->display_usage
) {
3531 "net rpc share list\n"
3534 _("List shares on remote server"));
3538 status
= NetShareEnum(c
->opt_host
,
3540 (uint8_t **)(void *)&i1
,
3549 /* Display results */
3551 if (c
->opt_long_list_entries
) {
3553 "\nEnumerating shared resources (exports) on remote server:\n\n"
3554 "\nShare name Type Description\n"
3555 "---------- ---- -----------\n"));
3557 for (i
= 0; i
< entries_read
; i
++)
3558 display_share_info_1(c
, &i1
[i
]);
3563 static bool check_share_availability(struct cli_state
*cli
, const char *netname
)
3567 status
= cli_tree_connect(cli
, netname
, "A:", "", 0);
3568 if (!NT_STATUS_IS_OK(status
)) {
3569 d_printf(_("skipping [%s]: not a file share.\n"), netname
);
3573 status
= cli_tdis(cli
);
3574 if (!NT_STATUS_IS_OK(status
)) {
3575 d_printf(_("cli_tdis returned %s\n"), nt_errstr(status
));
3582 static bool check_share_sanity(struct net_context
*c
, struct cli_state
*cli
,
3583 const char *netname
, uint32 type
)
3585 /* only support disk shares */
3586 if (! ( type
== STYPE_DISKTREE
|| type
== (STYPE_DISKTREE
| STYPE_HIDDEN
)) ) {
3587 printf(_("share [%s] is not a diskshare (type: %x)\n"), netname
,
3592 /* skip builtin shares */
3593 /* FIXME: should print$ be added too ? */
3594 if (strequal(netname
,"IPC$") || strequal(netname
,"ADMIN$") ||
3595 strequal(netname
,"global"))
3598 if (c
->opt_exclude
&& in_list(netname
, c
->opt_exclude
, false)) {
3599 printf(_("excluding [%s]\n"), netname
);
3603 return check_share_availability(cli
, netname
);
3607 * Migrate shares from a remote RPC server to the local RPC server.
3609 * All parameters are provided by the run_rpc_command function, except for
3610 * argc, argv which are passed through.
3612 * @param domain_sid The domain sid acquired from the remote server.
3613 * @param cli A cli_state connected to the server.
3614 * @param mem_ctx Talloc context, destroyed on completion of the function.
3615 * @param argc Standard main() style argc.
3616 * @param argv Standard main() style argv. Initial components are already
3619 * @return Normal NTSTATUS return.
3622 static NTSTATUS
rpc_share_migrate_shares_internals(struct net_context
*c
,
3623 const struct dom_sid
*domain_sid
,
3624 const char *domain_name
,
3625 struct cli_state
*cli
,
3626 struct rpc_pipe_client
*pipe_hnd
,
3627 TALLOC_CTX
*mem_ctx
,
3632 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
3633 struct srvsvc_NetShareInfoCtr ctr_src
;
3635 struct rpc_pipe_client
*srvsvc_pipe
= NULL
;
3636 struct cli_state
*cli_dst
= NULL
;
3637 uint32 level
= 502; /* includes secdesc */
3638 uint32_t parm_error
= 0;
3639 struct dcerpc_binding_handle
*b
;
3641 result
= get_share_info(c
, pipe_hnd
, mem_ctx
, level
, argc
, argv
,
3643 if (!W_ERROR_IS_OK(result
))
3646 /* connect destination PI_SRVSVC */
3647 nt_status
= connect_dst_pipe(c
, &cli_dst
, &srvsvc_pipe
,
3648 &ndr_table_srvsvc
.syntax_id
);
3649 if (!NT_STATUS_IS_OK(nt_status
))
3652 b
= srvsvc_pipe
->binding_handle
;
3654 for (i
= 0; i
< ctr_src
.ctr
.ctr502
->count
; i
++) {
3656 union srvsvc_NetShareInfo info
;
3657 struct srvsvc_NetShareInfo502 info502
=
3658 ctr_src
.ctr
.ctr502
->array
[i
];
3660 /* reset error-code */
3661 nt_status
= NT_STATUS_UNSUCCESSFUL
;
3663 if (!check_share_sanity(c
, cli
, info502
.name
, info502
.type
))
3666 /* finally add the share on the dst server */
3668 printf(_("migrating: [%s], path: %s, comment: %s, without "
3670 info502
.name
, info502
.path
, info502
.comment
);
3672 info
.info502
= &info502
;
3674 nt_status
= dcerpc_srvsvc_NetShareAdd(b
, mem_ctx
,
3675 srvsvc_pipe
->desthost
,
3680 if (!NT_STATUS_IS_OK(nt_status
)) {
3681 printf(_("cannot add share: %s\n"),
3682 nt_errstr(nt_status
));
3685 if (W_ERROR_V(result
) == W_ERROR_V(WERR_FILE_EXISTS
)) {
3686 printf(_(" [%s] does already exist\n"),
3691 if (!W_ERROR_IS_OK(result
)) {
3692 nt_status
= werror_to_ntstatus(result
);
3693 printf(_("cannot add share: %s\n"),
3694 win_errstr(result
));
3700 nt_status
= NT_STATUS_OK
;
3704 cli_shutdown(cli_dst
);
3712 * Migrate shares from a RPC server to another.
3714 * @param argc Standard main() style argc.
3715 * @param argv Standard main() style argv. Initial components are already
3718 * @return A shell status integer (0 for success).
3720 static int rpc_share_migrate_shares(struct net_context
*c
, int argc
,
3723 if (c
->display_usage
) {
3725 "net rpc share migrate shares\n"
3728 _("Migrate shares to local server"));
3733 printf(_("no server to migrate\n"));
3737 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
, 0,
3738 rpc_share_migrate_shares_internals
,
3745 * @param f file_info
3746 * @param mask current search mask
3747 * @param state arg-pointer
3750 static NTSTATUS
copy_fn(const char *mnt
, struct file_info
*f
,
3751 const char *mask
, void *state
)
3753 static NTSTATUS nt_status
;
3754 static struct copy_clistate
*local_state
;
3755 static fstring filename
, new_mask
;
3758 struct net_context
*c
;
3760 local_state
= (struct copy_clistate
*)state
;
3761 nt_status
= NT_STATUS_UNSUCCESSFUL
;
3765 if (strequal(f
->name
, ".") || strequal(f
->name
, ".."))
3766 return NT_STATUS_OK
;
3768 DEBUG(3,("got mask: %s, name: %s\n", mask
, f
->name
));
3771 if (f
->mode
& FILE_ATTRIBUTE_DIRECTORY
) {
3773 DEBUG(3,("got dir: %s\n", f
->name
));
3775 fstrcpy(dir
, local_state
->cwd
);
3777 fstrcat(dir
, f
->name
);
3779 switch (net_mode_share
)
3781 case NET_MODE_SHARE_MIGRATE
:
3782 /* create that directory */
3783 nt_status
= net_copy_file(c
, local_state
->mem_ctx
,
3784 local_state
->cli_share_src
,
3785 local_state
->cli_share_dst
,
3787 c
->opt_acls
? true : false,
3788 c
->opt_attrs
? true : false,
3789 c
->opt_timestamps
? true:false,
3793 d_fprintf(stderr
, _("Unsupported mode %d\n"), net_mode_share
);
3794 return NT_STATUS_INTERNAL_ERROR
;
3797 if (!NT_STATUS_IS_OK(nt_status
)) {
3798 printf(_("could not handle dir %s: %s\n"),
3799 dir
, nt_errstr(nt_status
));
3803 /* search below that directory */
3804 if (strlcpy(new_mask
, dir
, sizeof(new_mask
)) >= sizeof(new_mask
)) {
3805 return NT_STATUS_NO_MEMORY
;
3807 if (strlcat(new_mask
, "\\*", sizeof(new_mask
)) >= sizeof(new_mask
)) {
3808 return NT_STATUS_NO_MEMORY
;
3811 old_dir
= local_state
->cwd
;
3812 local_state
->cwd
= dir
;
3813 nt_status
= sync_files(local_state
, new_mask
);
3814 if (!NT_STATUS_IS_OK(nt_status
)) {
3815 printf(_("could not handle files\n"));
3817 local_state
->cwd
= old_dir
;
3824 fstrcpy(filename
, local_state
->cwd
);
3825 fstrcat(filename
, "\\");
3826 fstrcat(filename
, f
->name
);
3828 DEBUG(3,("got file: %s\n", filename
));
3830 switch (net_mode_share
)
3832 case NET_MODE_SHARE_MIGRATE
:
3833 nt_status
= net_copy_file(c
, local_state
->mem_ctx
,
3834 local_state
->cli_share_src
,
3835 local_state
->cli_share_dst
,
3837 c
->opt_acls
? true : false,
3838 c
->opt_attrs
? true : false,
3839 c
->opt_timestamps
? true: false,
3843 d_fprintf(stderr
, _("Unsupported file mode %d\n"),
3845 return NT_STATUS_INTERNAL_ERROR
;
3848 if (!NT_STATUS_IS_OK(nt_status
))
3849 printf(_("could not handle file %s: %s\n"),
3850 filename
, nt_errstr(nt_status
));
3855 * sync files, can be called recursivly to list files
3856 * and then call copy_fn for each file
3858 * @param cp_clistate pointer to the copy_clistate we work with
3859 * @param mask the current search mask
3861 * @return Boolean result
3863 static NTSTATUS
sync_files(struct copy_clistate
*cp_clistate
, const char *mask
)
3865 struct cli_state
*targetcli
;
3866 char *targetpath
= NULL
;
3869 DEBUG(3,("calling cli_list with mask: %s\n", mask
));
3871 status
= cli_resolve_path(talloc_tos(), "", NULL
,
3872 cp_clistate
->cli_share_src
,
3873 mask
, &targetcli
, &targetpath
);
3874 if (!NT_STATUS_IS_OK(status
)) {
3875 d_fprintf(stderr
, _("cli_resolve_path %s failed with error: "
3877 mask
, nt_errstr(status
));
3881 status
= cli_list(targetcli
, targetpath
, cp_clistate
->attribute
,
3882 copy_fn
, cp_clistate
);
3883 if (!NT_STATUS_IS_OK(status
)) {
3884 d_fprintf(stderr
, _("listing %s failed with error: %s\n"),
3885 mask
, nt_errstr(status
));
3893 * Set the top level directory permissions before we do any further copies.
3894 * Should set up ACL inheritance.
3897 bool copy_top_level_perms(struct net_context
*c
,
3898 struct copy_clistate
*cp_clistate
,
3899 const char *sharename
)
3901 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
3903 switch (net_mode_share
) {
3904 case NET_MODE_SHARE_MIGRATE
:
3905 DEBUG(3,("calling net_copy_fileattr for '.' directory in share %s\n", sharename
));
3906 nt_status
= net_copy_fileattr(c
,
3907 cp_clistate
->mem_ctx
,
3908 cp_clistate
->cli_share_src
,
3909 cp_clistate
->cli_share_dst
,
3911 c
->opt_acls
? true : false,
3912 c
->opt_attrs
? true : false,
3913 c
->opt_timestamps
? true: false,
3917 d_fprintf(stderr
, _("Unsupported mode %d\n"), net_mode_share
);
3921 if (!NT_STATUS_IS_OK(nt_status
)) {
3922 printf(_("Could handle directory attributes for top level "
3923 "directory of share %s. Error %s\n"),
3924 sharename
, nt_errstr(nt_status
));
3932 * Sync all files inside a remote share to another share (over smb).
3934 * All parameters are provided by the run_rpc_command function, except for
3935 * argc, argv which are passed through.
3937 * @param domain_sid The domain sid acquired from the remote server.
3938 * @param cli A cli_state connected to the server.
3939 * @param mem_ctx Talloc context, destroyed on completion of the function.
3940 * @param argc Standard main() style argc.
3941 * @param argv Standard main() style argv. Initial components are already
3944 * @return Normal NTSTATUS return.
3947 static NTSTATUS
rpc_share_migrate_files_internals(struct net_context
*c
,
3948 const struct dom_sid
*domain_sid
,
3949 const char *domain_name
,
3950 struct cli_state
*cli
,
3951 struct rpc_pipe_client
*pipe_hnd
,
3952 TALLOC_CTX
*mem_ctx
,
3957 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
3958 struct srvsvc_NetShareInfoCtr ctr_src
;
3961 struct copy_clistate cp_clistate
;
3962 bool got_src_share
= false;
3963 bool got_dst_share
= false;
3964 const char *mask
= "\\*";
3967 dst
= SMB_STRDUP(c
->opt_destination
?c
->opt_destination
:"127.0.0.1");
3969 nt_status
= NT_STATUS_NO_MEMORY
;
3973 result
= get_share_info(c
, pipe_hnd
, mem_ctx
, level
, argc
, argv
,
3976 if (!W_ERROR_IS_OK(result
))
3979 for (i
= 0; i
< ctr_src
.ctr
.ctr502
->count
; i
++) {
3981 struct srvsvc_NetShareInfo502 info502
=
3982 ctr_src
.ctr
.ctr502
->array
[i
];
3984 if (!check_share_sanity(c
, cli
, info502
.name
, info502
.type
))
3987 /* one might not want to mirror whole discs :) */
3988 if (strequal(info502
.name
, "print$") || info502
.name
[1] == '$') {
3989 d_printf(_("skipping [%s]: builtin/hidden share\n"),
3994 switch (net_mode_share
)
3996 case NET_MODE_SHARE_MIGRATE
:
4000 d_fprintf(stderr
, _("Unsupported mode %d\n"),
4004 printf(_(" [%s] files and directories %s ACLs, %s DOS "
4007 c
->opt_acls
? _("including") : _("without"),
4008 c
->opt_attrs
? _("including") : _("without"),
4009 c
->opt_timestamps
? _("(preserving timestamps)") : "");
4011 cp_clistate
.mem_ctx
= mem_ctx
;
4012 cp_clistate
.cli_share_src
= NULL
;
4013 cp_clistate
.cli_share_dst
= NULL
;
4014 cp_clistate
.cwd
= NULL
;
4015 cp_clistate
.attribute
= FILE_ATTRIBUTE_SYSTEM
| FILE_ATTRIBUTE_HIDDEN
| FILE_ATTRIBUTE_DIRECTORY
;
4018 /* open share source */
4019 nt_status
= connect_to_service(c
, &cp_clistate
.cli_share_src
,
4020 smbXcli_conn_remote_sockaddr(cli
->conn
),
4021 smbXcli_conn_remote_name(cli
->conn
),
4022 info502
.name
, "A:");
4023 if (!NT_STATUS_IS_OK(nt_status
))
4026 got_src_share
= true;
4028 if (net_mode_share
== NET_MODE_SHARE_MIGRATE
) {
4029 /* open share destination */
4030 nt_status
= connect_to_service(c
, &cp_clistate
.cli_share_dst
,
4031 NULL
, dst
, info502
.name
, "A:");
4032 if (!NT_STATUS_IS_OK(nt_status
))
4035 got_dst_share
= true;
4038 if (!copy_top_level_perms(c
, &cp_clistate
, info502
.name
)) {
4039 d_fprintf(stderr
, _("Could not handle the top level "
4040 "directory permissions for the "
4041 "share: %s\n"), info502
.name
);
4042 nt_status
= NT_STATUS_UNSUCCESSFUL
;
4046 nt_status
= sync_files(&cp_clistate
, mask
);
4047 if (!NT_STATUS_IS_OK(nt_status
)) {
4048 d_fprintf(stderr
, _("could not handle files for share: "
4049 "%s\n"), info502
.name
);
4054 nt_status
= NT_STATUS_OK
;
4059 cli_shutdown(cp_clistate
.cli_share_src
);
4062 cli_shutdown(cp_clistate
.cli_share_dst
);
4069 static int rpc_share_migrate_files(struct net_context
*c
, int argc
, const char **argv
)
4071 if (c
->display_usage
) {
4073 "net share migrate files\n"
4076 _("Migrate files to local server"));
4081 d_printf(_("no server to migrate\n"));
4085 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
, 0,
4086 rpc_share_migrate_files_internals
,
4091 * Migrate share-ACLs from a remote RPC server to the local RPC server.
