?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Add "net sam createdomaingroup"
[Samba.git] / source3 / utils / net_sam.c
blob45dfb61cef123b2d4e8e2d3bd3f99c037a315428
1 /*
2 * Unix SMB/CIFS implementation.
3 * Local SAM access routines
4 * Copyright (C) Volker Lendecke 2006
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20
21 #include "includes.h"
22 #include "utils/net.h"
23
24 /*
25 * Set a user's data
26 */
27
28 static int net_sam_userset(struct net_context *c, int argc, const char **argv,
29 const char *field,
30 bool (*fn)(struct samu *, const char *,
31 enum pdb_value_state))
32 {
33 struct samu *sam_acct = NULL;
34 DOM_SID sid;
35 enum lsa_SidType type;
36 const char *dom, *name;
37 NTSTATUS status;
38
39 if (argc != 2 || c->display_usage) {
40 d_fprintf(stderr, "usage: net sam set %s <user> <value>\n",
41 field);
42 return -1;
43 }
44
45 if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
46 &dom, &name, &sid, &type)) {
47 d_fprintf(stderr, "Could not find name %s\n", argv[0]);
48 return -1;
49 }
50
51 if (type != SID_NAME_USER) {
52 d_fprintf(stderr, "%s is a %s, not a user\n", argv[0],
53 sid_type_lookup(type));
54 return -1;
55 }
56
57 if ( !(sam_acct = samu_new( NULL )) ) {
58 d_fprintf(stderr, "Internal error\n");
59 return -1;
60 }
61
62 if (!pdb_getsampwsid(sam_acct, &sid)) {
63 d_fprintf(stderr, "Loading user %s failed\n", argv[0]);
64 return -1;
65 }
66
67 if (!fn(sam_acct, argv[1], PDB_CHANGED)) {
68 d_fprintf(stderr, "Internal error\n");
69 return -1;
70 }
71
72 status = pdb_update_sam_account(sam_acct);
73 if (!NT_STATUS_IS_OK(status)) {
74 d_fprintf(stderr, "Updating sam account %s failed with %s\n",
75 argv[0], nt_errstr(status));
76 return -1;
77 }
78
79 TALLOC_FREE(sam_acct);
80
81 d_printf("Updated %s for %s\\%s to %s\n", field, dom, name, argv[1]);
82 return 0;
83 }
84
85 static int net_sam_set_fullname(struct net_context *c, int argc,
86 const char **argv)
87 {
88 return net_sam_userset(c, argc, argv, "fullname",
89 pdb_set_fullname);
90 }
91
92 static int net_sam_set_logonscript(struct net_context *c, int argc,
93 const char **argv)
94 {
95 return net_sam_userset(c, argc, argv, "logonscript",
96 pdb_set_logon_script);
97 }
98
99 static int net_sam_set_profilepath(struct net_context *c, int argc,
100 const char **argv)
101 {
102 return net_sam_userset(c, argc, argv, "profilepath",
103 pdb_set_profile_path);
104 }
105
106 static int net_sam_set_homedrive(struct net_context *c, int argc,
107 const char **argv)
108 {
109 return net_sam_userset(c, argc, argv, "homedrive",
110 pdb_set_dir_drive);
111 }
112
113 static int net_sam_set_homedir(struct net_context *c, int argc,
114 const char **argv)
115 {
116 return net_sam_userset(c, argc, argv, "homedir",
117 pdb_set_homedir);
118 }
119
120 static int net_sam_set_workstations(struct net_context *c, int argc,
121 const char **argv)
122 {
123 return net_sam_userset(c, argc, argv, "workstations",
124 pdb_set_workstations);
125 }
126
127 /*
128 * Set account flags
129 */
130
131 static int net_sam_set_userflag(struct net_context *c, int argc,
132 const char **argv, const char *field,
133 uint16 flag)
134 {
135 struct samu *sam_acct = NULL;
136 DOM_SID sid;
137 enum lsa_SidType type;
138 const char *dom, *name;
139 NTSTATUS status;
140 uint16 acct_flags;
141
142 if ((argc != 2) || c->display_usage ||
143 (!strequal(argv[1], "yes") &&
144 !strequal(argv[1], "no"))) {
145 d_fprintf(stderr, "usage: net sam set %s <user> [yes|no]\n",
146 field);
147 return -1;
148 }
149
150 if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
151 &dom, &name, &sid, &type)) {
152 d_fprintf(stderr, "Could not find name %s\n", argv[0]);
153 return -1;
154 }
155
156 if (type != SID_NAME_USER) {
157 d_fprintf(stderr, "%s is a %s, not a user\n", argv[0],
158 sid_type_lookup(type));
159 return -1;
160 }
161
162 if ( !(sam_acct = samu_new( NULL )) ) {
163 d_fprintf(stderr, "Internal error\n");
164 return -1;
165 }
166
167 if (!pdb_getsampwsid(sam_acct, &sid)) {
168 d_fprintf(stderr, "Loading user %s failed\n", argv[0]);
169 return -1;
170 }
171
172 acct_flags = pdb_get_acct_ctrl(sam_acct);
173
174 if (strequal(argv[1], "yes")) {
175 acct_flags |= flag;
176 } else {
177 acct_flags &= ~flag;
178 }
179
180 pdb_set_acct_ctrl(sam_acct, acct_flags, PDB_CHANGED);
181
182 status = pdb_update_sam_account(sam_acct);
183 if (!NT_STATUS_IS_OK(status)) {
184 d_fprintf(stderr, "Updating sam account %s failed with %s\n",
185 argv[0], nt_errstr(status));
186 return -1;
187 }
188
189 TALLOC_FREE(sam_acct);
190
191 d_fprintf(stderr, "Updated flag %s for %s\\%s to %s\n", field, dom,
192 name, argv[1]);
193 return 0;
194 }
195
196 static int net_sam_set_disabled(struct net_context *c, int argc,
197 const char **argv)
198 {
199 return net_sam_set_userflag(c, argc, argv, "disabled", ACB_DISABLED);
200 }
201
202 static int net_sam_set_pwnotreq(struct net_context *c, int argc,
203 const char **argv)
204 {
205 return net_sam_set_userflag(c, argc, argv, "pwnotreq", ACB_PWNOTREQ);
206 }
207
208 static int net_sam_set_autolock(struct net_context *c, int argc,
209 const char **argv)
210 {
211 return net_sam_set_userflag(c, argc, argv, "autolock", ACB_AUTOLOCK);
212 }
213
214 static int net_sam_set_pwnoexp(struct net_context *c, int argc,
215 const char **argv)
216 {
217 return net_sam_set_userflag(c, argc, argv, "pwnoexp", ACB_PWNOEXP);
218 }
219
220 /*
221 * Set pass last change time, based on force pass change now
222 */
223
224 static int net_sam_set_pwdmustchangenow(struct net_context *c, int argc,
225 const char **argv)
226 {
227 struct samu *sam_acct = NULL;
228 DOM_SID sid;
229 enum lsa_SidType type;
230 const char *dom, *name;
231 NTSTATUS status;
232
233 if ((argc != 2) || c->display_usage ||
234 (!strequal(argv[1], "yes") &&
235 !strequal(argv[1], "no"))) {
236 d_fprintf(stderr, "usage: net sam set pwdmustchangenow <user> [yes|no]\n");
237 return -1;
238 }
239
240 if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
241 &dom, &name, &sid, &type)) {
242 d_fprintf(stderr, "Could not find name %s\n", argv[0]);
243 return -1;
244 }
245
246 if (type != SID_NAME_USER) {
247 d_fprintf(stderr, "%s is a %s, not a user\n", argv[0],
248 sid_type_lookup(type));
249 return -1;
250 }
251
252 if ( !(sam_acct = samu_new( NULL )) ) {
253 d_fprintf(stderr, "Internal error\n");
254 return -1;
255 }
256
257 if (!pdb_getsampwsid(sam_acct, &sid)) {
258 d_fprintf(stderr, "Loading user %s failed\n", argv[0]);
259 return -1;
260 }
261
262 if (strequal(argv[1], "yes")) {
