?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
pyldb: Fix memory context, add more OOM checks.
[Samba.git] / source3 / utils / net_ads.c
blob48df56479232c89639d90193e04ee21107d3757c
1 /*
2 Samba Unix/Linux SMB client library
3 net ads commands
4 Copyright (C) 2001 Andrew Tridgell (tridge@samba.org)
5 Copyright (C) 2001 Remus Koos (remuskoos@yahoo.com)
6 Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
7 Copyright (C) 2006 Gerald (Jerry) Carter (jerry@samba.org)
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "utils/net.h"
25 #include "librpc/gen_ndr/ndr_krb5pac.h"
26 #include "../librpc/gen_ndr/cli_spoolss.h"
27 #include "nsswitch/libwbclient/wbclient.h"
28 #include "ads.h"
29 #include "libads/cldap.h"
30 #include "libads/dns.h"
31 #include "../libds/common/flags.h"
32 #include "librpc/gen_ndr/libnet_join.h"
33 #include "libnet/libnet_join.h"
34 #include "smb_krb5.h"
35 #include "secrets.h"
36 #include "krb5_env.h"
37 #include "../libcli/security/security.h"
38
39 #ifdef HAVE_ADS
40
41 /* when we do not have sufficient input parameters to contact a remote domain
42 * we always fall back to our own realm - Guenther*/
43
44 static const char *assume_own_realm(struct net_context *c)
45 {
46 if (!c->opt_host && strequal(lp_workgroup(), c->opt_target_workgroup)) {
47 return lp_realm();
48 }
49
50 return NULL;
51 }
52
53 /*
54 do a cldap netlogon query
55 */
56 static int net_ads_cldap_netlogon(struct net_context *c, ADS_STRUCT *ads)
57 {
58 char addr[INET6_ADDRSTRLEN];
59 struct NETLOGON_SAM_LOGON_RESPONSE_EX reply;
60
61 print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
62 if ( !ads_cldap_netlogon_5(talloc_tos(), addr, ads->server.realm, &reply ) ) {
63 d_fprintf(stderr, _("CLDAP query failed!\n"));
64 return -1;
65 }
66
67 d_printf(_("Information for Domain Controller: %s\n\n"),
68 addr);
69
70 d_printf(_("Response Type: "));
71 switch (reply.command) {
72 case LOGON_SAM_LOGON_USER_UNKNOWN_EX:
73 d_printf("LOGON_SAM_LOGON_USER_UNKNOWN_EX\n");
74 break;
75 case LOGON_SAM_LOGON_RESPONSE_EX:
76 d_printf("LOGON_SAM_LOGON_RESPONSE_EX\n");
77 break;
78 default:
79 d_printf("0x%x\n", reply.command);
80 break;
81 }
82
83 d_printf(_("GUID: %s\n"), GUID_string(talloc_tos(),&reply.domain_uuid));
84
85 d_printf(_("Flags:\n"
86 "\tIs a PDC: %s\n"
87 "\tIs a GC of the forest: %s\n"
88 "\tIs an LDAP server: %s\n"
89 "\tSupports DS: %s\n"
90 "\tIs running a KDC: %s\n"
91 "\tIs running time services: %s\n"
92 "\tIs the closest DC: %s\n"
93 "\tIs writable: %s\n"
94 "\tHas a hardware clock: %s\n"
95 "\tIs a non-domain NC serviced by LDAP server: %s\n"
96 "\tIs NT6 DC that has some secrets: %s\n"
97 "\tIs NT6 DC that has all secrets: %s\n"),
98 (reply.server_type & NBT_SERVER_PDC) ? _("yes") : _("no"),
99 (reply.server_type & NBT_SERVER_GC) ? _("yes") : _("no"),
100 (reply.server_type & NBT_SERVER_LDAP) ? _("yes") : _("no"),
101 (reply.server_type & NBT_SERVER_DS) ? _("yes") : _("no"),
102 (reply.server_type & NBT_SERVER_KDC) ? _("yes") : _("no"),
103 (reply.server_type & NBT_SERVER_TIMESERV) ? _("yes") : _("no"),
104 (reply.server_type & NBT_SERVER_CLOSEST) ? _("yes") : _("no"),
105 (reply.server_type & NBT_SERVER_WRITABLE) ? _("yes") : _("no"),
106 (reply.server_type & NBT_SERVER_GOOD_TIMESERV) ? _("yes") : _("no"),
107 (reply.server_type & NBT_SERVER_NDNC) ? _("yes") : _("no"),
108 (reply.server_type & NBT_SERVER_SELECT_SECRET_DOMAIN_6) ? _("yes") : _("no"),
109 (reply.server_type & NBT_SERVER_FULL_SECRET_DOMAIN_6) ? _("yes") : _("no"));
110
111
112 printf(_("Forest:\t\t\t%s\n"), reply.forest);
113 printf(_("Domain:\t\t\t%s\n"), reply.dns_domain);
114 printf(_("Domain Controller:\t%s\n"), reply.pdc_dns_name);
115
116 printf(_("Pre-Win2k Domain:\t%s\n"), reply.domain_name);
117 printf(_("Pre-Win2k Hostname:\t%s\n"), reply.pdc_name);
118
119 if (*reply.user_name) printf(_("User name:\t%s\n"), reply.user_name);
120
121 printf(_("Server Site Name :\t\t%s\n"), reply.server_site);
122 printf(_("Client Site Name :\t\t%s\n"), reply.client_site);
123
124 d_printf(_("NT Version: %d\n"), reply.nt_version);
125 d_printf(_("LMNT Token: %.2x\n"), reply.lmnt_token);
126 d_printf(_("LM20 Token: %.2x\n"), reply.lm20_token);
127
128 return 0;
129 }
130
131 /*
132 this implements the CLDAP based netlogon lookup requests
133 for finding the domain controller of a ADS domain
134 */
135 static int net_ads_lookup(struct net_context *c, int argc, const char **argv)
136 {
137 ADS_STRUCT *ads;
138 int ret;
139
140 if (c->display_usage) {
141 d_printf("%s\n"
142 "net ads lookup\n"
143 " %s",
144 _("Usage:"),
145 _("Find the ADS DC using CLDAP lookup.\n"));
146 return 0;
147 }
148
149 if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
150 d_fprintf(stderr, _("Didn't find the cldap server!\n"));
151 ads_destroy(&ads);
152 return -1;
153 }
154
155 if (!ads->config.realm) {
156 ads->config.realm = CONST_DISCARD(char *, c->opt_target_workgroup);
157 ads->ldap.port = 389;
158 }
159
160 ret = net_ads_cldap_netlogon(c, ads);
161 ads_destroy(&ads);
162 return ret;
163 }
164
165
166
167 static int net_ads_info(struct net_context *c, int argc, const char **argv)
168 {
169 ADS_STRUCT *ads;
170 char addr[INET6_ADDRSTRLEN];
171
172 if (c->display_usage) {
173 d_printf("%s\n"
174 "net ads info\n"
175 " %s",
176 _("Usage:"),
177 _("Display information about an Active Directory "
178 "server.\n"));
179 return 0;
180 }
181
182 if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
183 d_fprintf(stderr, _("Didn't find the ldap server!\n"));
184 return -1;
185 }
186
187 if (!ads || !ads->config.realm) {
188 d_fprintf(stderr, _("Didn't find the ldap server!\n"));
189 ads_destroy(&ads);
190 return -1;
191 }
192
193 /* Try to set the server's current time since we didn't do a full
194 TCP LDAP session initially */
195
196 if ( !ADS_ERR_OK(ads_current_time( ads )) ) {
197 d_fprintf( stderr, _("Failed to get server's current time!\n"));
198 }
199
200 print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
201
202 d_printf(_("LDAP server: %s\n"), addr);
203 d_printf(_("LDAP server name: %s\n"), ads->config.ldap_server_name);
204 d_printf(_("Realm: %s\n"), ads->config.realm);
205 d_printf(_("Bind Path: %s\n"), ads->config.bind_path);
206 d_printf(_("LDAP port: %d\n"), ads->ldap.port);
207 d_printf(_("Server time: %s\n"),
208 http_timestring(talloc_tos(), ads->config.current_time));
209
210 d_printf(_("KDC server: %s\n"), ads->auth.kdc_server );
211 d_printf(_("Server time offset: %d\n"), ads->auth.time_offset );
212
213 ads_destroy(&ads);
214 return 0;
215 }
216
217 static void use_in_memory_ccache(void) {
218 /* Use in-memory credentials cache so we do not interfere with
219 * existing credentials */
220 setenv(KRB5_ENV_CCNAME, "MEMORY:net_ads", 1);
221 }
222
223 static ADS_STATUS ads_startup_int(struct net_context *c, bool only_own_domain,
224 uint32 auth_flags, ADS_STRUCT **ads_ret)
225 {
226 ADS_STRUCT *ads = NULL;
227 ADS_STATUS status;
228 bool need_password = false;
229 bool second_time = false;
230 char *cp;
231 const char *realm = NULL;
232 bool tried_closest_dc = false;
233
234 /* lp_realm() should be handled by a command line param,
235 However, the join requires that realm be set in smb.conf
236 and compares our realm with the remote server's so this is
237 ok until someone needs more flexibility */
238
239 *ads_ret = NULL;
240
241 retry_connect:
242 if (only_own_domain) {
243 realm = lp_realm();
244 } else {
245 realm = assume_own_realm(c);
246 }
247
248 ads = ads_init(realm, c->opt_target_workgroup, c->opt_host);
249
250 if (!c->opt_user_name) {
251 c->opt_user_name = "administrator";
252 }
253
254 if (c->opt_user_specified) {
255 need_password = true;
256 }
257
258 retry:
259 if (!c->opt_password && need_password && !c->opt_machine_pass) {
260 c->opt_password = net_prompt_pass(c, c->opt_user_name);
261 if (!c->opt_password) {
262 ads_destroy(&ads);
263 return ADS_ERROR(LDAP_NO_MEMORY);
264 }
265 }
266
267 if (c->opt_password) {
268 use_in_memory_ccache();
269 SAFE_FREE(ads->auth.password);
270 ads->auth.password = smb_xstrdup(c->opt_password);
271 }
272
273 ads->auth.flags |= auth_flags;
274 SAFE_FREE(ads->auth.user_name);
275 ads->auth.user_name = smb_xstrdup(c->opt_user_name);
276
277 /*
278 * If the username is of the form "name@realm",
279 * extract the realm and convert to upper case.
280 * This is only used to establish the connection.
281 */
282 if ((cp = strchr_m(ads->auth.user_name, '@'))!=0) {
283 *cp++ = '\0';
284 SAFE_FREE(ads->auth.realm);
285 ads->auth.realm = smb_xstrdup(cp);
286 strupper_m(ads->auth.realm);
287 }
288
289 status = ads_connect(ads);
290
291 if (!ADS_ERR_OK(status)) {
292
293 if (NT_STATUS_EQUAL(ads_ntstatus(status),
294 NT_STATUS_NO_LOGON_SERVERS)) {
295 DEBUG(0,("ads_connect: %s\n", ads_errstr(status)));
296 ads_destroy(&ads);
297 return status;
298 }
299
300 if (!need_password && !second_time && !(auth_flags & ADS_AUTH_NO_BIND)) {
301 need_password = true;
302 second_time = true;
303 goto retry;
304 } else {
305 ads_destroy(&ads);
306 return status;
307 }
308 }
309
310 /* when contacting our own domain, make sure we use the closest DC.
