2 Samba Unix/Linux SMB client library
3 Distributed SMB/CIFS Server Management Utility
4 Copyright (C) 2001 Andrew Bartlett (abartlet@samba.org)
5 Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
6 Copyright (C) 2004,2008 Guenther Deschner (gd@samba.org)
7 Copyright (C) 2005 Jeremy Allison (jra@samba.org)
8 Copyright (C) 2006 Jelmer Vernooij (jelmer@samba.org)
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>. */
24 #include "utils/net.h"
25 #include "../libcli/auth/libcli_auth.h"
26 #include "../librpc/gen_ndr/cli_samr.h"
27 #include "rpc_client/cli_samr.h"
28 #include "rpc_client/init_samr.h"
29 #include "../librpc/gen_ndr/cli_lsa.h"
30 #include "rpc_client/cli_lsarpc.h"
31 #include "../librpc/gen_ndr/cli_netlogon.h"
32 #include "../librpc/gen_ndr/cli_srvsvc.h"
33 #include "../librpc/gen_ndr/cli_spoolss.h"
34 #include "../librpc/gen_ndr/cli_initshutdown.h"
35 #include "../librpc/gen_ndr/cli_winreg.h"
37 #include "lib/netapi/netapi.h"
38 #include "rpc_client/init_lsa.h"
40 static int net_mode_share
;
41 static bool sync_files(struct copy_clistate
*cp_clistate
, const char *mask
);
46 * @brief RPC based subcommands for the 'net' utility.
48 * This file should contain much of the functionality that used to
49 * be found in rpcclient, execpt that the commands should change
50 * less often, and the fucntionality should be sane (the user is not
51 * expected to know a rid/sid before they conduct an operation etc.)
53 * @todo Perhaps eventually these should be split out into a number
54 * of files, as this could get quite big.
59 * Many of the RPC functions need the domain sid. This function gets
60 * it at the start of every run
62 * @param cli A cli_state already connected to the remote machine
64 * @return The Domain SID of the remote machine.
67 NTSTATUS
net_get_remote_domain_sid(struct cli_state
*cli
, TALLOC_CTX
*mem_ctx
,
68 struct dom_sid
**domain_sid
,
69 const char **domain_name
)
71 struct rpc_pipe_client
*lsa_pipe
= NULL
;
72 struct policy_handle pol
;
73 NTSTATUS result
= NT_STATUS_OK
;
74 union lsa_PolicyInformation
*info
= NULL
;
76 result
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
78 if (!NT_STATUS_IS_OK(result
)) {
79 d_fprintf(stderr
, _("Could not initialise lsa pipe\n"));
83 result
= rpccli_lsa_open_policy(lsa_pipe
, mem_ctx
, false,
84 SEC_FLAG_MAXIMUM_ALLOWED
,
86 if (!NT_STATUS_IS_OK(result
)) {
87 d_fprintf(stderr
, "open_policy %s: %s\n",
93 result
= rpccli_lsa_QueryInfoPolicy(lsa_pipe
, mem_ctx
,
95 LSA_POLICY_INFO_ACCOUNT_DOMAIN
,
97 if (!NT_STATUS_IS_OK(result
)) {
98 d_fprintf(stderr
, "lsaquery %s: %s\n",
104 *domain_name
= info
->account_domain
.name
.string
;
105 *domain_sid
= info
->account_domain
.sid
;
107 rpccli_lsa_Close(lsa_pipe
, mem_ctx
, &pol
);
108 TALLOC_FREE(lsa_pipe
);
114 * Run a single RPC command, from start to finish.
116 * @param pipe_name the pipe to connect to (usually a PIPE_ constant)
117 * @param conn_flag a NET_FLAG_ combination. Passed to
118 * net_make_ipc_connection.
119 * @param argc Standard main() style argc.
120 * @param argv Standard main() style argv. Initial components are already
122 * @return A shell status integer (0 for success).
125 int run_rpc_command(struct net_context
*c
,
126 struct cli_state
*cli_arg
,
127 const struct ndr_syntax_id
*interface
,
133 struct cli_state
*cli
= NULL
;
134 struct rpc_pipe_client
*pipe_hnd
= NULL
;
137 struct dom_sid
*domain_sid
;
138 const char *domain_name
;
141 /* make use of cli_state handed over as an argument, if possible */
143 nt_status
= net_make_ipc_connection(c
, conn_flags
, &cli
);
144 if (!NT_STATUS_IS_OK(nt_status
)) {
145 DEBUG(1, ("failed to make ipc connection: %s\n",
146 nt_errstr(nt_status
)));
159 if (!(mem_ctx
= talloc_init("run_rpc_command"))) {
160 DEBUG(0, ("talloc_init() failed\n"));
164 nt_status
= net_get_remote_domain_sid(cli
, mem_ctx
, &domain_sid
,
166 if (!NT_STATUS_IS_OK(nt_status
)) {
170 if (!(conn_flags
& NET_FLAGS_NO_PIPE
)) {
171 if (lp_client_schannel()
172 && (ndr_syntax_id_equal(interface
,
173 &ndr_table_netlogon
.syntax_id
))) {
174 /* Always try and create an schannel netlogon pipe. */
175 nt_status
= cli_rpc_pipe_open_schannel(
176 cli
, interface
, NCACN_NP
,
177 DCERPC_AUTH_LEVEL_PRIVACY
, domain_name
,
179 if (!NT_STATUS_IS_OK(nt_status
)) {
180 DEBUG(0, ("Could not initialise schannel netlogon pipe. Error was %s\n",
181 nt_errstr(nt_status
) ));
185 if (conn_flags
& NET_FLAGS_SEAL
) {
186 nt_status
= cli_rpc_pipe_open_ntlmssp(
188 (conn_flags
& NET_FLAGS_TCP
) ?
189 NCACN_IP_TCP
: NCACN_NP
,
190 DCERPC_AUTH_LEVEL_PRIVACY
,
191 lp_workgroup(), c
->opt_user_name
,
192 c
->opt_password
, &pipe_hnd
);
194 nt_status
= cli_rpc_pipe_open_noauth(
198 if (!NT_STATUS_IS_OK(nt_status
)) {
199 DEBUG(0, ("Could not initialise pipe %s. Error was %s\n",
200 get_pipe_name_from_syntax(
201 talloc_tos(), interface
),
202 nt_errstr(nt_status
) ));
208 nt_status
= fn(c
, domain_sid
, domain_name
, cli
, pipe_hnd
, mem_ctx
, argc
, argv
);
210 if (!NT_STATUS_IS_OK(nt_status
)) {
211 DEBUG(1, ("rpc command function failed! (%s)\n", nt_errstr(nt_status
)));
214 DEBUG(5, ("rpc command function succedded\n"));
217 if (!(conn_flags
& NET_FLAGS_NO_PIPE
)) {
219 TALLOC_FREE(pipe_hnd
);
224 /* close the connection only if it was opened here */
229 talloc_destroy(mem_ctx
);
234 * Force a change of the trust acccount password.
236 * All parameters are provided by the run_rpc_command function, except for
237 * argc, argv which are passed through.
239 * @param domain_sid The domain sid acquired from the remote server.
240 * @param cli A cli_state connected to the server.
241 * @param mem_ctx Talloc context, destroyed on completion of the function.
242 * @param argc Standard main() style argc.
243 * @param argv Standard main() style argv. Initial components are already
246 * @return Normal NTSTATUS return.
249 static NTSTATUS
rpc_changetrustpw_internals(struct net_context
*c
,
250 const struct dom_sid
*domain_sid
,
251 const char *domain_name
,
252 struct cli_state
*cli
,
253 struct rpc_pipe_client
*pipe_hnd
,
260 status
= trust_pw_find_change_and_store_it(pipe_hnd
, mem_ctx
, c
->opt_target_workgroup
);
261 if (!NT_STATUS_IS_OK(status
)) {
262 d_fprintf(stderr
, _("Failed to change machine account password: %s\n"),
271 * Force a change of the trust acccount password.
273 * @param argc Standard main() style argc.
274 * @param argv Standard main() style argv. Initial components are already
277 * @return A shell status integer (0 for success).
280 int net_rpc_changetrustpw(struct net_context
*c
, int argc
, const char **argv
)
282 if (c
->display_usage
) {
284 "net rpc changetrustpw\n"
287 _("Change the machine trust password"));
291 return run_rpc_command(c
, NULL
, &ndr_table_netlogon
.syntax_id
,
292 NET_FLAGS_ANONYMOUS
| NET_FLAGS_PDC
,
293 rpc_changetrustpw_internals
,
298 * Join a domain, the old way.
300 * This uses 'machinename' as the inital password, and changes it.
302 * The password should be created with 'server manager' or equiv first.
304 * All parameters are provided by the run_rpc_command function, except for
305 * argc, argv which are passed through.
307 * @param domain_sid The domain sid acquired from the remote server.
308 * @param cli A cli_state connected to the server.
309 * @param mem_ctx Talloc context, destroyed on completion of the function.
310 * @param argc Standard main() style argc.
311 * @param argv Standard main() style argv. Initial components are already
314 * @return Normal NTSTATUS return.
317 static NTSTATUS
rpc_oldjoin_internals(struct net_context
*c
,
318 const struct dom_sid
*domain_sid
,
319 const char *domain_name
,
320 struct cli_state
*cli
,
321 struct rpc_pipe_client
*pipe_hnd
,
327 fstring trust_passwd
;
328 unsigned char orig_trust_passwd_hash
[16];
330 enum netr_SchannelType sec_channel_type
;
332 result
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_netlogon
.syntax_id
,
334 if (!NT_STATUS_IS_OK(result
)) {
335 DEBUG(0,("rpc_oldjoin_internals: netlogon pipe open to machine %s failed. "
338 nt_errstr(result
) ));
343 check what type of join - if the user want's to join as
344 a BDC, the server must agree that we are a BDC.
347 sec_channel_type
= get_sec_channel_type(argv
[0]);
349 sec_channel_type
= get_sec_channel_type(NULL
);
352 fstrcpy(trust_passwd
, global_myname());
353 strlower_m(trust_passwd
);
356 * Machine names can be 15 characters, but the max length on
357 * a password is 14. --jerry
360 trust_passwd
[14] = '\0';
362 E_md4hash(trust_passwd
, orig_trust_passwd_hash
);
364 result
= trust_pw_change_and_store_it(pipe_hnd
, mem_ctx
, c
->opt_target_workgroup
,
366 orig_trust_passwd_hash
,
369 if (NT_STATUS_IS_OK(result
))
370 printf(_("Joined domain %s.\n"), c
->opt_target_workgroup
);
373 if (!secrets_store_domain_sid(c
->opt_target_workgroup
, domain_sid
)) {
374 DEBUG(0, ("error storing domain sid for %s\n", c
->opt_target_workgroup
));
375 result
= NT_STATUS_UNSUCCESSFUL
;
382 * Join a domain, the old way.
384 * @param argc Standard main() style argc.
385 * @param argv Standard main() style argv. Initial components are already
388 * @return A shell status integer (0 for success).
391 static int net_rpc_perform_oldjoin(struct net_context
*c
, int argc
, const char **argv
)
393 return run_rpc_command(c
, NULL
, &ndr_table_netlogon
.syntax_id
,
394 NET_FLAGS_NO_PIPE
| NET_FLAGS_ANONYMOUS
| NET_FLAGS_PDC
,
395 rpc_oldjoin_internals
,
400 * Join a domain, the old way. This function exists to allow
401 * the message to be displayed when oldjoin was explicitly
402 * requested, but not when it was implied by "net rpc join".
404 * @param argc Standard main() style argc.
405 * @param argv Standard main() style argv. Initial components are already
408 * @return A shell status integer (0 for success).
411 static int net_rpc_oldjoin(struct net_context
*c
, int argc
, const char **argv
)
415 if (c
->display_usage
) {
420 _("Join a domain the old way"));
424 rc
= net_rpc_perform_oldjoin(c
, argc
, argv
);
427 d_fprintf(stderr
, _("Failed to join domain\n"));
434 * 'net rpc join' entrypoint.
435 * @param argc Standard main() style argc.
436 * @param argv Standard main() style argv. Initial components are already
439 * Main 'net_rpc_join()' (where the admin username/password is used) is
441 * Try to just change the password, but if that doesn't work, use/prompt
442 * for a username/password.
445 int net_rpc_join(struct net_context
*c
, int argc
, const char **argv
)
447 if (c
->display_usage
) {
450 _("net rpc join -U <username>[%%password] <type>\n"
452 " username\tName of the admin user"
453 " password\tPassword of the admin user, will "
454 "prompt if not specified\n"
455 " type\tCan be one of the following:\n"
456 "\t\tMEMBER\tJoin as member server (default)\n"
457 "\t\tBDC\tJoin as BDC\n"
458 "\t\tPDC\tJoin as PDC\n"));
462 if (lp_server_role() == ROLE_STANDALONE
) {
463 d_printf(_("cannot join as standalone machine\n"));
467 if (strlen(global_myname()) > 15) {
468 d_printf(_("Our netbios name can be at most 15 chars long, "
469 "\"%s\" is %u chars long\n"),
470 global_myname(), (unsigned int)strlen(global_myname()));
474 if ((net_rpc_perform_oldjoin(c
, argc
, argv
) == 0))
477 return net_rpc_join_newstyle(c
, argc
, argv
);
481 * display info about a rpc domain
483 * All parameters are provided by the run_rpc_command function, except for
484 * argc, argv which are passed through.
486 * @param domain_sid The domain sid acquired from the remote server
487 * @param cli A cli_state connected to the server.
488 * @param mem_ctx Talloc context, destroyed on completion of the function.
489 * @param argc Standard main() style argc.
490 * @param argv Standard main() style argv. Initial components are already
493 * @return Normal NTSTATUS return.
496 NTSTATUS
rpc_info_internals(struct net_context
*c
,
497 const struct dom_sid
*domain_sid
,
498 const char *domain_name
,
499 struct cli_state
*cli
,
500 struct rpc_pipe_client
*pipe_hnd
,
505 struct policy_handle connect_pol
, domain_pol
;
506 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
507 union samr_DomainInfo
*info
= NULL
;
510 sid_to_fstring(sid_str
, domain_sid
);
512 /* Get sam policy handle */
513 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
515 MAXIMUM_ALLOWED_ACCESS
,
517 if (!NT_STATUS_IS_OK(result
)) {
518 d_fprintf(stderr
, _("Could not connect to SAM: %s\n"),
523 /* Get domain policy handle */
524 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
526 MAXIMUM_ALLOWED_ACCESS
,
527 CONST_DISCARD(struct dom_sid2
*, domain_sid
),
529 if (!NT_STATUS_IS_OK(result
)) {
530 d_fprintf(stderr
, _("Could not open domain: %s\n"),
535 result
= rpccli_samr_QueryDomainInfo(pipe_hnd
, mem_ctx
,
539 if (NT_STATUS_IS_OK(result
)) {
540 d_printf(_("Domain Name: %s\n"),
541 info
->general
.domain_name
.string
);
542 d_printf(_("Domain SID: %s\n"), sid_str
);
543 d_printf(_("Sequence number: %llu\n"),
544 (unsigned long long)info
->general
.sequence_num
);
545 d_printf(_("Num users: %u\n"), info
->general
.num_users
);
546 d_printf(_("Num domain groups: %u\n"),info
->general
.num_groups
);
547 d_printf(_("Num local groups: %u\n"),info
->general
.num_aliases
);
555 * 'net rpc info' entrypoint.
556 * @param argc Standard main() style argc.
557 * @param argv Standard main() style argv. Initial components are already
561 int net_rpc_info(struct net_context
*c
, int argc
, const char **argv
)
563 if (c
->display_usage
) {
568 _("Display information about the domain"));
572 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
,
573 NET_FLAGS_PDC
, rpc_info_internals
,
578 * Fetch domain SID into the local secrets.tdb.
580 * All parameters are provided by the run_rpc_command function, except for
581 * argc, argv which are passed through.
583 * @param domain_sid The domain sid acquired from the remote server.
584 * @param cli A cli_state connected to the server.
585 * @param mem_ctx Talloc context, destroyed on completion of the function.
586 * @param argc Standard main() style argc.
587 * @param argv Standard main() style argv. Initial components are already
590 * @return Normal NTSTATUS return.
593 static NTSTATUS
rpc_getsid_internals(struct net_context
*c
,
594 const struct dom_sid
*domain_sid
,
595 const char *domain_name
,
596 struct cli_state
*cli
,
597 struct rpc_pipe_client
*pipe_hnd
,
604 sid_to_fstring(sid_str
, domain_sid
);
605 d_printf(_("Storing SID %s for Domain %s in secrets.tdb\n"),
606 sid_str
, domain_name
);
608 if (!secrets_store_domain_sid(domain_name
, domain_sid
)) {
609 DEBUG(0,("Can't store domain SID\n"));
610 return NT_STATUS_UNSUCCESSFUL
;
617 * 'net rpc getsid' entrypoint.
618 * @param argc Standard main() style argc.
619 * @param argv Standard main() style argv. Initial components are already
623 int net_rpc_getsid(struct net_context
*c
, int argc
, const char **argv
)
625 int conn_flags
= NET_FLAGS_PDC
;
627 if (!c
->opt_user_specified
) {
628 conn_flags
|= NET_FLAGS_ANONYMOUS
;
631 if (c
->display_usage
) {
636 _("Fetch domain SID into local secrets.tdb"));
640 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
,
642 rpc_getsid_internals
,
646 /****************************************************************************/
649 * Basic usage function for 'net rpc user'.
650 * @param argc Standard main() style argc.
651 * @param argv Standard main() style argv. Initial components are already
655 static int rpc_user_usage(struct net_context
*c
, int argc
, const char **argv
)
657 return net_user_usage(c
, argc
, argv
);
661 * Add a new user to a remote RPC server.
663 * @param argc Standard main() style argc.
664 * @param argv Standard main() style argv. Initial components are already
667 * @return A shell status integer (0 for success).
670 static int rpc_user_add(struct net_context
*c
, int argc
, const char **argv
)
672 NET_API_STATUS status
;
673 struct USER_INFO_1 info1
;
674 uint32_t parm_error
= 0;
676 if (argc
< 1 || c
->display_usage
) {
677 rpc_user_usage(c
, argc
, argv
);
683 info1
.usri1_name
= argv
[0];
685 info1
.usri1_password
= argv
[1];
688 status
= NetUserAdd(c
->opt_host
, 1, (uint8_t *)&info1
, &parm_error
);
691 d_fprintf(stderr
,_("Failed to add user '%s' with error: %s.\n"),
692 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
696 d_printf(_("Added user '%s'.\n"), argv
[0]);
703 * Rename a user on a remote RPC server.
705 * @param argc Standard main() style argc.
706 * @param argv Standard main() style argv. Initial components are already
709 * @return A shell status integer (0 for success).
712 static int rpc_user_rename(struct net_context
*c
, int argc
, const char **argv
)
714 NET_API_STATUS status
;
715 struct USER_INFO_0 u0
;
716 uint32_t parm_err
= 0;
718 if (argc
!= 2 || c
->display_usage
) {
719 rpc_user_usage(c
, argc
, argv
);
723 u0
.usri0_name
= argv
[1];
725 status
= NetUserSetInfo(c
->opt_host
, argv
[0],
726 0, (uint8_t *)&u0
, &parm_err
);
729 _("Failed to rename user from %s to %s - %s\n"),
731 libnetapi_get_error_string(c
->netapi_ctx
, status
));
733 d_printf(_("Renamed user from %s to %s\n"), argv
[0], argv
[1]);
740 * Set a user's primary group
742 * @param argc Standard main() style argc.
743 * @param argv Standard main() style argv. Initial components are already
746 * @return A shell status integer (0 for success).
749 static int rpc_user_setprimarygroup(struct net_context
*c
, int argc
,
752 NET_API_STATUS status
;
754 struct GROUP_INFO_2
*g2
;
755 struct USER_INFO_1051 u1051
;
756 uint32_t parm_err
= 0;
758 if (argc
!= 2 || c
->display_usage
) {
759 rpc_user_usage(c
, argc
, argv
);
763 status
= NetGroupGetInfo(c
->opt_host
, argv
[1], 2, &buffer
);
765 d_fprintf(stderr
, _("Failed to find group name %s -- %s\n"),
767 libnetapi_get_error_string(c
->netapi_ctx
, status
));
770 g2
= (struct GROUP_INFO_2
*)buffer
;
772 u1051
.usri1051_primary_group_id
= g2
->grpi2_group_id
;
774 NetApiBufferFree(buffer
);
776 status
= NetUserSetInfo(c
->opt_host
, argv
[0], 1051,
777 (uint8_t *)&u1051
, &parm_err
);
780 _("Failed to set user's primary group %s to %s - "
781 "%s\n"), argv
[0], argv
[1],
782 libnetapi_get_error_string(c
->netapi_ctx
, status
));
784 d_printf(_("Set primary group of user %s to %s\n"), argv
[0],
791 * Delete a user from a remote RPC server.
793 * @param argc Standard main() style argc.
794 * @param argv Standard main() style argv. Initial components are already
797 * @return A shell status integer (0 for success).
800 static int rpc_user_delete(struct net_context
*c
, int argc
, const char **argv
)
802 NET_API_STATUS status
;
804 if (argc
< 1 || c
->display_usage
) {
805 rpc_user_usage(c
, argc
, argv
);
809 status
= NetUserDel(c
->opt_host
, argv
[0]);
812 d_fprintf(stderr
, _("Failed to delete user '%s' with: %s.\n"),
814 libnetapi_get_error_string(c
->netapi_ctx
, status
));
817 d_printf(_("Deleted user '%s'.\n"), argv
[0]);
824 * Set a user's password on a remote RPC server.
826 * @param argc Standard main() style argc.
827 * @param argv Standard main() style argv. Initial components are already
830 * @return A shell status integer (0 for success).
833 static int rpc_user_password(struct net_context
*c
, int argc
, const char **argv
)
835 NET_API_STATUS status
;
837 struct USER_INFO_1003 u1003
;
838 uint32_t parm_err
= 0;
841 if (argc
< 1 || c
->display_usage
) {
842 rpc_user_usage(c
, argc
, argv
);
847 u1003
.usri1003_password
= argv
[1];
849 ret
= asprintf(&prompt
, _("Enter new password for %s:"),
854 u1003
.usri1003_password
= talloc_strdup(c
, getpass(prompt
));
856 if (u1003
.usri1003_password
== NULL
) {
861 status
= NetUserSetInfo(c
->opt_host
, argv
[0], 1003, (uint8_t *)&u1003
, &parm_err
);
863 /* Display results */
866 _("Failed to set password for '%s' with error: %s.\n"),
867 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
876 * List a user's groups from a remote RPC server.
878 * @param argc Standard main() style argc.
879 * @param argv Standard main() style argv. Initial components are already
882 * @return A shell status integer (0 for success)
885 static int rpc_user_info(struct net_context
*c
, int argc
, const char **argv
)
888 NET_API_STATUS status
;
889 struct GROUP_USERS_INFO_0
*u0
= NULL
;
890 uint32_t entries_read
= 0;
891 uint32_t total_entries
= 0;
895 if (argc
< 1 || c
->display_usage
) {
896 rpc_user_usage(c
, argc
, argv
);
900 status
= NetUserGetGroups(c
->opt_host
,
903 (uint8_t **)(void *)&u0
,
909 _("Failed to get groups for '%s' with error: %s.\n"),
910 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
915 for (i
=0; i
< entries_read
; i
++) {
916 printf("%s\n", u0
->grui0_name
);
924 * List users on a remote RPC server.
926 * All parameters are provided by the run_rpc_command function, except for
927 * argc, argv which are passed through.
929 * @param domain_sid The domain sid acquired from the remote server.
930 * @param cli A cli_state connected to the server.
931 * @param mem_ctx Talloc context, destroyed on completion of the function.
932 * @param argc Standard main() style argc.
933 * @param argv Standard main() style argv. Initial components are already
936 * @return Normal NTSTATUS return.