263 pdb_set_pass_last_set_time(sam_acct, 0, PDB_CHANGED);
264 } else {
265 pdb_set_pass_last_set_time(sam_acct, time(NULL), PDB_CHANGED);
266 }
267
268 status = pdb_update_sam_account(sam_acct);
269 if (!NT_STATUS_IS_OK(status)) {
270 d_fprintf(stderr, "Updating sam account %s failed with %s\n",
271 argv[0], nt_errstr(status));
272 return -1;
273 }
274
275 TALLOC_FREE(sam_acct);
276
277 d_fprintf(stderr, "Updated 'user must change password at next logon' for %s\\%s to %s\n", dom,
278 name, argv[1]);
279 return 0;
280 }
281
282
283 /*
284 * Set a user's or a group's comment
285 */
286
287 static int net_sam_set_comment(struct net_context *c, int argc,
288 const char **argv)
289 {
290 GROUP_MAP map;
291 DOM_SID sid;
292 enum lsa_SidType type;
293 const char *dom, *name;
294 NTSTATUS status;
295
296 if (argc != 2 || c->display_usage) {
297 d_fprintf(stderr, "usage: net sam set comment <name> "
298 "<comment>\n");
299 return -1;
300 }
301
302 if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
303 &dom, &name, &sid, &type)) {
304 d_fprintf(stderr, "Could not find name %s\n", argv[0]);
305 return -1;
306 }
307
308 if (type == SID_NAME_USER) {
309 return net_sam_userset(c, argc, argv, "comment",
310 pdb_set_acct_desc);
311 }
312
313 if ((type != SID_NAME_DOM_GRP) && (type != SID_NAME_ALIAS) &&
314 (type != SID_NAME_WKN_GRP)) {
315 d_fprintf(stderr, "%s is a %s, not a group\n", argv[0],
316 sid_type_lookup(type));
317 return -1;
318 }
319
320 if (!pdb_getgrsid(&map, sid)) {
321 d_fprintf(stderr, "Could not load group %s\n", argv[0]);
322 return -1;
323 }
324
325 fstrcpy(map.comment, argv[1]);
326
327 status = pdb_update_group_mapping_entry(&map);
328
329 if (!NT_STATUS_IS_OK(status)) {
330 d_fprintf(stderr, "Updating group mapping entry failed with "
331 "%s\n", nt_errstr(status));
332 return -1;
333 }
334
335 d_printf("Updated comment of group %s\\%s to %s\n", dom, name,
336 argv[1]);
337
338 return 0;
339 }
340
341 static int net_sam_set(struct net_context *c, int argc, const char **argv)
342 {
343 struct functable func[] = {
344 {
345 "homedir",
346 net_sam_set_homedir,
347 NET_TRANSPORT_LOCAL,
348 "Change a user's home directory",
349 "net sam set homedir\n"
350 " Change a user's home directory"
351 },
352 {
353 "profilepath",
354 net_sam_set_profilepath,
355 NET_TRANSPORT_LOCAL,
356 "Change a user's profile path",
357 "net sam set profilepath\n"
358 " Change a user's profile path"
359 },
360 {
361 "comment",
362 net_sam_set_comment,
363 NET_TRANSPORT_LOCAL,
364 "Change a users or groups description",
365 "net sam set comment\n"
366 " Change a users or groups description"
367 },
368 {
369 "fullname",
370 net_sam_set_fullname,
371 NET_TRANSPORT_LOCAL,
372 "Change a user's full name",
373 "net sam set fullname\n"
374 " Change a user's full name"
375 },
376 {
377 "logonscript",
378 net_sam_set_logonscript,
379 NET_TRANSPORT_LOCAL,
380 "Change a user's logon script",
381 "net sam set logonscript\n"
382 " Change a user's logon script"
383 },
384 {
385 "homedrive",
386 net_sam_set_homedrive,
387 NET_TRANSPORT_LOCAL,
388 "Change a user's home drive",
389 "net sam set homedrive\n"
390 " Change a user's home drive"
391 },
392 {
393 "workstations",
394 net_sam_set_workstations,
395 NET_TRANSPORT_LOCAL,
396 "Change a user's allowed workstations",
397 "net sam set workstations\n"
398 " Change a user's allowed workstations"
399 },
400 {
401 "disabled",
402 net_sam_set_disabled,
403 NET_TRANSPORT_LOCAL,
404 "Disable/Enable a user",
405 "net sam set disable\n"
406 " Disable/Enable a user"
407 },
408 {
409 "pwnotreq",
410 net_sam_set_pwnotreq,
411 NET_TRANSPORT_LOCAL,
412 "Disable/Enable the password not required flag",
413 "net sam set pwnotreq\n"
414 " Disable/Enable the password not required flag"
415 },
416 {
417 "autolock",
418 net_sam_set_autolock,
419 NET_TRANSPORT_LOCAL,
420 "Disable/Enable a user's lockout flag",
421 "net sam set autolock\n"
422 " Disable/Enable a user's lockout flag"
423 },
424 {
425 "pwnoexp",
426 net_sam_set_pwnoexp,
427 NET_TRANSPORT_LOCAL,
428 "Disable/Enable whether a user's pw does not expire",
429 "net sam set pwnoexp\n"
430 " Disable/Enable whether a user's pw does not expire"
431 },
432 {
433 "pwdmustchangenow",
434 net_sam_set_pwdmustchangenow,
435 NET_TRANSPORT_LOCAL,
436 "Force users password must change at next logon",
437 "net sam set pwdmustchangenow\n"
438 " Force users password must change at next logon"
439 },
440 {NULL, NULL, 0, NULL, NULL}
441 };
442
443 return net_run_function(c, argc, argv, "net sam set", func);
444 }
445
446 /*
447 * Manage account policies
448 */
449
450 static int net_sam_policy_set(struct net_context *c, int argc, const char **argv)
451 {
452 const char *account_policy = NULL;
453 uint32 value = 0;
454 uint32 old_value = 0;
455 int field;
456 char *endptr;
457
458 if (argc != 2 || c->display_usage) {
459 d_fprintf(stderr, "usage: net sam policy set "
460 "\"<account policy>\" <value> \n");
461 return -1;
462 }
463
464 account_policy = argv[0];
465 field = account_policy_name_to_fieldnum(account_policy);
466
467 if (strequal(argv[1], "forever") || strequal(argv[1], "never")
468 || strequal(argv[1], "off")) {
469 value = -1;
470 }
471 else {
472 value = strtoul(argv[1], &endptr, 10);
473
474 if ((endptr == argv[1]) || (endptr[0] != '\0')) {
475 d_printf("Unable to set policy \"%s\"! Invalid value "
476 "\"%s\".\n",
477 account_policy, argv[1]);
478 return -1;
479 }
480 }
481
482 if (field == 0) {
483 const char **names;
484 int i, count;
485
486 account_policy_names_list(&names, &count);
487 d_fprintf(stderr, "No account policy \"%s\"!\n\n", argv[0]);
488 d_fprintf(stderr, "Valid account policies are:\n");
489
490 for (i=0; i<count; i++) {
491 d_fprintf(stderr, "%s\n", names[i]);
492 }
493
494 SAFE_FREE(names);
495 return -1;
496 }
497
498 if (!pdb_get_account_policy(field, &old_value)) {
499 d_fprintf(stderr, "Valid account policy, but unable to fetch "
500 "value!\n");
501 } else {
502 d_printf("Account policy \"%s\" value was: %d\n", account_policy,
503 old_value);
504 }
505
506 if (!pdb_set_account_policy(field, value)) {
507 d_fprintf(stderr, "Valid account policy, but unable to "
508 "set value!\n");
509 return -1;
510 } else {
511 d_printf("Account policy \"%s\" value is now: %d\n", account_policy,
512 value);
513 }
514
515 return 0;
516 }
517
518 static int net_sam_policy_show(struct net_context *c, int argc, const char **argv)
519 {
520 const char *account_policy = NULL;
521 uint32 old_value;
522 int field;
523