4093 * All parameters are provided by the run_rpc_command function, except for
4094 * argc, argv which are passed through.
4096 * @param domain_sid The domain sid acquired from the remote server.
4097 * @param cli A cli_state connected to the server.
4098 * @param mem_ctx Talloc context, destroyed on completion of the function.
4099 * @param argc Standard main() style argc.
4100 * @param argv Standard main() style argv. Initial components are already
4103 * @return Normal NTSTATUS return.
4106 static NTSTATUS
rpc_share_migrate_security_internals(struct net_context
*c
,
4107 const struct dom_sid
*domain_sid
,
4108 const char *domain_name
,
4109 struct cli_state
*cli
,
4110 struct rpc_pipe_client
*pipe_hnd
,
4111 TALLOC_CTX
*mem_ctx
,
4116 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
4117 struct srvsvc_NetShareInfoCtr ctr_src
;
4118 union srvsvc_NetShareInfo info
;
4120 struct rpc_pipe_client
*srvsvc_pipe
= NULL
;
4121 struct cli_state
*cli_dst
= NULL
;
4122 uint32 level
= 502; /* includes secdesc */
4123 uint32_t parm_error
= 0;
4124 struct dcerpc_binding_handle
*b
;
4126 result
= get_share_info(c
, pipe_hnd
, mem_ctx
, level
, argc
, argv
,
4129 if (!W_ERROR_IS_OK(result
))
4132 /* connect destination PI_SRVSVC */
4133 nt_status
= connect_dst_pipe(c
, &cli_dst
, &srvsvc_pipe
,
4134 &ndr_table_srvsvc
.syntax_id
);
4135 if (!NT_STATUS_IS_OK(nt_status
))
4138 b
= srvsvc_pipe
->binding_handle
;
4140 for (i
= 0; i
< ctr_src
.ctr
.ctr502
->count
; i
++) {
4142 struct srvsvc_NetShareInfo502 info502
=
4143 ctr_src
.ctr
.ctr502
->array
[i
];
4145 /* reset error-code */
4146 nt_status
= NT_STATUS_UNSUCCESSFUL
;
4148 if (!check_share_sanity(c
, cli
, info502
.name
, info502
.type
))
4151 printf(_("migrating: [%s], path: %s, comment: %s, including "
4153 info502
.name
, info502
.path
, info502
.comment
);
4156 display_sec_desc(info502
.sd_buf
.sd
);
4158 /* FIXME: shouldn't we be able to just set the security descriptor ? */
4159 info
.info502
= &info502
;
4161 /* finally modify the share on the dst server */
4162 nt_status
= dcerpc_srvsvc_NetShareSetInfo(b
, mem_ctx
,
4163 srvsvc_pipe
->desthost
,
4169 if (!NT_STATUS_IS_OK(nt_status
)) {
4170 printf(_("cannot set share-acl: %s\n"),
4171 nt_errstr(nt_status
));
4174 if (!W_ERROR_IS_OK(result
)) {
4175 nt_status
= werror_to_ntstatus(result
);
4176 printf(_("cannot set share-acl: %s\n"),
4177 win_errstr(result
));
4183 nt_status
= NT_STATUS_OK
;
4187 cli_shutdown(cli_dst
);
4195 * Migrate share-acls from a RPC server to another.
4197 * @param argc Standard main() style argc.
4198 * @param argv Standard main() style argv. Initial components are already
4201 * @return A shell status integer (0 for success).
4203 static int rpc_share_migrate_security(struct net_context
*c
, int argc
,
4206 if (c
->display_usage
) {
4208 "net rpc share migrate security\n"
4211 _("Migrate share-acls to local server"));
4216 d_printf(_("no server to migrate\n"));
4220 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
, 0,
4221 rpc_share_migrate_security_internals
,
4226 * Migrate shares (including share-definitions, share-acls and files with acls/attrs)
4227 * from one server to another.
4229 * @param argc Standard main() style argc.
4230 * @param argv Standard main() style argv. Initial components are already
4233 * @return A shell status integer (0 for success).
4236 static int rpc_share_migrate_all(struct net_context
*c
, int argc
,
4241 if (c
->display_usage
) {
4243 "net rpc share migrate all\n"
4246 _("Migrates shares including all share settings"));
4251 d_printf(_("no server to migrate\n"));
4255 /* order is important. we don't want to be locked out by the share-acl
4256 * before copying files - gd */
4258 ret
= run_rpc_command(c
, NULL
, &ndr_table_srvsvc
, 0,
4259 rpc_share_migrate_shares_internals
, argc
, argv
);
4263 ret
= run_rpc_command(c
, NULL
, &ndr_table_srvsvc
, 0,
4264 rpc_share_migrate_files_internals
, argc
, argv
);
4268 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
, 0,
4269 rpc_share_migrate_security_internals
, argc
,
4275 * 'net rpc share migrate' entrypoint.
4276 * @param argc Standard main() style argc.
4277 * @param argv Standard main() style argv. Initial components are already
4280 static int rpc_share_migrate(struct net_context
*c
, int argc
, const char **argv
)
4283 struct functable func
[] = {
4286 rpc_share_migrate_all
,
4288 N_("Migrate shares from remote to local server"),
4289 N_("net rpc share migrate all\n"
4290 " Migrate shares from remote to local server")
4294 rpc_share_migrate_files
,
4296 N_("Migrate files from remote to local server"),
4297 N_("net rpc share migrate files\n"
4298 " Migrate files from remote to local server")
4302 rpc_share_migrate_security
,
4304 N_("Migrate share-ACLs from remote to local server"),
4305 N_("net rpc share migrate security\n"
4306 " Migrate share-ACLs from remote to local server")
4310 rpc_share_migrate_shares
,
4312 N_("Migrate shares from remote to local server"),
4313 N_("net rpc share migrate shares\n"
4314 " Migrate shares from remote to local server")
4316 {NULL
, NULL
, 0, NULL
, NULL
}
4319 net_mode_share
= NET_MODE_SHARE_MIGRATE
;
4321 return net_run_function(c
, argc
, argv
, "net rpc share migrate", func
);
4327 struct dom_sid
*members
;
4330 static int num_server_aliases
;
4331 static struct full_alias
*server_aliases
;
4334 * Add an alias to the static list.
4336 static void push_alias(TALLOC_CTX
*mem_ctx
, struct full_alias
*alias
)
4338 if (server_aliases
== NULL
)
4339 server_aliases
= SMB_MALLOC_ARRAY(struct full_alias
, 100);
4341 server_aliases
[num_server_aliases
] = *alias
;
4342 num_server_aliases
+= 1;
4346 * For a specific domain on the server, fetch all the aliases
4347 * and their members. Add all of them to the server_aliases.
4350 static NTSTATUS
rpc_fetch_domain_aliases(struct rpc_pipe_client
*pipe_hnd
,
4351 TALLOC_CTX
*mem_ctx
,
4352 struct policy_handle
*connect_pol
,
4353 const struct dom_sid
*domain_sid
)
4355 uint32 start_idx
, max_entries
, num_entries
, i
;
4356 struct samr_SamArray
*groups
= NULL
;
4357 NTSTATUS result
, status
;
4358 struct policy_handle domain_pol
;
4359 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
4361 /* Get domain policy handle */
4363 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
4365 MAXIMUM_ALLOWED_ACCESS
,
4366 discard_const_p(struct dom_sid2
, domain_sid
),
4369 if (!NT_STATUS_IS_OK(status
)) {
4372 if (!NT_STATUS_IS_OK(result
)) {
4380 status
= dcerpc_samr_EnumDomainAliases(b
, mem_ctx
,
4387 if (!NT_STATUS_IS_OK(status
)) {
4390 for (i
= 0; i
< num_entries
; i
++) {
4392 struct policy_handle alias_pol
;
4393 struct full_alias alias
;
4394 struct lsa_SidArray sid_array
;
4398 status
= dcerpc_samr_OpenAlias(b
, mem_ctx
,
4400 MAXIMUM_ALLOWED_ACCESS
,
4401 groups
->entries
[i
].idx
,
4404 if (!NT_STATUS_IS_OK(status
)) {
4407 if (!NT_STATUS_IS_OK(_result
)) {
4412 status
= dcerpc_samr_GetMembersInAlias(b
, mem_ctx
,
4416 if (!NT_STATUS_IS_OK(status
)) {
4419 if (!NT_STATUS_IS_OK(_result
)) {
4424 alias
.num_members
= sid_array
.num_sids
;
4426 status
= dcerpc_samr_Close(b
, mem_ctx
, &alias_pol
, &_result
);
4427 if (!NT_STATUS_IS_OK(status
)) {
4430 if (!NT_STATUS_IS_OK(_result
)) {
4435 alias
.members
= NULL
;
4437 if (alias
.num_members
> 0) {
4438 alias
.members
= SMB_MALLOC_ARRAY(struct dom_sid
, alias
.num_members
);
4440 for (j
= 0; j
< alias
.num_members
; j
++)
4441 sid_copy(&alias
.members
[j
],
4442 sid_array
.sids
[j
].sid
);
4445 sid_compose(&alias
.sid
, domain_sid
,
4446 groups
->entries
[i
].idx
);
4448 push_alias(mem_ctx
, &alias
);
4450 } while (NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
4452 status
= NT_STATUS_OK
;
4455 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
4461 * Dump server_aliases as names for debugging purposes.
4464 static NTSTATUS
rpc_aliaslist_dump(struct net_context
*c
,
4465 const struct dom_sid
*domain_sid
,
4466 const char *domain_name
,
4467 struct cli_state
*cli
,
4468 struct rpc_pipe_client
*pipe_hnd
,
4469 TALLOC_CTX
*mem_ctx
,
4475 struct policy_handle lsa_pol
;
4476 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
4478 result
= rpccli_lsa_open_policy(pipe_hnd
, mem_ctx
, true,
4479 SEC_FLAG_MAXIMUM_ALLOWED
,
4481 if (!NT_STATUS_IS_OK(result
))
4484 for (i
=0; i
<num_server_aliases
; i
++) {
4487 enum lsa_SidType
*types
;
4490 struct full_alias
*alias
= &server_aliases
[i
];
4492 result
= rpccli_lsa_lookup_sids(pipe_hnd
, mem_ctx
, &lsa_pol
, 1,
4494 &domains
, &names
, &types
);
4495 if (!NT_STATUS_IS_OK(result
))
4498 DEBUG(1, ("%s\\%s %d: ", domains
[0], names
[0], types
[0]));
4500 if (alias
->num_members
== 0) {
4505 result
= rpccli_lsa_lookup_sids(pipe_hnd
, mem_ctx
, &lsa_pol
,
4508 &domains
, &names
, &types
);
4510 if (!NT_STATUS_IS_OK(result
) &&
4511 !NT_STATUS_EQUAL(result
, STATUS_SOME_UNMAPPED
))
4514 for (j
=0; j
<alias
->num_members
; j
++)
4515 DEBUG(1, ("%s\\%s (%d); ",
4516 domains
[j
] ? domains
[j
] : "*unknown*",
4517 names
[j
] ? names
[j
] : "*unknown*",types
[j
]));
4521 dcerpc_lsa_Close(b
, mem_ctx
, &lsa_pol
, &result
);
4523 return NT_STATUS_OK
;
4527 * Fetch a list of all server aliases and their members into
4531 static NTSTATUS
rpc_aliaslist_internals(struct net_context
*c
,
4532 const struct dom_sid
*domain_sid
,
4533 const char *domain_name
,
4534 struct cli_state
*cli
,
4535 struct rpc_pipe_client
*pipe_hnd
,
4536 TALLOC_CTX
*mem_ctx
,
4540 NTSTATUS result
, status
;
4541 struct policy_handle connect_pol
;
4542 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
4544 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
4546 MAXIMUM_ALLOWED_ACCESS
,
4549 if (!NT_STATUS_IS_OK(status
)) {
4552 if (!NT_STATUS_IS_OK(result
)) {
4557 status
= rpc_fetch_domain_aliases(pipe_hnd
, mem_ctx
, &connect_pol
,
4558 &global_sid_Builtin
);
4559 if (!NT_STATUS_IS_OK(status
)) {
4563 status
= rpc_fetch_domain_aliases(pipe_hnd
, mem_ctx
, &connect_pol
,
4566 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
4571 static void init_user_token(struct security_token
*token
, struct dom_sid
*user_sid
)
4573 token
->num_sids
= 4;
4575 if (!(token
->sids
= SMB_MALLOC_ARRAY(struct dom_sid
, 4))) {
4576 d_fprintf(stderr
, "malloc %s\n",_("failed"));
4577 token
->num_sids
= 0;
4581 token
->sids
[0] = *user_sid
;
4582 sid_copy(&token
->sids
[1], &global_sid_World
);
4583 sid_copy(&token
->sids
[2], &global_sid_Network
);
4584 sid_copy(&token
->sids
[3], &global_sid_Authenticated_Users
);
4587 static void free_user_token(struct security_token
*token
)
4589 SAFE_FREE(token
->sids
);
4592 static void add_sid_to_token(struct security_token
*token
, struct dom_sid
*sid
)
4594 if (security_token_has_sid(token
, sid
))
4597 token
->sids
= SMB_REALLOC_ARRAY(token
->sids
, struct dom_sid
, token
->num_sids
+1);
4602 sid_copy(&token
->sids
[token
->num_sids
], sid
);
4604 token
->num_sids
+= 1;
4609 struct security_token token
;
4612 static void dump_user_token(struct user_token
*token
)
4616 d_printf("%s\n", token
->name
);
4618 for (i
=0; i
<token
->token
.num_sids
; i
++) {
4619 d_printf(" %s\n", sid_string_tos(&token
->token
.sids
[i
]));
4623 static bool is_alias_member(struct dom_sid
*sid
, struct full_alias
*alias
)
4627 for (i
=0; i
<alias
->num_members
; i
++) {
4628 if (dom_sid_compare(sid
, &alias
->members
[i
]) == 0)
4635 static void collect_sid_memberships(struct security_token
*token
, struct dom_sid sid
)
4639 for (i
=0; i
<num_server_aliases
; i
++) {
4640 if (is_alias_member(&sid
, &server_aliases
[i
]))
4641 add_sid_to_token(token
, &server_aliases
[i
].sid
);
4646 * We got a user token with all the SIDs we can know about without asking the
4647 * server directly. These are the user and domain group sids. All of these can
4648 * be members of aliases. So scan the list of aliases for each of the SIDs and
4649 * add them to the token.