939 static int rpc_user_list(struct net_context
*c
, int argc
, const char **argv
)
941 NET_API_STATUS status
;
942 uint32_t start_idx
=0, num_entries
, i
, loop_count
= 0;
943 struct NET_DISPLAY_USER
*info
= NULL
;
946 /* Query domain users */
947 if (c
->opt_long_list_entries
)
948 d_printf(_("\nUser name Comment"
949 "\n-----------------------------\n"));
951 uint32_t max_entries
, max_size
;
953 get_query_dispinfo_params(
954 loop_count
, &max_entries
, &max_size
);
956 status
= NetQueryDisplayInformation(c
->opt_host
,
963 if (status
!= 0 && status
!= ERROR_MORE_DATA
) {
967 info
= (struct NET_DISPLAY_USER
*)buffer
;
969 for (i
= 0; i
< num_entries
; i
++) {
971 if (c
->opt_long_list_entries
)
972 printf("%-21.21s %s\n", info
->usri1_name
,
973 info
->usri1_comment
);
975 printf("%s\n", info
->usri1_name
);
979 NetApiBufferFree(buffer
);
982 start_idx
+= num_entries
;
984 } while (status
== ERROR_MORE_DATA
);
990 * 'net rpc user' entrypoint.
991 * @param argc Standard main() style argc.
992 * @param argv Standard main() style argv. Initial components are already
996 int net_rpc_user(struct net_context
*c
, int argc
, const char **argv
)
998 NET_API_STATUS status
;
1000 struct functable func
[] = {
1005 N_("Add specified user"),
1006 N_("net rpc user add\n"
1007 " Add specified user")
1013 N_("List domain groups of user"),
1014 N_("net rpc user info\n"
1015 " List domain groups of user")
1021 N_("Remove specified user"),
1022 N_("net rpc user delete\n"
1023 " Remove specified user")
1029 N_("Change user password"),
1030 N_("net rpc user password\n"
1031 " Change user password")
1037 N_("Rename specified user"),
1038 N_("net rpc user rename\n"
1039 " Rename specified user")
1043 rpc_user_setprimarygroup
,
1045 "Set a user's primary group",
1046 "net rpc user setprimarygroup\n"
1047 " Set a user's primary group"
1049 {NULL
, NULL
, 0, NULL
, NULL
}
1052 status
= libnetapi_init(&c
->netapi_ctx
);
1056 libnetapi_set_username(c
->netapi_ctx
, c
->opt_user_name
);
1057 libnetapi_set_password(c
->netapi_ctx
, c
->opt_password
);
1058 if (c
->opt_kerberos
) {
1059 libnetapi_set_use_kerberos(c
->netapi_ctx
);
1063 if (c
->display_usage
) {
1068 _("List all users"));
1069 net_display_usage_from_functable(func
);
1073 return rpc_user_list(c
, argc
, argv
);
1076 return net_run_function(c
, argc
, argv
, "net rpc user", func
);
1079 static NTSTATUS
rpc_sh_user_list(struct net_context
*c
,
1080 TALLOC_CTX
*mem_ctx
,
1081 struct rpc_sh_ctx
*ctx
,
1082 struct rpc_pipe_client
*pipe_hnd
,
1083 int argc
, const char **argv
)
1085 return werror_to_ntstatus(W_ERROR(rpc_user_list(c
, argc
, argv
)));
1088 static NTSTATUS
rpc_sh_user_info(struct net_context
*c
,
1089 TALLOC_CTX
*mem_ctx
,
1090 struct rpc_sh_ctx
*ctx
,
1091 struct rpc_pipe_client
*pipe_hnd
,
1092 int argc
, const char **argv
)
1094 return werror_to_ntstatus(W_ERROR(rpc_user_info(c
, argc
, argv
)));
1097 static NTSTATUS
rpc_sh_handle_user(struct net_context
*c
,
1098 TALLOC_CTX
*mem_ctx
,
1099 struct rpc_sh_ctx
*ctx
,
1100 struct rpc_pipe_client
*pipe_hnd
,
1101 int argc
, const char **argv
,
1103 struct net_context
*c
,
1104 TALLOC_CTX
*mem_ctx
,
1105 struct rpc_sh_ctx
*ctx
,
1106 struct rpc_pipe_client
*pipe_hnd
,
1107 struct policy_handle
*user_hnd
,
1108 int argc
, const char **argv
))
1110 struct policy_handle connect_pol
, domain_pol
, user_pol
;
1111 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
1114 enum lsa_SidType type
;
1117 d_fprintf(stderr
, "%s %s <username>\n", _("Usage:"),
1119 return NT_STATUS_INVALID_PARAMETER
;
1122 ZERO_STRUCT(connect_pol
);
1123 ZERO_STRUCT(domain_pol
);
1124 ZERO_STRUCT(user_pol
);
1126 result
= net_rpc_lookup_name(c
, mem_ctx
, rpc_pipe_np_smb_conn(pipe_hnd
),
1127 argv
[0], NULL
, NULL
, &sid
, &type
);
1128 if (!NT_STATUS_IS_OK(result
)) {
1129 d_fprintf(stderr
, _("Could not lookup %s: %s\n"), argv
[0],
1134 if (type
!= SID_NAME_USER
) {
1135 d_fprintf(stderr
, _("%s is a %s, not a user\n"), argv
[0],
1136 sid_type_lookup(type
));
1137 result
= NT_STATUS_NO_SUCH_USER
;
1141 if (!sid_peek_check_rid(ctx
->domain_sid
, &sid
, &rid
)) {
1142 d_fprintf(stderr
, _("%s is not in our domain\n"), argv
[0]);
1143 result
= NT_STATUS_NO_SUCH_USER
;
1147 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
1149 MAXIMUM_ALLOWED_ACCESS
,
1151 if (!NT_STATUS_IS_OK(result
)) {
1155 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
1157 MAXIMUM_ALLOWED_ACCESS
,
1160 if (!NT_STATUS_IS_OK(result
)) {
1164 result
= rpccli_samr_OpenUser(pipe_hnd
, mem_ctx
,
1166 MAXIMUM_ALLOWED_ACCESS
,
1169 if (!NT_STATUS_IS_OK(result
)) {
1173 result
= fn(c
, mem_ctx
, ctx
, pipe_hnd
, &user_pol
, argc
-1, argv
+1);
1176 if (is_valid_policy_hnd(&user_pol
)) {
1177 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &user_pol
);
1179 if (is_valid_policy_hnd(&domain_pol
)) {
1180 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &domain_pol
);
1182 if (is_valid_policy_hnd(&connect_pol
)) {
1183 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &connect_pol
);
1188 static NTSTATUS
rpc_sh_user_show_internals(struct net_context
*c
,
1189 TALLOC_CTX
*mem_ctx
,
1190 struct rpc_sh_ctx
*ctx
,
1191 struct rpc_pipe_client
*pipe_hnd
,
1192 struct policy_handle
*user_hnd
,
1193 int argc
, const char **argv
)
1196 union samr_UserInfo
*info
= NULL
;
1199 d_fprintf(stderr
, "%s %s show <username>\n", _("Usage:"),
1201 return NT_STATUS_INVALID_PARAMETER
;
1204 result
= rpccli_samr_QueryUserInfo(pipe_hnd
, mem_ctx
,
1208 if (!NT_STATUS_IS_OK(result
)) {
1212 d_printf(_("user rid: %d, group rid: %d\n"),
1214 info
->info21
.primary_gid
);
1219 static NTSTATUS
rpc_sh_user_show(struct net_context
*c
,
1220 TALLOC_CTX
*mem_ctx
,
1221 struct rpc_sh_ctx
*ctx
,
1222 struct rpc_pipe_client
*pipe_hnd
,
1223 int argc
, const char **argv
)
1225 return rpc_sh_handle_user(c
, mem_ctx
, ctx
, pipe_hnd
, argc
, argv
,
1226 rpc_sh_user_show_internals
);
1229 #define FETCHSTR(name, rec) \
1230 do { if (strequal(ctx->thiscmd, name)) { \
1231 oldval = talloc_strdup(mem_ctx, info->info21.rec.string); } \
1234 #define SETSTR(name, rec, flag) \
1235 do { if (strequal(ctx->thiscmd, name)) { \
1236 init_lsa_String(&(info->info21.rec), argv[0]); \
1237 info->info21.fields_present |= SAMR_FIELD_##flag; } \
1240 static NTSTATUS
rpc_sh_user_str_edit_internals(struct net_context
*c
,
1241 TALLOC_CTX
*mem_ctx
,
1242 struct rpc_sh_ctx
*ctx
,
1243 struct rpc_pipe_client
*pipe_hnd
,
1244 struct policy_handle
*user_hnd
,
1245 int argc
, const char **argv
)
1248 const char *username
;
1249 const char *oldval
= "";
1250 union samr_UserInfo
*info
= NULL
;
1253 d_fprintf(stderr
, "%s %s <username> [new value|NULL]\n",
1254 _("Usage:"), ctx
->whoami
);
1255 return NT_STATUS_INVALID_PARAMETER
;
1258 result
= rpccli_samr_QueryUserInfo(pipe_hnd
, mem_ctx
,
1262 if (!NT_STATUS_IS_OK(result
)) {
1266 username
= talloc_strdup(mem_ctx
, info
->info21
.account_name
.string
);
1268 FETCHSTR("fullname", full_name
);
1269 FETCHSTR("homedir", home_directory
);
1270 FETCHSTR("homedrive", home_drive
);
1271 FETCHSTR("logonscript", logon_script
);
1272 FETCHSTR("profilepath", profile_path
);
1273 FETCHSTR("description", description
);
1276 d_printf(_("%s's %s: [%s]\n"), username
, ctx
->thiscmd
, oldval
);
1280 if (strcmp(argv
[0], "NULL") == 0) {
1284 ZERO_STRUCT(info
->info21
);
1286 SETSTR("fullname", full_name
, FULL_NAME
);
1287 SETSTR("homedir", home_directory
, HOME_DIRECTORY
);
1288 SETSTR("homedrive", home_drive
, HOME_DRIVE
);
1289 SETSTR("logonscript", logon_script
, LOGON_SCRIPT
);
1290 SETSTR("profilepath", profile_path
, PROFILE_PATH
);
1291 SETSTR("description", description
, DESCRIPTION
);
1293 result
= rpccli_samr_SetUserInfo(pipe_hnd
, mem_ctx
,
1298 d_printf(_("Set %s's %s from [%s] to [%s]\n"), username
,
1299 ctx
->thiscmd
, oldval
, argv
[0]);
1306 #define HANDLEFLG(name, rec) \
1307 do { if (strequal(ctx->thiscmd, name)) { \
1308 oldval = (oldflags & ACB_##rec) ? "yes" : "no"; \
1310 newflags = oldflags | ACB_##rec; \
1312 newflags = oldflags & ~ACB_##rec; \
1315 static NTSTATUS
rpc_sh_user_str_edit(struct net_context
*c
,
1316 TALLOC_CTX
*mem_ctx
,
1317 struct rpc_sh_ctx
*ctx
,
1318 struct rpc_pipe_client
*pipe_hnd
,
1319 int argc
, const char **argv
)
1321 return rpc_sh_handle_user(c
, mem_ctx
, ctx
, pipe_hnd
, argc
, argv
,
1322 rpc_sh_user_str_edit_internals
);
1325 static NTSTATUS
rpc_sh_user_flag_edit_internals(struct net_context
*c
,
1326 TALLOC_CTX
*mem_ctx
,
1327 struct rpc_sh_ctx
*ctx
,
1328 struct rpc_pipe_client
*pipe_hnd
,
1329 struct policy_handle
*user_hnd
,
1330 int argc
, const char **argv
)
1333 const char *username
;
1334 const char *oldval
= "unknown";
1335 uint32 oldflags
, newflags
;
1337 union samr_UserInfo
*info
= NULL
;
1340 ((argc
== 1) && !strequal(argv
[0], "yes") &&
1341 !strequal(argv
[0], "no"))) {
1342 /* TRANSATORS: The yes|no here are program keywords. Please do
1344 d_fprintf(stderr
, _("Usage: %s <username> [yes|no]\n"),
1346 return NT_STATUS_INVALID_PARAMETER
;
1349 newval
= strequal(argv
[0], "yes");
1351 result
= rpccli_samr_QueryUserInfo(pipe_hnd
, mem_ctx
,
1355 if (!NT_STATUS_IS_OK(result
)) {
1359 username
= talloc_strdup(mem_ctx
, info
->info21
.account_name
.string
);
1360 oldflags
= info
->info21
.acct_flags
;
1361 newflags
= info
->info21
.acct_flags
;
1363 HANDLEFLG("disabled", DISABLED
);
1364 HANDLEFLG("pwnotreq", PWNOTREQ
);
1365 HANDLEFLG("autolock", AUTOLOCK
);
1366 HANDLEFLG("pwnoexp", PWNOEXP
);
1369 d_printf(_("%s's %s flag: %s\n"), username
, ctx
->thiscmd
,
1374 ZERO_STRUCT(info
->info21
);
1376 info
->info21
.acct_flags
= newflags
;
1377 info
->info21
.fields_present
= SAMR_FIELD_ACCT_FLAGS
;
1379 result
= rpccli_samr_SetUserInfo(pipe_hnd
, mem_ctx
,
1384 if (NT_STATUS_IS_OK(result
)) {
1385 d_printf(_("Set %s's %s flag from [%s] to [%s]\n"), username
,
1386 ctx
->thiscmd
, oldval
, argv
[0]);
1394 static NTSTATUS
rpc_sh_user_flag_edit(struct net_context
*c
,
1395 TALLOC_CTX
*mem_ctx
,
1396 struct rpc_sh_ctx
*ctx
,
1397 struct rpc_pipe_client
*pipe_hnd
,
1398 int argc
, const char **argv
)
1400 return rpc_sh_handle_user(c
, mem_ctx
, ctx
, pipe_hnd
, argc
, argv
,
1401 rpc_sh_user_flag_edit_internals
);
1404 struct rpc_sh_cmd
*net_rpc_user_edit_cmds(struct net_context
*c
,
1405 TALLOC_CTX
*mem_ctx
,
1406 struct rpc_sh_ctx
*ctx
)
1408 static struct rpc_sh_cmd cmds
[] = {
1410 { "fullname", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_str_edit
,
1411 N_("Show/Set a user's full name") },
1413 { "homedir", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_str_edit
,
1414 N_("Show/Set a user's home directory") },
1416 { "homedrive", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_str_edit
,
1417 N_("Show/Set a user's home drive") },
1419 { "logonscript", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_str_edit
,
1420 N_("Show/Set a user's logon script") },
1422 { "profilepath", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_str_edit
,
1423 N_("Show/Set a user's profile path") },
1425 { "description", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_str_edit
,
1426 N_("Show/Set a user's description") },
1428 { "disabled", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_flag_edit
,
1429 N_("Show/Set whether a user is disabled") },
1431 { "autolock", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_flag_edit
,
1432 N_("Show/Set whether a user locked out") },
1434 { "pwnotreq", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_flag_edit
,
1435 N_("Show/Set whether a user does not need a password") },
1437 { "pwnoexp", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_flag_edit
,
1438 N_("Show/Set whether a user's password does not expire") },
1440 { NULL
, NULL
, 0, NULL
, NULL
}
1446 struct rpc_sh_cmd
*net_rpc_user_cmds(struct net_context
*c
,
1447 TALLOC_CTX
*mem_ctx
,
1448 struct rpc_sh_ctx
*ctx
)
1450 static struct rpc_sh_cmd cmds
[] = {
1452 { "list", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_list
,
1453 N_("List available users") },
1455 { "info", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_info
,
1456 N_("List the domain groups a user is member of") },
1458 { "show", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_show
,
1459 N_("Show info about a user") },
1461 { "edit", net_rpc_user_edit_cmds
, 0, NULL
,
1462 N_("Show/Modify a user's fields") },
1464 { NULL
, NULL
, 0, NULL
, NULL
}
1470 /****************************************************************************/
1473 * Basic usage function for 'net rpc group'.
1474 * @param argc Standard main() style argc.
1475 * @param argv Standard main() style argv. Initial components are already
1479 static int rpc_group_usage(struct net_context
*c
, int argc
, const char **argv
)
1481 return net_group_usage(c
, argc
, argv
);
1485 * Delete group on a remote RPC server.
1487 * All parameters are provided by the run_rpc_command function, except for
1488 * argc, argv which are passed through.
1490 * @param domain_sid The domain sid acquired from the remote server.
1491 * @param cli A cli_state connected to the server.
1492 * @param mem_ctx Talloc context, destroyed on completion of the function.
1493 * @param argc Standard main() style argc.
1494 * @param argv Standard main() style argv. Initial components are already
1497 * @return Normal NTSTATUS return.
1500 static NTSTATUS
rpc_group_delete_internals(struct net_context
*c
,
1501 const struct dom_sid
*domain_sid
,
1502 const char *domain_name
,
1503 struct cli_state
*cli
,
1504 struct rpc_pipe_client
*pipe_hnd
,
1505 TALLOC_CTX
*mem_ctx
,
1509 struct policy_handle connect_pol
, domain_pol
, group_pol
, user_pol
;
1510 bool group_is_primary
= false;
1511 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
1513 struct samr_RidTypeArray
*rids
= NULL
;
1516 /* struct samr_RidWithAttribute *user_gids; */
1518 struct samr_Ids group_rids
, name_types
;
1519 struct lsa_String lsa_acct_name
;
1520 union samr_UserInfo
*info
= NULL
;
1522 if (argc
< 1 || c
->display_usage
) {
1523 rpc_group_usage(c
, argc
,argv
);
1524 return NT_STATUS_OK
; /* ok? */
1527 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
1529 MAXIMUM_ALLOWED_ACCESS
,
1532 if (!NT_STATUS_IS_OK(result
)) {
1533 d_fprintf(stderr
, _("Request samr_Connect2 failed\n"));
1537 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
1539 MAXIMUM_ALLOWED_ACCESS
,
1540 CONST_DISCARD(struct dom_sid2
*, domain_sid
),
1543 if (!NT_STATUS_IS_OK(result
)) {
1544 d_fprintf(stderr
, _("Request open_domain failed\n"));
1548 init_lsa_String(&lsa_acct_name
, argv
[0]);
1550 result
= rpccli_samr_LookupNames(pipe_hnd
, mem_ctx
,
1556 if (!NT_STATUS_IS_OK(result
)) {
1557 d_fprintf(stderr
, _("Lookup of '%s' failed\n"),argv
[0]);
1561 switch (name_types
.ids
[0])
1563 case SID_NAME_DOM_GRP
:
1564 result
= rpccli_samr_OpenGroup(pipe_hnd
, mem_ctx
,
1566 MAXIMUM_ALLOWED_ACCESS
,
1569 if (!NT_STATUS_IS_OK(result
)) {
1570 d_fprintf(stderr
, _("Request open_group failed"));
1574 group_rid
= group_rids
.ids
[0];
1576 result
= rpccli_samr_QueryGroupMember(pipe_hnd
, mem_ctx
,
1580 if (!NT_STATUS_IS_OK(result
)) {
1582 _("Unable to query group members of %s"),
1587 if (c
->opt_verbose
) {
1589 _("Domain Group %s (rid: %d) has %d members\n"),
1590 argv
[0],group_rid
, rids
->count
);
1593 /* Check if group is anyone's primary group */
1594 for (i
= 0; i
< rids
->count
; i
++)
1596 result
= rpccli_samr_OpenUser(pipe_hnd
, mem_ctx
,
1598 MAXIMUM_ALLOWED_ACCESS
,
1602 if (!NT_STATUS_IS_OK(result
)) {
1604 _("Unable to open group member %d\n"),
1609 result
= rpccli_samr_QueryUserInfo(pipe_hnd
, mem_ctx
,
1614 if (!NT_STATUS_IS_OK(result
)) {
1616 _("Unable to lookup userinfo for group "
1622 if (info
->info21
.primary_gid
== group_rid
) {
1623 if (c
->opt_verbose
) {
1624 d_printf(_("Group is primary group "
1626 info
->info21
.account_name
.string
);
1628 group_is_primary
= true;
1631 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &user_pol
);
1634 if (group_is_primary
) {
1635 d_fprintf(stderr
, _("Unable to delete group because "
1636 "some of it's members have it as primary "
1638 result
= NT_STATUS_MEMBERS_PRIMARY_GROUP
;
1642 /* remove all group members */
1643 for (i
= 0; i
< rids
->count
; i
++)
1646 d_printf(_("Remove group member %d..."),
1648 result
= rpccli_samr_DeleteGroupMember(pipe_hnd
, mem_ctx
,
1652 if (NT_STATUS_IS_OK(result
)) {
1654 d_printf(_("ok\n"));
1657 d_printf("%s\n", _("failed"));
1662 result
= rpccli_samr_DeleteDomainGroup(pipe_hnd
, mem_ctx
,
1666 /* removing a local group is easier... */
1667 case SID_NAME_ALIAS
:
1668 result
= rpccli_samr_OpenAlias(pipe_hnd
, mem_ctx
,
1670 MAXIMUM_ALLOWED_ACCESS
,
1674 if (!NT_STATUS_IS_OK(result
)) {
1675 d_fprintf(stderr
, _("Request open_alias failed\n"));
1679 result
= rpccli_samr_DeleteDomAlias(pipe_hnd
, mem_ctx
,
1683 d_fprintf(stderr
, _("%s is of type %s. This command is only "
1684 "for deleting local or global groups\n"),
1685 argv
[0],sid_type_lookup(name_types
.ids
[0]));
1686 result
= NT_STATUS_UNSUCCESSFUL
;
1690 if (NT_STATUS_IS_OK(result
)) {
1692 d_printf(_("Deleted %s '%s'\n"),
1693 sid_type_lookup(name_types
.ids
[0]), argv
[0]);
1695 d_fprintf(stderr
, _("Deleting of %s failed: %s\n"), argv
[0],
1696 get_friendly_nt_error_msg(result
));
1704 static int rpc_group_delete(struct net_context
*c
, int argc
, const char **argv
)
1706 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
, 0,
1707 rpc_group_delete_internals
, argc
,argv
);
1710 static int rpc_group_add_internals(struct net_context
*c
, int argc
, const char **argv
)
1712 NET_API_STATUS status
;
1713 struct GROUP_INFO_1 info1
;
1714 uint32_t parm_error
= 0;
1716 if (argc
!= 1 || c
->display_usage
) {
1717 rpc_group_usage(c
, argc
, argv
);
1723 info1
.grpi1_name
= argv
[0];
1724 if (c
->opt_comment
&& strlen(c
->opt_comment
) > 0) {
1725 info1
.grpi1_comment
= c
->opt_comment
;
1728 status
= NetGroupAdd(c
->opt_host
, 1, (uint8_t *)&info1
, &parm_error
);
1732 _("Failed to add group '%s' with error: %s.\n"),
1733 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
1737 d_printf(_("Added group '%s'.\n"), argv
[0]);
1743 static int rpc_alias_add_internals(struct net_context
*c
, int argc
, const char **argv
)
1745 NET_API_STATUS status
;
1746 struct LOCALGROUP_INFO_1 info1
;
1747 uint32_t parm_error
= 0;
1749 if (argc
!= 1 || c
->display_usage
) {
1750 rpc_group_usage(c
, argc
, argv
);
1756 info1
.lgrpi1_name
= argv
[0];
1757 if (c
->opt_comment
&& strlen(c
->opt_comment
) > 0) {
1758 info1
.lgrpi1_comment
= c
->opt_comment
;
1761 status
= NetLocalGroupAdd(c
->opt_host
, 1, (uint8_t *)&info1
, &parm_error
);
1765 _("Failed to add alias '%s' with error: %s.\n"),
1766 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
1770 d_printf(_("Added alias '%s'.\n"), argv
[0]);
1776 static int rpc_group_add(struct net_context
*c
, int argc
, const char **argv
)
1778 if (c
->opt_localgroup
)
1779 return rpc_alias_add_internals(c
, argc
, argv
);
1781 return rpc_group_add_internals(c
, argc
, argv
);
1784 static NTSTATUS
get_sid_from_name(struct cli_state
*cli
,
1785 TALLOC_CTX
*mem_ctx
,
1787 struct dom_sid
*sid
,
1788 enum lsa_SidType
*type
)
1790 struct dom_sid
*sids
= NULL
;
1791 enum lsa_SidType
*types
= NULL
;
1792 struct rpc_pipe_client
*pipe_hnd
= NULL
;
1793 struct policy_handle lsa_pol
;
1794 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
1796 result
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
1798 if (!NT_STATUS_IS_OK(result
)) {
1802 result
= rpccli_lsa_open_policy(pipe_hnd
, mem_ctx
, false,
1803 SEC_FLAG_MAXIMUM_ALLOWED
, &lsa_pol
);
1805 if (!NT_STATUS_IS_OK(result
)) {
1809 result
= rpccli_lsa_lookup_names(pipe_hnd
, mem_ctx
, &lsa_pol
, 1,
1810 &name
, NULL
, 1, &sids
, &types
);
1812 if (NT_STATUS_IS_OK(result
)) {
1813 sid_copy(sid
, &sids
[0]);
1817 rpccli_lsa_Close(pipe_hnd
, mem_ctx
, &lsa_pol
);
1821 TALLOC_FREE(pipe_hnd
);
1824 if (!NT_STATUS_IS_OK(result
) && (StrnCaseCmp(name
, "S-", 2) == 0)) {
1826 /* Try as S-1-5-whatever */
1828 struct dom_sid tmp_sid
;
1830 if (string_to_sid(&tmp_sid
, name
)) {
1831 sid_copy(sid
, &tmp_sid
);
1832 *type
= SID_NAME_UNKNOWN
;
1833 result
= NT_STATUS_OK
;
