2 Samba Unix/Linux SMB client library
3 Distributed SMB/CIFS Server Management Utility
4 Copyright (C) 2001 Andrew Bartlett (abartlet@samba.org)
5 Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
6 Copyright (C) 2004,2008 Guenther Deschner (gd@samba.org)
7 Copyright (C) 2005 Jeremy Allison (jra@samba.org)
8 Copyright (C) 2006 Jelmer Vernooij (jelmer@samba.org)
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>. */
24 #include "utils/net.h"
25 #include "../libcli/auth/libcli_auth.h"
27 static int net_mode_share
;
28 static bool sync_files(struct copy_clistate
*cp_clistate
, const char *mask
,
29 const struct user_auth_info
*auth_info
);
34 * @brief RPC based subcommands for the 'net' utility.
36 * This file should contain much of the functionality that used to
37 * be found in rpcclient, execpt that the commands should change
38 * less often, and the fucntionality should be sane (the user is not
39 * expected to know a rid/sid before they conduct an operation etc.)
41 * @todo Perhaps eventually these should be split out into a number
42 * of files, as this could get quite big.
47 * Many of the RPC functions need the domain sid. This function gets
48 * it at the start of every run
50 * @param cli A cli_state already connected to the remote machine
52 * @return The Domain SID of the remote machine.
55 NTSTATUS
net_get_remote_domain_sid(struct cli_state
*cli
, TALLOC_CTX
*mem_ctx
,
57 const char **domain_name
)
59 struct rpc_pipe_client
*lsa_pipe
= NULL
;
60 struct policy_handle pol
;
61 NTSTATUS result
= NT_STATUS_OK
;
62 union lsa_PolicyInformation
*info
= NULL
;
64 result
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
66 if (!NT_STATUS_IS_OK(result
)) {
67 d_fprintf(stderr
, "Could not initialise lsa pipe\n");
71 result
= rpccli_lsa_open_policy(lsa_pipe
, mem_ctx
, false,
72 SEC_FLAG_MAXIMUM_ALLOWED
,
74 if (!NT_STATUS_IS_OK(result
)) {
75 d_fprintf(stderr
, "open_policy failed: %s\n",
80 result
= rpccli_lsa_QueryInfoPolicy(lsa_pipe
, mem_ctx
,
82 LSA_POLICY_INFO_ACCOUNT_DOMAIN
,
84 if (!NT_STATUS_IS_OK(result
)) {
85 d_fprintf(stderr
, "lsaquery failed: %s\n",
90 *domain_name
= info
->account_domain
.name
.string
;
91 *domain_sid
= info
->account_domain
.sid
;
93 rpccli_lsa_Close(lsa_pipe
, mem_ctx
, &pol
);
94 TALLOC_FREE(lsa_pipe
);
100 * Run a single RPC command, from start to finish.
102 * @param pipe_name the pipe to connect to (usually a PIPE_ constant)
103 * @param conn_flag a NET_FLAG_ combination. Passed to
104 * net_make_ipc_connection.
105 * @param argc Standard main() style argc.
106 * @param argv Standard main() style argv. Initial components are already
108 * @return A shell status integer (0 for success).
111 int run_rpc_command(struct net_context
*c
,
112 struct cli_state
*cli_arg
,
113 const struct ndr_syntax_id
*interface
,
119 struct cli_state
*cli
= NULL
;
120 struct rpc_pipe_client
*pipe_hnd
= NULL
;
124 const char *domain_name
;
126 struct user_auth_info
*ai
= c
->auth_info
;
128 /* make use of cli_state handed over as an argument, if possible */
130 nt_status
= net_make_ipc_connection(c
, conn_flags
, &cli
);
131 if (!NT_STATUS_IS_OK(nt_status
)) {
132 DEBUG(1, ("failed to make ipc connection: %s\n",
133 nt_errstr(nt_status
)));
146 if (!(mem_ctx
= talloc_init("run_rpc_command"))) {
147 DEBUG(0, ("talloc_init() failed\n"));
151 nt_status
= net_get_remote_domain_sid(cli
, mem_ctx
, &domain_sid
,
153 if (!NT_STATUS_IS_OK(nt_status
)) {
157 if (!(conn_flags
& NET_FLAGS_NO_PIPE
)) {
158 if (lp_client_schannel()
159 && (ndr_syntax_id_equal(interface
,
160 &ndr_table_netlogon
.syntax_id
))) {
161 /* Always try and create an schannel netlogon pipe. */
162 nt_status
= cli_rpc_pipe_open_schannel(
164 PIPE_AUTH_LEVEL_PRIVACY
, domain_name
,
166 if (!NT_STATUS_IS_OK(nt_status
)) {
167 DEBUG(0, ("Could not initialise schannel netlogon pipe. Error was %s\n",
168 nt_errstr(nt_status
) ));
172 if (conn_flags
& NET_FLAGS_SEAL
) {
173 nt_status
= cli_rpc_pipe_open_ntlmssp(
175 PIPE_AUTH_LEVEL_PRIVACY
,
177 get_cmdline_auth_info_username(ai
),
178 get_cmdline_auth_info_password(ai
),
181 nt_status
= cli_rpc_pipe_open_noauth(
185 if (!NT_STATUS_IS_OK(nt_status
)) {
186 DEBUG(0, ("Could not initialise pipe %s. Error was %s\n",
187 get_pipe_name_from_iface(interface
),
188 nt_errstr(nt_status
) ));
194 nt_status
= fn(c
, domain_sid
, domain_name
, cli
, pipe_hnd
, mem_ctx
, argc
, argv
);
196 if (!NT_STATUS_IS_OK(nt_status
)) {
197 DEBUG(1, ("rpc command function failed! (%s)\n", nt_errstr(nt_status
)));
200 DEBUG(5, ("rpc command function succedded\n"));
203 if (!(conn_flags
& NET_FLAGS_NO_PIPE
)) {
205 TALLOC_FREE(pipe_hnd
);
210 /* close the connection only if it was opened here */
215 talloc_destroy(mem_ctx
);
220 * Force a change of the trust acccount password.
222 * All parameters are provided by the run_rpc_command function, except for
223 * argc, argv which are passed through.
225 * @param domain_sid The domain sid acquired from the remote server.
226 * @param cli A cli_state connected to the server.
227 * @param mem_ctx Talloc context, destroyed on completion of the function.
228 * @param argc Standard main() style argc.
229 * @param argv Standard main() style argv. Initial components are already
232 * @return Normal NTSTATUS return.
235 static NTSTATUS
rpc_changetrustpw_internals(struct net_context
*c
,
236 const DOM_SID
*domain_sid
,
237 const char *domain_name
,
238 struct cli_state
*cli
,
239 struct rpc_pipe_client
*pipe_hnd
,
245 return trust_pw_find_change_and_store_it(pipe_hnd
, mem_ctx
, c
->opt_target_workgroup
);
249 * Force a change of the trust acccount password.
251 * @param argc Standard main() style argc.
252 * @param argv Standard main() style argv. Initial components are already
255 * @return A shell status integer (0 for success).
258 int net_rpc_changetrustpw(struct net_context
*c
, int argc
, const char **argv
)
260 if (c
->display_usage
) {
262 "net rpc changetrustpw\n"
263 " Change the machine trust password\n");
267 return run_rpc_command(c
, NULL
, &ndr_table_netlogon
.syntax_id
,
268 NET_FLAGS_ANONYMOUS
| NET_FLAGS_PDC
,
269 rpc_changetrustpw_internals
,
274 * Join a domain, the old way.
276 * This uses 'machinename' as the inital password, and changes it.
278 * The password should be created with 'server manager' or equiv first.
280 * All parameters are provided by the run_rpc_command function, except for
281 * argc, argv which are passed through.
283 * @param domain_sid The domain sid acquired from the remote server.
284 * @param cli A cli_state connected to the server.
285 * @param mem_ctx Talloc context, destroyed on completion of the function.
286 * @param argc Standard main() style argc.
287 * @param argv Standard main() style argv. Initial components are already
290 * @return Normal NTSTATUS return.
293 static NTSTATUS
rpc_oldjoin_internals(struct net_context
*c
,
294 const DOM_SID
*domain_sid
,
295 const char *domain_name
,
296 struct cli_state
*cli
,
297 struct rpc_pipe_client
*pipe_hnd
,
303 fstring trust_passwd
;
304 unsigned char orig_trust_passwd_hash
[16];
306 uint32 sec_channel_type
;
308 result
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_netlogon
.syntax_id
,
310 if (!NT_STATUS_IS_OK(result
)) {
311 DEBUG(0,("rpc_oldjoin_internals: netlogon pipe open to machine %s failed. "
314 nt_errstr(result
) ));
319 check what type of join - if the user want's to join as
320 a BDC, the server must agree that we are a BDC.
323 sec_channel_type
= get_sec_channel_type(argv
[0]);
325 sec_channel_type
= get_sec_channel_type(NULL
);
328 fstrcpy(trust_passwd
, global_myname());
329 strlower_m(trust_passwd
);
332 * Machine names can be 15 characters, but the max length on
333 * a password is 14. --jerry
336 trust_passwd
[14] = '\0';
338 E_md4hash(trust_passwd
, orig_trust_passwd_hash
);
340 result
= trust_pw_change_and_store_it(pipe_hnd
, mem_ctx
, c
->opt_target_workgroup
,
341 orig_trust_passwd_hash
,
344 if (NT_STATUS_IS_OK(result
))
345 printf("Joined domain %s.\n", c
->opt_target_workgroup
);
348 if (!secrets_store_domain_sid(c
->opt_target_workgroup
, domain_sid
)) {
349 DEBUG(0, ("error storing domain sid for %s\n", c
->opt_target_workgroup
));
350 result
= NT_STATUS_UNSUCCESSFUL
;
357 * Join a domain, the old way.
359 * @param argc Standard main() style argc.
360 * @param argv Standard main() style argv. Initial components are already
363 * @return A shell status integer (0 for success).