4652 static void collect_alias_memberships(struct security_token
*token
)
4654 int num_global_sids
= token
->num_sids
;
4657 for (i
=0; i
<num_global_sids
; i
++) {
4658 collect_sid_memberships(token
, token
->sids
[i
]);
4662 static bool get_user_sids(const char *domain
, const char *user
, struct security_token
*token
)
4664 wbcErr wbc_status
= WBC_ERR_UNKNOWN_FAILURE
;
4665 enum wbcSidType type
;
4667 struct wbcDomainSid wsid
;
4668 char sid_str
[WBC_SID_STRING_BUFLEN
];
4669 struct dom_sid user_sid
;
4670 uint32_t num_groups
;
4671 gid_t
*groups
= NULL
;
4674 fstr_sprintf(full_name
, "%s%c%s",
4675 domain
, *lp_winbind_separator(), user
);
4677 /* First let's find out the user sid */
4679 wbc_status
= wbcLookupName(domain
, user
, &wsid
, &type
);
4681 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4682 DEBUG(1, ("winbind could not find %s: %s\n",
4683 full_name
, wbcErrorString(wbc_status
)));
4687 wbcSidToStringBuf(&wsid
, sid_str
, sizeof(sid_str
));
4689 if (type
!= WBC_SID_NAME_USER
) {
4690 DEBUG(1, ("%s is not a user\n", full_name
));
4694 if (!string_to_sid(&user_sid
, sid_str
)) {
4695 DEBUG(1,("Could not convert sid %s from string\n", sid_str
));
4699 init_user_token(token
, &user_sid
);
4701 /* And now the groups winbind knows about */
4703 wbc_status
= wbcGetGroups(full_name
, &num_groups
, &groups
);
4704 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4705 DEBUG(1, ("winbind could not get groups of %s: %s\n",
4706 full_name
, wbcErrorString(wbc_status
)));
4710 for (i
= 0; i
< num_groups
; i
++) {
4711 gid_t gid
= groups
[i
];
4714 wbc_status
= wbcGidToSid(gid
, &wsid
);
4715 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4716 DEBUG(1, ("winbind could not find SID of gid %u: %s\n",
4717 (unsigned int)gid
, wbcErrorString(wbc_status
)));
4718 wbcFreeMemory(groups
);
4722 wbcSidToStringBuf(&wsid
, sid_str
, sizeof(sid_str
));
4724 DEBUG(3, (" %s\n", sid_str
));
4726 string_to_sid(&sid
, sid_str
);
4727 add_sid_to_token(token
, &sid
);
4729 wbcFreeMemory(groups
);
4735 * Get a list of all user tokens we want to look at
4738 static bool get_user_tokens(struct net_context
*c
, int *num_tokens
,
4739 struct user_token
**user_tokens
)
4741 wbcErr wbc_status
= WBC_ERR_UNKNOWN_FAILURE
;
4742 uint32_t i
, num_users
;
4744 struct user_token
*result
;
4745 TALLOC_CTX
*frame
= NULL
;
4747 if (lp_winbind_use_default_domain() &&
4748 (c
->opt_target_workgroup
== NULL
)) {
4749 d_fprintf(stderr
, _("winbind use default domain = yes set, "
4750 "please specify a workgroup\n"));
4754 /* Send request to winbind daemon */
4756 wbc_status
= wbcListUsers(NULL
, &num_users
, &users
);
4757 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4758 DEBUG(1, (_("winbind could not list users: %s\n"),
4759 wbcErrorString(wbc_status
)));
4763 result
= SMB_MALLOC_ARRAY(struct user_token
, num_users
);
4765 if (result
== NULL
) {
4766 DEBUG(1, ("Could not malloc sid array\n"));
4767 wbcFreeMemory(users
);
4771 frame
= talloc_stackframe();
4772 for (i
=0; i
< num_users
; i
++) {
4773 fstring domain
, user
;
4776 fstrcpy(result
[i
].name
, users
[i
]);
4778 p
= strchr(users
[i
], *lp_winbind_separator());
4780 DEBUG(3, ("%s\n", users
[i
]));
4783 fstrcpy(domain
, c
->opt_target_workgroup
);
4784 fstrcpy(user
, users
[i
]);
4787 fstrcpy(domain
, users
[i
]);
4788 if (!strupper_m(domain
)) {
4789 DEBUG(1, ("strupper_m %s failed\n", domain
));
4790 wbcFreeMemory(users
);
4796 get_user_sids(domain
, user
, &(result
[i
].token
));
4799 wbcFreeMemory(users
);
4801 *num_tokens
= num_users
;
4802 *user_tokens
= result
;
4807 static bool get_user_tokens_from_file(FILE *f
,
4809 struct user_token
**tokens
)
4811 struct user_token
*token
= NULL
;
4816 if (fgets(line
, sizeof(line
)-1, f
) == NULL
) {
4820 if ((strlen(line
) > 0) && (line
[strlen(line
)-1] == '\n')) {
4821 line
[strlen(line
)-1] = '\0';
4824 if (line
[0] == ' ') {
4828 if(!string_to_sid(&sid
, &line
[1])) {
4829 DEBUG(1,("get_user_tokens_from_file: Could "
4830 "not convert sid %s \n",&line
[1]));
4834 if (token
== NULL
) {
4835 DEBUG(0, ("File does not begin with username"));
4839 add_sid_to_token(&token
->token
, &sid
);
4843 /* And a new user... */
4846 *tokens
= SMB_REALLOC_ARRAY(*tokens
, struct user_token
, *num_tokens
);
4847 if (*tokens
== NULL
) {
4848 DEBUG(0, ("Could not realloc tokens\n"));
4852 token
= &((*tokens
)[*num_tokens
-1]);
4854 if (strlcpy(token
->name
, line
, sizeof(token
->name
)) >= sizeof(token
->name
)) {
4857 token
->token
.num_sids
= 0;
4858 token
->token
.sids
= NULL
;
4867 * Show the list of all users that have access to a share
4870 static void show_userlist(struct rpc_pipe_client
*pipe_hnd
,
4871 TALLOC_CTX
*mem_ctx
,
4872 const char *netname
,
4874 struct user_token
*tokens
)
4877 struct security_descriptor
*share_sd
= NULL
;
4878 struct security_descriptor
*root_sd
= NULL
;
4879 struct cli_state
*cli
= rpc_pipe_np_smb_conn(pipe_hnd
);
4881 union srvsvc_NetShareInfo info
;
4885 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
4887 status
= dcerpc_srvsvc_NetShareGetInfo(b
, mem_ctx
,
4894 if (!NT_STATUS_IS_OK(status
) || !W_ERROR_IS_OK(result
)) {
4895 DEBUG(1, ("Coult not query secdesc for share %s\n",
4900 share_sd
= info
.info502
->sd_buf
.sd
;
4901 if (share_sd
== NULL
) {
4902 DEBUG(1, ("Got no secdesc for share %s\n",
4906 cnum
= cli_state_get_tid(cli
);
4908 if (!NT_STATUS_IS_OK(cli_tree_connect(cli
, netname
, "A:", "", 0))) {
4912 if (!NT_STATUS_IS_OK(cli_ntcreate(cli
, "\\", 0, READ_CONTROL_ACCESS
, 0,
4913 FILE_SHARE_READ
|FILE_SHARE_WRITE
, FILE_OPEN
, 0x0, 0x0, &fnum
))) {
4914 cli_query_secdesc(cli
, fnum
, mem_ctx
, &root_sd
);
4917 for (i
=0; i
<num_tokens
; i
++) {
4920 if (share_sd
!= NULL
) {
4921 status
= se_access_check(share_sd
, &tokens
[i
].token
,
4924 if (!NT_STATUS_IS_OK(status
)) {
4925 DEBUG(1, ("Could not check share_sd for "
4932 if (root_sd
== NULL
) {
4933 d_printf(" %s\n", tokens
[i
].name
);
4937 status
= se_access_check(root_sd
, &tokens
[i
].token
,
4939 if (!NT_STATUS_IS_OK(status
)) {
4940 DEBUG(1, ("Could not check root_sd for user %s\n",
4944 d_printf(" %s\n", tokens
[i
].name
);
4947 if (fnum
!= (uint16_t)-1)
4948 cli_close(cli
, fnum
);
4950 cli_state_set_tid(cli
, cnum
);
4956 * List shares on a remote RPC server, including the security descriptors.
4958 * All parameters are provided by the run_rpc_command function, except for
4959 * argc, argv which are passed through.
4961 * @param domain_sid The domain sid acquired from the remote server.
4962 * @param cli A cli_state connected to the server.
4963 * @param mem_ctx Talloc context, destroyed on completion of the function.
4964 * @param argc Standard main() style argc.
4965 * @param argv Standard main() style argv. Initial components are already
4968 * @return Normal NTSTATUS return.
4971 static NTSTATUS
rpc_share_allowedusers_internals(struct net_context
*c
,
4972 const struct dom_sid
*domain_sid
,
4973 const char *domain_name
,
4974 struct cli_state
*cli
,
4975 struct rpc_pipe_client
*pipe_hnd
,
4976 TALLOC_CTX
*mem_ctx
,
4982 NTSTATUS nt_status
= NT_STATUS_OK
;
4983 uint32_t total_entries
= 0;
4984 uint32_t resume_handle
= 0;
4985 uint32_t preferred_len
= 0xffffffff;
4987 struct dcerpc_binding_handle
*b
= NULL
;
4988 struct srvsvc_NetShareInfoCtr info_ctr
;
4989 struct srvsvc_NetShareCtr1 ctr1
;
4992 struct user_token
*tokens
= NULL
;
4998 f
= fopen(argv
[0], "r");
5002 DEBUG(0, ("Could not open userlist: %s\n", strerror(errno
)));
5003 return NT_STATUS_UNSUCCESSFUL
;
5006 r
= get_user_tokens_from_file(f
, &num_tokens
, &tokens
);
5012 DEBUG(0, ("Could not read users from file\n"));
5013 return NT_STATUS_UNSUCCESSFUL
;
5016 for (i
=0; i
<num_tokens
; i
++)
5017 collect_alias_memberships(&tokens
[i
].token
);
5019 ZERO_STRUCT(info_ctr
);
5023 info_ctr
.ctr
.ctr1
= &ctr1
;
5025 b
= pipe_hnd
->binding_handle
;
5027 /* Issue the NetShareEnum RPC call and retrieve the response */
5028 nt_status
= dcerpc_srvsvc_NetShareEnumAll(b
,
5037 /* Was it successful? */
5038 if (!NT_STATUS_IS_OK(nt_status
)) {
5039 /* Nope. Go clean up. */
5043 if (!W_ERROR_IS_OK(result
)) {
5044 /* Nope. Go clean up. */
5045 nt_status
= werror_to_ntstatus(result
);
5049 if (total_entries
== 0) {
5053 /* For each returned entry... */
5054 for (i
= 0; i
< info_ctr
.ctr
.ctr1
->count
; i
++) {
5055 const char *netname
= info_ctr
.ctr
.ctr1
->array
[i
].name
;
5057 if (info_ctr
.ctr
.ctr1
->array
[i
].type
!= STYPE_DISKTREE
) {
5061 d_printf("%s\n", netname
);
5063 show_userlist(pipe_hnd
, mem_ctx
, netname
,
5064 num_tokens
, tokens
);
5067 for (i
=0; i
<num_tokens
; i
++) {
5068 free_user_token(&tokens
[i
].token
);
5075 static int rpc_share_allowedusers(struct net_context
*c
, int argc
,
5080 if (c
->display_usage
) {
5082 "net rpc share allowedusers\n"
5085 _("List allowed users"));
5089 result
= run_rpc_command(c
, NULL
, &ndr_table_samr
, 0,
5090 rpc_aliaslist_internals
,
5095 result
= run_rpc_command(c
, NULL
, &ndr_table_lsarpc
, 0,
5101 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
, 0,
5102 rpc_share_allowedusers_internals
,
5106 int net_usersidlist(struct net_context
*c
, int argc
, const char **argv
)
5109 struct user_token
*tokens
= NULL
;
5113 net_usersidlist_usage(c
, argc
, argv
);
5117 if (!get_user_tokens(c
, &num_tokens
, &tokens
)) {
5118 DEBUG(0, ("Could not get the user/sid list\n"));
5122 for (i
=0; i
<num_tokens
; i
++) {
5123 dump_user_token(&tokens
[i
]);
5124 free_user_token(&tokens
[i
].token
);
5131 int net_usersidlist_usage(struct net_context
*c
, int argc
, const char **argv
)
5133 d_printf(_("net usersidlist\n"
5134 "\tprints out a list of all users the running winbind knows\n"
5135 "\tabout, together with all their SIDs. This is used as\n"
5136 "\tinput to the 'net rpc share allowedusers' command.\n\n"));
5138 net_common_flags_usage(c
, argc
, argv
);
5143 * 'net rpc share' entrypoint.
5144 * @param argc Standard main() style argc.
