2 * Unix SMB/CIFS implementation.
3 * Local SAM access routines
4 * Copyright (C) Volker Lendecke 2006
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 #include "system/passwd.h"
23 #include "utils/net.h"
24 #include "../librpc/gen_ndr/samr.h"
26 #include "../libcli/security/security.h"
27 #include "lib/winbind_util.h"
29 #include "passdb/pdb_ldap_util.h"
30 #include "passdb/pdb_ldap_schema.h"
31 #include "lib/privileges.h"
37 static int net_sam_userset(struct net_context
*c
, int argc
, const char **argv
,
39 bool (*fn
)(struct samu
*, const char *,
40 enum pdb_value_state
))
42 struct samu
*sam_acct
= NULL
;
44 enum lsa_SidType type
;
45 const char *dom
, *name
;
48 if (argc
!= 2 || c
->display_usage
) {
49 d_fprintf(stderr
, "%s\n", _("Usage:"));
50 d_fprintf(stderr
, _("net sam set %s <user> <value>\n"),
55 if (!lookup_name(talloc_tos(), argv
[0], LOOKUP_NAME_LOCAL
,
56 &dom
, &name
, &sid
, &type
)) {
57 d_fprintf(stderr
, _("Could not find name %s\n"), argv
[0]);
61 if (type
!= SID_NAME_USER
) {
62 d_fprintf(stderr
, _("%s is a %s, not a user\n"), argv
[0],
63 sid_type_lookup(type
));
67 if ( !(sam_acct
= samu_new( NULL
)) ) {
68 d_fprintf(stderr
, _("Internal error\n"));
72 if (!pdb_getsampwsid(sam_acct
, &sid
)) {
73 d_fprintf(stderr
, _("Loading user %s failed\n"), argv
[0]);
77 if (!fn(sam_acct
, argv
[1], PDB_CHANGED
)) {
78 d_fprintf(stderr
, _("Internal error\n"));
82 status
= pdb_update_sam_account(sam_acct
);
83 if (!NT_STATUS_IS_OK(status
)) {
84 d_fprintf(stderr
, _("Updating sam account %s failed with %s\n"),
85 argv
[0], nt_errstr(status
));
89 TALLOC_FREE(sam_acct
);
91 d_printf(_("Updated %s for %s\\%s to %s\n"), field
, dom
, name
, argv
[1]);
95 static int net_sam_set_fullname(struct net_context
*c
, int argc
,
98 return net_sam_userset(c
, argc
, argv
, "fullname",
102 static int net_sam_set_logonscript(struct net_context
*c
, int argc
,
105 return net_sam_userset(c
, argc
, argv
, "logonscript",
106 pdb_set_logon_script
);
109 static int net_sam_set_profilepath(struct net_context
*c
, int argc
,
112 return net_sam_userset(c
, argc
, argv
, "profilepath",
113 pdb_set_profile_path
);
116 static int net_sam_set_homedrive(struct net_context
*c
, int argc
,
119 return net_sam_userset(c
, argc
, argv
, "homedrive",
123 static int net_sam_set_homedir(struct net_context
*c
, int argc
,
126 return net_sam_userset(c
, argc
, argv
, "homedir",
130 static int net_sam_set_workstations(struct net_context
*c
, int argc
,
133 return net_sam_userset(c
, argc
, argv
, "workstations",
134 pdb_set_workstations
);
141 static int net_sam_set_userflag(struct net_context
*c
, int argc
,
142 const char **argv
, const char *field
,
145 struct samu
*sam_acct
= NULL
;
147 enum lsa_SidType type
;
148 const char *dom
, *name
;
152 if ((argc
!= 2) || c
->display_usage
||
153 (!strequal(argv
[1], "yes") &&
154 !strequal(argv
[1], "no"))) {
155 d_fprintf(stderr
, "%s\n", _("Usage:"));
156 d_fprintf(stderr
, _("net sam set %s <user> [yes|no]\n"),
161 if (!lookup_name(talloc_tos(), argv
[0], LOOKUP_NAME_LOCAL
,
162 &dom
, &name
, &sid
, &type
)) {
163 d_fprintf(stderr
, _("Could not find name %s\n"), argv
[0]);
167 if (type
!= SID_NAME_USER
) {
168 d_fprintf(stderr
, _("%s is a %s, not a user\n"), argv
[0],
169 sid_type_lookup(type
));
173 if ( !(sam_acct
= samu_new( NULL
)) ) {
174 d_fprintf(stderr
, _("Internal error\n"));
178 if (!pdb_getsampwsid(sam_acct
, &sid
)) {
179 d_fprintf(stderr
, _("Loading user %s failed\n"), argv
[0]);
183 acct_flags
= pdb_get_acct_ctrl(sam_acct
);
185 if (strequal(argv
[1], "yes")) {
191 pdb_set_acct_ctrl(sam_acct
, acct_flags
, PDB_CHANGED
);
193 status
= pdb_update_sam_account(sam_acct
);
194 if (!NT_STATUS_IS_OK(status
)) {
195 d_fprintf(stderr
, _("Updating sam account %s failed with %s\n"),
196 argv
[0], nt_errstr(status
));
200 TALLOC_FREE(sam_acct
);
202 d_fprintf(stderr
, _("Updated flag %s for %s\\%s to %s\n"), field
, dom
,
207 static int net_sam_set_disabled(struct net_context
*c
, int argc
,
210 return net_sam_set_userflag(c
, argc
, argv
, "disabled", ACB_DISABLED
);
213 static int net_sam_set_pwnotreq(struct net_context
*c
, int argc
,
216 return net_sam_set_userflag(c
, argc
, argv
, "pwnotreq", ACB_PWNOTREQ
);
219 static int net_sam_set_autolock(struct net_context
*c
, int argc
,
222 return net_sam_set_userflag(c
, argc
, argv
, "autolock", ACB_AUTOLOCK
);
225 static int net_sam_set_pwnoexp(struct net_context
*c
, int argc
,
228 return net_sam_set_userflag(c
, argc
, argv
, "pwnoexp", ACB_PWNOEXP
);
232 * Set pass last change time, based on force pass change now
235 static int net_sam_set_pwdmustchangenow(struct net_context
*c
, int argc
,
238 struct samu
*sam_acct
= NULL
;
240 enum lsa_SidType type
;
241 const char *dom
, *name
;
244 if ((argc
!= 2) || c
->display_usage
||
245 (!strequal(argv
[1], "yes") &&
246 !strequal(argv
[1], "no"))) {
247 d_fprintf(stderr
, "%s\n%s",
249 _("net sam set pwdmustchangenow <user> [yes|no]\n"));
253 if (!lookup_name(talloc_tos(), argv
[0], LOOKUP_NAME_LOCAL
,
254 &dom
, &name
, &sid
, &type
)) {
255 d_fprintf(stderr
, _("Could not find name %s\n"), argv
[0]);
259 if (type
!= SID_NAME_USER
) {
260 d_fprintf(stderr
, _("%s is a %s, not a user\n"), argv
[0],
261 sid_type_lookup(type
));
265 if ( !(sam_acct
= samu_new( NULL
)) ) {
266 d_fprintf(stderr
, _("Internal error\n"));
270 if (!pdb_getsampwsid(sam_acct
, &sid
)) {
271 d_fprintf(stderr
, _("Loading user %s failed\n"), argv
[0]);
275 if (strequal(argv
[1], "yes")) {
276 pdb_set_pass_last_set_time(sam_acct
, 0, PDB_CHANGED
);
278 pdb_set_pass_last_set_time(sam_acct
, time(NULL
), PDB_CHANGED
);
281 status
= pdb_update_sam_account(sam_acct
);
282 if (!NT_STATUS_IS_OK(status
)) {
283 d_fprintf(stderr
, _("Updating sam account %s failed with %s\n"),
284 argv
[0], nt_errstr(status
));
288 TALLOC_FREE(sam_acct
);
290 d_fprintf(stderr
, _("Updated 'user must change password at next logon' "
291 "for %s\\%s to %s\n"), dom
,
298 * Set a user's or a group's comment
301 static int net_sam_set_comment(struct net_context
*c
, int argc
,
306 enum lsa_SidType type
;