524 if (argc != 1 || c->display_usage) {
525 d_fprintf(stderr, "usage: net sam policy show"
526 " \"<account policy>\" \n");
527 return -1;
528 }
529
530 account_policy = argv[0];
531 field = account_policy_name_to_fieldnum(account_policy);
532
533 if (field == 0) {
534 const char **names;
535 int count;
536 int i;
537 account_policy_names_list(&names, &count);
538 d_fprintf(stderr, "No account policy by that name!\n");
539 if (count != 0) {
540 d_fprintf(stderr, "Valid account policies "
541 "are:\n");
542 for (i=0; i<count; i++) {
543 d_fprintf(stderr, "%s\n", names[i]);
544 }
545 }
546 SAFE_FREE(names);
547 return -1;
548 }
549
550 if (!pdb_get_account_policy(field, &old_value)) {
551 fprintf(stderr, "Valid account policy, but unable to "
552 "fetch value!\n");
553 return -1;
554 }
555
556 printf("Account policy \"%s\" description: %s\n",
557 account_policy, account_policy_get_desc(field));
558 printf("Account policy \"%s\" value is: %d\n", account_policy,
559 old_value);
560 return 0;
561 }
562
563 static int net_sam_policy_list(struct net_context *c, int argc, const char **argv)
564 {
565 const char **names;
566 int count;
567 int i;
568
569 if (c->display_usage) {
570 d_printf("Usage:\n"
571 "net sam policy list\n"
572 " List account policies\n");
573 return 0;
574 }
575
576 account_policy_names_list(&names, &count);
577 if (count != 0) {
578 d_fprintf(stderr, "Valid account policies "
579 "are:\n");
580 for (i = 0; i < count ; i++) {
581 d_fprintf(stderr, "%s\n", names[i]);
582 }
583 }
584 SAFE_FREE(names);
585 return -1;
586 }
587
588 static int net_sam_policy(struct net_context *c, int argc, const char **argv)
589 {
590 struct functable func[] = {
591 {
592 "list",
593 net_sam_policy_list,
594 NET_TRANSPORT_LOCAL,
595 "List account policies",
596 "net sam policy list\n"
597 " List account policies"
598 },
599 {
600 "show",
601 net_sam_policy_show,
602 NET_TRANSPORT_LOCAL,
603 "Show account policies",
604 "net sam policy show\n"
605 " Show account policies"
606 },
607 {
608 "set",
609 net_sam_policy_set,
610 NET_TRANSPORT_LOCAL,
611 "Change account policies",
612 "net sam policy set\n"
613 " Change account policies"
614 },
615 {NULL, NULL, 0, NULL, NULL}
616 };
617
618 return net_run_function(c, argc, argv, "net sam policy", func);
619 }
620
621 extern PRIVS privs[];
622
623 static int net_sam_rights_list(struct net_context *c, int argc,
624 const char **argv)
625 {
626 SE_PRIV mask;
627
628 if (argc > 1 || c->display_usage) {
629 d_fprintf(stderr, "usage: net sam rights list [privilege name]\n");
630 return -1;
631 }
632
633 if (argc == 0) {
634 int i;
635 int num = count_all_privileges();
636
637 for (i=0; i<num; i++) {
638 d_printf("%s\n", privs[i].name);
639 }
640 return 0;
641 }
642
643 if (se_priv_from_name(argv[0], &mask)) {
644 DOM_SID *sids;
645 int i, num_sids;
646 NTSTATUS status;
647
648 status = privilege_enum_sids(&mask, talloc_tos(),
649 &sids, &num_sids);
650 if (!NT_STATUS_IS_OK(status)) {
651 d_fprintf(stderr, "Could not list rights: %s\n",
652 nt_errstr(status));
653 return -1;
654 }
655
656 for (i=0; i<num_sids; i++) {
657 const char *dom, *name;
658 enum lsa_SidType type;
659
660 if (lookup_sid(talloc_tos(), &sids[i], &dom, &name,
661 &type)) {
662 d_printf("%s\\%s\n", dom, name);
663 }
664 else {
665 d_printf("%s\n", sid_string_tos(&sids[i]));
666 }
667 }
668 return 0;
669 }
670
671 return -1;
672 }
673
674 static int net_sam_rights_grant(struct net_context *c, int argc,
675 const char **argv)
676 {
677 DOM_SID sid;
678 enum lsa_SidType type;
679 const char *dom, *name;
680 SE_PRIV mask;
681
682 if (argc != 2 || c->display_usage) {
683 d_fprintf(stderr, "usage: net sam rights grant <name> "
684 "<right>\n");
685 return -1;
686 }
687
688 if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
689 &dom, &name, &sid, &type)) {
690 d_fprintf(stderr, "Could not find name %s\n", argv[0]);
691 return -1;
692 }
693
694 if (!se_priv_from_name(argv[1], &mask)) {
695 d_fprintf(stderr, "%s unknown\n", argv[1]);
696 return -1;
697 }
698
699 if (!grant_privilege(&sid, &mask)) {
700 d_fprintf(stderr, "Could not grant privilege\n");
701 return -1;
702 }
703
704 d_printf("Granted %s to %s\\%s\n", argv[1], dom, name);
705 return 0;
706 }
707
708 static int net_sam_rights_revoke(struct net_context *c, int argc, const char **argv)
709 {
710 DOM_SID sid;
711 enum lsa_SidType type;
712 const char *dom, *name;
713 SE_PRIV mask;
714
715 if (argc != 2 || c->display_usage) {
716 d_fprintf(stderr, "usage: net sam rights revoke <name> "
717 "<right>\n");
718 return -1;
719 }
720
721 if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
722 &dom, &name, &sid, &type)) {
723 d_fprintf(stderr, "Could not find name %s\n", argv[0]);
724 return -1;
725 }
726
727 if (!se_priv_from_name(argv[1], &mask)) {
728 d_fprintf(stderr, "%s unknown\n", argv[1]);
729 return -1;
730 }
731
732 if (!revoke_privilege(&sid, &mask)) {
733 d_fprintf(stderr, "Could not revoke privilege\n");
734 return -1;
735 }
736
737 d_printf("Revoked %s from %s\\%s\n", argv[1], dom, name);
738 return 0;
739 }
740
741 static int net_sam_rights(struct net_context *c, int argc, const char **argv)
742 {
743 struct functable func[] = {
744 {
745 "list",
746 net_sam_rights_list,
747 NET_TRANSPORT_LOCAL,
748 "List possible user rights",
749 "net sam rights list\n"
750 " List possible user rights"
751 },
752 {
753 "grant",
754 net_sam_rights_grant,
755 NET_TRANSPORT_LOCAL,
756 "Grant a right",
757 "net sam rights grant\n"
758 " Grant a right"
759 },
760 {
761 "revoke",
762 net_sam_rights_revoke,
763 NET_TRANSPORT_LOCAL,
764 "Revoke a right",
765 "net sam rights revoke\n"
766 " Revoke a right"
767 },
768 {NULL, NULL, 0, NULL, NULL}
769 };
770 return net_run_function(c, argc, argv, "net sam rights", func);
771 }
772
773 /*
774 * Map a unix group to a domain group
775 */
776
777 static NTSTATUS map_unix_group(const struct group *grp, GROUP_MAP *pmap)
778 {
779 NTSTATUS status;
780 GROUP_MAP map;
781 const char *grpname, *dom, *name;
782 uint32 rid;
783
784 if (pdb_getgrgid(&map, grp->gr_gid)) {
785 return NT_STATUS_GROUP_EXISTS;
786 }
787
788 map.gid = grp->gr_gid;
789 grpname = grp->gr_name;
790
791 if (lookup_name(talloc_tos(), grpname, LOOKUP_NAME_LOCAL,
792 &dom, &name, NULL, NULL)) {
793
794 const char *tmp = talloc_asprintf(
795 talloc_tos(), "Unix Group %s", grp->gr_name);
796
797 DEBUG(5, ("%s exists as %s\\%s, retrying as \"%s\"\n",
798 grpname, dom, name, tmp));
799 grpname = tmp;
800 }
801
802 if (lookup_name(talloc_tos(), grpname, LOOKUP_NAME_LOCAL,