5145 * @param argv Standard main() style argv. Initial components are already
5149 int net_rpc_share(struct net_context
*c
, int argc
, const char **argv
)
5151 NET_API_STATUS status
;
5153 struct functable func
[] = {
5159 N_("net rpc share add\n"
5167 N_("net rpc share delete\n"
5172 rpc_share_allowedusers
,
5174 N_("Modify allowed users"),
5175 N_("net rpc share allowedusers\n"
5176 " Modify allowed users")
5182 N_("Migrate share to local server"),
5183 N_("net rpc share migrate\n"
5184 " Migrate share to local server")
5191 N_("net rpc share list\n"
5194 {NULL
, NULL
, 0, NULL
, NULL
}
5197 status
= libnetapi_net_init(&c
->netapi_ctx
);
5201 libnetapi_set_username(c
->netapi_ctx
, c
->opt_user_name
);
5202 libnetapi_set_password(c
->netapi_ctx
, c
->opt_password
);
5203 if (c
->opt_kerberos
) {
5204 libnetapi_set_use_kerberos(c
->netapi_ctx
);
5208 if (c
->display_usage
) {
5213 " Alias for net rpc share list\n"));
5214 net_display_usage_from_functable(func
);
5218 return rpc_share_list(c
, argc
, argv
);
5221 return net_run_function(c
, argc
, argv
, "net rpc share", func
);
5224 static NTSTATUS
rpc_sh_share_list(struct net_context
*c
,
5225 TALLOC_CTX
*mem_ctx
,
5226 struct rpc_sh_ctx
*ctx
,
5227 struct rpc_pipe_client
*pipe_hnd
,
5228 int argc
, const char **argv
)
5231 return werror_to_ntstatus(W_ERROR(rpc_share_list(c
, argc
, argv
)));
5234 static NTSTATUS
rpc_sh_share_add(struct net_context
*c
,
5235 TALLOC_CTX
*mem_ctx
,
5236 struct rpc_sh_ctx
*ctx
,
5237 struct rpc_pipe_client
*pipe_hnd
,
5238 int argc
, const char **argv
)
5240 NET_API_STATUS status
;
5241 uint32_t parm_err
= 0;
5242 struct SHARE_INFO_2 i2
;
5244 if ((argc
< 2) || (argc
> 3)) {
5245 d_fprintf(stderr
, _("Usage: %s <share> <path> [comment]\n"),
5247 return NT_STATUS_INVALID_PARAMETER
;
5250 i2
.shi2_netname
= argv
[0];
5251 i2
.shi2_type
= STYPE_DISKTREE
;
5252 i2
.shi2_remark
= (argc
== 3) ? argv
[2] : "";
5253 i2
.shi2_permissions
= 0;
5254 i2
.shi2_max_uses
= 0;
5255 i2
.shi2_current_uses
= 0;
5256 i2
.shi2_path
= argv
[1];
5257 i2
.shi2_passwd
= NULL
;
5259 status
= NetShareAdd(pipe_hnd
->desthost
,
5264 return werror_to_ntstatus(W_ERROR(status
));
5267 static NTSTATUS
rpc_sh_share_delete(struct net_context
*c
,
5268 TALLOC_CTX
*mem_ctx
,
5269 struct rpc_sh_ctx
*ctx
,
5270 struct rpc_pipe_client
*pipe_hnd
,
5271 int argc
, const char **argv
)
5274 d_fprintf(stderr
, "%s %s <share>\n", _("Usage:"), ctx
->whoami
);
5275 return NT_STATUS_INVALID_PARAMETER
;
5278 return werror_to_ntstatus(W_ERROR(NetShareDel(pipe_hnd
->desthost
, argv
[0], 0)));
5281 static NTSTATUS
rpc_sh_share_info(struct net_context
*c
,
5282 TALLOC_CTX
*mem_ctx
,
5283 struct rpc_sh_ctx
*ctx
,
5284 struct rpc_pipe_client
*pipe_hnd
,
5285 int argc
, const char **argv
)
5287 union srvsvc_NetShareInfo info
;
5290 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
5293 d_fprintf(stderr
, "%s %s <share>\n", _("Usage:"), ctx
->whoami
);
5294 return NT_STATUS_INVALID_PARAMETER
;
5297 status
= dcerpc_srvsvc_NetShareGetInfo(b
, mem_ctx
,
5303 if (!NT_STATUS_IS_OK(status
)) {
5304 result
= ntstatus_to_werror(status
);
5307 if (!W_ERROR_IS_OK(result
)) {
5311 d_printf(_("Name: %s\n"), info
.info2
->name
);
5312 d_printf(_("Comment: %s\n"), info
.info2
->comment
);
5313 d_printf(_("Path: %s\n"), info
.info2
->path
);
5314 d_printf(_("Password: %s\n"), info
.info2
->password
);
5317 return werror_to_ntstatus(result
);
5320 struct rpc_sh_cmd
*net_rpc_share_cmds(struct net_context
*c
, TALLOC_CTX
*mem_ctx
,
5321 struct rpc_sh_ctx
*ctx
)
5323 static struct rpc_sh_cmd cmds
[] = {
5325 { "list", NULL
, &ndr_table_srvsvc
, rpc_sh_share_list
,
5326 N_("List available shares") },
5328 { "add", NULL
, &ndr_table_srvsvc
, rpc_sh_share_add
,
5329 N_("Add a share") },
5331 { "delete", NULL
, &ndr_table_srvsvc
, rpc_sh_share_delete
,
5332 N_("Delete a share") },
5334 { "info", NULL
, &ndr_table_srvsvc
, rpc_sh_share_info
,
5335 N_("Get information about a share") },
5337 { NULL
, NULL
, 0, NULL
, NULL
}
5343 /****************************************************************************/
5345 static int rpc_file_usage(struct net_context
*c
, int argc
, const char **argv
)
5347 return net_file_usage(c
, argc
, argv
);
5351 * Close a file on a remote RPC server.
5353 * @param argc Standard main() style argc.
5354 * @param argv Standard main() style argv. Initial components are already
5357 * @return A shell status integer (0 for success).
5359 static int rpc_file_close(struct net_context
*c
, int argc
, const char **argv
)
5361 if (argc
< 1 || c
->display_usage
) {
5362 return rpc_file_usage(c
, argc
, argv
);
5365 return NetFileClose(c
->opt_host
, atoi(argv
[0]));
5369 * Formatted print of open file info
5371 * @param r struct FILE_INFO_3 contents
5374 static void display_file_info_3(struct FILE_INFO_3
*r
)
5376 d_printf("%-7.1d %-20.20s 0x%-4.2x %-6.1d %s\n",
5377 r
->fi3_id
, r
->fi3_username
, r
->fi3_permissions
,
5378 r
->fi3_num_locks
, r
->fi3_pathname
);
5382 * List files for a user on a remote RPC server.
5384 * @param argc Standard main() style argc.
5385 * @param argv Standard main() style argv. Initial components are already
5388 * @return A shell status integer (0 for success)..
5391 static int rpc_file_user(struct net_context
*c
, int argc
, const char **argv
)
5393 NET_API_STATUS status
;
5394 uint32 preferred_len
= 0xffffffff, i
;
5395 const char *username
=NULL
;
5396 uint32_t total_entries
= 0;
5397 uint32_t entries_read
= 0;
5398 uint32_t resume_handle
= 0;
5399 struct FILE_INFO_3
*i3
= NULL
;
5401 if (c
->display_usage
) {
5402 return rpc_file_usage(c
, argc
, argv
);
5405 /* if argc > 0, must be user command */
5407 username
= smb_xstrdup(argv
[0]);
5410 status
= NetFileEnum(c
->opt_host
,
5414 (uint8_t **)(void *)&i3
,
5424 /* Display results */
5427 "\nEnumerating open files on remote server:\n\n"
5428 "\nFileId Opened by Perms Locks Path"
5429 "\n------ --------- ----- ----- ---- \n"));
5430 for (i
= 0; i
< entries_read
; i
++) {
5431 display_file_info_3(&i3
[i
]);
5438 * 'net rpc file' entrypoint.
5439 * @param argc Standard main() style argc.
5440 * @param argv Standard main() style argv. Initial components are already
5444 int net_rpc_file(struct net_context
*c
, int argc
, const char **argv
)
5446 NET_API_STATUS status
;
5448 struct functable func
[] = {
5453 N_("Close opened file"),
5454 N_("net rpc file close\n"
5455 " Close opened file")
5461 N_("List files opened by user"),
5462 N_("net rpc file user\n"
5463 " List files opened by user")
5470 N_("Display information about opened file"),
5471 N_("net rpc file info\n"
5472 " Display information about opened file")
5475 {NULL
, NULL
, 0, NULL
, NULL
}
5478 status
= libnetapi_net_init(&c
->netapi_ctx
);
5482 libnetapi_set_username(c
->netapi_ctx
, c
->opt_user_name
);
5483 libnetapi_set_password(c
->netapi_ctx
, c
->opt_password
);
5484 if (c
->opt_kerberos
) {
5485 libnetapi_set_use_kerberos(c
->netapi_ctx
);
5489 if (c
->display_usage
) {
5490 d_printf(_("Usage:\n"));
5491 d_printf(_("net rpc file\n"
5492 " List opened files\n"));
5493 net_display_usage_from_functable(func
);
5497 return rpc_file_user(c
, argc
, argv
);
5500 return net_run_function(c
, argc
, argv
, "net rpc file", func
);
5504 * ABORT the shutdown of a remote RPC Server, over initshutdown pipe.
5506 * All parameters are provided by the run_rpc_command function, except for
5507 * argc, argv which are passed through.
5509 * @param c A net_context structure.
5510 * @param domain_sid The domain sid acquired from the remote server.
5511 * @param cli A cli_state connected to the server.
5512 * @param mem_ctx Talloc context, destroyed on completion of the function.
5513 * @param argc Standard main() style argc.
5514 * @param argv Standard main() style argv. Initial components are already
5517 * @return Normal NTSTATUS return.
5520 static NTSTATUS
rpc_shutdown_abort_internals(struct net_context
*c
,
5521 const struct dom_sid
*domain_sid
,
5522 const char *domain_name
,
5523 struct cli_state
*cli
,
5524 struct rpc_pipe_client
*pipe_hnd
,
5525 TALLOC_CTX
*mem_ctx
,
5529 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
5531 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
5533 status
= dcerpc_initshutdown_Abort(b
, mem_ctx
, NULL
, &result
);
5534 if (!NT_STATUS_IS_OK(status
)) {
5537 if (W_ERROR_IS_OK(result
)) {
5538 d_printf(_("\nShutdown successfully aborted\n"));
5539 DEBUG(5,("cmd_shutdown_abort: query succeeded\n"));
5541 DEBUG(5,("cmd_shutdown_abort: query failed\n"));
5543 return werror_to_ntstatus(result
);
5547 * ABORT the shutdown of a remote RPC Server, over winreg pipe.
5549 * All parameters are provided by the run_rpc_command function, except for
5550 * argc, argv which are passed through.
5552 * @param c A net_context structure.
5553 * @param domain_sid The domain sid acquired from the remote server.
5554 * @param cli A cli_state connected to the server.
5555 * @param mem_ctx Talloc context, destroyed on completion of the function.
5556 * @param argc Standard main() style argc.
5557 * @param argv Standard main() style argv. Initial components are already
5560 * @return Normal NTSTATUS return.
5563 static NTSTATUS
rpc_reg_shutdown_abort_internals(struct net_context
*c
,
5564 const struct dom_sid
*domain_sid
,
5565 const char *domain_name
,
5566 struct cli_state
*cli
,
5567 struct rpc_pipe_client
*pipe_hnd
,
5568 TALLOC_CTX
*mem_ctx
,
5572 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
5574 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
5576 result
= dcerpc_winreg_AbortSystemShutdown(b
, mem_ctx
, NULL
, &werr
);
5578 if (!NT_STATUS_IS_OK(result
)) {
5579 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
5582 if (W_ERROR_IS_OK(werr
)) {
5583 d_printf(_("\nShutdown successfully aborted\n"));
5584 DEBUG(5,("cmd_reg_abort_shutdown: query succeeded\n"));
5586 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
5588 return werror_to_ntstatus(werr
);
5592 * ABORT the shutdown of a remote RPC server.
5594 * @param argc Standard main() style argc.
5595 * @param argv Standard main() style argv. Initial components are already
5598 * @return A shell status integer (0 for success).
5601 static int rpc_shutdown_abort(struct net_context
*c
, int argc
,
5606 if (c
->display_usage
) {
5608 "net rpc abortshutdown\n"
5611 _("Abort a scheduled shutdown"));
5615 rc
= run_rpc_command(c
, NULL
, &ndr_table_initshutdown
, 0,
5616 rpc_shutdown_abort_internals
, argc
, argv
);
5621 DEBUG(1, ("initshutdown pipe didn't work, trying winreg pipe\n"));
5623 return run_rpc_command(c
, NULL
, &ndr_table_winreg
, 0,
5624 rpc_reg_shutdown_abort_internals
,
5629 * Shut down a remote RPC Server via initshutdown pipe.
5631 * All parameters are provided by the run_rpc_command function, except for
5632 * argc, argv which are passed through.
5634 * @param c A net_context structure.
5635 * @param domain_sid The domain sid acquired from the remote server.
5636 * @param cli A cli_state connected to the server.
5637 * @param mem_ctx Talloc context, destroyed on completion of the function.
5638 * @param argc Standard main() style argc.
5639 * @param argv Standard main() style argv. Initial components are already
5642 * @return Normal NTSTATUS return.
5645 NTSTATUS
rpc_init_shutdown_internals(struct net_context
*c
,
5646 const struct dom_sid
*domain_sid
,
5647 const char *domain_name
,
5648 struct cli_state
*cli
,
5649 struct rpc_pipe_client
*pipe_hnd
,
5650 TALLOC_CTX
*mem_ctx
,
5654 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
5656 const char *msg
= N_("This machine will be shutdown shortly");
5657 uint32 timeout
= 20;
5658 struct lsa_StringLarge msg_string
;
5659 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
5661 if (c
->opt_comment
) {
5662 msg
= c
->opt_comment
;
5664 if (c
->opt_timeout
) {
5665 timeout
= c
->opt_timeout
;
5668 msg_string
.string
= msg
;
5670 /* create an entry */
5671 status
= dcerpc_initshutdown_Init(b
, mem_ctx
, NULL
,
5672 &msg_string
, timeout
, c
->opt_force
, c
->opt_reboot
,
5674 if (!NT_STATUS_IS_OK(status
)) {
5677 if (W_ERROR_IS_OK(result
)) {
5678 d_printf(_("\nShutdown of remote machine succeeded\n"));
5679 DEBUG(5,("Shutdown of remote machine succeeded\n"));
5681 DEBUG(1,("Shutdown of remote machine failed!\n"));
5683 return werror_to_ntstatus(result
);
5687 * Shut down a remote RPC Server via winreg pipe.
5689 * All parameters are provided by the run_rpc_command function, except for
5690 * argc, argv which are passed through.
5692 * @param c A net_context structure.
5693 * @param domain_sid The domain sid acquired from the remote server.
5694 * @param cli A cli_state connected to the server.
5695 * @param mem_ctx Talloc context, destroyed on completion of the function.
5696 * @param argc Standard main() style argc.
5697 * @param argv Standard main() style argv. Initial components are already
5700 * @return Normal NTSTATUS return.
