?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: Fix bug #9085.
[Samba.git] / source3 / utils / net_ads.c
blobe5e76be71a9bd7de494a5015ae5d94578df46cce
1 /*
2 Samba Unix/Linux SMB client library
3 net ads commands
4 Copyright (C) 2001 Andrew Tridgell (tridge@samba.org)
5 Copyright (C) 2001 Remus Koos (remuskoos@yahoo.com)
6 Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
7 Copyright (C) 2006 Gerald (Jerry) Carter (jerry@samba.org)
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "utils/net.h"
25 #include "librpc/gen_ndr/ndr_krb5pac.h"
26 #include "../librpc/gen_ndr/cli_spoolss.h"
27 #include "nsswitch/libwbclient/wbclient.h"
28
29 #ifdef HAVE_ADS
30
31 /* when we do not have sufficient input parameters to contact a remote domain
32 * we always fall back to our own realm - Guenther*/
33
34 static const char *assume_own_realm(struct net_context *c)
35 {
36 if (!c->opt_host && strequal(lp_workgroup(), c->opt_target_workgroup)) {
37 return lp_realm();
38 }
39
40 return NULL;
41 }
42
43 /*
44 do a cldap netlogon query
45 */
46 static int net_ads_cldap_netlogon(struct net_context *c, ADS_STRUCT *ads)
47 {
48 char addr[INET6_ADDRSTRLEN];
49 struct NETLOGON_SAM_LOGON_RESPONSE_EX reply;
50
51 print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
52 if ( !ads_cldap_netlogon_5(talloc_tos(), addr, ads->server.realm, &reply ) ) {
53 d_fprintf(stderr, _("CLDAP query failed!\n"));
54 return -1;
55 }
56
57 d_printf(_("Information for Domain Controller: %s\n\n"),
58 addr);
59
60 d_printf(_("Response Type: "));
61 switch (reply.command) {
62 case LOGON_SAM_LOGON_USER_UNKNOWN_EX:
63 d_printf("LOGON_SAM_LOGON_USER_UNKNOWN_EX\n");
64 break;
65 case LOGON_SAM_LOGON_RESPONSE_EX:
66 d_printf("LOGON_SAM_LOGON_RESPONSE_EX\n");
67 break;
68 default:
69 d_printf("0x%x\n", reply.command);
70 break;
71 }
72
73 d_printf(_("GUID: %s\n"), GUID_string(talloc_tos(),&reply.domain_uuid));
74
75 d_printf(_("Flags:\n"
76 "\tIs a PDC: %s\n"
77 "\tIs a GC of the forest: %s\n"
78 "\tIs an LDAP server: %s\n"
79 "\tSupports DS: %s\n"
80 "\tIs running a KDC: %s\n"
81 "\tIs running time services: %s\n"
82 "\tIs the closest DC: %s\n"
83 "\tIs writable: %s\n"
84 "\tHas a hardware clock: %s\n"
85 "\tIs a non-domain NC serviced by LDAP server: %s\n"
86 "\tIs NT6 DC that has some secrets: %s\n"
87 "\tIs NT6 DC that has all secrets: %s\n"),
88 (reply.server_type & NBT_SERVER_PDC) ? _("yes") : _("no"),
89 (reply.server_type & NBT_SERVER_GC) ? _("yes") : _("no"),
90 (reply.server_type & NBT_SERVER_LDAP) ? _("yes") : _("no"),
91 (reply.server_type & NBT_SERVER_DS) ? _("yes") : _("no"),
92 (reply.server_type & NBT_SERVER_KDC) ? _("yes") : _("no"),
93 (reply.server_type & NBT_SERVER_TIMESERV) ? _("yes") : _("no"),
94 (reply.server_type & NBT_SERVER_CLOSEST) ? _("yes") : _("no"),
95 (reply.server_type & NBT_SERVER_WRITABLE) ? _("yes") : _("no"),
96 (reply.server_type & NBT_SERVER_GOOD_TIMESERV) ? _("yes") : _("no"),
97 (reply.server_type & NBT_SERVER_NDNC) ? _("yes") : _("no"),
98 (reply.server_type & NBT_SERVER_SELECT_SECRET_DOMAIN_6) ? _("yes") : _("no"),
99 (reply.server_type & NBT_SERVER_FULL_SECRET_DOMAIN_6) ? _("yes") : _("no"));
100
101
102 printf(_("Forest:\t\t\t%s\n"), reply.forest);
103 printf(_("Domain:\t\t\t%s\n"), reply.dns_domain);
104 printf(_("Domain Controller:\t%s\n"), reply.pdc_dns_name);
105
106 printf(_("Pre-Win2k Domain:\t%s\n"), reply.domain);
107 printf(_("Pre-Win2k Hostname:\t%s\n"), reply.pdc_name);
108
109 if (*reply.user_name) printf(_("User name:\t%s\n"), reply.user_name);
110
111 printf(_("Server Site Name :\t\t%s\n"), reply.server_site);
112 printf(_("Client Site Name :\t\t%s\n"), reply.client_site);
113
114 d_printf(_("NT Version: %d\n"), reply.nt_version);
115 d_printf(_("LMNT Token: %.2x\n"), reply.lmnt_token);
116 d_printf(_("LM20 Token: %.2x\n"), reply.lm20_token);
117
118 return 0;
119 }
120
121 /*
122 this implements the CLDAP based netlogon lookup requests
123 for finding the domain controller of a ADS domain
124 */
125 static int net_ads_lookup(struct net_context *c, int argc, const char **argv)
126 {
127 ADS_STRUCT *ads;
128 int ret;
129
130 if (c->display_usage) {
131 d_printf("%s\n"
132 "net ads lookup\n"
133 " %s",
134 _("Usage:"),
135 _("Find the ADS DC using CLDAP lookup.\n"));
136 return 0;
137 }
138
139 if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
140 d_fprintf(stderr, _("Didn't find the cldap server!\n"));
141 ads_destroy(&ads);
142 return -1;
143 }
144
145 if (!ads->config.realm) {
146 ads->config.realm = CONST_DISCARD(char *, c->opt_target_workgroup);
147 ads->ldap.port = 389;
148 }
149
150 ret = net_ads_cldap_netlogon(c, ads);
151 ads_destroy(&ads);
152 return ret;
153 }
154
155
156
157 static int net_ads_info(struct net_context *c, int argc, const char **argv)
158 {
159 ADS_STRUCT *ads;
160 char addr[INET6_ADDRSTRLEN];
161
162 if (c->display_usage) {
163 d_printf("%s\n"
164 "net ads info\n"
165 " %s",
166 _("Usage:"),
167 _("Display information about an Active Directory "
168 "server.\n"));
169 return 0;
170 }
171
172 if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
173 d_fprintf(stderr, _("Didn't find the ldap server!\n"));
174 return -1;
175 }
176
177 if (!ads || !ads->config.realm) {
178 d_fprintf(stderr, _("Didn't find the ldap server!\n"));
179 ads_destroy(&ads);
180 return -1;
181 }
182
183 /* Try to set the server's current time since we didn't do a full
184 TCP LDAP session initially */
185
186 if ( !ADS_ERR_OK(ads_current_time( ads )) ) {
187 d_fprintf( stderr, _("Failed to get server's current time!\n"));
188 }
189
190 print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
191
192 d_printf(_("LDAP server: %s\n"), addr);
193 d_printf(_("LDAP server name: %s\n"), ads->config.ldap_server_name);
194 d_printf(_("Realm: %s\n"), ads->config.realm);
195 d_printf(_("Bind Path: %s\n"), ads->config.bind_path);
196 d_printf(_("LDAP port: %d\n"), ads->ldap.port);
197 d_printf(_("Server time: %s\n"),
198 http_timestring(talloc_tos(), ads->config.current_time));
199
200 d_printf(_("KDC server: %s\n"), ads->auth.kdc_server );
201 d_printf(_("Server time offset: %d\n"), ads->auth.time_offset );
202
203 ads_destroy(&ads);
204 return 0;
205 }
206
207 static void use_in_memory_ccache(void) {
208 /* Use in-memory credentials cache so we do not interfere with
209 * existing credentials */
210 setenv(KRB5_ENV_CCNAME, "MEMORY:net_ads", 1);
211 }
212
213 static ADS_STATUS ads_startup_int(struct net_context *c, bool only_own_domain,
214 uint32 auth_flags, ADS_STRUCT **ads_ret)
215 {
216 ADS_STRUCT *ads = NULL;
217 ADS_STATUS status;
218 bool need_password = false;
219 bool second_time = false;
220 char *cp;
221 const char *realm = NULL;
222 bool tried_closest_dc = false;
223
224 /* lp_realm() should be handled by a command line param,
225 However, the join requires that realm be set in smb.conf
226 and compares our realm with the remote server's so this is
227 ok until someone needs more flexibility */
228
229 *ads_ret = NULL;
230
231 retry_connect:
232 if (only_own_domain) {
233 realm = lp_realm();
234 } else {
235 realm = assume_own_realm(c);
236 }
237
238 ads = ads_init(realm, c->opt_target_workgroup, c->opt_host);
239
240 if (!c->opt_user_name) {
241 c->opt_user_name = "administrator";
242 }
243
244 if (c->opt_user_specified) {
245 need_password = true;
246 }
247
248 retry:
249 if (!c->opt_password && need_password && !c->opt_machine_pass) {
250 c->opt_password = net_prompt_pass(c, c->opt_user_name);
251 if (!c->opt_password) {
252 ads_destroy(&ads);
253 return ADS_ERROR(LDAP_NO_MEMORY);
254 }
255 }
256
257 if (c->opt_password) {
258 use_in_memory_ccache();
259 SAFE_FREE(ads->auth.password);
260 ads->auth.password = smb_xstrdup(c->opt_password);
261 }
262
263 ads->auth.flags |= auth_flags;
264 SAFE_FREE(ads->auth.user_name);
265 ads->auth.user_name = smb_xstrdup(c->opt_user_name);
266
267 /*
268 * If the username is of the form "name@realm",
269 * extract the realm and convert to upper case.
270 * This is only used to establish the connection.
271 */
272 if ((cp = strchr_m(ads->auth.user_name, '@'))!=0) {
273 *cp++ = '\0';
274 SAFE_FREE(ads->auth.realm);
275 ads->auth.realm = smb_xstrdup(cp);
276 strupper_m(ads->auth.realm);
277 }
278
279 status = ads_connect(ads);
280
281 if (!ADS_ERR_OK(status)) {
282
283 if (NT_STATUS_EQUAL(ads_ntstatus(status),
284 NT_STATUS_NO_LOGON_SERVERS)) {
285 DEBUG(0,("ads_connect: %s\n", ads_errstr(status)));
286 ads_destroy(&ads);
287 return status;
288 }
289
290 if (!need_password && !second_time && !(auth_flags & ADS_AUTH_NO_BIND)) {
291 need_password = true;
292 second_time = true;
293 goto retry;
294 } else {
295 ads_destroy(&ads);
296 return status;
297 }
298 }
299
300 /* when contacting our own domain, make sure we use the closest DC.
301 * This is done by reconnecting to ADS because only the first call to
302 * ads_connect will give us our own sitename */
303
304 if ((only_own_domain || !c->opt_host) && !tried_closest_dc) {
305
306 tried_closest_dc = true; /* avoid loop */
307
308 if (!ads_closest_dc(ads)) {
309
310 namecache_delete(ads->server.realm, 0x1C);
311 namecache_delete(ads->server.workgroup, 0x1C);
312
313 ads_destroy(&ads);
314 ads = NULL;
315
316 goto retry_connect;
317 }
318 }
319
320 *ads_ret = ads;
321 return status;
322 }
323
324 ADS_STATUS ads_startup(struct net_context *c, bool only_own_domain, ADS_STRUCT **ads)
325 {
326 return ads_startup_int(c, only_own_domain, 0, ads);
327 }
328
329 ADS_STATUS ads_startup_nobind(struct net_context *c, bool only_own_domain, ADS_STRUCT **ads)
330 {
331 return ads_startup_int(c, only_own_domain, ADS_AUTH_NO_BIND, ads);
332 }
333
334 /*
335 Check to see if connection can be made via ads.
336 ads_startup() stores the password in opt_password if it needs to so
337 that rpc or rap can use it without re-prompting.