311 * This is done by reconnecting to ADS because only the first call to
312 * ads_connect will give us our own sitename */
313
314 if ((only_own_domain || !c->opt_host) && !tried_closest_dc) {
315
316 tried_closest_dc = true; /* avoid loop */
317
318 if (!ads_closest_dc(ads)) {
319
320 namecache_delete(ads->server.realm, 0x1C);
321 namecache_delete(ads->server.workgroup, 0x1C);
322
323 ads_destroy(&ads);
324 ads = NULL;
325
326 goto retry_connect;
327 }
328 }
329
330 *ads_ret = ads;
331 return status;
332 }
333
334 ADS_STATUS ads_startup(struct net_context *c, bool only_own_domain, ADS_STRUCT **ads)
335 {
336 return ads_startup_int(c, only_own_domain, 0, ads);
337 }
338
339 ADS_STATUS ads_startup_nobind(struct net_context *c, bool only_own_domain, ADS_STRUCT **ads)
340 {
341 return ads_startup_int(c, only_own_domain, ADS_AUTH_NO_BIND, ads);
342 }
343
344 /*
345 Check to see if connection can be made via ads.
346 ads_startup() stores the password in opt_password if it needs to so
347 that rpc or rap can use it without re-prompting.
348 */
349 static int net_ads_check_int(const char *realm, const char *workgroup, const char *host)
350 {
351 ADS_STRUCT *ads;
352 ADS_STATUS status;
353
354 if ( (ads = ads_init( realm, workgroup, host )) == NULL ) {
355 return -1;
356 }
357
358 ads->auth.flags |= ADS_AUTH_NO_BIND;
359
360 status = ads_connect(ads);
361 if ( !ADS_ERR_OK(status) ) {
362 return -1;
363 }
364
365 ads_destroy(&ads);
366 return 0;
367 }
368
369 int net_ads_check_our_domain(struct net_context *c)
370 {
371 return net_ads_check_int(lp_realm(), lp_workgroup(), NULL);
372 }
373
374 int net_ads_check(struct net_context *c)
375 {
376 return net_ads_check_int(NULL, c->opt_workgroup, c->opt_host);
377 }
378
379 /*
380 determine the netbios workgroup name for a domain
381 */
382 static int net_ads_workgroup(struct net_context *c, int argc, const char **argv)
383 {
384 ADS_STRUCT *ads;
385 char addr[INET6_ADDRSTRLEN];
386 struct NETLOGON_SAM_LOGON_RESPONSE_EX reply;
387
388 if (c->display_usage) {
389 d_printf ("%s\n"
390 "net ads workgroup\n"
391 " %s\n",
392 _("Usage:"),
393 _("Print the workgroup name"));
394 return 0;
395 }
396
397 if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
398 d_fprintf(stderr, _("Didn't find the cldap server!\n"));
399 return -1;
400 }
401
402 if (!ads->config.realm) {
403 ads->config.realm = CONST_DISCARD(char *, c->opt_target_workgroup);
404 ads->ldap.port = 389;
405 }
406
407 print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
408 if ( !ads_cldap_netlogon_5(talloc_tos(), addr, ads->server.realm, &reply ) ) {
409 d_fprintf(stderr, _("CLDAP query failed!\n"));
410 ads_destroy(&ads);
411 return -1;
412 }
413
414 d_printf(_("Workgroup: %s\n"), reply.domain_name);
415
416 ads_destroy(&ads);
417
418 return 0;
419 }
420
421
422
423 static bool usergrp_display(ADS_STRUCT *ads, char *field, void **values, void *data_area)
424 {
425 char **disp_fields = (char **) data_area;
426
427 if (!field) { /* must be end of record */
428 if (disp_fields[0]) {
429 if (!strchr_m(disp_fields[0], '$')) {
430 if (disp_fields[1])
431 d_printf("%-21.21s %s\n",
432 disp_fields[0], disp_fields[1]);
433 else
434 d_printf("%s\n", disp_fields[0]);
435 }
436 }
437 SAFE_FREE(disp_fields[0]);
438 SAFE_FREE(disp_fields[1]);
439 return true;
440 }
441 if (!values) /* must be new field, indicate string field */
442 return true;
443 if (StrCaseCmp(field, "sAMAccountName") == 0) {
444 disp_fields[0] = SMB_STRDUP((char *) values[0]);
445 }
446 if (StrCaseCmp(field, "description") == 0)
447 disp_fields[1] = SMB_STRDUP((char *) values[0]);
448 return true;
449 }
450
451 static int net_ads_user_usage(struct net_context *c, int argc, const char **argv)
452 {
453 return net_user_usage(c, argc, argv);
454 }
455
456 static int ads_user_add(struct net_context *c, int argc, const char **argv)
457 {
458 ADS_STRUCT *ads;
459 ADS_STATUS status;
460 char *upn, *userdn;
461 LDAPMessage *res=NULL;
462 int rc = -1;
463 char *ou_str = NULL;
464
465 if (argc < 1 || c->display_usage)
466 return net_ads_user_usage(c, argc, argv);
467
468 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
469 return -1;
470 }
471
472 status = ads_find_user_acct(ads, &res, argv[0]);
473
474 if (!ADS_ERR_OK(status)) {
475 d_fprintf(stderr, _("ads_user_add: %s\n"), ads_errstr(status));
476 goto done;
477 }
478
479 if (ads_count_replies(ads, res)) {
480 d_fprintf(stderr, _("ads_user_add: User %s already exists\n"),
481 argv[0]);
482 goto done;
483 }
484
485 if (c->opt_container) {
486 ou_str = SMB_STRDUP(c->opt_container);
487 } else {
488 ou_str = ads_default_ou_string(ads, DS_GUID_USERS_CONTAINER);
489 }
490
491 status = ads_add_user_acct(ads, argv[0], ou_str, c->opt_comment);
492
493 if (!ADS_ERR_OK(status)) {
494 d_fprintf(stderr, _("Could not add user %s: %s\n"), argv[0],
495 ads_errstr(status));
496 goto done;
497 }
498
499 /* if no password is to be set, we're done */
500 if (argc == 1) {
501 d_printf(_("User %s added\n"), argv[0]);
502 rc = 0;
503 goto done;
504 }
505
506 /* try setting the password */
507 if (asprintf(&upn, "%s@%s", argv[0], ads->config.realm) == -1) {
508 goto done;
509 }
510 status = ads_krb5_set_password(ads->auth.kdc_server, upn, argv[1],
511 ads->auth.time_offset);
512 SAFE_FREE(upn);
513 if (ADS_ERR_OK(status)) {
514 d_printf(_("User %s added\n"), argv[0]);
515 rc = 0;
516 goto done;
517 }
518
519 /* password didn't set, delete account */
520 d_fprintf(stderr, _("Could not add user %s. "
521 "Error setting password %s\n"),
522 argv[0], ads_errstr(status));
523 ads_msgfree(ads, res);
524 status=ads_find_user_acct(ads, &res, argv[0]);
525 if (ADS_ERR_OK(status)) {
526 userdn = ads_get_dn(ads, talloc_tos(), res);
527 ads_del_dn(ads, userdn);
528 TALLOC_FREE(userdn);
529 }
530
531 done:
532 if (res)
533 ads_msgfree(ads, res);
534 ads_destroy(&ads);
535 SAFE_FREE(ou_str);
536 return rc;
537 }
538
539 static int ads_user_info(struct net_context *c, int argc, const char **argv)
540 {
541 ADS_STRUCT *ads = NULL;
542 ADS_STATUS rc;
543 LDAPMessage *res = NULL;
544 TALLOC_CTX *frame;
545 int ret = 0;
546 wbcErr wbc_status;
547 const char *attrs[] = {"memberOf", "primaryGroupID", NULL};
548 char *searchstring=NULL;
549 char **grouplist;
550 char *primary_group;
551 char *escaped_user;
552 struct dom_sid primary_group_sid;
553 uint32_t group_rid;
554 enum wbcSidType type;
555
556 if (argc < 1 || c->display_usage) {
557 return net_ads_user_usage(c, argc, argv);
558 }
559
560 frame = talloc_new(talloc_tos());
561 if (frame == NULL) {
562 return -1;
563 }
564
565 escaped_user = escape_ldap_string(frame, argv[0]);
566 if (!escaped_user) {
567 d_fprintf(stderr,
568 _("ads_user_info: failed to escape user %s\n"),
569 argv[0]);
570 return -1;
571 }
572
573 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
574 ret = -1;
575 goto error;
576 }
577
578 if (asprintf(&searchstring, "(sAMAccountName=%s)", escaped_user) == -1) {
579 ret =-1;
580 goto error;
581 }
582 rc = ads_search(ads, &res, searchstring, attrs);
583 SAFE_FREE(searchstring);
584
585 if (!ADS_ERR_OK(rc)) {
586 d_fprintf(stderr, _("ads_search: %s\n"), ads_errstr(rc));
587 ret = -1;
588 goto error;
589 }
590
591 if (!ads_pull_uint32(ads, res, "primaryGroupID", &group_rid)) {
592 d_fprintf(stderr, _("ads_pull_uint32 failed\n"));
593 ret = -1;
594 goto error;
595 }
596
597 rc = ads_domain_sid(ads, &primary_group_sid);
598 if (!ADS_ERR_OK(rc)) {
599 d_fprintf(stderr, _("ads_domain_sid: %s\n"), ads_errstr(rc));
600 ret = -1;
601 goto error;
602 }
603
604 sid_append_rid(&primary_group_sid, group_rid);
605
606 wbc_status = wbcLookupSid((struct wbcDomainSid *)&primary_group_sid,
607 NULL, /* don't look up domain */
608 &primary_group,
609 &type);
610 if (!WBC_ERROR_IS_OK(wbc_status)) {
611 d_fprintf(stderr, "wbcLookupSid: %s\n",
612 wbcErrorString(wbc_status));
613 ret = -1;
614 goto error;
615 }
616
617 d_printf("%s\n", primary_group);
618
619 wbcFreeMemory(primary_group);
620
621 grouplist = ldap_get_values((LDAP *)ads->ldap.ld,
622 (LDAPMessage *)res, "memberOf");
623
624 if (grouplist) {
625 int i;
626 char **groupname;
627 for (i=0;grouplist[i];i++) {
628 groupname = ldap_explode_dn(grouplist[i], 1);
629 d_printf("%s\n", groupname[0]);
630 ldap_value_free(groupname);
631 }
632 ldap_value_free(grouplist);
633 }
634
635 error:
636 if (res) ads_msgfree(ads, res);
637 if (ads) ads_destroy(&ads);
638 TALLOC_FREE(frame);
639 return ret;
640 }
641
642 static int ads_user_delete(struct net_context *c, int argc, const char **argv)
643 {
644 ADS_STRUCT *ads;
645 ADS_STATUS rc;
646 LDAPMessage *res = NULL;
647 char *userdn;
648
649 if (argc < 1) {
650 return net_ads_user_usage(c, argc, argv);
651 }
652
653 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
654 return -1;
655 }
656
657 rc = ads_find_user_acct(ads, &res, argv[0]);
658 if (!ADS_ERR_OK(rc) || ads_count_replies(ads, res) != 1) {
659 d_printf(_("User %s does not exist.\n"), argv[0]);
660 ads_msgfree(ads, res);
661 ads_destroy(&ads);
662 return -1;
663 }
664 userdn = ads_get_dn(ads, talloc_tos(), res);
665 ads_msgfree(ads, res);
666 rc = ads_del_dn(ads, userdn);
667 TALLOC_FREE(userdn);
668 if (ADS_ERR_OK(rc)) {
669 d_printf(_("User %s deleted\n"), argv[0]);
670 ads_destroy(&ads);
671 return 0;
672 }
673 d_fprintf(stderr, _("Error deleting user %s: %s\n"), argv[0],
674 ads_errstr(rc));
675 ads_destroy(&ads);
676 return -1;
677 }
678
679 int net_ads_user(struct net_context *c, int argc, const char **argv)
680 {
681 struct functable func[] = {
682 {
683 "add",
684 ads_user_add,
685 NET_TRANSPORT_ADS,
686 N_("Add an AD user"),
687 N_("net ads user add\n"
688 " Add an AD user")
689 },
690 {
691 "info",
692 ads_user_info,
693 NET_TRANSPORT_ADS,
694 N_("Display information about an AD user"),
695 N_("net ads user info\n"
696 " Display information about an AD user")
697 },
698 {
699 "delete",
700 ads_user_delete,
701 NET_TRANSPORT_ADS,
702 N_("Delete an AD user"),
703 N_("net ads user delete\n"
704 " Delete an AD user")
705 },
706 {NULL, NULL, 0, NULL, NULL}
707 };
708 ADS_STRUCT *ads;
709 ADS_STATUS rc;
710 const char *shortattrs[] = {"sAMAccountName", NULL};
711 const char *longattrs[] = {"sAMAccountName", "description", NULL};
712 char *disp_fields[2] = {NULL, NULL};
713
714 if (argc == 0) {
715 if (c->display_usage) {
716 d_printf( "%s\n"
717 "net ads user\n"
718 " %s\n",
719 _("Usage:"),
720 _("List AD users"));
721 net_display_usage_from_functable(func);
722 return 0;