366 static int net_rpc_perform_oldjoin(struct net_context
*c
, int argc
, const char **argv
)
368 return run_rpc_command(c
, NULL
, &ndr_table_netlogon
.syntax_id
,
369 NET_FLAGS_NO_PIPE
| NET_FLAGS_ANONYMOUS
| NET_FLAGS_PDC
,
370 rpc_oldjoin_internals
,
375 * Join a domain, the old way. This function exists to allow
376 * the message to be displayed when oldjoin was explicitly
377 * requested, but not when it was implied by "net rpc join".
379 * @param argc Standard main() style argc.
380 * @param argv Standard main() style argv. Initial components are already
383 * @return A shell status integer (0 for success).
386 static int net_rpc_oldjoin(struct net_context
*c
, int argc
, const char **argv
)
390 if (c
->display_usage
) {
393 " Join a domain the old way\n");
397 rc
= net_rpc_perform_oldjoin(c
, argc
, argv
);
400 d_fprintf(stderr
, "Failed to join domain\n");
407 * 'net rpc join' entrypoint.
408 * @param argc Standard main() style argc.
409 * @param argv Standard main() style argv. Initial components are already
412 * Main 'net_rpc_join()' (where the admin username/password is used) is
414 * Try to just change the password, but if that doesn't work, use/prompt
415 * for a username/password.
418 int net_rpc_join(struct net_context
*c
, int argc
, const char **argv
)
420 if (c
->display_usage
) {
422 "net rpc join -U <username>[%%password] <type>\n"
424 " username\tName of the admin user"
425 " password\tPassword of the admin user, will "
426 "prompt if not specified\n"
427 " type\tCan be one of the following:\n"
428 "\t\tMEMBER\tJoin as member server (default)\n"
429 "\t\tBDC\tJoin as BDC\n"
430 "\t\tPDC\tJoin as PDC\n");
434 if (lp_server_role() == ROLE_STANDALONE
) {
435 d_printf("cannot join as standalone machine\n");
439 if (strlen(global_myname()) > 15) {
440 d_printf("Our netbios name can be at most 15 chars long, "
441 "\"%s\" is %u chars long\n",
442 global_myname(), (unsigned int)strlen(global_myname()));
446 if ((net_rpc_perform_oldjoin(c
, argc
, argv
) == 0))
449 return net_rpc_join_newstyle(c
, argc
, argv
);
453 * display info about a rpc domain
455 * All parameters are provided by the run_rpc_command function, except for
456 * argc, argv which are passed through.
458 * @param domain_sid The domain sid acquired from the remote server
459 * @param cli A cli_state connected to the server.
460 * @param mem_ctx Talloc context, destroyed on completion of the function.
461 * @param argc Standard main() style argc.
462 * @param argv Standard main() style argv. Initial components are already
465 * @return Normal NTSTATUS return.
468 NTSTATUS
rpc_info_internals(struct net_context
*c
,
469 const DOM_SID
*domain_sid
,
470 const char *domain_name
,
471 struct cli_state
*cli
,
472 struct rpc_pipe_client
*pipe_hnd
,
477 struct policy_handle connect_pol
, domain_pol
;
478 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
479 union samr_DomainInfo
*info
= NULL
;
482 sid_to_fstring(sid_str
, domain_sid
);
484 /* Get sam policy handle */
485 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
487 MAXIMUM_ALLOWED_ACCESS
,
489 if (!NT_STATUS_IS_OK(result
)) {
490 d_fprintf(stderr
, "Could not connect to SAM: %s\n", nt_errstr(result
));
494 /* Get domain policy handle */
495 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
497 MAXIMUM_ALLOWED_ACCESS
,
498 CONST_DISCARD(struct dom_sid2
*, domain_sid
),
500 if (!NT_STATUS_IS_OK(result
)) {
501 d_fprintf(stderr
, "Could not open domain: %s\n", nt_errstr(result
));
505 result
= rpccli_samr_QueryDomainInfo(pipe_hnd
, mem_ctx
,
509 if (NT_STATUS_IS_OK(result
)) {
510 d_printf("Domain Name: %s\n", info
->general
.domain_name
.string
);
511 d_printf("Domain SID: %s\n", sid_str
);
512 d_printf("Sequence number: %llu\n",
513 (unsigned long long)info
->general
.sequence_num
);
514 d_printf("Num users: %u\n", info
->general
.num_users
);
515 d_printf("Num domain groups: %u\n", info
->general
.num_groups
);
516 d_printf("Num local groups: %u\n", info
->general
.num_aliases
);
524 * 'net rpc info' entrypoint.
525 * @param argc Standard main() style argc.
526 * @param argv Standard main() style argv. Initial components are already
530 int net_rpc_info(struct net_context
*c
, int argc
, const char **argv
)
532 if (c
->display_usage
) {
535 " Display information about the domain\n");
539 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
,
540 NET_FLAGS_PDC
, rpc_info_internals
,
545 * Fetch domain SID into the local secrets.tdb.
547 * All parameters are provided by the run_rpc_command function, except for
548 * argc, argv which are passed through.
550 * @param domain_sid The domain sid acquired from the remote server.
551 * @param cli A cli_state connected to the server.
552 * @param mem_ctx Talloc context, destroyed on completion of the function.
553 * @param argc Standard main() style argc.
554 * @param argv Standard main() style argv. Initial components are already
557 * @return Normal NTSTATUS return.
560 static NTSTATUS
rpc_getsid_internals(struct net_context
*c
,
561 const DOM_SID
*domain_sid
,
562 const char *domain_name
,
563 struct cli_state
*cli
,
564 struct rpc_pipe_client
*pipe_hnd
,
571 sid_to_fstring(sid_str
, domain_sid
);
572 d_printf("Storing SID %s for Domain %s in secrets.tdb\n",
573 sid_str
, domain_name
);
575 if (!secrets_store_domain_sid(domain_name
, domain_sid
)) {
576 DEBUG(0,("Can't store domain SID\n"));
577 return NT_STATUS_UNSUCCESSFUL
;
584 * 'net rpc getsid' entrypoint.
585 * @param argc Standard main() style argc.
586 * @param argv Standard main() style argv. Initial components are already
590 int net_rpc_getsid(struct net_context
*c
, int argc
, const char **argv
)
592 if (c
->display_usage
) {
595 " Fetch domain SID into local secrets.tdb\n");
599 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
,
600 NET_FLAGS_ANONYMOUS
| NET_FLAGS_PDC
,
601 rpc_getsid_internals
,
605 /****************************************************************************/
608 * Basic usage function for 'net rpc user'.
609 * @param argc Standard main() style argc.
610 * @param argv Standard main() style argv. Initial components are already
614 static int rpc_user_usage(struct net_context
*c
, int argc
, const char **argv
)
616 return net_user_usage(c
, argc
, argv
);
620 * Add a new user to a remote RPC server.
622 * @param argc Standard main() style argc.
623 * @param argv Standard main() style argv. Initial components are already
626 * @return A shell status integer (0 for success).
629 static int rpc_user_add(struct net_context
*c
, int argc
, const char **argv
)
631 NET_API_STATUS status
;
632 struct USER_INFO_1 info1
;
633 uint32_t parm_error
= 0;
635 if (argc
< 1 || c
->display_usage
) {
636 rpc_user_usage(c
, argc
, argv
);
642 info1
.usri1_name
= argv
[0];
644 info1
.usri1_password
= argv
[1];
647 status
= NetUserAdd(c
->opt_host
, 1, (uint8_t *)&info1
, &parm_error
);
650 d_fprintf(stderr
, "Failed to add user '%s' with: %s.\n",
651 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
655 d_printf("Added user '%s'.\n", argv
[0]);
662 * Rename a user on a remote RPC server.
664 * @param argc Standard main() style argc.
665 * @param argv Standard main() style argv. Initial components are already
668 * @return A shell status integer (0 for success).
671 static int rpc_user_rename(struct net_context
*c
, int argc
, const char **argv
)
673 NET_API_STATUS status
;
674 struct USER_INFO_0 u0
;
675 uint32_t parm_err
= 0;
677 if (argc
!= 2 || c
->display_usage
) {
678 rpc_user_usage(c
, argc
, argv
);
682 u0
.usri0_name
= argv
[1];
684 status
= NetUserSetInfo(c
->opt_host
, argv
[0],
685 0, (uint8_t *)&u0
, &parm_err
);
687 d_fprintf(stderr
, "Failed to rename user from %s to %s - %s\n",
689 libnetapi_get_error_string(c
->netapi_ctx
, status
));
691 d_printf("Renamed user from %s to %s\n", argv
[0], argv
[1]);
698 * Delete a user from a remote RPC server.
700 * @param argc Standard main() style argc.
701 * @param argv Standard main() style argv. Initial components are already
704 * @return A shell status integer (0 for success).
707 static int rpc_user_delete(struct net_context
*c
, int argc
, const char **argv
)
709 NET_API_STATUS status
;
711 if (argc
< 1 || c
->display_usage
) {
712 rpc_user_usage(c
, argc
, argv
);
716 status
= NetUserDel(c
->opt_host
, argv
[0]);
719 d_fprintf(stderr
, "Failed to delete user '%s' with: %s.\n",
721 libnetapi_get_error_string(c
->netapi_ctx
, status
));
724 d_printf("Deleted user '%s'.\n", argv
[0]);
731 * Set a user's password on a remote RPC server.
733 * @param argc Standard main() style argc.
734 * @param argv Standard main() style argv. Initial components are already
737 * @return A shell status integer (0 for success).
740 static int rpc_user_password(struct net_context
*c
, int argc
, const char **argv
)
742 NET_API_STATUS status
;
744 struct USER_INFO_1003 u1003
;
745 uint32_t parm_err
= 0;
747 if (argc
< 1 || c
->display_usage
) {
748 rpc_user_usage(c
, argc
, argv
);
753 u1003
.usri1003_password
= argv
[1];
755 if (asprintf(&prompt
, "Enter new password for %s:", argv
[0]) == -1) {
758 u1003
.usri1003_password
= getpass(prompt
);
762 status
= NetUserSetInfo(c
->opt_host
, argv
[0], 1003, (uint8_t *)&u1003
, &parm_err
);
764 /* Display results */
766 d_fprintf(stderr
, "Failed to set password for '%s' with: %s.\n",
767 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
776 * List a user's groups from a remote RPC server.