338 */
339 static int net_ads_check_int(const char *realm, const char *workgroup, const char *host)
340 {
341 ADS_STRUCT *ads;
342 ADS_STATUS status;
343
344 if ( (ads = ads_init( realm, workgroup, host )) == NULL ) {
345 return -1;
346 }
347
348 ads->auth.flags |= ADS_AUTH_NO_BIND;
349
350 status = ads_connect(ads);
351 if ( !ADS_ERR_OK(status) ) {
352 return -1;
353 }
354
355 ads_destroy(&ads);
356 return 0;
357 }
358
359 int net_ads_check_our_domain(struct net_context *c)
360 {
361 return net_ads_check_int(lp_realm(), lp_workgroup(), NULL);
362 }
363
364 int net_ads_check(struct net_context *c)
365 {
366 return net_ads_check_int(NULL, c->opt_workgroup, c->opt_host);
367 }
368
369 /*
370 determine the netbios workgroup name for a domain
371 */
372 static int net_ads_workgroup(struct net_context *c, int argc, const char **argv)
373 {
374 ADS_STRUCT *ads;
375 char addr[INET6_ADDRSTRLEN];
376 struct NETLOGON_SAM_LOGON_RESPONSE_EX reply;
377
378 if (c->display_usage) {
379 d_printf ("%s\n"
380 "net ads workgroup\n"
381 " %s\n",
382 _("Usage:"),
383 _("Print the workgroup name"));
384 return 0;
385 }
386
387 if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
388 d_fprintf(stderr, _("Didn't find the cldap server!\n"));
389 return -1;
390 }
391
392 if (!ads->config.realm) {
393 ads->config.realm = CONST_DISCARD(char *, c->opt_target_workgroup);
394 ads->ldap.port = 389;
395 }
396
397 print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
398 if ( !ads_cldap_netlogon_5(talloc_tos(), addr, ads->server.realm, &reply ) ) {
399 d_fprintf(stderr, _("CLDAP query failed!\n"));
400 ads_destroy(&ads);
401 return -1;
402 }
403
404 d_printf(_("Workgroup: %s\n"), reply.domain);
405
406 ads_destroy(&ads);
407
408 return 0;
409 }
410
411
412
413 static bool usergrp_display(ADS_STRUCT *ads, char *field, void **values, void *data_area)
414 {
415 char **disp_fields = (char **) data_area;
416
417 if (!field) { /* must be end of record */
418 if (disp_fields[0]) {
419 if (!strchr_m(disp_fields[0], '$')) {
420 if (disp_fields[1])
421 d_printf("%-21.21s %s\n",
422 disp_fields[0], disp_fields[1]);
423 else
424 d_printf("%s\n", disp_fields[0]);
425 }
426 }
427 SAFE_FREE(disp_fields[0]);
428 SAFE_FREE(disp_fields[1]);
429 return true;
430 }
431 if (!values) /* must be new field, indicate string field */
432 return true;
433 if (StrCaseCmp(field, "sAMAccountName") == 0) {
434 disp_fields[0] = SMB_STRDUP((char *) values[0]);
435 }
436 if (StrCaseCmp(field, "description") == 0)
437 disp_fields[1] = SMB_STRDUP((char *) values[0]);
438 return true;
439 }
440
441 static int net_ads_user_usage(struct net_context *c, int argc, const char **argv)
442 {
443 return net_user_usage(c, argc, argv);
444 }
445
446 static int ads_user_add(struct net_context *c, int argc, const char **argv)
447 {
448 ADS_STRUCT *ads;
449 ADS_STATUS status;
450 char *upn, *userdn;
451 LDAPMessage *res=NULL;
452 int rc = -1;
453 char *ou_str = NULL;
454
455 if (argc < 1 || c->display_usage)
456 return net_ads_user_usage(c, argc, argv);
457
458 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
459 return -1;
460 }
461
462 status = ads_find_user_acct(ads, &res, argv[0]);
463
464 if (!ADS_ERR_OK(status)) {
465 d_fprintf(stderr, _("ads_user_add: %s\n"), ads_errstr(status));
466 goto done;
467 }
468
469 if (ads_count_replies(ads, res)) {
470 d_fprintf(stderr, _("ads_user_add: User %s already exists\n"),
471 argv[0]);
472 goto done;
473 }
474
475 if (c->opt_container) {
476 ou_str = SMB_STRDUP(c->opt_container);
477 } else {
478 ou_str = ads_default_ou_string(ads, WELL_KNOWN_GUID_USERS);
479 }
480
481 status = ads_add_user_acct(ads, argv[0], ou_str, c->opt_comment);
482
483 if (!ADS_ERR_OK(status)) {
484 d_fprintf(stderr, _("Could not add user %s: %s\n"), argv[0],
485 ads_errstr(status));
486 goto done;
487 }
488
489 /* if no password is to be set, we're done */
490 if (argc == 1) {
491 d_printf(_("User %s added\n"), argv[0]);
492 rc = 0;
493 goto done;
494 }
495
496 /* try setting the password */
497 if (asprintf(&upn, "%s@%s", argv[0], ads->config.realm) == -1) {
498 goto done;
499 }
500 status = ads_krb5_set_password(ads->auth.kdc_server, upn, argv[1],
501 ads->auth.time_offset);
502 SAFE_FREE(upn);
503 if (ADS_ERR_OK(status)) {
504 d_printf(_("User %s added\n"), argv[0]);
505 rc = 0;
506 goto done;
507 }
508
509 /* password didn't set, delete account */
510 d_fprintf(stderr, _("Could not add user %s. "
511 "Error setting password %s\n"),
512 argv[0], ads_errstr(status));
513 ads_msgfree(ads, res);
514 status=ads_find_user_acct(ads, &res, argv[0]);
515 if (ADS_ERR_OK(status)) {
516 userdn = ads_get_dn(ads, talloc_tos(), res);
517 ads_del_dn(ads, userdn);
518 TALLOC_FREE(userdn);
519 }
520
521 done:
522 if (res)
523 ads_msgfree(ads, res);
524 ads_destroy(&ads);
525 SAFE_FREE(ou_str);
526 return rc;
527 }
528
529 static int ads_user_info(struct net_context *c, int argc, const char **argv)
530 {
531 ADS_STRUCT *ads = NULL;
532 ADS_STATUS rc;
533 LDAPMessage *res = NULL;
534 TALLOC_CTX *frame;
535 int ret = 0;
536 wbcErr wbc_status;
537 const char *attrs[] = {"memberOf", "primaryGroupID", NULL};
538 char *searchstring=NULL;
539 char **grouplist;
540 char *primary_group;
541 char *escaped_user;
542 DOM_SID primary_group_sid;
543 uint32_t group_rid;
544 enum wbcSidType type;
545
546 if (argc < 1 || c->display_usage) {
547 return net_ads_user_usage(c, argc, argv);
548 }
549
550 frame = talloc_new(talloc_tos());
551 if (frame == NULL) {
552 return -1;
553 }
554
555 escaped_user = escape_ldap_string(frame, argv[0]);
556 if (!escaped_user) {
557 d_fprintf(stderr,
558 _("ads_user_info: failed to escape user %s\n"),
559 argv[0]);
560 return -1;
561 }
562
563 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
564 ret = -1;
565 goto error;
566 }
567
568 if (asprintf(&searchstring, "(sAMAccountName=%s)", escaped_user) == -1) {
569 ret =-1;
570 goto error;
571 }
572 rc = ads_search(ads, &res, searchstring, attrs);
573 SAFE_FREE(searchstring);
574
575 if (!ADS_ERR_OK(rc)) {
576 d_fprintf(stderr, _("ads_search: %s\n"), ads_errstr(rc));
577 ret = -1;
578 goto error;
579 }
580
581 if (!ads_pull_uint32(ads, res, "primaryGroupID", &group_rid)) {
582 d_fprintf(stderr, _("ads_pull_uint32 failed\n"));
583 ret = -1;
584 goto error;
585 }
586
587 rc = ads_domain_sid(ads, &primary_group_sid);
588 if (!ADS_ERR_OK(rc)) {
589 d_fprintf(stderr, _("ads_domain_sid: %s\n"), ads_errstr(rc));
590 ret = -1;
591 goto error;
592 }
593
594 sid_append_rid(&primary_group_sid, group_rid);
595
596 wbc_status = wbcLookupSid((struct wbcDomainSid *)&primary_group_sid,
597 NULL, /* don't look up domain */
598 &primary_group,
599 &type);
600 if (!WBC_ERROR_IS_OK(wbc_status)) {
601 d_fprintf(stderr, "wbcLookupSid: %s\n",
602 wbcErrorString(wbc_status));
603 ret = -1;
604 goto error;
605 }
606
607 d_printf("%s\n", primary_group);
608
609 wbcFreeMemory(primary_group);
610
611 grouplist = ldap_get_values((LDAP *)ads->ldap.ld,
612 (LDAPMessage *)res, "memberOf");
613
614 if (grouplist) {
615 int i;
616 char **groupname;
617 for (i=0;grouplist[i];i++) {
618 groupname = ldap_explode_dn(grouplist[i], 1);
619 d_printf("%s\n", groupname[0]);
620 ldap_value_free(groupname);
621 }
622 ldap_value_free(grouplist);
623 }
624
625 error:
626 if (res) ads_msgfree(ads, res);
627 if (ads) ads_destroy(&ads);
628 TALLOC_FREE(frame);
629 return ret;
630 }
631
632 static int ads_user_delete(struct net_context *c, int argc, const char **argv)
633 {
634 ADS_STRUCT *ads;
635 ADS_STATUS rc;
636 LDAPMessage *res = NULL;
637 char *userdn;
638
639 if (argc < 1) {
640 return net_ads_user_usage(c, argc, argv);
641 }
642
643 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
644 return -1;
645 }
646
647 rc = ads_find_user_acct(ads, &res, argv[0]);
648 if (!ADS_ERR_OK(rc) || ads_count_replies(ads, res) != 1) {
649 d_printf(_("User %s does not exist.\n"), argv[0]);
650 ads_msgfree(ads, res);
651 ads_destroy(&ads);
652 return -1;
653 }
654 userdn = ads_get_dn(ads, talloc_tos(), res);
655 ads_msgfree(ads, res);
656 rc = ads_del_dn(ads, userdn);
657 TALLOC_FREE(userdn);
658 if (ADS_ERR_OK(rc)) {
659 d_printf(_("User %s deleted\n"), argv[0]);
660 ads_destroy(&ads);
661 return 0;
662 }
663 d_fprintf(stderr, _("Error deleting user %s: %s\n"), argv[0],
664 ads_errstr(rc));
665 ads_destroy(&ads);
666 return -1;
667 }
668
669 int net_ads_user(struct net_context *c, int argc, const char **argv)
670 {
671 struct functable func[] = {
672 {
673 "add",
674 ads_user_add,
675 NET_TRANSPORT_ADS,
676 N_("Add an AD user"),
677 N_("net ads user add\n"
678 " Add an AD user")
679 },
680 {
681 "info",
682 ads_user_info,
683 NET_TRANSPORT_ADS,
684 N_("Display information about an AD user"),
685 N_("net ads user info\n"
686 " Display information about an AD user")
687 },
688 {
689 "delete",
690 ads_user_delete,
691 NET_TRANSPORT_ADS,
692 N_("Delete an AD user"),
693 N_("net ads user delete\n"
694 " Delete an AD user")
695 },
696 {NULL, NULL, 0, NULL, NULL}
697 };
698 ADS_STRUCT *ads;
699 ADS_STATUS rc;
700 const char *shortattrs[] = {"sAMAccountName", NULL};
701 const char *longattrs[] = {"sAMAccountName", "description", NULL};
702 char *disp_fields[2] = {NULL, NULL};
703
704 if (argc == 0) {
705 if (c->display_usage) {
706 d_printf( "%s\n"
707 "net ads user\n"
708 " %s\n",
709 _("Usage:"),
710 _("List AD users"));
711 net_display_usage_from_functable(func);
712 return 0;
713 }
714
715 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
716 return -1;
717 }
718
719 if (c->opt_long_list_entries)
720 d_printf(_("\nUser name Comment"
721 "\n-----------------------------\n"));
722
723 rc = ads_do_search_all_fn(ads, ads->config.bind_path,
724 LDAP_SCOPE_SUBTREE,
725 "(objectCategory=user)",
726 c->opt_long_list_entries ? longattrs :
727 shortattrs, usergrp_display,
728 disp_fields);
729 ads_destroy(&ads);
730 return ADS_ERR_OK(rc) ? 0 : -1;
731 }
732
733 return net_run_function(c, argc, argv, "net ads user", func);