307 const char *dom
, *name
;
310 if (argc
!= 2 || c
->display_usage
) {
311 d_fprintf(stderr
, "%s\n%s",
313 _("net sam set comment <name> <comment>\n"));
317 if (!lookup_name(talloc_tos(), argv
[0], LOOKUP_NAME_LOCAL
,
318 &dom
, &name
, &sid
, &type
)) {
319 d_fprintf(stderr
, _("Could not find name %s\n"), argv
[0]);
323 if (type
== SID_NAME_USER
) {
324 return net_sam_userset(c
, argc
, argv
, "comment",
328 if ((type
!= SID_NAME_DOM_GRP
) && (type
!= SID_NAME_ALIAS
) &&
329 (type
!= SID_NAME_WKN_GRP
)) {
330 d_fprintf(stderr
, _("%s is a %s, not a group\n"), argv
[0],
331 sid_type_lookup(type
));
335 map
= talloc_zero(talloc_tos(), GROUP_MAP
);
337 d_fprintf(stderr
, _("Out of memory!\n"));
341 if (!pdb_getgrsid(map
, sid
)) {
342 d_fprintf(stderr
, _("Could not load group %s\n"), argv
[0]);
346 map
->comment
= talloc_strdup(map
, argv
[1]);
348 d_fprintf(stderr
, _("Out of memory!\n"));
352 status
= pdb_update_group_mapping_entry(map
);
354 if (!NT_STATUS_IS_OK(status
)) {
355 d_fprintf(stderr
, _("Updating group mapping entry failed with "
356 "%s\n"), nt_errstr(status
));
360 d_printf("Updated comment of group %s\\%s to %s\n", dom
, name
,
367 static int net_sam_set(struct net_context
*c
, int argc
, const char **argv
)
369 struct functable func
[] = {
374 N_("Change a user's home directory"),
375 N_("net sam set homedir\n"
376 " Change a user's home directory")
380 net_sam_set_profilepath
,
382 N_("Change a user's profile path"),
383 N_("net sam set profilepath\n"
384 " Change a user's profile path")
390 N_("Change a users or groups description"),
391 N_("net sam set comment\n"
392 " Change a users or groups description")
396 net_sam_set_fullname
,
398 N_("Change a user's full name"),
399 N_("net sam set fullname\n"
400 " Change a user's full name")
404 net_sam_set_logonscript
,
406 N_("Change a user's logon script"),
407 N_("net sam set logonscript\n"
408 " Change a user's logon script")
412 net_sam_set_homedrive
,
414 N_("Change a user's home drive"),
415 N_("net sam set homedrive\n"
416 " Change a user's home drive")
420 net_sam_set_workstations
,
422 N_("Change a user's allowed workstations"),
423 N_("net sam set workstations\n"
424 " Change a user's allowed workstations")
428 net_sam_set_disabled
,
430 N_("Disable/Enable a user"),
431 N_("net sam set disable\n"
432 " Disable/Enable a user")
436 net_sam_set_pwnotreq
,
438 N_("Disable/Enable the password not required flag"),
439 N_("net sam set pwnotreq\n"
440 " Disable/Enable the password not required flag")
444 net_sam_set_autolock
,
446 N_("Disable/Enable a user's lockout flag"),
447 N_("net sam set autolock\n"
448 " Disable/Enable a user's lockout flag")
454 N_("Disable/Enable whether a user's pw does not "
456 N_("net sam set pwnoexp\n"
457 " Disable/Enable whether a user's pw does not "
462 net_sam_set_pwdmustchangenow
,
464 N_("Force users password must change at next logon"),
465 N_("net sam set pwdmustchangenow\n"
466 " Force users password must change at next logon")
468 {NULL
, NULL
, 0, NULL
, NULL
}
471 return net_run_function(c
, argc
, argv
, "net sam set", func
);
475 * Manage account policies
478 static int net_sam_policy_set(struct net_context
*c
, int argc
, const char **argv
)
480 const char *account_policy
= NULL
;
482 uint32 old_value
= 0;
483 enum pdb_policy_type field
;
486 if (argc
!= 2 || c
->display_usage
) {
487 d_fprintf(stderr
, "%s\n%s",
489 _("net sam policy set \"<account policy>\" <value>\n"));
493 account_policy
= argv
[0];
494 field
= account_policy_name_to_typenum(account_policy
);
496 if (strequal(argv
[1], "forever") || strequal(argv
[1], "never")
497 || strequal(argv
[1], "off")) {
501 value
= strtoul(argv
[1], &endptr
, 10);
503 if ((endptr
== argv
[1]) || (endptr
[0] != '\0')) {
504 d_printf(_("Unable to set policy \"%s\"! Invalid value "
506 account_policy
, argv
[1]);
515 account_policy_names_list(talloc_tos(), &names
, &count
);
516 d_fprintf(stderr
, _("No account policy \"%s\"!\n\n"), argv
[0]);
517 d_fprintf(stderr
, _("Valid account policies are:\n"));
519 for (i
=0; i
<count
; i
++) {
520 d_fprintf(stderr
, "%s\n", names
[i
]);
528 if (!pdb_get_account_policy(field
, &old_value
)) {
529 d_fprintf(stderr
, _("Valid account policy, but unable to fetch "
532 d_printf(_("Account policy \"%s\" value was: %d\n"),
533 account_policy
, old_value
);
536 if (!pdb_set_account_policy(field
, value
)) {
537 d_fprintf(stderr
, _("Valid account policy, but unable to "
541 d_printf(_("Account policy \"%s\" value is now: %d\n"),
542 account_policy
, value
);
548 static int net_sam_policy_show(struct net_context
*c
, int argc
, const char **argv
)
550 const char *account_policy
= NULL
;
552 enum pdb_policy_type field
;
554 if (argc
!= 1 || c
->display_usage
) {
555 d_fprintf(stderr
, "%s\n%s",
557 _("net sam policy show \"<account policy>\"\n"));
561 account_policy
= argv
[0];
562 field
= account_policy_name_to_typenum(account_policy
);
568 account_policy_names_list(talloc_tos(), &names
, &count
);
569 d_fprintf(stderr
, _("No account policy by that name!\n"));
571 d_fprintf(stderr
, _("Valid account policies "
573 for (i
=0; i
<count
; i
++) {
574 d_fprintf(stderr
, "%s\n", names
[i
]);
581 if (!pdb_get_account_policy(field
, &old_value
)) {
582 fprintf(stderr
, _("Valid account policy, but unable to "
587 printf(_("Account policy \"%s\" description: %s\n"),
588 account_policy
, account_policy_get_desc(field
));
589 printf(_("Account policy \"%s\" value is: %d\n"), account_policy
,
594 static int net_sam_policy_list(struct net_context
*c
, int argc
, const char **argv
)
600 if (c
->display_usage
) {
602 "net sam policy list\n"
605 _("List account policies"));
609 account_policy_names_list(talloc_tos(), &names
, &count
);
611 d_fprintf(stderr
, _("Valid account policies "
613 for (i
= 0; i
< count
; i
++) {
614 d_fprintf(stderr
, "%s\n", names
[i
]);
621 static int net_sam_policy(struct net_context
*c
, int argc
, const char **argv
)
623 struct functable func
[] = {
628 N_("List account policies"),
629 N_("net sam policy list\n"
630 " List account policies")
636 N_("Show account policies"),
