source4/setup/provision

   1 #!/usr/bin/python
   2 #
   3 # Unix SMB/CIFS implementation.
   4 # provision a Samba4 server
   5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
   6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
   7 #
   8 # Based on the original in EJS:
   9 # Copyright (C) Andrew Tridgell 2005
  10 #
  11 # This program is free software; you can redistribute it and/or modify
  12 # it under the terms of the GNU General Public License as published by
  13 # the Free Software Foundation; either version 3 of the License, or
  14 # (at your option) any later version.
  15 #
  16 # This program is distributed in the hope that it will be useful,
  17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19 # GNU General Public License for more details.
  20 #
  21 # You should have received a copy of the GNU General Public License
  22 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 #
  24
  25 import optparse
  26 import sys
  27 import os
  28 import tempfile
  29
  30 # Find right directory when running from source tree
  31 sys.path.insert(0, "bin/python")
  32
  33 import samba
  34 import samba.ntacls
  35 from samba.credentials import DONT_USE_KERBEROS
  36 from samba.auth import system_session
  37 import samba.getopt as options
  38 from samba.provision import provision, FILL_FULL, FILL_NT4SYNC, FILL_DRS, find_setup_dir
  39 from samba import DS_DOMAIN_FUNCTION_2003, DS_DOMAIN_FUNCTION_2008, DS_DOMAIN_FUNCTION_2008_R2
  40
  41 # how do we make this case insensitive??
  42
  43 parser = optparse.OptionParser("provision [options]")
  44 sambaopts = options.SambaOptions(parser)
  45 parser.add_option_group(sambaopts)
  46 parser.add_option_group(options.VersionOptions(parser))
  47 credopts = options.CredentialsOptions(parser)
  48 parser.add_option_group(credopts)
  49 parser.add_option("--interactive", help="Ask for names", action="store_true")
  50 parser.add_option("--setupdir", type="string", metavar="DIR",
  51                 help="directory with setup files")
  52 parser.add_option("--realm", type="string", metavar="REALM", help="set realm")
  53 parser.add_option("--domain", type="string", metavar="DOMAIN",
  54                                   help="set domain")
  55 parser.add_option("--domain-guid", type="string", metavar="GUID",
  56                 help="set domainguid (otherwise random)")
  57 parser.add_option("--domain-sid", type="string", metavar="SID",
  58                 help="set domainsid (otherwise random)")
  59 parser.add_option("--policy-guid", type="string", metavar="GUID",
  60                                   help="set guid for domain policy")
  61 parser.add_option("--policy-guid-dc", type="string", metavar="GUID",
  62                                   help="set guid for domain controller policy")
  63 parser.add_option("--ntds-guid", type="string", metavar="GUID",
  64                   help="set NTDS object GUID (otherwise random)")
  65 parser.add_option("--invocationid", type="string", metavar="GUID",
  66                   help="set invocationid (otherwise random)")
  67 parser.add_option("--host-name", type="string", metavar="HOSTNAME",
  68                 help="set hostname")
  69 parser.add_option("--host-ip", type="string", metavar="IPADDRESS",
  70                 help="set IPv4 ipaddress")
  71 parser.add_option("--host-ip6", type="string", metavar="IP6ADDRESS",
  72                 help="set IPv6 ipaddress")
  73 parser.add_option("--adminpass", type="string", metavar="PASSWORD",
  74                 help="choose admin password (otherwise random)")
  75 parser.add_option("--krbtgtpass", type="string", metavar="PASSWORD",
  76                 help="choose krbtgt password (otherwise random)")
  77 parser.add_option("--machinepass", type="string", metavar="PASSWORD",
  78                 help="choose machine password (otherwise random)")
  79 parser.add_option("--dnspass", type="string", metavar="PASSWORD",
  80                 help="choose dns password (otherwise random)")
  81 parser.add_option("--ldapadminpass", type="string", metavar="PASSWORD",
  82                 help="choose password to set between Samba and it's LDAP backend (otherwise random)")
  83 parser.add_option("--root", type="string", metavar="USERNAME",
  84                 help="choose 'root' unix username")
  85 parser.add_option("--nobody", type="string", metavar="USERNAME",
  86                 help="choose 'nobody' user")
  87 parser.add_option("--wheel", type="string", metavar="GROUPNAME",
  88                 help="choose 'wheel' privileged group")
  89 parser.add_option("--users", type="string", metavar="GROUPNAME",
  90                 help="choose 'users' group")
  91 parser.add_option("--quiet", help="Be quiet", action="store_true")
  92 parser.add_option("--blank", action="store_true",
  93                 help="do not add users or groups, just the structure")
  94 parser.add_option("--ldap-backend-extra-port", type="int", metavar="LDAP-BACKEND-EXTRA-PORT",
  95                 help="Additional TCP port for LDAP backend server (to use for replication)")
  96 parser.add_option("--ldap-backend-type", type="choice", metavar="LDAP-BACKEND-TYPE",
  97                 help="LDAP backend type (fedora-ds or openldap)",
  98                 choices=["fedora-ds", "openldap"])
  99 parser.add_option("--ldap-backend-nosync", help="Configure LDAP backend not to call fsync() (for performance in test environments)", action="store_true")
 100 parser.add_option("--server-role", type="choice", metavar="ROLE",
 101                   choices=["domain controller", "dc", "member server", "member", "standalone"],
 102                 help="The server role (domain controller | dc | member server | member | standalone). Default is standalone.")