5703 NTSTATUS
rpc_reg_shutdown_internals(struct net_context
*c
,
5704 const struct dom_sid
*domain_sid
,
5705 const char *domain_name
,
5706 struct cli_state
*cli
,
5707 struct rpc_pipe_client
*pipe_hnd
,
5708 TALLOC_CTX
*mem_ctx
,
5712 const char *msg
= N_("This machine will be shutdown shortly");
5713 uint32 timeout
= 20;
5714 struct lsa_StringLarge msg_string
;
5717 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
5719 if (c
->opt_comment
) {
5720 msg
= c
->opt_comment
;
5722 msg_string
.string
= msg
;
5724 if (c
->opt_timeout
) {
5725 timeout
= c
->opt_timeout
;
5728 /* create an entry */
5729 result
= dcerpc_winreg_InitiateSystemShutdown(b
, mem_ctx
, NULL
,
5730 &msg_string
, timeout
, c
->opt_force
, c
->opt_reboot
,
5732 if (!NT_STATUS_IS_OK(result
)) {
5733 d_fprintf(stderr
, "\nShutdown of remote machine failed\n");
5737 if (W_ERROR_IS_OK(werr
)) {
5738 d_printf(_("\nShutdown of remote machine succeeded\n"));
5740 d_fprintf(stderr
, "\nShutdown of remote machine failed\n");
5741 if ( W_ERROR_EQUAL(werr
, WERR_MACHINE_LOCKED
) )
5742 d_fprintf(stderr
, "\nMachine locked, use -f switch to force\n");
5744 d_fprintf(stderr
, "\nresult was: %s\n", win_errstr(werr
));
5747 return werror_to_ntstatus(werr
);
5751 * Shut down a remote RPC server.
5753 * @param argc Standard main() style argc.
5754 * @param argv Standard main() style argv. Initial components are already
5757 * @return A shell status integer (0 for success).
5760 static int rpc_shutdown(struct net_context
*c
, int argc
, const char **argv
)
5764 if (c
->display_usage
) {
5766 "net rpc shutdown\n"
5769 _("Shut down a remote RPC server"));
5773 rc
= run_rpc_command(c
, NULL
, &ndr_table_initshutdown
, 0,
5774 rpc_init_shutdown_internals
, argc
, argv
);
5777 DEBUG(1, ("initshutdown pipe failed, trying winreg pipe\n"));
5778 rc
= run_rpc_command(c
, NULL
, &ndr_table_winreg
, 0,
5779 rpc_reg_shutdown_internals
, argc
, argv
);
5785 /***************************************************************************
5786 NT Domain trusts code (i.e. 'net rpc trustdom' functionality)
5787 ***************************************************************************/
5790 * Add interdomain trust account to the RPC server.
5791 * All parameters (except for argc and argv) are passed by run_rpc_command
5794 * @param c A net_context structure.
5795 * @param domain_sid The domain sid acquired from the server.
5796 * @param cli A cli_state connected to the server.
5797 * @param mem_ctx Talloc context, destroyed on completion of the function.
5798 * @param argc Standard main() style argc.
5799 * @param argv Standard main() style argv. Initial components are already
5802 * @return normal NTSTATUS return code.
5805 static NTSTATUS
rpc_trustdom_add_internals(struct net_context
*c
,
5806 const struct dom_sid
*domain_sid
,
5807 const char *domain_name
,
5808 struct cli_state
*cli
,
5809 struct rpc_pipe_client
*pipe_hnd
,
5810 TALLOC_CTX
*mem_ctx
,
5814 struct policy_handle connect_pol
, domain_pol
, user_pol
;
5815 NTSTATUS status
, result
;
5817 struct lsa_String lsa_acct_name
;
5819 uint32 acct_flags
=0;
5821 uint32_t access_granted
= 0;
5822 union samr_UserInfo info
;
5823 unsigned int orig_timeout
;
5824 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
5825 DATA_BLOB session_key
= data_blob_null
;
5830 _(" net rpc trustdom add <domain_name> "
5831 "<trust password>\n"));
5832 return NT_STATUS_INVALID_PARAMETER
;
5836 * Make valid trusting domain account (ie. uppercased and with '$' appended)
5839 if (asprintf(&acct_name
, "%s$", argv
[0]) < 0) {
5840 return NT_STATUS_NO_MEMORY
;
5843 if (!strupper_m(acct_name
)) {
5844 SAFE_FREE(acct_name
);
5845 return NT_STATUS_INVALID_PARAMETER
;
5848 init_lsa_String(&lsa_acct_name
, acct_name
);
5850 status
= cli_get_session_key(mem_ctx
, pipe_hnd
, &session_key
);
5851 if (!NT_STATUS_IS_OK(status
)) {
5852 DEBUG(0,("Error getting session_key of SAM pipe. Error was %s\n",
5853 nt_errstr(status
)));
5857 /* Get samr policy handle */
5858 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
5860 MAXIMUM_ALLOWED_ACCESS
,
5863 if (!NT_STATUS_IS_OK(status
)) {
5866 if (!NT_STATUS_IS_OK(result
)) {
5871 /* Get domain policy handle */
5872 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
5874 MAXIMUM_ALLOWED_ACCESS
,
5875 discard_const_p(struct dom_sid2
, domain_sid
),
5878 if (!NT_STATUS_IS_OK(status
)) {
5881 if (!NT_STATUS_IS_OK(result
)) {
5886 /* This call can take a long time - allow the server to time out.
5887 * 35 seconds should do it. */
5889 orig_timeout
= rpccli_set_timeout(pipe_hnd
, 35000);
5891 /* Create trusting domain's account */
5892 acb_info
= ACB_NORMAL
;
5893 acct_flags
= SEC_GENERIC_READ
| SEC_GENERIC_WRITE
| SEC_GENERIC_EXECUTE
|
5894 SEC_STD_WRITE_DAC
| SEC_STD_DELETE
|
5895 SAMR_USER_ACCESS_SET_PASSWORD
|
5896 SAMR_USER_ACCESS_GET_ATTRIBUTES
|
5897 SAMR_USER_ACCESS_SET_ATTRIBUTES
;
5899 status
= dcerpc_samr_CreateUser2(b
, mem_ctx
,
5908 if (!NT_STATUS_IS_OK(status
)) {
5911 /* And restore our original timeout. */
5912 rpccli_set_timeout(pipe_hnd
, orig_timeout
);
5914 if (!NT_STATUS_IS_OK(result
)) {
5916 d_printf(_("net rpc trustdom add: create user %s failed %s\n"),
5917 acct_name
, nt_errstr(result
));
5922 struct samr_CryptPassword crypt_pwd
;
5924 ZERO_STRUCT(info
.info23
);
5926 init_samr_CryptPassword(argv
[1],
5930 info
.info23
.info
.fields_present
= SAMR_FIELD_ACCT_FLAGS
|
5931 SAMR_FIELD_NT_PASSWORD_PRESENT
;
5932 info
.info23
.info
.acct_flags
= ACB_DOMTRUST
;
5933 info
.info23
.password
= crypt_pwd
;
5935 status
= dcerpc_samr_SetUserInfo2(b
, mem_ctx
,
5940 if (!NT_STATUS_IS_OK(status
)) {
5944 if (!NT_STATUS_IS_OK(result
)) {
5946 DEBUG(0,("Could not set trust account password: %s\n",
5947 nt_errstr(result
)));
5953 SAFE_FREE(acct_name
);
5954 data_blob_clear_free(&session_key
);
5959 * Create interdomain trust account for a remote domain.
5961 * @param argc Standard argc.
5962 * @param argv Standard argv without initial components.
5964 * @return Integer status (0 means success).
5967 static int rpc_trustdom_add(struct net_context
*c
, int argc
, const char **argv
)
5969 if (argc
> 0 && !c
->display_usage
) {
5970 return run_rpc_command(c
, NULL
, &ndr_table_samr
, 0,
5971 rpc_trustdom_add_internals
, argc
, argv
);
5975 _("net rpc trustdom add <domain_name> <trust "
5983 * Remove interdomain trust account from the RPC server.
5984 * All parameters (except for argc and argv) are passed by run_rpc_command
5987 * @param c A net_context structure.
5988 * @param domain_sid The domain sid acquired from the server.
5989 * @param cli A cli_state connected to the server.
5990 * @param mem_ctx Talloc context, destroyed on completion of the function.
5991 * @param argc Standard main() style argc.
5992 * @param argv Standard main() style argv. Initial components are already
5995 * @return normal NTSTATUS return code.
5998 static NTSTATUS
rpc_trustdom_del_internals(struct net_context
*c
,
5999 const struct dom_sid
*domain_sid
,
6000 const char *domain_name
,
6001 struct cli_state
*cli
,
6002 struct rpc_pipe_client
*pipe_hnd
,
6003 TALLOC_CTX
*mem_ctx
,
6007 struct policy_handle connect_pol
, domain_pol
, user_pol
;
6008 NTSTATUS status
, result
;
6010 struct dom_sid trust_acct_sid
;
6011 struct samr_Ids user_rids
, name_types
;
6012 struct lsa_String lsa_acct_name
;
6013 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
6018 _(" net rpc trustdom del <domain_name>\n"));
6019 return NT_STATUS_INVALID_PARAMETER
;
6023 * Make valid trusting domain account (ie. uppercased and with '$' appended)
6025 acct_name
= talloc_asprintf(mem_ctx
, "%s$", argv
[0]);
6027 if (acct_name
== NULL
)
6028 return NT_STATUS_NO_MEMORY
;
6030 if (!strupper_m(acct_name
)) {
6031 TALLOC_FREE(acct_name
);
6032 return NT_STATUS_INVALID_PARAMETER
;
6035 /* Get samr policy handle */
6036 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
6038 MAXIMUM_ALLOWED_ACCESS
,
6041 if (!NT_STATUS_IS_OK(status
)) {
6044 if (!NT_STATUS_IS_OK(result
)) {
6049 /* Get domain policy handle */
6050 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
6052 MAXIMUM_ALLOWED_ACCESS
,
6053 discard_const_p(struct dom_sid2
, domain_sid
),
6056 if (!NT_STATUS_IS_OK(status
)) {
6059 if (!NT_STATUS_IS_OK(result
)) {
6064 init_lsa_String(&lsa_acct_name
, acct_name
);
6066 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
6073 if (!NT_STATUS_IS_OK(status
)) {
6074 d_printf(_("net rpc trustdom del: LookupNames on user %s "
6076 acct_name
, nt_errstr(status
));
6079 if (!NT_STATUS_IS_OK(result
)) {
6081 d_printf(_("net rpc trustdom del: LookupNames on user %s "
6083 acct_name
, nt_errstr(result
) );
6086 if (user_rids
.count
!= 1) {
6087 status
= NT_STATUS_INVALID_NETWORK_RESPONSE
;
6090 if (name_types
.count
!= 1) {
6091 status
= NT_STATUS_INVALID_NETWORK_RESPONSE
;
6095 status
= dcerpc_samr_OpenUser(b
, mem_ctx
,
6097 MAXIMUM_ALLOWED_ACCESS
,
6101 if (!NT_STATUS_IS_OK(status
)) {
6102 d_printf(_("net rpc trustdom del: OpenUser on user %s failed "
6104 acct_name
, nt_errstr(status
) );
6108 if (!NT_STATUS_IS_OK(result
)) {
6110 d_printf(_("net rpc trustdom del: OpenUser on user %s failed "
6112 acct_name
, nt_errstr(result
) );
6116 /* append the rid to the domain sid */
6117 if (!sid_compose(&trust_acct_sid
, domain_sid
, user_rids
.ids
[0])) {
6121 /* remove the sid */
6123 status
= dcerpc_samr_RemoveMemberFromForeignDomain(b
, mem_ctx
,
6127 if (!NT_STATUS_IS_OK(status
)) {
6128 d_printf(_("net rpc trustdom del: RemoveMemberFromForeignDomain"
6129 " on user %s failed %s\n"),
6130 acct_name
, nt_errstr(status
));
6133 if (!NT_STATUS_IS_OK(result
)) {
6135 d_printf(_("net rpc trustdom del: RemoveMemberFromForeignDomain"
6136 " on user %s failed %s\n"),
6137 acct_name
, nt_errstr(result
) );
6144 status
= dcerpc_samr_DeleteUser(b
, mem_ctx
,
6147 if (!NT_STATUS_IS_OK(status
)) {
6148 d_printf(_("net rpc trustdom del: DeleteUser on user %s failed "
6150 acct_name
, nt_errstr(status
));
6154 if (!NT_STATUS_IS_OK(result
)) {
6156 d_printf(_("net rpc trustdom del: DeleteUser on user %s failed "
6158 acct_name
, nt_errstr(result
) );
6162 if (!NT_STATUS_IS_OK(result
)) {
6163 d_printf(_("Could not set trust account password: %s\n"),
6173 * Delete interdomain trust account for a remote domain.
6175 * @param argc Standard argc.
6176 * @param argv Standard argv without initial components.
6178 * @return Integer status (0 means success).
6181 static int rpc_trustdom_del(struct net_context
*c
, int argc
, const char **argv
)
6183 if (argc
> 0 && !c
->display_usage
) {
6184 return run_rpc_command(c
, NULL
, &ndr_table_samr
, 0,
6185 rpc_trustdom_del_internals
, argc
, argv
);
6189 _("net rpc trustdom del <domain>\n"));
6194 static NTSTATUS
rpc_trustdom_get_pdc(struct net_context
*c
,
6195 struct cli_state
*cli
,
6196 TALLOC_CTX
*mem_ctx
,
6197 const char *domain_name
)
6199 char *dc_name
= NULL
;
6200 const char *buffer
= NULL
;
6201 struct rpc_pipe_client
*netr
;
6204 struct dcerpc_binding_handle
*b
;
6206 /* Use NetServerEnum2 */
6208 if (cli_get_pdc_name(cli
, domain_name
, &dc_name
)) {
6210 return NT_STATUS_OK
;
6213 DEBUG(1,("NetServerEnum2 error: Couldn't find primary domain controller\
6214 for domain %s\n", domain_name
));
6216 /* Try netr_GetDcName */
6218 status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_netlogon
.syntax_id
,
6220 if (!NT_STATUS_IS_OK(status
)) {
6224 b
= netr
->binding_handle
;
6226 status
= dcerpc_netr_GetDcName(b
, mem_ctx
,
6233 if (NT_STATUS_IS_OK(status
) && W_ERROR_IS_OK(result
)) {
6237 DEBUG(1,("netr_GetDcName error: Couldn't find primary domain controller\
6238 for domain %s\n", domain_name
));
6240 if (!NT_STATUS_IS_OK(status
)) {
6244 return werror_to_ntstatus(result
);
6248 * Establish trust relationship to a trusting domain.
6249 * Interdomain account must already be created on remote PDC.
6251 * @param c A net_context structure.
6252 * @param argc Standard argc.
6253 * @param argv Standard argv without initial components.
6255 * @return Integer status (0 means success).