778 * @param argc Standard main() style argc.
779 * @param argv Standard main() style argv. Initial components are already
782 * @return A shell status integer (0 for success)
785 static int rpc_user_info(struct net_context
*c
, int argc
, const char **argv
)
788 NET_API_STATUS status
;
789 struct GROUP_USERS_INFO_0
*u0
= NULL
;
790 uint32_t entries_read
= 0;
791 uint32_t total_entries
= 0;
795 if (argc
< 1 || c
->display_usage
) {
796 rpc_user_usage(c
, argc
, argv
);
800 status
= NetUserGetGroups(c
->opt_host
,
803 (uint8_t **)(void *)&u0
,
808 d_fprintf(stderr
, "Failed to get groups for '%s' with: %s.\n",
809 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
814 for (i
=0; i
< entries_read
; i
++) {
815 printf("%s\n", u0
->grui0_name
);
823 * List users on a remote RPC server.
825 * All parameters are provided by the run_rpc_command function, except for
826 * argc, argv which are passed through.
828 * @param domain_sid The domain sid acquired from the remote server.
829 * @param cli A cli_state connected to the server.
830 * @param mem_ctx Talloc context, destroyed on completion of the function.
831 * @param argc Standard main() style argc.
832 * @param argv Standard main() style argv. Initial components are already
835 * @return Normal NTSTATUS return.
838 static int rpc_user_list(struct net_context
*c
, int argc
, const char **argv
)
840 NET_API_STATUS status
;
841 uint32_t start_idx
=0, num_entries
, i
, loop_count
= 0;
842 struct NET_DISPLAY_USER
*info
= NULL
;
845 /* Query domain users */
846 if (c
->opt_long_list_entries
)
847 d_printf("\nUser name Comment"
848 "\n-----------------------------\n");
850 uint32_t max_entries
, max_size
;
852 get_query_dispinfo_params(
853 loop_count
, &max_entries
, &max_size
);
855 status
= NetQueryDisplayInformation(c
->opt_host
,
862 if (status
!= 0 && status
!= ERROR_MORE_DATA
) {
866 info
= (struct NET_DISPLAY_USER
*)buffer
;
868 for (i
= 0; i
< num_entries
; i
++) {
870 if (c
->opt_long_list_entries
)
871 printf("%-21.21s %s\n", info
->usri1_name
,
872 info
->usri1_comment
);
874 printf("%s\n", info
->usri1_name
);
878 NetApiBufferFree(buffer
);
881 start_idx
+= num_entries
;
883 } while (status
== ERROR_MORE_DATA
);
889 * 'net rpc user' entrypoint.
890 * @param argc Standard main() style argc.
891 * @param argv Standard main() style argv. Initial components are already
895 int net_rpc_user(struct net_context
*c
, int argc
, const char **argv
)
897 NET_API_STATUS status
;
899 struct functable func
[] = {
904 "Add specified user",
906 " Add specified user"
912 "List domain groups of user",
913 "net rpc user info\n"
914 " Lis domain groups of user"
920 "Remove specified user",
921 "net rpc user delete\n"
922 " Remove specified user"
928 "Change user password",
929 "net rpc user password\n"
930 " Change user password"
936 "Rename specified user",
937 "net rpc user rename\n"
938 " Rename specified user"
940 {NULL
, NULL
, 0, NULL
, NULL
}
943 status
= libnetapi_init(&c
->netapi_ctx
);
947 set_cmdline_auth_info_getpass(c
->auth_info
);
948 libnetapi_set_username(c
->netapi_ctx
,
949 get_cmdline_auth_info_username(c
->auth_info
));
950 libnetapi_set_password(c
->netapi_ctx
,
951 get_cmdline_auth_info_password(c
->auth_info
));
952 if (get_cmdline_auth_info_use_kerberos(c
->auth_info
)) {
953 libnetapi_set_use_kerberos(c
->netapi_ctx
);
957 if (c
->display_usage
) {
958 d_printf("Usage:\n");
959 d_printf("net rpc user\n"
960 " List all users\n");
961 net_display_usage_from_functable(func
);
965 return rpc_user_list(c
, argc
, argv
);
968 return net_run_function(c
, argc
, argv
, "net rpc user", func
);
971 static NTSTATUS
rpc_sh_user_list(struct net_context
*c
,
973 struct rpc_sh_ctx
*ctx
,
974 struct rpc_pipe_client
*pipe_hnd
,
975 int argc
, const char **argv
)
977 return werror_to_ntstatus(W_ERROR(rpc_user_list(c
, argc
, argv
)));
980 static NTSTATUS
rpc_sh_user_info(struct net_context
*c
,
982 struct rpc_sh_ctx
*ctx
,
983 struct rpc_pipe_client
*pipe_hnd
,
984 int argc
, const char **argv
)
986 return werror_to_ntstatus(W_ERROR(rpc_user_info(c
, argc
, argv
)));
989 static NTSTATUS
rpc_sh_handle_user(struct net_context
*c
,
991 struct rpc_sh_ctx
*ctx
,
992 struct rpc_pipe_client
*pipe_hnd
,
993 int argc
, const char **argv
,
995 struct net_context
*c
,
997 struct rpc_sh_ctx
*ctx
,
998 struct rpc_pipe_client
*pipe_hnd
,
999 struct policy_handle
*user_hnd
,
1000 int argc
, const char **argv
))
1002 struct policy_handle connect_pol
, domain_pol
, user_pol
;
1003 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
1006 enum lsa_SidType type
;
1009 d_fprintf(stderr
, "usage: %s <username>\n", ctx
->whoami
);
1010 return NT_STATUS_INVALID_PARAMETER
;
1013 ZERO_STRUCT(connect_pol
);
1014 ZERO_STRUCT(domain_pol
);
1015 ZERO_STRUCT(user_pol
);
1017 result
= net_rpc_lookup_name(c
, mem_ctx
, rpc_pipe_np_smb_conn(pipe_hnd
),
1018 argv
[0], NULL
, NULL
, &sid
, &type
);
1019 if (!NT_STATUS_IS_OK(result
)) {
1020 d_fprintf(stderr
, "Could not lookup %s: %s\n", argv
[0],
1025 if (type
!= SID_NAME_USER
) {
1026 d_fprintf(stderr
, "%s is a %s, not a user\n", argv
[0],
1027 sid_type_lookup(type
));
1028 result
= NT_STATUS_NO_SUCH_USER
;
1032 if (!sid_peek_check_rid(ctx
->domain_sid
, &sid
, &rid
)) {
1033 d_fprintf(stderr
, "%s is not in our domain\n", argv
[0]);
1034 result
= NT_STATUS_NO_SUCH_USER
;
1038 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
1040 MAXIMUM_ALLOWED_ACCESS
,
1042 if (!NT_STATUS_IS_OK(result
)) {
1046 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
1048 MAXIMUM_ALLOWED_ACCESS
,
1051 if (!NT_STATUS_IS_OK(result
)) {
1055 result
= rpccli_samr_OpenUser(pipe_hnd
, mem_ctx
,
1057 MAXIMUM_ALLOWED_ACCESS
,
1060 if (!NT_STATUS_IS_OK(result
)) {
1064 result
= fn(c
, mem_ctx
, ctx
, pipe_hnd
, &user_pol
, argc
-1, argv
+1);
1067 if (is_valid_policy_hnd(&user_pol
)) {
1068 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &user_pol
);
1070 if (is_valid_policy_hnd(&domain_pol
)) {
1071 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &domain_pol
);
1073 if (is_valid_policy_hnd(&connect_pol
)) {
1074 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &connect_pol
);
1079 static NTSTATUS
rpc_sh_user_show_internals(struct net_context
*c
,
1080 TALLOC_CTX
*mem_ctx
,
1081 struct rpc_sh_ctx
*ctx
,
1082 struct rpc_pipe_client
*pipe_hnd
,
1083 struct policy_handle
*user_hnd
,
1084 int argc
, const char **argv
)
1087 union samr_UserInfo
*info
= NULL
;
1090 d_fprintf(stderr
, "usage: %s show <username>\n", ctx
->whoami
);
1091 return NT_STATUS_INVALID_PARAMETER
;
1094 result
= rpccli_samr_QueryUserInfo(pipe_hnd
, mem_ctx
,
1098 if (!NT_STATUS_IS_OK(result
)) {
1102 d_printf("user rid: %d, group rid: %d\n",
1104 info
->info21
.primary_gid
);
1109 static NTSTATUS
rpc_sh_user_show(struct net_context
*c
,
1110 TALLOC_CTX
*mem_ctx
,
1111 struct rpc_sh_ctx
*ctx
,
1112 struct rpc_pipe_client
*pipe_hnd
,
1113 int argc
, const char **argv
)
1115 return rpc_sh_handle_user(c
, mem_ctx
, ctx
, pipe_hnd
, argc
, argv
,
1116 rpc_sh_user_show_internals
);
1119 #define FETCHSTR(name, rec) \
1120 do { if (strequal(ctx->thiscmd, name)) { \