637 N_("net sam policy show\n"
638 " Show account policies")
644 N_("Change account policies"),
645 N_("net sam policy set\n"
646 " Change account policies")
648 {NULL
, NULL
, 0, NULL
, NULL
}
651 return net_run_function(c
, argc
, argv
, "net sam policy", func
);
654 static int net_sam_rights_list(struct net_context
*c
, int argc
,
657 enum sec_privilege privilege
;
659 if (argc
> 1 || c
->display_usage
) {
660 d_fprintf(stderr
, "%s\n%s",
662 _("net sam rights list [privilege name]\n"));
668 int num
= num_privileges_in_short_list();
670 for (i
=0; i
<num
; i
++) {
671 d_printf("%s\n", sec_privilege_name_from_index(i
));
676 privilege
= sec_privilege_id(argv
[0]);
678 if (privilege
!= SEC_PRIV_INVALID
) {
679 struct dom_sid
*sids
;
683 status
= privilege_enum_sids(privilege
, talloc_tos(),
685 if (!NT_STATUS_IS_OK(status
)) {
686 d_fprintf(stderr
, _("Could not list rights: %s\n"),
691 for (i
=0; i
<num_sids
; i
++) {
692 const char *dom
, *name
;
693 enum lsa_SidType type
;
695 if (lookup_sid(talloc_tos(), &sids
[i
], &dom
, &name
,
697 d_printf("%s\\%s\n", dom
, name
);
700 d_printf("%s\n", sid_string_tos(&sids
[i
]));
709 static int net_sam_rights_grant(struct net_context
*c
, int argc
,
713 enum lsa_SidType type
;
714 const char *dom
, *name
;
717 if (argc
< 2 || c
->display_usage
) {
718 d_fprintf(stderr
, "%s\n%s",
720 _("net sam rights grant <name> <rights> ...\n"));
724 if (!lookup_name(talloc_tos(), argv
[0], LOOKUP_NAME_LOCAL
,
725 &dom
, &name
, &sid
, &type
)) {
726 d_fprintf(stderr
, _("Could not find name %s\n"), argv
[0]);
730 for (i
=1; i
< argc
; i
++) {
731 enum sec_privilege privilege
= sec_privilege_id(argv
[i
]);
732 if (privilege
== SEC_PRIV_INVALID
) {
733 d_fprintf(stderr
, _("%s unknown\n"), argv
[i
]);
737 if (!grant_privilege_by_name(&sid
, argv
[i
])) {
738 d_fprintf(stderr
, _("Could not grant privilege\n"));
742 d_printf(_("Granted %s to %s\\%s\n"), argv
[i
], dom
, name
);
748 static int net_sam_rights_revoke(struct net_context
*c
, int argc
,
752 enum lsa_SidType type
;
753 const char *dom
, *name
;
756 if (argc
< 2 || c
->display_usage
) {
757 d_fprintf(stderr
, "%s\n%s",
759 _("net sam rights revoke <name> <rights>\n"));
763 if (!lookup_name(talloc_tos(), argv
[0], LOOKUP_NAME_LOCAL
,
764 &dom
, &name
, &sid
, &type
)) {
765 d_fprintf(stderr
, _("Could not find name %s\n"), argv
[0]);
769 for (i
=1; i
< argc
; i
++) {
770 enum sec_privilege privilege
= sec_privilege_id(argv
[i
]);
771 if (privilege
== SEC_PRIV_INVALID
) {
772 d_fprintf(stderr
, _("%s unknown\n"), argv
[i
]);
776 if (!revoke_privilege_by_name(&sid
, argv
[i
])) {
777 d_fprintf(stderr
, _("Could not revoke privilege\n"));
781 d_printf(_("Revoked %s from %s\\%s\n"), argv
[i
], dom
, name
);
787 static int net_sam_rights(struct net_context
*c
, int argc
, const char **argv
)
789 struct functable func
[] = {
794 N_("List possible user rights"),
795 N_("net sam rights list\n"
796 " List possible user rights")
800 net_sam_rights_grant
,
802 N_("Grant right(s)"),
803 N_("net sam rights grant\n"
808 net_sam_rights_revoke
,
810 N_("Revoke right(s)"),
811 N_("net sam rights revoke\n"
814 {NULL
, NULL
, 0, NULL
, NULL
}
816 return net_run_function(c
, argc
, argv
, "net sam rights", func
);
820 * Map a unix group to a domain group
823 static NTSTATUS
map_unix_group(const struct group
*grp
, GROUP_MAP
*map
)
825 const char *dom
, *name
;
828 if (pdb_getgrgid(map
, grp
->gr_gid
)) {
829 return NT_STATUS_GROUP_EXISTS
;
832 map
->gid
= grp
->gr_gid
;
834 if (lookup_name(talloc_tos(), grp
->gr_name
, LOOKUP_NAME_LOCAL
,
835 &dom
, &name
, NULL
, NULL
)) {
837 map
->nt_name
= talloc_asprintf(map
, "Unix Group %s",
840 DEBUG(5, ("%s exists as %s\\%s, retrying as \"%s\"\n",
841 grp
->gr_name
, dom
, name
, map
->nt_name
));
844 if (lookup_name(talloc_tos(), grp
->gr_name
, LOOKUP_NAME_LOCAL
,
845 NULL
, NULL
, NULL
, NULL
)) {
846 DEBUG(3, ("\"%s\" exists, can't map it\n", grp
->gr_name
));
847 return NT_STATUS_GROUP_EXISTS
;
850 if (pdb_capabilities() & PDB_CAP_STORE_RIDS
) {
851 if (!pdb_new_rid(&rid
)) {
852 DEBUG(3, ("Could not get a new RID for %s\n",
854 return NT_STATUS_ACCESS_DENIED
;
857 rid
= algorithmic_pdb_gid_to_group_rid( grp
->gr_gid
);
860 sid_compose(&map
->sid
, get_global_sam_sid(), rid
);
861 map
->sid_name_use
= SID_NAME_DOM_GRP
;
862 map
->comment
= talloc_asprintf(map
, "Unix Group %s", grp
->gr_name
);
864 return pdb_add_group_mapping_entry(map
);
867 static int net_sam_mapunixgroup(struct net_context
*c
, int argc
, const char **argv
)
873 if (argc
!= 1 || c
->display_usage
) {
874 d_fprintf(stderr
, "%s\n%s",
876 _("net sam mapunixgroup <name>\n"));
880 grp
= getgrnam(argv
[0]);
882 d_fprintf(stderr
, _("Could not find group %s\n"), argv
[0]);
886 map
= talloc_zero(talloc_tos(), GROUP_MAP
);
888 d_fprintf(stderr
, _("Out of memory!\n"));
892 status
= map_unix_group(grp
, map
);
894 if (!NT_STATUS_IS_OK(status
)) {
895 d_fprintf(stderr
, _("Mapping group %s failed with %s\n"),
896 argv
[0], nt_errstr(status
));
900 d_printf(_("Mapped unix group %s to SID %s\n"), argv
[0],
901 sid_string_tos(&map
->sid
));
908 * Remove a group mapping
911 static NTSTATUS
unmap_unix_group(const struct group
*grp
)
913 struct dom_sid dom_sid
;
915 if (!lookup_name(talloc_tos(), grp
->gr_name
, LOOKUP_NAME_LOCAL
,
916 NULL
, NULL
, NULL
, NULL
)) {
917 DEBUG(3, ("\"%s\" does not exist, can't unmap it\n", grp
->gr_name
));
918 return NT_STATUS_NO_SUCH_GROUP
;
921 if (!pdb_gid_to_sid(grp
->gr_gid
, &dom_sid
)) {
922 return NT_STATUS_UNSUCCESSFUL
;
925 return pdb_delete_group_mapping_entry(dom_sid
);
928 static int net_sam_unmapunixgroup(struct net_context
*c
, int argc
, const char **argv
)
933 if (argc
!= 1 || c
->display_usage
) {
934 d_fprintf(stderr
, "%s\n%s",
936 _("net sam unmapunixgroup <name>\n"));
940 grp
= getgrnam(argv
[0]);
942 d_fprintf(stderr
, _("Could not find mapping for group %s.\n"),
947 status
= unmap_unix_group(grp
);
949 if (!NT_STATUS_IS_OK(status
)) {
950 d_fprintf(stderr
, _("Unmapping group %s failed with %s.\n"),
951 argv
[0], nt_errstr(status
));
955 d_printf(_("Unmapped unix group %s.\n"), argv