734 }
735
736 static int net_ads_group_usage(struct net_context *c, int argc, const char **argv)
737 {
738 return net_group_usage(c, argc, argv);
739 }
740
741 static int ads_group_add(struct net_context *c, int argc, const char **argv)
742 {
743 ADS_STRUCT *ads;
744 ADS_STATUS status;
745 LDAPMessage *res=NULL;
746 int rc = -1;
747 char *ou_str = NULL;
748
749 if (argc < 1 || c->display_usage) {
750 return net_ads_group_usage(c, argc, argv);
751 }
752
753 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
754 return -1;
755 }
756
757 status = ads_find_user_acct(ads, &res, argv[0]);
758
759 if (!ADS_ERR_OK(status)) {
760 d_fprintf(stderr, _("ads_group_add: %s\n"), ads_errstr(status));
761 goto done;
762 }
763
764 if (ads_count_replies(ads, res)) {
765 d_fprintf(stderr, _("ads_group_add: Group %s already exists\n"), argv[0]);
766 goto done;
767 }
768
769 if (c->opt_container) {
770 ou_str = SMB_STRDUP(c->opt_container);
771 } else {
772 ou_str = ads_default_ou_string(ads, WELL_KNOWN_GUID_USERS);
773 }
774
775 status = ads_add_group_acct(ads, argv[0], ou_str, c->opt_comment);
776
777 if (ADS_ERR_OK(status)) {
778 d_printf(_("Group %s added\n"), argv[0]);
779 rc = 0;
780 } else {
781 d_fprintf(stderr, _("Could not add group %s: %s\n"), argv[0],
782 ads_errstr(status));
783 }
784
785 done:
786 if (res)
787 ads_msgfree(ads, res);
788 ads_destroy(&ads);
789 SAFE_FREE(ou_str);
790 return rc;
791 }
792
793 static int ads_group_delete(struct net_context *c, int argc, const char **argv)
794 {
795 ADS_STRUCT *ads;
796 ADS_STATUS rc;
797 LDAPMessage *res = NULL;
798 char *groupdn;
799
800 if (argc < 1 || c->display_usage) {
801 return net_ads_group_usage(c, argc, argv);
802 }
803
804 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
805 return -1;
806 }
807
808 rc = ads_find_user_acct(ads, &res, argv[0]);
809 if (!ADS_ERR_OK(rc) || ads_count_replies(ads, res) != 1) {
810 d_printf(_("Group %s does not exist.\n"), argv[0]);
811 ads_msgfree(ads, res);
812 ads_destroy(&ads);
813 return -1;
814 }
815 groupdn = ads_get_dn(ads, talloc_tos(), res);
816 ads_msgfree(ads, res);
817 rc = ads_del_dn(ads, groupdn);
818 TALLOC_FREE(groupdn);
819 if (ADS_ERR_OK(rc)) {
820 d_printf(_("Group %s deleted\n"), argv[0]);
821 ads_destroy(&ads);
822 return 0;
823 }
824 d_fprintf(stderr, _("Error deleting group %s: %s\n"), argv[0],
825 ads_errstr(rc));
826 ads_destroy(&ads);
827 return -1;
828 }
829
830 int net_ads_group(struct net_context *c, int argc, const char **argv)
831 {
832 struct functable func[] = {
833 {
834 "add",
835 ads_group_add,
836 NET_TRANSPORT_ADS,
837 N_("Add an AD group"),
838 N_("net ads group add\n"
839 " Add an AD group")
840 },
841 {
842 "delete",
843 ads_group_delete,
844 NET_TRANSPORT_ADS,
845 N_("Delete an AD group"),
846 N_("net ads group delete\n"
847 " Delete an AD group")
848 },
849 {NULL, NULL, 0, NULL, NULL}
850 };
851 ADS_STRUCT *ads;
852 ADS_STATUS rc;
853 const char *shortattrs[] = {"sAMAccountName", NULL};
854 const char *longattrs[] = {"sAMAccountName", "description", NULL};
855 char *disp_fields[2] = {NULL, NULL};
856
857 if (argc == 0) {
858 if (c->display_usage) {
859 d_printf( "%s\n"
860 "net ads group\n"
861 " %s\n",
862 _("Usage:"),
863 _("List AD groups"));
864 net_display_usage_from_functable(func);
865 return 0;
866 }
867
868 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
869 return -1;
870 }
871
872 if (c->opt_long_list_entries)
873 d_printf(_("\nGroup name Comment"
874 "\n-----------------------------\n"));
875 rc = ads_do_search_all_fn(ads, ads->config.bind_path,
876 LDAP_SCOPE_SUBTREE,
877 "(objectCategory=group)",
878 c->opt_long_list_entries ? longattrs :
879 shortattrs, usergrp_display,
880 disp_fields);
881
882 ads_destroy(&ads);
883 return ADS_ERR_OK(rc) ? 0 : -1;
884 }
885 return net_run_function(c, argc, argv, "net ads group", func);
886 }
887
888 static int net_ads_status(struct net_context *c, int argc, const char **argv)
889 {
890 ADS_STRUCT *ads;
891 ADS_STATUS rc;
892 LDAPMessage *res;
893
894 if (c->display_usage) {
895 d_printf( "%s\n"
896 "net ads status\n"
897 " %s\n",
898 _("Usage:"),
899 _("Display machine account details"));
900 return 0;
901 }
902
903 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
904 return -1;
905 }
906
907 rc = ads_find_machine_acct(ads, &res, global_myname());
908 if (!ADS_ERR_OK(rc)) {
909 d_fprintf(stderr, _("ads_find_machine_acct: %s\n"), ads_errstr(rc));
910 ads_destroy(&ads);
911 return -1;
912 }
913
914 if (ads_count_replies(ads, res) == 0) {
915 d_fprintf(stderr, _("No machine account for '%s' found\n"), global_myname());
916 ads_destroy(&ads);
917 return -1;
918 }
919
920 ads_dump(ads, res);
921 ads_destroy(&ads);
922 return 0;
923 }
924
925 /*******************************************************************
926 Leave an AD domain. Windows XP disables the machine account.
927 We'll try the same. The old code would do an LDAP delete.
928 That only worked using the machine creds because added the machine
929 with full control to the computer object's ACL.
930 *******************************************************************/
931
932 static int net_ads_leave(struct net_context *c, int argc, const char **argv)
933 {
934 TALLOC_CTX *ctx;
935 struct libnet_UnjoinCtx *r = NULL;
936 WERROR werr;
937
938 if (c->display_usage) {
939 d_printf( "%s\n"
940 "net ads leave\n"
941 " %s\n",
942 _("Usage:"),
943 _("Leave an AD domain"));
944 return 0;
945 }
946
947 if (!*lp_realm()) {
948 d_fprintf(stderr, _("No realm set, are we joined ?\n"));
949 return -1;
950 }
951
952 if (!(ctx = talloc_init("net_ads_leave"))) {
953 d_fprintf(stderr, _("Could not initialise talloc context.\n"));
954 return -1;
955 }
956
957 if (!c->opt_kerberos) {
958 use_in_memory_ccache();
959 }
960
961 werr = libnet_init_UnjoinCtx(ctx, &r);
962 if (!W_ERROR_IS_OK(werr)) {
963 d_fprintf(stderr, _("Could not initialise unjoin context.\n"));
964 return -1;
965 }
966
967 r->in.debug = true;
968 r->in.use_kerberos = c->opt_kerberos;
969 r->in.dc_name = c->opt_host;
970 r->in.domain_name = lp_realm();
971 r->in.admin_account = c->opt_user_name;
972 r->in.admin_password = net_prompt_pass(c, c->opt_user_name);
973 r->in.modify_config = lp_config_backend_is_registry();
974
975 /* Try to delete it, but if that fails, disable it. The
976 WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE really means "disable */
977 r->in.unjoin_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
978 WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
979 r->in.delete_machine_account = true;
980
981 werr = libnet_Unjoin(ctx, r);
982 if (!W_ERROR_IS_OK(werr)) {
983 d_printf(_("Failed to leave domain: %s\n"),
984 r->out.error_string ? r->out.error_string :
985 get_friendly_werror_msg(werr));
986 goto done;
987 }
988
989 if (r->out.deleted_machine_account) {
990 d_printf(_("Deleted account for '%s' in realm '%s'\n"),
991 r->in.machine_name, r->out.dns_domain_name);
992 goto done;
993 }
994
995 /* We couldn't delete it - see if the disable succeeded. */
996 if (r->out.disabled_machine_account) {
997 d_printf(_("Disabled account for '%s' in realm '%s'\n"),
998 r->in.machine_name, r->out.dns_domain_name);
999 werr = WERR_OK;
1000 goto done;
1001 }
1002
1003 /* Based on what we requseted, we shouldn't get here, but if
1004 we did, it means the secrets were removed, and therefore
1005 we have left the domain */
1006 d_fprintf(stderr, _("Machine '%s' Left domain '%s'\n"),
1007 r->in.machine_name, r->out.dns_domain_name);
1008
1009 done:
1010 TALLOC_FREE(r);
1011 TALLOC_FREE(ctx);
1012
1013 if (W_ERROR_IS_OK(werr)) {
1014 return 0;
1015 }
1016
1017 return -1;
1018 }
1019
1020 static NTSTATUS net_ads_join_ok(struct net_context *c)
1021 {
1022 ADS_STRUCT *ads = NULL;
1023 ADS_STATUS status;
1024 fstring dc_name;
1025 struct sockaddr_storage dcip;
1026
1027 if (!secrets_init()) {
1028 DEBUG(1,("Failed to initialise secrets database\n"));
1029 return NT_STATUS_ACCESS_DENIED;
1030 }
1031
1032 net_use_krb_machine_account(c);
1033
1034 get_dc_name(lp_workgroup(), lp_realm(), dc_name, &dcip);
1035
1036 status = ads_startup(c, true, &ads);
1037 if (!ADS_ERR_OK(status)) {
1038 return ads_ntstatus(status);
1039 }
1040
1041 ads_destroy(&ads);
1042 return NT_STATUS_OK;
1043 }
1044
1045 /*
1046 check that an existing join is OK
1047 */
1048 int net_ads_testjoin(struct net_context *c, int argc, const char **argv)
1049 {
1050 NTSTATUS status;
1051 use_in_memory_ccache();
1052
1053 if (c->display_usage) {
1054 d_printf( "%s\n"
1055 "net ads testjoin\n"
1056 " %s\n",
1057 _("Usage:"),
1058 _("Test if the existing join is ok"));
1059 return 0;
1060 }
1061
1062 /* Display success or failure */
1063 status = net_ads_join_ok(c);
1064 if (!NT_STATUS_IS_OK(status)) {
1065 fprintf(stderr, _("Join to domain is not valid: %s\n"),
1066 get_friendly_nt_error_msg(status));
1067 return -1;
1068 }
1069
1070 printf(_("Join is OK\n"));
1071 return 0;
1072 }
1073
1074 /*******************************************************************
1075 Simple configu checks before beginning the join
1076 ********************************************************************/
1077
1078 static WERROR check_ads_config( void )
1079 {
1080 if (lp_server_role() != ROLE_DOMAIN_MEMBER ) {
1081 d_printf(_("Host is not configured as a member server.\n"));
1082 return WERR_INVALID_DOMAIN_ROLE;
1083 }
1084
1085 if (strlen(global_myname()) > 15) {
1086 d_printf(_("Our netbios name can be at most 15 chars long, "
1087 "\"%s\" is %u chars long\n"), global_myname(),
1088 (unsigned int)strlen(global_myname()));
1089 return WERR_INVALID_COMPUTERNAME;
1090 }
1091
1092 if ( lp_security() == SEC_ADS && !*lp_realm()) {
1093 d_fprintf(stderr, _("realm must be set in in %s for ADS "
1094 "join to succeed.\n"), get_dyn_CONFIGFILE());
1095 return WERR_INVALID_PARAM;
1096 }
1097
1098 return WERR_OK;
1099 }
1100
1101 /*******************************************************************