1840 static NTSTATUS
rpc_add_groupmem(struct rpc_pipe_client
*pipe_hnd
,
1841 TALLOC_CTX
*mem_ctx
,
1842 const struct dom_sid
*group_sid
,
1845 struct policy_handle connect_pol
, domain_pol
;
1848 struct policy_handle group_pol
;
1850 struct samr_Ids rids
, rid_types
;
1851 struct lsa_String lsa_acct_name
;
1855 sid_copy(&sid
, group_sid
);
1857 if (!sid_split_rid(&sid
, &group_rid
)) {
1858 return NT_STATUS_UNSUCCESSFUL
;
1861 /* Get sam policy handle */
1862 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
1864 MAXIMUM_ALLOWED_ACCESS
,
1866 if (!NT_STATUS_IS_OK(result
)) {
1870 /* Get domain policy handle */
1871 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
1873 MAXIMUM_ALLOWED_ACCESS
,
1876 if (!NT_STATUS_IS_OK(result
)) {
1880 init_lsa_String(&lsa_acct_name
, member
);
1882 result
= rpccli_samr_LookupNames(pipe_hnd
, mem_ctx
,
1889 if (!NT_STATUS_IS_OK(result
)) {
1890 d_fprintf(stderr
, _("Could not lookup up group member %s\n"),
1895 result
= rpccli_samr_OpenGroup(pipe_hnd
, mem_ctx
,
1897 MAXIMUM_ALLOWED_ACCESS
,
1901 if (!NT_STATUS_IS_OK(result
)) {
1905 result
= rpccli_samr_AddGroupMember(pipe_hnd
, mem_ctx
,
1908 0x0005); /* unknown flags */
1911 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &connect_pol
);
1915 static NTSTATUS
rpc_add_aliasmem(struct rpc_pipe_client
*pipe_hnd
,
1916 TALLOC_CTX
*mem_ctx
,
1917 const struct dom_sid
*alias_sid
,
1920 struct policy_handle connect_pol
, domain_pol
;
1923 struct policy_handle alias_pol
;
1925 struct dom_sid member_sid
;
1926 enum lsa_SidType member_type
;
1930 sid_copy(&sid
, alias_sid
);
1932 if (!sid_split_rid(&sid
, &alias_rid
)) {
1933 return NT_STATUS_UNSUCCESSFUL
;
1936 result
= get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd
), mem_ctx
,
1937 member
, &member_sid
, &member_type
);
1939 if (!NT_STATUS_IS_OK(result
)) {
1940 d_fprintf(stderr
, _("Could not lookup up group member %s\n"),
1945 /* Get sam policy handle */
1946 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
1948 MAXIMUM_ALLOWED_ACCESS
,
1950 if (!NT_STATUS_IS_OK(result
)) {
1954 /* Get domain policy handle */
1955 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
1957 MAXIMUM_ALLOWED_ACCESS
,
1960 if (!NT_STATUS_IS_OK(result
)) {
1964 result
= rpccli_samr_OpenAlias(pipe_hnd
, mem_ctx
,
1966 MAXIMUM_ALLOWED_ACCESS
,
1970 if (!NT_STATUS_IS_OK(result
)) {
1974 result
= rpccli_samr_AddAliasMember(pipe_hnd
, mem_ctx
,
1978 if (!NT_STATUS_IS_OK(result
)) {
1983 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &connect_pol
);
1987 static NTSTATUS
rpc_group_addmem_internals(struct net_context
*c
,
1988 const struct dom_sid
*domain_sid
,
1989 const char *domain_name
,
1990 struct cli_state
*cli
,
1991 struct rpc_pipe_client
*pipe_hnd
,
1992 TALLOC_CTX
*mem_ctx
,
1996 struct dom_sid group_sid
;
1997 enum lsa_SidType group_type
;
1999 if (argc
!= 2 || c
->display_usage
) {
2002 _("net rpc group addmem <group> <member>\n"
2003 " Add a member to a group\n"
2004 " group\tGroup to add member to\n"
2005 " member\tMember to add to group\n"));
2006 return NT_STATUS_UNSUCCESSFUL
;
2009 if (!NT_STATUS_IS_OK(get_sid_from_name(cli
, mem_ctx
, argv
[0],
2010 &group_sid
, &group_type
))) {
2011 d_fprintf(stderr
, _("Could not lookup group name %s\n"),
2013 return NT_STATUS_UNSUCCESSFUL
;
2016 if (group_type
== SID_NAME_DOM_GRP
) {
2017 NTSTATUS result
= rpc_add_groupmem(pipe_hnd
, mem_ctx
,
2018 &group_sid
, argv
[1]);
2020 if (!NT_STATUS_IS_OK(result
)) {
2021 d_fprintf(stderr
, _("Could not add %s to %s: %s\n"),
2022 argv
[1], argv
[0], nt_errstr(result
));
2027 if (group_type
== SID_NAME_ALIAS
) {
2028 NTSTATUS result
= rpc_add_aliasmem(pipe_hnd
, mem_ctx
,
2029 &group_sid
, argv
[1]);
2031 if (!NT_STATUS_IS_OK(result
)) {
2032 d_fprintf(stderr
, _("Could not add %s to %s: %s\n"),
2033 argv
[1], argv
[0], nt_errstr(result
));
2038 d_fprintf(stderr
, _("Can only add members to global or local groups "
2039 "which %s is not\n"), argv
[0]);
2041 return NT_STATUS_UNSUCCESSFUL
;
2044 static int rpc_group_addmem(struct net_context
*c
, int argc
, const char **argv
)
2046 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
, 0,
2047 rpc_group_addmem_internals
,
2051 static NTSTATUS
rpc_del_groupmem(struct net_context
*c
,
2052 struct rpc_pipe_client
*pipe_hnd
,
2053 TALLOC_CTX
*mem_ctx
,
2054 const struct dom_sid
*group_sid
,
2057 struct policy_handle connect_pol
, domain_pol
;
2060 struct policy_handle group_pol
;
2062 struct samr_Ids rids
, rid_types
;
2063 struct lsa_String lsa_acct_name
;
2067 sid_copy(&sid
, group_sid
);
2069 if (!sid_split_rid(&sid
, &group_rid
))
2070 return NT_STATUS_UNSUCCESSFUL
;
2072 /* Get sam policy handle */
2073 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
2075 MAXIMUM_ALLOWED_ACCESS
,
2077 if (!NT_STATUS_IS_OK(result
))
2080 /* Get domain policy handle */
2081 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
2083 MAXIMUM_ALLOWED_ACCESS
,
2086 if (!NT_STATUS_IS_OK(result
))
2089 init_lsa_String(&lsa_acct_name
, member
);
2091 result
= rpccli_samr_LookupNames(pipe_hnd
, mem_ctx
,
2097 if (!NT_STATUS_IS_OK(result
)) {
2098 d_fprintf(stderr
, _("Could not lookup up group member %s\n"),
2103 result
= rpccli_samr_OpenGroup(pipe_hnd
, mem_ctx
,
2105 MAXIMUM_ALLOWED_ACCESS
,
2109 if (!NT_STATUS_IS_OK(result
))
2112 result
= rpccli_samr_DeleteGroupMember(pipe_hnd
, mem_ctx
,
2117 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &connect_pol
);
2121 static NTSTATUS
rpc_del_aliasmem(struct rpc_pipe_client
*pipe_hnd
,
2122 TALLOC_CTX
*mem_ctx
,
2123 const struct dom_sid
*alias_sid
,
2126 struct policy_handle connect_pol
, domain_pol
;
2129 struct policy_handle alias_pol
;
2131 struct dom_sid member_sid
;
2132 enum lsa_SidType member_type
;
2136 sid_copy(&sid
, alias_sid
);
2138 if (!sid_split_rid(&sid
, &alias_rid
))
2139 return NT_STATUS_UNSUCCESSFUL
;
2141 result
= get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd
), mem_ctx
,
2142 member
, &member_sid
, &member_type
);
2144 if (!NT_STATUS_IS_OK(result
)) {
2145 d_fprintf(stderr
, _("Could not lookup up group member %s\n"),
2150 /* Get sam policy handle */
2151 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
2153 MAXIMUM_ALLOWED_ACCESS
,
2155 if (!NT_STATUS_IS_OK(result
)) {
2159 /* Get domain policy handle */
2160 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
2162 MAXIMUM_ALLOWED_ACCESS
,
2165 if (!NT_STATUS_IS_OK(result
)) {
2169 result
= rpccli_samr_OpenAlias(pipe_hnd
, mem_ctx
,
2171 MAXIMUM_ALLOWED_ACCESS
,
2175 if (!NT_STATUS_IS_OK(result
))
2178 result
= rpccli_samr_DeleteAliasMember(pipe_hnd
, mem_ctx
,
2182 if (!NT_STATUS_IS_OK(result
))
2186 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &connect_pol
);
2190 static NTSTATUS
rpc_group_delmem_internals(struct net_context
*c
,
2191 const struct dom_sid
*domain_sid
,
2192 const char *domain_name
,
2193 struct cli_state
*cli
,
2194 struct rpc_pipe_client
*pipe_hnd
,
2195 TALLOC_CTX
*mem_ctx
,
2199 struct dom_sid group_sid
;
2200 enum lsa_SidType group_type
;
2202 if (argc
!= 2 || c
->display_usage
) {
2205 _("net rpc group delmem <group> <member>\n"
2206 " Delete a member from a group\n"
2207 " group\tGroup to delete member from\n"
2208 " member\tMember to delete from group\n"));
2209 return NT_STATUS_UNSUCCESSFUL
;
2212 if (!NT_STATUS_IS_OK(get_sid_from_name(cli
, mem_ctx
, argv
[0],
2213 &group_sid
, &group_type
))) {
2214 d_fprintf(stderr
, _("Could not lookup group name %s\n"),
2216 return NT_STATUS_UNSUCCESSFUL
;
2219 if (group_type
== SID_NAME_DOM_GRP
) {
2220 NTSTATUS result
= rpc_del_groupmem(c
, pipe_hnd
, mem_ctx
,
2221 &group_sid
, argv
[1]);
2223 if (!NT_STATUS_IS_OK(result
)) {
2224 d_fprintf(stderr
, _("Could not del %s from %s: %s\n"),
2225 argv
[1], argv
[0], nt_errstr(result
));
2230 if (group_type
== SID_NAME_ALIAS
) {
2231 NTSTATUS result
= rpc_del_aliasmem(pipe_hnd
, mem_ctx
,
2232 &group_sid
, argv
[1]);
2234 if (!NT_STATUS_IS_OK(result
)) {
2235 d_fprintf(stderr
, _("Could not del %s from %s: %s\n"),
2236 argv
[1], argv
[0], nt_errstr(result
));
2241 d_fprintf(stderr
, _("Can only delete members from global or local "
2242 "groups which %s is not\n"), argv
[0]);
2244 return NT_STATUS_UNSUCCESSFUL
;
2247 static int rpc_group_delmem(struct net_context
*c
, int argc
, const char **argv
)
2249 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
, 0,
2250 rpc_group_delmem_internals
,
2255 * List groups on a remote RPC server.
2257 * All parameters are provided by the run_rpc_command function, except for
2258 * argc, argv which are passes through.
2260 * @param domain_sid The domain sid acquired from the remote server.
2261 * @param cli A cli_state connected to the server.
2262 * @param mem_ctx Talloc context, destroyed on completion of the function.
2263 * @param argc Standard main() style argc.
2264 * @param argv Standard main() style argv. Initial components are already
2267 * @return Normal NTSTATUS return.
2270 static NTSTATUS
rpc_group_list_internals(struct net_context
*c
,
2271 const struct dom_sid
*domain_sid
,
2272 const char *domain_name
,
2273 struct cli_state
*cli
,
2274 struct rpc_pipe_client
*pipe_hnd
,
2275 TALLOC_CTX
*mem_ctx
,
2279 struct policy_handle connect_pol
, domain_pol
;
2280 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
2281 uint32 start_idx
=0, max_entries
=250, num_entries
, i
, loop_count
= 0;
2282 struct samr_SamArray
*groups
= NULL
;
2283 bool global
= false;
2285 bool builtin
= false;
2287 if (c
->display_usage
) {
2290 _("net rpc group list [global] [local] [builtin]\n"
2291 " List groups on RPC server\n"
2292 " global\tList global groups\n"
2293 " local\tList local groups\n"
2294 " builtin\tList builtin groups\n"
2295 " If none of global, local or builtin is "
2296 "specified, all three options are considered "
2298 return NT_STATUS_OK
;
2307 for (i
=0; i
<argc
; i
++) {
2308 if (strequal(argv
[i
], "global"))
2311 if (strequal(argv
[i
], "local"))
2314 if (strequal(argv
[i
], "builtin"))
2318 /* Get sam policy handle */
2320 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
2322 MAXIMUM_ALLOWED_ACCESS
,
2324 if (!NT_STATUS_IS_OK(result
)) {
2328 /* Get domain policy handle */
2330 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
2332 MAXIMUM_ALLOWED_ACCESS
,
2333 CONST_DISCARD(struct dom_sid2
*, domain_sid
),
2335 if (!NT_STATUS_IS_OK(result
)) {
2339 /* Query domain groups */
2340 if (c
->opt_long_list_entries
)
2341 d_printf(_("\nGroup name Comment"
2342 "\n-----------------------------\n"));
2344 uint32_t max_size
, total_size
, returned_size
;
2345 union samr_DispInfo info
;
2349 get_query_dispinfo_params(
2350 loop_count
, &max_entries
, &max_size
);
2352 result
= rpccli_samr_QueryDisplayInfo(pipe_hnd
, mem_ctx
,
2361 num_entries
= info
.info3
.count
;
2362 start_idx
+= info
.info3
.count
;
2364 if (!NT_STATUS_IS_OK(result
) &&
2365 !NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
))
2368 for (i
= 0; i
< num_entries
; i
++) {
2370 const char *group
= NULL
;
2371 const char *desc
= NULL
;
2373 group
= info
.info3
.entries
[i
].account_name
.string
;
2374 desc
= info
.info3
.entries
[i
].description
.string
;
2376 if (c
->opt_long_list_entries
)
2377 printf("%-21.21s %-50.50s\n",
2380 printf("%s\n", group
);
2382 } while (NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
2383 /* query domain aliases */
2388 result
= rpccli_samr_EnumDomainAliases(pipe_hnd
, mem_ctx
,
2394 if (!NT_STATUS_IS_OK(result
) &&
2395 !NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
))
2398 for (i
= 0; i
< num_entries
; i
++) {
2400 const char *description
= NULL
;
2402 if (c
->opt_long_list_entries
) {
2404 struct policy_handle alias_pol
;
2405 union samr_AliasInfo
*info
= NULL
;
2407 if ((NT_STATUS_IS_OK(rpccli_samr_OpenAlias(pipe_hnd
, mem_ctx
,
2410 groups
->entries
[i
].idx
,
2412 (NT_STATUS_IS_OK(rpccli_samr_QueryAliasInfo(pipe_hnd
, mem_ctx
,
2416 (NT_STATUS_IS_OK(rpccli_samr_Close(pipe_hnd
, mem_ctx
,
2418 description
= info
->description
.string
;
2422 if (description
!= NULL
) {
2423 printf("%-21.21s %-50.50s\n",
2424 groups
->entries
[i
].name
.string
,
2427 printf("%s\n", groups
->entries
[i
].name
.string
);
2430 } while (NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
2431 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &domain_pol
);
2432 /* Get builtin policy handle */
2434 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
2436 MAXIMUM_ALLOWED_ACCESS
,
2437 CONST_DISCARD(struct dom_sid2
*, &global_sid_Builtin
),
2439 if (!NT_STATUS_IS_OK(result
)) {
2442 /* query builtin aliases */
2445 if (!builtin
) break;
2447 result
= rpccli_samr_EnumDomainAliases(pipe_hnd
, mem_ctx
,
2453 if (!NT_STATUS_IS_OK(result
) &&
2454 !NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
))
2457 for (i
= 0; i
< num_entries
; i
++) {
2459 const char *description
= NULL
;
2461 if (c
->opt_long_list_entries
) {
2463 struct policy_handle alias_pol
;
2464 union samr_AliasInfo
*info
= NULL
;
2466 if ((NT_STATUS_IS_OK(rpccli_samr_OpenAlias(pipe_hnd
, mem_ctx
,
2469 groups
->entries
[i
].idx
,
2471 (NT_STATUS_IS_OK(rpccli_samr_QueryAliasInfo(pipe_hnd
, mem_ctx
,
2475 (NT_STATUS_IS_OK(rpccli_samr_Close(pipe_hnd
, mem_ctx
,
2477 description
= info
->description
.string
;
2481 if (description
!= NULL
) {
2482 printf("%-21.21s %-50.50s\n",
2483 groups
->entries
[i
].name
.string
,
2486 printf("%s\n", groups
->entries
[i
].name
.string
);
2489 } while (NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
2495 static int rpc_group_list(struct net_context
*c
, int argc
, const char **argv
)
2497 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
, 0,
2498 rpc_group_list_internals
,
2502 static NTSTATUS
rpc_list_group_members(struct net_context
*c
,
2503 struct rpc_pipe_client
*pipe_hnd
,
2504 TALLOC_CTX
*mem_ctx
,
2505 const char *domain_name
,
2506 const struct dom_sid
*domain_sid
,
2507 struct policy_handle
*domain_pol
,
2511 struct policy_handle group_pol
;
2512 uint32 num_members
, *group_rids
;
2514 struct samr_RidTypeArray
*rids
= NULL
;
2515 struct lsa_Strings names
;
2516 struct samr_Ids types
;
2519 sid_to_fstring(sid_str
, domain_sid
);
2521 result
= rpccli_samr_OpenGroup(pipe_hnd
, mem_ctx
,
2523 MAXIMUM_ALLOWED_ACCESS
,
2527 if (!NT_STATUS_IS_OK(result
))
2530 result
= rpccli_samr_QueryGroupMember(pipe_hnd
, mem_ctx
,
2534 if (!NT_STATUS_IS_OK(result
))
2537 num_members
= rids
->count
;
2538 group_rids
= rids
->rids
;
2540 while (num_members
> 0) {
2541 int this_time
= 512;
2543 if (num_members
< this_time
)
2544 this_time
= num_members
;
2546 result
= rpccli_samr_LookupRids(pipe_hnd
, mem_ctx
,
2553 if (!NT_STATUS_IS_OK(result
))
2556 /* We only have users as members, but make the output
2557 the same as the output of alias members */
2559 for (i
= 0; i
< this_time
; i
++) {
2561 if (c
->opt_long_list_entries
) {
2562 printf("%s-%d %s\\%s %d\n", sid_str
,
2563 group_rids
[i
], domain_name
,
2564 names
.names
[i
].string
,
2567 printf("%s\\%s\n", domain_name
,
2568 names
.names
[i
].string
);
2572 num_members
-= this_time
;
2576 return NT_STATUS_OK
;
2579 static NTSTATUS
rpc_list_alias_members(struct net_context
*c
,
2580 struct rpc_pipe_client
*pipe_hnd
,
2581 TALLOC_CTX
*mem_ctx
,
2582 struct policy_handle
*domain_pol
,
2586 struct rpc_pipe_client
*lsa_pipe
;
2587 struct policy_handle alias_pol
, lsa_pol
;
2589 struct dom_sid
*alias_sids
;
2592 enum lsa_SidType
*types
;
2594 struct lsa_SidArray sid_array
;
2596 result
= rpccli_samr_OpenAlias(pipe_hnd
, mem_ctx
,
2598 MAXIMUM_ALLOWED_ACCESS
,
2602 if (!NT_STATUS_IS_OK(result
))
2605 result
= rpccli_samr_GetMembersInAlias(pipe_hnd
, mem_ctx
,
2609 if (!NT_STATUS_IS_OK(result
)) {
2610 d_fprintf(stderr
, _("Couldn't list alias members\n"));
2614 num_members
= sid_array
.num_sids
;
2616 if (num_members
== 0) {
2617 return NT_STATUS_OK
;
2620 result
= cli_rpc_pipe_open_noauth(rpc_pipe_np_smb_conn(pipe_hnd
),
2621 &ndr_table_lsarpc
.syntax_id
,
2623 if (!NT_STATUS_IS_OK(result
)) {
2624 d_fprintf(stderr
, _("Couldn't open LSA pipe. Error was %s\n"),
2625 nt_errstr(result
) );
2629 result
= rpccli_lsa_open_policy(lsa_pipe
, mem_ctx
, true,
2630 SEC_FLAG_MAXIMUM_ALLOWED
, &lsa_pol
);
2632 if (!NT_STATUS_IS_OK(result
)) {
2633 d_fprintf(stderr
, _("Couldn't open LSA policy handle\n"));
2634 TALLOC_FREE(lsa_pipe
);
2638 alias_sids
= TALLOC_ZERO_ARRAY(mem_ctx
, struct dom_sid
, num_members
);
2640 d_fprintf(stderr
, _("Out of memory\n"));
2641 TALLOC_FREE(lsa_pipe
);
2642 return NT_STATUS_NO_MEMORY
;
2645 for (i
=0; i
<num_members
; i
++) {
2646 sid_copy(&alias_sids
[i
], sid_array
.sids
[i
].sid
);
2649 result
= rpccli_lsa_lookup_sids(lsa_pipe
, mem_ctx
, &lsa_pol
,
2650 num_members
, alias_sids
,
2651 &domains
, &names
, &types
);
2653 if (!NT_STATUS_IS_OK(result
) &&
2654 !NT_STATUS_EQUAL(result
, STATUS_SOME_UNMAPPED
)) {
2655 d_fprintf(stderr
, _("Couldn't lookup SIDs\n"));
2656 TALLOC_FREE(lsa_pipe
);
2660 for (i
= 0; i
< num_members
; i
++) {
2662 sid_to_fstring(sid_str
, &alias_sids
[i
]);
2664 if (c
->opt_long_list_entries
) {
2665 printf("%s %s\\%s %d\n", sid_str
,
2666 domains
[i
] ? domains
[i
] : _("*unknown*"),
2667 names
[i
] ? names
[i
] : _("*unknown*"), types
[i
]);
2670 printf("%s\\%s\n", domains
[i
], names
[i
]);
2672 printf("%s\n", sid_str
);
2676 TALLOC_FREE(lsa_pipe
);
2677 return NT_STATUS_OK
;
2680 static NTSTATUS
rpc_group_members_internals(struct net_context
*c
,
2681 const struct dom_sid
*domain_sid
,
2682 const char *domain_name
,
2683 struct cli_state
*cli
,
2684 struct rpc_pipe_client
*pipe_hnd
,
2685 TALLOC_CTX
*mem_ctx
,
2690 struct policy_handle connect_pol
, domain_pol
;
2691 struct samr_Ids rids
, rid_types
;
2692 struct lsa_String lsa_acct_name
;
2694 /* Get sam policy handle */
2696 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
2698 MAXIMUM_ALLOWED_ACCESS
,
2701 if (!NT_STATUS_IS_OK(result
))
2704 /* Get domain policy handle */
2706 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
2708 MAXIMUM_ALLOWED_ACCESS
,
2709 CONST_DISCARD(struct dom_sid2
*, domain_sid
),
2712 if (!NT_STATUS_IS_OK(result
))
2715 init_lsa_String(&lsa_acct_name
, argv
[0]); /* sure? */
2717 result
= rpccli_samr_LookupNames(pipe_hnd
, mem_ctx
,
2724 if (!NT_STATUS_IS_OK(result
)) {
2726 /* Ok, did not find it in the global sam, try with builtin */
2728 struct dom_sid sid_Builtin
;
2730 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &domain_pol
);
2732 sid_copy(&sid_Builtin
, &global_sid_Builtin
);
2734 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
2736 MAXIMUM_ALLOWED_ACCESS
,
2740 if (!NT_STATUS_IS_OK(result
)) {
2741 d_fprintf(stderr
, _("Couldn't find group %s\n"),
2746 result
= rpccli_samr_LookupNames(pipe_hnd
, mem_ctx
,
2753 if (!NT_STATUS_IS_OK(result
)) {
2754 d_fprintf(stderr
, _("Couldn't find group %s\n"),
2760 if (rids
.count
!= 1) {
2761 d_fprintf(stderr
, _("Couldn't find group %s\n"),
2766 if (rid_types
.ids
[0] == SID_NAME_DOM_GRP
) {
2767 return rpc_list_group_members(c
, pipe_hnd
, mem_ctx
, domain_name
,
2768 domain_sid
, &domain_pol
,
2772 if (rid_types
.ids
[0] == SID_NAME_ALIAS
) {
2773 return rpc_list_alias_members(c
, pipe_hnd
, mem_ctx
, &domain_pol
,
2777 return NT_STATUS_NO_SUCH_GROUP
;
2780 static int rpc_group_members(struct net_context
*c
, int argc
, const char **argv
)
2782 if (argc
!= 1 || c
->display_usage
) {
2783 return rpc_group_usage(c
, argc
, argv
);
2786 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
, 0,
2787 rpc_group_members_internals
,
2791 static int rpc_group_rename_internals(struct net_context
*c
, int argc
, const char **argv
)
2793 NET_API_STATUS status
;
2794 struct GROUP_INFO_0 g0
;
2798 d_printf(_("Usage:\n"));
2799 d_printf("net rpc group rename group newname\n");
2803 g0
.grpi0_name
= argv
[1];
2805 status
= NetGroupSetInfo(c
->opt_host
,
2812 d_fprintf(stderr
, _("Renaming group %s failed with: %s\n"),
2813 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
2821 static int rpc_group_rename(struct net_context
*c
, int argc
, const char **argv
)
2823 if (argc
!= 2 || c
->display_usage
) {
2824 return rpc_group_usage(c
, argc
, argv
);
2827 return rpc_group_rename_internals(c
, argc
, argv
);
2831 * 'net rpc group' entrypoint.