803 NULL, NULL, NULL, NULL)) {
804 DEBUG(3, ("\"%s\" exists, can't map it\n", grp->gr_name));
805 return NT_STATUS_GROUP_EXISTS;
806 }
807
808 fstrcpy(map.nt_name, grpname);
809
810 if (pdb_rid_algorithm()) {
811 rid = algorithmic_pdb_gid_to_group_rid( grp->gr_gid );
812 } else {
813 if (!pdb_new_rid(&rid)) {
814 DEBUG(3, ("Could not get a new RID for %s\n",
815 grp->gr_name));
816 return NT_STATUS_ACCESS_DENIED;
817 }
818 }
819
820 sid_compose(&map.sid, get_global_sam_sid(), rid);
821 map.sid_name_use = SID_NAME_DOM_GRP;
822 fstrcpy(map.comment, talloc_asprintf(talloc_tos(), "Unix Group %s",
823 grp->gr_name));
824
825 status = pdb_add_group_mapping_entry(&map);
826 if (NT_STATUS_IS_OK(status)) {
827 *pmap = map;
828 }
829 return status;
830 }
831
832 static int net_sam_mapunixgroup(struct net_context *c, int argc, const char **argv)
833 {
834 NTSTATUS status;
835 GROUP_MAP map;
836 struct group *grp;
837
838 if (argc != 1 || c->display_usage) {
839 d_fprintf(stderr, "usage: net sam mapunixgroup <name>\n");
840 return -1;
841 }
842
843 grp = getgrnam(argv[0]);
844 if (grp == NULL) {
845 d_fprintf(stderr, "Could not find group %s\n", argv[0]);
846 return -1;
847 }
848
849 status = map_unix_group(grp, &map);
850
851 if (!NT_STATUS_IS_OK(status)) {
852 d_fprintf(stderr, "Mapping group %s failed with %s\n",
853 argv[0], nt_errstr(status));
854 return -1;
855 }
856
857 d_printf("Mapped unix group %s to SID %s\n", argv[0],
858 sid_string_tos(&map.sid));
859
860 return 0;
861 }
862
863 /*
864 * Remove a group mapping
865 */
866
867 static NTSTATUS unmap_unix_group(const struct group *grp, GROUP_MAP *pmap)
868 {
869 NTSTATUS status;
870 GROUP_MAP map;
871 const char *grpname;
872 DOM_SID dom_sid;
873
874 map.gid = grp->gr_gid;
875 grpname = grp->gr_name;
876
877 if (!lookup_name(talloc_tos(), grpname, LOOKUP_NAME_LOCAL,
878 NULL, NULL, NULL, NULL)) {
879 DEBUG(3, ("\"%s\" does not exist, can't unmap it\n", grp->gr_name));
880 return NT_STATUS_NO_SUCH_GROUP;
881 }
882
883 fstrcpy(map.nt_name, grpname);
884
885 if (!pdb_gid_to_sid(map.gid, &dom_sid)) {
886 return NT_STATUS_UNSUCCESSFUL;
887 }
888
889 status = pdb_delete_group_mapping_entry(dom_sid);
890
891 return status;
892 }
893
894 static int net_sam_unmapunixgroup(struct net_context *c, int argc, const char **argv)
895 {
896 NTSTATUS status;
897 GROUP_MAP map;
898 struct group *grp;
899
900 if (argc != 1 || c->display_usage) {
901 d_fprintf(stderr, "usage: net sam unmapunixgroup <name>\n");
902 return -1;
903 }
904
905 grp = getgrnam(argv[0]);
906 if (grp == NULL) {
907 d_fprintf(stderr, "Could not find mapping for group %s.\n", argv[0]);
908 return -1;
909 }
910
911 status = unmap_unix_group(grp, &map);
912
913 if (!NT_STATUS_IS_OK(status)) {
914 d_fprintf(stderr, "Unmapping group %s failed with %s.\n",
915 argv[0], nt_errstr(status));
916 return -1;
917 }
918
919 d_printf("Unmapped unix group %s.\n", argv[0]);
920
921 return 0;
922 }
923
924 /*
925 * Create a domain group
926 */
927
928 static int net_sam_createdomaingroup(struct net_context *c, int argc,
929 const char **argv)
930 {
931 NTSTATUS status;
932 uint32 rid;
933
934 if (argc != 1 || c->display_usage) {
935 d_fprintf(stderr, "usage: net sam createdomaingroup <name>\n");
936 return -1;
937 }
938
939 status = pdb_create_dom_group(talloc_tos(), argv[0], &rid);
940
941 if (!NT_STATUS_IS_OK(status)) {
942 d_fprintf(stderr, "Creating %s failed with %s\n",
943 argv[0], nt_errstr(status));
944 return -1;
945 }
946
947 d_printf("Created domain group %s with RID %d\n", argv[0], rid);
948
949 return 0;
950 }
951
952 /*
953 * Create a local group
954 */
955
956 static int net_sam_createlocalgroup(struct net_context *c, int argc, const char **argv)
957 {
958 NTSTATUS status;
959 uint32 rid;
960
961 if (argc != 1 || c->display_usage) {
962 d_fprintf(stderr, "usage: net sam createlocalgroup <name>\n");
963 return -1;
964 }
965
966 if (!winbind_ping()) {
967 d_fprintf(stderr, "winbind seems not to run. createlocalgroup "
968 "only works when winbind runs.\n");
969 return -1;
970 }
971
972 status = pdb_create_alias(argv[0], &rid);
973
974 if (!NT_STATUS_IS_OK(status)) {
975 d_fprintf(stderr, "Creating %s failed with %s\n",
976 argv[0], nt_errstr(status));
977 return -1;
978 }
979
980 d_printf("Created local group %s with RID %d\n", argv[0], rid);
981
982 return 0;
983 }
984
985 /*
986 * Delete a local group
987 */
988
989 static int net_sam_deletelocalgroup(struct net_context *c, int argc, const char **argv)
990 {
991 DOM_SID sid;
992 enum lsa_SidType type;
993 const char *dom, *name;
994 NTSTATUS status;
995
996 if (argc != 1 || c->display_usage) {
997 d_fprintf(stderr, "usage: net sam deletelocalgroup <name>\n");
998 return -1;
999 }
1000
1001 if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1002 &dom, &name, &sid, &type)) {
1003 d_fprintf(stderr, "Could not find %s.\n", argv[0]);
1004 return -1;
1005 }
1006
1007 if (type != SID_NAME_ALIAS) {
1008 d_fprintf(stderr, "%s is a %s, not a local group.\n", argv[0],
1009 sid_type_lookup(type));
1010 return -1;
1011 }
1012
1013 status = pdb_delete_alias(&sid);
1014
1015 if (!NT_STATUS_IS_OK(status)) {
1016 d_fprintf(stderr, "Deleting local group %s failed with %s\n",
1017 argv[0], nt_errstr(status));
1018 return -1;
1019 }
1020
1021 d_printf("Deleted local group %s.\n", argv[0]);
1022
1023 return 0;
1024 }
1025
1026 /*
1027 * Create a builtin group
1028 */
1029
1030 static int net_sam_createbuiltingroup(struct net_context *c, int argc, const char **argv)
1031 {
1032 NTSTATUS status;
1033 uint32 rid;
1034 enum lsa_SidType type;
1035 fstring groupname;
1036 DOM_SID sid;
1037
1038 if (argc != 1 || c->display_usage) {
1039 d_fprintf(stderr, "usage: net sam createbuiltingroup <name>\n");
1040 return -1;
1041 }
1042
1043 if (!winbind_ping()) {
1044 d_fprintf(stderr, "winbind seems not to run. createbuiltingroup "
1045 "only works when winbind runs.\n");
1046 return -1;
1047 }
1048
1049 /* validate the name and get the group */
1050
1051 fstrcpy( groupname, "BUILTIN\\" );
1052 fstrcat( groupname, argv[0] );
1053
1054 if ( !lookup_name(talloc_tos(), groupname, LOOKUP_NAME_ALL, NULL,
1055 NULL, &sid, &type)) {
1056 d_fprintf(stderr, "%s is not a BUILTIN group\n", argv[0]);
1057 return -1;
1058 }
1059
1060 if ( !sid_peek_rid( &sid, &rid ) ) {
1061 d_fprintf(stderr, "Failed to get RID for %s\n", argv[0]);
1062 return -1;
1063 }
1064
1065 status = pdb_create_builtin_alias( rid );
1066
1067 if (!NT_STATUS_IS_OK(status)) {