1102 Send a DNS update request
1103 *******************************************************************/
1104
1105 #if defined(WITH_DNS_UPDATES)
1106 #include "dns.h"
1107 DNS_ERROR DoDNSUpdate(char *pszServerName,
1108 const char *pszDomainName, const char *pszHostName,
1109 const struct sockaddr_storage *sslist,
1110 size_t num_addrs );
1111
1112 static NTSTATUS net_update_dns_internal(TALLOC_CTX *ctx, ADS_STRUCT *ads,
1113 const char *machine_name,
1114 const struct sockaddr_storage *addrs,
1115 int num_addrs)
1116 {
1117 struct dns_rr_ns *nameservers = NULL;
1118 int ns_count = 0;
1119 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
1120 DNS_ERROR dns_err;
1121 fstring dns_server;
1122 const char *dnsdomain = NULL;
1123 char *root_domain = NULL;
1124
1125 if ( (dnsdomain = strchr_m( machine_name, '.')) == NULL ) {
1126 d_printf(_("No DNS domain configured for %s. "
1127 "Unable to perform DNS Update.\n"), machine_name);
1128 status = NT_STATUS_INVALID_PARAMETER;
1129 goto done;
1130 }
1131 dnsdomain++;
1132
1133 status = ads_dns_lookup_ns( ctx, dnsdomain, &nameservers, &ns_count );
1134 if ( !NT_STATUS_IS_OK(status) || (ns_count == 0)) {
1135 /* Child domains often do not have NS records. Look
1136 for the NS record for the forest root domain
1137 (rootDomainNamingContext in therootDSE) */
1138
1139 const char *rootname_attrs[] = { "rootDomainNamingContext", NULL };
1140 LDAPMessage *msg = NULL;
1141 char *root_dn;
1142 ADS_STATUS ads_status;
1143
1144 if ( !ads->ldap.ld ) {
1145 ads_status = ads_connect( ads );
1146 if ( !ADS_ERR_OK(ads_status) ) {
1147 DEBUG(0,("net_update_dns_internal: Failed to connect to our DC!\n"));
1148 goto done;
1149 }
1150 }
1151
1152 ads_status = ads_do_search(ads, "", LDAP_SCOPE_BASE,
1153 "(objectclass=*)", rootname_attrs, &msg);
1154 if (!ADS_ERR_OK(ads_status)) {
1155 goto done;
1156 }
1157
1158 root_dn = ads_pull_string(ads, ctx, msg, "rootDomainNamingContext");
1159 if ( !root_dn ) {
1160 ads_msgfree( ads, msg );
1161 goto done;
1162 }
1163
1164 root_domain = ads_build_domain( root_dn );
1165
1166 /* cleanup */
1167 ads_msgfree( ads, msg );
1168
1169 /* try again for NS servers */
1170
1171 status = ads_dns_lookup_ns( ctx, root_domain, &nameservers, &ns_count );
1172
1173 if ( !NT_STATUS_IS_OK(status) || (ns_count == 0)) {
1174 DEBUG(3,("net_ads_join: Failed to find name server for the %s "
1175 "realm\n", ads->config.realm));
1176 goto done;
1177 }
1178
1179 dnsdomain = root_domain;
1180
1181 }
1182
1183 /* Now perform the dns update - we'll try non-secure and if we fail,
1184 we'll follow it up with a secure update */
1185
1186 fstrcpy( dns_server, nameservers[0].hostname );
1187
1188 dns_err = DoDNSUpdate(dns_server, dnsdomain, machine_name, addrs, num_addrs);
1189 if (!ERR_DNS_IS_OK(dns_err)) {
1190 status = NT_STATUS_UNSUCCESSFUL;
1191 }
1192
1193 done:
1194
1195 SAFE_FREE( root_domain );
1196
1197 return status;
1198 }
1199
1200 static NTSTATUS net_update_dns_ext(TALLOC_CTX *mem_ctx, ADS_STRUCT *ads,
1201 const char *hostname,
1202 struct sockaddr_storage *iplist,
1203 int num_addrs)
1204 {
1205 struct sockaddr_storage *iplist_alloc = NULL;
1206 fstring machine_name;
1207 NTSTATUS status;
1208
1209 if (hostname) {
1210 fstrcpy(machine_name, hostname);
1211 } else {
1212 name_to_fqdn( machine_name, global_myname() );
1213 }
1214 strlower_m( machine_name );
1215
1216 if (num_addrs == 0 || iplist == NULL) {
1217 /*
1218 * Get our ip address
1219 * (not the 127.0.0.x address but a real ip address)
1220 */
1221 num_addrs = get_my_ip_address(&iplist_alloc);
1222 if ( num_addrs <= 0 ) {
1223 DEBUG(4, ("net_update_dns_ext: Failed to find my "
1224 "non-loopback IP addresses!\n"));
1225 return NT_STATUS_INVALID_PARAMETER;
1226 }
1227 iplist = iplist_alloc;
1228 }
1229
1230 status = net_update_dns_internal(mem_ctx, ads, machine_name,
1231 iplist, num_addrs);
1232
1233 SAFE_FREE(iplist_alloc);
1234 return status;
1235 }
1236
1237 static NTSTATUS net_update_dns(TALLOC_CTX *mem_ctx, ADS_STRUCT *ads, const char *hostname)
1238 {
1239 NTSTATUS status;
1240
1241 status = net_update_dns_ext(mem_ctx, ads, hostname, NULL, 0);
1242 return status;
1243 }
1244 #endif
1245
1246
1247 /*******************************************************************
1248 ********************************************************************/
1249
1250 static int net_ads_join_usage(struct net_context *c, int argc, const char **argv)
1251 {
1252 d_printf(_("net ads join [options]\n"
1253 "Valid options:\n"));
1254 d_printf(_(" createupn[=UPN] Set the userPrincipalName attribute during the join.\n"
1255 " The deault UPN is in the form host/netbiosname@REALM.\n"));
1256 d_printf(_(" createcomputer=OU Precreate the computer account in a specific OU.\n"
1257 " The OU string read from top to bottom without RDNs and delimited by a '/'.\n"
1258 " E.g. \"createcomputer=Computers/Servers/Unix\"\n"
1259 " NB: A backslash '\\' is used as escape at multiple levels and may\n"
1260 " need to be doubled or even quadrupled. It is not used as a separator.\n"));
1261 d_printf(_(" osName=string Set the operatingSystem attribute during the join.\n"));
1262 d_printf(_(" osVer=string Set the operatingSystemVersion attribute during the join.\n"
1263 " NB: osName and osVer must be specified together for either to take effect.\n"
1264 " Also, the operatingSystemService attribute is also set when along with\n"
1265 " the two other attributes.\n"));
1266
1267 return -1;
1268 }
1269
1270 /*******************************************************************
1271 ********************************************************************/
1272
1273 int net_ads_join(struct net_context *c, int argc, const char **argv)
1274 {
1275 TALLOC_CTX *ctx = NULL;
1276 struct libnet_JoinCtx *r = NULL;
1277 const char *domain = lp_realm();
1278 WERROR werr = WERR_SETUP_NOT_JOINED;
1279 bool createupn = false;
1280 const char *machineupn = NULL;
1281 const char *create_in_ou = NULL;
1282 int i;
1283 const char *os_name = NULL;
1284 const char *os_version = NULL;
1285 bool modify_config = lp_config_backend_is_registry();
1286
1287 if (c->display_usage)
1288 return net_ads_join_usage(c, argc, argv);
1289
1290 if (!modify_config) {
1291
1292 werr = check_ads_config();
1293 if (!W_ERROR_IS_OK(werr)) {
1294 d_fprintf(stderr, _("Invalid configuration. Exiting....\n"));
1295 goto fail;
1296 }
1297 }
1298
1299 if (!(ctx = talloc_init("net_ads_join"))) {
1300 d_fprintf(stderr, _("Could not initialise talloc context.\n"));
1301 werr = WERR_NOMEM;
1302 goto fail;
1303 }
1304
1305 if (!c->opt_kerberos) {
1306 use_in_memory_ccache();
1307 }
1308
1309 werr = libnet_init_JoinCtx(ctx, &r);
1310 if (!W_ERROR_IS_OK(werr)) {
1311 goto fail;
1312 }
1313
1314 /* process additional command line args */
1315
1316 for ( i=0; i<argc; i++ ) {
1317 if ( !StrnCaseCmp(argv[i], "createupn", strlen("createupn")) ) {
1318 createupn = true;
1319 machineupn = get_string_param(argv[i]);
1320 }
1321 else if ( !StrnCaseCmp(argv[i], "createcomputer", strlen("createcomputer")) ) {
1322 if ( (create_in_ou = get_string_param(argv[i])) == NULL ) {
1323 d_fprintf(stderr, _("Please supply a valid OU path.\n"));
1324 werr = WERR_INVALID_PARAM;
1325 goto fail;
1326 }
1327 }
1328 else if ( !StrnCaseCmp(argv[i], "osName", strlen("osName")) ) {
1329 if ( (os_name = get_string_param(argv[i])) == NULL ) {
1330 d_fprintf(stderr, _("Please supply a operating system name.\n"));
1331 werr = WERR_INVALID_PARAM;
1332 goto fail;
1333 }
1334 }
1335 else if ( !StrnCaseCmp(argv[i], "osVer", strlen("osVer")) ) {
1336 if ( (os_version = get_string_param(argv[i])) == NULL ) {
1337 d_fprintf(stderr, _("Please supply a valid operating system version.\n"));
1338 werr = WERR_INVALID_PARAM;
1339 goto fail;
1340 }
1341 }
1342 else {
1343 domain = argv[i];
1344 }
1345 }
1346
1347 if (!*domain) {
1348 d_fprintf(stderr, _("Please supply a valid domain name\n"));
1349 werr = WERR_INVALID_PARAM;
1350 goto fail;
1351 }
1352
1353 /* Do the domain join here */
1354
1355 r->in.domain_name = domain;
1356 r->in.create_upn = createupn;
1357 r->in.upn = machineupn;
1358 r->in.account_ou = create_in_ou;
1359 r->in.os_name = os_name;
1360 r->in.os_version = os_version;
1361 r->in.dc_name = c->opt_host;
1362 r->in.admin_account = c->opt_user_name;
1363 r->in.admin_password = net_prompt_pass(c, c->opt_user_name);
1364 r->in.debug = true;
1365 r->in.use_kerberos = c->opt_kerberos;
1366 r->in.modify_config = modify_config;
1367 r->in.join_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
1368 WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE |
1369 WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED;
1370
1371 werr = libnet_Join(ctx, r);
1372 if (!W_ERROR_IS_OK(werr)) {
1373 goto fail;
1374 }
1375
1376 /* Check the short name of the domain */
1377
1378 if (!modify_config && !strequal(lp_workgroup(), r->out.netbios_domain_name)) {
1379 d_printf(_("The workgroup in %s does not match the short\n"
1380 "domain name obtained from the server.\n"
1381 "Using the name [%s] from the server.\n"
1382 "You should set \"workgroup = %s\" in %s.\n"),
1383 get_dyn_CONFIGFILE(), r->out.netbios_domain_name,
1384 r->out.netbios_domain_name, get_dyn_CONFIGFILE());
1385 }
1386
1387 d_printf(_("Using short domain name -- %s\n"), r->out.netbios_domain_name);
1388
1389 if (r->out.dns_domain_name) {
1390 d_printf(_("Joined '%s' to realm '%s'\n"), r->in.machine_name,
1391 r->out.dns_domain_name);
1392 } else {
1393 d_printf(_("Joined '%s' to domain '%s'\n"), r->in.machine_name,
1394 r->out.netbios_domain_name);
1395 }
1396
1397 #if defined(WITH_DNS_UPDATES)
1398 /*
1399 * In a clustered environment, don't do dynamic dns updates:
1400 * Registering the set of ip addresses that are assigned to
1401 * the interfaces of the node that performs the join does usually
1402 * not have the desired effect, since the local interfaces do not
1403 * carry the complete set of the cluster's public IP addresses.