723 }
724
725 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
726 return -1;
727 }
728
729 if (c->opt_long_list_entries)
730 d_printf(_("\nUser name Comment"
731 "\n-----------------------------\n"));
732
733 rc = ads_do_search_all_fn(ads, ads->config.bind_path,
734 LDAP_SCOPE_SUBTREE,
735 "(objectCategory=user)",
736 c->opt_long_list_entries ? longattrs :
737 shortattrs, usergrp_display,
738 disp_fields);
739 ads_destroy(&ads);
740 return ADS_ERR_OK(rc) ? 0 : -1;
741 }
742
743 return net_run_function(c, argc, argv, "net ads user", func);
744 }
745
746 static int net_ads_group_usage(struct net_context *c, int argc, const char **argv)
747 {
748 return net_group_usage(c, argc, argv);
749 }
750
751 static int ads_group_add(struct net_context *c, int argc, const char **argv)
752 {
753 ADS_STRUCT *ads;
754 ADS_STATUS status;
755 LDAPMessage *res=NULL;
756 int rc = -1;
757 char *ou_str = NULL;
758
759 if (argc < 1 || c->display_usage) {
760 return net_ads_group_usage(c, argc, argv);
761 }
762
763 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
764 return -1;
765 }
766
767 status = ads_find_user_acct(ads, &res, argv[0]);
768
769 if (!ADS_ERR_OK(status)) {
770 d_fprintf(stderr, _("ads_group_add: %s\n"), ads_errstr(status));
771 goto done;
772 }
773
774 if (ads_count_replies(ads, res)) {
775 d_fprintf(stderr, _("ads_group_add: Group %s already exists\n"), argv[0]);
776 goto done;
777 }
778
779 if (c->opt_container) {
780 ou_str = SMB_STRDUP(c->opt_container);
781 } else {
782 ou_str = ads_default_ou_string(ads, DS_GUID_USERS_CONTAINER);
783 }
784
785 status = ads_add_group_acct(ads, argv[0], ou_str, c->opt_comment);
786
787 if (ADS_ERR_OK(status)) {
788 d_printf(_("Group %s added\n"), argv[0]);
789 rc = 0;
790 } else {
791 d_fprintf(stderr, _("Could not add group %s: %s\n"), argv[0],
792 ads_errstr(status));
793 }
794
795 done:
796 if (res)
797 ads_msgfree(ads, res);
798 ads_destroy(&ads);
799 SAFE_FREE(ou_str);
800 return rc;
801 }
802
803 static int ads_group_delete(struct net_context *c, int argc, const char **argv)
804 {
805 ADS_STRUCT *ads;
806 ADS_STATUS rc;
807 LDAPMessage *res = NULL;
808 char *groupdn;
809
810 if (argc < 1 || c->display_usage) {
811 return net_ads_group_usage(c, argc, argv);
812 }
813
814 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
815 return -1;
816 }
817
818 rc = ads_find_user_acct(ads, &res, argv[0]);
819 if (!ADS_ERR_OK(rc) || ads_count_replies(ads, res) != 1) {
820 d_printf(_("Group %s does not exist.\n"), argv[0]);
821 ads_msgfree(ads, res);
822 ads_destroy(&ads);
823 return -1;
824 }
825 groupdn = ads_get_dn(ads, talloc_tos(), res);
826 ads_msgfree(ads, res);
827 rc = ads_del_dn(ads, groupdn);
828 TALLOC_FREE(groupdn);
829 if (ADS_ERR_OK(rc)) {
830 d_printf(_("Group %s deleted\n"), argv[0]);
831 ads_destroy(&ads);
832 return 0;
833 }
834 d_fprintf(stderr, _("Error deleting group %s: %s\n"), argv[0],
835 ads_errstr(rc));
836 ads_destroy(&ads);
837 return -1;
838 }
839
840 int net_ads_group(struct net_context *c, int argc, const char **argv)
841 {
842 struct functable func[] = {
843 {
844 "add",
845 ads_group_add,
846 NET_TRANSPORT_ADS,
847 N_("Add an AD group"),
848 N_("net ads group add\n"
849 " Add an AD group")
850 },
851 {
852 "delete",
853 ads_group_delete,
854 NET_TRANSPORT_ADS,
855 N_("Delete an AD group"),
856 N_("net ads group delete\n"
857 " Delete an AD group")
858 },
859 {NULL, NULL, 0, NULL, NULL}
860 };
861 ADS_STRUCT *ads;
862 ADS_STATUS rc;
863 const char *shortattrs[] = {"sAMAccountName", NULL};
864 const char *longattrs[] = {"sAMAccountName", "description", NULL};
865 char *disp_fields[2] = {NULL, NULL};
866
867 if (argc == 0) {
868 if (c->display_usage) {
869 d_printf( "%s\n"
870 "net ads group\n"
871 " %s\n",
872 _("Usage:"),
873 _("List AD groups"));
874 net_display_usage_from_functable(func);
875 return 0;
876 }
877
878 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
879 return -1;
880 }
881
882 if (c->opt_long_list_entries)
883 d_printf(_("\nGroup name Comment"
884 "\n-----------------------------\n"));
885 rc = ads_do_search_all_fn(ads, ads->config.bind_path,
886 LDAP_SCOPE_SUBTREE,
887 "(objectCategory=group)",
888 c->opt_long_list_entries ? longattrs :
889 shortattrs, usergrp_display,
890 disp_fields);
891
892 ads_destroy(&ads);
893 return ADS_ERR_OK(rc) ? 0 : -1;
894 }
895 return net_run_function(c, argc, argv, "net ads group", func);
896 }
897
898 static int net_ads_status(struct net_context *c, int argc, const char **argv)
899 {
900 ADS_STRUCT *ads;
901 ADS_STATUS rc;
902 LDAPMessage *res;
903
904 if (c->display_usage) {
905 d_printf( "%s\n"
906 "net ads status\n"
907 " %s\n",
908 _("Usage:"),
909 _("Display machine account details"));
910 return 0;
911 }
912
913 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
914 return -1;
915 }
916
917 rc = ads_find_machine_acct(ads, &res, global_myname());
918 if (!ADS_ERR_OK(rc)) {
919 d_fprintf(stderr, _("ads_find_machine_acct: %s\n"), ads_errstr(rc));
920 ads_destroy(&ads);
921 return -1;
922 }
923
924 if (ads_count_replies(ads, res) == 0) {
925 d_fprintf(stderr, _("No machine account for '%s' found\n"), global_myname());
926 ads_destroy(&ads);
927 return -1;
928 }
929
930 ads_dump(ads, res);
931 ads_destroy(&ads);
932 return 0;
933 }
934
935 /*******************************************************************
936 Leave an AD domain. Windows XP disables the machine account.
937 We'll try the same. The old code would do an LDAP delete.
938 That only worked using the machine creds because added the machine
939 with full control to the computer object's ACL.
940 *******************************************************************/
941
942 static int net_ads_leave(struct net_context *c, int argc, const char **argv)
943 {
944 TALLOC_CTX *ctx;
945 struct libnet_UnjoinCtx *r = NULL;
946 WERROR werr;
947
948 if (c->display_usage) {
949 d_printf( "%s\n"
950 "net ads leave\n"
951 " %s\n",
952 _("Usage:"),
953 _("Leave an AD domain"));
954 return 0;
955 }
956
957 if (!*lp_realm()) {
958 d_fprintf(stderr, _("No realm set, are we joined ?\n"));
959 return -1;
960 }
961
962 if (!(ctx = talloc_init("net_ads_leave"))) {
963 d_fprintf(stderr, _("Could not initialise talloc context.\n"));
964 return -1;
965 }
966
967 if (!c->opt_kerberos) {
968 use_in_memory_ccache();
969 }
970
971 if (!c->msg_ctx) {
972 d_fprintf(stderr, _("Could not initialise message context. "
973 "Try running as root\n"));
974 return -1;
975 }
976
977 werr = libnet_init_UnjoinCtx(ctx, &r);
978 if (!W_ERROR_IS_OK(werr)) {
979 d_fprintf(stderr, _("Could not initialise unjoin context.\n"));
980 return -1;
981 }
982
983 r->in.debug = true;
984 r->in.use_kerberos = c->opt_kerberos;
985 r->in.dc_name = c->opt_host;
986 r->in.domain_name = lp_realm();
987 r->in.admin_account = c->opt_user_name;
988 r->in.admin_password = net_prompt_pass(c, c->opt_user_name);
989 r->in.modify_config = lp_config_backend_is_registry();
990
991 /* Try to delete it, but if that fails, disable it. The
992 WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE really means "disable */
993 r->in.unjoin_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
994 WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
995 r->in.delete_machine_account = true;
996 r->in.msg_ctx = c->msg_ctx;
997
998 werr = libnet_Unjoin(ctx, r);
999 if (!W_ERROR_IS_OK(werr)) {
1000 d_printf(_("Failed to leave domain: %s\n"),
1001 r->out.error_string ? r->out.error_string :
1002 get_friendly_werror_msg(werr));
1003 goto done;
1004 }
1005
1006 if (r->out.deleted_machine_account) {
1007 d_printf(_("Deleted account for '%s' in realm '%s'\n"),
1008 r->in.machine_name, r->out.dns_domain_name);
1009 goto done;
1010 }
1011
1012 /* We couldn't delete it - see if the disable succeeded. */
1013 if (r->out.disabled_machine_account) {
1014 d_printf(_("Disabled account for '%s' in realm '%s'\n"),
1015 r->in.machine_name, r->out.dns_domain_name);
1016 werr = WERR_OK;
1017 goto done;
1018 }
1019
1020 /* Based on what we requseted, we shouldn't get here, but if
1021 we did, it means the secrets were removed, and therefore
1022 we have left the domain */
1023 d_fprintf(stderr, _("Machine '%s' Left domain '%s'\n"),
1024 r->in.machine_name, r->out.dns_domain_name);
1025
1026 done:
1027 TALLOC_FREE(r);
1028 TALLOC_FREE(ctx);
1029
1030 if (W_ERROR_IS_OK(werr)) {
1031 return 0;
1032 }
1033
1034 return -1;
1035 }
1036
1037 static NTSTATUS net_ads_join_ok(struct net_context *c)
1038 {
1039 ADS_STRUCT *ads = NULL;
1040 ADS_STATUS status;
1041 fstring dc_name;
1042 struct sockaddr_storage dcip;
1043
1044 if (!secrets_init()) {
1045 DEBUG(1,("Failed to initialise secrets database\n"));
1046 return NT_STATUS_ACCESS_DENIED;
1047 }
1048
1049 net_use_krb_machine_account(c);
1050
1051 get_dc_name(lp_workgroup(), lp_realm(), dc_name, &dcip);
1052
1053 status = ads_startup(c, true, &ads);
1054 if (!ADS_ERR_OK(status)) {
1055 return ads_ntstatus(status);
1056 }
1057
1058 ads_destroy(&ads);
1059 return NT_STATUS_OK;
1060 }
1061
1062 /*
1063 check that an existing join is OK
1064 */
1065 int net_ads_testjoin(struct net_context *c, int argc, const char **argv)
1066 {
1067 NTSTATUS status;
1068 use_in_memory_ccache();
1069
1070 if (c->display_usage) {
1071 d_printf( "%s\n"
1072 "net ads testjoin\n"
1073 " %s\n",
1074 _("Usage:"),
1075 _("Test if the existing join is ok"));
1076 return 0;
1077 }
1078
1079 /* Display success or failure */
1080 status = net_ads_join_ok(c);
1081 if (!NT_STATUS_IS_OK(status)) {
1082 fprintf(stderr, _("Join to domain is not valid: %s\n"),
1083 get_friendly_nt_error_msg(status));
1084 return -1;
1085 }
1086
1087 printf(_("Join is OK\n"));
1088 return 0;
1089 }
1090
1091 /*******************************************************************
1092 Simple configu checks before beginning the join
1093 ********************************************************************/
1094
1095 static WERROR check_ads_config( void )
1096 {
1097 if (lp_server_role() != ROLE_DOMAIN_MEMBER ) {
1098 d_printf(_("Host is not configured as a member server.\n"));
1099 return WERR_INVALID_DOMAIN_ROLE;
1100 }
1101
1102 if (strlen(global_myname()) > 15) {
1103 d_printf(_("Our netbios name can be at most 15 chars long, "
1104 "\"%s\" is %u chars long\n"), global_myname(),
1105 (unsigned int)strlen(global_myname()));
1106 return WERR_INVALID_COMPUTERNAME;
1107 }
1108
1109 if ( lp_security() == SEC_ADS && !*lp_realm()) {
1110 d_fprintf(stderr, _("realm must be set in in %s for ADS "