1068 d_fprintf(stderr, "Creating %s failed with %s\n",
1069 argv[0], nt_errstr(status));
1070 return -1;
1071 }
1072
1073 d_printf("Created BUILTIN group %s with RID %d\n", argv[0], rid);
1074
1075 return 0;
1076 }
1077
1078 /*
1079 * Add a group member
1080 */
1081
1082 static int net_sam_addmem(struct net_context *c, int argc, const char **argv)
1083 {
1084 const char *groupdomain, *groupname, *memberdomain, *membername;
1085 DOM_SID group, member;
1086 enum lsa_SidType grouptype, membertype;
1087 NTSTATUS status;
1088
1089 if (argc != 2 || c->display_usage) {
1090 d_fprintf(stderr, "usage: net sam addmem <group> <member>\n");
1091 return -1;
1092 }
1093
1094 if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1095 &groupdomain, &groupname, &group, &grouptype)) {
1096 d_fprintf(stderr, "Could not find group %s\n", argv[0]);
1097 return -1;
1098 }
1099
1100 /* check to see if the member to be added is a name or a SID */
1101
1102 if (!lookup_name(talloc_tos(), argv[1], LOOKUP_NAME_LOCAL,
1103 &memberdomain, &membername, &member, &membertype))
1104 {
1105 /* try it as a SID */
1106
1107 if ( !string_to_sid( &member, argv[1] ) ) {
1108 d_fprintf(stderr, "Could not find member %s\n", argv[1]);
1109 return -1;
1110 }
1111
1112 if ( !lookup_sid(talloc_tos(), &member, &memberdomain,
1113 &membername, &membertype) )
1114 {
1115 d_fprintf(stderr, "Could not resolve SID %s\n", argv[1]);
1116 return -1;
1117 }
1118 }
1119
1120 if ((grouptype == SID_NAME_ALIAS) || (grouptype == SID_NAME_WKN_GRP)) {
1121 if ((membertype != SID_NAME_USER) &&
1122 (membertype != SID_NAME_DOM_GRP)) {
1123 d_fprintf(stderr, "%s is a local group, only users "
1124 "and domain groups can be added.\n"
1125 "%s is a %s\n", argv[0], argv[1],
1126 sid_type_lookup(membertype));
1127 return -1;
1128 }
1129 status = pdb_add_aliasmem(&group, &member);
1130
1131 if (!NT_STATUS_IS_OK(status)) {
1132 d_fprintf(stderr, "Adding local group member failed "
1133 "with %s\n", nt_errstr(status));
1134 return -1;
1135 }
1136 } else {
1137 d_fprintf(stderr, "Can only add members to local groups so "
1138 "far, %s is a %s\n", argv[0],
1139 sid_type_lookup(grouptype));
1140 return -1;
1141 }
1142
1143 d_printf("Added %s\\%s to %s\\%s\n", memberdomain, membername,
1144 groupdomain, groupname);
1145
1146 return 0;
1147 }
1148
1149 /*
1150 * Delete a group member
1151 */
1152
1153 static int net_sam_delmem(struct net_context *c, int argc, const char **argv)
1154 {
1155 const char *groupdomain, *groupname;
1156 const char *memberdomain = NULL;
1157 const char *membername = NULL;
1158 DOM_SID group, member;
1159 enum lsa_SidType grouptype;
1160 NTSTATUS status;
1161
1162 if (argc != 2 || c->display_usage) {
1163 d_fprintf(stderr, "usage: net sam delmem <group> <member>\n");
1164 return -1;
1165 }
1166
1167 if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1168 &groupdomain, &groupname, &group, &grouptype)) {
1169 d_fprintf(stderr, "Could not find group %s\n", argv[0]);
1170 return -1;
1171 }
1172
1173 if (!lookup_name(talloc_tos(), argv[1], LOOKUP_NAME_LOCAL,
1174 &memberdomain, &membername, &member, NULL)) {
1175 if (!string_to_sid(&member, argv[1])) {
1176 d_fprintf(stderr, "Could not find member %s\n",
1177 argv[1]);
1178 return -1;
1179 }
1180 }
1181
1182 if ((grouptype == SID_NAME_ALIAS) ||
1183 (grouptype == SID_NAME_WKN_GRP)) {
1184 status = pdb_del_aliasmem(&group, &member);
1185
1186 if (!NT_STATUS_IS_OK(status)) {
1187 d_fprintf(stderr, "Deleting local group member failed "
1188 "with %s\n", nt_errstr(status));
1189 return -1;
1190 }
1191 } else {
1192 d_fprintf(stderr, "Can only delete members from local groups "
1193 "so far, %s is a %s\n", argv[0],
1194 sid_type_lookup(grouptype));
1195 return -1;
1196 }
1197
1198 if (membername != NULL) {
1199 d_printf("Deleted %s\\%s from %s\\%s\n",
1200 memberdomain, membername, groupdomain, groupname);
1201 } else {
1202 d_printf("Deleted %s from %s\\%s\n",
1203 sid_string_tos(&member), groupdomain, groupname);
1204 }
1205
1206 return 0;
1207 }
1208
1209 /*
1210 * List group members
1211 */
1212
1213 static int net_sam_listmem(struct net_context *c, int argc, const char **argv)
1214 {
1215 const char *groupdomain, *groupname;
1216 DOM_SID group;
1217 enum lsa_SidType grouptype;
1218 NTSTATUS status;
1219
1220 if (argc != 1 || c->display_usage) {
1221 d_fprintf(stderr, "usage: net sam listmem <group>\n");
1222 return -1;
1223 }
1224
1225 if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1226 &groupdomain, &groupname, &group, &grouptype)) {
1227 d_fprintf(stderr, "Could not find group %s\n", argv[0]);
1228 return -1;
1229 }
1230
1231 if ((grouptype == SID_NAME_ALIAS) ||
1232 (grouptype == SID_NAME_WKN_GRP)) {
1233 DOM_SID *members = NULL;
1234 size_t i, num_members = 0;
1235
1236 status = pdb_enum_aliasmem(&group, &members, &num_members);
1237
1238 if (!NT_STATUS_IS_OK(status)) {
1239 d_fprintf(stderr, "Listing group members failed with "
1240 "%s\n", nt_errstr(status));
1241 return -1;
1242 }
1243
1244 d_printf("%s\\%s has %u members\n", groupdomain, groupname,
1245 (unsigned int)num_members);
1246 for (i=0; i<num_members; i++) {
1247 const char *dom, *name;
1248 if (lookup_sid(talloc_tos(), &members[i],
1249 &dom, &name, NULL)) {
1250 d_printf(" %s\\%s\n", dom, name);
1251 } else {
1252 d_printf(" %s\n", sid_string_tos(&members[i]));
1253 }
1254 }
1255
1256 TALLOC_FREE(members);
1257 } else {
1258 d_fprintf(stderr, "Can only list local group members so far.\n"
1259 "%s is a %s\n", argv[0], sid_type_lookup(grouptype));
1260 return -1;
1261 }
1262
1263 return 0;
1264 }
1265
1266 /*
1267 * Do the listing
1268 */
1269 static int net_sam_do_list(struct net_context *c, int argc, const char **argv,
1270 struct pdb_search *search, const char *what)
1271 {
1272 bool verbose = (argc == 1);
1273
1274 if ((argc > 1) || c->display_usage ||
1275 ((argc == 1) && !strequal(argv[0], "verbose"))) {
1276 d_fprintf(stderr, "usage: net sam list %s [verbose]\n", what);
1277 return -1;
1278 }
1279
1280 if (search == NULL) {
1281 d_fprintf(stderr, "Could not start search\n");
1282 return -1;
1283 }
1284
1285 while (true) {
1286 struct samr_displayentry entry;
1287 if (!search->next_entry(search, &entry)) {
1288 break;
1289 }
1290 if (verbose) {
1291 d_printf("%s:%d:%s\n",
1292 entry.account_name,
1293 entry.rid,
1294 entry.description);
1295 } else {
1296 d_printf("%s\n", entry.account_name);
1297 }
1298 }
1299
1300 TALLOC_FREE(search);
1301 return 0;
1302 }
1303
1304 static int net_sam_list_users(struct net_context *c, int argc,