 103 parser.add_option("--function-level", type="choice", metavar="FOR-FUN-LEVEL",
 104                   choices=["2003", "2008", "2008_R2"],
 105                 help="The domain and forest function level (2003 | 2008 | 2008_R2). Default is (Windows) 2003 (Native).")
 106 parser.add_option("--partitions-only",
 107                 help="Configure Samba's partitions, but do not modify them (ie, join a BDC)", action="store_true")
 108 parser.add_option("--targetdir", type="string", metavar="DIR",
 109                           help="Set target directory")
 110 parser.add_option("--ol-mmr-urls", type="string", metavar="LDAPSERVER",
 111                 help="List of LDAP-URLS [ ldap://<FQHN>:<PORT>/  (where <PORT> has to be different than 389!) ] separated with whitespaces for use with OpenLDAP-MMR (Multi-Master-Replication)")
 112 parser.add_option("--slapd-path", type="string", metavar="SLAPD-PATH",
 113                 help="Path to slapd for LDAP backend [e.g.:'/usr/local/libexec/slapd']. Required for Setup with LDAP-Backend. OpenLDAP Version >= 2.4.17 should be used.")
 114 parser.add_option("--setup-ds-path", type="string", metavar="SETUP_DS-PATH",
 115                 help="Path to setup-ds.pl script for Fedora DS LDAP backend [e.g.:'/usr/sbin/setup-ds.pl']. Required for Setup with Fedora DS backend.")
 116 parser.add_option("--nosync", help="Configure LDAP backend not to call fsync() (for performance in test environments)", action="store_true")
 117 parser.add_option("--use-xattrs", type="choice", choices=["yes","no","auto"], help="Define if we should use the native fs capabilities or a tdb file for storing attributes likes ntacl, auto tries to make an inteligent guess based on the user rights and system capabilities")
 118 parser.add_option("--ldap-dryrun-mode", help="Configure LDAP backend, but do not run any binaries and exit early.  Used only for the test environment.  DO NOT USE", action="store_true")
 119
 120 opts = parser.parse_args()[0]
 121
 122 def message(text):
 123         """print a message if quiet is not set."""
 124         if not opts.quiet:
 125                 print text
 126
 127 if len(sys.argv) == 1:
 128         opts.interactive = True
 129
 130 if opts.interactive:
 131         from getpass import getpass
 132         import socket
 133         def ask(prompt, default=None):
 134                 if default is not None:
 135                         print "%s [%s]: " % (prompt,default),
 136                 else:
 137                         print "%s: " % (prompt,),
 138                 return sys.stdin.readline().rstrip("\n") or default
 139         try:
 140                 default = socket.getfqdn().split(".", 1)[1].upper()
 141         except IndexError:
 142                 default = None
 143         opts.realm = ask("Realm", default)
 144         if opts.realm in (None, ""):
 145                 print >>sys.stderr, "No realm set!"
 146                 sys.exit(1)
 147
 148         try:
 149                 default = opts.realm.split(".")[0]
 150         except IndexError:
 151                 default = None
 152         opts.domain = ask("Domain", default)
 153         if opts.domain is None:
 154                 print >> sys.stderr, "No domain set!"