[0]);
961 * Create a domain group
964 static int net_sam_createdomaingroup(struct net_context
*c
, int argc
,
970 if (argc
!= 1 || c
->display_usage
) {
971 d_fprintf(stderr
, "%s\n%s",
973 _("net sam createdomaingroup <name>\n"));
977 status
= pdb_create_dom_group(talloc_tos(), argv
[0], &rid
);
979 if (!NT_STATUS_IS_OK(status
)) {
980 d_fprintf(stderr
, _("Creating %s failed with %s\n"),
981 argv
[0], nt_errstr(status
));
985 d_printf(_("Created domain group %s with RID %d\n"), argv
[0], rid
);
991 * Delete a domain group
994 static int net_sam_deletedomaingroup(struct net_context
*c
, int argc
,
999 enum lsa_SidType type
;
1000 const char *dom
, *name
;
1003 if (argc
!= 1 || c
->display_usage
) {
1004 d_fprintf(stderr
, "%s\n%s",
1006 _("net sam deletelocalgroup <name>\n"));
1010 if (!lookup_name(talloc_tos(), argv
[0], LOOKUP_NAME_LOCAL
,
1011 &dom
, &name
, &sid
, &type
)) {
1012 d_fprintf(stderr
, _("Could not find %s.\n"), argv
[0]);
1016 if (type
!= SID_NAME_DOM_GRP
) {
1017 d_fprintf(stderr
, _("%s is a %s, not a domain group.\n"),
1018 argv
[0], sid_type_lookup(type
));
1022 sid_peek_rid(&sid
, &rid
);
1024 status
= pdb_delete_dom_group(talloc_tos(), rid
);
1026 if (!NT_STATUS_IS_OK(status
)) {
1027 d_fprintf(stderr
,_("Deleting domain group %s failed with %s\n"),
1028 argv
[0], nt_errstr(status
));
1032 d_printf(_("Deleted domain group %s.\n"), argv
[0]);
1038 * Create a local group
1041 static int net_sam_createlocalgroup(struct net_context
*c
, int argc
, const char **argv
)
1046 if (argc
!= 1 || c
->display_usage
) {
1047 d_fprintf(stderr
, "%s\n%s",
1049 _("net sam createlocalgroup <name>\n"));
1053 if (!winbind_ping()) {
1054 d_fprintf(stderr
, _("winbind seems not to run. "
1055 "createlocalgroup only works when winbind runs.\n"));
1059 status
= pdb_create_alias(argv
[0], &rid
);
1061 if (!NT_STATUS_IS_OK(status
)) {
1062 d_fprintf(stderr
, _("Creating %s failed with %s\n"),
1063 argv
[0], nt_errstr(status
));
1067 d_printf(_("Created local group %s with RID %d\n"), argv
[0], rid
);
1073 * Delete a local group
1076 static int net_sam_deletelocalgroup(struct net_context
*c
, int argc
, const char **argv
)
1079 enum lsa_SidType type
;
1080 const char *dom
, *name
;
1083 if (argc
!= 1 || c
->display_usage
) {
1084 d_fprintf(stderr
, "%s\n%s",
1086 _("net sam deletelocalgroup <name>\n"));
1090 if (!lookup_name(talloc_tos(), argv
[0], LOOKUP_NAME_LOCAL
,
1091 &dom
, &name
, &sid
, &type
)) {
1092 d_fprintf(stderr
,_("Could not find %s.\n"), argv
[0]);
1096 if (type
!= SID_NAME_ALIAS
) {
1097 d_fprintf(stderr
, _("%s is a %s, not a local group.\n"),argv
[0],
1098 sid_type_lookup(type
));
1102 status
= pdb_delete_alias(&sid
);
1104 if (!NT_STATUS_IS_OK(status
)) {
1105 d_fprintf(stderr
, _("Deleting local group %s failed with %s\n"),
1106 argv
[0], nt_errstr(status
));
1110 d_printf(_("Deleted local group %s.\n"), argv
[0]);
1116 * Create a builtin group
1119 static int net_sam_createbuiltingroup(struct net_context
*c
, int argc
, const char **argv
)
1123 enum lsa_SidType type
;
1127 if (argc
!= 1 || c
->display_usage
) {
1128 d_fprintf(stderr
, "%s\n%s",
1130 _("net sam createbuiltingroup <name>\n"));
1134 if (!winbind_ping()) {
1135 d_fprintf(stderr
, _("winbind seems not to run. "
1136 "createbuiltingroup only works when winbind "
1141 /* validate the name and get the group */
1143 fstrcpy( groupname
, "BUILTIN\\" );
1144 fstrcat( groupname
, argv
[0] );
1146 if ( !lookup_name(talloc_tos(), groupname
, LOOKUP_NAME_ALL
, NULL
,
1147 NULL
, &sid
, &type
)) {
1148 d_fprintf(stderr
, _("%s is not a BUILTIN group\n"), argv
[0]);
1152 if ( !sid_peek_rid( &sid
, &rid
) ) {
1153 d_fprintf(stderr
, _("Failed to get RID for %s\n"), argv
[0]);
1157 status
= pdb_create_builtin_alias( rid
);
1159 if (!NT_STATUS_IS_OK(status
)) {
1160 d_fprintf(stderr
, _("Creating %s failed with %s\n"),
1161 argv
[0], nt_errstr(status
));
1165 d_printf(_("Created BUILTIN group %s with RID %d\n"), argv
[0], rid
);
1171 * Add a group member
1174 static int net_sam_addmem(struct net_context
*c
, int argc
, const char **argv
)
1176 const char *groupdomain
, *groupname
, *memberdomain
, *membername
;
1177 struct dom_sid group
, member
;
1178 enum lsa_SidType grouptype
, membertype
;
1181 if (argc
!= 2 || c
->display_usage
) {
1182 d_fprintf(stderr
, "%s\n%s",
1184 _("net sam addmem <group> <member>\n"));
1188 if (!lookup_name(talloc_tos(), argv
[0], LOOKUP_NAME_LOCAL
,
1189 &groupdomain
, &groupname
, &group
, &grouptype
)) {
1190 d_fprintf(stderr
, _("Could not find group %s\n"), argv
[0]);
1194 /* check to see if the member to be added is a name or a SID */
1196 if (!lookup_name(talloc_tos(), argv
[1], LOOKUP_NAME_LOCAL
,
1197 &memberdomain
, &membername
, &member
, &membertype
))
1199 /* try it as a SID */
1201 if ( !string_to_sid( &member
, argv
[1] ) ) {
1202 d_fprintf(stderr
, _("Could not find member %s\n"),
1207 if ( !lookup_sid(talloc_tos(), &member
, &memberdomain
,
1208 &membername
, &membertype
) )
1210 d_fprintf(stderr
, _("Could not resolve SID %s\n"),
1216 if ((grouptype
== SID_NAME_ALIAS
) || (grouptype
== SID_NAME_WKN_GRP
)) {
1217 if ((membertype
!= SID_NAME_USER
) &&
1218 (membertype
!= SID_NAME_DOM_GRP
)) {
1219 d_fprintf(stderr
, _("%s is a local group, only users "
1220 "and domain groups can be added.\n"
1221 "%s is a %s\n"), argv
[0], argv
[1],
1222 sid_type_lookup(membertype
));
1225 status
= pdb_add_aliasmem(&group
, &member
);
1227 if (!NT_STATUS_IS_OK(status
)) {
1228 d_fprintf(stderr
, _("Adding local group member failed "
1229 "with %s\n"), nt_errstr(status
));
1232 } else if (grouptype
== SID_NAME_DOM_GRP
) {
1233 uint32_t grouprid
, memberrid
;
1235 sid_peek_rid(&group
, &grouprid
);
1236 sid_peek_rid(&member
, &memberrid
);
1238 status
= pdb_add_groupmem(talloc_tos(), grouprid
, memberrid
);
1239 if (!NT_STATUS_IS_OK(status
)) {
1240 d_fprintf(stderr
, _("Adding domain group member failed "
1241 "with %s\n"), nt_errstr(status
));
1245 d_fprintf(stderr
, _("Can only add members to local groups so "
1246 "far, %s is a %s\n"), argv
[0],
1247 sid_type_lookup(grouptype