6258 static int rpc_trustdom_establish(struct net_context
*c
, int argc
,
6261 struct cli_state
*cli
= NULL
;
6262 struct sockaddr_storage server_ss
;
6263 struct rpc_pipe_client
*pipe_hnd
= NULL
;
6264 struct policy_handle connect_hnd
;
6265 TALLOC_CTX
*mem_ctx
;
6266 NTSTATUS nt_status
, result
;
6267 struct dom_sid
*domain_sid
;
6272 union lsa_PolicyInformation
*info
= NULL
;
6273 struct dcerpc_binding_handle
*b
;
6276 * Connect to \\server\ipc$ as 'our domain' account with password
6279 if (argc
!= 1 || c
->display_usage
) {
6282 _("net rpc trustdom establish <domain_name>\n"));
6286 domain_name
= smb_xstrdup(argv
[0]);
6287 if (!strupper_m(domain_name
)) {
6288 SAFE_FREE(domain_name
);
6292 /* account name used at first is our domain's name with '$' */
6293 if (asprintf(&acct_name
, "%s$", lp_workgroup()) == -1) {
6296 if (!strupper_m(acct_name
)) {
6297 SAFE_FREE(domain_name
);
6298 SAFE_FREE(acct_name
);
6303 * opt_workgroup will be used by connection functions further,
6304 * hence it should be set to remote domain name instead of ours
6306 if (c
->opt_workgroup
) {
6307 c
->opt_workgroup
= smb_xstrdup(domain_name
);
6310 c
->opt_user_name
= acct_name
;
6312 /* find the domain controller */
6313 if (!net_find_pdc(&server_ss
, pdc_name
, domain_name
)) {
6314 DEBUG(0, ("Couldn't find domain controller for domain %s\n", domain_name
));
6318 /* connect to ipc$ as username/password */
6319 nt_status
= connect_to_ipc(c
, &cli
, &server_ss
, pdc_name
);
6320 if (!NT_STATUS_EQUAL(nt_status
, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT
)) {
6322 /* Is it trusting domain account for sure ? */
6323 DEBUG(0, ("Couldn't verify trusting domain account. Error was %s\n",
6324 nt_errstr(nt_status
)));
6328 /* store who we connected to */
6330 saf_store( domain_name
, pdc_name
);
6333 * Connect to \\server\ipc$ again (this time anonymously)
6336 nt_status
= connect_to_ipc_anonymous(c
, &cli
, &server_ss
,
6339 if (NT_STATUS_IS_ERR(nt_status
)) {
6340 DEBUG(0, ("Couldn't connect to domain %s controller. Error was %s.\n",
6341 domain_name
, nt_errstr(nt_status
)));
6345 if (!(mem_ctx
= talloc_init("establishing trust relationship to "
6346 "domain %s", domain_name
))) {
6347 DEBUG(0, ("talloc_init() failed\n"));
6352 /* Make sure we're talking to a proper server */
6354 nt_status
= rpc_trustdom_get_pdc(c
, cli
, mem_ctx
, domain_name
);
6355 if (!NT_STATUS_IS_OK(nt_status
)) {
6357 talloc_destroy(mem_ctx
);
6362 * Call LsaOpenPolicy and LsaQueryInfo
6365 nt_status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
6367 if (!NT_STATUS_IS_OK(nt_status
)) {
6368 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n", nt_errstr(nt_status
) ));
6370 talloc_destroy(mem_ctx
);
6374 b
= pipe_hnd
->binding_handle
;
6376 nt_status
= rpccli_lsa_open_policy2(pipe_hnd
, mem_ctx
, true, KEY_QUERY_VALUE
,
6378 if (NT_STATUS_IS_ERR(nt_status
)) {
6379 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6380 nt_errstr(nt_status
)));
6382 talloc_destroy(mem_ctx
);
6386 /* Querying info level 5 */
6388 nt_status
= dcerpc_lsa_QueryInfoPolicy(b
, mem_ctx
,
6390 LSA_POLICY_INFO_ACCOUNT_DOMAIN
,
6393 if (NT_STATUS_IS_ERR(nt_status
)) {
6394 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6395 nt_errstr(nt_status
)));
6397 talloc_destroy(mem_ctx
);
6400 if (NT_STATUS_IS_ERR(result
)) {
6401 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6402 nt_errstr(result
)));
6404 talloc_destroy(mem_ctx
);
6408 domain_sid
= info
->account_domain
.sid
;
6410 /* There should be actually query info level 3 (following nt serv behaviour),
6411 but I still don't know if it's _really_ necessary */
6414 * Store the password in secrets db
6417 if (!pdb_set_trusteddom_pw(domain_name
, c
->opt_password
, domain_sid
)) {
6418 DEBUG(0, ("Storing password for trusted domain failed.\n"));
6420 talloc_destroy(mem_ctx
);
6425 * Close the pipes and clean up
6428 nt_status
= dcerpc_lsa_Close(b
, mem_ctx
, &connect_hnd
, &result
);
6429 if (NT_STATUS_IS_ERR(nt_status
)) {
6430 DEBUG(0, ("Couldn't close LSA pipe. Error was %s\n",
6431 nt_errstr(nt_status
)));
6433 talloc_destroy(mem_ctx
);
6439 talloc_destroy(mem_ctx
);
6441 d_printf(_("Trust to domain %s established\n"), domain_name
);
6446 * Revoke trust relationship to the remote domain.
6448 * @param c A net_context structure.
6449 * @param argc Standard argc.
6450 * @param argv Standard argv without initial components.
6452 * @return Integer status (0 means success).
6455 static int rpc_trustdom_revoke(struct net_context
*c
, int argc
,
6461 if (argc
< 1 || c
->display_usage
) {
6464 _("net rpc trustdom revoke <domain_name>\n"
6465 " Revoke trust relationship\n"
6466 " domain_name\tName of domain to revoke trust\n"));
6470 /* generate upper cased domain name */
6471 domain_name
= smb_xstrdup(argv
[0]);
6472 if (!strupper_m(domain_name
)) {
6473 SAFE_FREE(domain_name
);
6477 /* delete password of the trust */
6478 if (!pdb_del_trusteddom_pw(domain_name
)) {
6479 DEBUG(0, ("Failed to revoke relationship to the trusted domain %s\n",
6486 SAFE_FREE(domain_name
);
6490 static NTSTATUS
rpc_query_domain_sid(struct net_context
*c
,
6491 const struct dom_sid
*domain_sid
,
6492 const char *domain_name
,
6493 struct cli_state
*cli
,
6494 struct rpc_pipe_client
*pipe_hnd
,
6495 TALLOC_CTX
*mem_ctx
,
6500 if (!sid_to_fstring(str_sid
, domain_sid
)) {
6501 return NT_STATUS_UNSUCCESSFUL
;
6503 d_printf("%s\n", str_sid
);
6504 return NT_STATUS_OK
;
6507 static void print_trusted_domain(struct dom_sid
*dom_sid
, const char *trusted_dom_name
)
6511 /* convert sid into ascii string */
6512 sid_to_fstring(ascii_sid
, dom_sid
);
6514 d_printf("%-20s%s\n", trusted_dom_name
, ascii_sid
);
6517 static NTSTATUS
vampire_trusted_domain(struct rpc_pipe_client
*pipe_hnd
,
6518 TALLOC_CTX
*mem_ctx
,
6519 struct policy_handle
*pol
,
6520 struct dom_sid dom_sid
,
6521 const char *trusted_dom_name
)
6523 NTSTATUS nt_status
, result
;
6524 union lsa_TrustedDomainInfo
*info
= NULL
;
6525 char *cleartextpwd
= NULL
;
6526 DATA_BLOB session_key
;
6527 DATA_BLOB data
= data_blob_null
;
6528 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
6530 nt_status
= dcerpc_lsa_QueryTrustedDomainInfoBySid(b
, mem_ctx
,
6533 LSA_TRUSTED_DOMAIN_INFO_PASSWORD
,
6536 if (NT_STATUS_IS_ERR(nt_status
)) {
6537 DEBUG(0,("Could not query trusted domain info. Error was %s\n",
6538 nt_errstr(nt_status
)));
6541 if (NT_STATUS_IS_ERR(result
)) {
6543 DEBUG(0,("Could not query trusted domain info. Error was %s\n",
6544 nt_errstr(result
)));
6548 data
= data_blob(info
->password
.password
->data
,
6549 info
->password
.password
->length
);
6551 nt_status
= cli_get_session_key(mem_ctx
, pipe_hnd
, &session_key
);
6552 if (!NT_STATUS_IS_OK(nt_status
)) {
6553 DEBUG(0, ("Could not retrieve session key: %s\n", nt_errstr(nt_status
)));
6557 cleartextpwd
= sess_decrypt_string(mem_ctx
, &data
, &session_key
);
6558 data_blob_free(&session_key
);
6560 if (cleartextpwd
== NULL
) {
6561 DEBUG(0,("retrieved NULL password\n"));
6562 nt_status
= NT_STATUS_UNSUCCESSFUL
;
6566 if (!pdb_set_trusteddom_pw(trusted_dom_name
, cleartextpwd
, &dom_sid
)) {
6567 DEBUG(0, ("Storing password for trusted domain failed.\n"));
6568 nt_status
= NT_STATUS_UNSUCCESSFUL
;
6572 #ifdef DEBUG_PASSWORD
6573 DEBUG(100,("successfully vampired trusted domain [%s], sid: [%s], "
6574 "password: [%s]\n", trusted_dom_name
,
6575 sid_string_dbg(&dom_sid
), cleartextpwd
));
6579 SAFE_FREE(cleartextpwd
);
6580 data_blob_free(&data
);
6585 static int rpc_trustdom_vampire(struct net_context
*c
, int argc
,
6588 /* common variables */
6589 TALLOC_CTX
* mem_ctx
;
6590 struct cli_state
*cli
= NULL
;
6591 struct rpc_pipe_client
*pipe_hnd
= NULL
;
6592 NTSTATUS nt_status
, result
;
6593 const char *domain_name
= NULL
;
6594 struct policy_handle connect_hnd
;
6595 union lsa_PolicyInformation
*info
= NULL
;
6597 /* trusted domains listing variables */
6598 unsigned int enum_ctx
= 0;
6600 struct lsa_DomainList dom_list
;
6602 struct dcerpc_binding_handle
*b
;
6604 if (c
->display_usage
) {
6606 "net rpc trustdom vampire\n"
6609 _("Vampire trust relationship from remote server"));
6614 * Listing trusted domains (stored in secrets.tdb, if local)
6617 mem_ctx
= talloc_init("trust relationships vampire");
6620 * set domain and pdc name to local samba server (default)
6621 * or to remote one given in command line
6624 if (strcasecmp_m(c
->opt_workgroup
, lp_workgroup())) {
6625 domain_name
= c
->opt_workgroup
;
6626 c
->opt_target_workgroup
= c
->opt_workgroup
;
6628 fstrcpy(pdc_name
, lp_netbios_name());
6629 domain_name
= talloc_strdup(mem_ctx
, lp_workgroup());
6630 c
->opt_target_workgroup
= domain_name
;
6633 /* open \PIPE\lsarpc and open policy handle */
6634 nt_status
= net_make_ipc_connection(c
, NET_FLAGS_PDC
, &cli
);
6635 if (!NT_STATUS_IS_OK(nt_status
)) {
6636 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
6637 nt_errstr(nt_status
)));
6638 talloc_destroy(mem_ctx
);
6642 nt_status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
6644 if (!NT_STATUS_IS_OK(nt_status
)) {
6645 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
6646 nt_errstr(nt_status
) ));
6648 talloc_destroy(mem_ctx
);
6652 b
= pipe_hnd
->binding_handle
;
6654 nt_status
= rpccli_lsa_open_policy2(pipe_hnd
, mem_ctx
, false, KEY_QUERY_VALUE
,
6656 if (NT_STATUS_IS_ERR(nt_status
)) {
6657 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6658 nt_errstr(nt_status
)));
6660 talloc_destroy(mem_ctx
);
6664 /* query info level 5 to obtain sid of a domain being queried */
6665 nt_status
= dcerpc_lsa_QueryInfoPolicy(b
, mem_ctx
,
6667 LSA_POLICY_INFO_ACCOUNT_DOMAIN
,
6671 if (NT_STATUS_IS_ERR(nt_status
)) {
6672 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6673 nt_errstr(nt_status
)));
6675 talloc_destroy(mem_ctx
);
6678 if (NT_STATUS_IS_ERR(result
)) {
6679 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6680 nt_errstr(result
)));
6682 talloc_destroy(mem_ctx
);
6687 * Keep calling LsaEnumTrustdom over opened pipe until
6688 * the end of enumeration is reached
6691 d_printf(_("Vampire trusted domains:\n\n"));
6694 nt_status
= dcerpc_lsa_EnumTrustDom(b
, mem_ctx
,
6700 if (NT_STATUS_IS_ERR(nt_status
)) {
6701 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6702 nt_errstr(nt_status
)));
6704 talloc_destroy(mem_ctx
);
6707 if (NT_STATUS_IS_ERR(result
)) {
6709 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6710 nt_errstr(result
)));
6712 talloc_destroy(mem_ctx
);
6717 for (i
= 0; i
< dom_list
.count
; i
++) {
6719 print_trusted_domain(dom_list
.domains
[i
].sid
,
6720 dom_list
.domains
[i
].name
.string
);
6722 nt_status
= vampire_trusted_domain(pipe_hnd
, mem_ctx
, &connect_hnd
,
6723 *dom_list
.domains
[i
].sid
,
6724 dom_list
.domains
[i
].name
.string
);
6725 if (!NT_STATUS_IS_OK(nt_status
)) {
6727 talloc_destroy(mem_ctx
);
6733 * in case of no trusted domains say something rather
6734 * than just display blank line
6736 if (!dom_list
.count
) d_printf(_("none\n"));
6738 } while (NT_STATUS_EQUAL(nt_status
, STATUS_MORE_ENTRIES
));
6740 /* close this connection before doing next one */
6741 nt_status
= dcerpc_lsa_Close(b
, mem_ctx
, &connect_hnd
, &result
);
6742 if (NT_STATUS_IS_ERR(nt_status
)) {
6743 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
6744 nt_errstr(nt_status
)));
6746 talloc_destroy(mem_ctx
);
6750 /* close lsarpc pipe and connection to IPC$ */
6753 talloc_destroy(mem_ctx
);
6757 static int rpc_trustdom_list(struct net_context
*c
, int argc
, const char **argv
)
6759 /* common variables */
6760 TALLOC_CTX
* mem_ctx
;
6761 struct cli_state
*cli
= NULL
, *remote_cli
= NULL
;
6762 struct rpc_pipe_client
*pipe_hnd
= NULL
;
6763 NTSTATUS nt_status
, result
;
6764 const char *domain_name
= NULL
;
6765 struct dom_sid
*queried_dom_sid
;
6766 int ascii_dom_name_len
;
6767 struct policy_handle connect_hnd
;
6768 union lsa_PolicyInformation
*info
= NULL
;
6769 struct dcerpc_binding_handle
*b
= NULL
;
6771 /* trusted domains listing variables */
6772 unsigned int num_domains
, enum_ctx
= 0;
6774 struct lsa_DomainList dom_list
;
6778 /* trusting domains listing variables */
6779 struct policy_handle domain_hnd
;
6780 struct samr_SamArray
*trusts
= NULL
;
6782 if (c
->display_usage
) {
6784 "net rpc trustdom list\n"
6787 _("List incoming and outgoing trust relationships"));
6792 * Listing trusted domains (stored in secrets.tdb, if local)
6795 mem_ctx
= talloc_init("trust relationships listing");
6798 * set domain and pdc name to local samba server (default)
6799 * or to remote one given in command line
6802 if (strcasecmp_m(c
->opt_workgroup
, lp_workgroup())) {
6803 domain_name
= c