 155                 sys.exit(1)
 156
 157         opts.server_role = ask("Server Role (dc, member, standalone)", "dc")
 158         for i in range(3):
 159                 opts.adminpass = getpass("Administrator password: ")
 160                 if not opts.adminpass:
 161                         print >>sys.stderr, "Invalid administrator password."
 162                 else:
 163                         break
 164 else:
 165         if opts.realm is None or opts.domain is None:
 166                 if opts.realm is None:
 167                         print >>sys.stderr, "No realm set!"
 168                 if opts.domain is None:
 169                         print >> sys.stderr, "No domain set!"
 170                 parser.print_usage()
 171                 sys.exit(1)
 172
 173 if not opts.adminpass:
 174         message("Administrator password will be set randomly!")
 175
 176 lp = sambaopts.get_loadparm()
 177 smbconf = lp.configfile
 178
 179 if opts.server_role == "dc":
 180         server_role = "domain controller"
 181 elif opts.server_role == "member":
 182         server_role = "member server"
 183 else:
 184         server_role = opts.server_role
 185
 186 if opts.function_level is None:
 187         dom_for_fun_level = None
 188 elif opts.function_level == "2003":
 189         dom_for_fun_level = DS_DOMAIN_FUNCTION_2003
 190 elif opts.function_level == "2008":
 191         dom_for_fun_level = DS_DOMAIN_FUNCTION_2008
 192 elif opts.function_level == "2008_R2":
 193         dom_for_fun_level = DS_DOMAIN_FUNCTION_2008_R2
 194
 195 creds = credopts.get_credentials(lp)
 196
 197 creds.set_kerberos_state(DONT_USE_KERBEROS)
 198
 199 setup_dir = opts.setupdir
 200 if setup_dir is None:
 201         setup_dir = find_setup_dir()
 202
 203 samdb_fill = FILL_FULL
 204 if opts.blank:
 205     samdb_fill = FILL_NT4SYNC
 206 elif opts.partitions_only:
 207     samdb_fill = FILL_DRS
 208
 209 if not opts.use_xattrs:
 210         opts.use_xattrs="auto"
 211
 212 eadb = True
 213 if opts.use_xattrs == "yes":
 214         eadb = False
 215 elif opts.use_xattrs == "auto":
 216         file=tempfile.NamedTemporaryFile()
 217         try:
 218                 samba.ntacls.setntacl(lp,file.name,"O:S-1-5-32G:S-1-5-32","S-1-5-32","native")
 219                 eadb = False
 220         except:
 221                 if lp.get("posix:eadb") == None:
 222                         message("Notice: you are not root or your system do not support xattr, tdb backend for attributes has been selected")
 223                         message(" if you intend to use this provision in production you'd better rerun the script as root on a system supporting xattr")
 224         file.close()
 225
 226
 227 session = system_session()
 228 provision(setup_dir, message,
 229           session, creds, smbconf=smbconf, targetdir=opts.targetdir,
 230           samdb_fill=samdb_fill, realm=opts.realm, domain=opts.domain,
 231           domainguid=opts.domain_guid, domainsid=opts.domain_sid,
 232           policyguid=opts.policy_guid, policyguid_dc=opts.policy_guid_dc,
 233           hostname=opts.host_name,
 234           hostip=opts.host_ip, hostip6=opts.host_ip6,
 235           ntdsguid=opts.ntds_guid,
 236           invocationid=opts.invocationid, adminpass=opts.adminpass,
 237           krbtgtpass=opts.krbtgtpass, machinepass=opts.machinepass,
 238           dnspass=opts.dnspass, root=opts.root, nobody=opts.nobody,
 239           wheel=opts.wheel, users=opts.users,
 240           serverrole=server_role, dom_for_fun_level=dom_for_fun_level,
 241           ldap_backend_extra_port=opts.ldap_backend_extra_port,
 242           backend_type=opts.ldap_backend_type,
 243           ldapadminpass=opts.ldapadminpass, ol_mmr_urls=opts.ol_mmr_urls,
 244           slapd_path=opts.slapd_path, setup_ds_path=opts.setup_ds_path,
 245           nosync=opts.nosync,ldap_dryrun_mode=opts.ldap_dryrun_mode,useeadb=eadb)