1121 oldval = talloc_strdup(mem_ctx, info->info21.rec.string); } \
1124 #define SETSTR(name, rec, flag) \
1125 do { if (strequal(ctx->thiscmd, name)) { \
1126 init_lsa_String(&(info->info21.rec), argv[0]); \
1127 info->info21.fields_present |= SAMR_FIELD_##flag; } \
1130 static NTSTATUS
rpc_sh_user_str_edit_internals(struct net_context
*c
,
1131 TALLOC_CTX
*mem_ctx
,
1132 struct rpc_sh_ctx
*ctx
,
1133 struct rpc_pipe_client
*pipe_hnd
,
1134 struct policy_handle
*user_hnd
,
1135 int argc
, const char **argv
)
1138 const char *username
;
1139 const char *oldval
= "";
1140 union samr_UserInfo
*info
= NULL
;
1143 d_fprintf(stderr
, "usage: %s <username> [new value|NULL]\n",
1145 return NT_STATUS_INVALID_PARAMETER
;
1148 result
= rpccli_samr_QueryUserInfo(pipe_hnd
, mem_ctx
,
1152 if (!NT_STATUS_IS_OK(result
)) {
1156 username
= talloc_strdup(mem_ctx
, info
->info21
.account_name
.string
);
1158 FETCHSTR("fullname", full_name
);
1159 FETCHSTR("homedir", home_directory
);
1160 FETCHSTR("homedrive", home_drive
);
1161 FETCHSTR("logonscript", logon_script
);
1162 FETCHSTR("profilepath", profile_path
);
1163 FETCHSTR("description", description
);
1166 d_printf("%s's %s: [%s]\n", username
, ctx
->thiscmd
, oldval
);
1170 if (strcmp(argv
[0], "NULL") == 0) {
1174 ZERO_STRUCT(info
->info21
);
1176 SETSTR("fullname", full_name
, FULL_NAME
);
1177 SETSTR("homedir", home_directory
, HOME_DIRECTORY
);
1178 SETSTR("homedrive", home_drive
, HOME_DRIVE
);
1179 SETSTR("logonscript", logon_script
, LOGON_SCRIPT
);
1180 SETSTR("profilepath", profile_path
, PROFILE_PATH
);
1181 SETSTR("description", description
, DESCRIPTION
);
1183 result
= rpccli_samr_SetUserInfo(pipe_hnd
, mem_ctx
,
1188 d_printf("Set %s's %s from [%s] to [%s]\n", username
,
1189 ctx
->thiscmd
, oldval
, argv
[0]);
1196 #define HANDLEFLG(name, rec) \
1197 do { if (strequal(ctx->thiscmd, name)) { \
1198 oldval = (oldflags & ACB_##rec) ? "yes" : "no"; \
1200 newflags = oldflags | ACB_##rec; \
1202 newflags = oldflags & ~ACB_##rec; \
1205 static NTSTATUS
rpc_sh_user_str_edit(struct net_context
*c
,
1206 TALLOC_CTX
*mem_ctx
,
1207 struct rpc_sh_ctx
*ctx
,
1208 struct rpc_pipe_client
*pipe_hnd
,
1209 int argc
, const char **argv
)
1211 return rpc_sh_handle_user(c
, mem_ctx
, ctx
, pipe_hnd
, argc
, argv
,
1212 rpc_sh_user_str_edit_internals
);
1215 static NTSTATUS
rpc_sh_user_flag_edit_internals(struct net_context
*c
,
1216 TALLOC_CTX
*mem_ctx
,
1217 struct rpc_sh_ctx
*ctx
,
1218 struct rpc_pipe_client
*pipe_hnd
,
1219 struct policy_handle
*user_hnd
,
1220 int argc
, const char **argv
)
1223 const char *username
;
1224 const char *oldval
= "unknown";
1225 uint32 oldflags
, newflags
;
1227 union samr_UserInfo
*info
= NULL
;
1230 ((argc
== 1) && !strequal(argv
[0], "yes") &&
1231 !strequal(argv
[0], "no"))) {
1232 d_fprintf(stderr
, "usage: %s <username> [yes|no]\n",
1234 return NT_STATUS_INVALID_PARAMETER
;
1237 newval
= strequal(argv
[0], "yes");
1239 result
= rpccli_samr_QueryUserInfo(pipe_hnd
, mem_ctx
,
1243 if (!NT_STATUS_IS_OK(result
)) {
1247 username
= talloc_strdup(mem_ctx
, info
->info21
.account_name
.string
);
1248 oldflags
= info
->info21
.acct_flags
;
1249 newflags
= info
->info21
.acct_flags
;
1251 HANDLEFLG("disabled", DISABLED
);
1252 HANDLEFLG("pwnotreq", PWNOTREQ
);
1253 HANDLEFLG("autolock", AUTOLOCK
);
1254 HANDLEFLG("pwnoexp", PWNOEXP
);
1257 d_printf("%s's %s flag: %s\n", username
, ctx
->thiscmd
, oldval
);
1261 ZERO_STRUCT(info
->info21
);
1263 info
->info21
.acct_flags
= newflags
;
1264 info
->info21
.fields_present
= SAMR_FIELD_ACCT_FLAGS
;
1266 result
= rpccli_samr_SetUserInfo(pipe_hnd
, mem_ctx
,
1271 if (NT_STATUS_IS_OK(result
)) {
1272 d_printf("Set %s's %s flag from [%s] to [%s]\n", username
,
1273 ctx
->thiscmd
, oldval
, argv
[0]);
1281 static NTSTATUS
rpc_sh_user_flag_edit(struct net_context
*c
,
1282 TALLOC_CTX
*mem_ctx
,
1283 struct rpc_sh_ctx
*ctx
,
1284 struct rpc_pipe_client
*pipe_hnd
,
1285 int argc
, const char **argv
)
1287 return rpc_sh_handle_user(c
, mem_ctx
, ctx
, pipe_hnd
, argc
, argv
,
1288 rpc_sh_user_flag_edit_internals
);
1291 struct rpc_sh_cmd
*net_rpc_user_edit_cmds(struct net_context
*c
,
1292 TALLOC_CTX
*mem_ctx
,
1293 struct rpc_sh_ctx
*ctx
)
1295 static struct rpc_sh_cmd cmds
[] = {
1297 { "fullname", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_str_edit
,
1298 "Show/Set a user's full name" },
1300 { "homedir", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_str_edit
,
1301 "Show/Set a user's home directory" },
1303 { "homedrive", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_str_edit
,
1304 "Show/Set a user's home drive" },
1306 { "logonscript", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_str_edit
,
1307 "Show/Set a user's logon script" },
1309 { "profilepath", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_str_edit
,
1310 "Show/Set a user's profile path" },
1312 { "description", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_str_edit
,
1313 "Show/Set a user's description" },
1315 { "disabled", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_flag_edit
,
1316 "Show/Set whether a user is disabled" },
1318 { "autolock", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_flag_edit
,
1319 "Show/Set whether a user locked out" },
1321 { "pwnotreq", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_flag_edit
,
1322 "Show/Set whether a user does not need a password" },
1324 { "pwnoexp", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_flag_edit
,
1325 "Show/Set whether a user's password does not expire" },
1327 { NULL
, NULL
, 0, NULL
, NULL
}
1333 struct rpc_sh_cmd
*net_rpc_user_cmds(struct net_context
*c
,
1334 TALLOC_CTX
*mem_ctx
,
1335 struct rpc_sh_ctx
*ctx
)
1337 static struct rpc_sh_cmd cmds
[] = {
1339 { "list", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_list
,
1340 "List available users" },
1342 { "info", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_info
,
1343 "List the domain groups a user is member of" },
1345 { "show", NULL
, &ndr_table_samr
.syntax_id
, rpc_sh_user_show
,
1346 "Show info about a user" },
1348 { "edit", net_rpc_user_edit_cmds
, 0, NULL
,
1349 "Show/Modify a user's fields" },
1351 { NULL
, NULL
, 0, NULL
, NULL
}
1357 /****************************************************************************/
1360 * Basic usage function for 'net rpc group'.
1361 * @param argc Standard main() style argc.
1362 * @param argv Standard main() style argv. Initial components are already
1366 static int rpc_group_usage(struct net_context
*c
, int argc
, const char **argv
)
1368 return net_group_usage(c
, argc
, argv
);
1372 * Delete group on a remote RPC server.
1374 * All parameters are provided by the run_rpc_command function, except for
1375 * argc, argv which are passed through.
1377 * @param domain_sid The domain sid acquired from the remote server.
1378 * @param cli A cli_state connected to the server.
1379 * @param mem_ctx Talloc context, destroyed on completion of the function.
1380 * @param argc Standard main() style argc.
1381 * @param argv Standard main() style argv. Initial components are already
1384 * @return Normal NTSTATUS return.