));
1251 d_printf(_("Added %s\\%s to %s\\%s\n"), memberdomain
, membername
,
1252 groupdomain
, groupname
);
1258 * Delete a group member
1261 static int net_sam_delmem(struct net_context
*c
, int argc
, const char **argv
)
1263 const char *groupdomain
, *groupname
;
1264 const char *memberdomain
= NULL
;
1265 const char *membername
= NULL
;
1266 struct dom_sid group
, member
;
1267 enum lsa_SidType grouptype
;
1270 if (argc
!= 2 || c
->display_usage
) {
1271 d_fprintf(stderr
,"%s\n%s",
1273 _("net sam delmem <group> <member>\n"));
1277 if (!lookup_name(talloc_tos(), argv
[0], LOOKUP_NAME_LOCAL
,
1278 &groupdomain
, &groupname
, &group
, &grouptype
)) {
1279 d_fprintf(stderr
, _("Could not find group %s\n"), argv
[0]);
1283 if (!lookup_name(talloc_tos(), argv
[1], LOOKUP_NAME_LOCAL
,
1284 &memberdomain
, &membername
, &member
, NULL
)) {
1285 if (!string_to_sid(&member
, argv
[1])) {
1286 d_fprintf(stderr
, _("Could not find member %s\n"),
1292 if ((grouptype
== SID_NAME_ALIAS
) ||
1293 (grouptype
== SID_NAME_WKN_GRP
)) {
1294 status
= pdb_del_aliasmem(&group
, &member
);
1296 if (!NT_STATUS_IS_OK(status
)) {
1297 d_fprintf(stderr
,_("Deleting local group member failed "
1298 "with %s\n"), nt_errstr(status
));
1301 } else if (grouptype
== SID_NAME_DOM_GRP
) {
1302 uint32_t grouprid
, memberrid
;
1304 sid_peek_rid(&group
, &grouprid
);
1305 sid_peek_rid(&member
, &memberrid
);
1307 status
= pdb_del_groupmem(talloc_tos(), grouprid
, memberrid
);
1308 if (!NT_STATUS_IS_OK(status
)) {
1309 d_fprintf(stderr
, _("Deleting domain group member "
1310 "failed with %s\n"), nt_errstr(status
));
1314 d_fprintf(stderr
, _("Can only delete members from local groups "
1315 "so far, %s is a %s\n"), argv
[0],
1316 sid_type_lookup(grouptype
));
1320 if (membername
!= NULL
) {
1321 d_printf(_("Deleted %s\\%s from %s\\%s\n"),
1322 memberdomain
, membername
, groupdomain
, groupname
);
1324 d_printf(_("Deleted %s from %s\\%s\n"),
1325 sid_string_tos(&member
), groupdomain
, groupname
);
1332 * List group members
1335 static int net_sam_listmem(struct net_context
*c
, int argc
, const char **argv
)
1337 const char *groupdomain
, *groupname
;
1338 struct dom_sid group
;
1339 struct dom_sid
*members
= NULL
;
1340 size_t i
, num_members
= 0;
1341 enum lsa_SidType grouptype
;
1344 if (argc
!= 1 || c
->display_usage
) {
1345 d_fprintf(stderr
, "%s\n%s",
1347 _("net sam listmem <group>\n"));
1351 if (!lookup_name(talloc_tos(), argv
[0], LOOKUP_NAME_LOCAL
,
1352 &groupdomain
, &groupname
, &group
, &grouptype
)) {
1353 d_fprintf(stderr
, _("Could not find group %s\n"), argv
[0]);
1357 if ((grouptype
== SID_NAME_ALIAS
) ||
1358 (grouptype
== SID_NAME_WKN_GRP
)) {
1359 status
= pdb_enum_aliasmem(&group
, talloc_tos(), &members
,
1361 if (!NT_STATUS_IS_OK(status
)) {
1362 d_fprintf(stderr
, _("Listing group members failed with "
1363 "%s\n"), nt_errstr(status
));
1366 } else if (grouptype
== SID_NAME_DOM_GRP
) {
1369 status
= pdb_enum_group_members(talloc_tos(), &group
,
1370 &rids
, &num_members
);
1371 if (!NT_STATUS_IS_OK(status
)) {
1372 d_fprintf(stderr
, _("Listing group members failed with "
1373 "%s\n"), nt_errstr(status
));
1377 members
= talloc_array(talloc_tos(), struct dom_sid
,
1379 if (members
== NULL
) {
1384 for (i
=0; i
<num_members
; i
++) {
1385 sid_compose(&members
[i
], get_global_sam_sid(),
1390 d_fprintf(stderr
,_("Can only list local group members so far.\n"
1391 "%s is a %s\n"), argv
[0], sid_type_lookup(grouptype
));
1395 d_printf(_("%s\\%s has %u members\n"), groupdomain
, groupname
,
1396 (unsigned int)num_members
);
1397 for (i
=0; i
<num_members
; i
++) {
1398 const char *dom
, *name
;
1399 if (lookup_sid(talloc_tos(), &members
[i
], &dom
, &name
, NULL
)) {
1400 d_printf(" %s\\%s\n", dom
, name
);
1402 d_printf(" %s\n", sid_string_tos(&members
[i
]));
1406 TALLOC_FREE(members
);
1414 static int net_sam_do_list(struct net_context
*c
, int argc
, const char **argv
,
1415 struct pdb_search
*search
, const char *what
)
1417 bool verbose
= (argc
== 1);
1419 if ((argc
> 1) || c
->display_usage
||
1420 ((argc
== 1) && !strequal(argv
[0], "verbose"))) {
1421 d_fprintf(stderr
, "%s\n", _("Usage:"));
1422 d_fprintf(stderr
, _("net sam list %s [verbose]\n"), what
);
1426 if (search
== NULL
) {
1427 d_fprintf(stderr
, _("Could not start search\n"));
1432 struct samr_displayentry entry
;
1433 if (!search
->next_entry(search
, &entry
)) {
1437 d_printf("%s:%d:%s\n",
1442 d_printf("%s\n", entry
.account_name
);
1446 TALLOC_FREE(search
);
1450 static int net_sam_list_users(struct net_context
*c
, int argc
,
1453 return net_sam_do_list(c
, argc
, argv
,
1454 pdb_search_users(talloc_tos(), ACB_NORMAL
),
1458 static int net_sam_list_groups(struct net_context
*c
, int argc
,
1461 return net_sam_do_list(c
, argc
, argv
, pdb_search_groups(talloc_tos()),
1465 static int net_sam_list_localgroups(struct net_context
*c
, int argc
,
1468 return net_sam_do_list(c
, argc
, argv
,
1469 pdb_search_aliases(talloc_tos(),
1470 get_global_sam_sid()),
1474 static int net_sam_list_builtin(struct net_context
*c
, int argc
,
1477 return net_sam_do_list(c
, argc
, argv
,
1478 pdb_search_aliases(talloc_tos(),
1479 &global_sid_Builtin
),
1483 static int net_sam_list_workstations(struct net_context
*c
, int argc
,
1486 return net_sam_do_list(c
, argc
, argv
,
1487 pdb_search_users(talloc_tos(), ACB_WSTRUST
),
1495 static int net_sam_list(struct net_context
*c
, int argc
, const char **argv
)
1497 struct functable func
[] = {
1501 NET_TRANSPORT_LOCAL
,
1502 N_("List SAM users"),
1503 N_("net sam list users\n"
1508 net_sam_list_groups
,
1509 NET_TRANSPORT_LOCAL
,
1510 N_("List SAM groups"),
1511 N_("net sam list groups\n"
1516 net_sam_list_localgroups
,
1517 NET_TRANSPORT_LOCAL
,
1518 N_("List SAM local groups"),
1519 N_("net sam list localgroups\n"
1520 " List SAM local groups")
1524 net_sam_list_builtin
,
1525 NET_TRANSPORT_LOCAL
,
1526 N_("List builtin groups"),
1527 N_("net sam list builtin\n"
1528 " List builtin groups")
1532 net_sam_list_workstations
,
1533 NET_TRANSPORT_LOCAL
,
1534 N_("List domain member workstations"),