1111 "join to succeed.\n"), get_dyn_CONFIGFILE());
1112 return WERR_INVALID_PARAM;
1113 }
1114
1115 return WERR_OK;
1116 }
1117
1118 /*******************************************************************
1119 Send a DNS update request
1120 *******************************************************************/
1121
1122 #if defined(WITH_DNS_UPDATES)
1123 #include "dns.h"
1124 DNS_ERROR DoDNSUpdate(char *pszServerName,
1125 const char *pszDomainName, const char *pszHostName,
1126 const struct sockaddr_storage *sslist,
1127 size_t num_addrs );
1128
1129 static NTSTATUS net_update_dns_internal(TALLOC_CTX *ctx, ADS_STRUCT *ads,
1130 const char *machine_name,
1131 const struct sockaddr_storage *addrs,
1132 int num_addrs)
1133 {
1134 struct dns_rr_ns *nameservers = NULL;
1135 int ns_count = 0;
1136 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
1137 DNS_ERROR dns_err;
1138 fstring dns_server;
1139 const char *dnsdomain = NULL;
1140 char *root_domain = NULL;
1141
1142 if ( (dnsdomain = strchr_m( machine_name, '.')) == NULL ) {
1143 d_printf(_("No DNS domain configured for %s. "
1144 "Unable to perform DNS Update.\n"), machine_name);
1145 status = NT_STATUS_INVALID_PARAMETER;
1146 goto done;
1147 }
1148 dnsdomain++;
1149
1150 status = ads_dns_lookup_ns( ctx, dnsdomain, &nameservers, &ns_count );
1151 if ( !NT_STATUS_IS_OK(status) || (ns_count == 0)) {
1152 /* Child domains often do not have NS records. Look
1153 for the NS record for the forest root domain
1154 (rootDomainNamingContext in therootDSE) */
1155
1156 const char *rootname_attrs[] = { "rootDomainNamingContext", NULL };
1157 LDAPMessage *msg = NULL;
1158 char *root_dn;
1159 ADS_STATUS ads_status;
1160
1161 if ( !ads->ldap.ld ) {
1162 ads_status = ads_connect( ads );
1163 if ( !ADS_ERR_OK(ads_status) ) {
1164 DEBUG(0,("net_update_dns_internal: Failed to connect to our DC!\n"));
1165 goto done;
1166 }
1167 }
1168
1169 ads_status = ads_do_search(ads, "", LDAP_SCOPE_BASE,
1170 "(objectclass=*)", rootname_attrs, &msg);
1171 if (!ADS_ERR_OK(ads_status)) {
1172 goto done;
1173 }
1174
1175 root_dn = ads_pull_string(ads, ctx, msg, "rootDomainNamingContext");
1176 if ( !root_dn ) {
1177 ads_msgfree( ads, msg );
1178 goto done;
1179 }
1180
1181 root_domain = ads_build_domain( root_dn );
1182
1183 /* cleanup */
1184 ads_msgfree( ads, msg );
1185
1186 /* try again for NS servers */
1187
1188 status = ads_dns_lookup_ns( ctx, root_domain, &nameservers, &ns_count );
1189
1190 if ( !NT_STATUS_IS_OK(status) || (ns_count == 0)) {
1191 DEBUG(3,("net_ads_join: Failed to find name server for the %s "
1192 "realm\n", ads->config.realm));
1193 goto done;
1194 }
1195
1196 dnsdomain = root_domain;
1197
1198 }
1199
1200 /* Now perform the dns update - we'll try non-secure and if we fail,
1201 we'll follow it up with a secure update */
1202
1203 fstrcpy( dns_server, nameservers[0].hostname );
1204
1205 dns_err = DoDNSUpdate(dns_server, dnsdomain, machine_name, addrs, num_addrs);
1206 if (!ERR_DNS_IS_OK(dns_err)) {
1207 d_printf(_("DNS Update for %s failed: %s\n"),
1208 machine_name, dns_errstr(dns_err));
1209 status = NT_STATUS_UNSUCCESSFUL;
1210 }
1211
1212 done:
1213
1214 SAFE_FREE( root_domain );
1215
1216 return status;
1217 }
1218
1219 static NTSTATUS net_update_dns_ext(TALLOC_CTX *mem_ctx, ADS_STRUCT *ads,
1220 const char *hostname,
1221 struct sockaddr_storage *iplist,
1222 int num_addrs)
1223 {
1224 struct sockaddr_storage *iplist_alloc = NULL;
1225 fstring machine_name;
1226 NTSTATUS status;
1227
1228 if (hostname) {
1229 fstrcpy(machine_name, hostname);
1230 } else {
1231 name_to_fqdn( machine_name, global_myname() );
1232 }
1233 strlower_m( machine_name );
1234
1235 if (num_addrs == 0 || iplist == NULL) {
1236 /*
1237 * Get our ip address
1238 * (not the 127.0.0.x address but a real ip address)
1239 */
1240 num_addrs = get_my_ip_address(&iplist_alloc);
1241 if ( num_addrs <= 0 ) {
1242 DEBUG(4, ("net_update_dns_ext: Failed to find my "
1243 "non-loopback IP addresses!\n"));
1244 return NT_STATUS_INVALID_PARAMETER;
1245 }
1246 iplist = iplist_alloc;
1247 }
1248
1249 status = net_update_dns_internal(mem_ctx, ads, machine_name,
1250 iplist, num_addrs);
1251
1252 SAFE_FREE(iplist_alloc);
1253 return status;
1254 }
1255
1256 static NTSTATUS net_update_dns(TALLOC_CTX *mem_ctx, ADS_STRUCT *ads, const char *hostname)
1257 {
1258 NTSTATUS status;
1259
1260 status = net_update_dns_ext(mem_ctx, ads, hostname, NULL, 0);
1261 return status;
1262 }
1263 #endif
1264
1265
1266 /*******************************************************************
1267 ********************************************************************/
1268
1269 static int net_ads_join_usage(struct net_context *c, int argc, const char **argv)
1270 {
1271 d_printf(_("net ads join [options]\n"
1272 "Valid options:\n"));
1273 d_printf(_(" createupn[=UPN] Set the userPrincipalName attribute during the join.\n"
1274 " The deault UPN is in the form host/netbiosname@REALM.\n"));
1275 d_printf(_(" createcomputer=OU Precreate the computer account in a specific OU.\n"
1276 " The OU string read from top to bottom without RDNs and delimited by a '/'.\n"
1277 " E.g. \"createcomputer=Computers/Servers/Unix\"\n"
1278 " NB: A backslash '\\' is used as escape at multiple levels and may\n"
1279 " need to be doubled or even quadrupled. It is not used as a separator.\n"));
1280 d_printf(_(" osName=string Set the operatingSystem attribute during the join.\n"));
1281 d_printf(_(" osVer=string Set the operatingSystemVersion attribute during the join.\n"
1282 " NB: osName and osVer must be specified together for either to take effect.\n"
1283 " Also, the operatingSystemService attribute is also set when along with\n"
1284 " the two other attributes.\n"));
1285
1286 return -1;
1287 }
1288
1289 /*******************************************************************
1290 ********************************************************************/
1291
1292 int net_ads_join(struct net_context *c, int argc, const char **argv)
1293 {
1294 TALLOC_CTX *ctx = NULL;
1295 struct libnet_JoinCtx *r = NULL;
1296 const char *domain = lp_realm();
1297 WERROR werr = WERR_SETUP_NOT_JOINED;
1298 bool createupn = false;
1299 const char *machineupn = NULL;
1300 const char *create_in_ou = NULL;
1301 int i;
1302 const char *os_name = NULL;
1303 const char *os_version = NULL;
1304 bool modify_config = lp_config_backend_is_registry();
1305
1306 if (c->display_usage)
1307 return net_ads_join_usage(c, argc, argv);
1308
1309 if (!modify_config) {
1310
1311 werr = check_ads_config();
1312 if (!W_ERROR_IS_OK(werr)) {
1313 d_fprintf(stderr, _("Invalid configuration. Exiting....\n"));
1314 goto fail;
1315 }
1316 }
1317
1318 if (!(ctx = talloc_init("net_ads_join"))) {
1319 d_fprintf(stderr, _("Could not initialise talloc context.\n"));
1320 werr = WERR_NOMEM;
1321 goto fail;
1322 }
1323
1324 if (!c->opt_kerberos) {
1325 use_in_memory_ccache();
1326 }
1327
1328 werr = libnet_init_JoinCtx(ctx, &r);
1329 if (!W_ERROR_IS_OK(werr)) {
1330 goto fail;
1331 }
1332
1333 /* process additional command line args */
1334
1335 for ( i=0; i<argc; i++ ) {
1336 if ( !StrnCaseCmp(argv[i], "createupn", strlen("createupn")) ) {
1337 createupn = true;
1338 machineupn = get_string_param(argv[i]);
1339 }
1340 else if ( !StrnCaseCmp(argv[i], "createcomputer", strlen("createcomputer")) ) {
1341 if ( (create_in_ou = get_string_param(argv[i])) == NULL ) {
1342 d_fprintf(stderr, _("Please supply a valid OU path.\n"));
1343 werr = WERR_INVALID_PARAM;
1344 goto fail;
1345 }
1346 }
1347 else if ( !StrnCaseCmp(argv[i], "osName", strlen("osName")) ) {
1348 if ( (os_name = get_string_param(argv[i])) == NULL ) {
1349 d_fprintf(stderr, _("Please supply a operating system name.\n"));
1350 werr = WERR_INVALID_PARAM;
1351 goto fail;
1352 }
1353 }
1354 else if ( !StrnCaseCmp(argv[i], "osVer", strlen("osVer")) ) {
1355 if ( (os_version = get_string_param(argv[i])) == NULL ) {
1356 d_fprintf(stderr, _("Please supply a valid operating system version.\n"));
1357 werr = WERR_INVALID_PARAM;
1358 goto fail;
1359 }
1360 }
1361 else {
1362 domain = argv[i];
1363 }
1364 }
1365
1366 if (!*domain) {
1367 d_fprintf(stderr, _("Please supply a valid domain name\n"));
1368 werr = WERR_INVALID_PARAM;
1369 goto fail;
1370 }
1371
1372 if (!c->msg_ctx) {
1373 d_fprintf(stderr, _("Could not initialise message context. "
1374 "Try running as root\n"));
1375 werr = WERR_ACCESS_DENIED;
1376 goto fail;
1377 }
1378
1379 /* Do the domain join here */
1380
1381 r->in.domain_name = domain;
1382 r->in.create_upn = createupn;
1383 r->in.upn = machineupn;
1384 r->in.account_ou = create_in_ou;
1385 r->in.os_name = os_name;
1386 r->in.os_version = os_version;
1387 r->in.dc_name = c->opt_host;
1388 r->in.admin_account = c->opt_user_name;
1389 r->in.admin_password = net_prompt_pass(c, c->opt_user_name);
1390 r->in.debug = true;
1391 r->in.use_kerberos = c->opt_kerberos;
1392 r->in.modify_config = modify_config;
1393 r->in.join_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
1394 WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE |
1395 WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED;
1396 r->in.msg_ctx = c->msg_ctx;
1397
1398 werr = libnet_Join(ctx, r);
1399 if (!W_ERROR_IS_OK(werr)) {
1400 goto fail;
1401 }
1402
1403 /* Check the short name of the domain */
1404
1405 if (!modify_config && !strequal(lp_workgroup(), r->out.netbios_domain_name)) {
1406 d_printf(_("The workgroup in %s does not match the short\n"
1407 "domain name obtained from the server.\n"
1408 "Using the name [%s] from the server.\n"
1409 "You should set \"workgroup = %s\" in %s.\n"),
1410 get_dyn_CONFIGFILE(), r->out.netbios_domain_name,
1411 r->out.netbios_domain_name, get_dyn_CONFIGFILE());
1412 }
1413
1414 d_printf(_("Using short domain name -- %s\n"), r->out.netbios_domain_name);
1415
1416 if (r->out.dns_domain_name) {
1417 d_printf(_("Joined '%s' to realm '%s'\n"), r->in.machine_name,
1418 r->out.dns_domain_name);
1419 } else {
1420 d_printf(_("Joined '%s' to domain '%s'\n"), r->in.machine_name,
1421 r->out.netbios_domain_name);
1422 }
1423
1424 #if defined(WITH_DNS_UPDATES)
1425 /*
1426 * In a clustered environment, don't do dynamic dns updates:
1427 * Registering the set of ip addresses that are assigned to
1428 * the interfaces of the node that performs the join does usually
1429 * not have the desired effect, since the local interfaces do not
1430 * carry the complete set of the cluster's public IP addresses.