1387 static NTSTATUS
rpc_group_delete_internals(struct net_context
*c
,
1388 const DOM_SID
*domain_sid
,
1389 const char *domain_name
,
1390 struct cli_state
*cli
,
1391 struct rpc_pipe_client
*pipe_hnd
,
1392 TALLOC_CTX
*mem_ctx
,
1396 struct policy_handle connect_pol
, domain_pol
, group_pol
, user_pol
;
1397 bool group_is_primary
= false;
1398 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
1400 struct samr_RidTypeArray
*rids
= NULL
;
1403 /* struct samr_RidWithAttribute *user_gids; */
1405 struct samr_Ids group_rids
, name_types
;
1406 struct lsa_String lsa_acct_name
;
1407 union samr_UserInfo
*info
= NULL
;
1409 if (argc
< 1 || c
->display_usage
) {
1410 rpc_group_usage(c
, argc
,argv
);
1411 return NT_STATUS_OK
; /* ok? */
1414 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
1416 MAXIMUM_ALLOWED_ACCESS
,
1419 if (!NT_STATUS_IS_OK(result
)) {
1420 d_fprintf(stderr
, "Request samr_Connect2 failed\n");
1424 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
1426 MAXIMUM_ALLOWED_ACCESS
,
1427 CONST_DISCARD(struct dom_sid2
*, domain_sid
),
1430 if (!NT_STATUS_IS_OK(result
)) {
1431 d_fprintf(stderr
, "Request open_domain failed\n");
1435 init_lsa_String(&lsa_acct_name
, argv
[0]);
1437 result
= rpccli_samr_LookupNames(pipe_hnd
, mem_ctx
,
1443 if (!NT_STATUS_IS_OK(result
)) {
1444 d_fprintf(stderr
, "Lookup of '%s' failed\n",argv
[0]);
1448 switch (name_types
.ids
[0])
1450 case SID_NAME_DOM_GRP
:
1451 result
= rpccli_samr_OpenGroup(pipe_hnd
, mem_ctx
,
1453 MAXIMUM_ALLOWED_ACCESS
,
1456 if (!NT_STATUS_IS_OK(result
)) {
1457 d_fprintf(stderr
, "Request open_group failed");
1461 group_rid
= group_rids
.ids
[0];
1463 result
= rpccli_samr_QueryGroupMember(pipe_hnd
, mem_ctx
,
1467 if (!NT_STATUS_IS_OK(result
)) {
1468 d_fprintf(stderr
, "Unable to query group members of %s",argv
[0]);
1472 if (c
->opt_verbose
) {
1473 d_printf("Domain Group %s (rid: %d) has %d members\n",
1474 argv
[0],group_rid
, rids
->count
);
1477 /* Check if group is anyone's primary group */
1478 for (i
= 0; i
< rids
->count
; i
++)
1480 result
= rpccli_samr_OpenUser(pipe_hnd
, mem_ctx
,
1482 MAXIMUM_ALLOWED_ACCESS
,
1486 if (!NT_STATUS_IS_OK(result
)) {
1487 d_fprintf(stderr
, "Unable to open group member %d\n",
1492 result
= rpccli_samr_QueryUserInfo(pipe_hnd
, mem_ctx
,
1497 if (!NT_STATUS_IS_OK(result
)) {
1498 d_fprintf(stderr
, "Unable to lookup userinfo for group member %d\n",
1503 if (info
->info21
.primary_gid
== group_rid
) {
1504 if (c
->opt_verbose
) {
1505 d_printf("Group is primary group of %s\n",
1506 info
->info21
.account_name
.string
);
1508 group_is_primary
= true;
1511 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &user_pol
);
1514 if (group_is_primary
) {
1515 d_fprintf(stderr
, "Unable to delete group because some "
1516 "of it's members have it as primary group\n");
1517 result
= NT_STATUS_MEMBERS_PRIMARY_GROUP
;
1521 /* remove all group members */
1522 for (i
= 0; i
< rids
->count
; i
++)
1525 d_printf("Remove group member %d...",
1527 result
= rpccli_samr_DeleteGroupMember(pipe_hnd
, mem_ctx
,
1531 if (NT_STATUS_IS_OK(result
)) {
1536 d_printf("failed\n");
1541 result
= rpccli_samr_DeleteDomainGroup(pipe_hnd
, mem_ctx
,
1545 /* removing a local group is easier... */
1546 case SID_NAME_ALIAS
:
1547 result
= rpccli_samr_OpenAlias(pipe_hnd
, mem_ctx
,
1549 MAXIMUM_ALLOWED_ACCESS
,
1553 if (!NT_STATUS_IS_OK(result
)) {
1554 d_fprintf(stderr
, "Request open_alias failed\n");
1558 result
= rpccli_samr_DeleteDomAlias(pipe_hnd
, mem_ctx
,
1562 d_fprintf(stderr
, "%s is of type %s. This command is only for deleting local or global groups\n",
1563 argv
[0],sid_type_lookup(name_types
.ids
[0]));
1564 result
= NT_STATUS_UNSUCCESSFUL
;
1568 if (NT_STATUS_IS_OK(result
)) {
1570 d_printf("Deleted %s '%s'\n",sid_type_lookup(name_types
.ids
[0]),argv
[0]);
1572 d_fprintf(stderr
, "Deleting of %s failed: %s\n",argv
[0],
1573 get_friendly_nt_error_msg(result
));
1581 static int rpc_group_delete(struct net_context
*c
, int argc
, const char **argv
)
1583 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
, 0,
1584 rpc_group_delete_internals
, argc
,argv
);
1587 static int rpc_group_add_internals(struct net_context
*c
, int argc
, const char **argv
)
1589 NET_API_STATUS status
;
1590 struct GROUP_INFO_1 info1
;
1591 uint32_t parm_error
= 0;
1593 if (argc
!= 1 || c
->display_usage
) {
1594 rpc_group_usage(c
, argc
, argv
);
1600 info1
.grpi1_name
= argv
[0];
1601 if (c
->opt_comment
&& strlen(c
->opt_comment
) > 0) {
1602 info1
.grpi1_comment
= c
->opt_comment
;
1605 status
= NetGroupAdd(c
->opt_host
, 1, (uint8_t *)&info1
, &parm_error
);
1608 d_fprintf(stderr
, "Failed to add group '%s' with: %s.\n",
1609 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
1613 d_printf("Added group '%s'.\n", argv
[0]);
1619 static int rpc_alias_add_internals(struct net_context
*c
, int argc
, const char **argv
)
1621 NET_API_STATUS status
;
1622 struct LOCALGROUP_INFO_1 info1
;
1623 uint32_t parm_error
= 0;
1625 if (argc
!= 1 || c
->display_usage
) {
1626 rpc_group_usage(c
, argc
, argv
);
1632 info1
.lgrpi1_name
= argv
[0];
1633 if (c
->opt_comment
&& strlen(c
->opt_comment
) > 0) {
1634 info1
.lgrpi1_comment
= c
->opt_comment
;
1637 status
= NetLocalGroupAdd(c
->opt_host
, 1, (uint8_t *)&info1
, &parm_error
);
1640 d_fprintf(stderr
, "Failed to add alias '%s' with: %s.\n",
1641 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
1645 d_printf("Added alias '%s'.\n", argv
[0]);
1651 static int rpc_group_add(struct net_context
*c
, int argc
, const char **argv
)
1653 if (c
->opt_localgroup
)
1654 return rpc_alias_add_internals(c
, argc
, argv
);
1656 return rpc_group_add_internals(c
, argc
, argv
);
1659 static NTSTATUS
get_sid_from_name(struct cli_state
*cli
,
1660 TALLOC_CTX
*mem_ctx
,
1663 enum lsa_SidType
*type
)
1665 DOM_SID
*sids
= NULL
;
1666 enum lsa_SidType
*types
= NULL
;
1667 struct rpc_pipe_client
*pipe_hnd
= NULL
;
1668 struct policy_handle lsa_pol
;
1669 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
1671 result
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
1673 if (!NT_STATUS_IS_OK(result
)) {
1677 result
= rpccli_lsa_open_policy(pipe_hnd
, mem_ctx
, false,
1678 SEC_FLAG_MAXIMUM_ALLOWED
, &lsa_pol
);
1680 if (!NT_STATUS_IS_OK(result
)) {
1684 result
= rpccli_lsa_lookup_names(pipe_hnd
, mem_ctx
, &lsa_pol
, 1,
1685 &name
, NULL
, 1, &sids
, &types
);
1687 if (NT_STATUS_IS_OK(result
)) {
1688 sid_copy(sid
, &sids
[0]);
1692 rpccli_lsa_Close(pipe_hnd
, mem_ctx
, &lsa_pol
);
1696 TALLOC_FREE(pipe_hnd
);
1699 if (!NT_STATUS_IS_OK(result
) && (StrnCaseCmp(name
, "S-", 2) == 0)) {
1701 /* Try as S-1-5-whatever */
1705 if (string_to_sid(&tmp_sid
, name
)) {
1706 sid_copy(sid
, &tmp_sid
);
1707 *type
= SID_NAME_UNKNOWN
;
1708 result
= NT_STATUS_OK
;
1715 static NTSTATUS
rpc_add_groupmem(struct rpc_pipe_client
*pipe_hnd
,
1716 TALLOC_CTX
*mem_ctx
,
1717 const DOM_SID
*group_sid
,
1720 struct policy_handle connect_pol
, domain_pol
;
1723 struct policy_handle group_pol
;
1725 struct samr_Ids rids
, rid_types
;
1726 struct lsa_String lsa_acct_name
;
1730 sid_copy(&sid
, group_sid
);
1732 if (!sid_split_rid(&sid
, &group_rid
)) {
1733 return NT_STATUS_UNSUCCESSFUL
;
1736 /* Get sam policy handle */
1737 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
1739 MAXIMUM_ALLOWED_ACCESS
,
1741 if (!NT_STATUS_IS_OK(result
)) {
1745 /* Get domain policy handle */
1746 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
1748 MAXIMUM_ALLOWED_ACCESS
,
1751 if (!NT_STATUS_IS_OK(result
)) {
1755 init_lsa_String(&lsa_acct_name
, member
);
1757 result
= rpccli_samr_LookupNames(pipe_hnd
, mem_ctx
,
1764 if (!NT_STATUS_IS_OK(result
)) {
1765 d_fprintf(stderr
, "Could not lookup up group member %s\n", member
);
1769 result