2832 * @param argc Standard main() style argc.
2833 * @param argv Standard main() style argv. Initial components are already
2837 int net_rpc_group(struct net_context
*c
, int argc
, const char **argv
)
2839 NET_API_STATUS status
;
2841 struct functable func
[] = {
2846 N_("Create specified group"),
2847 N_("net rpc group add\n"
2848 " Create specified group")
2854 N_("Delete specified group"),
2855 N_("net rpc group delete\n"
2856 " Delete specified group")
2862 N_("Add member to group"),
2863 N_("net rpc group addmem\n"
2864 " Add member to group")
2870 N_("Remove member from group"),
2871 N_("net rpc group delmem\n"
2872 " Remove member from group")
2879 N_("net rpc group list\n"
2886 N_("List group members"),
2887 N_("net rpc group members\n"
2888 " List group members")
2895 N_("net rpc group rename\n"
2898 {NULL
, NULL
, 0, NULL
, NULL
}
2901 status
= libnetapi_init(&c
->netapi_ctx
);
2905 libnetapi_set_username(c
->netapi_ctx
, c
->opt_user_name
);
2906 libnetapi_set_password(c
->netapi_ctx
, c
->opt_password
);
2907 if (c
->opt_kerberos
) {
2908 libnetapi_set_use_kerberos(c
->netapi_ctx
);
2912 if (c
->display_usage
) {
2913 d_printf(_("Usage:\n"));
2914 d_printf(_("net rpc group\n"
2915 " Alias for net rpc group list global "
2916 "local builtin\n"));
2917 net_display_usage_from_functable(func
);
2921 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
, 0,
2922 rpc_group_list_internals
,
2926 return net_run_function(c
, argc
, argv
, "net rpc group", func
);
2929 /****************************************************************************/
2931 static int rpc_share_usage(struct net_context
*c
, int argc
, const char **argv
)
2933 return net_share_usage(c
, argc
, argv
);
2937 * Add a share on a remote RPC server.
2939 * @param argc Standard main() style argc.
2940 * @param argv Standard main() style argv. Initial components are already
2943 * @return A shell status integer (0 for success).
2946 static int rpc_share_add(struct net_context
*c
, int argc
, const char **argv
)
2948 NET_API_STATUS status
;
2951 uint32 type
= STYPE_DISKTREE
; /* only allow disk shares to be added */
2952 uint32 num_users
=0, perms
=0;
2953 char *password
=NULL
; /* don't allow a share password */
2954 struct SHARE_INFO_2 i2
;
2955 uint32_t parm_error
= 0;
2957 if ((argc
< 1) || !strchr(argv
[0], '=') || c
->display_usage
) {
2958 return rpc_share_usage(c
, argc
, argv
);
2961 if ((sharename
= talloc_strdup(c
, argv
[0])) == NULL
) {
2965 path
= strchr(sharename
, '=');
2972 i2
.shi2_netname
= sharename
;
2973 i2
.shi2_type
= type
;
2974 i2
.shi2_remark
= c
->opt_comment
;
2975 i2
.shi2_permissions
= perms
;
2976 i2
.shi2_max_uses
= c
->opt_maxusers
;
2977 i2
.shi2_current_uses
= num_users
;
2978 i2
.shi2_path
= path
;
2979 i2
.shi2_passwd
= password
;
2981 status
= NetShareAdd(c
->opt_host
,
2986 printf(_("NetShareAdd failed with: %s\n"),
2987 libnetapi_get_error_string(c
->netapi_ctx
, status
));
2994 * Delete a share on a remote RPC server.
2996 * @param domain_sid The domain sid acquired from the remote server.
2997 * @param argc Standard main() style argc.
2998 * @param argv Standard main() style argv. Initial components are already
3001 * @return A shell status integer (0 for success).
3003 static int rpc_share_delete(struct net_context
*c
, int argc
, const char **argv
)
3005 if (argc
< 1 || c
->display_usage
) {
3006 return rpc_share_usage(c
, argc
, argv
);
3009 return NetShareDel(c
->opt_host
, argv
[0], 0);
3013 * Formatted print of share info
3015 * @param r pointer to SHARE_INFO_1 to format
3018 static void display_share_info_1(struct net_context
*c
,
3019 struct SHARE_INFO_1
*r
)
3021 if (c
->opt_long_list_entries
) {
3022 d_printf("%-12s %-8.8s %-50s\n",
3024 net_share_type_str(r
->shi1_type
& ~(STYPE_TEMPORARY
|STYPE_HIDDEN
)),
3027 d_printf("%s\n", r
->shi1_netname
);
3031 static WERROR
get_share_info(struct net_context
*c
,
3032 struct rpc_pipe_client
*pipe_hnd
,
3033 TALLOC_CTX
*mem_ctx
,
3037 struct srvsvc_NetShareInfoCtr
*info_ctr
)
3041 union srvsvc_NetShareInfo info
;
3043 /* no specific share requested, enumerate all */
3046 uint32_t preferred_len
= 0xffffffff;
3047 uint32_t total_entries
= 0;
3048 uint32_t resume_handle
= 0;
3050 info_ctr
->level
= level
;
3052 status
= rpccli_srvsvc_NetShareEnumAll(pipe_hnd
, mem_ctx
,
3062 /* request just one share */
3063 status
= rpccli_srvsvc_NetShareGetInfo(pipe_hnd
, mem_ctx
,
3070 if (!NT_STATUS_IS_OK(status
) || !W_ERROR_IS_OK(result
)) {
3075 ZERO_STRUCTP(info_ctr
);
3077 info_ctr
->level
= level
;
3082 struct srvsvc_NetShareCtr1
*ctr1
;
3084 ctr1
= TALLOC_ZERO_P(mem_ctx
, struct srvsvc_NetShareCtr1
);
3085 W_ERROR_HAVE_NO_MEMORY(ctr1
);
3088 ctr1
->array
= info
.info1
;
3090 info_ctr
->ctr
.ctr1
= ctr1
;
3094 struct srvsvc_NetShareCtr2
*ctr2
;
3096 ctr2
= TALLOC_ZERO_P(mem_ctx
, struct srvsvc_NetShareCtr2
);
3097 W_ERROR_HAVE_NO_MEMORY(ctr2
);
3100 ctr2
->array
= info
.info2
;
3102 info_ctr
->ctr
.ctr2
= ctr2
;
3106 struct srvsvc_NetShareCtr502
*ctr502
;
3108 ctr502
= TALLOC_ZERO_P(mem_ctx
, struct srvsvc_NetShareCtr502
);
3109 W_ERROR_HAVE_NO_MEMORY(ctr502
);
3112 ctr502
->array
= info
.info502
;
3114 info_ctr
->ctr
.ctr502
= ctr502
;
3122 * 'net rpc share list' entrypoint.
3123 * @param argc Standard main() style argc.
3124 * @param argv Standard main() style argv. Initial components are already
3127 static int rpc_share_list(struct net_context
*c
, int argc
, const char **argv
)
3129 NET_API_STATUS status
;
3130 struct SHARE_INFO_1
*i1
= NULL
;
3131 uint32_t entries_read
= 0;
3132 uint32_t total_entries
= 0;
3133 uint32_t resume_handle
= 0;
3134 uint32_t i
, level
= 1;
3136 if (c
->display_usage
) {
3138 "net rpc share list\n"
3141 _("List shares on remote server"));
3145 status
= NetShareEnum(c
->opt_host
,
3147 (uint8_t **)(void *)&i1
,
3156 /* Display results */
3158 if (c
->opt_long_list_entries
) {
3160 "\nEnumerating shared resources (exports) on remote server:\n\n"
3161 "\nShare name Type Description\n"
3162 "---------- ---- -----------\n"));
3164 for (i
= 0; i
< entries_read
; i
++)
3165 display_share_info_1(c
, &i1
[i
]);
3170 static bool check_share_availability(struct cli_state
*cli
, const char *netname
)
3174 status
= cli_tcon_andx(cli
, netname
, "A:", "", 0);
3175 if (!NT_STATUS_IS_OK(status
)) {
3176 d_printf(_("skipping [%s]: not a file share.\n"), netname
);
3180 status
= cli_tdis(cli
);
3181 if (!NT_STATUS_IS_OK(status
)) {
3182 d_printf(_("cli_tdis returned %s\n"), nt_errstr(status
));
3189 static bool check_share_sanity(struct net_context
*c
, struct cli_state
*cli
,
3190 const char *netname
, uint32 type
)
3192 /* only support disk shares */
3193 if (! ( type
== STYPE_DISKTREE
|| type
== (STYPE_DISKTREE
| STYPE_HIDDEN
)) ) {
3194 printf(_("share [%s] is not a diskshare (type: %x)\n"), netname
,
3199 /* skip builtin shares */
3200 /* FIXME: should print$ be added too ? */
3201 if (strequal(netname
,"IPC$") || strequal(netname
,"ADMIN$") ||
3202 strequal(netname
,"global"))
3205 if (c
->opt_exclude
&& in_list(netname
, c
->opt_exclude
, false)) {
3206 printf(_("excluding [%s]\n"), netname
);
3210 return check_share_availability(cli
, netname
);
3214 * Migrate shares from a remote RPC server to the local RPC server.
3216 * All parameters are provided by the run_rpc_command function, except for
3217 * argc, argv which are passed through.
3219 * @param domain_sid The domain sid acquired from the remote server.
3220 * @param cli A cli_state connected to the server.
3221 * @param mem_ctx Talloc context, destroyed on completion of the function.
3222 * @param argc Standard main() style argc.
3223 * @param argv Standard main() style argv. Initial components are already
3226 * @return Normal NTSTATUS return.
3229 static NTSTATUS
rpc_share_migrate_shares_internals(struct net_context
*c
,
3230 const struct dom_sid
*domain_sid
,
3231 const char *domain_name
,
3232 struct cli_state
*cli
,
3233 struct rpc_pipe_client
*pipe_hnd
,
3234 TALLOC_CTX
*mem_ctx
,
3239 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
3240 struct srvsvc_NetShareInfoCtr ctr_src
;
3242 struct rpc_pipe_client
*srvsvc_pipe
= NULL
;
3243 struct cli_state
*cli_dst
= NULL
;
3244 uint32 level
= 502; /* includes secdesc */
3245 uint32_t parm_error
= 0;
3247 result
= get_share_info(c
, pipe_hnd
, mem_ctx
, level
, argc
, argv
,
3249 if (!W_ERROR_IS_OK(result
))
3252 /* connect destination PI_SRVSVC */
3253 nt_status
= connect_dst_pipe(c
, &cli_dst
, &srvsvc_pipe
,
3254 &ndr_table_srvsvc
.syntax_id
);
3255 if (!NT_STATUS_IS_OK(nt_status
))
3259 for (i
= 0; i
< ctr_src
.ctr
.ctr502
->count
; i
++) {
3261 union srvsvc_NetShareInfo info
;
3262 struct srvsvc_NetShareInfo502 info502
=
3263 ctr_src
.ctr
.ctr502
->array
[i
];
3265 /* reset error-code */
3266 nt_status
= NT_STATUS_UNSUCCESSFUL
;
3268 if (!check_share_sanity(c
, cli
, info502
.name
, info502
.type
))
3271 /* finally add the share on the dst server */
3273 printf(_("migrating: [%s], path: %s, comment: %s, without "
3275 info502
.name
, info502
.path
, info502
.comment
);
3277 info
.info502
= &info502
;
3279 nt_status
= rpccli_srvsvc_NetShareAdd(srvsvc_pipe
, mem_ctx
,
3280 srvsvc_pipe
->desthost
,
3286 if (W_ERROR_V(result
) == W_ERROR_V(WERR_FILE_EXISTS
)) {
3287 printf(_(" [%s] does already exist\n"),
3292 if (!NT_STATUS_IS_OK(nt_status
) || !W_ERROR_IS_OK(result
)) {
3293 printf(_("cannot add share: %s\n"), win_errstr(result
));
3299 nt_status
= NT_STATUS_OK
;
3303 cli_shutdown(cli_dst
);
3311 * Migrate shares from a RPC server to another.
3313 * @param argc Standard main() style argc.
3314 * @param argv Standard main() style argv. Initial components are already
3317 * @return A shell status integer (0 for success).
3319 static int rpc_share_migrate_shares(struct net_context
*c
, int argc
,
3322 if (c
->display_usage
) {
3324 "net rpc share migrate shares\n"
3327 _("Migrate shares to local server"));
3332 printf(_("no server to migrate\n"));
3336 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
.syntax_id
, 0,
3337 rpc_share_migrate_shares_internals
,
3344 * @param f file_info
3345 * @param mask current search mask
3346 * @param state arg-pointer
3349 static void copy_fn(const char *mnt
, struct file_info
*f
,
3350 const char *mask
, void *state
)
3352 static NTSTATUS nt_status
;
3353 static struct copy_clistate
*local_state
;
3354 static fstring filename
, new_mask
;
3357 struct net_context
*c
;
3359 local_state
= (struct copy_clistate
*)state
;
3360 nt_status
= NT_STATUS_UNSUCCESSFUL
;
3364 if (strequal(f
->name
, ".") || strequal(f
->name
, ".."))
3367 DEBUG(3,("got mask: %s, name: %s\n", mask
, f
->name
));
3370 if (f
->mode
& aDIR
) {
3372 DEBUG(3,("got dir: %s\n", f
->name
));
3374 fstrcpy(dir
, local_state
->cwd
);
3376 fstrcat(dir
, f
->name
);
3378 switch (net_mode_share
)
3380 case NET_MODE_SHARE_MIGRATE
:
3381 /* create that directory */
3382 nt_status
= net_copy_file(c
, local_state
->mem_ctx
,
3383 local_state
->cli_share_src
,
3384 local_state
->cli_share_dst
,
3386 c
->opt_acls
? true : false,
3387 c
->opt_attrs
? true : false,
3388 c
->opt_timestamps
? true:false,
3392 d_fprintf(stderr
, _("Unsupported mode %d\n"), net_mode_share
);
3396 if (!NT_STATUS_IS_OK(nt_status
))
3397 printf(_("could not handle dir %s: %s\n"),
3398 dir
, nt_errstr(nt_status
));
3400 /* search below that directory */
3401 fstrcpy(new_mask
, dir
);
3402 fstrcat(new_mask
, "\\*");
3404 old_dir
= local_state
->cwd
;
3405 local_state
->cwd
= dir
;
3406 if (!sync_files(local_state
, new_mask
))
3407 printf(_("could not handle files\n"));
3408 local_state
->cwd
= old_dir
;
3415 fstrcpy(filename
, local_state
->cwd
);
3416 fstrcat(filename
, "\\");
3417 fstrcat(filename
, f
->name
);
3419 DEBUG(3,("got file: %s\n", filename
));
3421 switch (net_mode_share
)
3423 case NET_MODE_SHARE_MIGRATE
:
3424 nt_status
= net_copy_file(c
, local_state
->mem_ctx
,
3425 local_state
->cli_share_src
,
3426 local_state
->cli_share_dst
,
3428 c
->opt_acls
? true : false,
3429 c
->opt_attrs
? true : false,
3430 c
->opt_timestamps
? true: false,
3434 d_fprintf(stderr
, _("Unsupported file mode %d\n"),
3439 if (!NT_STATUS_IS_OK(nt_status
))
3440 printf(_("could not handle file %s: %s\n"),
3441 filename
, nt_errstr(nt_status
));
3446 * sync files, can be called recursivly to list files
3447 * and then call copy_fn for each file
3449 * @param cp_clistate pointer to the copy_clistate we work with
3450 * @param mask the current search mask
3452 * @return Boolean result
3454 static bool sync_files(struct copy_clistate
*cp_clistate
, const char *mask
)
3456 struct cli_state
*targetcli
;
3457 char *targetpath
= NULL
;
3460 DEBUG(3,("calling cli_list with mask: %s\n", mask
));
3462 if ( !cli_resolve_path(talloc_tos(), "", NULL
, cp_clistate
->cli_share_src
,
3463 mask
, &targetcli
, &targetpath
) ) {
3464 d_fprintf(stderr
, _("cli_resolve_path %s failed with error: "
3466 mask
, cli_errstr(cp_clistate
->cli_share_src
));
3470 status
= cli_list(targetcli
, targetpath
, cp_clistate
->attribute
,
3471 copy_fn
, cp_clistate
);
3472 if (!NT_STATUS_IS_OK(status
)) {
3473 d_fprintf(stderr
, _("listing %s failed with error: %s\n"),
3474 mask
, nt_errstr(status
));
3483 * Set the top level directory permissions before we do any further copies.
3484 * Should set up ACL inheritance.
3487 bool copy_top_level_perms(struct net_context
*c
,
3488 struct copy_clistate
*cp_clistate
,
3489 const char *sharename
)
3491 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
3493 switch (net_mode_share
) {
3494 case NET_MODE_SHARE_MIGRATE
:
3495 DEBUG(3,("calling net_copy_fileattr for '.' directory in share %s\n", sharename
));
3496 nt_status
= net_copy_fileattr(c
,
3497 cp_clistate
->mem_ctx
,
3498 cp_clistate
->cli_share_src
,
3499 cp_clistate
->cli_share_dst
,
3501 c
->opt_acls
? true : false,
3502 c
->opt_attrs
? true : false,
3503 c
->opt_timestamps
? true: false,
3507 d_fprintf(stderr
, _("Unsupported mode %d\n"), net_mode_share
);
3511 if (!NT_STATUS_IS_OK(nt_status
)) {
3512 printf(_("Could handle directory attributes for top level "
3513 "directory of share %s. Error %s\n"),
3514 sharename
, nt_errstr(nt_status
));
3522 * Sync all files inside a remote share to another share (over smb).
3524 * All parameters are provided by the run_rpc_command function, except for
3525 * argc, argv which are passed through.
3527 * @param domain_sid The domain sid acquired from the remote server.
3528 * @param cli A cli_state connected to the server.
3529 * @param mem_ctx Talloc context, destroyed on completion of the function.
3530 * @param argc Standard main() style argc.
3531 * @param argv Standard main() style argv. Initial components are already
3534 * @return Normal NTSTATUS return.
3537 static NTSTATUS
rpc_share_migrate_files_internals(struct net_context
*c
,
3538 const struct dom_sid
*domain_sid
,
3539 const char *domain_name
,
3540 struct cli_state
*cli
,
3541 struct rpc_pipe_client
*pipe_hnd
,
3542 TALLOC_CTX
*mem_ctx
,
3547 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
3548 struct srvsvc_NetShareInfoCtr ctr_src
;
3551 struct copy_clistate cp_clistate
;
3552 bool got_src_share
= false;
3553 bool got_dst_share
= false;
3554 const char *mask
= "\\*";
3557 dst
= SMB_STRDUP(c
->opt_destination
?c
->opt_destination
:"127.0.0.1");
3559 nt_status
= NT_STATUS_NO_MEMORY
;
3563 result
= get_share_info(c
, pipe_hnd
, mem_ctx
, level
, argc
, argv
,
3566 if (!W_ERROR_IS_OK(result
))
3569 for (i
= 0; i
< ctr_src
.ctr
.ctr502
->count
; i
++) {
3571 struct srvsvc_NetShareInfo502 info502
=
3572 ctr_src
.ctr
.ctr502
->array
[i
];
3574 if (!check_share_sanity(c
, cli
, info502
.name
, info502
.type
))
3577 /* one might not want to mirror whole discs :) */
3578 if (strequal(info502
.name
, "print$") || info502
.name
[1] == '$') {
3579 d_printf(_("skipping [%s]: builtin/hidden share\n"),
3584 switch (net_mode_share
)
3586 case NET_MODE_SHARE_MIGRATE
:
3590 d_fprintf(stderr
, _("Unsupported mode %d\n"),
3594 printf(_(" [%s] files and directories %s ACLs, %s DOS "
3597 c
->opt_acls
? _("including") : _("without"),
3598 c
->opt_attrs
? _("including") : _("without"),
3599 c
->opt_timestamps
? _("(preserving timestamps)") : "");
3601 cp_clistate
.mem_ctx
= mem_ctx
;
3602 cp_clistate
.cli_share_src
= NULL
;
3603 cp_clistate
.cli_share_dst
= NULL
;
3604 cp_clistate
.cwd
= NULL
;
3605 cp_clistate
.attribute
= aSYSTEM
| aHIDDEN
| aDIR
;
3608 /* open share source */
3609 nt_status
= connect_to_service(c
, &cp_clistate
.cli_share_src
,
3610 &cli
->dest_ss
, cli
->desthost
,
3611 info502
.name
, "A:");
3612 if (!NT_STATUS_IS_OK(nt_status
))
3615 got_src_share
= true;
3617 if (net_mode_share
== NET_MODE_SHARE_MIGRATE
) {
3618 /* open share destination */
3619 nt_status
= connect_to_service(c
, &cp_clistate
.cli_share_dst
,
3620 NULL
, dst
, info502
.name
, "A:");
3621 if (!NT_STATUS_IS_OK(nt_status
))
3624 got_dst_share
= true;
3627 if (!copy_top_level_perms(c
, &cp_clistate
, info502
.name
)) {
3628 d_fprintf(stderr
, _("Could not handle the top level "
3629 "directory permissions for the "
3630 "share: %s\n"), info502
.name
);
3631 nt_status
= NT_STATUS_UNSUCCESSFUL
;
3635 if (!sync_files(&cp_clistate
, mask
)) {
3636 d_fprintf(stderr
, _("could not handle files for share: "
3637 "%s\n"), info502
.name
);
3638 nt_status
= NT_STATUS_UNSUCCESSFUL
;
3643 nt_status
= NT_STATUS_OK
;
3648 cli_shutdown(cp_clistate
.cli_share_src
);
3651 cli_shutdown(cp_clistate
.cli_share_dst
);
3658 static int rpc_share_migrate_files(struct net_context
*c
, int argc
, const char **argv
)
3660 if (c
->display_usage
) {
3662 "net share migrate files\n"
3665 _("Migrate files to local server"));
3670 d_printf(_("no server to migrate\n"));
3674 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
.syntax_id
, 0,
3675 rpc_share_migrate_files_internals
,
3680 * Migrate share-ACLs from a remote RPC server to the local RPC server.