1431 * And it can also contain internal addresses that should not
1432 * be visible to the outside at all.
1433 * In order to do dns updates in a clustererd setup, use
1434 * net ads dns register.
1435 */
1436 if (lp_clustering()) {
1437 d_fprintf(stderr, _("Not doing automatic DNS update in a"
1438 "clustered setup.\n"));
1439 goto done;
1440 }
1441
1442 if (r->out.domain_is_ad) {
1443 /* We enter this block with user creds */
1444 ADS_STRUCT *ads_dns = NULL;
1445
1446 if ( (ads_dns = ads_init( lp_realm(), NULL, NULL )) != NULL ) {
1447 /* kinit with the machine password */
1448
1449 use_in_memory_ccache();
1450 if (asprintf( &ads_dns->auth.user_name, "%s$", global_myname()) == -1) {
1451 goto fail;
1452 }
1453 ads_dns->auth.password = secrets_fetch_machine_password(
1454 r->out.netbios_domain_name, NULL, NULL );
1455 ads_dns->auth.realm = SMB_STRDUP( r->out.dns_domain_name );
1456 strupper_m(ads_dns->auth.realm );
1457 ads_kinit_password( ads_dns );
1458 }
1459
1460 if ( !ads_dns || !NT_STATUS_IS_OK(net_update_dns( ctx, ads_dns, NULL)) ) {
1461 d_fprintf( stderr, _("DNS update failed!\n") );
1462 }
1463
1464 /* exit from this block using machine creds */
1465 ads_destroy(&ads_dns);
1466 }
1467
1468 done:
1469 #endif
1470
1471 TALLOC_FREE(r);
1472 TALLOC_FREE( ctx );
1473
1474 return 0;
1475
1476 fail:
1477 /* issue an overall failure message at the end. */
1478 d_printf(_("Failed to join domain: %s\n"),
1479 r && r->out.error_string ? r->out.error_string :
1480 get_friendly_werror_msg(werr));
1481 TALLOC_FREE( ctx );
1482
1483 return -1;
1484 }
1485
1486 /*******************************************************************
1487 ********************************************************************/
1488
1489 static int net_ads_dns_register(struct net_context *c, int argc, const char **argv)
1490 {
1491 #if defined(WITH_DNS_UPDATES)
1492 ADS_STRUCT *ads;
1493 ADS_STATUS status;
1494 NTSTATUS ntstatus;
1495 TALLOC_CTX *ctx;
1496 const char *hostname = NULL;
1497 const char **addrs_list = NULL;
1498 struct sockaddr_storage *addrs = NULL;
1499 int num_addrs = 0;
1500 int count;
1501
1502 #ifdef DEVELOPER
1503 talloc_enable_leak_report();
1504 #endif
1505
1506 if (argc <= 1 && lp_clustering() && lp_cluster_addresses() == NULL) {
1507 d_fprintf(stderr, _("Refusing DNS updates with automatic "
1508 "detection of addresses in a clustered "
1509 "setup.\n"));
1510 c->display_usage = true;
1511 }
1512
1513 if (c->display_usage) {
1514 d_printf( "%s\n"
1515 "net ads dns register [hostname [IP [IP...]]]\n"
1516 " %s\n",
1517 _("Usage:"),
1518 _("Register hostname with DNS\n"));
1519 return -1;
1520 }
1521
1522 if (!(ctx = talloc_init("net_ads_dns"))) {
1523 d_fprintf(stderr, _("Could not initialise talloc context\n"));
1524 return -1;
1525 }
1526
1527 if (argc >= 1) {
1528 hostname = argv[0];
1529 }
1530
1531 if (argc > 1) {
1532 num_addrs = argc - 1;
1533 addrs_list = &argv[1];
1534 } else if (lp_clustering()) {
1535 addrs_list = lp_cluster_addresses();
1536 num_addrs = str_list_length(addrs_list);
1537 }
1538
1539 if (num_addrs > 0) {
1540 addrs = talloc_zero_array(ctx, struct sockaddr_storage, num_addrs);
1541 if (addrs == NULL) {
1542 d_fprintf(stderr, _("Error allocating memory!\n"));
1543 talloc_free(ctx);
1544 return -1;
1545 }
1546 }
1547
1548 for (count = 0; count < num_addrs; count++) {
1549 if (!interpret_string_addr(&addrs[count], addrs_list[count], 0)) {
1550 d_fprintf(stderr, "%s '%s'.\n",
1551 _("Cannot interpret address"),
1552 addrs_list[count]);
1553 talloc_free(ctx);
1554 return -1;
1555 }
1556 }
1557
1558 status = ads_startup(c, true, &ads);
1559 if ( !ADS_ERR_OK(status) ) {
1560 DEBUG(1, ("error on ads_startup: %s\n", ads_errstr(status)));
1561 TALLOC_FREE(ctx);
1562 return -1;
1563 }
1564
1565 ntstatus = net_update_dns_ext(ctx, ads, hostname, addrs, num_addrs);
1566 if (!NT_STATUS_IS_OK(ntstatus)) {
1567 d_fprintf( stderr, _("DNS update failed!\n") );
1568 ads_destroy( &ads );
1569 TALLOC_FREE( ctx );
1570 return -1;
1571 }
1572
1573 d_fprintf( stderr, _("Successfully registered hostname with DNS\n") );
1574
1575 ads_destroy(&ads);
1576 TALLOC_FREE( ctx );
1577
1578 return 0;
1579 #else
1580 d_fprintf(stderr,
1581 _("DNS update support not enabled at compile time!\n"));
1582 return -1;
1583 #endif
1584 }
1585
1586 #if defined(WITH_DNS_UPDATES)
1587 DNS_ERROR do_gethostbyname(const char *server, const char *host);
1588 #endif
1589
1590 static int net_ads_dns_gethostbyname(struct net_context *c, int argc, const char **argv)
1591 {
1592 #if defined(WITH_DNS_UPDATES)
1593 DNS_ERROR err;
1594
1595 #ifdef DEVELOPER
1596 talloc_enable_leak_report();
1597 #endif
1598
1599 if (argc != 2 || c->display_usage) {
1600 d_printf( "%s\n"
1601 " %s\n"
1602 " %s\n",
1603 _("Usage:"),
1604 _("net ads dns gethostbyname <server> <name>\n"),
1605 _(" Look up hostname from the AD\n"
1606 " server\tName server to use\n"
1607 " name\tName to look up\n"));
1608 return -1;
1609 }
1610
1611 err = do_gethostbyname(argv[0], argv[1]);
1612
1613 d_printf(_("do_gethostbyname returned %s (%d)\n"),
1614 dns_errstr(err), ERROR_DNS_V(err));
1615 #endif
1616 return 0;
1617 }
1618
1619 static int net_ads_dns(struct net_context *c, int argc, const char *argv[])
1620 {
1621 struct functable func[] = {
1622 {
1623 "register",
1624 net_ads_dns_register,
1625 NET_TRANSPORT_ADS,
1626 N_("Add host dns entry to AD"),
1627 N_("net ads dns register\n"
1628 " Add host dns entry to AD")
1629 },
1630 {
1631 "gethostbyname",
1632 net_ads_dns_gethostbyname,
1633 NET_TRANSPORT_ADS,
1634 N_("Look up host"),
1635 N_("net ads dns gethostbyname\n"
1636 " Look up host")
1637 },
1638 {NULL, NULL, 0, NULL, NULL}
1639 };
1640
1641 return net_run_function(c, argc, argv, "net ads dns", func);
1642 }
1643
1644 /*******************************************************************
1645 ********************************************************************/
1646
1647 int net_ads_printer_usage(struct net_context *c, int argc, const char **argv)
1648 {
1649 d_printf(_(
1650 "\nnet ads printer search <printer>"
1651 "\n\tsearch for a printer in the directory\n"
1652 "\nnet ads printer info <printer> <server>"
1653 "\n\tlookup info in directory for printer on server"
1654 "\n\t(note: printer defaults to \"*\", server defaults to local)\n"
1655 "\nnet ads printer publish <printername>"
1656 "\n\tpublish printer in directory"
1657 "\n\t(note: printer name is required)\n"
1658 "\nnet ads printer remove <printername>"
1659 "\n\tremove printer from directory"
1660 "\n\t(note: printer name is required)\n"));
1661 return -1;
1662 }
1663
1664 /*******************************************************************
1665 ********************************************************************/
1666
1667 static int net_ads_printer_search(struct net_context *c, int argc, const char **argv)
1668 {
1669 ADS_STRUCT *ads;
1670 ADS_STATUS rc;
1671 LDAPMessage *res = NULL;
1672
1673 if (c->display_usage) {
1674 d_printf( "%s\n"
1675 "net ads printer search\n"
1676 " %s\n",
1677 _("Usage:"),
1678 _("List printers in the AD"));
1679 return 0;
1680 }
1681
1682 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
1683 return -1;
1684 }
1685
1686 rc = ads_find_printers(ads, &res);
1687
1688 if (!ADS_ERR_OK(rc)) {
1689 d_fprintf(stderr, _("ads_find_printer: %s\n"), ads_errstr(rc));
1690 ads_msgfree(ads, res);
1691 ads_destroy(&ads);
1692 return -1;
1693 }
1694
1695 if (ads_count_replies(ads, res) == 0) {
1696 d_fprintf(stderr, _("No results found\n"));
1697 ads_msgfree(ads, res);
1698 ads_destroy(&ads);
1699 return -1;
1700 }
1701
1702 ads_dump(ads, res);
1703 ads_msgfree(ads, res);
1704 ads_destroy(&ads);
1705 return 0;
1706 }
1707
1708 static int net_ads_printer_info(struct net_context *c, int argc, const char **argv)
1709 {
1710 ADS_STRUCT *ads;
1711 ADS_STATUS rc;
1712 const char *servername, *printername;
1713 LDAPMessage *res = NULL;
1714
1715 if (c->display_usage) {
1716 d_printf("%s\n%s",
1717 _("Usage:"),
1718 _("net ads printer info [printername [servername]]\n"
1719 " Display printer info from AD\n"
1720 " printername\tPrinter name or wildcard\n"
1721 " servername\tName of the print server\n"));
1722 return 0;
1723 }
1724
1725 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
1726 return -1;
1727 }
1728
1729 if (argc > 0) {
1730 printername = argv[0];
1731 } else {
1732 printername = "*";
1733 }
1734
1735 if (argc > 1) {
1736 servername = argv[1];
1737 } else {
1738 servername = global_myname();
1739 }
1740
1741 rc = ads_find_printer_on_server(ads, &res, printername, servername);
1742
1743 if (!ADS_ERR_OK(rc)) {
1744 d_fprintf(stderr, _("Server '%s' not found: %s\n"),
1745 servername, ads_errstr(rc));
1746 ads_msgfree(ads, res);
1747 ads_destroy(&ads);
1748 return -1;
1749 }
1750
1751 if (ads_count_replies(ads, res) == 0) {
1752 d_fprintf(stderr, _("Printer '%s' not found\n"), printername);
1753 ads_msgfree(ads, res);
1754 ads_destroy(&ads);
1755 return -1;
1756 }
1757
1758 ads_dump(ads, res);
1759 ads_msgfree(ads, res);
1760 ads_destroy(&ads);
1761