1305 const char **argv)
1306 {
1307 return net_sam_do_list(c, argc, argv,
1308 pdb_search_users(talloc_tos(), ACB_NORMAL),
1309 "users");
1310 }
1311
1312 static int net_sam_list_groups(struct net_context *c, int argc,
1313 const char **argv)
1314 {
1315 return net_sam_do_list(c, argc, argv, pdb_search_groups(talloc_tos()),
1316 "groups");
1317 }
1318
1319 static int net_sam_list_localgroups(struct net_context *c, int argc,
1320 const char **argv)
1321 {
1322 return net_sam_do_list(c, argc, argv,
1323 pdb_search_aliases(talloc_tos(),
1324 get_global_sam_sid()),
1325 "localgroups");
1326 }
1327
1328 static int net_sam_list_builtin(struct net_context *c, int argc,
1329 const char **argv)
1330 {
1331 return net_sam_do_list(c, argc, argv,
1332 pdb_search_aliases(talloc_tos(),
1333 &global_sid_Builtin),
1334 "builtin");
1335 }
1336
1337 static int net_sam_list_workstations(struct net_context *c, int argc,
1338 const char **argv)
1339 {
1340 return net_sam_do_list(c, argc, argv,
1341 pdb_search_users(talloc_tos(), ACB_WSTRUST),
1342 "workstations");
1343 }
1344
1345 /*
1346 * List stuff
1347 */
1348
1349 static int net_sam_list(struct net_context *c, int argc, const char **argv)
1350 {
1351 struct functable func[] = {
1352 {
1353 "users",
1354 net_sam_list_users,
1355 NET_TRANSPORT_LOCAL,
1356 "List SAM users",
1357 "net sam list users\n"
1358 " List SAM users"
1359 },
1360 {
1361 "groups",
1362 net_sam_list_groups,
1363 NET_TRANSPORT_LOCAL,
1364 "List SAM groups",
1365 "net sam list groups\n"
1366 " List SAM groups"
1367 },
1368 {
1369 "localgroups",
1370 net_sam_list_localgroups,
1371 NET_TRANSPORT_LOCAL,
1372 "List SAM local groups",
1373 "net sam list localgroups\n"
1374 " List SAM local groups"
1375 },
1376 {
1377 "builtin",
1378 net_sam_list_builtin,
1379 NET_TRANSPORT_LOCAL,
1380 "List builtin groups",
1381 "net sam list builtin\n"
1382 " List builtin groups"
1383 },
1384 {
1385 "workstations",
1386 net_sam_list_workstations,
1387 NET_TRANSPORT_LOCAL,
1388 "List domain member workstations",
1389 "net sam list workstations\n"
1390 " List domain member workstations"
1391 },
1392 {NULL, NULL, 0, NULL, NULL}
1393 };
1394
1395 return net_run_function(c, argc, argv, "net sam list", func);
1396 }
1397
1398 /*
1399 * Show details of SAM entries
1400 */
1401
1402 static int net_sam_show(struct net_context *c, int argc, const char **argv)
1403 {
1404 DOM_SID sid;
1405 enum lsa_SidType type;
1406 const char *dom, *name;
1407
1408 if (argc != 1 || c->display_usage) {
1409 d_fprintf(stderr, "usage: net sam show <name>\n");
1410 return -1;
1411 }
1412
1413 if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1414 &dom, &name, &sid, &type)) {
1415 d_fprintf(stderr, "Could not find name %s\n", argv[0]);
1416 return -1;
1417 }
1418
1419 d_printf("%s\\%s is a %s with SID %s\n", dom, name,
1420 sid_type_lookup(type), sid_string_tos(&sid));
1421
1422 return 0;
1423 }
1424
1425 #ifdef HAVE_LDAP
1426
1427 /*
1428 * Init an LDAP tree with default users and Groups
1429 * if ldapsam:editposix is enabled
1430 */
1431
1432 static int net_sam_provision(struct net_context *c, int argc, const char **argv)
1433 {
1434 TALLOC_CTX *tc;
1435 char *ldap_bk;
1436 char *ldap_uri = NULL;
1437 char *p;
1438 struct smbldap_state *ls;
1439 GROUP_MAP gmap;
1440 DOM_SID gsid;
1441 gid_t domusers_gid = -1;
1442 gid_t domadmins_gid = -1;
1443 struct samu *samuser;
1444 struct passwd *pwd;
1445
1446 if (c->display_usage) {
1447 d_printf("Usage:\n"
1448 "net sam provision\n"
1449 " Init an LDAP tree with default users/groups\n");
1450 return 0;
1451 }
1452
1453 tc = talloc_new(NULL);
1454 if (!tc) {
1455 d_fprintf(stderr, "Out of Memory!\n");
1456 return -1;
1457 }
1458
1459 if ((ldap_bk = talloc_strdup(tc, lp_passdb_backend())) == NULL) {
1460 d_fprintf(stderr, "talloc failed\n");
1461 talloc_free(tc);
1462 return -1;
1463 }
1464 p = strchr(ldap_bk, ':');
1465 if (p) {
1466 *p = 0;
1467 ldap_uri = talloc_strdup(tc, p+1);
1468 trim_char(ldap_uri, ' ', ' ');
1469 }
1470
1471 trim_char(ldap_bk, ' ', ' ');
1472
1473 if (strcmp(ldap_bk, "ldapsam") != 0) {
1474 d_fprintf(stderr, "Provisioning works only with ldapsam backend\n");
1475 goto failed;
1476 }
1477
1478 if (!lp_parm_bool(-1, "ldapsam", "trusted", false) ||
1479 !lp_parm_bool(-1, "ldapsam", "editposix", false)) {
1480
1481 d_fprintf(stderr, "Provisioning works only if ldapsam:trusted"
1482 " and ldapsam:editposix are enabled.\n");
1483 goto failed;
1484 }
1485
1486 if (!winbind_ping()) {
1487 d_fprintf(stderr, "winbind seems not to run. Provisioning "
1488 "LDAP only works when winbind runs.\n");
1489 goto failed;
1490 }
1491
1492 if (!NT_STATUS_IS_OK(smbldap_init(tc, NULL, ldap_uri, &ls))) {
1493 d_fprintf(stderr, "Unable to connect to the LDAP server.\n");
1494 goto failed;
1495 }
1496
1497 d_printf("Checking for Domain Users group.\n");
1498
1499 sid_compose(&gsid, get_global_sam_sid(), DOMAIN_GROUP_RID_USERS);
1500
1501 if (!pdb_getgrsid(&gmap, gsid)) {
1502 LDAPMod **mods = NULL;
1503 char *dn;
1504 char *uname;
1505 char *wname;
1506 char *gidstr;
1507 char *gtype;
1508 int rc;
1509
1510 d_printf("Adding the Domain Users group.\n");
1511
1512 /* lets allocate a new groupid for this group */
1513 if (!winbind_allocate_gid(&domusers_gid)) {
1514 d_fprintf(stderr, "Unable to allocate a new gid to create Domain Users group!\n");
1515 goto domu_done;
1516 }
1517
1518 uname = talloc_strdup(tc, "domusers");
1519 wname = talloc_strdup(tc, "Domain Users");
1520 dn = talloc_asprintf(tc, "cn=%s,%s", "domusers", lp_ldap_group_suffix());
1521 gidstr = talloc_asprintf(tc, "%u", (unsigned int)domusers_gid);
1522 gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
1523
1524 if (!uname || !wname || !dn || !gidstr || !gtype) {
1525 d_fprintf(stderr, "Out of Memory!\n");
1526 goto failed;
1527 }
1528
1529 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXGROUP);
1530 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
1531 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", uname);
1532 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", wname);
1533 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
1534 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid",
1535 sid_string_talloc(tc, &gsid));
1536 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", gtype);
1537
1538 talloc_autofree_ldapmod(tc, mods);
1539
1540 rc = smbldap_add(ls, dn, mods);
1541
1542 if (rc != LDAP_SUCCESS) {
1543 d_fprintf(stderr, "Failed to add Domain Users group to ldap directory\n");