1404 * And it can also contain internal addresses that should not
1405 * be visible to the outside at all.
1406 * In order to do dns updates in a clustererd setup, use
1407 * net ads dns register.
1408 */
1409 if (lp_clustering()) {
1410 d_fprintf(stderr, _("Not doing automatic DNS update in a"
1411 "clustered setup.\n"));
1412 goto done;
1413 }
1414
1415 if (r->out.domain_is_ad) {
1416 /* We enter this block with user creds */
1417 ADS_STRUCT *ads_dns = NULL;
1418
1419 if ( (ads_dns = ads_init( lp_realm(), NULL, NULL )) != NULL ) {
1420 /* kinit with the machine password */
1421
1422 use_in_memory_ccache();
1423 if (asprintf( &ads_dns->auth.user_name, "%s$", global_myname()) == -1) {
1424 goto fail;
1425 }
1426 ads_dns->auth.password = secrets_fetch_machine_password(
1427 r->out.netbios_domain_name, NULL, NULL );
1428 ads_dns->auth.realm = SMB_STRDUP( r->out.dns_domain_name );
1429 strupper_m(ads_dns->auth.realm );
1430 ads_kinit_password( ads_dns );
1431 }
1432
1433 if ( !ads_dns || !NT_STATUS_IS_OK(net_update_dns( ctx, ads_dns, NULL)) ) {
1434 d_fprintf( stderr, _("DNS update failed!\n") );
1435 }
1436
1437 /* exit from this block using machine creds */
1438 ads_destroy(&ads_dns);
1439 }
1440 #endif
1441
1442 done:
1443 TALLOC_FREE(r);
1444 TALLOC_FREE( ctx );
1445
1446 return 0;
1447
1448 fail:
1449 /* issue an overall failure message at the end. */
1450 d_printf(_("Failed to join domain: %s\n"),
1451 r && r->out.error_string ? r->out.error_string :
1452 get_friendly_werror_msg(werr));
1453 TALLOC_FREE( ctx );
1454
1455 return -1;
1456 }
1457
1458 /*******************************************************************
1459 ********************************************************************/
1460
1461 static int net_ads_dns_register(struct net_context *c, int argc, const char **argv)
1462 {
1463 #if defined(WITH_DNS_UPDATES)
1464 ADS_STRUCT *ads;
1465 ADS_STATUS status;
1466 NTSTATUS ntstatus;
1467 TALLOC_CTX *ctx;
1468 const char *hostname = NULL;
1469 const char **addrs_list = NULL;
1470 struct sockaddr_storage *addrs = NULL;
1471 int num_addrs = 0;
1472 int count;
1473
1474 #ifdef DEVELOPER
1475 talloc_enable_leak_report();
1476 #endif
1477
1478 if (argc <= 1 && lp_clustering() && lp_cluster_addresses() == NULL) {
1479 d_fprintf(stderr, _("Refusing DNS updates with automatic "
1480 "detection of addresses in a clustered "
1481 "setup.\n"));
1482 c->display_usage = true;
1483 }
1484
1485 if (c->display_usage) {
1486 d_printf( "%s\n"
1487 "net ads dns register [hostname [IP [IP...]]]\n"
1488 " %s\n",
1489 _("Usage:"),
1490 _("Register hostname with DNS\n"));
1491 return -1;
1492 }
1493
1494 if (!(ctx = talloc_init("net_ads_dns"))) {
1495 d_fprintf(stderr, _("Could not initialise talloc context\n"));
1496 return -1;
1497 }
1498
1499 if (argc >= 1) {
1500 hostname = argv[0];
1501 }
1502
1503 if (argc > 1) {
1504 num_addrs = argc - 1;
1505 addrs_list = &argv[1];
1506 } else if (lp_clustering()) {
1507 addrs_list = lp_cluster_addresses();
1508 num_addrs = str_list_length(addrs_list);
1509 }
1510
1511 if (num_addrs > 0) {
1512 addrs = talloc_zero_array(ctx, struct sockaddr_storage, num_addrs);
1513 if (addrs == NULL) {
1514 d_fprintf(stderr, _("Error allocating memory!\n"));
1515 talloc_free(ctx);
1516 return -1;
1517 }
1518 }
1519
1520 for (count = 0; count < num_addrs; count++) {
1521 if (!interpret_string_addr(&addrs[count], addrs_list[count], 0)) {
1522 d_fprintf(stderr, "%s '%s'.\n",
1523 _("Cannot interpret address"),
1524 addrs_list[count]);
1525 talloc_free(ctx);
1526 return -1;
1527 }
1528 }
1529
1530 status = ads_startup(c, true, &ads);
1531 if ( !ADS_ERR_OK(status) ) {
1532 DEBUG(1, ("error on ads_startup: %s\n", ads_errstr(status)));
1533 TALLOC_FREE(ctx);
1534 return -1;
1535 }
1536
1537 ntstatus = net_update_dns_ext(ctx, ads, hostname, addrs, num_addrs);
1538 if (!NT_STATUS_IS_OK(ntstatus)) {
1539 d_fprintf( stderr, _("DNS update failed!\n") );
1540 ads_destroy( &ads );
1541 TALLOC_FREE( ctx );
1542 return -1;
1543 }
1544
1545 d_fprintf( stderr, _("Successfully registered hostname with DNS\n") );
1546
1547 ads_destroy(&ads);
1548 TALLOC_FREE( ctx );
1549
1550 return 0;
1551 #else
1552 d_fprintf(stderr,
1553 _("DNS update support not enabled at compile time!\n"));
1554 return -1;
1555 #endif
1556 }
1557
1558 #if defined(WITH_DNS_UPDATES)
1559 DNS_ERROR do_gethostbyname(const char *server, const char *host);
1560 #endif
1561
1562 static int net_ads_dns_gethostbyname(struct net_context *c, int argc, const char **argv)
1563 {
1564 #if defined(WITH_DNS_UPDATES)
1565 DNS_ERROR err;
1566
1567 #ifdef DEVELOPER
1568 talloc_enable_leak_report();
1569 #endif
1570
1571 if (argc != 2 || c->display_usage) {
1572 d_printf( "%s\n"
1573 " %s\n"
1574 " %s\n",
1575 _("Usage:"),
1576 _("net ads dns gethostbyname <server> <name>\n"),
1577 _(" Look up hostname from the AD\n"
1578 " server\tName server to use\n"
1579 " name\tName to look up\n"));
1580 return -1;
1581 }
1582
1583 err = do_gethostbyname(argv[0], argv[1]);
1584
1585 d_printf(_("do_gethostbyname returned %d\n"), ERROR_DNS_V(err));
1586 #endif
1587 return 0;
1588 }
1589
1590 static int net_ads_dns(struct net_context *c, int argc, const char *argv[])
1591 {
1592 struct functable func[] = {
1593 {
1594 "register",
1595 net_ads_dns_register,
1596 NET_TRANSPORT_ADS,
1597 N_("Add host dns entry to AD"),
1598 N_("net ads dns register\n"
1599 " Add host dns entry to AD")
1600 },
1601 {
1602 "gethostbyname",
1603 net_ads_dns_gethostbyname,
1604 NET_TRANSPORT_ADS,
1605 N_("Look up host"),
1606 N_("net ads dns gethostbyname\n"
1607 " Look up host")
1608 },
1609 {NULL, NULL, 0, NULL, NULL}
1610 };
1611
1612 return net_run_function(c, argc, argv, "net ads dns", func);
1613 }
1614
1615 /*******************************************************************
1616 ********************************************************************/
1617
1618 int net_ads_printer_usage(struct net_context *c, int argc, const char **argv)
1619 {
1620 d_printf(_(
1621 "\nnet ads printer search <printer>"
1622 "\n\tsearch for a printer in the directory\n"
1623 "\nnet ads printer info <printer> <server>"
1624 "\n\tlookup info in directory for printer on server"
1625 "\n\t(note: printer defaults to \"*\", server defaults to local)\n"
1626 "\nnet ads printer publish <printername>"
1627 "\n\tpublish printer in directory"
1628 "\n\t(note: printer name is required)\n"
1629 "\nnet ads printer remove <printername>"
1630 "\n\tremove printer from directory"
1631 "\n\t(note: printer name is required)\n"));
1632 return -1;
1633 }
1634
1635 /*******************************************************************
1636 ********************************************************************/
1637
1638 static int net_ads_printer_search(struct net_context *c, int argc, const char **argv)
1639 {
1640 ADS_STRUCT *ads;
1641 ADS_STATUS rc;
1642 LDAPMessage *res = NULL;
1643
1644 if (c->display_usage) {
1645 d_printf( "%s\n"
1646 "net ads printer search\n"
1647 " %s\n",
1648 _("Usage:"),
1649 _("List printers in the AD"));
1650 return 0;
1651 }
1652
1653 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
1654 return -1;
1655 }
1656
1657 rc = ads_find_printers(ads, &res);
1658
1659 if (!ADS_ERR_OK(rc)) {
1660 d_fprintf(stderr, _("ads_find_printer: %s\n"), ads_errstr(rc));
1661 ads_msgfree(ads, res);
1662 ads_destroy(&ads);
1663 return -1;
1664 }
1665
1666 if (ads_count_replies(ads, res) == 0) {
1667 d_fprintf(stderr, _("No results found\n"));
1668 ads_msgfree(ads, res);
1669 ads_destroy(&ads);
1670 return -1;
1671 }
1672
1673 ads_dump(ads, res);
1674 ads_msgfree(ads, res);
1675 ads_destroy(&ads);
1676 return 0;
1677 }
1678
1679 static int net_ads_printer_info(struct net_context *c, int argc, const char **argv)
1680 {
1681 ADS_STRUCT *ads;
1682 ADS_STATUS rc;
1683 const char *servername, *printername;
1684 LDAPMessage *res = NULL;
1685
1686 if (c->display_usage) {
1687 d_printf("%s\n%s",
1688 _("Usage:"),
1689 _("net ads printer info [printername [servername]]\n"
1690 " Display printer info from AD\n"
1691 " printername\tPrinter name or wildcard\n"
1692 " servername\tName of the print server\n"));
1693 return 0;
1694 }
1695
1696 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
1697 return -1;
1698 }
1699
1700 if (argc > 0) {
1701 printername = argv[0];
1702 } else {
1703 printername = "*";
1704 }
1705
1706 if (argc > 1) {
1707 servername = argv[1];
1708 } else {
1709 servername = global_myname();
1710 }
1711
1712 rc = ads_find_printer_on_server(ads, &res, printername, servername);
1713
1714 if (!ADS_ERR_OK(rc)) {
1715 d_fprintf(stderr, _("Server '%s' not found: %s\n"),
1716 servername, ads_errstr(rc));
1717 ads_msgfree(ads, res);
1718 ads_destroy(&ads);
1719 return -1;
1720 }
1721
1722 if (ads_count_replies(ads, res) == 0) {
1723 d_fprintf(stderr, _("Printer '%s' not found\n"), printername);
1724 ads_msgfree(ads, res);
1725 ads_destroy(&ads);
1726 return -1;
1727 }
1728
1729 ads_dump(ads, res);
1730 ads_msgfree(ads, res);
1731 ads_destroy(&ads);
1732
1733 return 0;