1762 return 0;
1763 }
1764
1765 static int net_ads_printer_publish(struct net_context *c, int argc, const char **argv)
1766 {
1767 ADS_STRUCT *ads;
1768 ADS_STATUS rc;
1769 const char *servername, *printername;
1770 struct cli_state *cli = NULL;
1771 struct rpc_pipe_client *pipe_hnd = NULL;
1772 struct sockaddr_storage server_ss;
1773 NTSTATUS nt_status;
1774 TALLOC_CTX *mem_ctx = talloc_init("net_ads_printer_publish");
1775 ADS_MODLIST mods = ads_init_mods(mem_ctx);
1776 char *prt_dn, *srv_dn, **srv_cn;
1777 char *srv_cn_escaped = NULL, *printername_escaped = NULL;
1778 LDAPMessage *res = NULL;
1779
1780 if (argc < 1 || c->display_usage) {
1781 d_printf("%s\n%s",
1782 _("Usage:"),
1783 _("net ads printer publish <printername> [servername]\n"
1784 " Publish printer in AD\n"
1785 " printername\tName of the printer\n"
1786 " servername\tName of the print server\n"));
1787 talloc_destroy(mem_ctx);
1788 return -1;
1789 }
1790
1791 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
1792 talloc_destroy(mem_ctx);
1793 return -1;
1794 }
1795
1796 printername = argv[0];
1797
1798 if (argc == 2) {
1799 servername = argv[1];
1800 } else {
1801 servername = global_myname();
1802 }
1803
1804 /* Get printer data from SPOOLSS */
1805
1806 resolve_name(servername, &server_ss, 0x20, false);
1807
1808 nt_status = cli_full_connection(&cli, global_myname(), servername,
1809 &server_ss, 0,
1810 "IPC$", "IPC",
1811 c->opt_user_name, c->opt_workgroup,
1812 c->opt_password ? c->opt_password : "",
1813 CLI_FULL_CONNECTION_USE_KERBEROS,
1814 Undefined);
1815
1816 if (NT_STATUS_IS_ERR(nt_status)) {
1817 d_fprintf(stderr, _("Unable to open a connnection to %s to "
1818 "obtain data for %s\n"),
1819 servername, printername);
1820 ads_destroy(&ads);
1821 talloc_destroy(mem_ctx);
1822 return -1;
1823 }
1824
1825 /* Publish on AD server */
1826
1827 ads_find_machine_acct(ads, &res, servername);
1828
1829 if (ads_count_replies(ads, res) == 0) {
1830 d_fprintf(stderr, _("Could not find machine account for server "
1831 "%s\n"),
1832 servername);
1833 ads_destroy(&ads);
1834 talloc_destroy(mem_ctx);
1835 return -1;
1836 }
1837
1838 srv_dn = ldap_get_dn((LDAP *)ads->ldap.ld, (LDAPMessage *)res);
1839 srv_cn = ldap_explode_dn(srv_dn, 1);
1840
1841 srv_cn_escaped = escape_rdn_val_string_alloc(srv_cn[0]);
1842 printername_escaped = escape_rdn_val_string_alloc(printername);
1843 if (!srv_cn_escaped || !printername_escaped) {
1844 SAFE_FREE(srv_cn_escaped);
1845 SAFE_FREE(printername_escaped);
1846 d_fprintf(stderr, _("Internal error, out of memory!"));
1847 ads_destroy(&ads);
1848 talloc_destroy(mem_ctx);
1849 return -1;
1850 }
1851
1852 if (asprintf(&prt_dn, "cn=%s-%s,%s", srv_cn_escaped, printername_escaped, srv_dn) == -1) {
1853 SAFE_FREE(srv_cn_escaped);
1854 SAFE_FREE(printername_escaped);
1855 d_fprintf(stderr, _("Internal error, out of memory!"));
1856 ads_destroy(&ads);
1857 talloc_destroy(mem_ctx);
1858 return -1;
1859 }
1860
1861 SAFE_FREE(srv_cn_escaped);
1862 SAFE_FREE(printername_escaped);
1863
1864 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_spoolss.syntax_id, &pipe_hnd);
1865 if (!NT_STATUS_IS_OK(nt_status)) {
1866 d_fprintf(stderr, _("Unable to open a connnection to the spoolss pipe on %s\n"),
1867 servername);
1868 SAFE_FREE(prt_dn);
1869 ads_destroy(&ads);
1870 talloc_destroy(mem_ctx);
1871 return -1;
1872 }
1873
1874 if (!W_ERROR_IS_OK(get_remote_printer_publishing_data(pipe_hnd, mem_ctx, &mods,
1875 printername))) {
1876 SAFE_FREE(prt_dn);
1877 ads_destroy(&ads);
1878 talloc_destroy(mem_ctx);
1879 return -1;
1880 }
1881
1882 rc = ads_add_printer_entry(ads, prt_dn, mem_ctx, &mods);
1883 if (!ADS_ERR_OK(rc)) {
1884 d_fprintf(stderr, "ads_publish_printer: %s\n", ads_errstr(rc));
1885 SAFE_FREE(prt_dn);
1886 ads_destroy(&ads);
1887 talloc_destroy(mem_ctx);
1888 return -1;
1889 }
1890
1891 d_printf("published printer\n");
1892 SAFE_FREE(prt_dn);
1893 ads_destroy(&ads);
1894 talloc_destroy(mem_ctx);
1895
1896 return 0;
1897 }
1898
1899 static int net_ads_printer_remove(struct net_context *c, int argc, const char **argv)
1900 {
1901 ADS_STRUCT *ads;
1902 ADS_STATUS rc;
1903 const char *servername;
1904 char *prt_dn;
1905 LDAPMessage *res = NULL;
1906
1907 if (argc < 1 || c->display_usage) {
1908 d_printf("%s\n%s",
1909 _("Usage:"),
1910 _("net ads printer remove <printername> [servername]\n"
1911 " Remove a printer from the AD\n"
1912 " printername\tName of the printer\n"
1913 " servername\tName of the print server\n"));
1914 return -1;
1915 }
1916
1917 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
1918 return -1;
1919 }
1920
1921 if (argc > 1) {
1922 servername = argv[1];
1923 } else {
1924 servername = global_myname();
1925 }
1926
1927 rc = ads_find_printer_on_server(ads, &res, argv[0], servername);
1928
1929 if (!ADS_ERR_OK(rc)) {
1930 d_fprintf(stderr, _("ads_find_printer_on_server: %s\n"), ads_errstr(rc));
1931 ads_msgfree(ads, res);
1932 ads_destroy(&ads);
1933 return -1;
1934 }
1935
1936 if (ads_count_replies(ads, res) == 0) {
1937 d_fprintf(stderr, _("Printer '%s' not found\n"), argv[1]);
1938 ads_msgfree(ads, res);
1939 ads_destroy(&ads);
1940 return -1;
1941 }
1942
1943 prt_dn = ads_get_dn(ads, talloc_tos(), res);
1944 ads_msgfree(ads, res);
1945 rc = ads_del_dn(ads, prt_dn);
1946 TALLOC_FREE(prt_dn);
1947
1948 if (!ADS_ERR_OK(rc)) {
1949 d_fprintf(stderr, _("ads_del_dn: %s\n"), ads_errstr(rc));
1950 ads_destroy(&ads);
1951 return -1;
1952 }
1953
1954 ads_destroy(&ads);
1955 return 0;
1956 }
1957
1958 static int net_ads_printer(struct net_context *c, int argc, const char **argv)
1959 {
1960 struct functable func[] = {
1961 {
1962 "search",
1963 net_ads_printer_search,
1964 NET_TRANSPORT_ADS,
1965 N_("Search for a printer"),
1966 N_("net ads printer search\n"
1967 " Search for a printer")
1968 },
1969 {
1970 "info",
1971 net_ads_printer_info,
1972 NET_TRANSPORT_ADS,
1973 N_("Display printer information"),
1974 N_("net ads printer info\n"
1975 " Display printer information")
1976 },
1977 {
1978 "publish",
1979 net_ads_printer_publish,
1980 NET_TRANSPORT_ADS,
1981 N_("Publish a printer"),
1982 N_("net ads printer publish\n"
1983 " Publish a printer")
1984 },
1985 {
1986 "remove",
1987 net_ads_printer_remove,
1988 NET_TRANSPORT_ADS,
1989 N_("Delete a printer"),
1990 N_("net ads printer remove\n"
1991 " Delete a printer")
1992 },
1993 {NULL, NULL, 0, NULL, NULL}
1994 };
1995
1996 return net_run_function(c, argc, argv, "net ads printer", func);
1997 }
1998
1999
2000 static int net_ads_password(struct net_context *c, int argc, const char **argv)
2001 {
2002 ADS_STRUCT *ads;
2003 const char *auth_principal = c->opt_user_name;
2004 const char *auth_password = c->opt_password;
2005 char *realm = NULL;
2006 char *new_password = NULL;
2007 char *chr, *prompt;
2008 const char *user;
2009 ADS_STATUS ret;
2010
2011 if (c->display_usage) {
2012 d_printf("%s\n%s",
2013 _("Usage:"),
2014 _("net ads password <username>\n"
2015 " Change password for user\n"
2016 " username\tName of user to change password for\n"));
2017 return 0;
2018 }
2019
2020 if (c->opt_user_name == NULL || c->opt_password == NULL) {
2021 d_fprintf(stderr, _("You must supply an administrator "
2022 "username/password\n"));
2023 return -1;
2024 }
2025
2026 if (argc < 1) {
2027 d_fprintf(stderr, _("ERROR: You must say which username to "
2028 "change password for\n"));
2029 return -1;
2030 }
2031
2032 user = argv[0];
2033 if (!strchr_m(user, '@')) {
2034 if (asprintf(&chr, "%s@%s", argv[0], lp_realm()) == -1) {
2035 return -1;
2036 }
2037 user = chr;
2038 }
2039
2040 use_in_memory_ccache();
2041 chr = strchr_m(auth_principal, '@');
2042 if (chr) {
2043 realm = ++chr;
2044 } else {
2045 realm = lp_realm();
2046 }
2047
2048 /* use the realm so we can eventually change passwords for users
2049 in realms other than default */
2050 if (!(ads = ads_init(realm, c->opt_workgroup, c->opt_host))) {
2051 return -1;
2052 }
2053
2054 /* we don't actually need a full connect, but it's the easy way to
2055 fill in the KDC's addresss */
2056 ads_connect(ads);
2057
2058 if (!ads->config.realm) {
2059 d_fprintf(stderr, _("Didn't find the kerberos server!\n"));
2060 ads_destroy(&ads);
2061 return -1;
2062 }
2063
2064 if (argv[1]) {
2065 new_password = (char *)argv[1];
2066 } else {
2067 if (asprintf(&prompt, _("Enter new password for %s:"), user) == -1) {
2068 return -1;
2069 }
2070 new_password = getpass(prompt);
2071 free(prompt);
2072 }
2073
2074 ret = kerberos_set_password(ads->auth.kdc_server, auth_principal,
2075 auth_password, user, new_password, ads->auth.time_offset);
2076 if (!ADS_ERR_OK(ret)) {
2077 d_fprintf(stderr, _("Password change failed: %s\n"), ads_errstr(ret));
2078 ads_destroy(&ads);
2079 return -1;
2080 }
2081
2082 d_printf(_("Password change for %s completed.\n"), user);
2083 ads_destroy(&ads);
2084
2085 return 0;
2086 }
2087
2088 int net_ads_changetrustpw(struct net_context *c, int argc, const char **argv)
2089 {
2090 ADS_STRUCT *ads;
2091 char *host_principal;
2092 fstring my_name;
2093 ADS_STATUS ret;
2094