3682 * All parameters are provided by the run_rpc_command function, except for
3683 * argc, argv which are passed through.
3685 * @param domain_sid The domain sid acquired from the remote server.
3686 * @param cli A cli_state connected to the server.
3687 * @param mem_ctx Talloc context, destroyed on completion of the function.
3688 * @param argc Standard main() style argc.
3689 * @param argv Standard main() style argv. Initial components are already
3692 * @return Normal NTSTATUS return.
3695 static NTSTATUS
rpc_share_migrate_security_internals(struct net_context
*c
,
3696 const struct dom_sid
*domain_sid
,
3697 const char *domain_name
,
3698 struct cli_state
*cli
,
3699 struct rpc_pipe_client
*pipe_hnd
,
3700 TALLOC_CTX
*mem_ctx
,
3705 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
3706 struct srvsvc_NetShareInfoCtr ctr_src
;
3707 union srvsvc_NetShareInfo info
;
3709 struct rpc_pipe_client
*srvsvc_pipe
= NULL
;
3710 struct cli_state
*cli_dst
= NULL
;
3711 uint32 level
= 502; /* includes secdesc */
3712 uint32_t parm_error
= 0;
3714 result
= get_share_info(c
, pipe_hnd
, mem_ctx
, level
, argc
, argv
,
3717 if (!W_ERROR_IS_OK(result
))
3720 /* connect destination PI_SRVSVC */
3721 nt_status
= connect_dst_pipe(c
, &cli_dst
, &srvsvc_pipe
,
3722 &ndr_table_srvsvc
.syntax_id
);
3723 if (!NT_STATUS_IS_OK(nt_status
))
3727 for (i
= 0; i
< ctr_src
.ctr
.ctr502
->count
; i
++) {
3729 struct srvsvc_NetShareInfo502 info502
=
3730 ctr_src
.ctr
.ctr502
->array
[i
];
3732 /* reset error-code */
3733 nt_status
= NT_STATUS_UNSUCCESSFUL
;
3735 if (!check_share_sanity(c
, cli
, info502
.name
, info502
.type
))
3738 printf(_("migrating: [%s], path: %s, comment: %s, including "
3740 info502
.name
, info502
.path
, info502
.comment
);
3743 display_sec_desc(info502
.sd_buf
.sd
);
3745 /* FIXME: shouldn't we be able to just set the security descriptor ? */
3746 info
.info502
= &info502
;
3748 /* finally modify the share on the dst server */
3749 nt_status
= rpccli_srvsvc_NetShareSetInfo(srvsvc_pipe
, mem_ctx
,
3750 srvsvc_pipe
->desthost
,
3756 if (!NT_STATUS_IS_OK(nt_status
) || !W_ERROR_IS_OK(result
)) {
3757 printf(_("cannot set share-acl: %s\n"),
3758 win_errstr(result
));
3764 nt_status
= NT_STATUS_OK
;
3768 cli_shutdown(cli_dst
);
3776 * Migrate share-acls from a RPC server to another.
3778 * @param argc Standard main() style argc.
3779 * @param argv Standard main() style argv. Initial components are already
3782 * @return A shell status integer (0 for success).
3784 static int rpc_share_migrate_security(struct net_context
*c
, int argc
,
3787 if (c
->display_usage
) {
3789 "net rpc share migrate security\n"
3792 _("Migrate share-acls to local server"));
3797 d_printf(_("no server to migrate\n"));
3801 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
.syntax_id
, 0,
3802 rpc_share_migrate_security_internals
,
3807 * Migrate shares (including share-definitions, share-acls and files with acls/attrs)
3808 * from one server to another.
3810 * @param argc Standard main() style argc.
3811 * @param argv Standard main() style argv. Initial components are already
3814 * @return A shell status integer (0 for success).
3817 static int rpc_share_migrate_all(struct net_context
*c
, int argc
,
3822 if (c
->display_usage
) {
3824 "net rpc share migrate all\n"
3827 _("Migrates shares including all share settings"));
3832 d_printf(_("no server to migrate\n"));
3836 /* order is important. we don't want to be locked out by the share-acl
3837 * before copying files - gd */
3839 ret
= run_rpc_command(c
, NULL
, &ndr_table_srvsvc
.syntax_id
, 0,
3840 rpc_share_migrate_shares_internals
, argc
, argv
);
3844 ret
= run_rpc_command(c
, NULL
, &ndr_table_srvsvc
.syntax_id
, 0,
3845 rpc_share_migrate_files_internals
, argc
, argv
);
3849 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
.syntax_id
, 0,
3850 rpc_share_migrate_security_internals
, argc
,
3856 * 'net rpc share migrate' entrypoint.
3857 * @param argc Standard main() style argc.
3858 * @param argv Standard main() style argv. Initial components are already
3861 static int rpc_share_migrate(struct net_context
*c
, int argc
, const char **argv
)
3864 struct functable func
[] = {
3867 rpc_share_migrate_all
,
3869 N_("Migrate shares from remote to local server"),
3870 N_("net rpc share migrate all\n"
3871 " Migrate shares from remote to local server")
3875 rpc_share_migrate_files
,
3877 N_("Migrate files from remote to local server"),
3878 N_("net rpc share migrate files\n"
3879 " Migrate files from remote to local server")
3883 rpc_share_migrate_security
,
3885 N_("Migrate share-ACLs from remote to local server"),
3886 N_("net rpc share migrate security\n"
3887 " Migrate share-ACLs from remote to local server")
3891 rpc_share_migrate_shares
,
3893 N_("Migrate shares from remote to local server"),
3894 N_("net rpc share migrate shares\n"
3895 " Migrate shares from remote to local server")
3897 {NULL
, NULL
, 0, NULL
, NULL
}
3900 net_mode_share
= NET_MODE_SHARE_MIGRATE
;
3902 return net_run_function(c
, argc
, argv
, "net rpc share migrate", func
);
3908 struct dom_sid
*members
;
3911 static int num_server_aliases
;
3912 static struct full_alias
*server_aliases
;
3915 * Add an alias to the static list.
3917 static void push_alias(TALLOC_CTX
*mem_ctx
, struct full_alias
*alias
)
3919 if (server_aliases
== NULL
)
3920 server_aliases
= SMB_MALLOC_ARRAY(struct full_alias
, 100);
3922 server_aliases
[num_server_aliases
] = *alias
;
3923 num_server_aliases
+= 1;
3927 * For a specific domain on the server, fetch all the aliases
3928 * and their members. Add all of them to the server_aliases.
3931 static NTSTATUS
rpc_fetch_domain_aliases(struct rpc_pipe_client
*pipe_hnd
,
3932 TALLOC_CTX
*mem_ctx
,
3933 struct policy_handle
*connect_pol
,
3934 const struct dom_sid
*domain_sid
)
3936 uint32 start_idx
, max_entries
, num_entries
, i
;
3937 struct samr_SamArray
*groups
= NULL
;
3939 struct policy_handle domain_pol
;
3941 /* Get domain policy handle */
3943 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
3945 MAXIMUM_ALLOWED_ACCESS
,
3946 CONST_DISCARD(struct dom_sid2
*, domain_sid
),
3948 if (!NT_STATUS_IS_OK(result
))
3955 result
= rpccli_samr_EnumDomainAliases(pipe_hnd
, mem_ctx
,
3961 for (i
= 0; i
< num_entries
; i
++) {
3963 struct policy_handle alias_pol
;
3964 struct full_alias alias
;
3965 struct lsa_SidArray sid_array
;
3968 result
= rpccli_samr_OpenAlias(pipe_hnd
, mem_ctx
,
3970 MAXIMUM_ALLOWED_ACCESS
,
3971 groups
->entries
[i
].idx
,
3973 if (!NT_STATUS_IS_OK(result
))
3976 result
= rpccli_samr_GetMembersInAlias(pipe_hnd
, mem_ctx
,
3979 if (!NT_STATUS_IS_OK(result
))
3982 alias
.num_members
= sid_array
.num_sids
;
3984 result
= rpccli_samr_Close(pipe_hnd
, mem_ctx
, &alias_pol
);
3985 if (!NT_STATUS_IS_OK(result
))
3988 alias
.members
= NULL
;
3990 if (alias
.num_members
> 0) {
3991 alias
.members
= SMB_MALLOC_ARRAY(struct dom_sid
, alias
.num_members
);
3993 for (j
= 0; j
< alias
.num_members
; j
++)
3994 sid_copy(&alias
.members
[j
],
3995 sid_array
.sids
[j
].sid
);
3998 sid_compose(&alias
.sid
, domain_sid
,
3999 groups
->entries
[i
].idx
);
4001 push_alias(mem_ctx
, &alias
);
4003 } while (NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
4005 result
= NT_STATUS_OK
;
4008 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &domain_pol
);
4014 * Dump server_aliases as names for debugging purposes.
4017 static NTSTATUS
rpc_aliaslist_dump(struct net_context
*c
,
4018 const struct dom_sid
*domain_sid
,
4019 const char *domain_name
,
4020 struct cli_state
*cli
,
4021 struct rpc_pipe_client
*pipe_hnd
,
4022 TALLOC_CTX
*mem_ctx
,
4028 struct policy_handle lsa_pol
;
4030 result
= rpccli_lsa_open_policy(pipe_hnd
, mem_ctx
, true,
4031 SEC_FLAG_MAXIMUM_ALLOWED
,
4033 if (!NT_STATUS_IS_OK(result
))
4036 for (i
=0; i
<num_server_aliases
; i
++) {
4039 enum lsa_SidType
*types
;
4042 struct full_alias
*alias
= &server_aliases
[i
];
4044 result
= rpccli_lsa_lookup_sids(pipe_hnd
, mem_ctx
, &lsa_pol
, 1,
4046 &domains
, &names
, &types
);
4047 if (!NT_STATUS_IS_OK(result
))
4050 DEBUG(1, ("%s\\%s %d: ", domains
[0], names
[0], types
[0]));
4052 if (alias
->num_members
== 0) {
4057 result
= rpccli_lsa_lookup_sids(pipe_hnd
, mem_ctx
, &lsa_pol
,
4060 &domains
, &names
, &types
);
4062 if (!NT_STATUS_IS_OK(result
) &&
4063 !NT_STATUS_EQUAL(result
, STATUS_SOME_UNMAPPED
))
4066 for (j
=0; j
<alias
->num_members
; j
++)
4067 DEBUG(1, ("%s\\%s (%d); ",
4068 domains
[j
] ? domains
[j
] : "*unknown*",
4069 names
[j
] ? names
[j
] : "*unknown*",types
[j
]));
4073 rpccli_lsa_Close(pipe_hnd
, mem_ctx
, &lsa_pol
);
4075 return NT_STATUS_OK
;
4079 * Fetch a list of all server aliases and their members into
4083 static NTSTATUS
rpc_aliaslist_internals(struct net_context
*c
,
4084 const struct dom_sid
*domain_sid
,
4085 const char *domain_name
,
4086 struct cli_state
*cli
,
4087 struct rpc_pipe_client
*pipe_hnd
,
4088 TALLOC_CTX
*mem_ctx
,
4093 struct policy_handle connect_pol
;
4095 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
4097 MAXIMUM_ALLOWED_ACCESS
,
4100 if (!NT_STATUS_IS_OK(result
))
4103 result
= rpc_fetch_domain_aliases(pipe_hnd
, mem_ctx
, &connect_pol
,
4104 &global_sid_Builtin
);
4106 if (!NT_STATUS_IS_OK(result
))
4109 result
= rpc_fetch_domain_aliases(pipe_hnd
, mem_ctx
, &connect_pol
,
4112 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &connect_pol
);
4117 static void init_user_token(struct security_token
*token
, struct dom_sid
*user_sid
)
4119 token
->num_sids
= 4;
4121 if (!(token
->sids
= SMB_MALLOC_ARRAY(struct dom_sid
, 4))) {
4122 d_fprintf(stderr
, "malloc %s\n",_("failed"));
4123 token
->num_sids
= 0;
4127 token
->sids
[0] = *user_sid
;
4128 sid_copy(&token
->sids
[1], &global_sid_World
);
4129 sid_copy(&token
->sids
[2], &global_sid_Network
);
4130 sid_copy(&token
->sids
[3], &global_sid_Authenticated_Users
);
4133 static void free_user_token(struct security_token
*token
)
4135 SAFE_FREE(token
->sids
);
4138 static void add_sid_to_token(struct security_token
*token
, struct dom_sid
*sid
)
4140 if (is_sid_in_token(token
, sid
))
4143 token
->sids
= SMB_REALLOC_ARRAY(token
->sids
, struct dom_sid
, token
->num_sids
+1);
4148 sid_copy(&token
->sids
[token
->num_sids
], sid
);
4150 token
->num_sids
+= 1;
4155 struct security_token token
;
4158 static void dump_user_token(struct user_token
*token
)
4162 d_printf("%s\n", token
->name
);
4164 for (i
=0; i
<token
->token
.num_sids
; i
++) {
4165 d_printf(" %s\n", sid_string_tos(&token
->token
.sids
[i
]));
4169 static bool is_alias_member(struct dom_sid
*sid
, struct full_alias
*alias
)
4173 for (i
=0; i
<alias
->num_members
; i
++) {
4174 if (sid_compare(sid
, &alias
->members
[i
]) == 0)
4181 static void collect_sid_memberships(struct security_token
*token
, struct dom_sid sid
)
4185 for (i
=0; i
<num_server_aliases
; i
++) {
4186 if (is_alias_member(&sid
, &server_aliases
[i
]))
4187 add_sid_to_token(token
, &server_aliases
[i
].sid
);
4192 * We got a user token with all the SIDs we can know about without asking the
4193 * server directly. These are the user and domain group sids. All of these can
4194 * be members of aliases. So scan the list of aliases for each of the SIDs and
4195 * add them to the token.
4198 static void collect_alias_memberships(struct security_token
*token
)
4200 int num_global_sids
= token
->num_sids
;
4203 for (i
=0; i
<num_global_sids
; i
++) {
4204 collect_sid_memberships(token
, token
->sids
[i
]);
4208 static bool get_user_sids(const char *domain
, const char *user
, struct security_token
*token
)
4210 wbcErr wbc_status
= WBC_ERR_UNKNOWN_FAILURE
;
4211 enum wbcSidType type
;
4213 struct wbcDomainSid wsid
;
4214 char *sid_str
= NULL
;
4215 struct dom_sid user_sid
;
4216 uint32_t num_groups
;
4217 gid_t
*groups
= NULL
;
4220 fstr_sprintf(full_name
, "%s%c%s",
4221 domain
, *lp_winbind_separator(), user
);
4223 /* First let's find out the user sid */
4225 wbc_status
= wbcLookupName(domain
, user
, &wsid
, &type
);
4227 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4228 DEBUG(1, ("winbind could not find %s: %s\n",
4229 full_name
, wbcErrorString(wbc_status
)));
4233 wbc_status
= wbcSidToString(&wsid
, &sid_str
);
4234 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4238 if (type
!= SID_NAME_USER
) {
4239 wbcFreeMemory(sid_str
);
4240 DEBUG(1, ("%s is not a user\n", full_name
));
4244 if (!string_to_sid(&user_sid
, sid_str
)) {
4245 DEBUG(1,("Could not convert sid %s from string\n", sid_str
));
4249 wbcFreeMemory(sid_str
);
4252 init_user_token(token
, &user_sid
);
4254 /* And now the groups winbind knows about */
4256 wbc_status
= wbcGetGroups(full_name
, &num_groups
, &groups
);
4257 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4258 DEBUG(1, ("winbind could not get groups of %s: %s\n",
4259 full_name
, wbcErrorString(wbc_status
)));
4263 for (i
= 0; i
< num_groups
; i
++) {
4264 gid_t gid
= groups
[i
];
4267 wbc_status
= wbcGidToSid(gid
, &wsid
);
4268 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4269 DEBUG(1, ("winbind could not find SID of gid %u: %s\n",
4270 (unsigned int)gid
, wbcErrorString(wbc_status
)));
4271 wbcFreeMemory(groups
);
4275 wbc_status
= wbcSidToString(&wsid
, &sid_str
);
4276 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4277 wbcFreeMemory(groups
);
4281 DEBUG(3, (" %s\n", sid_str
));
4283 string_to_sid(&sid
, sid_str
);
4284 wbcFreeMemory(sid_str
);
4287 add_sid_to_token(token
, &sid
);
4289 wbcFreeMemory(groups
);
4295 * Get a list of all user tokens we want to look at
4298 static bool get_user_tokens(struct net_context
*c
, int *num_tokens
,
4299 struct user_token
**user_tokens
)
4301 wbcErr wbc_status
= WBC_ERR_UNKNOWN_FAILURE
;
4302 uint32_t i
, num_users
;
4304 struct user_token
*result
;
4305 TALLOC_CTX
*frame
= NULL
;
4307 if (lp_winbind_use_default_domain() &&
4308 (c
->opt_target_workgroup
== NULL
)) {
4309 d_fprintf(stderr
, _("winbind use default domain = yes set, "
4310 "please specify a workgroup\n"));
4314 /* Send request to winbind daemon */
4316 wbc_status
= wbcListUsers(NULL
, &num_users
, &users
);
4317 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4318 DEBUG(1, (_("winbind could not list users: %s\n"),
4319 wbcErrorString(wbc_status
)));
4323 result
= SMB_MALLOC_ARRAY(struct user_token
, num_users
);
4325 if (result
== NULL
) {
4326 DEBUG(1, ("Could not malloc sid array\n"));
4327 wbcFreeMemory(users
);
4331 frame
= talloc_stackframe();
4332 for (i
=0; i
< num_users
; i
++) {
4333 fstring domain
, user
;
4336 fstrcpy(result
[i
].name
, users
[i
]);
4338 p
= strchr(users
[i
], *lp_winbind_separator());
4340 DEBUG(3, ("%s\n", users
[i
]));
4343 fstrcpy(domain
, c
->opt_target_workgroup
);
4344 fstrcpy(user
, users
[i
]);
4347 fstrcpy(domain
, users
[i
]);
4352 get_user_sids(domain
, user
, &(result
[i
].token
));
4356 wbcFreeMemory(users
);
4358 *num_tokens
= num_users
;
4359 *user_tokens
= result
;
4364 static bool get_user_tokens_from_file(FILE *f
,
4366 struct user_token
**tokens
)
4368 struct user_token
*token
= NULL
;
4373 if (fgets(line
, sizeof(line
)-1, f
) == NULL
) {
4377 if ((strlen(line
) > 0) && (line
[strlen(line
)-1] == '\n')) {
4378 line
[strlen(line
)-1] = '\0';
4381 if (line
[0] == ' ') {
4385 if(!string_to_sid(&sid
, &line
[1])) {
4386 DEBUG(1,("get_user_tokens_from_file: Could "
4387 "not convert sid %s \n",&line
[1]));
4391 if (token
== NULL
) {
4392 DEBUG(0, ("File does not begin with username"));
4396 add_sid_to_token(&token
->token
, &sid
);
4400 /* And a new user... */
4403 *tokens
= SMB_REALLOC_ARRAY(*tokens
, struct user_token
, *num_tokens
);
4404 if (*tokens
== NULL
) {
4405 DEBUG(0, ("Could not realloc tokens\n"));
4409 token
= &((*tokens
)[*num_tokens
-1]);
4411 fstrcpy(token
->name
, line
);
4412 token
->token
.num_sids
= 0;
4413 token
->token
.sids
= NULL
;
4422 * Show the list of all users that have access to a share
4425 static void show_userlist(struct rpc_pipe_client
*pipe_hnd
,
4426 TALLOC_CTX
*mem_ctx
,
4427 const char *netname
,
4429 struct user_token
*tokens
)
4432 struct security_descriptor
*share_sd
= NULL
;
4433 struct security_descriptor
*root_sd
= NULL
;
4434 struct cli_state
*cli
= rpc_pipe_np_smb_conn(pipe_hnd
);
4436 union srvsvc_NetShareInfo info
;
4441 status
= rpccli_srvsvc_NetShareGetInfo(pipe_hnd
, mem_ctx
,
4448 if (!NT_STATUS_IS_OK(status
) || !W_ERROR_IS_OK(result
)) {
4449 DEBUG(1, ("Coult not query secdesc for share %s\n",
4454 share_sd
= info
.info502
->sd_buf
.sd
;
4455 if (share_sd
== NULL
) {
4456 DEBUG(1, ("Got no secdesc for share %s\n",
4462 if (!NT_STATUS_IS_OK(cli_tcon_andx(cli
, netname
, "A:", "", 0))) {
4466 if (!NT_STATUS_IS_OK(cli_ntcreate(cli
, "\\", 0, READ_CONTROL_ACCESS
, 0,
4467 FILE_SHARE_READ
|FILE_SHARE_WRITE
, FILE_OPEN
, 0x0, 0x0, &fnum
))) {
4468 root_sd
= cli_query_secdesc(cli
, fnum
, mem_ctx
);
4471 for (i
=0; i
<num_tokens
; i
++) {
4474 if (share_sd
!= NULL
) {
4475 status
= se_access_check(share_sd
, &tokens
[i
].token
,
4478 if (!NT_STATUS_IS_OK(status
)) {
4479 DEBUG(1, ("Could not check share_sd for "
4486 if (root_sd
== NULL
) {
4487 d_printf(" %s\n", tokens
[i
].name
);
4491 status
= se_access_check(root_sd
, &tokens
[i
].token
,
4493 if (!NT_STATUS_IS_OK(status
)) {
4494 DEBUG(1, ("Could not check root_sd for user %s\n",
4498 d_printf(" %s\n", tokens
[i
].name
);
4501 if (fnum
!= (uint16_t)-1)
4502 cli_close(cli
, fnum
);
4514 static void collect_share(const char *name
, uint32 m
,
4515 const char *comment
, void *state
)
4517 struct share_list
*share_list
= (struct share_list
*)state
;
4519 if (m
!= STYPE_DISKTREE
)
4522 share_list
->num_shares
+= 1;
4523 share_list
->shares
= SMB_REALLOC_ARRAY(share_list
->shares
, char *, share_list
->num_shares
);
4524 if (!share_list
->shares
) {
4525 share_list
->num_shares
= 0;
4528 share_list
->shares
[share_list
->num_shares
-1] = SMB_STRDUP(name
);
4532 * List shares on a remote RPC server, including the security descriptors.
4534 * All parameters are provided by the run_rpc_command function, except for
4535 * argc, argv which are passed through.
4537 * @param domain_sid The domain sid acquired from the remote server.
4538 * @param cli A cli_state connected to the server.
4539 * @param mem_ctx Talloc context, destroyed on completion of the function.
4540 * @param argc Standard main() style argc.
4541 * @param argv Standard main() style argv. Initial components are already
4544 * @return Normal NTSTATUS return.