= rpccli_samr_OpenGroup(pipe_hnd
, mem_ctx
,
1771 MAXIMUM_ALLOWED_ACCESS
,
1775 if (!NT_STATUS_IS_OK(result
)) {
1779 result
= rpccli_samr_AddGroupMember(pipe_hnd
, mem_ctx
,
1782 0x0005); /* unknown flags */
1785 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &connect_pol
);
1789 static NTSTATUS
rpc_add_aliasmem(struct rpc_pipe_client
*pipe_hnd
,
1790 TALLOC_CTX
*mem_ctx
,
1791 const DOM_SID
*alias_sid
,
1794 struct policy_handle connect_pol
, domain_pol
;
1797 struct policy_handle alias_pol
;
1800 enum lsa_SidType member_type
;
1804 sid_copy(&sid
, alias_sid
);
1806 if (!sid_split_rid(&sid
, &alias_rid
)) {
1807 return NT_STATUS_UNSUCCESSFUL
;
1810 result
= get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd
), mem_ctx
,
1811 member
, &member_sid
, &member_type
);
1813 if (!NT_STATUS_IS_OK(result
)) {
1814 d_fprintf(stderr
, "Could not lookup up group member %s\n", member
);
1818 /* Get sam policy handle */
1819 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
1821 MAXIMUM_ALLOWED_ACCESS
,
1823 if (!NT_STATUS_IS_OK(result
)) {
1827 /* Get domain policy handle */
1828 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
1830 MAXIMUM_ALLOWED_ACCESS
,
1833 if (!NT_STATUS_IS_OK(result
)) {
1837 result
= rpccli_samr_OpenAlias(pipe_hnd
, mem_ctx
,
1839 MAXIMUM_ALLOWED_ACCESS
,
1843 if (!NT_STATUS_IS_OK(result
)) {
1847 result
= rpccli_samr_AddAliasMember(pipe_hnd
, mem_ctx
,
1851 if (!NT_STATUS_IS_OK(result
)) {
1856 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &connect_pol
);
1860 static NTSTATUS
rpc_group_addmem_internals(struct net_context
*c
,
1861 const DOM_SID
*domain_sid
,
1862 const char *domain_name
,
1863 struct cli_state
*cli
,
1864 struct rpc_pipe_client
*pipe_hnd
,
1865 TALLOC_CTX
*mem_ctx
,
1870 enum lsa_SidType group_type
;
1872 if (argc
!= 2 || c
->display_usage
) {
1874 "net rpc group addmem <group> <member>\n"
1875 " Add a member to a group\n"
1876 " group\tGroup to add member to\n"
1877 " member\tMember to add to group\n");
1878 return NT_STATUS_UNSUCCESSFUL
;
1881 if (!NT_STATUS_IS_OK(get_sid_from_name(cli
, mem_ctx
, argv
[0],
1882 &group_sid
, &group_type
))) {
1883 d_fprintf(stderr
, "Could not lookup group name %s\n", argv
[0]);
1884 return NT_STATUS_UNSUCCESSFUL
;
1887 if (group_type
== SID_NAME_DOM_GRP
) {
1888 NTSTATUS result
= rpc_add_groupmem(pipe_hnd
, mem_ctx
,
1889 &group_sid
, argv
[1]);
1891 if (!NT_STATUS_IS_OK(result
)) {
1892 d_fprintf(stderr
, "Could not add %s to %s: %s\n",
1893 argv
[1], argv
[0], nt_errstr(result
));
1898 if (group_type
== SID_NAME_ALIAS
) {
1899 NTSTATUS result
= rpc_add_aliasmem(pipe_hnd
, mem_ctx
,
1900 &group_sid
, argv
[1]);
1902 if (!NT_STATUS_IS_OK(result
)) {
1903 d_fprintf(stderr
, "Could not add %s to %s: %s\n",
1904 argv
[1], argv
[0], nt_errstr(result
));
1909 d_fprintf(stderr
, "Can only add members to global or local groups "
1910 "which %s is not\n", argv
[0]);
1912 return NT_STATUS_UNSUCCESSFUL
;
1915 static int rpc_group_addmem(struct net_context
*c
, int argc
, const char **argv
)
1917 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
, 0,
1918 rpc_group_addmem_internals
,
1922 static NTSTATUS
rpc_del_groupmem(struct net_context
*c
,
1923 struct rpc_pipe_client
*pipe_hnd
,
1924 TALLOC_CTX
*mem_ctx
,
1925 const DOM_SID
*group_sid
,
1928 struct policy_handle connect_pol
, domain_pol
;
1931 struct policy_handle group_pol
;
1933 struct samr_Ids rids
, rid_types
;
1934 struct lsa_String lsa_acct_name
;
1938 sid_copy(&sid
, group_sid
);
1940 if (!sid_split_rid(&sid
, &group_rid
))
1941 return NT_STATUS_UNSUCCESSFUL
;
1943 /* Get sam policy handle */
1944 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
1946 MAXIMUM_ALLOWED_ACCESS
,
1948 if (!NT_STATUS_IS_OK(result
))
1951 /* Get domain policy handle */
1952 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
1954 MAXIMUM_ALLOWED_ACCESS
,
1957 if (!NT_STATUS_IS_OK(result
))
1960 init_lsa_String(&lsa_acct_name
, member
);
1962 result
= rpccli_samr_LookupNames(pipe_hnd
, mem_ctx
,
1968 if (!NT_STATUS_IS_OK(result
)) {
1969 d_fprintf(stderr
, "Could not lookup up group member %s\n", member
);
1973 result
= rpccli_samr_OpenGroup(pipe_hnd
, mem_ctx
,
1975 MAXIMUM_ALLOWED_ACCESS
,
1979 if (!NT_STATUS_IS_OK(result
))
1982 result
= rpccli_samr_DeleteGroupMember(pipe_hnd
, mem_ctx
,
1987 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &connect_pol
);
1991 static NTSTATUS
rpc_del_aliasmem(struct rpc_pipe_client
*pipe_hnd
,
1992 TALLOC_CTX
*mem_ctx
,
1993 const DOM_SID
*alias_sid
,
1996 struct policy_handle connect_pol
, domain_pol
;
1999 struct policy_handle alias_pol
;
2002 enum lsa_SidType member_type
;
2006 sid_copy(&sid
, alias_sid
);
2008 if (!sid_split_rid(&sid
, &alias_rid
))
2009 return NT_STATUS_UNSUCCESSFUL
;
2011 result
= get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd
), mem_ctx
,
2012 member
, &member_sid
, &member_type
);
2014 if (!NT_STATUS_IS_OK(result
)) {
2015 d_fprintf(stderr
, "Could not lookup up group member %s\n", member
);
2019 /* Get sam policy handle */
2020 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
2022 MAXIMUM_ALLOWED_ACCESS
,
2024 if (!NT_STATUS_IS_OK(result
)) {
2028 /* Get domain policy handle */
2029 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
2031 MAXIMUM_ALLOWED_ACCESS
,
2034 if (!NT_STATUS_IS_OK(result
)) {
2038 result
= rpccli_samr_OpenAlias(pipe_hnd
, mem_ctx
,
2040 MAXIMUM_ALLOWED_ACCESS
,
2044 if (!NT_STATUS_IS_OK(result
))
2047 result
= rpccli_samr_DeleteAliasMember(pipe_hnd
, mem_ctx
,
2051 if (!NT_STATUS_IS_OK(result
))
2055 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &connect_pol
);
2059 static NTSTATUS
rpc_group_delmem_internals(struct net_context
*c
,
2060 const DOM_SID
*domain_sid
,
2061 const char *domain_name
,
2062 struct cli_state
*cli
,
2063 struct rpc_pipe_client
*pipe_hnd
,
2064 TALLOC_CTX
*mem_ctx
,
2069 enum lsa_SidType group_type
;
2071 if (argc
!= 2 || c
->display_usage
) {
2073 "net rpc group delmem <group> <member>\n"
2074 " Delete a member from a group\n"
2075 " group\tGroup to delete member from\n"
2076 " member\tMember to delete from group\n");
2077 return NT_STATUS_UNSUCCESSFUL
;
2080 if (!NT_STATUS_IS_OK(get_sid_from_name(cli
, mem_ctx
, argv
[0],
2081 &group_sid
, &group_type
))) {
2082 d_fprintf(stderr
, "Could not lookup group name %s\n", argv
[0]);
2083 return NT_STATUS_UNSUCCESSFUL
;
2086 if (group_type
== SID_NAME_DOM_GRP
) {
2087 NTSTATUS result
= rpc_del_groupmem(c
, pipe_hnd
, mem_ctx
,
2088 &group_sid
, argv
[1]);
2090 if (!NT_STATUS_IS_OK(result
)) {
2091 d_fprintf(stderr
, "Could not del %s from %s: %s\n",
2092 argv
[1], argv
[0], nt_errstr(result
));
2097 if (group_type
== SID_NAME_ALIAS
) {
2098 NTSTATUS result
= rpc_del_aliasmem(pipe_hnd
, mem_ctx
,
2099 &group_sid
, argv
[1]);
2101 if (!NT_STATUS_IS_OK(result
)) {
2102 d_fprintf(stderr
, "Could not del %s from %s: %s\n",
2103 argv
[1], argv
[0], nt_errstr(result
));
2108 d_fprintf(stderr
, "Can only delete members from global or local groups "
2109 "which %s is not\n", argv
[0]);
2111 return NT_STATUS_UNSUCCESSFUL
;
2114 static int rpc_group_delmem(struct net_context
*c
, int argc
, const char **argv
)
2116 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
, 0,
2117 rpc_group_delmem_internals
,
2122 * List groups on a remote RPC server.
2124 * All parameters are provided by the run_rpc_command function, except for
2125 * argc, argv which are passes through.
2127 * @param domain_sid The domain sid acquired from the remote server.
2128 * @param cli A cli_state connected to the server.
2129 * @param mem_ctx Talloc context, destroyed on completion of the function.
2130 * @param argc Standard main() style argc.
2131 * @param argv Standard main() style argv. Initial components are already
2134 * @return Normal NTSTATUS return.