2095 if (c->display_usage) {
2096 d_printf( "%s\n"
2097 "net ads changetrustpw\n"
2098 " %s\n",
2099 _("Usage:"),
2100 _("Change the machine account's trust password"));
2101 return 0;
2102 }
2103
2104 if (!secrets_init()) {
2105 DEBUG(1,("Failed to initialise secrets database\n"));
2106 return -1;
2107 }
2108
2109 net_use_krb_machine_account(c);
2110
2111 use_in_memory_ccache();
2112
2113 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2114 return -1;
2115 }
2116
2117 fstrcpy(my_name, global_myname());
2118 strlower_m(my_name);
2119 if (asprintf(&host_principal, "%s$@%s", my_name, ads->config.realm) == -1) {
2120 ads_destroy(&ads);
2121 return -1;
2122 }
2123 d_printf(_("Changing password for principal: %s\n"), host_principal);
2124
2125 ret = ads_change_trust_account_password(ads, host_principal);
2126
2127 if (!ADS_ERR_OK(ret)) {
2128 d_fprintf(stderr, _("Password change failed: %s\n"), ads_errstr(ret));
2129 ads_destroy(&ads);
2130 SAFE_FREE(host_principal);
2131 return -1;
2132 }
2133
2134 d_printf(_("Password change for principal %s succeeded.\n"), host_principal);
2135
2136 if (USE_SYSTEM_KEYTAB) {
2137 d_printf(_("Attempting to update system keytab with new password.\n"));
2138 if (ads_keytab_create_default(ads)) {
2139 d_printf(_("Failed to update system keytab.\n"));
2140 }
2141 }
2142
2143 ads_destroy(&ads);
2144 SAFE_FREE(host_principal);
2145
2146 return 0;
2147 }
2148
2149 /*
2150 help for net ads search
2151 */
2152 static int net_ads_search_usage(struct net_context *c, int argc, const char **argv)
2153 {
2154 d_printf(_(
2155 "\nnet ads search <expression> <attributes...>\n"
2156 "\nPerform a raw LDAP search on a ADS server and dump the results.\n"
2157 "The expression is a standard LDAP search expression, and the\n"
2158 "attributes are a list of LDAP fields to show in the results.\n\n"
2159 "Example: net ads search '(objectCategory=group)' sAMAccountName\n\n"
2160 ));
2161 net_common_flags_usage(c, argc, argv);
2162 return -1;
2163 }
2164
2165
2166 /*
2167 general ADS search function. Useful in diagnosing problems in ADS
2168 */
2169 static int net_ads_search(struct net_context *c, int argc, const char **argv)
2170 {
2171 ADS_STRUCT *ads;
2172 ADS_STATUS rc;
2173 const char *ldap_exp;
2174 const char **attrs;
2175 LDAPMessage *res = NULL;
2176
2177 if (argc < 1 || c->display_usage) {
2178 return net_ads_search_usage(c, argc, argv);
2179 }
2180
2181 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2182 return -1;
2183 }
2184
2185 ldap_exp = argv[0];
2186 attrs = (argv + 1);
2187
2188 rc = ads_do_search_all(ads, ads->config.bind_path,
2189 LDAP_SCOPE_SUBTREE,
2190 ldap_exp, attrs, &res);
2191 if (!ADS_ERR_OK(rc)) {
2192 d_fprintf(stderr, _("search failed: %s\n"), ads_errstr(rc));
2193 ads_destroy(&ads);
2194 return -1;
2195 }
2196
2197 d_printf(_("Got %d replies\n\n"), ads_count_replies(ads, res));
2198
2199 /* dump the results */
2200 ads_dump(ads, res);
2201
2202 ads_msgfree(ads, res);
2203 ads_destroy(&ads);
2204
2205 return 0;
2206 }
2207
2208
2209 /*
2210 help for net ads search
2211 */
2212 static int net_ads_dn_usage(struct net_context *c, int argc, const char **argv)
2213 {
2214 d_printf(_(
2215 "\nnet ads dn <dn> <attributes...>\n"
2216 "\nperform a raw LDAP search on a ADS server and dump the results\n"
2217 "The DN standard LDAP DN, and the attributes are a list of LDAP fields \n"
2218 "to show in the results\n\n"
2219 "Example: net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' sAMAccountName\n\n"
2220 "Note: the DN must be provided properly escaped. See RFC 4514 for details\n\n"
2221 ));
2222 net_common_flags_usage(c, argc, argv);
2223 return -1;
2224 }
2225
2226
2227 /*
2228 general ADS search function. Useful in diagnosing problems in ADS
2229 */
2230 static int net_ads_dn(struct net_context *c, int argc, const char **argv)
2231 {
2232 ADS_STRUCT *ads;
2233 ADS_STATUS rc;
2234 const char *dn;
2235 const char **attrs;
2236 LDAPMessage *res = NULL;
2237
2238 if (argc < 1 || c->display_usage) {
2239 return net_ads_dn_usage(c, argc, argv);
2240 }
2241
2242 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2243 return -1;
2244 }
2245
2246 dn = argv[0];
2247 attrs = (argv + 1);
2248
2249 rc = ads_do_search_all(ads, dn,
2250 LDAP_SCOPE_BASE,
2251 "(objectclass=*)", attrs, &res);
2252 if (!ADS_ERR_OK(rc)) {
2253 d_fprintf(stderr, _("search failed: %s\n"), ads_errstr(rc));
2254 ads_destroy(&ads);
2255 return -1;
2256 }
2257
2258 d_printf("Got %d replies\n\n", ads_count_replies(ads, res));
2259
2260 /* dump the results */
2261 ads_dump(ads, res);
2262
2263 ads_msgfree(ads, res);
2264 ads_destroy(&ads);
2265
2266 return 0;
2267 }
2268
2269 /*
2270 help for net ads sid search
2271 */
2272 static int net_ads_sid_usage(struct net_context *c, int argc, const char **argv)
2273 {
2274 d_printf(_(
2275 "\nnet ads sid <sid> <attributes...>\n"
2276 "\nperform a raw LDAP search on a ADS server and dump the results\n"
2277 "The SID is in string format, and the attributes are a list of LDAP fields \n"
2278 "to show in the results\n\n"
2279 "Example: net ads sid 'S-1-5-32' distinguishedName\n\n"
2280 ));
2281 net_common_flags_usage(c, argc, argv);
2282 return -1;
2283 }
2284
2285
2286 /*
2287 general ADS search function. Useful in diagnosing problems in ADS
2288 */
2289 static int net_ads_sid(struct net_context *c, int argc, const char **argv)
2290 {
2291 ADS_STRUCT *ads;
2292 ADS_STATUS rc;
2293 const char *sid_string;
2294 const char **attrs;
2295 LDAPMessage *res = NULL;
2296 struct dom_sid sid;
2297
2298 if (argc < 1 || c->display_usage) {
2299 return net_ads_sid_usage(c, argc, argv);
2300 }
2301
2302 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2303 return -1;
2304 }
2305
2306 sid_string = argv[0];
2307 attrs = (argv + 1);
2308
2309 if (!string_to_sid(&sid, sid_string)) {
2310 d_fprintf(stderr, _("could not convert sid\n"));
2311 ads_destroy(&ads);
2312 return -1;
2313 }
2314
2315 rc = ads_search_retry_sid(ads, &res, &sid, attrs);
2316 if (!ADS_ERR_OK(rc)) {
2317 d_fprintf(stderr, _("search failed: %s\n"), ads_errstr(rc));
2318 ads_destroy(&ads);
2319 return -1;
2320 }
2321
2322 d_printf(_("Got %d replies\n\n"), ads_count_replies(ads, res));
2323
2324 /* dump the results */
2325 ads_dump(ads, res);
2326
2327 ads_msgfree(ads, res);
2328 ads_destroy(&ads);
2329
2330 return 0;
2331 }
2332
2333 static int net_ads_keytab_flush(struct net_context *c, int argc, const char **argv)
2334 {
2335 int ret;
2336 ADS_STRUCT *ads;
2337
2338 if (c->display_usage) {
2339 d_printf( "%s\n"
2340 "net ads keytab flush\n"
2341 " %s\n",
2342 _("Usage:"),
2343 _("Delete the whole keytab"));
2344 return 0;
2345 }
2346
2347 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2348 return -1;
2349 }
2350 ret = ads_keytab_flush(ads);
2351 ads_destroy(&ads);
2352 return ret;
2353 }
2354
2355 static int net_ads_keytab_add(struct net_context *c, int argc, const char **argv)
2356 {
2357 int i;
2358 int ret = 0;
2359 ADS_STRUCT *ads;
2360
2361 if (c->display_usage) {
2362 d_printf("%s\n%s",
2363 _("Usage:"),
2364 _("net ads keytab add <principal> [principal ...]\n"
2365 " Add principals to local keytab\n"
2366 " principal\tKerberos principal to add to "
2367 "keytab\n"));
2368 return 0;
2369 }
2370
2371 d_printf(_("Processing principals to add...\n"));
2372 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2373 return -1;
2374 }
2375 for (i = 0; i < argc; i++) {
2376 ret |= ads_keytab_add_entry(ads, argv[i]);
2377 }
2378 ads_destroy(&ads);
2379 return ret;
2380 }
2381
2382 static int net_ads_keytab_create(struct net_context *c, int argc, const char **argv)
2383 {
2384 ADS_STRUCT *ads;
2385 int ret;
2386
2387 if (c->display_usage) {
2388 d_printf( "%s\n"
2389 "net ads keytab create\n"
2390 " %s\n",
2391 _("Usage:"),
2392 _("Create new default keytab"));
2393 return 0;
2394 }
2395
2396 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2397 return -1;
2398 }
2399 ret = ads_keytab_create_default(ads);
2400 ads_destroy(&ads);
2401 return ret;
2402 }
2403
2404 static int net_ads_keytab_list(struct net_context *c, int argc, const char **argv)
2405 {
2406 const char *keytab = NULL;
2407
2408 if (c->display_usage) {
2409 d_printf("%s\n%s",
2410 _("Usage:"),
2411 _("net ads keytab list [keytab]\n"
2412 " List a local keytab\n"
2413 " keytab\tKeytab to list\n"));
2414 return 0;
2415 }
2416
2417 if (argc >= 1) {
2418 keytab = argv[0];
2419 }
2420
2421 return ads_keytab_list(keytab);
2422 }
2423
2424
2425 int net_ads_keytab(struct net_context *c, int argc, const char **argv)
2426 {
2427 struct functable func[] = {
2428 {
2429 "add",
2430 net_ads_keytab_add,
2431 NET_TRANSPORT_ADS,
2432 N_("Add a service principal"),
2433 N_("net ads keytab add\n"
2434 " Add a service principal")
2435 },
2436 {
2437 "create",
2438 net_ads_keytab_create,
2439 NET_TRANSPORT_ADS,
2440 N_("Create a fresh keytab"),
2441 N_("net ads keytab create\n"
2442 " Create a fresh keytab")
2443 },
2444 {
2445 "flush",
2446 net_ads_keytab_flush,
2447 NET_TRANSPORT_ADS,
2448 N_("Remove all keytab entries"),