1734 }
1735
1736 static int net_ads_printer_publish(struct net_context *c, int argc, const char **argv)
1737 {
1738 ADS_STRUCT *ads;
1739 ADS_STATUS rc;
1740 const char *servername, *printername;
1741 struct cli_state *cli = NULL;
1742 struct rpc_pipe_client *pipe_hnd = NULL;
1743 struct sockaddr_storage server_ss;
1744 NTSTATUS nt_status;
1745 TALLOC_CTX *mem_ctx = talloc_init("net_ads_printer_publish");
1746 ADS_MODLIST mods = ads_init_mods(mem_ctx);
1747 char *prt_dn, *srv_dn, **srv_cn;
1748 char *srv_cn_escaped = NULL, *printername_escaped = NULL;
1749 LDAPMessage *res = NULL;
1750
1751 if (argc < 1 || c->display_usage) {
1752 d_printf("%s\n%s",
1753 _("Usage:"),
1754 _("net ads printer publish <printername> [servername]\n"
1755 " Publish printer in AD\n"
1756 " printername\tName of the printer\n"
1757 " servername\tName of the print server\n"));
1758 talloc_destroy(mem_ctx);
1759 return -1;
1760 }
1761
1762 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
1763 talloc_destroy(mem_ctx);
1764 return -1;
1765 }
1766
1767 printername = argv[0];
1768
1769 if (argc == 2) {
1770 servername = argv[1];
1771 } else {
1772 servername = global_myname();
1773 }
1774
1775 /* Get printer data from SPOOLSS */
1776
1777 resolve_name(servername, &server_ss, 0x20, false);
1778
1779 nt_status = cli_full_connection(&cli, global_myname(), servername,
1780 &server_ss, 0,
1781 "IPC$", "IPC",
1782 c->opt_user_name, c->opt_workgroup,
1783 c->opt_password ? c->opt_password : "",
1784 CLI_FULL_CONNECTION_USE_KERBEROS,
1785 Undefined, NULL);
1786
1787 if (NT_STATUS_IS_ERR(nt_status)) {
1788 d_fprintf(stderr, _("Unable to open a connnection to %s to "
1789 "obtain data for %s\n"),
1790 servername, printername);
1791 ads_destroy(&ads);
1792 talloc_destroy(mem_ctx);
1793 return -1;
1794 }
1795
1796 /* Publish on AD server */
1797
1798 ads_find_machine_acct(ads, &res, servername);
1799
1800 if (ads_count_replies(ads, res) == 0) {
1801 d_fprintf(stderr, _("Could not find machine account for server "
1802 "%s\n"),
1803 servername);
1804 ads_destroy(&ads);
1805 talloc_destroy(mem_ctx);
1806 return -1;
1807 }
1808
1809 srv_dn = ldap_get_dn((LDAP *)ads->ldap.ld, (LDAPMessage *)res);
1810 srv_cn = ldap_explode_dn(srv_dn, 1);
1811
1812 srv_cn_escaped = escape_rdn_val_string_alloc(srv_cn[0]);
1813 printername_escaped = escape_rdn_val_string_alloc(printername);
1814 if (!srv_cn_escaped || !printername_escaped) {
1815 SAFE_FREE(srv_cn_escaped);
1816 SAFE_FREE(printername_escaped);
1817 d_fprintf(stderr, _("Internal error, out of memory!"));
1818 ads_destroy(&ads);
1819 talloc_destroy(mem_ctx);
1820 return -1;
1821 }
1822
1823 if (asprintf(&prt_dn, "cn=%s-%s,%s", srv_cn_escaped, printername_escaped, srv_dn) == -1) {
1824 SAFE_FREE(srv_cn_escaped);
1825 SAFE_FREE(printername_escaped);
1826 d_fprintf(stderr, _("Internal error, out of memory!"));
1827 ads_destroy(&ads);
1828 talloc_destroy(mem_ctx);
1829 return -1;
1830 }
1831
1832 SAFE_FREE(srv_cn_escaped);
1833 SAFE_FREE(printername_escaped);
1834
1835 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_spoolss.syntax_id, &pipe_hnd);
1836 if (!NT_STATUS_IS_OK(nt_status)) {
1837 d_fprintf(stderr, _("Unable to open a connnection to the spoolss pipe on %s\n"),
1838 servername);
1839 SAFE_FREE(prt_dn);
1840 ads_destroy(&ads);
1841 talloc_destroy(mem_ctx);
1842 return -1;
1843 }
1844
1845 if (!W_ERROR_IS_OK(get_remote_printer_publishing_data(pipe_hnd, mem_ctx, &mods,
1846 printername))) {
1847 SAFE_FREE(prt_dn);
1848 ads_destroy(&ads);
1849 talloc_destroy(mem_ctx);
1850 return -1;
1851 }
1852
1853 rc = ads_add_printer_entry(ads, prt_dn, mem_ctx, &mods);
1854 if (!ADS_ERR_OK(rc)) {
1855 d_fprintf(stderr, "ads_publish_printer: %s\n", ads_errstr(rc));
1856 SAFE_FREE(prt_dn);
1857 ads_destroy(&ads);
1858 talloc_destroy(mem_ctx);
1859 return -1;
1860 }
1861
1862 d_printf("published printer\n");
1863 SAFE_FREE(prt_dn);
1864 ads_destroy(&ads);
1865 talloc_destroy(mem_ctx);
1866
1867 return 0;
1868 }
1869
1870 static int net_ads_printer_remove(struct net_context *c, int argc, const char **argv)
1871 {
1872 ADS_STRUCT *ads;
1873 ADS_STATUS rc;
1874 const char *servername;
1875 char *prt_dn;
1876 LDAPMessage *res = NULL;
1877
1878 if (argc < 1 || c->display_usage) {
1879 d_printf("%s\n%s",
1880 _("Usage:"),
1881 _("net ads printer remove <printername> [servername]\n"
1882 " Remove a printer from the AD\n"
1883 " printername\tName of the printer\n"
1884 " servername\tName of the print server\n"));
1885 return -1;
1886 }
1887
1888 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
1889 return -1;
1890 }
1891
1892 if (argc > 1) {
1893 servername = argv[1];
1894 } else {
1895 servername = global_myname();
1896 }
1897
1898 rc = ads_find_printer_on_server(ads, &res, argv[0], servername);
1899
1900 if (!ADS_ERR_OK(rc)) {
1901 d_fprintf(stderr, _("ads_find_printer_on_server: %s\n"), ads_errstr(rc));
1902 ads_msgfree(ads, res);
1903 ads_destroy(&ads);
1904 return -1;
1905 }
1906
1907 if (ads_count_replies(ads, res) == 0) {
1908 d_fprintf(stderr, _("Printer '%s' not found\n"), argv[1]);
1909 ads_msgfree(ads, res);
1910 ads_destroy(&ads);
1911 return -1;
1912 }
1913
1914 prt_dn = ads_get_dn(ads, talloc_tos(), res);
1915 ads_msgfree(ads, res);
1916 rc = ads_del_dn(ads, prt_dn);
1917 TALLOC_FREE(prt_dn);
1918
1919 if (!ADS_ERR_OK(rc)) {
1920 d_fprintf(stderr, _("ads_del_dn: %s\n"), ads_errstr(rc));
1921 ads_destroy(&ads);
1922 return -1;
1923 }
1924
1925 ads_destroy(&ads);
1926 return 0;
1927 }
1928
1929 static int net_ads_printer(struct net_context *c, int argc, const char **argv)
1930 {
1931 struct functable func[] = {
1932 {
1933 "search",
1934 net_ads_printer_search,
1935 NET_TRANSPORT_ADS,
1936 N_("Search for a printer"),
1937 N_("net ads printer search\n"
1938 " Search for a printer")
1939 },
1940 {
1941 "info",
1942 net_ads_printer_info,
1943 NET_TRANSPORT_ADS,
1944 N_("Display printer information"),
1945 N_("net ads printer info\n"
1946 " Display printer information")
1947 },
1948 {
1949 "publish",
1950 net_ads_printer_publish,
1951 NET_TRANSPORT_ADS,
1952 N_("Publish a printer"),
1953 N_("net ads printer publish\n"
1954 " Publish a printer")
1955 },
1956 {
1957 "remove",
1958 net_ads_printer_remove,
1959 NET_TRANSPORT_ADS,
1960 N_("Delete a printer"),
1961 N_("net ads printer remove\n"
1962 " Delete a printer")
1963 },
1964 {NULL, NULL, 0, NULL, NULL}
1965 };
1966
1967 return net_run_function(c, argc, argv, "net ads printer", func);
1968 }
1969
1970
1971 static int net_ads_password(struct net_context *c, int argc, const char **argv)
1972 {
1973 ADS_STRUCT *ads;
1974 const char *auth_principal = c->opt_user_name;
1975 const char *auth_password = c->opt_password;
1976 char *realm = NULL;
1977 char *new_password = NULL;
1978 char *chr, *prompt;
1979 const char *user;
1980 ADS_STATUS ret;
1981
1982 if (c->display_usage) {
1983 d_printf("%s\n%s",
1984 _("Usage:"),
1985 _("net ads password <username>\n"
1986 " Change password for user\n"
1987 " username\tName of user to change password for\n"));
1988 return 0;
1989 }
1990
1991 if (c->opt_user_name == NULL || c->opt_password == NULL) {
1992 d_fprintf(stderr, _("You must supply an administrator "
1993 "username/password\n"));
1994 return -1;
1995 }
1996
1997 if (argc < 1) {
1998 d_fprintf(stderr, _("ERROR: You must say which username to "
1999 "change password for\n"));
2000 return -1;
2001 }
2002
2003 user = argv[0];
2004 if (!strchr_m(user, '@')) {
2005 if (asprintf(&chr, "%s@%s", argv[0], lp_realm()) == -1) {
2006 return -1;
2007 }
2008 user = chr;
2009 }
2010
2011 use_in_memory_ccache();
2012 chr = strchr_m(auth_principal, '@');
2013 if (chr) {
2014 realm = ++chr;
2015 } else {
2016 realm = lp_realm();
2017 }
2018
2019 /* use the realm so we can eventually change passwords for users
2020 in realms other than default */
2021 if (!(ads = ads_init(realm, c->opt_workgroup, c->opt_host))) {
2022 return -1;
2023 }
2024
2025 /* we don't actually need a full connect, but it's the easy way to
2026 fill in the KDC's addresss */
2027 ads_connect(ads);
2028
2029 if (!ads->config.realm) {
2030 d_fprintf(stderr, _("Didn't find the kerberos server!\n"));
2031 ads_destroy(&ads);
2032 return -1;
2033 }
2034
2035 if (argv[1]) {
2036 new_password = (char *)argv[1];
2037 } else {
2038 if (asprintf(&prompt, _("Enter new password for %s:"), user) == -1) {
2039 return -1;
2040 }
2041 new_password = getpass(prompt);
2042 free(prompt);
2043 }
2044
2045 ret = kerberos_set_password(ads->auth.kdc_server, auth_principal,
2046 auth_password, user, new_password, ads->auth.time_offset);
2047 if (!ADS_ERR_OK(ret)) {
2048 d_fprintf(stderr, _("Password change failed: %s\n"), ads_errstr(ret));
2049 ads_destroy(&ads);
2050 return -1;
2051 }
2052
2053 d_printf(_("Password change for %s completed.\n"), user);
2054 ads_destroy(&ads);
2055
2056 return 0;
2057 }
2058
2059 int net_ads_changetrustpw(struct net_context *c, int argc, const char **argv)
2060 {
2061 ADS_STRUCT *ads;
2062 char *host_principal;
2063 fstring my_name;
2064 ADS_STATUS ret;