2137 static NTSTATUS
rpc_group_list_internals(struct net_context
*c
,
2138 const DOM_SID
*domain_sid
,
2139 const char *domain_name
,
2140 struct cli_state
*cli
,
2141 struct rpc_pipe_client
*pipe_hnd
,
2142 TALLOC_CTX
*mem_ctx
,
2146 struct policy_handle connect_pol
, domain_pol
;
2147 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
2148 uint32 start_idx
=0, max_entries
=250, num_entries
, i
, loop_count
= 0;
2149 struct samr_SamArray
*groups
= NULL
;
2150 bool global
= false;
2152 bool builtin
= false;
2154 if (c
->display_usage
) {
2156 "net rpc group list [global] [local] [builtin]\n"
2157 " List groups on RPC server\n"
2158 " global\tList global groups\n"
2159 " local\tList local groups\n"
2160 " builtin\tList builtin groups\n"
2161 " If none of global, local or builtin is "
2162 "specified, all three options are considered set\n");
2163 return NT_STATUS_OK
;
2172 for (i
=0; i
<argc
; i
++) {
2173 if (strequal(argv
[i
], "global"))
2176 if (strequal(argv
[i
], "local"))
2179 if (strequal(argv
[i
], "builtin"))
2183 /* Get sam policy handle */
2185 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
2187 MAXIMUM_ALLOWED_ACCESS
,
2189 if (!NT_STATUS_IS_OK(result
)) {
2193 /* Get domain policy handle */
2195 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
2197 MAXIMUM_ALLOWED_ACCESS
,
2198 CONST_DISCARD(struct dom_sid2
*, domain_sid
),
2200 if (!NT_STATUS_IS_OK(result
)) {
2204 /* Query domain groups */
2205 if (c
->opt_long_list_entries
)
2206 d_printf("\nGroup name Comment"
2207 "\n-----------------------------\n");
2209 uint32_t max_size
, total_size
, returned_size
;
2210 union samr_DispInfo info
;
2214 get_query_dispinfo_params(
2215 loop_count
, &max_entries
, &max_size
);
2217 result
= rpccli_samr_QueryDisplayInfo(pipe_hnd
, mem_ctx
,
2226 num_entries
= info
.info3
.count
;
2227 start_idx
+= info
.info3
.count
;
2229 if (!NT_STATUS_IS_OK(result
) &&
2230 !NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
))
2233 for (i
= 0; i
< num_entries
; i
++) {
2235 const char *group
= NULL
;
2236 const char *desc
= NULL
;
2238 group
= info
.info3
.entries
[i
].account_name
.string
;
2239 desc
= info
.info3
.entries
[i
].description
.string
;
2241 if (c
->opt_long_list_entries
)
2242 printf("%-21.21s %-50.50s\n",
2245 printf("%s\n", group
);
2247 } while (NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
2248 /* query domain aliases */
2253 result
= rpccli_samr_EnumDomainAliases(pipe_hnd
, mem_ctx
,
2259 if (!NT_STATUS_IS_OK(result
) &&
2260 !NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
))
2263 for (i
= 0; i
< num_entries
; i
++) {
2265 const char *description
= NULL
;
2267 if (c
->opt_long_list_entries
) {
2269 struct policy_handle alias_pol
;
2270 union samr_AliasInfo
*info
= NULL
;
2272 if ((NT_STATUS_IS_OK(rpccli_samr_OpenAlias(pipe_hnd
, mem_ctx
,
2275 groups
->entries
[i
].idx
,
2277 (NT_STATUS_IS_OK(rpccli_samr_QueryAliasInfo(pipe_hnd
, mem_ctx
,
2281 (NT_STATUS_IS_OK(rpccli_samr_Close(pipe_hnd
, mem_ctx
,
2283 description
= info
->description
.string
;
2287 if (description
!= NULL
) {
2288 printf("%-21.21s %-50.50s\n",
2289 groups
->entries
[i
].name
.string
,
2292 printf("%s\n", groups
->entries
[i
].name
.string
);
2295 } while (NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
2296 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &domain_pol
);
2297 /* Get builtin policy handle */
2299 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
2301 MAXIMUM_ALLOWED_ACCESS
,
2302 CONST_DISCARD(struct dom_sid2
*, &global_sid_Builtin
),
2304 if (!NT_STATUS_IS_OK(result
)) {
2307 /* query builtin aliases */
2310 if (!builtin
) break;
2312 result
= rpccli_samr_EnumDomainAliases(pipe_hnd
, mem_ctx
,
2318 if (!NT_STATUS_IS_OK(result
) &&
2319 !NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
))
2322 for (i
= 0; i
< num_entries
; i
++) {
2324 const char *description
= NULL
;
2326 if (c
->opt_long_list_entries
) {
2328 struct policy_handle alias_pol
;
2329 union samr_AliasInfo
*info
= NULL
;
2331 if ((NT_STATUS_IS_OK(rpccli_samr_OpenAlias(pipe_hnd
, mem_ctx
,
2334 groups
->entries
[i
].idx
,
2336 (NT_STATUS_IS_OK(rpccli_samr_QueryAliasInfo(pipe_hnd
, mem_ctx
,
2340 (NT_STATUS_IS_OK(rpccli_samr_Close(pipe_hnd
, mem_ctx
,
2342 description
= info
->description
.string
;
2346 if (description
!= NULL
) {
2347 printf("%-21.21s %-50.50s\n",
2348 groups
->entries
[i
].name
.string
,
2351 printf("%s\n", groups
->entries
[i
].name
.string
);
2354 } while (NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
2360 static int rpc_group_list(struct net_context
*c
, int argc
, const char **argv
)
2362 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
, 0,
2363 rpc_group_list_internals
,
2367 static NTSTATUS
rpc_list_group_members(struct net_context
*c
,
2368 struct rpc_pipe_client
*pipe_hnd
,
2369 TALLOC_CTX
*mem_ctx
,
2370 const char *domain_name
,
2371 const DOM_SID
*domain_sid
,
2372 struct policy_handle
*domain_pol
,
2376 struct policy_handle group_pol
;
2377 uint32 num_members
, *group_rids
;
2379 struct samr_RidTypeArray
*rids
= NULL
;
2380 struct lsa_Strings names
;
2381 struct samr_Ids types
;
2384 sid_to_fstring(sid_str
, domain_sid
);
2386 result
= rpccli_samr_OpenGroup(pipe_hnd
, mem_ctx
,
2388 MAXIMUM_ALLOWED_ACCESS
,
2392 if (!NT_STATUS_IS_OK(result
))
2395 result
= rpccli_samr_QueryGroupMember(pipe_hnd
, mem_ctx
,
2399 if (!NT_STATUS_IS_OK(result
))
2402 num_members
= rids
->count
;
2403 group_rids
= rids
->rids
;
2405 while (num_members
> 0) {
2406 int this_time
= 512;
2408 if (num_members
< this_time
)
2409 this_time
= num_members
;
2411 result
= rpccli_samr_LookupRids(pipe_hnd
, mem_ctx
,
2418 if (!NT_STATUS_IS_OK(result
))
2421 /* We only have users as members, but make the output
2422 the same as the output of alias members */
2424 for (i
= 0; i
< this_time
; i
++) {
2426 if (c
->opt_long_list_entries
) {
2427 printf("%s-%d %s\\%s %d\n", sid_str
,
2428 group_rids
[i
], domain_name
,
2429 names
.names
[i
].string
,
2432 printf("%s\\%s\n", domain_name
,
2433 names
.names
[i
].string
);
2437 num_members
-= this_time
;
2441 return NT_STATUS_OK
;
2444 static NTSTATUS
rpc_list_alias_members(struct net_context
*c
,
2445 struct rpc_pipe_client
*pipe_hnd
,
2446 TALLOC_CTX
*mem_ctx
,
2447 struct policy_handle
*domain_pol
,
2451 struct rpc_pipe_client
*lsa_pipe
;
2452 struct policy_handle alias_pol
, lsa_pol
;
2454 DOM_SID
*alias_sids
;
2457 enum lsa_SidType
*types
;
2459 struct lsa_SidArray sid_array
;
2461 result
= rpccli_samr_OpenAlias(pipe_hnd
, mem_ctx
,
2463 MAXIMUM_ALLOWED_ACCESS
,
2467 if (!NT_STATUS_IS_OK(result
))
2470 result
= rpccli_samr_GetMembersInAlias(pipe_hnd
, mem_ctx
,
2474 if (!NT_STATUS_IS_OK(result
)) {
2475 d_fprintf(stderr
, "Couldn't list alias members\n");
2479 num_members
= sid_array
.num_sids
;
2481 if (num_members
== 0) {
2482 return NT_STATUS_OK
;
2485 result
= cli_rpc_pipe_open_noauth(rpc_pipe_np_smb_conn(pipe_hnd
),
2486 &ndr_table_lsarpc
.syntax_id
,
2488 if (!NT_STATUS_IS_OK(result
)) {
2489 d_fprintf(stderr
, "Couldn't open LSA pipe. Error was %s\n",
2490 nt_errstr(result
) );
2494 result
= rpccli_lsa_open_policy(lsa_pipe
, mem_ctx
, true,
2495 SEC_FLAG_MAXIMUM_ALLOWED
, &lsa_pol
);
2497 if (!NT_STATUS_IS_OK(result
)) {
2498 d_fprintf(stderr
, "Couldn't open LSA policy handle\n");
2499 TALLOC_FREE(lsa_pipe
);
2503 alias_sids
= TALLOC_ZERO_ARRAY(mem_ctx
, DOM_SID
, num_members
);
2505 d_fprintf(stderr
, "Out of memory\n");
2506 TALLOC_FREE(lsa_pipe
);
2507 return NT_STATUS_NO_MEMORY
;
2510 for (i
=0; i
<num_members
; i
++) {
2511 sid_copy(&alias_sids
[i
], sid_array
.sids
[i
].sid
);
2514 result
= rpccli_lsa_lookup_sids(lsa_pipe
, mem_ctx
, &lsa_pol
,
2515 num_members
, alias_sids
,
2516 &domains
, &names
, &types
);
2518 if (!NT_STATUS_IS_OK(result
) &&
2519 !NT_STATUS_EQUAL(result
, STATUS_SOME_UNMAPPED
)) {
2520 d_fprintf(stderr
, "Couldn't lookup SIDs\n");
2521 TALLOC_FREE(lsa_pipe
);
2525 for (i
= 0; i
< num_members
; i
++) {
2527 sid_to_fstring(sid_str
, &alias_sids
[i
]);
2529 if (c
->opt_long_list_entries
) {
2530 printf("%s %s\\%s %d\n", sid_str
,
2531 domains
[i
] ? domains
[i
] : "*unknown*",
2532 names
[i
] ? names
[i
] : "*unknown*", types
[i
]);
2535 printf("%s\\%s\n", domains
[i
], names
[i
]);
2537 printf("%s\n", sid_str
);
2541 TALLOC_FREE(lsa_pipe
);
2542 return NT_STATUS_OK
;
2545 static NTSTATUS
rpc_group_members_internals(struct net_context
*c
,
2546 const DOM_SID
*domain_sid
,
2547 const char *domain_name
,
2548 struct cli_state
*cli
,
2549 struct rpc_pipe_client
*pipe_hnd
,
2550 TALLOC_CTX
*mem_ctx
,
2555 struct policy_handle connect_pol
, domain_pol
;
2556 struct samr_Ids rids
, rid_types
;
2557 struct lsa_String lsa_acct_name
;
2559 /* Get sam policy handle */
2561 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
2563 MAXIMUM_ALLOWED_ACCESS
,
2566 if (!NT_STATUS_IS_OK(result
))
2569 /* Get domain policy handle */
2571 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
2573 MAXIMUM_ALLOWED_ACCESS
,
2574 CONST_DISCARD(struct dom_sid2
*, domain_sid
),
2577 if (!NT_STATUS_IS_OK(result
))
2580 init_lsa_String(&lsa_acct_name
, argv
[0]); /* sure? */
2582 result
= rpccli_samr_LookupNames(pipe_hnd
, mem_ctx
,
2589 if (!NT_STATUS_IS_OK(result
)) {
2591 /* Ok, did not find it in the global sam, try with builtin */
2593 DOM_SID sid_Builtin
;
2595 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &domain_pol
);
2597 sid_copy(&sid_Builtin
, &global_sid_Builtin
);
2599 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
2601 MAXIMUM_ALLOWED_ACCESS
,
2605 if (!NT_STATUS_IS_OK(result
)) {
2606 d_fprintf(stderr
, "Couldn't find group %s\n", argv
[0]);
2610 result
= rpccli_samr_LookupNames(pipe_hnd
, mem_ctx
,
2617 if (!NT_STATUS_IS_OK(result
)) {
2618 d_fprintf(stderr
, "Couldn't find group %s\n", argv
[0]);
2623 if (rids
.count
!= 1) {
2624 d_fprintf(stderr
, "Couldn't find group %s\n", argv
[0]);
2628 if (rid_types
.ids
[0] == SID_NAME_DOM_GRP
) {
2629 return rpc_list_group_members(c
, pipe_hnd
, mem_ctx
, domain_name
,
2630 domain_sid
, &domain_pol
,
2634 if (rid_types
.ids
[0] == SID_NAME_ALIAS
) {
2635 return rpc_list_alias_members(c
, pipe_hnd
, mem_ctx
, &domain_pol
,
2639 return NT_STATUS_NO_SUCH_GROUP
;
2642 static int rpc_group_members(struct net_context
*c
, int argc
, const char **argv
)
2644 if (argc
!= 1 || c
->display_usage
) {
2645 return rpc_group_usage(c
, argc
, argv
);
2648 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
, 0,
2649 rpc_group_members_internals
,
2653 static int rpc_group_rename_internals(struct net_context
*c
, int argc
, const char **argv
)
2655 NET_API_STATUS status
;
2656 struct GROUP_INFO_0 g0
;
2660 d_printf("Usage: 'net rpc group rename group newname'\n");
2664 g0
.grpi0_name
= argv
[1];
2666 status
= NetGroupSetInfo(c
->opt_host
,
2673 d_fprintf(stderr
, "Renaming group %s failed with: %s\n",
2674 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
2682 static int rpc_group_rename(struct net_context
*c
, int argc
, const char **argv
)
2684 if (argc
!= 2 || c
->display_usage
) {
2685 return rpc_group_usage(c
, argc
, argv
);
2688 return rpc_group_rename_internals(c
, argc
, argv
);
2692 * 'net rpc group' entrypoint.