->opt_workgroup
;
6804 c
->opt_target_workgroup
= c
->opt_workgroup
;
6806 fstrcpy(pdc_name
, lp_netbios_name());
6807 domain_name
= talloc_strdup(mem_ctx
, lp_workgroup());
6808 c
->opt_target_workgroup
= domain_name
;
6811 /* open \PIPE\lsarpc and open policy handle */
6812 nt_status
= net_make_ipc_connection(c
, NET_FLAGS_PDC
, &cli
);
6813 if (!NT_STATUS_IS_OK(nt_status
)) {
6814 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
6815 nt_errstr(nt_status
)));
6816 talloc_destroy(mem_ctx
);
6820 nt_status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
6822 if (!NT_STATUS_IS_OK(nt_status
)) {
6823 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
6824 nt_errstr(nt_status
) ));
6826 talloc_destroy(mem_ctx
);
6830 b
= pipe_hnd
->binding_handle
;
6832 nt_status
= rpccli_lsa_open_policy2(pipe_hnd
, mem_ctx
, false, KEY_QUERY_VALUE
,
6834 if (NT_STATUS_IS_ERR(nt_status
)) {
6835 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6836 nt_errstr(nt_status
)));
6838 talloc_destroy(mem_ctx
);
6842 /* query info level 5 to obtain sid of a domain being queried */
6843 nt_status
= dcerpc_lsa_QueryInfoPolicy(b
, mem_ctx
,
6845 LSA_POLICY_INFO_ACCOUNT_DOMAIN
,
6849 if (NT_STATUS_IS_ERR(nt_status
)) {
6850 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6851 nt_errstr(nt_status
)));
6853 talloc_destroy(mem_ctx
);
6856 if (NT_STATUS_IS_ERR(result
)) {
6857 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6858 nt_errstr(result
)));
6860 talloc_destroy(mem_ctx
);
6864 queried_dom_sid
= info
->account_domain
.sid
;
6867 * Keep calling LsaEnumTrustdom over opened pipe until
6868 * the end of enumeration is reached
6871 d_printf(_("Trusted domains list:\n\n"));
6873 found_domain
= false;
6876 nt_status
= dcerpc_lsa_EnumTrustDom(b
, mem_ctx
,
6882 if (NT_STATUS_IS_ERR(nt_status
)) {
6883 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6884 nt_errstr(nt_status
)));
6886 talloc_destroy(mem_ctx
);
6889 if (NT_STATUS_IS_ERR(result
)) {
6890 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6891 nt_errstr(result
)));
6893 talloc_destroy(mem_ctx
);
6898 for (i
= 0; i
< dom_list
.count
; i
++) {
6899 print_trusted_domain(dom_list
.domains
[i
].sid
,
6900 dom_list
.domains
[i
].name
.string
);
6901 found_domain
= true;
6905 } while (NT_STATUS_EQUAL(nt_status
, STATUS_MORE_ENTRIES
));
6908 * in case of no trusted domains say something rather
6909 * than just display blank line
6911 if (!found_domain
) {
6912 d_printf(_("none\n"));
6915 /* close this connection before doing next one */
6916 nt_status
= dcerpc_lsa_Close(b
, mem_ctx
, &connect_hnd
, &result
);
6917 if (NT_STATUS_IS_ERR(nt_status
)) {
6918 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
6919 nt_errstr(nt_status
)));
6921 talloc_destroy(mem_ctx
);
6925 TALLOC_FREE(pipe_hnd
);
6928 * Listing trusting domains (stored in passdb backend, if local)
6931 d_printf(_("\nTrusting domains list:\n\n"));
6934 * Open \PIPE\samr and get needed policy handles
6936 nt_status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_samr
.syntax_id
,
6938 if (!NT_STATUS_IS_OK(nt_status
)) {
6939 DEBUG(0, ("Could not initialise samr pipe. Error was %s\n", nt_errstr(nt_status
)));
6941 talloc_destroy(mem_ctx
);
6945 b
= pipe_hnd
->binding_handle
;
6948 nt_status
= dcerpc_samr_Connect2(b
, mem_ctx
,
6950 SAMR_ACCESS_LOOKUP_DOMAIN
,
6953 if (!NT_STATUS_IS_OK(nt_status
)) {
6954 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
6955 nt_errstr(nt_status
)));
6957 talloc_destroy(mem_ctx
);
6960 if (!NT_STATUS_IS_OK(result
)) {
6962 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
6963 nt_errstr(result
)));
6965 talloc_destroy(mem_ctx
);
6969 /* SamrOpenDomain - we have to open domain policy handle in order to be
6970 able to enumerate accounts*/
6971 nt_status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
6973 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS
,
6977 if (!NT_STATUS_IS_OK(nt_status
)) {
6978 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
6979 nt_errstr(nt_status
)));
6981 talloc_destroy(mem_ctx
);
6984 if (!NT_STATUS_IS_OK(result
)) {
6986 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
6987 nt_errstr(result
)));
6989 talloc_destroy(mem_ctx
);
6994 * perform actual enumeration
6997 found_domain
= false;
6999 enum_ctx
= 0; /* reset enumeration context from last enumeration */
7002 nt_status
= dcerpc_samr_EnumDomainUsers(b
, mem_ctx
,
7010 if (NT_STATUS_IS_ERR(nt_status
)) {
7011 DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
7012 nt_errstr(nt_status
)));
7014 talloc_destroy(mem_ctx
);
7017 if (NT_STATUS_IS_ERR(result
)) {
7019 DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
7020 nt_errstr(result
)));
7022 talloc_destroy(mem_ctx
);
7026 for (i
= 0; i
< num_domains
; i
++) {
7028 char *str
= discard_const_p(char, trusts
->entries
[i
].name
.string
);
7030 found_domain
= true;
7033 * get each single domain's sid (do we _really_ need this ?):
7034 * 1) connect to domain's pdc
7035 * 2) query the pdc for domain's sid
7038 /* get rid of '$' tail */
7039 ascii_dom_name_len
= strlen(str
);
7040 if (ascii_dom_name_len
&& ascii_dom_name_len
< FSTRING_LEN
)
7041 str
[ascii_dom_name_len
- 1] = '\0';
7043 /* set opt_* variables to remote domain */
7044 if (!strupper_m(str
)) {
7046 talloc_destroy(mem_ctx
);
7049 c
->opt_workgroup
= talloc_strdup(mem_ctx
, str
);
7050 c
->opt_target_workgroup
= c
->opt_workgroup
;
7052 d_printf("%-20s", str
);
7054 /* connect to remote domain controller */
7055 nt_status
= net_make_ipc_connection(c
,
7056 NET_FLAGS_PDC
| NET_FLAGS_ANONYMOUS
,
7058 if (NT_STATUS_IS_OK(nt_status
)) {
7059 /* query for domain's sid */
7060 if (run_rpc_command(
7062 &ndr_table_lsarpc
, 0,
7063 rpc_query_domain_sid
, argc
,
7065 d_printf(_("strange - couldn't get domain's sid\n"));
7067 cli_shutdown(remote_cli
);
7070 d_fprintf(stderr
, _("domain controller is not "
7071 "responding: %s\n"),
7072 nt_errstr(nt_status
));
7073 d_printf(_("couldn't get domain's sid\n"));
7077 } while (NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
7079 if (!found_domain
) {
7083 /* close opened samr and domain policy handles */
7084 nt_status
= dcerpc_samr_Close(b
, mem_ctx
, &domain_hnd
, &result
);
7085 if (!NT_STATUS_IS_OK(nt_status
)) {
7086 DEBUG(0, ("Couldn't properly close domain policy handle for domain %s\n", domain_name
));
7089 nt_status
= dcerpc_samr_Close(b
, mem_ctx
, &connect_hnd
, &result
);
7090 if (!NT_STATUS_IS_OK(nt_status
)) {
7091 DEBUG(0, ("Couldn't properly close samr policy handle for domain %s\n", domain_name
));
7094 /* close samr pipe and connection to IPC$ */
7097 talloc_destroy(mem_ctx
);
7102 * Entrypoint for 'net rpc trustdom' code.
7104 * @param argc Standard argc.
7105 * @param argv Standard argv without initial components.
7107 * @return Integer status (0 means success).
7110 static int rpc_trustdom(struct net_context
*c
, int argc
, const char **argv
)
7112 struct functable func
[] = {
7117 N_("Add trusting domain's account"),
7118 N_("net rpc trustdom add\n"
7119 " Add trusting domain's account")
7125 N_("Remove trusting domain's account"),
7126 N_("net rpc trustdom del\n"
7127 " Remove trusting domain's account")
7131 rpc_trustdom_establish
,
7133 N_("Establish outgoing trust relationship"),
7134 N_("net rpc trustdom establish\n"
7135 " Establish outgoing trust relationship")
7139 rpc_trustdom_revoke
,
7141 N_("Revoke outgoing trust relationship"),
7142 N_("net rpc trustdom revoke\n"
7143 " Revoke outgoing trust relationship")
7149 N_("List in- and outgoing domain trusts"),
7150 N_("net rpc trustdom list\n"
7151 " List in- and outgoing domain trusts")
7155 rpc_trustdom_vampire
,
7157 N_("Vampire trusts from remote server"),
7158 N_("net rpc trustdom vampire\n"
7159 " Vampire trusts from remote server")
7161 {NULL
, NULL
, 0, NULL
, NULL
}
7164 return net_run_function(c
, argc
, argv
, "net rpc trustdom", func
);
7168 * Check if a server will take rpc commands
7169 * @param flags Type of server to connect to (PDC, DMB, localhost)
7170 * if the host is not explicitly specified
7171 * @return bool (true means rpc supported)
7173 bool net_rpc_check(struct net_context
*c
, unsigned flags
)
7175 struct cli_state
*cli
;
7177 struct sockaddr_storage server_ss
;
7178 char *server_name
= NULL
;
7181 /* flags (i.e. server type) may depend on command */
7182 if (!net_find_server(c
, NULL
, flags
, &server_ss
, &server_name
))
7185 status
= cli_connect_nb(server_name
, &server_ss
, 0, 0x20,
7186 lp_netbios_name(), SMB_SIGNING_DEFAULT
,
7188 if (!NT_STATUS_IS_OK(status
)) {
7191 status
= smbXcli_negprot(cli
->conn
, cli
->timeout
, PROTOCOL_CORE
,
7193 if (!NT_STATUS_IS_OK(status
))
7195 if (smbXcli_conn_protocol(cli
->conn
) < PROTOCOL_NT1
)
7204 /* dump sam database via samsync rpc calls */
7205 static int rpc_samdump(struct net_context
*c
, int argc
, const char **argv
) {
7206 if (c
->display_usage
) {
7211 _("Dump remote SAM database"));
7215 return run_rpc_command(c
, NULL
, &ndr_table_netlogon
,
7216 NET_FLAGS_ANONYMOUS
,
7217 rpc_samdump_internals
, argc
, argv
);
7220 /* syncronise sam database via samsync rpc calls */
7221 static int rpc_vampire(struct net_context
*c
, int argc
, const char **argv
)
7223 struct functable func
[] = {
7228 N_("Dump remote SAM database to ldif"),
7229 N_("net rpc vampire ldif\n"
7230 " Dump remote SAM database to LDIF file or "
7237 N_("Dump remote SAM database to Kerberos Keytab"),
7238 N_("net rpc vampire keytab\n"
7239 " Dump remote SAM database to Kerberos keytab "
7246 N_("Dump remote SAM database to passdb"),
7247 N_("net rpc vampire passdb\n"
7248 " Dump remote SAM database to passdb")
7251 {NULL
, NULL
, 0, NULL
, NULL
}
7255 if (c
->display_usage
) {
7260 _("Vampire remote SAM database"));
7264 return rpc_vampire_passdb(c
, argc
, argv
);
7267 return net_run_function(c
, argc
, argv
, "net rpc vampire", func
);
7271 * Migrate everything from a print server.
7273 * @param c A net_context structure.
7274 * @param argc Standard main() style argc.
7275 * @param argv Standard main() style argv. Initial components are already
7278 * @return A shell status integer (0 for success).
7280 * The order is important !
7281 * To successfully add drivers the print queues have to exist !
7282 * Applying ACLs should be the last step, because you're easily locked out.
7285 static int rpc_printer_migrate_all(struct net_context
*c
, int argc
,
7290 if (c
->display_usage
) {
7292 "net rpc printer migrate all\n"
7295 _("Migrate everything from a print server"));
7300 d_printf(_("no server to migrate\n"));
7304 ret
= run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7305 rpc_printer_migrate_printers_internals
, argc
,
7310 ret
= run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7311 rpc_printer_migrate_drivers_internals
, argc
,
7316 ret
= run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7317 rpc_printer_migrate_forms_internals
, argc
, argv
);
7321 ret
= run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7322 rpc_printer_migrate_settings_internals
, argc
,
7327 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7328 rpc_printer_migrate_security_internals
, argc
,
7334 * Migrate print drivers from a print server.
7336 * @param c A net_context structure.
7337 * @param argc Standard main() style argc.
7338 * @param argv Standard main() style argv. Initial components are already
7341 * @return A shell status integer (0 for success).
7343 static int rpc_printer_migrate_drivers(struct net_context
*c
, int argc
,
7346 if (c
->display_usage
) {
7348 "net rpc printer migrate drivers\n"
7351 _("Migrate print-drivers from a print-server"));
7356 d_printf(_("no server to migrate\n"));
7360 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7361 rpc_printer_migrate_drivers_internals
,
7366 * Migrate print-forms from a print-server.
7368 * @param c A net_context structure.
7369 * @param argc Standard main() style argc.
7370 * @param argv Standard main() style argv. Initial components are already
7373 * @return A shell status integer (0 for success).
7375 static int rpc_printer_migrate_forms(struct net_context
*c
, int argc
,
7378 if (c
->display_usage
) {
7380 "net rpc printer migrate forms\n"
7383 _("Migrate print-forms from a print-server"));
7388 d_printf(_("no server to migrate\n"));
7392 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7393 rpc_printer_migrate_forms_internals
,
7398 * Migrate printers from a print-server.
7400 * @param c A net_context structure.
7401 * @param argc Standard main() style argc.
7402 * @param argv Standard main() style argv. Initial components are already
7405 * @return A shell status integer (0 for success).