4547 static NTSTATUS
rpc_share_allowedusers_internals(struct net_context
*c
,
4548 const struct dom_sid
*domain_sid
,
4549 const char *domain_name
,
4550 struct cli_state
*cli
,
4551 struct rpc_pipe_client
*pipe_hnd
,
4552 TALLOC_CTX
*mem_ctx
,
4561 struct user_token
*tokens
= NULL
;
4564 struct share_list share_list
;
4569 f
= fopen(argv
[0], "r");
4573 DEBUG(0, ("Could not open userlist: %s\n", strerror(errno
)));
4574 return NT_STATUS_UNSUCCESSFUL
;
4577 r
= get_user_tokens_from_file(f
, &num_tokens
, &tokens
);
4583 DEBUG(0, ("Could not read users from file\n"));
4584 return NT_STATUS_UNSUCCESSFUL
;
4587 for (i
=0; i
<num_tokens
; i
++)
4588 collect_alias_memberships(&tokens
[i
].token
);
4590 share_list
.num_shares
= 0;
4591 share_list
.shares
= NULL
;
4593 ret
= cli_RNetShareEnum(cli
, collect_share
, &share_list
);
4596 DEBUG(0, ("Error returning browse list: %s\n",
4601 for (i
= 0; i
< share_list
.num_shares
; i
++) {
4602 char *netname
= share_list
.shares
[i
];
4604 if (netname
[strlen(netname
)-1] == '$')
4607 d_printf("%s\n", netname
);
4609 show_userlist(pipe_hnd
, mem_ctx
, netname
,
4610 num_tokens
, tokens
);
4613 for (i
=0; i
<num_tokens
; i
++) {
4614 free_user_token(&tokens
[i
].token
);
4617 SAFE_FREE(share_list
.shares
);
4619 return NT_STATUS_OK
;
4622 static int rpc_share_allowedusers(struct net_context
*c
, int argc
,
4627 if (c
->display_usage
) {
4629 "net rpc share allowedusers\n"
4632 _("List allowed users"));
4636 result
= run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
, 0,
4637 rpc_aliaslist_internals
,
4642 result
= run_rpc_command(c
, NULL
, &ndr_table_lsarpc
.syntax_id
, 0,
4648 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
.syntax_id
, 0,
4649 rpc_share_allowedusers_internals
,
4653 int net_usersidlist(struct net_context
*c
, int argc
, const char **argv
)
4656 struct user_token
*tokens
= NULL
;
4660 net_usersidlist_usage(c
, argc
, argv
);
4664 if (!get_user_tokens(c
, &num_tokens
, &tokens
)) {
4665 DEBUG(0, ("Could not get the user/sid list\n"));
4669 for (i
=0; i
<num_tokens
; i
++) {
4670 dump_user_token(&tokens
[i
]);
4671 free_user_token(&tokens
[i
].token
);
4678 int net_usersidlist_usage(struct net_context
*c
, int argc
, const char **argv
)
4680 d_printf(_("net usersidlist\n"
4681 "\tprints out a list of all users the running winbind knows\n"
4682 "\tabout, together with all their SIDs. This is used as\n"
4683 "\tinput to the 'net rpc share allowedusers' command.\n\n"));
4685 net_common_flags_usage(c
, argc
, argv
);
4690 * 'net rpc share' entrypoint.
4691 * @param argc Standard main() style argc.
4692 * @param argv Standard main() style argv. Initial components are already
4696 int net_rpc_share(struct net_context
*c
, int argc
, const char **argv
)
4698 NET_API_STATUS status
;
4700 struct functable func
[] = {
4706 N_("net rpc share add\n"
4714 N_("net rpc share delete\n"
4719 rpc_share_allowedusers
,
4721 N_("Modify allowed users"),
4722 N_("net rpc share allowedusers\n"
4723 " Modify allowed users")
4729 N_("Migrate share to local server"),
4730 N_("net rpc share migrate\n"
4731 " Migrate share to local server")
4738 N_("net rpc share list\n"
4741 {NULL
, NULL
, 0, NULL
, NULL
}
4744 status
= libnetapi_init(&c
->netapi_ctx
);
4748 libnetapi_set_username(c
->netapi_ctx
, c
->opt_user_name
);
4749 libnetapi_set_password(c
->netapi_ctx
, c
->opt_password
);
4750 if (c
->opt_kerberos
) {
4751 libnetapi_set_use_kerberos(c
->netapi_ctx
);
4755 if (c
->display_usage
) {
4760 " Alias for net rpc share list\n"));
4761 net_display_usage_from_functable(func
);
4765 return rpc_share_list(c
, argc
, argv
);
4768 return net_run_function(c
, argc
, argv
, "net rpc share", func
);
4771 static NTSTATUS
rpc_sh_share_list(struct net_context
*c
,
4772 TALLOC_CTX
*mem_ctx
,
4773 struct rpc_sh_ctx
*ctx
,
4774 struct rpc_pipe_client
*pipe_hnd
,
4775 int argc
, const char **argv
)
4778 return werror_to_ntstatus(W_ERROR(rpc_share_list(c
, argc
, argv
)));
4781 static NTSTATUS
rpc_sh_share_add(struct net_context
*c
,
4782 TALLOC_CTX
*mem_ctx
,
4783 struct rpc_sh_ctx
*ctx
,
4784 struct rpc_pipe_client
*pipe_hnd
,
4785 int argc
, const char **argv
)
4787 NET_API_STATUS status
;
4788 uint32_t parm_err
= 0;
4789 struct SHARE_INFO_2 i2
;
4791 if ((argc
< 2) || (argc
> 3)) {
4792 d_fprintf(stderr
, _("Usage: %s <share> <path> [comment]\n"),
4794 return NT_STATUS_INVALID_PARAMETER
;
4797 i2
.shi2_netname
= argv
[0];
4798 i2
.shi2_type
= STYPE_DISKTREE
;
4799 i2
.shi2_remark
= (argc
== 3) ? argv
[2] : "";
4800 i2
.shi2_permissions
= 0;
4801 i2
.shi2_max_uses
= 0;
4802 i2
.shi2_current_uses
= 0;
4803 i2
.shi2_path
= argv
[1];
4804 i2
.shi2_passwd
= NULL
;
4806 status
= NetShareAdd(pipe_hnd
->desthost
,
4811 return werror_to_ntstatus(W_ERROR(status
));
4814 static NTSTATUS
rpc_sh_share_delete(struct net_context
*c
,
4815 TALLOC_CTX
*mem_ctx
,
4816 struct rpc_sh_ctx
*ctx
,
4817 struct rpc_pipe_client
*pipe_hnd
,
4818 int argc
, const char **argv
)
4821 d_fprintf(stderr
, "%s %s <share>\n", _("Usage:"), ctx
->whoami
);
4822 return NT_STATUS_INVALID_PARAMETER
;
4825 return werror_to_ntstatus(W_ERROR(NetShareDel(pipe_hnd
->desthost
, argv
[0], 0)));
4828 static NTSTATUS
rpc_sh_share_info(struct net_context
*c
,
4829 TALLOC_CTX
*mem_ctx
,
4830 struct rpc_sh_ctx
*ctx
,
4831 struct rpc_pipe_client
*pipe_hnd
,
4832 int argc
, const char **argv
)
4834 union srvsvc_NetShareInfo info
;
4839 d_fprintf(stderr
, "%s %s <share>\n", _("Usage:"), ctx
->whoami
);
4840 return NT_STATUS_INVALID_PARAMETER
;
4843 status
= rpccli_srvsvc_NetShareGetInfo(pipe_hnd
, mem_ctx
,
4849 if (!NT_STATUS_IS_OK(status
) || !W_ERROR_IS_OK(result
)) {
4853 d_printf(_("Name: %s\n"), info
.info2
->name
);
4854 d_printf(_("Comment: %s\n"), info
.info2
->comment
);
4855 d_printf(_("Path: %s\n"), info
.info2
->path
);
4856 d_printf(_("Password: %s\n"), info
.info2
->password
);
4859 return werror_to_ntstatus(result
);
4862 struct rpc_sh_cmd
*net_rpc_share_cmds(struct net_context
*c
, TALLOC_CTX
*mem_ctx
,
4863 struct rpc_sh_ctx
*ctx
)
4865 static struct rpc_sh_cmd cmds
[] = {
4867 { "list", NULL
, &ndr_table_srvsvc
.syntax_id
, rpc_sh_share_list
,
4868 N_("List available shares") },
4870 { "add", NULL
, &ndr_table_srvsvc
.syntax_id
, rpc_sh_share_add
,
4871 N_("Add a share") },
4873 { "delete", NULL
, &ndr_table_srvsvc
.syntax_id
, rpc_sh_share_delete
,
4874 N_("Delete a share") },
4876 { "info", NULL
, &ndr_table_srvsvc
.syntax_id
, rpc_sh_share_info
,
4877 N_("Get information about a share") },
4879 { NULL
, NULL
, 0, NULL
, NULL
}
4885 /****************************************************************************/
4887 static int rpc_file_usage(struct net_context
*c
, int argc
, const char **argv
)
4889 return net_file_usage(c
, argc
, argv
);
4893 * Close a file on a remote RPC server.
4895 * @param argc Standard main() style argc.
4896 * @param argv Standard main() style argv. Initial components are already
4899 * @return A shell status integer (0 for success).
4901 static int rpc_file_close(struct net_context
*c
, int argc
, const char **argv
)
4903 if (argc
< 1 || c
->display_usage
) {
4904 return rpc_file_usage(c
, argc
, argv
);
4907 return NetFileClose(c
->opt_host
, atoi(argv
[0]));
4911 * Formatted print of open file info
4913 * @param r struct FILE_INFO_3 contents
4916 static void display_file_info_3(struct FILE_INFO_3
*r
)
4918 d_printf("%-7.1d %-20.20s 0x%-4.2x %-6.1d %s\n",
4919 r
->fi3_id
, r
->fi3_username
, r
->fi3_permissions
,
4920 r
->fi3_num_locks
, r
->fi3_pathname
);
4924 * List files for a user on a remote RPC server.
4926 * @param argc Standard main() style argc.
4927 * @param argv Standard main() style argv. Initial components are already
4930 * @return A shell status integer (0 for success)..
4933 static int rpc_file_user(struct net_context
*c
, int argc
, const char **argv
)
4935 NET_API_STATUS status
;
4936 uint32 preferred_len
= 0xffffffff, i
;
4937 const char *username
=NULL
;
4938 uint32_t total_entries
= 0;
4939 uint32_t entries_read
= 0;
4940 uint32_t resume_handle
= 0;
4941 struct FILE_INFO_3
*i3
= NULL
;
4943 if (c
->display_usage
) {
4944 return rpc_file_usage(c
, argc
, argv
);
4947 /* if argc > 0, must be user command */
4949 username
= smb_xstrdup(argv
[0]);
4952 status
= NetFileEnum(c
->opt_host
,
4956 (uint8_t **)(void *)&i3
,
4966 /* Display results */
4969 "\nEnumerating open files on remote server:\n\n"
4970 "\nFileId Opened by Perms Locks Path"
4971 "\n------ --------- ----- ----- ---- \n"));
4972 for (i
= 0; i
< entries_read
; i
++) {
4973 display_file_info_3(&i3
[i
]);
4980 * 'net rpc file' entrypoint.
4981 * @param argc Standard main() style argc.
4982 * @param argv Standard main() style argv. Initial components are already
4986 int net_rpc_file(struct net_context
*c
, int argc
, const char **argv
)
4988 NET_API_STATUS status
;
4990 struct functable func
[] = {
4995 N_("Close opened file"),
4996 N_("net rpc file close\n"
4997 " Close opened file")
5003 N_("List files opened by user"),
5004 N_("net rpc file user\n"
5005 " List files opened by user")
5012 N_("Display information about opened file"),
5013 N_("net rpc file info\n"
5014 " Display information about opened file")
5017 {NULL
, NULL
, 0, NULL
, NULL
}
5020 status
= libnetapi_init(&c
->netapi_ctx
);
5024 libnetapi_set_username(c
->netapi_ctx
, c
->opt_user_name
);
5025 libnetapi_set_password(c
->netapi_ctx
, c
->opt_password
);
5026 if (c
->opt_kerberos
) {
5027 libnetapi_set_use_kerberos(c
->netapi_ctx
);
5031 if (c
->display_usage
) {
5032 d_printf(_("Usage:\n"));
5033 d_printf(_("net rpc file\n"
5034 " List opened files\n"));
5035 net_display_usage_from_functable(func
);
5039 return rpc_file_user(c
, argc
, argv
);
5042 return net_run_function(c
, argc
, argv
, "net rpc file", func
);
5046 * ABORT the shutdown of a remote RPC Server, over initshutdown pipe.
5048 * All parameters are provided by the run_rpc_command function, except for
5049 * argc, argv which are passed through.
5051 * @param c A net_context structure.
5052 * @param domain_sid The domain sid acquired from the remote server.
5053 * @param cli A cli_state connected to the server.
5054 * @param mem_ctx Talloc context, destroyed on completion of the function.
5055 * @param argc Standard main() style argc.
5056 * @param argv Standard main() style argv. Initial components are already
5059 * @return Normal NTSTATUS return.
5062 static NTSTATUS
rpc_shutdown_abort_internals(struct net_context
*c
,
5063 const struct dom_sid
*domain_sid
,
5064 const char *domain_name
,
5065 struct cli_state
*cli
,
5066 struct rpc_pipe_client
*pipe_hnd
,
5067 TALLOC_CTX
*mem_ctx
,
5071 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
5073 result
= rpccli_initshutdown_Abort(pipe_hnd
, mem_ctx
, NULL
, NULL
);
5075 if (NT_STATUS_IS_OK(result
)) {
5076 d_printf(_("\nShutdown successfully aborted\n"));
5077 DEBUG(5,("cmd_shutdown_abort: query succeeded\n"));
5079 DEBUG(5,("cmd_shutdown_abort: query failed\n"));
5085 * ABORT the shutdown of a remote RPC Server, over winreg pipe.
5087 * All parameters are provided by the run_rpc_command function, except for
5088 * argc, argv which are passed through.
5090 * @param c A net_context structure.
5091 * @param domain_sid The domain sid acquired from the remote server.
5092 * @param cli A cli_state connected to the server.
5093 * @param mem_ctx Talloc context, destroyed on completion of the function.
5094 * @param argc Standard main() style argc.
5095 * @param argv Standard main() style argv. Initial components are already
5098 * @return Normal NTSTATUS return.
5101 static NTSTATUS
rpc_reg_shutdown_abort_internals(struct net_context
*c
,
5102 const struct dom_sid
*domain_sid
,
5103 const char *domain_name
,
5104 struct cli_state
*cli
,
5105 struct rpc_pipe_client
*pipe_hnd
,
5106 TALLOC_CTX
*mem_ctx
,
5110 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
5112 result
= rpccli_winreg_AbortSystemShutdown(pipe_hnd
, mem_ctx
, NULL
, NULL
);
5114 if (NT_STATUS_IS_OK(result
)) {
5115 d_printf(_("\nShutdown successfully aborted\n"));
5116 DEBUG(5,("cmd_reg_abort_shutdown: query succeeded\n"));
5118 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
5124 * ABORT the shutdown of a remote RPC server.
5126 * @param argc Standard main() style argc.
5127 * @param argv Standard main() style argv. Initial components are already
5130 * @return A shell status integer (0 for success).
5133 static int rpc_shutdown_abort(struct net_context
*c
, int argc
,
5138 if (c
->display_usage
) {
5140 "net rpc abortshutdown\n"
5143 _("Abort a scheduled shutdown"));
5147 rc
= run_rpc_command(c
, NULL
, &ndr_table_initshutdown
.syntax_id
, 0,
5148 rpc_shutdown_abort_internals
, argc
, argv
);
5153 DEBUG(1, ("initshutdown pipe didn't work, trying winreg pipe\n"));
5155 return run_rpc_command(c
, NULL
, &ndr_table_winreg
.syntax_id
, 0,
5156 rpc_reg_shutdown_abort_internals
,
5161 * Shut down a remote RPC Server via initshutdown pipe.
5163 * All parameters are provided by the run_rpc_command function, except for
5164 * argc, argv which are passed through.
5166 * @param c A net_context structure.
5167 * @param domain_sid The domain sid acquired from the remote server.
5168 * @param cli A cli_state connected to the server.
5169 * @param mem_ctx Talloc context, destroyed on completion of the function.
5170 * @param argc Standard main() style argc.
5171 * @param argv Standard main() style argv. Initial components are already
5174 * @return Normal NTSTATUS return.
5177 NTSTATUS
rpc_init_shutdown_internals(struct net_context
*c
,
5178 const struct dom_sid
*domain_sid
,
5179 const char *domain_name
,
5180 struct cli_state
*cli
,
5181 struct rpc_pipe_client
*pipe_hnd
,
5182 TALLOC_CTX
*mem_ctx
,
5186 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
5187 const char *msg
= N_("This machine will be shutdown shortly");
5188 uint32 timeout
= 20;
5189 struct lsa_StringLarge msg_string
;
5191 if (c
->opt_comment
) {
5192 msg
= c
->opt_comment
;
5194 if (c
->opt_timeout
) {
5195 timeout
= c
->opt_timeout
;
5198 msg_string
.string
= msg
;
5200 /* create an entry */
5201 result
= rpccli_initshutdown_Init(pipe_hnd
, mem_ctx
, NULL
,
5202 &msg_string
, timeout
, c
->opt_force
, c
->opt_reboot
,
5205 if (NT_STATUS_IS_OK(result
)) {
5206 d_printf(_("\nShutdown of remote machine succeeded\n"));
5207 DEBUG(5,("Shutdown of remote machine succeeded\n"));
5209 DEBUG(1,("Shutdown of remote machine failed!\n"));
5215 * Shut down a remote RPC Server via winreg pipe.
5217 * All parameters are provided by the run_rpc_command function, except for
5218 * argc, argv which are passed through.
5220 * @param c A net_context structure.
5221 * @param domain_sid The domain sid acquired from the remote server.
5222 * @param cli A cli_state connected to the server.
5223 * @param mem_ctx Talloc context, destroyed on completion of the function.
5224 * @param argc Standard main() style argc.
5225 * @param argv Standard main() style argv. Initial components are already
5228 * @return Normal NTSTATUS return.
5231 NTSTATUS
rpc_reg_shutdown_internals(struct net_context
*c
,
5232 const struct dom_sid
*domain_sid
,
5233 const char *domain_name
,
5234 struct cli_state
*cli
,
5235 struct rpc_pipe_client
*pipe_hnd
,
5236 TALLOC_CTX
*mem_ctx
,
5240 const char *msg
= N_("This machine will be shutdown shortly");
5241 uint32 timeout
= 20;
5242 struct lsa_StringLarge msg_string
;
5246 if (c
->opt_comment
) {
5247 msg
= c
->opt_comment
;
5249 msg_string
.string
= msg
;
5251 if (c
->opt_timeout
) {
5252 timeout
= c
->opt_timeout
;
5255 /* create an entry */
5256 result
= rpccli_winreg_InitiateSystemShutdown(pipe_hnd
, mem_ctx
, NULL
,
5257 &msg_string
, timeout
, c
->opt_force
, c
->opt_reboot
,
5260 if (NT_STATUS_IS_OK(result
)) {
5261 d_printf(_("\nShutdown of remote machine succeeded\n"));
5263 d_fprintf(stderr
, "\nShutdown of remote machine failed\n");
5264 if ( W_ERROR_EQUAL(werr
, WERR_MACHINE_LOCKED
) )
5265 d_fprintf(stderr
, "\nMachine locked, use -f switch to force\n");
5267 d_fprintf(stderr
, "\nresult was: %s\n", win_errstr(werr
));
5274 * Shut down a remote RPC server.
5276 * @param argc Standard main() style argc.
5277 * @param argv Standard main() style argv. Initial components are already
5280 * @return A shell status integer (0 for success).
5283 static int rpc_shutdown(struct net_context
*c
, int argc
, const char **argv
)
5287 if (c
->display_usage
) {
5289 "net rpc shutdown\n"
5292 _("Shut down a remote RPC server"));
5296 rc
= run_rpc_command(c
, NULL
, &ndr_table_initshutdown
.syntax_id
, 0,
5297 rpc_init_shutdown_internals
, argc
, argv
);
5300 DEBUG(1, ("initshutdown pipe failed, trying winreg pipe\n"));
5301 rc
= run_rpc_command(c
, NULL
, &ndr_table_winreg
.syntax_id
, 0,
5302 rpc_reg_shutdown_internals
, argc
, argv
);
5308 /***************************************************************************
5309 NT Domain trusts code (i.e. 'net rpc trustdom' functionality)
5310 ***************************************************************************/
5313 * Add interdomain trust account to the RPC server.
5314 * All parameters (except for argc and argv) are passed by run_rpc_command
5317 * @param c A net_context structure.
5318 * @param domain_sid The domain sid acquired from the server.
5319 * @param cli A cli_state connected to the server.
5320 * @param mem_ctx Talloc context, destroyed on completion of the function.
5321 * @param argc Standard main() style argc.
5322 * @param argv Standard main() style argv. Initial components are already
5325 * @return normal NTSTATUS return code.
5328 static NTSTATUS
rpc_trustdom_add_internals(struct net_context
*c
,
5329 const struct dom_sid
*domain_sid
,
5330 const char *domain_name
,
5331 struct cli_state
*cli
,
5332 struct rpc_pipe_client
*pipe_hnd
,
5333 TALLOC_CTX
*mem_ctx
,
5337 struct policy_handle connect_pol
, domain_pol
, user_pol
;
5338 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
5340 struct lsa_String lsa_acct_name
;
5342 uint32 acct_flags
=0;
5344 uint32_t access_granted
= 0;
5345 union samr_UserInfo info
;
5346 unsigned int orig_timeout
;
5351 _(" net rpc trustdom add <domain_name> "
5352 "<trust password>\n"));
5353 return NT_STATUS_INVALID_PARAMETER
;
5357 * Make valid trusting domain account (ie. uppercased and with '$' appended)
5360 if (asprintf(&acct_name
, "%s$", argv
[0]) < 0) {
5361 return NT_STATUS_NO_MEMORY
;
5364 strupper_m(acct_name
);
5366 init_lsa_String(&lsa_acct_name
, acct_name
);
5368 /* Get samr policy handle */
5369 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
5371 MAXIMUM_ALLOWED_ACCESS
,
5373 if (!NT_STATUS_IS_OK(result
)) {
5377 /* Get domain policy handle */
5378 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
5380 MAXIMUM_ALLOWED_ACCESS
,
5381 CONST_DISCARD(struct dom_sid2
*, domain_sid
),
5383 if (!NT_STATUS_IS_OK(result
)) {
5387 /* This call can take a long time - allow the server to time out.
5388 * 35 seconds should do it. */
5390 orig_timeout
= rpccli_set_timeout(pipe_hnd
, 35000);
5392 /* Create trusting domain's account */
5393 acb_info
= ACB_NORMAL
;
5394 acct_flags
= SEC_GENERIC_READ
| SEC_GENERIC_WRITE
| SEC_GENERIC_EXECUTE
|
5395 SEC_STD_WRITE_DAC
| SEC_STD_DELETE
|
5396 SAMR_USER_ACCESS_SET_PASSWORD
|
5397 SAMR_USER_ACCESS_GET_ATTRIBUTES
|
5398 SAMR_USER_ACCESS_SET_ATTRIBUTES
;
5400 result
= rpccli_samr_CreateUser2(pipe_hnd
, mem_ctx
,
5409 /* And restore our original timeout. */
5410 rpccli_set_timeout(pipe_hnd
, orig_timeout
);
5412 if (!NT_STATUS_IS_OK(result
)) {
5413 d_printf(_("net rpc trustdom add: create user %s failed %s\n"),
5414 acct_name
, nt_errstr(result
));
5419 struct samr_CryptPassword crypt_pwd
;
5421 ZERO_STRUCT(info
.info23
);
5423 init_samr_CryptPassword(argv
[1],
5424 &cli
->user_session_key
,
5427 info
.info23
.info
.fields_present
= SAMR_FIELD_ACCT_FLAGS
|
5428 SAMR_FIELD_NT_PASSWORD_PRESENT
;
5429 info
.info23
.info
.acct_flags
= ACB_DOMTRUST
;
5430 info
.info23
.password
= crypt_pwd
;
5432 result
= rpccli_samr_SetUserInfo2(pipe_hnd
, mem_ctx
,
5437 if (!NT_STATUS_IS_OK(result
)) {
5438 DEBUG(0,("Could not set trust account password: %s\n",
5439 nt_errstr(result
)));
5445 SAFE_FREE(acct_name
);
5450 * Create interdomain trust account for a remote domain.
5452 * @param argc Standard argc.
5453 * @param argv Standard argv without initial components.