1544 }
1545 } else {
1546 domusers_gid = gmap.gid;
1547 d_printf("found!\n");
1548 }
1549
1550 domu_done:
1551
1552 d_printf("Checking for Domain Admins group.\n");
1553
1554 sid_compose(&gsid, get_global_sam_sid(), DOMAIN_GROUP_RID_ADMINS);
1555
1556 if (!pdb_getgrsid(&gmap, gsid)) {
1557 LDAPMod **mods = NULL;
1558 char *dn;
1559 char *uname;
1560 char *wname;
1561 char *gidstr;
1562 char *gtype;
1563 int rc;
1564
1565 d_printf("Adding the Domain Admins group.\n");
1566
1567 /* lets allocate a new groupid for this group */
1568 if (!winbind_allocate_gid(&domadmins_gid)) {
1569 d_fprintf(stderr, "Unable to allocate a new gid to create Domain Admins group!\n");
1570 goto doma_done;
1571 }
1572
1573 uname = talloc_strdup(tc, "domadmins");
1574 wname = talloc_strdup(tc, "Domain Admins");
1575 dn = talloc_asprintf(tc, "cn=%s,%s", "domadmins", lp_ldap_group_suffix());
1576 gidstr = talloc_asprintf(tc, "%u", (unsigned int)domadmins_gid);
1577 gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
1578
1579 if (!uname || !wname || !dn || !gidstr || !gtype) {
1580 d_fprintf(stderr, "Out of Memory!\n");
1581 goto failed;
1582 }
1583
1584 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXGROUP);
1585 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
1586 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", uname);
1587 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", wname);
1588 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
1589 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid",
1590 sid_string_talloc(tc, &gsid));
1591 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", gtype);
1592
1593 talloc_autofree_ldapmod(tc, mods);
1594
1595 rc = smbldap_add(ls, dn, mods);
1596
1597 if (rc != LDAP_SUCCESS) {
1598 d_fprintf(stderr, "Failed to add Domain Admins group to ldap directory\n");
1599 }
1600 } else {
1601 domadmins_gid = gmap.gid;
1602 d_printf("found!\n");
1603 }
1604
1605 doma_done:
1606
1607 d_printf("Check for Administrator account.\n");
1608
1609 samuser = samu_new(tc);
1610 if (!samuser) {
1611 d_fprintf(stderr, "Out of Memory!\n");
1612 goto failed;
1613 }
1614
1615 if (!pdb_getsampwnam(samuser, "Administrator")) {
1616 LDAPMod **mods = NULL;
1617 DOM_SID sid;
1618 char *dn;
1619 char *name;
1620 char *uidstr;
1621 char *gidstr;
1622 char *shell;
1623 char *dir;
1624 uid_t uid;
1625 int rc;
1626
1627 d_printf("Adding the Administrator user.\n");
1628
1629 if (domadmins_gid == -1) {
1630 d_fprintf(stderr, "Can't create Administrator user, Domain Admins group not available!\n");
1631 goto done;
1632 }
1633 if (!winbind_allocate_uid(&uid)) {
1634 d_fprintf(stderr, "Unable to allocate a new uid to create the Administrator user!\n");
1635 goto done;
1636 }
1637 name = talloc_strdup(tc, "Administrator");
1638 dn = talloc_asprintf(tc, "uid=Administrator,%s", lp_ldap_user_suffix());
1639 uidstr = talloc_asprintf(tc, "%u", (unsigned int)uid);
1640 gidstr = talloc_asprintf(tc, "%u", (unsigned int)domadmins_gid);
1641 dir = talloc_sub_specified(tc, lp_template_homedir(),
1642 "Administrator",
1643 get_global_sam_name(),
1644 uid, domadmins_gid);
1645 shell = talloc_sub_specified(tc, lp_template_shell(),
1646 "Administrator",
1647 get_global_sam_name(),
1648 uid, domadmins_gid);
1649
1650 if (!name || !dn || !uidstr || !gidstr || !dir || !shell) {
1651 d_fprintf(stderr, "Out of Memory!\n");
1652 goto failed;
1653 }
1654
1655 sid_compose(&sid, get_global_sam_sid(), DOMAIN_USER_RID_ADMIN);
1656
1657 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_ACCOUNT);
1658 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXACCOUNT);
1659 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SAMBASAMACCOUNT);
1660 smbldap_set_mod(&mods, LDAP_MOD_ADD, "uid", name);
1661 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", name);
1662 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", name);
1663 smbldap_set_mod(&mods, LDAP_MOD_ADD, "uidNumber", uidstr);
1664 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
1665 smbldap_set_mod(&mods, LDAP_MOD_ADD, "homeDirectory", dir);
1666 smbldap_set_mod(&mods, LDAP_MOD_ADD, "loginShell", shell);
1667 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSID",
1668 sid_string_talloc(tc, &sid));
1669 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaAcctFlags",
1670 pdb_encode_acct_ctrl(ACB_NORMAL|ACB_DISABLED,
1671 NEW_PW_FORMAT_SPACE_PADDED_LEN));
1672
1673 talloc_autofree_ldapmod(tc, mods);
1674
1675 rc = smbldap_add(ls, dn, mods);
1676
1677 if (rc != LDAP_SUCCESS) {
1678 d_fprintf(stderr, "Failed to add Administrator user to ldap directory\n");
1679 }
1680 } else {
1681 d_printf("found!\n");
1682 }
1683
1684 d_printf("Checking for Guest user.\n");
1685
1686 samuser = samu_new(tc);
1687 if (!samuser) {
1688 d_fprintf(stderr, "Out of Memory!\n");
1689 goto failed;
1690 }
1691
1692 if (!pdb_getsampwnam(samuser, lp_guestaccount())) {
1693 LDAPMod **mods = NULL;
1694 DOM_SID sid;
1695 char *dn;
1696 char *uidstr;
1697 char *gidstr;
1698 int rc;
1699
1700 d_printf("Adding the Guest user.\n");
1701
1702 pwd = getpwnam_alloc(tc, lp_guestaccount());
1703
1704 if (!pwd) {
1705 if (domusers_gid == -1) {
1706 d_fprintf(stderr, "Can't create Guest user, Domain Users group not available!\n");
1707 goto done;
1708 }
1709 if ((pwd = talloc(tc, struct passwd)) == NULL) {
1710 d_fprintf(stderr, "talloc failed\n");
1711 goto done;
1712 }
1713 pwd->pw_name = talloc_strdup(pwd, lp_guestaccount());
1714 if (!winbind_allocate_uid(&(pwd->pw_uid))) {
1715 d_fprintf(stderr, "Unable to allocate a new uid to create the Guest user!\n");
1716 goto done;
1717 }
1718 pwd->pw_gid = domusers_gid;
1719 pwd->pw_dir = talloc_strdup(tc, "/");
1720 pwd->pw_shell = talloc_strdup(tc, "/bin/false");
1721 if (!pwd->pw_dir || !pwd->pw_shell) {
1722 d_fprintf(stderr, "Out of Memory!\n");
1723 goto failed;
1724 }
1725 }
1726
1727 sid_compose(&sid, get_global_sam_sid(), DOMAIN_USER_RID_GUEST);
1728
1729 dn = talloc_asprintf(tc, "uid=%s,%s", pwd->pw_name, lp_ldap_user_suffix ());
1730 uidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_uid);
1731 gidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_gid);
1732 if (!dn || !uidstr || !gidstr) {
1733 d_fprintf(stderr, "Out of Memory!\n");
1734 goto failed;
1735 }
1736
1737 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_ACCOUNT);
1738 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXACCOUNT);
1739 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SAMBASAMACCOUNT);
1740 smbldap_set_mod(&mods, LDAP_MOD_ADD, "uid", pwd->pw_name);