1535 N_("net sam list workstations\n"
1536 " List domain member workstations")
1538 {NULL
, NULL
, 0, NULL
, NULL
}
1541 return net_run_function(c
, argc
, argv
, "net sam list", func
);
1545 * Show details of SAM entries
1548 static int net_sam_show(struct net_context
*c
, int argc
, const char **argv
)
1551 enum lsa_SidType type
;
1552 const char *dom
, *name
;
1554 if (argc
!= 1 || c
->display_usage
) {
1555 d_fprintf(stderr
, "%s\n%s",
1557 _("net sam show <name>\n"));
1561 if (!lookup_name(talloc_tos(), argv
[0], LOOKUP_NAME_LOCAL
,
1562 &dom
, &name
, &sid
, &type
)) {
1563 d_fprintf(stderr
, _("Could not find name %s\n"), argv
[0]);
1567 d_printf(_("%s\\%s is a %s with SID %s\n"), dom
, name
,
1568 sid_type_lookup(type
), sid_string_tos(&sid
));
1576 * Init an LDAP tree with default users and Groups
1577 * if ldapsam:editposix is enabled
1580 static int net_sam_provision(struct net_context
*c
, int argc
, const char **argv
)
1584 char *ldap_uri
= NULL
;
1586 struct smbldap_state
*state
= NULL
;
1587 GROUP_MAP
*gmap
= NULL
;
1588 struct dom_sid gsid
;
1589 gid_t domusers_gid
= -1;
1590 gid_t domadmins_gid
= -1;
1591 struct samu
*samuser
;
1593 bool is_ipa
= false;
1595 if (c
->display_usage
) {
1597 "net sam provision\n"
1600 _("Init an LDAP tree with default users/groups"));
1604 tc
= talloc_new(NULL
);
1606 d_fprintf(stderr
, _("Out of Memory!\n"));
1610 if ((ldap_bk
= talloc_strdup(tc
, lp_passdb_backend())) == NULL
) {
1611 d_fprintf(stderr
, _("talloc failed\n"));
1615 p
= strchr(ldap_bk
, ':');
1618 ldap_uri
= talloc_strdup(tc
, p
+1);
1619 trim_char(ldap_uri
, ' ', ' ');
1622 trim_char(ldap_bk
, ' ', ' ');
1624 if (strcmp(ldap_bk
, "IPA_ldapsam") == 0 ) {
1628 if (strcmp(ldap_bk
, "ldapsam") != 0 && !is_ipa
) {
1630 _("Provisioning works only with ldapsam backend\n"));
1634 if (!lp_parm_bool(-1, "ldapsam", "trusted", false) ||
1635 !lp_parm_bool(-1, "ldapsam", "editposix", false)) {
1637 d_fprintf(stderr
, _("Provisioning works only if ldapsam:trusted"
1638 " and ldapsam:editposix are enabled.\n"));
1642 if (!is_ipa
&& !winbind_ping()) {
1643 d_fprintf(stderr
, _("winbind seems not to run. Provisioning "
1644 "LDAP only works when winbind runs.\n"));
1648 if (!NT_STATUS_IS_OK(smbldap_init(tc
, NULL
, ldap_uri
, &state
))) {
1649 d_fprintf(stderr
, _("Unable to connect to the LDAP server.\n"));
1653 d_printf(_("Checking for Domain Users group.\n"));
1655 sid_compose(&gsid
, get_global_sam_sid(), DOMAIN_RID_USERS
);
1657 gmap
= talloc_zero(tc
, GROUP_MAP
);
1659 d_printf(_("Out of memory!\n"));
1663 if (!pdb_getgrsid(gmap
, gsid
)) {
1664 LDAPMod
**mods
= NULL
;
1672 d_printf(_("Adding the Domain Users group.\n"));
1674 /* lets allocate a new groupid for this group */
1678 if (!winbind_allocate_gid(&domusers_gid
)) {
1679 d_fprintf(stderr
, _("Unable to allocate a new gid to "
1680 "create Domain Users group!\n"));
1685 uname
= talloc_strdup(tc
, "domusers");
1686 wname
= talloc_strdup(tc
, "Domain Users");
1687 dn
= talloc_asprintf(tc
, "cn=%s,%s", "domusers", lp_ldap_group_suffix());
1688 gidstr
= talloc_asprintf(tc
, "%u", (unsigned int)domusers_gid
);
1689 gtype
= talloc_asprintf(tc
, "%d", SID_NAME_DOM_GRP
);
1691 if (!uname
|| !wname
|| !dn
|| !gidstr
|| !gtype
) {
1692 d_fprintf(stderr
, "Out of Memory!\n");
1696 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", LDAP_OBJ_POSIXGROUP
);
1697 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", LDAP_OBJ_GROUPMAP
);
1699 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "groupofnames");
1700 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "nestedgroup");
1701 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "ipausergroup");
1703 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "cn", uname
);
1704 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "displayName", wname
);
1705 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "gidNumber", gidstr
);
1706 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "sambaSid",
1707 sid_string_talloc(tc
, &gsid
));
1708 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "sambaGroupType", gtype
);
1710 talloc_autofree_ldapmod(tc
, mods
);
1712 rc
= smbldap_add(state
, dn
, mods
);
1714 if (rc
!= LDAP_SUCCESS
) {
1715 d_fprintf(stderr
, _("Failed to add Domain Users group "
1716 "to ldap directory\n"));
1720 if (!pdb_getgrsid(gmap
, gsid
)) {
1721 d_fprintf(stderr
, _("Failed to read just "
1722 "created domain group.\n"));
1725 domusers_gid
= gmap
->gid
;
1729 domusers_gid
= gmap
->gid
;
1730 d_printf(_("found!\n"));
1735 d_printf(_("Checking for Domain Admins group.\n"));
1737 sid_compose(&gsid
, get_global_sam_sid(), DOMAIN_RID_ADMINS
);
1739 if (!pdb_getgrsid(gmap
, gsid
)) {
1740 LDAPMod
**mods
= NULL
;
1748 d_printf(_("Adding the Domain Admins group.\n"));
1750 /* lets allocate a new groupid for this group */
1752 domadmins_gid
= 999;
1754 if (!winbind_allocate_gid(&domadmins_gid
)) {
1755 d_fprintf(stderr
, _("Unable to allocate a new gid to "
1756 "create Domain Admins group!\n"));
1761 uname
= talloc_strdup(tc
, "domadmins");
1762 wname
= talloc_strdup(tc
, "Domain Admins");
1763 dn
= talloc_asprintf(tc
, "cn=%s,%s", "domadmins", lp_ldap_group_suffix());
1764 gidstr
= talloc_asprintf(tc
, "%u", (unsigned int)domadmins_gid
);
1765 gtype
= talloc_asprintf(tc
, "%d", SID_NAME_DOM_GRP
);
1767 if (!uname
|| !wname
|| !dn
|| !gidstr
|| !gtype
) {
1768 d_fprintf(stderr
, _("Out of Memory!\n"));
1772 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", LDAP_OBJ_POSIXGROUP
);
1773 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", LDAP_OBJ_GROUPMAP
);
1775 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "groupofnames");
1776 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "nestedgroup");
1777 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "ipausergroup");
1779 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "cn", uname
);
1780 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "displayName", wname
);
1781 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "gidNumber", gidstr
);
1782 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "sambaSid",