5455 * @return Integer status (0 means success).
5458 static int rpc_trustdom_add(struct net_context
*c
, int argc
, const char **argv
)
5460 if (argc
> 0 && !c
->display_usage
) {
5461 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
, 0,
5462 rpc_trustdom_add_internals
, argc
, argv
);
5466 _("net rpc trustdom add <domain_name> <trust "
5474 * Remove interdomain trust account from the RPC server.
5475 * All parameters (except for argc and argv) are passed by run_rpc_command
5478 * @param c A net_context structure.
5479 * @param domain_sid The domain sid acquired from the server.
5480 * @param cli A cli_state connected to the server.
5481 * @param mem_ctx Talloc context, destroyed on completion of the function.
5482 * @param argc Standard main() style argc.
5483 * @param argv Standard main() style argv. Initial components are already
5486 * @return normal NTSTATUS return code.
5489 static NTSTATUS
rpc_trustdom_del_internals(struct net_context
*c
,
5490 const struct dom_sid
*domain_sid
,
5491 const char *domain_name
,
5492 struct cli_state
*cli
,
5493 struct rpc_pipe_client
*pipe_hnd
,
5494 TALLOC_CTX
*mem_ctx
,
5498 struct policy_handle connect_pol
, domain_pol
, user_pol
;
5499 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
5501 struct dom_sid trust_acct_sid
;
5502 struct samr_Ids user_rids
, name_types
;
5503 struct lsa_String lsa_acct_name
;
5508 _(" net rpc trustdom del <domain_name>\n"));
5509 return NT_STATUS_INVALID_PARAMETER
;
5513 * Make valid trusting domain account (ie. uppercased and with '$' appended)
5515 acct_name
= talloc_asprintf(mem_ctx
, "%s$", argv
[0]);
5517 if (acct_name
== NULL
)
5518 return NT_STATUS_NO_MEMORY
;
5520 strupper_m(acct_name
);
5522 /* Get samr policy handle */
5523 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
5525 MAXIMUM_ALLOWED_ACCESS
,
5527 if (!NT_STATUS_IS_OK(result
)) {
5531 /* Get domain policy handle */
5532 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
5534 MAXIMUM_ALLOWED_ACCESS
,
5535 CONST_DISCARD(struct dom_sid2
*, domain_sid
),
5537 if (!NT_STATUS_IS_OK(result
)) {
5541 init_lsa_String(&lsa_acct_name
, acct_name
);
5543 result
= rpccli_samr_LookupNames(pipe_hnd
, mem_ctx
,
5550 if (!NT_STATUS_IS_OK(result
)) {
5551 d_printf(_("net rpc trustdom del: LookupNames on user %s "
5553 acct_name
, nt_errstr(result
) );
5557 result
= rpccli_samr_OpenUser(pipe_hnd
, mem_ctx
,
5559 MAXIMUM_ALLOWED_ACCESS
,
5563 if (!NT_STATUS_IS_OK(result
)) {
5564 d_printf(_("net rpc trustdom del: OpenUser on user %s failed "
5566 acct_name
, nt_errstr(result
) );
5570 /* append the rid to the domain sid */
5571 if (!sid_compose(&trust_acct_sid
, domain_sid
, user_rids
.ids
[0])) {
5575 /* remove the sid */
5577 result
= rpccli_samr_RemoveMemberFromForeignDomain(pipe_hnd
, mem_ctx
,
5580 if (!NT_STATUS_IS_OK(result
)) {
5581 d_printf(_("net rpc trustdom del: RemoveMemberFromForeignDomain"
5582 " on user %s failed %s\n"),
5583 acct_name
, nt_errstr(result
) );
5589 result
= rpccli_samr_DeleteUser(pipe_hnd
, mem_ctx
,
5592 if (!NT_STATUS_IS_OK(result
)) {
5593 d_printf(_("net rpc trustdom del: DeleteUser on user %s failed "
5595 acct_name
, nt_errstr(result
) );
5599 if (!NT_STATUS_IS_OK(result
)) {
5600 d_printf(_("Could not set trust account password: %s\n"),
5610 * Delete interdomain trust account for a remote domain.
5612 * @param argc Standard argc.
5613 * @param argv Standard argv without initial components.
5615 * @return Integer status (0 means success).
5618 static int rpc_trustdom_del(struct net_context
*c
, int argc
, const char **argv
)
5620 if (argc
> 0 && !c
->display_usage
) {
5621 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
, 0,
5622 rpc_trustdom_del_internals
, argc
, argv
);
5626 _("net rpc trustdom del <domain>\n"));
5631 static NTSTATUS
rpc_trustdom_get_pdc(struct net_context
*c
,
5632 struct cli_state
*cli
,
5633 TALLOC_CTX
*mem_ctx
,
5634 const char *domain_name
)
5636 char *dc_name
= NULL
;
5637 const char *buffer
= NULL
;
5638 struct rpc_pipe_client
*netr
;
5641 /* Use NetServerEnum2 */
5643 if (cli_get_pdc_name(cli
, domain_name
, &dc_name
)) {
5645 return NT_STATUS_OK
;
5648 DEBUG(1,("NetServerEnum2 error: Couldn't find primary domain controller\
5649 for domain %s\n", domain_name
));
5651 /* Try netr_GetDcName */
5653 status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_netlogon
.syntax_id
,
5655 if (!NT_STATUS_IS_OK(status
)) {
5659 status
= rpccli_netr_GetDcName(netr
, mem_ctx
,
5666 if (NT_STATUS_IS_OK(status
)) {
5670 DEBUG(1,("netr_GetDcName error: Couldn't find primary domain controller\
5671 for domain %s\n", domain_name
));
5677 * Establish trust relationship to a trusting domain.
5678 * Interdomain account must already be created on remote PDC.
5680 * @param c A net_context structure.
5681 * @param argc Standard argc.
5682 * @param argv Standard argv without initial components.
5684 * @return Integer status (0 means success).
5687 static int rpc_trustdom_establish(struct net_context
*c
, int argc
,
5690 struct cli_state
*cli
= NULL
;
5691 struct sockaddr_storage server_ss
;
5692 struct rpc_pipe_client
*pipe_hnd
= NULL
;
5693 struct policy_handle connect_hnd
;
5694 TALLOC_CTX
*mem_ctx
;
5696 struct dom_sid
*domain_sid
;
5701 union lsa_PolicyInformation
*info
= NULL
;
5704 * Connect to \\server\ipc$ as 'our domain' account with password
5707 if (argc
!= 1 || c
->display_usage
) {
5710 _("net rpc trustdom establish <domain_name>\n"));
5714 domain_name
= smb_xstrdup(argv
[0]);
5715 strupper_m(domain_name
);
5717 /* account name used at first is our domain's name with '$' */
5718 if (asprintf(&acct_name
, "%s$", lp_workgroup()) == -1) {
5721 strupper_m(acct_name
);
5724 * opt_workgroup will be used by connection functions further,
5725 * hence it should be set to remote domain name instead of ours
5727 if (c
->opt_workgroup
) {
5728 c
->opt_workgroup
= smb_xstrdup(domain_name
);
5731 c
->opt_user_name
= acct_name
;
5733 /* find the domain controller */
5734 if (!net_find_pdc(&server_ss
, pdc_name
, domain_name
)) {
5735 DEBUG(0, ("Couldn't find domain controller for domain %s\n", domain_name
));
5739 /* connect to ipc$ as username/password */
5740 nt_status
= connect_to_ipc(c
, &cli
, &server_ss
, pdc_name
);
5741 if (!NT_STATUS_EQUAL(nt_status
, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT
)) {
5743 /* Is it trusting domain account for sure ? */
5744 DEBUG(0, ("Couldn't verify trusting domain account. Error was %s\n",
5745 nt_errstr(nt_status
)));
5749 /* store who we connected to */
5751 saf_store( domain_name
, pdc_name
);
5754 * Connect to \\server\ipc$ again (this time anonymously)
5757 nt_status
= connect_to_ipc_anonymous(c
, &cli
, &server_ss
,
5760 if (NT_STATUS_IS_ERR(nt_status
)) {
5761 DEBUG(0, ("Couldn't connect to domain %s controller. Error was %s.\n",
5762 domain_name
, nt_errstr(nt_status
)));
5766 if (!(mem_ctx
= talloc_init("establishing trust relationship to "
5767 "domain %s", domain_name
))) {
5768 DEBUG(0, ("talloc_init() failed\n"));
5773 /* Make sure we're talking to a proper server */
5775 nt_status
= rpc_trustdom_get_pdc(c
, cli
, mem_ctx
, domain_name
);
5776 if (!NT_STATUS_IS_OK(nt_status
)) {
5778 talloc_destroy(mem_ctx
);
5783 * Call LsaOpenPolicy and LsaQueryInfo
5786 nt_status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
5788 if (!NT_STATUS_IS_OK(nt_status
)) {
5789 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n", nt_errstr(nt_status
) ));
5791 talloc_destroy(mem_ctx
);
5795 nt_status
= rpccli_lsa_open_policy2(pipe_hnd
, mem_ctx
, true, KEY_QUERY_VALUE
,
5797 if (NT_STATUS_IS_ERR(nt_status
)) {
5798 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
5799 nt_errstr(nt_status
)));
5801 talloc_destroy(mem_ctx
);
5805 /* Querying info level 5 */
5807 nt_status
= rpccli_lsa_QueryInfoPolicy(pipe_hnd
, mem_ctx
,
5809 LSA_POLICY_INFO_ACCOUNT_DOMAIN
,
5811 if (NT_STATUS_IS_ERR(nt_status
)) {
5812 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
5813 nt_errstr(nt_status
)));
5815 talloc_destroy(mem_ctx
);
5819 domain_sid
= info
->account_domain
.sid
;
5821 /* There should be actually query info level 3 (following nt serv behaviour),
5822 but I still don't know if it's _really_ necessary */
5825 * Store the password in secrets db
5828 if (!pdb_set_trusteddom_pw(domain_name
, c
->opt_password
, domain_sid
)) {
5829 DEBUG(0, ("Storing password for trusted domain failed.\n"));
5831 talloc_destroy(mem_ctx
);
5836 * Close the pipes and clean up
5839 nt_status
= rpccli_lsa_Close(pipe_hnd
, mem_ctx
, &connect_hnd
);
5840 if (NT_STATUS_IS_ERR(nt_status
)) {
5841 DEBUG(0, ("Couldn't close LSA pipe. Error was %s\n",
5842 nt_errstr(nt_status
)));
5844 talloc_destroy(mem_ctx
);
5850 talloc_destroy(mem_ctx
);
5852 d_printf(_("Trust to domain %s established\n"), domain_name
);
5857 * Revoke trust relationship to the remote domain.
5859 * @param c A net_context structure.
5860 * @param argc Standard argc.
5861 * @param argv Standard argv without initial components.
5863 * @return Integer status (0 means success).
5866 static int rpc_trustdom_revoke(struct net_context
*c
, int argc
,
5872 if (argc
< 1 || c
->display_usage
) {
5875 _("net rpc trustdom revoke <domain_name>\n"
5876 " Revoke trust relationship\n"
5877 " domain_name\tName of domain to revoke trust\n"));
5881 /* generate upper cased domain name */
5882 domain_name
= smb_xstrdup(argv
[0]);
5883 strupper_m(domain_name
);
5885 /* delete password of the trust */
5886 if (!pdb_del_trusteddom_pw(domain_name
)) {
5887 DEBUG(0, ("Failed to revoke relationship to the trusted domain %s\n",
5894 SAFE_FREE(domain_name
);
5898 static NTSTATUS
rpc_query_domain_sid(struct net_context
*c
,
5899 const struct dom_sid
*domain_sid
,
5900 const char *domain_name
,
5901 struct cli_state
*cli
,
5902 struct rpc_pipe_client
*pipe_hnd
,
5903 TALLOC_CTX
*mem_ctx
,
5908 if (!sid_to_fstring(str_sid
, domain_sid
)) {
5909 return NT_STATUS_UNSUCCESSFUL
;
5911 d_printf("%s\n", str_sid
);
5912 return NT_STATUS_OK
;
5915 static void print_trusted_domain(struct dom_sid
*dom_sid
, const char *trusted_dom_name
)
5919 /* convert sid into ascii string */
5920 sid_to_fstring(ascii_sid
, dom_sid
);
5922 d_printf("%-20s%s\n", trusted_dom_name
, ascii_sid
);
5925 static NTSTATUS
vampire_trusted_domain(struct rpc_pipe_client
*pipe_hnd
,
5926 TALLOC_CTX
*mem_ctx
,
5927 struct policy_handle
*pol
,
5928 struct dom_sid dom_sid
,
5929 const char *trusted_dom_name
)
5932 union lsa_TrustedDomainInfo
*info
= NULL
;
5933 char *cleartextpwd
= NULL
;
5934 uint8_t session_key
[16];
5935 DATA_BLOB session_key_blob
;
5936 DATA_BLOB data
= data_blob_null
;
5938 nt_status
= rpccli_lsa_QueryTrustedDomainInfoBySid(pipe_hnd
, mem_ctx
,
5941 LSA_TRUSTED_DOMAIN_INFO_PASSWORD
,
5943 if (NT_STATUS_IS_ERR(nt_status
)) {
5944 DEBUG(0,("Could not query trusted domain info. Error was %s\n",
5945 nt_errstr(nt_status
)));
5949 data
= data_blob(info
->password
.password
->data
,
5950 info
->password
.password
->length
);
5952 if (!rpccli_get_pwd_hash(pipe_hnd
, session_key
)) {
5953 DEBUG(0, ("Could not retrieve password hash\n"));
5957 session_key_blob
= data_blob_const(session_key
, sizeof(session_key
));
5958 cleartextpwd
= sess_decrypt_string(mem_ctx
, &data
, &session_key_blob
);
5960 if (cleartextpwd
== NULL
) {
5961 DEBUG(0,("retrieved NULL password\n"));
5962 nt_status
= NT_STATUS_UNSUCCESSFUL
;
5966 if (!pdb_set_trusteddom_pw(trusted_dom_name
, cleartextpwd
, &dom_sid
)) {
5967 DEBUG(0, ("Storing password for trusted domain failed.\n"));
5968 nt_status
= NT_STATUS_UNSUCCESSFUL
;
5972 #ifdef DEBUG_PASSWORD
5973 DEBUG(100,("successfully vampired trusted domain [%s], sid: [%s], "
5974 "password: [%s]\n", trusted_dom_name
,
5975 sid_string_dbg(&dom_sid
), cleartextpwd
));
5979 SAFE_FREE(cleartextpwd
);
5980 data_blob_free(&data
);
5985 static int rpc_trustdom_vampire(struct net_context
*c
, int argc
,
5988 /* common variables */
5989 TALLOC_CTX
* mem_ctx
;
5990 struct cli_state
*cli
= NULL
;
5991 struct rpc_pipe_client
*pipe_hnd
= NULL
;
5993 const char *domain_name
= NULL
;
5994 struct dom_sid
*queried_dom_sid
;
5995 struct policy_handle connect_hnd
;
5996 union lsa_PolicyInformation
*info
= NULL
;
5998 /* trusted domains listing variables */
5999 unsigned int enum_ctx
= 0;
6001 struct lsa_DomainList dom_list
;
6004 if (c
->display_usage
) {
6006 "net rpc trustdom vampire\n"
6009 _("Vampire trust relationship from remote server"));
6014 * Listing trusted domains (stored in secrets.tdb, if local)
6017 mem_ctx
= talloc_init("trust relationships vampire");
6020 * set domain and pdc name to local samba server (default)
6021 * or to remote one given in command line
6024 if (StrCaseCmp(c
->opt_workgroup
, lp_workgroup())) {
6025 domain_name
= c
->opt_workgroup
;
6026 c
->opt_target_workgroup
= c
->opt_workgroup
;
6028 fstrcpy(pdc_name
, global_myname());
6029 domain_name
= talloc_strdup(mem_ctx
, lp_workgroup());
6030 c
->opt_target_workgroup
= domain_name
;
6033 /* open \PIPE\lsarpc and open policy handle */
6034 nt_status
= net_make_ipc_connection(c
, NET_FLAGS_PDC
, &cli
);
6035 if (!NT_STATUS_IS_OK(nt_status
)) {
6036 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
6037 nt_errstr(nt_status
)));
6038 talloc_destroy(mem_ctx
);
6042 nt_status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
6044 if (!NT_STATUS_IS_OK(nt_status
)) {
6045 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
6046 nt_errstr(nt_status
) ));
6048 talloc_destroy(mem_ctx
);
6052 nt_status
= rpccli_lsa_open_policy2(pipe_hnd
, mem_ctx
, false, KEY_QUERY_VALUE
,
6054 if (NT_STATUS_IS_ERR(nt_status
)) {
6055 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6056 nt_errstr(nt_status
)));
6058 talloc_destroy(mem_ctx
);
6062 /* query info level 5 to obtain sid of a domain being queried */
6063 nt_status
= rpccli_lsa_QueryInfoPolicy(pipe_hnd
, mem_ctx
,
6065 LSA_POLICY_INFO_ACCOUNT_DOMAIN
,
6068 if (NT_STATUS_IS_ERR(nt_status
)) {
6069 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6070 nt_errstr(nt_status
)));
6072 talloc_destroy(mem_ctx
);
6076 queried_dom_sid
= info
->account_domain
.sid
;
6079 * Keep calling LsaEnumTrustdom over opened pipe until
6080 * the end of enumeration is reached
6083 d_printf(_("Vampire trusted domains:\n\n"));
6086 nt_status
= rpccli_lsa_EnumTrustDom(pipe_hnd
, mem_ctx
,
6091 if (NT_STATUS_IS_ERR(nt_status
)) {
6092 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6093 nt_errstr(nt_status
)));
6095 talloc_destroy(mem_ctx
);
6099 for (i
= 0; i
< dom_list
.count
; i
++) {
6101 print_trusted_domain(dom_list
.domains
[i
].sid
,
6102 dom_list
.domains
[i
].name
.string
);
6104 nt_status
= vampire_trusted_domain(pipe_hnd
, mem_ctx
, &connect_hnd
,
6105 *dom_list
.domains
[i
].sid
,
6106 dom_list
.domains
[i
].name
.string
);
6107 if (!NT_STATUS_IS_OK(nt_status
)) {
6109 talloc_destroy(mem_ctx
);
6115 * in case of no trusted domains say something rather
6116 * than just display blank line
6118 if (!dom_list
.count
) d_printf(_("none\n"));
6120 } while (NT_STATUS_EQUAL(nt_status
, STATUS_MORE_ENTRIES
));
6122 /* close this connection before doing next one */
6123 nt_status
= rpccli_lsa_Close(pipe_hnd
, mem_ctx
, &connect_hnd
);
6124 if (NT_STATUS_IS_ERR(nt_status
)) {
6125 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
6126 nt_errstr(nt_status
)));
6128 talloc_destroy(mem_ctx
);
6132 /* close lsarpc pipe and connection to IPC$ */
6135 talloc_destroy(mem_ctx
);
6139 static int rpc_trustdom_list(struct net_context
*c
, int argc
, const char **argv
)
6141 /* common variables */
6142 TALLOC_CTX
* mem_ctx
;
6143 struct cli_state
*cli
= NULL
, *remote_cli
= NULL
;
6144 struct rpc_pipe_client
*pipe_hnd
= NULL
;
6146 const char *domain_name
= NULL
;
6147 struct dom_sid
*queried_dom_sid
;
6148 int ascii_dom_name_len
;
6149 struct policy_handle connect_hnd
;
6150 union lsa_PolicyInformation
*info
= NULL
;
6152 /* trusted domains listing variables */
6153 unsigned int num_domains
, enum_ctx
= 0;
6155 struct lsa_DomainList dom_list
;
6159 /* trusting domains listing variables */
6160 struct policy_handle domain_hnd
;
6161 struct samr_SamArray
*trusts
= NULL
;
6163 if (c
->display_usage
) {
6165 "net rpc trustdom list\n"
6168 _("List incoming and outgoing trust relationships"));
6173 * Listing trusted domains (stored in secrets.tdb, if local)
6176 mem_ctx
= talloc_init("trust relationships listing");
6179 * set domain and pdc name to local samba server (default)
6180 * or to remote one given in command line
6183 if (StrCaseCmp(c
->opt_workgroup
, lp_workgroup())) {
6184 domain_name
= c
->opt_workgroup
;
6185 c
->opt_target_workgroup
= c
->opt_workgroup
;
6187 fstrcpy(pdc_name
, global_myname());
6188 domain_name
= talloc_strdup(mem_ctx
, lp_workgroup());
6189 c
->opt_target_workgroup
= domain_name
;
6192 /* open \PIPE\lsarpc and open policy handle */
6193 nt_status
= net_make_ipc_connection(c
, NET_FLAGS_PDC
, &cli
);
6194 if (!NT_STATUS_IS_OK(nt_status
)) {
6195 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
6196 nt_errstr(nt_status
)));
6197 talloc_destroy(mem_ctx
);
6201 nt_status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
6203 if (!NT_STATUS_IS_OK(nt_status
)) {
6204 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
6205 nt_errstr(nt_status
) ));
6207 talloc_destroy(mem_ctx
);
6211 nt_status
= rpccli_lsa_open_policy2(pipe_hnd
, mem_ctx
, false, KEY_QUERY_VALUE
,
6213 if (NT_STATUS_IS_ERR(nt_status
)) {
6214 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6215 nt_errstr(nt_status
)));
6217 talloc_destroy(mem_ctx
);
6221 /* query info level 5 to obtain sid of a domain being queried */
6222 nt_status
= rpccli_lsa_QueryInfoPolicy(pipe_hnd
, mem_ctx
,
6224 LSA_POLICY_INFO_ACCOUNT_DOMAIN
,
6227 if (NT_STATUS_IS_ERR(nt_status
)) {
6228 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6229 nt_errstr(nt_status
)));
6231 talloc_destroy(mem_ctx
);
6235 queried_dom_sid
= info
->account_domain
.sid
;
6238 * Keep calling LsaEnumTrustdom over opened pipe until
6239 * the end of enumeration is reached
6242 d_printf(_("Trusted domains list:\n\n"));
6244 found_domain
= false;
6247 nt_status
= rpccli_lsa_EnumTrustDom(pipe_hnd
, mem_ctx
,
6252 if (NT_STATUS_IS_ERR(nt_status
)) {
6253 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6254 nt_errstr(nt_status
)));
6256 talloc_destroy(mem_ctx
);
6260 for (i
= 0; i
< dom_list
.count
; i
++) {
6261 print_trusted_domain(dom_list
.domains
[i
].sid
,
6262 dom_list
.domains
[i
].name
.string
);
6263 found_domain
= true;
6267 } while (NT_STATUS_EQUAL(nt_status
, STATUS_MORE_ENTRIES
));
6270 * in case of no trusted domains say something rather
6271 * than just display blank line
6273 if (!found_domain
) {
6274 d_printf(_("none\n"));
6277 /* close this connection before doing next one */
6278 nt_status
= rpccli_lsa_Close(pipe_hnd
, mem_ctx
, &connect_hnd
);
6279 if (NT_STATUS_IS_ERR(nt_status
)) {
6280 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
6281 nt_errstr(nt_status
)));
6283 talloc_destroy(mem_ctx
);
6287 TALLOC_FREE(pipe_hnd
);
6290 * Listing trusting domains (stored in passdb backend, if local)
6293 d_printf(_("\nTrusting domains list:\n\n"));
6296 * Open \PIPE\samr and get needed policy handles
6298 nt_status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_samr
.syntax_id
,
6300 if (!NT_STATUS_IS_OK(nt_status
)) {
6301 DEBUG(0, ("Could not initialise samr pipe. Error was %s\n", nt_errstr(nt_status
)));
6303 talloc_destroy(mem_ctx
);
6308 nt_status
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
6310 SAMR_ACCESS_LOOKUP_DOMAIN
,
6312 if (!NT_STATUS_IS_OK(nt_status
)) {
6313 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
6314 nt_errstr(nt_status
)));
6316 talloc_destroy(mem_ctx
);
6320 /* SamrOpenDomain - we have to open domain policy handle in order to be
6321 able to enumerate accounts*/
6322 nt_status
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
6324 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS
,
6327 if (!NT_STATUS_IS_OK(nt_status
)) {
6328 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
6329 nt_errstr(nt_status
)));
6331 talloc_destroy(mem_ctx
);
6336 * perform actual enumeration
6339 found_domain
= false;
6341 enum_ctx
= 0; /* reset enumeration context from last enumeration */
6344 nt_status
= rpccli_samr_EnumDomainUsers(pipe_hnd
, mem_ctx
,
6351 if (NT_STATUS_IS_ERR(nt_status
)) {
6352 DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
6353 nt_errstr(nt_status
)));
6355 talloc_destroy(mem_ctx
);
6359 for (i
= 0; i
< num_domains
; i
++) {
6361 char *str
= CONST_DISCARD(char *, trusts
->entries
[i
].name
.string
);
6363 found_domain
= true;
6366 * get each single domain's sid (do we _really_ need this ?):
6367 * 1) connect to domain's pdc
6368 * 2) query the pdc for domain's sid
6371 /* get rid of '$' tail */
6372 ascii_dom_name_len
= strlen(str
);
6373 if (ascii_dom_name_len
&& ascii_dom_name_len
< FSTRING_LEN
)
6374 str
[ascii_dom_name_len
- 1] = '\0';
6376 /* set opt_* variables to remote domain */
6378 c
->opt_workgroup
= talloc_strdup(mem_ctx
, str
);
6379 c
->opt_target_workgroup
= c
->opt_workgroup
;
6381 d_printf("%-20s", str
);
6383 /* connect to remote domain controller */
6384 nt_status
= net_make_ipc_connection(c
,
6385 NET_FLAGS_PDC
| NET_FLAGS_ANONYMOUS
,
6387 if (NT_STATUS_IS_OK(nt_status
)) {
6388 /* query for domain's sid */
6389 if (run_rpc_command(
6391 &ndr_table_lsarpc
.syntax_id
, 0,
6392 rpc_query_domain_sid
, argc
,
6394 d_printf(_("strange - couldn't get domain's sid\n"));
6396 cli_shutdown(remote_cli
);
6399 d_fprintf(stderr
, _("domain controller is not "
6400 "responding: %s\n"),
6401 nt_errstr(nt_status
));
6402 d_printf(_("couldn't get domain's sid\n"));
6406 } while (NT_STATUS_EQUAL(nt_status
, STATUS_MORE_ENTRIES
));
6408 if (!found_domain
) {
6412 /* close opened samr and domain policy handles */
6413 nt_status
= rpccli_samr_Close(pipe_hnd
, mem_ctx
, &domain_hnd
);
6414 if (!NT_STATUS_IS_OK(nt_status
)) {
6415 DEBUG(0, ("Couldn't properly close domain policy handle for domain %s\n", domain_name
));
6418 nt_status
= rpccli_samr_Close(pipe_hnd
, mem_ctx
, &connect_hnd
);
6419 if (!NT_STATUS_IS_OK(nt_status
)) {
6420 DEBUG(0, ("Couldn't properly close samr policy handle for domain %s\n", domain_name
));
6423 /* close samr pipe and connection to IPC$ */
6426 talloc_destroy(mem_ctx
);
6431 * Entrypoint for 'net rpc trustdom' code.