7407 static int rpc_printer_migrate_printers(struct net_context
*c
, int argc
,
7410 if (c
->display_usage
) {
7412 "net rpc printer migrate printers\n"
7415 _("Migrate printers from a print-server"));
7420 d_printf(_("no server to migrate\n"));
7424 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7425 rpc_printer_migrate_printers_internals
,
7430 * Migrate printer-ACLs from a print-server
7432 * @param c A net_context structure.
7433 * @param argc Standard main() style argc.
7434 * @param argv Standard main() style argv. Initial components are already
7437 * @return A shell status integer (0 for success).
7439 static int rpc_printer_migrate_security(struct net_context
*c
, int argc
,
7442 if (c
->display_usage
) {
7444 "net rpc printer migrate security\n"
7447 _("Migrate printer-ACLs from a print-server"));
7452 d_printf(_("no server to migrate\n"));
7456 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7457 rpc_printer_migrate_security_internals
,
7462 * Migrate printer-settings from a print-server.
7464 * @param c A net_context structure.
7465 * @param argc Standard main() style argc.
7466 * @param argv Standard main() style argv. Initial components are already
7469 * @return A shell status integer (0 for success).
7471 static int rpc_printer_migrate_settings(struct net_context
*c
, int argc
,
7474 if (c
->display_usage
) {
7476 "net rpc printer migrate settings\n"
7479 _("Migrate printer-settings from a "
7485 d_printf(_("no server to migrate\n"));
7489 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7490 rpc_printer_migrate_settings_internals
,
7495 * 'net rpc printer' entrypoint.
7497 * @param c A net_context structure.
7498 * @param argc Standard main() style argc.
7499 * @param argv Standard main() style argv. Initial components are already
7503 int rpc_printer_migrate(struct net_context
*c
, int argc
, const char **argv
)
7506 /* ouch: when addriver and setdriver are called from within
7507 rpc_printer_migrate_drivers_internals, the printer-queue already
7510 struct functable func
[] = {
7513 rpc_printer_migrate_all
,
7515 N_("Migrate all from remote to local print server"),
7516 N_("net rpc printer migrate all\n"
7517 " Migrate all from remote to local print server")
7521 rpc_printer_migrate_drivers
,
7523 N_("Migrate drivers to local server"),
7524 N_("net rpc printer migrate drivers\n"
7525 " Migrate drivers to local server")
7529 rpc_printer_migrate_forms
,
7531 N_("Migrate froms to local server"),
7532 N_("net rpc printer migrate forms\n"
7533 " Migrate froms to local server")
7537 rpc_printer_migrate_printers
,
7539 N_("Migrate printers to local server"),
7540 N_("net rpc printer migrate printers\n"
7541 " Migrate printers to local server")
7545 rpc_printer_migrate_security
,
7547 N_("Mirgate printer ACLs to local server"),
7548 N_("net rpc printer migrate security\n"
7549 " Mirgate printer ACLs to local server")
7553 rpc_printer_migrate_settings
,
7555 N_("Migrate printer settings to local server"),
7556 N_("net rpc printer migrate settings\n"
7557 " Migrate printer settings to local server")
7559 {NULL
, NULL
, 0, NULL
, NULL
}
7562 return net_run_function(c
, argc
, argv
, "net rpc printer migrate",func
);
7567 * List printers on a remote RPC server.
7569 * @param c A net_context structure.
7570 * @param argc Standard main() style argc.
7571 * @param argv Standard main() style argv. Initial components are already
7574 * @return A shell status integer (0 for success).
7576 static int rpc_printer_list(struct net_context
*c
, int argc
, const char **argv
)
7578 if (c
->display_usage
) {
7580 "net rpc printer list\n"
7583 _("List printers on a remote RPC server"));
7587 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7588 rpc_printer_list_internals
,
7593 * List printer-drivers on a remote RPC server.
7595 * @param c A net_context structure.
7596 * @param argc Standard main() style argc.
7597 * @param argv Standard main() style argv. Initial components are already
7600 * @return A shell status integer (0 for success).
7602 static int rpc_printer_driver_list(struct net_context
*c
, int argc
,
7605 if (c
->display_usage
) {
7607 "net rpc printer driver\n"
7610 _("List printer-drivers on a remote RPC server"));
7614 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7615 rpc_printer_driver_list_internals
,
7620 * Publish printer in ADS via MSRPC.
7622 * @param c A net_context structure.
7623 * @param argc Standard main() style argc.
7624 * @param argv Standard main() style argv. Initial components are already
7627 * @return A shell status integer (0 for success).
7629 static int rpc_printer_publish_publish(struct net_context
*c
, int argc
,
7632 if (c
->display_usage
) {
7634 "net rpc printer publish publish\n"
7637 _("Publish printer in ADS via MSRPC"));
7641 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7642 rpc_printer_publish_publish_internals
,
7647 * Update printer in ADS via MSRPC.
7649 * @param c A net_context structure.
7650 * @param argc Standard main() style argc.
7651 * @param argv Standard main() style argv. Initial components are already
7654 * @return A shell status integer (0 for success).
7656 static int rpc_printer_publish_update(struct net_context
*c
, int argc
, const char **argv
)
7658 if (c
->display_usage
) {
7660 "net rpc printer publish update\n"
7663 _("Update printer in ADS via MSRPC"));
7667 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7668 rpc_printer_publish_update_internals
,
7673 * UnPublish printer in ADS via MSRPC.
7675 * @param c A net_context structure.
7676 * @param argc Standard main() style argc.
7677 * @param argv Standard main() style argv. Initial components are already
7680 * @return A shell status integer (0 for success).
7682 static int rpc_printer_publish_unpublish(struct net_context
*c
, int argc
,
7685 if (c
->display_usage
) {
7687 "net rpc printer publish unpublish\n"
7690 _("UnPublish printer in ADS via MSRPC"));
7694 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7695 rpc_printer_publish_unpublish_internals
,
7700 * List published printers via MSRPC.
7702 * @param c A net_context structure.
7703 * @param argc Standard main() style argc.
7704 * @param argv Standard main() style argv. Initial components are already
7707 * @return A shell status integer (0 for success).
7709 static int rpc_printer_publish_list(struct net_context
*c
, int argc
,
7712 if (c
->display_usage
) {
7714 "net rpc printer publish list\n"
7717 _("List published printers via MSRPC"));
7721 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7722 rpc_printer_publish_list_internals
,
7728 * Publish printer in ADS.
7730 * @param c A net_context structure.
7731 * @param argc Standard main() style argc.
7732 * @param argv Standard main() style argv. Initial components are already
7735 * @return A shell status integer (0 for success).
7737 static int rpc_printer_publish(struct net_context
*c
, int argc
,
7741 struct functable func
[] = {
7744 rpc_printer_publish_publish
,
7746 N_("Publish printer in AD"),
7747 N_("net rpc printer publish publish\n"
7748 " Publish printer in AD")
7752 rpc_printer_publish_update
,
7754 N_("Update printer in AD"),
7755 N_("net rpc printer publish update\n"
7756 " Update printer in AD")
7760 rpc_printer_publish_unpublish
,
7762 N_("Unpublish printer"),
7763 N_("net rpc printer publish unpublish\n"
7764 " Unpublish printer")
7768 rpc_printer_publish_list
,
7770 N_("List published printers"),
7771 N_("net rpc printer publish list\n"
7772 " List published printers")
7774 {NULL
, NULL
, 0, NULL
, NULL
}
7778 if (c
->display_usage
) {
7779 d_printf(_("Usage:\n"));
7780 d_printf(_("net rpc printer publish\n"
7781 " List published printers\n"
7782 " Alias of net rpc printer publish "
7784 net_display_usage_from_functable(func
);
7787 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7788 rpc_printer_publish_list_internals
,
7792 return net_run_function(c
, argc
, argv
, "net rpc printer publish",func
);
7798 * Display rpc printer help page.
7800 * @param c A net_context structure.
7801 * @param argc Standard main() style argc.
7802 * @param argv Standard main() style argv. Initial components are already
7805 int rpc_printer_usage(struct net_context
*c
, int argc
, const char **argv
)
7807 d_printf(_("net rpc printer LIST [printer] [misc. options] [targets]\n"
7808 "\tlists all printers on print-server\n\n"));
7809 d_printf(_("net rpc printer DRIVER [printer] [misc. options] [targets]\n"
7810 "\tlists all printer-drivers on print-server\n\n"));
7811 d_printf(_("net rpc printer PUBLISH action [printer] [misc. options] [targets]\n"
7812 "\tpublishes printer settings in Active Directory\n"
7813 "\taction can be one of PUBLISH, UPDATE, UNPUBLISH or LIST\n\n"));
7814 d_printf(_("net rpc printer MIGRATE PRINTERS [printer] [misc. options] [targets]"
7815 "\n\tmigrates printers from remote to local server\n\n"));
7816 d_printf(_("net rpc printer MIGRATE SETTINGS [printer] [misc. options] [targets]"
7817 "\n\tmigrates printer-settings from remote to local server\n\n"));
7818 d_printf(_("net rpc printer MIGRATE DRIVERS [printer] [misc. options] [targets]"
7819 "\n\tmigrates printer-drivers from remote to local server\n\n"));
7820 d_printf(_("net rpc printer MIGRATE FORMS [printer] [misc. options] [targets]"
7821 "\n\tmigrates printer-forms from remote to local server\n\n"));
7822 d_printf(_("net rpc printer MIGRATE SECURITY [printer] [misc. options] [targets]"
7823 "\n\tmigrates printer-ACLs from remote to local server\n\n"));
7824 d_printf(_("net rpc printer MIGRATE ALL [printer] [misc. options] [targets]"
7825 "\n\tmigrates drivers, forms, queues, settings and acls from\n"
7826 "\tremote to local print-server\n\n"));
7827 net_common_methods_usage(c
, argc
, argv
);
7828 net_common_flags_usage(c
, argc
, argv
);
7830 "\t-v or --verbose\t\t\tgive verbose output\n"
7831 "\t --destination\t\tmigration target server (default: localhost)\n"));
7837 * 'net rpc printer' entrypoint.
7839 * @param c A net_context structure.
7840 * @param argc Standard main() style argc.
7841 * @param argv Standard main() style argv. Initial components are already
7844 int net_rpc_printer(struct net_context
*c
, int argc
, const char **argv
)
7846 struct functable func
[] = {
7851 N_("List all printers on print server"),
7852 N_("net rpc printer list\n"
7853 " List all printers on print server")
7857 rpc_printer_migrate
,
7859 N_("Migrate printer to local server"),
7860 N_("net rpc printer migrate\n"
7861 " Migrate printer to local server")
7865 rpc_printer_driver_list
,
7867 N_("List printer drivers"),
7868 N_("net rpc printer driver\n"
7869 " List printer drivers")
7873 rpc_printer_publish
,
7875 N_("Publish printer in AD"),
7876 N_("net rpc printer publish\n"
7877 " Publish printer in AD")
7879 {NULL
, NULL
, 0, NULL
, NULL
}
7883 if (c
->display_usage
) {
7884 d_printf(_("Usage:\n"));
7885 d_printf(_("net rpc printer\n"
7886 " List printers\n"));
7887 net_display_usage_from_functable(func
);
7890 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7891 rpc_printer_list_internals
,
7895 return net_run_function(c
, argc
, argv
, "net rpc printer", func
);
7899 * 'net rpc' entrypoint.
7901 * @param c A net_context structure.
7902 * @param argc Standard main() style argc.
7903 * @param argv Standard main() style argv. Initial components are already
7907 int net_rpc(struct net_context
*c
, int argc
, const char **argv
)
7909 NET_API_STATUS status
;
7911 struct functable func
[] = {
7916 N_("Modify global audit settings"),
7917 N_("net rpc audit\n"
7918 " Modify global audit settings")
7924 N_("Show basic info about a domain"),
7926 " Show basic info about a domain")
7932 N_("Join a domain"),
7940 N_("Join a domain created in server manager"),
7941 N_("net rpc oldjoin\n"
7942 " Join a domain created in server manager")
7948 N_("Test that a join is valid"),
7949 N_("net rpc testjoin\n"
7950 " Test that a join is valid")
7956 N_("List/modify users"),
7958 " List/modify users")
7964 N_("Change a user password"),
7965 N_("net rpc password\n"
7966 " Change a user password\n"
7967 " Alias for net rpc user password")
7973 N_("List/modify groups"),
7974 N_("net rpc group\n"
7975 " List/modify groups")
7981 N_("List/modify shares"),
7982 N_("net rpc share\n"
7983 " List/modify shares")
7989 N_("List open files"),
7997 N_("List/modify printers"),
7998 N_("net rpc printer\n"
7999 " List/modify printers")
8003 net_rpc_changetrustpw
,
8005 N_("Change trust account password"),
8006 N_("net rpc changetrustpw\n"
8007 " Change trust account password")
8013 N_("Modify domain trusts"),
8014 N_("net rpc trustdom\n"
8015 " Modify domain trusts")
8021 N_("Abort a remote shutdown"),
8022 N_("net rpc abortshutdown\n"
8023 " Abort a remote shutdown")
8029 N_("Shutdown a remote server"),
8030 N_("net rpc shutdown\n"
8031 " Shutdown a remote server")
8037 N_("Dump SAM data of remote NT PDC"),
8038 N_("net rpc samdump\n"
8039 " Dump SAM data of remote NT PDC")
8045 N_("Sync a remote NT PDC's data into local passdb"),
8046 N_("net rpc vampire\n"
8047 " Sync a remote NT PDC's data into local passdb")
8053 N_("Fetch the domain sid into local secrets.tdb"),
8054 N_("net rpc getsid\n"
8055 " Fetch the domain sid into local secrets.tdb")
8061 N_("Manage privileges assigned to SID"),
8062 N_("net rpc rights\n"
8063 " Manage privileges assigned to SID")
8069 N_("Start/stop/query remote services"),
8070 N_("net rpc service\n"
8071 " Start/stop/query remote services")
8077 N_("Manage registry hives"),
8078 N_("net rpc registry\n"
8079 " Manage registry hives")
8085 N_("Open interactive shell on remote server"),
8086 N_("net rpc shell\n"
8087 " Open interactive shell on remote server")
8093 N_("Manage trusts"),
8094 N_("net rpc trust\n"
8101 N_("Configure a remote samba server"),
8103 " Configure a remote samba server")
8105 {NULL
, NULL
, 0, NULL
, NULL
}
8108 status
= libnetapi_net_init(&c
->netapi_ctx
);
8112 libnetapi_set_username(c
->netapi_ctx
, c
->opt_user_name
);
8113 libnetapi_set_password(c
->netapi_ctx
, c
->opt_password
);
8114 if (c
->opt_kerberos
) {
8115 libnetapi_set_use_kerberos(c
->netapi_ctx
);
8117 if (c
->opt_ccache
) {
8118 libnetapi_set_use_ccache(c
->netapi_ctx
);
8121 return net_run_function(c
, argc
, argv
, "net rpc", func
);