1783 sid_string_talloc(tc
, &gsid
));
1784 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "sambaGroupType", gtype
);
1786 talloc_autofree_ldapmod(tc
, mods
);
1788 rc
= smbldap_add(state
, dn
, mods
);
1790 if (rc
!= LDAP_SUCCESS
) {
1791 d_fprintf(stderr
, _("Failed to add Domain Admins group "
1792 "to ldap directory\n"));
1796 if (!pdb_getgrsid(gmap
, gsid
)) {
1797 d_fprintf(stderr
, _("Failed to read just "
1798 "created domain group.\n"));
1801 domadmins_gid
= gmap
->gid
;
1805 domadmins_gid
= gmap
->gid
;
1806 d_printf(_("found!\n"));
1811 d_printf(_("Check for Administrator account.\n"));
1813 samuser
= samu_new(tc
);
1815 d_fprintf(stderr
, _("Out of Memory!\n"));
1819 if (!pdb_getsampwnam(samuser
, "Administrator")) {
1820 LDAPMod
**mods
= NULL
;
1832 d_printf(_("Adding the Administrator user.\n"));
1834 if (domadmins_gid
== -1) {
1836 _("Can't create Administrator user, Domain "
1837 "Admins group not available!\n"));
1844 if (!winbind_allocate_uid(&uid
)) {
1846 _("Unable to allocate a new uid to create "
1847 "the Administrator user!\n"));
1852 name
= talloc_strdup(tc
, "Administrator");
1853 dn
= talloc_asprintf(tc
, "uid=Administrator,%s", lp_ldap_user_suffix());
1854 uidstr
= talloc_asprintf(tc
, "%u", (unsigned int)uid
);
1855 gidstr
= talloc_asprintf(tc
, "%u", (unsigned int)domadmins_gid
);
1856 dir
= talloc_sub_specified(tc
, lp_template_homedir(),
1858 get_global_sam_name(),
1859 uid
, domadmins_gid
);
1860 shell
= talloc_sub_specified(tc
, lp_template_shell(),
1862 get_global_sam_name(),
1863 uid
, domadmins_gid
);
1865 if (!name
|| !dn
|| !uidstr
|| !gidstr
|| !dir
|| !shell
) {
1866 d_fprintf(stderr
, _("Out of Memory!\n"));
1870 sid_compose(&sid
, get_global_sam_sid(), DOMAIN_RID_ADMINISTRATOR
);
1872 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", LDAP_OBJ_ACCOUNT
);
1873 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", LDAP_OBJ_POSIXACCOUNT
);
1874 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", LDAP_OBJ_SAMBASAMACCOUNT
);
1876 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "person");
1877 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "organizationalperson");
1878 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "inetorgperson");
1879 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "inetuser");
1880 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "krbprincipalaux");
1881 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "krbticketpolicyaux");
1882 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "sn", name
);
1883 princ
= talloc_asprintf(tc
, "%s@%s", name
, lp_realm());
1885 d_fprintf(stderr
, _("Out of Memory!\n"));
1888 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "krbPrincipalName", princ
);
1890 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "uid", name
);
1891 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "cn", name
);
1892 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "displayName", name
);
1893 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "uidNumber", uidstr
);
1894 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "gidNumber", gidstr
);
1895 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "homeDirectory", dir
);
1896 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "loginShell", shell
);
1897 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "sambaSID",
1898 sid_string_talloc(tc
, &sid
));
1899 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "sambaAcctFlags",
1900 pdb_encode_acct_ctrl(ACB_NORMAL
|ACB_DISABLED
,
1901 NEW_PW_FORMAT_SPACE_PADDED_LEN
));
1903 talloc_autofree_ldapmod(tc
, mods
);
1905 rc
= smbldap_add(state
, dn
, mods
);
1907 if (rc
!= LDAP_SUCCESS
) {
1908 d_fprintf(stderr
, _("Failed to add Administrator user "
1909 "to ldap directory\n"));
1913 if (!pdb_getsampwnam(samuser
, "Administrator")) {
1914 d_fprintf(stderr
, _("Failed to read just "
1915 "created user.\n"));
1920 d_printf(_("found!\n"));
1923 d_printf(_("Checking for Guest user.\n"));
1925 samuser
= samu_new(tc
);
1927 d_fprintf(stderr
, _("Out of Memory!\n"));
1931 if (!pdb_getsampwnam(samuser
, lp_guestaccount())) {
1932 LDAPMod
**mods
= NULL
;
1939 d_printf(_("Adding the Guest user.\n"));
1941 sid_compose(&sid
, get_global_sam_sid(), DOMAIN_RID_GUEST
);
1943 pwd
= Get_Pwnam_alloc(tc
, lp_guestaccount());
1946 if (domusers_gid
== -1) {
1948 _("Can't create Guest user, Domain "
1949 "Users group not available!\n"));
1952 if ((pwd
= talloc(tc
, struct passwd
)) == NULL
) {
1953 d_fprintf(stderr
, _("talloc failed\n"));
1956 pwd
->pw_name
= talloc_strdup(pwd
, lp_guestaccount());
1961 if (!winbind_allocate_uid(&(pwd
->pw_uid
))) {
1963 _("Unable to allocate a new uid to "
1964 "create the Guest user!\n"));
1968 pwd
->pw_gid
= domusers_gid
;
1969 pwd
->pw_dir
= talloc_strdup(tc
, "/");
1970 pwd
->pw_shell
= talloc_strdup(tc
, "/bin/false");
1971 if (!pwd
->pw_dir
|| !pwd
->pw_shell
) {
1972 d_fprintf(stderr
, _("Out of Memory!\n"));
1977 dn
= talloc_asprintf(tc
, "uid=%s,%s", pwd
->pw_name
, lp_ldap_user_suffix ());
1978 uidstr
= talloc_asprintf(tc
, "%u", (unsigned int)pwd
->pw_uid
);
1979 gidstr
= talloc_asprintf(tc
, "%u", (unsigned int)pwd
->pw_gid
);
1980 if (!dn
|| !uidstr
|| !gidstr
) {
1981 d_fprintf(stderr
, _("Out of Memory!\n"));
1985 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", LDAP_OBJ_ACCOUNT
);
1986 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", LDAP_OBJ_POSIXACCOUNT
);
1987 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", LDAP_OBJ_SAMBASAMACCOUNT
);
1989 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "person");
1990 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "organizationalperson");
1991 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "inetorgperson");
1992 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "inetuser");
1993 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "krbprincipalaux");
1994 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "krbticketpolicyaux");
1995 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "sn", pwd
->pw_name
);