6433 * @param argc Standard argc.
6434 * @param argv Standard argv without initial components.
6436 * @return Integer status (0 means success).
6439 static int rpc_trustdom(struct net_context
*c
, int argc
, const char **argv
)
6441 struct functable func
[] = {
6446 N_("Add trusting domain's account"),
6447 N_("net rpc trustdom add\n"
6448 " Add trusting domain's account")
6454 N_("Remove trusting domain's account"),
6455 N_("net rpc trustdom del\n"
6456 " Remove trusting domain's account")
6460 rpc_trustdom_establish
,
6462 N_("Establish outgoing trust relationship"),
6463 N_("net rpc trustdom establish\n"
6464 " Establish outgoing trust relationship")
6468 rpc_trustdom_revoke
,
6470 N_("Revoke outgoing trust relationship"),
6471 N_("net rpc trustdom revoke\n"
6472 " Revoke outgoing trust relationship")
6478 N_("List in- and outgoing domain trusts"),
6479 N_("net rpc trustdom list\n"
6480 " List in- and outgoing domain trusts")
6484 rpc_trustdom_vampire
,
6486 N_("Vampire trusts from remote server"),
6487 N_("net rpc trustdom vampire\n"
6488 " Vampire trusts from remote server")
6490 {NULL
, NULL
, 0, NULL
, NULL
}
6493 return net_run_function(c
, argc
, argv
, "net rpc trustdom", func
);
6497 * Check if a server will take rpc commands
6498 * @param flags Type of server to connect to (PDC, DMB, localhost)
6499 * if the host is not explicitly specified
6500 * @return bool (true means rpc supported)
6502 bool net_rpc_check(struct net_context
*c
, unsigned flags
)
6504 struct cli_state
*cli
;
6506 struct sockaddr_storage server_ss
;
6507 char *server_name
= NULL
;
6510 /* flags (i.e. server type) may depend on command */
6511 if (!net_find_server(c
, NULL
, flags
, &server_ss
, &server_name
))
6514 if ((cli
= cli_initialise()) == NULL
) {
6518 status
= cli_connect(cli
, server_name
, &server_ss
);
6519 if (!NT_STATUS_IS_OK(status
))
6521 if (!attempt_netbios_session_request(&cli
, global_myname(),
6522 server_name
, &server_ss
))
6524 status
= cli_negprot(cli
);
6525 if (!NT_STATUS_IS_OK(status
))
6527 if (cli
->protocol
< PROTOCOL_NT1
)
6536 /* dump sam database via samsync rpc calls */
6537 static int rpc_samdump(struct net_context
*c
, int argc
, const char **argv
) {
6538 if (c
->display_usage
) {
6543 _("Dump remote SAM database"));
6547 return run_rpc_command(c
, NULL
, &ndr_table_netlogon
.syntax_id
,
6548 NET_FLAGS_ANONYMOUS
,
6549 rpc_samdump_internals
, argc
, argv
);
6552 /* syncronise sam database via samsync rpc calls */
6553 static int rpc_vampire(struct net_context
*c
, int argc
, const char **argv
)
6555 struct functable func
[] = {
6560 N_("Dump remote SAM database to ldif"),
6561 N_("net rpc vampire ldif\n"
6562 " Dump remote SAM database to LDIF file or "
6569 N_("Dump remote SAM database to Kerberos Keytab"),
6570 N_("net rpc vampire keytab\n"
6571 " Dump remote SAM database to Kerberos keytab "
6578 N_("Dump remote SAM database to passdb"),
6579 N_("net rpc vampire passdb\n"
6580 " Dump remote SAM database to passdb")
6583 {NULL
, NULL
, 0, NULL
, NULL
}
6587 if (c
->display_usage
) {
6592 _("Vampire remote SAM database"));
6596 return run_rpc_command(c
, NULL
, &ndr_table_netlogon
.syntax_id
,
6597 NET_FLAGS_ANONYMOUS
,
6598 rpc_vampire_internals
,
6602 return net_run_function(c
, argc
, argv
, "net rpc vampire", func
);
6606 * Migrate everything from a print server.
6608 * @param c A net_context structure.
6609 * @param argc Standard main() style argc.
6610 * @param argv Standard main() style argv. Initial components are already
6613 * @return A shell status integer (0 for success).
6615 * The order is important !
6616 * To successfully add drivers the print queues have to exist !
6617 * Applying ACLs should be the last step, because you're easily locked out.
6620 static int rpc_printer_migrate_all(struct net_context
*c
, int argc
,
6625 if (c
->display_usage
) {
6627 "net rpc printer migrate all\n"
6630 _("Migrate everything from a print server"));
6635 d_printf(_("no server to migrate\n"));
6639 ret
= run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6640 rpc_printer_migrate_printers_internals
, argc
,
6645 ret
= run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6646 rpc_printer_migrate_drivers_internals
, argc
,
6651 ret
= run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6652 rpc_printer_migrate_forms_internals
, argc
, argv
);
6656 ret
= run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6657 rpc_printer_migrate_settings_internals
, argc
,
6662 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6663 rpc_printer_migrate_security_internals
, argc
,
6669 * Migrate print drivers from a print server.
6671 * @param c A net_context structure.
6672 * @param argc Standard main() style argc.
6673 * @param argv Standard main() style argv. Initial components are already
6676 * @return A shell status integer (0 for success).
6678 static int rpc_printer_migrate_drivers(struct net_context
*c
, int argc
,
6681 if (c
->display_usage
) {
6683 "net rpc printer migrate drivers\n"
6686 _("Migrate print-drivers from a print-server"));
6691 d_printf(_("no server to migrate\n"));
6695 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6696 rpc_printer_migrate_drivers_internals
,
6701 * Migrate print-forms from a print-server.
6703 * @param c A net_context structure.
6704 * @param argc Standard main() style argc.
6705 * @param argv Standard main() style argv. Initial components are already
6708 * @return A shell status integer (0 for success).
6710 static int rpc_printer_migrate_forms(struct net_context
*c
, int argc
,
6713 if (c
->display_usage
) {
6715 "net rpc printer migrate forms\n"
6718 _("Migrate print-forms from a print-server"));
6723 d_printf(_("no server to migrate\n"));
6727 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6728 rpc_printer_migrate_forms_internals
,
6733 * Migrate printers from a print-server.
6735 * @param c A net_context structure.
6736 * @param argc Standard main() style argc.
6737 * @param argv Standard main() style argv. Initial components are already
6740 * @return A shell status integer (0 for success).
6742 static int rpc_printer_migrate_printers(struct net_context
*c
, int argc
,
6745 if (c
->display_usage
) {
6747 "net rpc printer migrate printers\n"
6750 _("Migrate printers from a print-server"));
6755 d_printf(_("no server to migrate\n"));
6759 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6760 rpc_printer_migrate_printers_internals
,
6765 * Migrate printer-ACLs from a print-server
6767 * @param c A net_context structure.
6768 * @param argc Standard main() style argc.
6769 * @param argv Standard main() style argv. Initial components are already
6772 * @return A shell status integer (0 for success).
6774 static int rpc_printer_migrate_security(struct net_context
*c
, int argc
,
6777 if (c
->display_usage
) {
6779 "net rpc printer migrate security\n"
6782 _("Migrate printer-ACLs from a print-server"));
6787 d_printf(_("no server to migrate\n"));
6791 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6792 rpc_printer_migrate_security_internals
,
6797 * Migrate printer-settings from a print-server.
6799 * @param c A net_context structure.
6800 * @param argc Standard main() style argc.
6801 * @param argv Standard main() style argv. Initial components are already
6804 * @return A shell status integer (0 for success).
6806 static int rpc_printer_migrate_settings(struct net_context
*c
, int argc
,
6809 if (c
->display_usage
) {
6811 "net rpc printer migrate settings\n"
6814 _("Migrate printer-settings from a "
6820 d_printf(_("no server to migrate\n"));
6824 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6825 rpc_printer_migrate_settings_internals
,
6830 * 'net rpc printer' entrypoint.
6832 * @param c A net_context structure.
6833 * @param argc Standard main() style argc.
6834 * @param argv Standard main() style argv. Initial components are already
6838 int rpc_printer_migrate(struct net_context
*c
, int argc
, const char **argv
)
6841 /* ouch: when addriver and setdriver are called from within
6842 rpc_printer_migrate_drivers_internals, the printer-queue already
6845 struct functable func
[] = {
6848 rpc_printer_migrate_all
,
6850 N_("Migrate all from remote to local print server"),
6851 N_("net rpc printer migrate all\n"
6852 " Migrate all from remote to local print server")
6856 rpc_printer_migrate_drivers
,
6858 N_("Migrate drivers to local server"),
6859 N_("net rpc printer migrate drivers\n"
6860 " Migrate drivers to local server")
6864 rpc_printer_migrate_forms
,
6866 N_("Migrate froms to local server"),
6867 N_("net rpc printer migrate forms\n"
6868 " Migrate froms to local server")
6872 rpc_printer_migrate_printers
,
6874 N_("Migrate printers to local server"),
6875 N_("net rpc printer migrate printers\n"
6876 " Migrate printers to local server")
6880 rpc_printer_migrate_security
,
6882 N_("Mirgate printer ACLs to local server"),
6883 N_("net rpc printer migrate security\n"
6884 " Mirgate printer ACLs to local server")
6888 rpc_printer_migrate_settings
,
6890 N_("Migrate printer settings to local server"),
6891 N_("net rpc printer migrate settings\n"
6892 " Migrate printer settings to local server")
6894 {NULL
, NULL
, 0, NULL
, NULL
}
6897 return net_run_function(c
, argc
, argv
, "net rpc printer migrate",func
);
6902 * List printers on a remote RPC server.
6904 * @param c A net_context structure.
6905 * @param argc Standard main() style argc.
6906 * @param argv Standard main() style argv. Initial components are already
6909 * @return A shell status integer (0 for success).
6911 static int rpc_printer_list(struct net_context
*c
, int argc
, const char **argv
)
6913 if (c
->display_usage
) {
6915 "net rpc printer list\n"
6918 _("List printers on a remote RPC server"));
6922 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6923 rpc_printer_list_internals
,
6928 * List printer-drivers on a remote RPC server.
6930 * @param c A net_context structure.
6931 * @param argc Standard main() style argc.
6932 * @param argv Standard main() style argv. Initial components are already
6935 * @return A shell status integer (0 for success).
6937 static int rpc_printer_driver_list(struct net_context
*c
, int argc
,
6940 if (c
->display_usage
) {
6942 "net rpc printer driver\n"
6945 _("List printer-drivers on a remote RPC server"));
6949 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6950 rpc_printer_driver_list_internals
,
6955 * Publish printer in ADS via MSRPC.
6957 * @param c A net_context structure.
6958 * @param argc Standard main() style argc.
6959 * @param argv Standard main() style argv. Initial components are already
6962 * @return A shell status integer (0 for success).
6964 static int rpc_printer_publish_publish(struct net_context
*c
, int argc
,
6967 if (c
->display_usage
) {
6969 "net rpc printer publish publish\n"
6972 _("Publish printer in ADS via MSRPC"));
6976 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6977 rpc_printer_publish_publish_internals
,
6982 * Update printer in ADS via MSRPC.
6984 * @param c A net_context structure.
6985 * @param argc Standard main() style argc.
6986 * @param argv Standard main() style argv. Initial components are already
6989 * @return A shell status integer (0 for success).
6991 static int rpc_printer_publish_update(struct net_context
*c
, int argc
, const char **argv
)
6993 if (c
->display_usage
) {
6995 "net rpc printer publish update\n"
6998 _("Update printer in ADS via MSRPC"));
7002 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
7003 rpc_printer_publish_update_internals
,
7008 * UnPublish printer in ADS via MSRPC.
7010 * @param c A net_context structure.
7011 * @param argc Standard main() style argc.
7012 * @param argv Standard main() style argv. Initial components are already
7015 * @return A shell status integer (0 for success).
7017 static int rpc_printer_publish_unpublish(struct net_context
*c
, int argc
,
7020 if (c
->display_usage
) {
7022 "net rpc printer publish unpublish\n"
7025 _("UnPublish printer in ADS via MSRPC"));
7029 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
7030 rpc_printer_publish_unpublish_internals
,
7035 * List published printers via MSRPC.
7037 * @param c A net_context structure.
7038 * @param argc Standard main() style argc.
7039 * @param argv Standard main() style argv. Initial components are already
7042 * @return A shell status integer (0 for success).
7044 static int rpc_printer_publish_list(struct net_context
*c
, int argc
,
7047 if (c
->display_usage
) {
7049 "net rpc printer publish list\n"
7052 _("List published printers via MSRPC"));
7056 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
7057 rpc_printer_publish_list_internals
,
7063 * Publish printer in ADS.
7065 * @param c A net_context structure.
7066 * @param argc Standard main() style argc.
7067 * @param argv Standard main() style argv. Initial components are already
7070 * @return A shell status integer (0 for success).
7072 static int rpc_printer_publish(struct net_context
*c
, int argc
,
7076 struct functable func
[] = {
7079 rpc_printer_publish_publish
,
7081 N_("Publish printer in AD"),
7082 N_("net rpc printer publish publish\n"
7083 " Publish printer in AD")
7087 rpc_printer_publish_update
,
7089 N_("Update printer in AD"),
7090 N_("net rpc printer publish update\n"
7091 " Update printer in AD")
7095 rpc_printer_publish_unpublish
,
7097 N_("Unpublish printer"),
7098 N_("net rpc printer publish unpublish\n"
7099 " Unpublish printer")
7103 rpc_printer_publish_list
,
7105 N_("List published printers"),
7106 N_("net rpc printer publish list\n"
7107 " List published printers")
7109 {NULL
, NULL
, 0, NULL
, NULL
}
7113 if (c
->display_usage
) {
7114 d_printf(_("Usage:\n"));
7115 d_printf(_("net rpc printer publish\n"
7116 " List published printers\n"
7117 " Alias of net rpc printer publish "
7119 net_display_usage_from_functable(func
);
7122 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
7123 rpc_printer_publish_list_internals
,
7127 return net_run_function(c
, argc
, argv
, "net rpc printer publish",func
);
7133 * Display rpc printer help page.
7135 * @param c A net_context structure.
7136 * @param argc Standard main() style argc.
7137 * @param argv Standard main() style argv. Initial components are already
7140 int rpc_printer_usage(struct net_context
*c
, int argc
, const char **argv
)
7142 d_printf(_("net rpc printer LIST [printer] [misc. options] [targets]\n"
7143 "\tlists all printers on print-server\n\n"));
7144 d_printf(_("net rpc printer DRIVER [printer] [misc. options] [targets]\n"
7145 "\tlists all printer-drivers on print-server\n\n"));
7146 d_printf(_("net rpc printer PUBLISH action [printer] [misc. options] [targets]\n"
7147 "\tpublishes printer settings in Active Directory\n"
7148 "\taction can be one of PUBLISH, UPDATE, UNPUBLISH or LIST\n\n"));
7149 d_printf(_("net rpc printer MIGRATE PRINTERS [printer] [misc. options] [targets]"
7150 "\n\tmigrates printers from remote to local server\n\n"));
7151 d_printf(_("net rpc printer MIGRATE SETTINGS [printer] [misc. options] [targets]"
7152 "\n\tmigrates printer-settings from remote to local server\n\n"));
7153 d_printf(_("net rpc printer MIGRATE DRIVERS [printer] [misc. options] [targets]"
7154 "\n\tmigrates printer-drivers from remote to local server\n\n"));
7155 d_printf(_("net rpc printer MIGRATE FORMS [printer] [misc. options] [targets]"
7156 "\n\tmigrates printer-forms from remote to local server\n\n"));
7157 d_printf(_("net rpc printer MIGRATE SECURITY [printer] [misc. options] [targets]"
7158 "\n\tmigrates printer-ACLs from remote to local server\n\n"));
7159 d_printf(_("net rpc printer MIGRATE ALL [printer] [misc. options] [targets]"
7160 "\n\tmigrates drivers, forms, queues, settings and acls from\n"
7161 "\tremote to local print-server\n\n"));
7162 net_common_methods_usage(c
, argc
, argv
);
7163 net_common_flags_usage(c
, argc
, argv
);
7165 "\t-v or --verbose\t\t\tgive verbose output\n"
7166 "\t --destination\t\tmigration target server (default: localhost)\n"));
7172 * 'net rpc printer' entrypoint.
7174 * @param c A net_context structure.
7175 * @param argc Standard main() style argc.
7176 * @param argv Standard main() style argv. Initial components are already
7179 int net_rpc_printer(struct net_context
*c
, int argc
, const char **argv
)
7181 struct functable func
[] = {
7186 N_("List all printers on print server"),
7187 N_("net rpc printer list\n"
7188 " List all printers on print server")
7192 rpc_printer_migrate
,
7194 N_("Migrate printer to local server"),
7195 N_("net rpc printer migrate\n"
7196 " Migrate printer to local server")
7200 rpc_printer_driver_list
,
7202 N_("List printer drivers"),
7203 N_("net rpc printer driver\n"
7204 " List printer drivers")
7208 rpc_printer_publish
,
7210 N_("Publish printer in AD"),
7211 N_("net rpc printer publish\n"
7212 " Publish printer in AD")
7214 {NULL
, NULL
, 0, NULL
, NULL
}
7218 if (c
->display_usage
) {
7219 d_printf(_("Usage:\n"));
7220 d_printf(_("net rpc printer\n"
7221 " List printers\n"));
7222 net_display_usage_from_functable(func
);
7225 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
7226 rpc_printer_list_internals
,
7230 return net_run_function(c
, argc
, argv
, "net rpc printer", func
);
7234 * 'net rpc' entrypoint.
7236 * @param c A net_context structure.
7237 * @param argc Standard main() style argc.
7238 * @param argv Standard main() style argv. Initial components are already
7242 int net_rpc(struct net_context
*c
, int argc
, const char **argv
)
7244 NET_API_STATUS status
;
7246 struct functable func
[] = {
7251 N_("Modify global audit settings"),
7252 N_("net rpc audit\n"
7253 " Modify global audit settings")
7259 N_("Show basic info about a domain"),
7261 " Show basic info about a domain")
7267 N_("Join a domain"),
7275 N_("Join a domain created in server manager"),
7276 N_("net rpc oldjoin\n"
7277 " Join a domain created in server manager")
7283 N_("Test that a join is valid"),
7284 N_("net rpc testjoin\n"
7285 " Test that a join is valid")
7291 N_("List/modify users"),
7293 " List/modify users")
7299 N_("Change a user password"),
7300 N_("net rpc password\n"
7301 " Change a user password\n"
7302 " Alias for net rpc user password")
7308 N_("List/modify groups"),
7309 N_("net rpc group\n"
7310 " List/modify groups")
7316 N_("List/modify shares"),
7317 N_("net rpc share\n"
7318 " List/modify shares")
7324 N_("List open files"),
7332 N_("List/modify printers"),
7333 N_("net rpc printer\n"
7334 " List/modify printers")
7338 net_rpc_changetrustpw
,
7340 N_("Change trust account password"),
7341 N_("net rpc changetrustpw\n"
7342 " Change trust account password")
7348 N_("Modify domain trusts"),
7349 N_("net rpc trustdom\n"
7350 " Modify domain trusts")
7356 N_("Abort a remote shutdown"),
7357 N_("net rpc abortshutdown\n"
7358 " Abort a remote shutdown")
7364 N_("Shutdown a remote server"),
7365 N_("net rpc shutdown\n"
7366 " Shutdown a remote server")
7372 N_("Dump SAM data of remote NT PDC"),
7373 N_("net rpc samdump\n"
7374 " Dump SAM data of remote NT PDC")
7380 N_("Sync a remote NT PDC's data into local passdb"),
7381 N_("net rpc vampire\n"
7382 " Sync a remote NT PDC's data into local passdb")
7388 N_("Fetch the domain sid into local secrets.tdb"),
7389 N_("net rpc getsid\n"
7390 " Fetch the domain sid into local secrets.tdb")
7396 N_("Manage privileges assigned to SID"),
7397 N_("net rpc rights\n"
7398 " Manage privileges assigned to SID")
7404 N_("Start/stop/query remote services"),
7405 N_("net rpc service\n"
7406 " Start/stop/query remote services")
7412 N_("Manage registry hives"),
7413 N_("net rpc registry\n"
7414 " Manage registry hives")
7420 N_("Open interactive shell on remote server"),
7421 N_("net rpc shell\n"
7422 " Open interactive shell on remote server")
7424 {NULL
, NULL
, 0, NULL
, NULL
}
7427 status
= libnetapi_init(&c
->netapi_ctx
);
7431 libnetapi_set_username(c
->netapi_ctx
, c
->opt_user_name
);
7432 libnetapi_set_password(c
->netapi_ctx
, c
->opt_password
);
7433 if (c
->opt_kerberos
) {
7434 libnetapi_set_use_kerberos(c
->netapi_ctx
);
7436 if (c
->opt_ccache
) {
7437 libnetapi_set_use_ccache(c
->netapi_ctx
);
7440 return net_run_function(c
, argc
, argv
, "net rpc", func
);