2065
2066 if (c->display_usage) {
2067 d_printf( "%s\n"
2068 "net ads changetrustpw\n"
2069 " %s\n",
2070 _("Usage:"),
2071 _("Change the machine account's trust password"));
2072 return 0;
2073 }
2074
2075 if (!secrets_init()) {
2076 DEBUG(1,("Failed to initialise secrets database\n"));
2077 return -1;
2078 }
2079
2080 net_use_krb_machine_account(c);
2081
2082 use_in_memory_ccache();
2083
2084 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2085 return -1;
2086 }
2087
2088 fstrcpy(my_name, global_myname());
2089 strlower_m(my_name);
2090 if (asprintf(&host_principal, "%s$@%s", my_name, ads->config.realm) == -1) {
2091 ads_destroy(&ads);
2092 return -1;
2093 }
2094 d_printf(_("Changing password for principal: %s\n"), host_principal);
2095
2096 ret = ads_change_trust_account_password(ads, host_principal);
2097
2098 if (!ADS_ERR_OK(ret)) {
2099 d_fprintf(stderr, _("Password change failed: %s\n"), ads_errstr(ret));
2100 ads_destroy(&ads);
2101 SAFE_FREE(host_principal);
2102 return -1;
2103 }
2104
2105 d_printf(_("Password change for principal %s succeeded.\n"), host_principal);
2106
2107 if (USE_SYSTEM_KEYTAB) {
2108 d_printf(_("Attempting to update system keytab with new password.\n"));
2109 if (ads_keytab_create_default(ads)) {
2110 d_printf(_("Failed to update system keytab.\n"));
2111 }
2112 }
2113
2114 ads_destroy(&ads);
2115 SAFE_FREE(host_principal);
2116
2117 return 0;
2118 }
2119
2120 /*
2121 help for net ads search
2122 */
2123 static int net_ads_search_usage(struct net_context *c, int argc, const char **argv)
2124 {
2125 d_printf(_(
2126 "\nnet ads search <expression> <attributes...>\n"
2127 "\nPerform a raw LDAP search on a ADS server and dump the results.\n"
2128 "The expression is a standard LDAP search expression, and the\n"
2129 "attributes are a list of LDAP fields to show in the results.\n\n"
2130 "Example: net ads search '(objectCategory=group)' sAMAccountName\n\n"
2131 ));
2132 net_common_flags_usage(c, argc, argv);
2133 return -1;
2134 }
2135
2136
2137 /*
2138 general ADS search function. Useful in diagnosing problems in ADS
2139 */
2140 static int net_ads_search(struct net_context *c, int argc, const char **argv)
2141 {
2142 ADS_STRUCT *ads;
2143 ADS_STATUS rc;
2144 const char *ldap_exp;
2145 const char **attrs;
2146 LDAPMessage *res = NULL;
2147
2148 if (argc < 1 || c->display_usage) {
2149 return net_ads_search_usage(c, argc, argv);
2150 }
2151
2152 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2153 return -1;
2154 }
2155
2156 ldap_exp = argv[0];
2157 attrs = (argv + 1);
2158
2159 rc = ads_do_search_retry(ads, ads->config.bind_path,
2160 LDAP_SCOPE_SUBTREE,
2161 ldap_exp, attrs, &res);
2162 if (!ADS_ERR_OK(rc)) {
2163 d_fprintf(stderr, _("search failed: %s\n"), ads_errstr(rc));
2164 ads_destroy(&ads);
2165 return -1;
2166 }
2167
2168 d_printf(_("Got %d replies\n\n"), ads_count_replies(ads, res));
2169
2170 /* dump the results */
2171 ads_dump(ads, res);
2172
2173 ads_msgfree(ads, res);
2174 ads_destroy(&ads);
2175
2176 return 0;
2177 }
2178
2179
2180 /*
2181 help for net ads search
2182 */
2183 static int net_ads_dn_usage(struct net_context *c, int argc, const char **argv)
2184 {
2185 d_printf(_(
2186 "\nnet ads dn <dn> <attributes...>\n"
2187 "\nperform a raw LDAP search on a ADS server and dump the results\n"
2188 "The DN standard LDAP DN, and the attributes are a list of LDAP fields \n"
2189 "to show in the results\n\n"
2190 "Example: net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' sAMAccountName\n\n"
2191 "Note: the DN must be provided properly escaped. See RFC 4514 for details\n\n"
2192 ));
2193 net_common_flags_usage(c, argc, argv);
2194 return -1;
2195 }
2196
2197
2198 /*
2199 general ADS search function. Useful in diagnosing problems in ADS
2200 */
2201 static int net_ads_dn(struct net_context *c, int argc, const char **argv)
2202 {
2203 ADS_STRUCT *ads;
2204 ADS_STATUS rc;
2205 const char *dn;
2206 const char **attrs;
2207 LDAPMessage *res = NULL;
2208
2209 if (argc < 1 || c->display_usage) {
2210 return net_ads_dn_usage(c, argc, argv);
2211 }
2212
2213 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2214 return -1;
2215 }
2216
2217 dn = argv[0];
2218 attrs = (argv + 1);
2219
2220 rc = ads_do_search_all(ads, dn,
2221 LDAP_SCOPE_BASE,
2222 "(objectclass=*)", attrs, &res);
2223 if (!ADS_ERR_OK(rc)) {
2224 d_fprintf(stderr, _("search failed: %s\n"), ads_errstr(rc));
2225 ads_destroy(&ads);
2226 return -1;
2227 }
2228
2229 d_printf("Got %d replies\n\n", ads_count_replies(ads, res));
2230
2231 /* dump the results */
2232 ads_dump(ads, res);
2233
2234 ads_msgfree(ads, res);
2235 ads_destroy(&ads);
2236
2237 return 0;
2238 }
2239
2240 /*
2241 help for net ads sid search
2242 */
2243 static int net_ads_sid_usage(struct net_context *c, int argc, const char **argv)
2244 {
2245 d_printf(_(
2246 "\nnet ads sid <sid> <attributes...>\n"
2247 "\nperform a raw LDAP search on a ADS server and dump the results\n"
2248 "The SID is in string format, and the attributes are a list of LDAP fields \n"
2249 "to show in the results\n\n"
2250 "Example: net ads sid 'S-1-5-32' distinguishedName\n\n"
2251 ));
2252 net_common_flags_usage(c, argc, argv);
2253 return -1;
2254 }
2255
2256
2257 /*
2258 general ADS search function. Useful in diagnosing problems in ADS
2259 */
2260 static int net_ads_sid(struct net_context *c, int argc, const char **argv)
2261 {
2262 ADS_STRUCT *ads;
2263 ADS_STATUS rc;
2264 const char *sid_string;
2265 const char **attrs;
2266 LDAPMessage *res = NULL;
2267 DOM_SID sid;
2268
2269 if (argc < 1 || c->display_usage) {
2270 return net_ads_sid_usage(c, argc, argv);
2271 }
2272
2273 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2274 return -1;
2275 }
2276
2277 sid_string = argv[0];
2278 attrs = (argv + 1);
2279
2280 if (!string_to_sid(&sid, sid_string)) {
2281 d_fprintf(stderr, _("could not convert sid\n"));
2282 ads_destroy(&ads);
2283 return -1;
2284 }
2285
2286 rc = ads_search_retry_sid(ads, &res, &sid, attrs);
2287 if (!ADS_ERR_OK(rc)) {
2288 d_fprintf(stderr, _("search failed: %s\n"), ads_errstr(rc));
2289 ads_destroy(&ads);
2290 return -1;
2291 }
2292
2293 d_printf(_("Got %d replies\n\n"), ads_count_replies(ads, res));
2294
2295 /* dump the results */
2296 ads_dump(ads, res);
2297
2298 ads_msgfree(ads, res);
2299 ads_destroy(&ads);
2300
2301 return 0;
2302 }
2303
2304 static int net_ads_keytab_flush(struct net_context *c, int argc, const char **argv)
2305 {
2306 int ret;
2307 ADS_STRUCT *ads;
2308
2309 if (c->display_usage) {
2310 d_printf( "%s\n"
2311 "net ads keytab flush\n"
2312 " %s\n",
2313 _("Usage:"),
2314 _("Delete the whole keytab"));
2315 return 0;
2316 }
2317
2318 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2319 return -1;
2320 }
2321 ret = ads_keytab_flush(ads);
2322 ads_destroy(&ads);
2323 return ret;
2324 }
2325
2326 static int net_ads_keytab_add(struct net_context *c, int argc, const char **argv)
2327 {
2328 int i;
2329 int ret = 0;
2330 ADS_STRUCT *ads;
2331
2332 if (c->display_usage) {
2333 d_printf("%s\n%s",
2334 _("Usage:"),
2335 _("net ads keytab add <principal> [principal ...]\n"
2336 " Add principals to local keytab\n"
2337 " principal\tKerberos principal to add to "
2338 "keytab\n"));
2339 return 0;
2340 }
2341
2342 d_printf(_("Processing principals to add...\n"));
2343 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2344 return -1;
2345 }
2346 for (i = 0; i < argc; i++) {
2347 ret |= ads_keytab_add_entry(ads, argv[i]);
2348 }
2349 ads_destroy(&ads);
2350 return ret;
2351 }
2352
2353 static int net_ads_keytab_create(struct net_context *c, int argc, const char **argv)
2354 {
2355 ADS_STRUCT *ads;
2356 int ret;
2357
2358 if (c->display_usage) {
2359 d_printf( "%s\n"
2360 "net ads keytab create\n"
2361 " %s\n",
2362 _("Usage:"),
2363 _("Create new default keytab"));
2364 return 0;
2365 }
2366
2367 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2368 return -1;
2369 }
2370 ret = ads_keytab_create_default(ads);
2371 ads_destroy(&ads);
2372 return ret;
2373 }
2374
2375 static int net_ads_keytab_list(struct net_context *c, int argc, const char **argv)
2376 {
2377 const char *keytab = NULL;
2378
2379 if (c->display_usage) {
2380 d_printf("%s\n%s",
2381 _("Usage:"),
2382 _("net ads keytab list [keytab]\n"
2383 " List a local keytab\n"
2384 " keytab\tKeytab to list\n"));
2385 return 0;
2386 }
2387
2388 if (argc >= 1) {
2389 keytab = argv[0];
2390 }
2391
2392 return ads_keytab_list(keytab);
2393 }
2394
2395
2396 int net_ads_keytab(struct net_context *c, int argc, const char **argv)
2397 {
2398 struct functable func[] = {
2399 {
2400 "add",
2401 net_ads_keytab_add,
2402 NET_TRANSPORT_ADS,
2403 N_("Add a service principal"),
2404 N_("net ads keytab add\n"
2405 " Add a service principal")
2406 },
2407 {
2408 "create",
2409 net_ads_keytab_create,
2410 NET_TRANSPORT_ADS,
2411 N_("Create a fresh keytab"),
2412 N_("net ads keytab create\n"
2413 " Create a fresh keytab")
2414 },
2415 {
2416 "flush",
2417 net_ads_keytab_flush,
2418 NET_TRANSPORT_ADS,