2449 N_("net ads keytab flush\n"
2450 " Remove all keytab entries")
2451 },
2452 {
2453 "list",
2454 net_ads_keytab_list,
2455 NET_TRANSPORT_ADS,
2456 N_("List a keytab"),
2457 N_("net ads keytab list\n"
2458 " List a keytab")
2459 },
2460 {NULL, NULL, 0, NULL, NULL}
2461 };
2462
2463 if (!USE_KERBEROS_KEYTAB) {
2464 d_printf(_("\nWarning: \"kerberos method\" must be set to a "
2465 "keytab method to use keytab functions.\n"));
2466 }
2467
2468 return net_run_function(c, argc, argv, "net ads keytab", func);
2469 }
2470
2471 static int net_ads_kerberos_renew(struct net_context *c, int argc, const char **argv)
2472 {
2473 int ret = -1;
2474
2475 if (c->display_usage) {
2476 d_printf( "%s\n"
2477 "net ads kerberos renew\n"
2478 " %s\n",
2479 _("Usage:"),
2480 _("Renew TGT from existing credential cache"));
2481 return 0;
2482 }
2483
2484 ret = smb_krb5_renew_ticket(NULL, NULL, NULL, NULL);
2485 if (ret) {
2486 d_printf(_("failed to renew kerberos ticket: %s\n"),
2487 error_message(ret));
2488 }
2489 return ret;
2490 }
2491
2492 static int net_ads_kerberos_pac(struct net_context *c, int argc, const char **argv)
2493 {
2494 struct PAC_LOGON_INFO *info = NULL;
2495 TALLOC_CTX *mem_ctx = NULL;
2496 NTSTATUS status;
2497 int ret = -1;
2498 const char *impersonate_princ_s = NULL;
2499
2500 if (c->display_usage) {
2501 d_printf( "%s\n"
2502 "net ads kerberos pac\n"
2503 " %s\n",
2504 _("Usage:"),
2505 _("Dump the Kerberos PAC"));
2506 return 0;
2507 }
2508
2509 mem_ctx = talloc_init("net_ads_kerberos_pac");
2510 if (!mem_ctx) {
2511 goto out;
2512 }
2513
2514 if (argc > 0) {
2515 impersonate_princ_s = argv[0];
2516 }
2517
2518 c->opt_password = net_prompt_pass(c, c->opt_user_name);
2519
2520 status = kerberos_return_pac(mem_ctx,
2521 c->opt_user_name,
2522 c->opt_password,
2523 0,
2524 NULL,
2525 NULL,
2526 NULL,
2527 true,
2528 true,
2529 2592000, /* one month */
2530 impersonate_princ_s,
2531 &info);
2532 if (!NT_STATUS_IS_OK(status)) {
2533 d_printf(_("failed to query kerberos PAC: %s\n"),
2534 nt_errstr(status));
2535 goto out;
2536 }
2537
2538 if (info) {
2539 const char *s;
2540 s = NDR_PRINT_STRUCT_STRING(mem_ctx, PAC_LOGON_INFO, info);
2541 d_printf(_("The Pac: %s\n"), s);
2542 }
2543
2544 ret = 0;
2545 out:
2546 TALLOC_FREE(mem_ctx);
2547 return ret;
2548 }
2549
2550 static int net_ads_kerberos_kinit(struct net_context *c, int argc, const char **argv)
2551 {
2552 TALLOC_CTX *mem_ctx = NULL;
2553 int ret = -1;
2554 NTSTATUS status;
2555
2556 if (c->display_usage) {
2557 d_printf( "%s\n"
2558 "net ads kerberos kinit\n"
2559 " %s\n",
2560 _("Usage:"),
2561 _("Get Ticket Granting Ticket (TGT) for the user"));
2562 return 0;
2563 }
2564
2565 mem_ctx = talloc_init("net_ads_kerberos_kinit");
2566 if (!mem_ctx) {
2567 goto out;
2568 }
2569
2570 c->opt_password = net_prompt_pass(c, c->opt_user_name);
2571
2572 ret = kerberos_kinit_password_ext(c->opt_user_name,
2573 c->opt_password,
2574 0,
2575 NULL,
2576 NULL,
2577 NULL,
2578 true,
2579 true,
2580 2592000, /* one month */
2581 &status);
2582 if (ret) {
2583 d_printf(_("failed to kinit password: %s\n"),
2584 nt_errstr(status));
2585 }
2586 out:
2587 return ret;
2588 }
2589
2590 int net_ads_kerberos(struct net_context *c, int argc, const char **argv)
2591 {
2592 struct functable func[] = {
2593 {
2594 "kinit",
2595 net_ads_kerberos_kinit,
2596 NET_TRANSPORT_ADS,
2597 N_("Retrieve Ticket Granting Ticket (TGT)"),
2598 N_("net ads kerberos kinit\n"
2599 " Receive Ticket Granting Ticket (TGT)")
2600 },
2601 {
2602 "renew",
2603 net_ads_kerberos_renew,
2604 NET_TRANSPORT_ADS,
2605 N_("Renew Ticket Granting Ticket from credential cache"),
2606 N_("net ads kerberos renew\n"
2607 " Renew Ticket Granting Ticket (TGT) from "
2608 "credential cache")
2609 },
2610 {
2611 "pac",
2612 net_ads_kerberos_pac,
2613 NET_TRANSPORT_ADS,
2614 N_("Dump Kerberos PAC"),
2615 N_("net ads kerberos pac\n"
2616 " Dump Kerberos PAC")
2617 },
2618 {NULL, NULL, 0, NULL, NULL}
2619 };
2620
2621 return net_run_function(c, argc, argv, "net ads kerberos", func);
2622 }
2623
2624 int net_ads(struct net_context *c, int argc, const char **argv)
2625 {
2626 struct functable func[] = {
2627 {
2628 "info",
2629 net_ads_info,
2630 NET_TRANSPORT_ADS,
2631 N_("Display details on remote ADS server"),
2632 N_("net ads info\n"
2633 " Display details on remote ADS server")
2634 },
2635 {
2636 "join",
2637 net_ads_join,
2638 NET_TRANSPORT_ADS,
2639 N_("Join the local machine to ADS realm"),
2640 N_("net ads join\n"
2641 " Join the local machine to ADS realm")
2642 },
2643 {
2644 "testjoin",
2645 net_ads_testjoin,
2646 NET_TRANSPORT_ADS,
2647 N_("Validate machine account"),
2648 N_("net ads testjoin\n"
2649 " Validate machine account")
2650 },
2651 {
2652 "leave",
2653 net_ads_leave,
2654 NET_TRANSPORT_ADS,
2655 N_("Remove the local machine from ADS"),
2656 N_("net ads leave\n"
2657 " Remove the local machine from ADS")
2658 },
2659 {
2660 "status",
2661 net_ads_status,
2662 NET_TRANSPORT_ADS,
2663 N_("Display machine account details"),
2664 N_("net ads status\n"
2665 " Display machine account details")
2666 },
2667 {
2668 "user",
2669 net_ads_user,
2670 NET_TRANSPORT_ADS,
2671 N_("List/modify users"),
2672 N_("net ads user\n"
2673 " List/modify users")
2674 },
2675 {
2676 "group",
2677 net_ads_group,
2678 NET_TRANSPORT_ADS,
2679 N_("List/modify groups"),
2680 N_("net ads group\n"
2681 " List/modify groups")
2682 },
2683 {
2684 "dns",
2685 net_ads_dns,
2686 NET_TRANSPORT_ADS,
2687 N_("Issue dynamic DNS update"),
2688 N_("net ads dns\n"
2689 " Issue dynamic DNS update")
2690 },
2691 {
2692 "password",
2693 net_ads_password,
2694 NET_TRANSPORT_ADS,
2695 N_("Change user passwords"),
2696 N_("net ads password\n"
2697 " Change user passwords")
2698 },
2699 {
2700 "changetrustpw",
2701 net_ads_changetrustpw,
2702 NET_TRANSPORT_ADS,
2703 N_("Change trust account password"),
2704 N_("net ads changetrustpw\n"
2705 " Change trust account password")
2706 },
2707 {
2708 "printer",
2709 net_ads_printer,
2710 NET_TRANSPORT_ADS,
2711 N_("List/modify printer entries"),
2712 N_("net ads printer\n"
2713 " List/modify printer entries")
2714 },
2715 {
2716 "search",
2717 net_ads_search,
2718 NET_TRANSPORT_ADS,
2719 N_("Issue LDAP search using filter"),
2720 N_("net ads search\n"
2721 " Issue LDAP search using filter")
2722 },
2723 {
2724 "dn",
2725 net_ads_dn,
2726 NET_TRANSPORT_ADS,
2727 N_("Issue LDAP search by DN"),
2728 N_("net ads dn\n"
2729 " Issue LDAP search by DN")
2730 },
2731 {
2732 "sid",
2733 net_ads_sid,
2734 NET_TRANSPORT_ADS,
2735 N_("Issue LDAP search by SID"),
2736 N_("net ads sid\n"
2737 " Issue LDAP search by SID")
2738 },
2739 {
2740 "workgroup",
2741 net_ads_workgroup,
2742 NET_TRANSPORT_ADS,
2743 N_("Display workgroup name"),
2744 N_("net ads workgroup\n"
2745 " Display the workgroup name")
2746 },
2747 {
2748 "lookup",
2749 net_ads_lookup,
2750 NET_TRANSPORT_ADS,
2751 N_("Perfom CLDAP query on DC"),
2752 N_("net ads lookup\n"
2753 " Find the ADS DC using CLDAP lookups")
2754 },
2755 {
2756 "keytab",
2757 net_ads_keytab,
2758 NET_TRANSPORT_ADS,
2759 N_("Manage local keytab file"),
2760 N_("net ads keytab\n"
2761 " Manage local keytab file")
2762 },
2763 {
2764 "gpo",
2765 net_ads_gpo,
2766 NET_TRANSPORT_ADS,
2767 N_("Manage group policy objects"),
2768 N_("net ads gpo\n"
2769 " Manage group policy objects")
2770 },
2771 {
2772 "kerberos",
2773 net_ads_kerberos,
2774 NET_TRANSPORT_ADS,
2775 N_("Manage kerberos keytab"),
2776 N_("net ads kerberos\n"
2777 " Manage kerberos keytab")
2778 },
2779 {NULL, NULL, 0, NULL, NULL}
2780 };
2781
2782 return net_run_function(c, argc, argv, "net ads", func);
2783 }
2784
2785 #else
2786
2787 static int net_ads_noads(void)
2788 {
2789 d_fprintf(stderr, _("ADS support not compiled in\n"));
2790 return -1;
2791 }
2792
2793 int net_ads_keytab(struct net_context *c, int argc, const char **argv)
2794 {
2795 return net_ads_noads();
2796 }
2797
2798 int net_ads_kerberos(struct net_context *c, int argc, const char **argv)
2799 {
2800 return net_ads_noads();
2801 }
2802
2803 int net_ads_changetrustpw(struct net_context *c, int argc, const char **argv)
2804 {
2805 return net_ads_noads();
2806 }
2807
2808 int net_ads_join(struct net_context *c, int argc, const char **argv)
2809 {
2810 return net_ads_noads();
2811 }
2812
2813 int net_ads_user(struct net_context *c, int argc, const char **argv)
2814 {
2815 return net_ads_noads();
2816 }
2817
2818 int net_ads_group(struct net_context *c, int argc, const char **argv)
2819 {
2820 return net_ads_noads();
2821 }
2822
2823 int net_ads_gpo(struct net_context *c, int argc, const char **argv)
2824 {
2825 return net_ads_noads();
2826 }
2827
2828 /* this one shouldn't display a message */
2829 int net_ads_check(struct net_context *c)
2830 {
2831 return -1;
2832 }
2833
2834 int net_ads_check_our_domain(struct net_context *c)
2835 {
2836 return -1;
2837 }
2838
2839 int net_ads(struct net_context *c, int argc, const char **argv)
2840 {
2841 return net_ads_noads();
2842 }
2843
2844 #endif /* WITH_ADS */
Samba GIT mirror