1741 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", pwd->pw_name);
1742 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", pwd->pw_name);
1743 smbldap_set_mod(&mods, LDAP_MOD_ADD, "uidNumber", uidstr);
1744 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
1745 if ((pwd->pw_dir != NULL) && (pwd->pw_dir[0] != '\0')) {
1746 smbldap_set_mod(&mods, LDAP_MOD_ADD, "homeDirectory", pwd->pw_dir);
1747 }
1748 if ((pwd->pw_shell != NULL) && (pwd->pw_shell[0] != '\0')) {
1749 smbldap_set_mod(&mods, LDAP_MOD_ADD, "loginShell", pwd->pw_shell);
1750 }
1751 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSID",
1752 sid_string_talloc(tc, &sid));
1753 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaAcctFlags",
1754 pdb_encode_acct_ctrl(ACB_NORMAL|ACB_DISABLED,
1755 NEW_PW_FORMAT_SPACE_PADDED_LEN));
1756
1757 talloc_autofree_ldapmod(tc, mods);
1758
1759 rc = smbldap_add(ls, dn, mods);
1760
1761 if (rc != LDAP_SUCCESS) {
1762 d_fprintf(stderr, "Failed to add Guest user to ldap directory\n");
1763 }
1764 } else {
1765 d_printf("found!\n");
1766 }
1767
1768 d_printf("Checking Guest's group.\n");
1769
1770 pwd = getpwnam_alloc(talloc_autofree_context(), lp_guestaccount());
1771 if (!pwd) {
1772 d_fprintf(stderr, "Failed to find just created Guest account!\n"
1773 " Is nss properly configured?!\n");
1774 goto failed;
1775 }
1776
1777 if (pwd->pw_gid == domusers_gid) {
1778 d_printf("found!\n");
1779 goto done;
1780 }
1781
1782 if (!pdb_getgrgid(&gmap, pwd->pw_gid)) {
1783 LDAPMod **mods = NULL;
1784 char *dn;
1785 char *uname;
1786 char *wname;
1787 char *gidstr;
1788 char *gtype;
1789 int rc;
1790
1791 d_printf("Adding the Domain Guests group.\n");
1792
1793 uname = talloc_strdup(tc, "domguests");
1794 wname = talloc_strdup(tc, "Domain Guests");
1795 dn = talloc_asprintf(tc, "cn=%s,%s", "domguests", lp_ldap_group_suffix());
1796 gidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_gid);
1797 gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
1798
1799 if (!uname || !wname || !dn || !gidstr || !gtype) {
1800 d_fprintf(stderr, "Out of Memory!\n");
1801 goto failed;
1802 }
1803
1804 sid_compose(&gsid, get_global_sam_sid(), DOMAIN_GROUP_RID_GUESTS);
1805
1806 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXGROUP);
1807 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
1808 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", uname);
1809 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", wname);
1810 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
1811 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid",
1812 sid_string_talloc(tc, &gsid));
1813 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", gtype);
1814
1815 talloc_autofree_ldapmod(tc, mods);
1816
1817 rc = smbldap_add(ls, dn, mods);
1818
1819 if (rc != LDAP_SUCCESS) {
1820 d_fprintf(stderr, "Failed to add Domain Guests group to ldap directory\n");
1821 }
1822 } else {
1823 d_printf("found!\n");
1824 }
1825
1826
1827 done:
1828 talloc_free(tc);
1829 return 0;
1830
1831 failed:
1832 talloc_free(tc);
1833 return -1;
1834 }
1835
1836 #endif
1837
1838 /***********************************************************
1839 migrated functionality from smbgroupedit
1840 **********************************************************/
1841 int net_sam(struct net_context *c, int argc, const char **argv)
1842 {
1843 struct functable func[] = {
1844 {
1845 "createbuiltingroup",
1846 net_sam_createbuiltingroup,
1847 NET_TRANSPORT_LOCAL,
1848 "Create a new BUILTIN group",
1849 "net sam createbuiltingroup\n"
1850 " Create a new BUILTIN group"
1851 },
1852 {
1853 "createlocalgroup",
1854 net_sam_createlocalgroup,
1855 NET_TRANSPORT_LOCAL,
1856 "Create a new local group",
1857 "net sam createlocalgroup\n"
1858 " Create a new local group"
1859 },
1860 {
1861 "createdomaingroup",
1862 net_sam_createdomaingroup,
1863 NET_TRANSPORT_LOCAL,
1864 "Create a new group",
1865 "net sam createdomaingroup\n"
1866 " Create a new group"
1867 },
1868 {
1869 "deletelocalgroup",
1870 net_sam_deletelocalgroup,
1871 NET_TRANSPORT_LOCAL,
1872 "Delete an existing local group",
1873 "net sam deletelocalgroup\n"
1874 " Delete an existing local group"
1875 },
1876 {
1877 "mapunixgroup",
1878 net_sam_mapunixgroup,
1879 NET_TRANSPORT_LOCAL,
1880 "Map a unix group to a domain group",
1881 "net sam mapunixgroup\n"
1882 " Map a unix group to a domain group"
1883 },
1884 {
1885 "unmapunixgroup",
1886 net_sam_unmapunixgroup,
1887 NET_TRANSPORT_LOCAL,
1888 "Remove a group mapping of an unix group to a domain "
1889 "group",
1890 "net sam unmapunixgroup\n"
1891 " Remove a group mapping of an unix group to a "
1892 "domain group"
1893 },
1894 {
1895 "addmem",
1896 net_sam_addmem,
1897 NET_TRANSPORT_LOCAL,
1898 "Add a member to a group",
1899 "net sam addmem\n"
1900 " Add a member to a group"
1901 },
1902 {
1903 "delmem",
1904 net_sam_delmem,
1905 NET_TRANSPORT_LOCAL,
1906 "Delete a member from a group",
1907 "net sam delmem\n"
1908 " Delete a member from a group"
1909 },
1910 {
1911 "listmem",
1912 net_sam_listmem,
1913 NET_TRANSPORT_LOCAL,
1914 "List group members",
1915 "net sam listmem\n"
1916 " List group members"
1917 },
1918 {
1919 "list",
1920 net_sam_list,
1921 NET_TRANSPORT_LOCAL,
1922 "List users, groups and local groups",
1923 "net sam list\n"
1924 " List users, groups and local groups"
1925 },
1926 {
1927 "show",
1928 net_sam_show,
1929 NET_TRANSPORT_LOCAL,
1930 "Show details of a SAM entry",
1931 "net sam show\n"
1932 " Show details of a SAM entry"
1933 },
1934 {
1935 "set",
1936 net_sam_set,
1937 NET_TRANSPORT_LOCAL,
1938 "Set details of a SAM account",
1939 "net sam set\n"
1940 " Set details of a SAM account"
1941 },
1942 {
1943 "policy",
1944 net_sam_policy,
1945 NET_TRANSPORT_LOCAL,
1946 "Set account policies",
1947 "net sam policy\n"
1948 " Set account policies"
1949 },
1950 {
1951 "rights",
1952 net_sam_rights,
1953 NET_TRANSPORT_LOCAL,
1954 "Manipulate user privileges",
1955 "net sam rights\n"
1956 " Manipulate user privileges"
1957 },
1958 #ifdef HAVE_LDAP
1959 {
1960 "provision",
1961 net_sam_provision,
1962 NET_TRANSPORT_LOCAL,
1963 "Provision a clean user database",
1964 "net sam privison\n"
1965 " Provision a clear user database"
1966 },
1967 #endif
1968 {NULL, NULL, 0, NULL, NULL}
1969 };
1970
1971 if (getuid() != 0) {
1972 d_fprintf(stderr, "You are not root, most things won't "
1973 "work\n");
1974 }
1975
1976 return net_run_function(c, argc, argv, "net sam", func);
1977 }
1978
Samba GIT mirror