2419 N_("Remove all keytab entries"),
2420 N_("net ads keytab flush\n"
2421 " Remove all keytab entries")
2422 },
2423 {
2424 "list",
2425 net_ads_keytab_list,
2426 NET_TRANSPORT_ADS,
2427 N_("List a keytab"),
2428 N_("net ads keytab list\n"
2429 " List a keytab")
2430 },
2431 {NULL, NULL, 0, NULL, NULL}
2432 };
2433
2434 if (!USE_KERBEROS_KEYTAB) {
2435 d_printf(_("\nWarning: \"kerberos method\" must be set to a "
2436 "keytab method to use keytab functions.\n"));
2437 }
2438
2439 return net_run_function(c, argc, argv, "net ads keytab", func);
2440 }
2441
2442 static int net_ads_kerberos_renew(struct net_context *c, int argc, const char **argv)
2443 {
2444 int ret = -1;
2445
2446 if (c->display_usage) {
2447 d_printf( "%s\n"
2448 "net ads kerberos renew\n"
2449 " %s\n",
2450 _("Usage:"),
2451 _("Renew TGT from existing credential cache"));
2452 return 0;
2453 }
2454
2455 ret = smb_krb5_renew_ticket(NULL, NULL, NULL, NULL);
2456 if (ret) {
2457 d_printf(_("failed to renew kerberos ticket: %s\n"),
2458 error_message(ret));
2459 }
2460 return ret;
2461 }
2462
2463 static int net_ads_kerberos_pac(struct net_context *c, int argc, const char **argv)
2464 {
2465 struct PAC_DATA *pac = NULL;
2466 struct PAC_LOGON_INFO *info = NULL;
2467 TALLOC_CTX *mem_ctx = NULL;
2468 NTSTATUS status;
2469 int ret = -1;
2470 const char *impersonate_princ_s = NULL;
2471
2472 if (c->display_usage) {
2473 d_printf( "%s\n"
2474 "net ads kerberos pac\n"
2475 " %s\n",
2476 _("Usage:"),
2477 _("Dump the Kerberos PAC"));
2478 return 0;
2479 }
2480
2481 mem_ctx = talloc_init("net_ads_kerberos_pac");
2482 if (!mem_ctx) {
2483 goto out;
2484 }
2485
2486 if (argc > 0) {
2487 impersonate_princ_s = argv[0];
2488 }
2489
2490 c->opt_password = net_prompt_pass(c, c->opt_user_name);
2491
2492 status = kerberos_return_pac(mem_ctx,
2493 c->opt_user_name,
2494 c->opt_password,
2495 0,
2496 NULL,
2497 NULL,
2498 NULL,
2499 true,
2500 true,
2501 2592000, /* one month */
2502 impersonate_princ_s,
2503 &pac);
2504 if (!NT_STATUS_IS_OK(status)) {
2505 d_printf(_("failed to query kerberos PAC: %s\n"),
2506 nt_errstr(status));
2507 goto out;
2508 }
2509
2510 info = get_logon_info_from_pac(pac);
2511 if (info) {
2512 const char *s;
2513 s = NDR_PRINT_STRUCT_STRING(mem_ctx, PAC_LOGON_INFO, info);
2514 d_printf(_("The Pac: %s\n"), s);
2515 }
2516
2517 ret = 0;
2518 out:
2519 TALLOC_FREE(mem_ctx);
2520 return ret;
2521 }
2522
2523 static int net_ads_kerberos_kinit(struct net_context *c, int argc, const char **argv)
2524 {
2525 TALLOC_CTX *mem_ctx = NULL;
2526 int ret = -1;
2527 NTSTATUS status;
2528
2529 if (c->display_usage) {
2530 d_printf( "%s\n"
2531 "net ads kerberos kinit\n"
2532 " %s\n",
2533 _("Usage:"),
2534 _("Get Ticket Granting Ticket (TGT) for the user"));
2535 return 0;
2536 }
2537
2538 mem_ctx = talloc_init("net_ads_kerberos_kinit");
2539 if (!mem_ctx) {
2540 goto out;
2541 }
2542
2543 c->opt_password = net_prompt_pass(c, c->opt_user_name);
2544
2545 ret = kerberos_kinit_password_ext(c->opt_user_name,
2546 c->opt_password,
2547 0,
2548 NULL,
2549 NULL,
2550 NULL,
2551 true,
2552 true,
2553 2592000, /* one month */
2554 &status);
2555 if (ret) {
2556 d_printf(_("failed to kinit password: %s\n"),
2557 nt_errstr(status));
2558 }
2559 out:
2560 return ret;
2561 }
2562
2563 int net_ads_kerberos(struct net_context *c, int argc, const char **argv)
2564 {
2565 struct functable func[] = {
2566 {
2567 "kinit",
2568 net_ads_kerberos_kinit,
2569 NET_TRANSPORT_ADS,
2570 N_("Retrieve Ticket Granting Ticket (TGT)"),
2571 N_("net ads kerberos kinit\n"
2572 " Receive Ticket Granting Ticket (TGT)")
2573 },
2574 {
2575 "renew",
2576 net_ads_kerberos_renew,
2577 NET_TRANSPORT_ADS,
2578 N_("Renew Ticket Granting Ticket from credential cache"),
2579 N_("net ads kerberos renew\n"
2580 " Renew Ticket Granting Ticket (TGT) from "
2581 "credential cache")
2582 },
2583 {
2584 "pac",
2585 net_ads_kerberos_pac,
2586 NET_TRANSPORT_ADS,
2587 N_("Dump Kerberos PAC"),
2588 N_("net ads kerberos pac\n"
2589 " Dump Kerberos PAC")
2590 },
2591 {NULL, NULL, 0, NULL, NULL}
2592 };
2593
2594 return net_run_function(c, argc, argv, "net ads kerberos", func);
2595 }
2596
2597 int net_ads(struct net_context *c, int argc, const char **argv)
2598 {
2599 struct functable func[] = {
2600 {
2601 "info",
2602 net_ads_info,
2603 NET_TRANSPORT_ADS,
2604 N_("Display details on remote ADS server"),
2605 N_("net ads info\n"
2606 " Display details on remote ADS server")
2607 },
2608 {
2609 "join",
2610 net_ads_join,
2611 NET_TRANSPORT_ADS,
2612 N_("Join the local machine to ADS realm"),
2613 N_("net ads join\n"
2614 " Join the local machine to ADS realm")
2615 },
2616 {
2617 "testjoin",
2618 net_ads_testjoin,
2619 NET_TRANSPORT_ADS,
2620 N_("Validate machine account"),
2621 N_("net ads testjoin\n"
2622 " Validate machine account")
2623 },
2624 {
2625 "leave",
2626 net_ads_leave,
2627 NET_TRANSPORT_ADS,
2628 N_("Remove the local machine from ADS"),
2629 N_("net ads leave\n"
2630 " Remove the local machine from ADS")
2631 },
2632 {
2633 "status",
2634 net_ads_status,
2635 NET_TRANSPORT_ADS,
2636 N_("Display machine account details"),
2637 N_("net ads status\n"
2638 " Display machine account details")
2639 },
2640 {
2641 "user",
2642 net_ads_user,
2643 NET_TRANSPORT_ADS,
2644 N_("List/modify users"),
2645 N_("net ads user\n"
2646 " List/modify users")
2647 },
2648 {
2649 "group",
2650 net_ads_group,
2651 NET_TRANSPORT_ADS,
2652 N_("List/modify groups"),
2653 N_("net ads group\n"
2654 " List/modify groups")
2655 },
2656 {
2657 "dns",
2658 net_ads_dns,
2659 NET_TRANSPORT_ADS,
2660 N_("Issue dynamic DNS update"),
2661 N_("net ads dns\n"
2662 " Issue dynamic DNS update")
2663 },
2664 {
2665 "password",
2666 net_ads_password,
2667 NET_TRANSPORT_ADS,
2668 N_("Change user passwords"),
2669 N_("net ads password\n"
2670 " Change user passwords")
2671 },
2672 {
2673 "changetrustpw",
2674 net_ads_changetrustpw,
2675 NET_TRANSPORT_ADS,
2676 N_("Change trust account password"),
2677 N_("net ads changetrustpw\n"
2678 " Change trust account password")
2679 },
2680 {
2681 "printer",
2682 net_ads_printer,
2683 NET_TRANSPORT_ADS,
2684 N_("List/modify printer entries"),
2685 N_("net ads printer\n"
2686 " List/modify printer entries")
2687 },
2688 {
2689 "search",
2690 net_ads_search,
2691 NET_TRANSPORT_ADS,
2692 N_("Issue LDAP search using filter"),
2693 N_("net ads search\n"
2694 " Issue LDAP search using filter")
2695 },
2696 {
2697 "dn",
2698 net_ads_dn,
2699 NET_TRANSPORT_ADS,
2700 N_("Issue LDAP search by DN"),
2701 N_("net ads dn\n"
2702 " Issue LDAP search by DN")
2703 },
2704 {
2705 "sid",
2706 net_ads_sid,
2707 NET_TRANSPORT_ADS,
2708 N_("Issue LDAP search by SID"),
2709 N_("net ads sid\n"
2710 " Issue LDAP search by SID")
2711 },
2712 {
2713 "workgroup",
2714 net_ads_workgroup,
2715 NET_TRANSPORT_ADS,
2716 N_("Display workgroup name"),
2717 N_("net ads workgroup\n"
2718 " Display the workgroup name")
2719 },
2720 {
2721 "lookup",
2722 net_ads_lookup,
2723 NET_TRANSPORT_ADS,
2724 N_("Perfom CLDAP query on DC"),
2725 N_("net ads lookup\n"
2726 " Find the ADS DC using CLDAP lookups")
2727 },
2728 {
2729 "keytab",
2730 net_ads_keytab,
2731 NET_TRANSPORT_ADS,
2732 N_("Manage local keytab file"),
2733 N_("net ads keytab\n"
2734 " Manage local keytab file")
2735 },
2736 {
2737 "gpo",
2738 net_ads_gpo,
2739 NET_TRANSPORT_ADS,
2740 N_("Manage group policy objects"),
2741 N_("net ads gpo\n"
2742 " Manage group policy objects")
2743 },
2744 {
2745 "kerberos",
2746 net_ads_kerberos,
2747 NET_TRANSPORT_ADS,
2748 N_("Manage kerberos keytab"),
2749 N_("net ads kerberos\n"
2750 " Manage kerberos keytab")
2751 },
2752 {NULL, NULL, 0, NULL, NULL}
2753 };
2754
2755 return net_run_function(c, argc, argv, "net ads", func);
2756 }
2757
2758 #else
2759
2760 static int net_ads_noads(void)
2761 {
2762 d_fprintf(stderr, _("ADS support not compiled in\n"));
2763 return -1;
2764 }
2765
2766 int net_ads_keytab(struct net_context *c, int argc, const char **argv)
2767 {
2768 return net_ads_noads();
2769 }
2770
2771 int net_ads_kerberos(struct net_context *c, int argc, const char **argv)
2772 {
2773 return net_ads_noads();
2774 }
2775
2776 int net_ads_changetrustpw(struct net_context *c, int argc, const char **argv)
2777 {
2778 return net_ads_noads();
2779 }
2780
2781 int net_ads_join(struct net_context *c, int argc, const char **argv)
2782 {
2783 return net_ads_noads();
2784 }
2785
2786 int net_ads_user(struct net_context *c, int argc, const char **argv)
2787 {
2788 return net_ads_noads();
2789 }
2790
2791 int net_ads_group(struct net_context *c, int argc, const char **argv)
2792 {
2793 return net_ads_noads();
2794 }
2795
2796 /* this one shouldn't display a message */
2797 int net_ads_check(struct net_context *c)
2798 {
2799 return -1;
2800 }
2801
2802 int net_ads_check_our_domain(struct net_context *c)
2803 {
2804 return -1;
2805 }
2806
2807 int net_ads(struct net_context *c, int argc, const char **argv)
2808 {
2809 return net_ads_noads();
2810 }
2811
2812 #endif /* WITH_ADS */
Samba GIT mirror