1997 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "uid", pwd
->pw_name
);
1998 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "cn", pwd
->pw_name
);
1999 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "displayName", pwd
->pw_name
);
2000 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "uidNumber", uidstr
);
2001 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "gidNumber", gidstr
);
2002 if ((pwd
->pw_dir
!= NULL
) && (pwd
->pw_dir
[0] != '\0')) {
2003 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "homeDirectory", pwd
->pw_dir
);
2005 if ((pwd
->pw_shell
!= NULL
) && (pwd
->pw_shell
[0] != '\0')) {
2006 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "loginShell", pwd
->pw_shell
);
2008 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "sambaSID",
2009 sid_string_talloc(tc
, &sid
));
2010 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "sambaAcctFlags",
2011 pdb_encode_acct_ctrl(ACB_NORMAL
|ACB_DISABLED
,
2012 NEW_PW_FORMAT_SPACE_PADDED_LEN
));
2014 talloc_autofree_ldapmod(tc
, mods
);
2016 rc
= smbldap_add(state
, dn
, mods
);
2018 if (rc
!= LDAP_SUCCESS
) {
2019 d_fprintf(stderr
, _("Failed to add Guest user to "
2020 "ldap directory\n"));
2024 if (!pdb_getsampwnam(samuser
, lp_guestaccount())) {
2025 d_fprintf(stderr
, _("Failed to read just "
2026 "created user.\n"));
2031 d_printf(_("found!\n"));
2034 d_printf(_("Checking Guest's group.\n"));
2036 pwd
= Get_Pwnam_alloc(tc
, lp_guestaccount());
2039 _("Failed to find just created Guest account!\n"
2040 " Is nss properly configured?!\n"));
2044 if (pwd
->pw_gid
== domusers_gid
) {
2045 d_printf(_("found!\n"));
2049 if (!pdb_getgrgid(gmap
, pwd
->pw_gid
)) {
2050 LDAPMod
**mods
= NULL
;
2058 d_printf(_("Adding the Domain Guests group.\n"));
2060 uname
= talloc_strdup(tc
, "domguests");
2061 wname
= talloc_strdup(tc
, "Domain Guests");
2062 dn
= talloc_asprintf(tc
, "cn=%s,%s", "domguests", lp_ldap_group_suffix());
2063 gidstr
= talloc_asprintf(tc
, "%u", (unsigned int)pwd
->pw_gid
);
2064 gtype
= talloc_asprintf(tc
, "%d", SID_NAME_DOM_GRP
);
2066 if (!uname
|| !wname
|| !dn
|| !gidstr
|| !gtype
) {
2067 d_fprintf(stderr
, _("Out of Memory!\n"));
2071 sid_compose(&gsid
, get_global_sam_sid(), DOMAIN_RID_GUESTS
);
2073 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", LDAP_OBJ_POSIXGROUP
);
2074 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", LDAP_OBJ_GROUPMAP
);
2076 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "groupofnames");
2077 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "nestedgroup");
2078 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", "ipausergroup");
2080 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "cn", uname
);
2081 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "displayName", wname
);
2082 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "gidNumber", gidstr
);
2083 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "sambaSid",
2084 sid_string_talloc(tc
, &gsid
));
2085 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "sambaGroupType", gtype
);
2087 talloc_autofree_ldapmod(tc
, mods
);
2089 rc
= smbldap_add(state
, dn
, mods
);
2091 if (rc
!= LDAP_SUCCESS
) {
2093 _("Failed to add Domain Guests group to ldap "
2097 d_printf(_("found!\n"));
2112 /***********************************************************
2113 migrated functionality from smbgroupedit
2114 **********************************************************/
2115 int net_sam(struct net_context
*c
, int argc
, const char **argv
)
2117 struct functable func
[] = {
2119 "createbuiltingroup",
2120 net_sam_createbuiltingroup
,
2121 NET_TRANSPORT_LOCAL
,
2122 N_("Create a new BUILTIN group"),
2123 N_("net sam createbuiltingroup\n"
2124 " Create a new BUILTIN group")
2128 net_sam_createlocalgroup
,
2129 NET_TRANSPORT_LOCAL
,
2130 N_("Create a new local group"),
2131 N_("net sam createlocalgroup\n"
2132 " Create a new local group")
2135 "createdomaingroup",
2136 net_sam_createdomaingroup
,
2137 NET_TRANSPORT_LOCAL
,
2138 N_("Create a new group"),
2139 N_("net sam createdomaingroup\n"
2140 " Create a new group")
2144 net_sam_deletelocalgroup
,
2145 NET_TRANSPORT_LOCAL
,
2146 N_("Delete an existing local group"),
2147 N_("net sam deletelocalgroup\n"
2148 " Delete an existing local group")
2151 "deletedomaingroup",
2152 net_sam_deletedomaingroup
,
2153 NET_TRANSPORT_LOCAL
,
2154 N_("Delete a domain group"),
2155 N_("net sam deletedomaingroup\n"
2160 net_sam_mapunixgroup
,
2161 NET_TRANSPORT_LOCAL
,
2162 N_("Map a unix group to a domain group"),
2163 N_("net sam mapunixgroup\n"
2164 " Map a unix group to a domain group")
2168 net_sam_unmapunixgroup
,
2169 NET_TRANSPORT_LOCAL
,
2170 N_("Remove a group mapping of an unix group to a "
2172 N_("net sam unmapunixgroup\n"
2173 " Remove a group mapping of an unix group to a "
2179 NET_TRANSPORT_LOCAL
,
2180 N_("Add a member to a group"),
2181 N_("net sam addmem\n"
2182 " Add a member to a group")
2187 NET_TRANSPORT_LOCAL
,
2188 N_("Delete a member from a group"),
2189 N_("net sam delmem\n"
2190 " Delete a member from a group")
2195 NET_TRANSPORT_LOCAL
,
2196 N_("List group members"),
2197 N_("net sam listmem\n"
2198 " List group members")
2203 NET_TRANSPORT_LOCAL
,
2204 N_("List users, groups and local groups"),
2206 " List users, groups and local groups")
2211 NET_TRANSPORT_LOCAL
,
2212 N_("Show details of a SAM entry"),
2214 " Show details of a SAM entry")
2219 NET_TRANSPORT_LOCAL
,
2220 N_("Set details of a SAM account"),
2222 " Set details of a SAM account")
2227 NET_TRANSPORT_LOCAL
,
2228 N_("Set account policies"),
2229 N_("net sam policy\n"
2230 " Set account policies")
2235 NET_TRANSPORT_LOCAL
,
2236 N_("Manipulate user privileges"),
2237 N_("net sam rights\n"
2238 " Manipulate user privileges")
2244 NET_TRANSPORT_LOCAL
,
2245 N_("Provision a clean user database"),
2246 N_("net sam privison\n"
2247 " Provision a clear user database")
2250 {NULL
, NULL
, 0, NULL
, NULL
}
2253 if (getuid() != 0) {
2254 d_fprintf(stderr
, _("You are not root, most things won't "
2258 return net_run_function(c
, argc
, argv
, "net sam", func
);