2693 * @param argc Standard main() style argc.
2694 * @param argv Standard main() style argv. Initial components are already
2698 int net_rpc_group(struct net_context
*c
, int argc
, const char **argv
)
2700 NET_API_STATUS status
;
2702 struct functable func
[] = {
2707 "Create specified group",
2708 "net rpc group add\n"
2709 " Create specified group"
2715 "Delete specified group",
2716 "net rpc group delete\n"
2717 " Delete specified group"
2723 "Add member to group",
2724 "net rpc group addmem\n"
2725 " Add member to group"
2731 "Remove member from group",
2732 "net rpc group delmem\n"
2733 " Remove member from group"
2740 "net rpc group list\n"
2747 "List group members",
2748 "net rpc group members\n"
2749 " List group members"
2756 "net rpc group rename\n"
2759 {NULL
, NULL
, 0, NULL
, NULL
}
2762 status
= libnetapi_init(&c
->netapi_ctx
);
2766 set_cmdline_auth_info_getpass(c
->auth_info
);
2767 libnetapi_set_username(c
->netapi_ctx
,
2768 get_cmdline_auth_info_username(c
->auth_info
));
2769 libnetapi_set_password(c
->netapi_ctx
,
2770 get_cmdline_auth_info_password(c
->auth_info
));
2771 if (get_cmdline_auth_info_use_kerberos(c
->auth_info
)) {
2772 libnetapi_set_use_kerberos(c
->netapi_ctx
);
2776 if (c
->display_usage
) {
2777 d_printf("Usage:\n");
2778 d_printf("net rpc group\n"
2779 " Alias for net rpc group list global local "
2781 net_display_usage_from_functable(func
);
2785 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
, 0,
2786 rpc_group_list_internals
,
2790 return net_run_function(c
, argc
, argv
, "net rpc group", func
);
2793 /****************************************************************************/
2795 static int rpc_share_usage(struct net_context
*c
, int argc
, const char **argv
)
2797 return net_share_usage(c
, argc
, argv
);
2801 * Add a share on a remote RPC server.
2803 * @param argc Standard main() style argc.
2804 * @param argv Standard main() style argv. Initial components are already
2807 * @return A shell status integer (0 for success).
2810 static int rpc_share_add(struct net_context
*c
, int argc
, const char **argv
)
2812 NET_API_STATUS status
;
2815 uint32 type
= STYPE_DISKTREE
; /* only allow disk shares to be added */
2816 uint32 num_users
=0, perms
=0;
2817 char *password
=NULL
; /* don't allow a share password */
2818 struct SHARE_INFO_2 i2
;
2819 uint32_t parm_error
= 0;
2821 if ((argc
< 1) || !strchr(argv
[0], '=') || c
->display_usage
) {
2822 return rpc_share_usage(c
, argc
, argv
);
2825 if ((sharename
= talloc_strdup(c
, argv
[0])) == NULL
) {
2829 path
= strchr(sharename
, '=');
2836 i2
.shi2_netname
= sharename
;
2837 i2
.shi2_type
= type
;
2838 i2
.shi2_remark
= c
->opt_comment
;
2839 i2
.shi2_permissions
= perms
;
2840 i2
.shi2_max_uses
= c
->opt_maxusers
;
2841 i2
.shi2_current_uses
= num_users
;
2842 i2
.shi2_path
= path
;
2843 i2
.shi2_passwd
= password
;
2845 status
= NetShareAdd(c
->opt_host
,
2850 printf("NetShareAdd failed with: %s\n",
2851 libnetapi_get_error_string(c
->netapi_ctx
, status
));
2858 * Delete a share on a remote RPC server.
2860 * @param domain_sid The domain sid acquired from the remote server.
2861 * @param argc Standard main() style argc.
2862 * @param argv Standard main() style argv. Initial components are already
2865 * @return A shell status integer (0 for success).
2867 static int rpc_share_delete(struct net_context
*c
, int argc
, const char **argv
)
2869 if (argc
< 1 || c
->display_usage
) {
2870 return rpc_share_usage(c
, argc
, argv
);
2873 return NetShareDel(c
->opt_host
, argv
[0], 0);
2877 * Formatted print of share info
2879 * @param r pointer to SHARE_INFO_1 to format
2882 static void display_share_info_1(struct net_context
*c
,
2883 struct SHARE_INFO_1
*r
)
2885 if (c
->opt_long_list_entries
) {
2886 d_printf("%-12s %-8.8s %-50s\n",
2888 net_share_type_str(r
->shi1_type
& ~(STYPE_TEMPORARY
|STYPE_HIDDEN
)),
2891 d_printf("%s\n", r
->shi1_netname
);
2895 static WERROR
get_share_info(struct net_context
*c
,
2896 struct rpc_pipe_client
*pipe_hnd
,
2897 TALLOC_CTX
*mem_ctx
,
2901 struct srvsvc_NetShareInfoCtr
*info_ctr
)
2905 union srvsvc_NetShareInfo info
;
2907 /* no specific share requested, enumerate all */
2910 uint32_t preferred_len
= 0xffffffff;
2911 uint32_t total_entries
= 0;
2912 uint32_t resume_handle
= 0;
2914 info_ctr
->level
= level
;
2916 status
= rpccli_srvsvc_NetShareEnumAll(pipe_hnd
, mem_ctx
,
2926 /* request just one share */
2927 status
= rpccli_srvsvc_NetShareGetInfo(pipe_hnd
, mem_ctx
,
2934 if (!NT_STATUS_IS_OK(status
) || !W_ERROR_IS_OK(result
)) {
2939 ZERO_STRUCTP(info_ctr
);
2941 info_ctr
->level
= level
;
2946 struct srvsvc_NetShareCtr1
*ctr1
;
2948 ctr1
= TALLOC_ZERO_P(mem_ctx
, struct srvsvc_NetShareCtr1
);
2949 W_ERROR_HAVE_NO_MEMORY(ctr1
);
2952 ctr1
->array
= info
.info1
;
2954 info_ctr
->ctr
.ctr1
= ctr1
;
2958 struct srvsvc_NetShareCtr2
*ctr2
;
2960 ctr2
= TALLOC_ZERO_P(mem_ctx
, struct srvsvc_NetShareCtr2
);
2961 W_ERROR_HAVE_NO_MEMORY(ctr2
);
2964 ctr2
->array
= info
.info2
;
2966 info_ctr
->ctr
.ctr2
= ctr2
;
2970 struct srvsvc_NetShareCtr502
*ctr502
;
2972 ctr502
= TALLOC_ZERO_P(mem_ctx
, struct srvsvc_NetShareCtr502
);
2973 W_ERROR_HAVE_NO_MEMORY(ctr502
);
2976 ctr502
->array
= info
.info502
;
2978 info_ctr
->ctr
.ctr502
= ctr502
;
2986 * 'net rpc share list' entrypoint.
2987 * @param argc Standard main() style argc.
2988 * @param argv Standard main() style argv. Initial components are already
2991 static int rpc_share_list(struct net_context
*c
, int argc
, const char **argv
)
2993 NET_API_STATUS status
;
2994 struct SHARE_INFO_1
*i1
= NULL
;
2995 uint32_t entries_read
= 0;
2996 uint32_t total_entries
= 0;
2997 uint32_t resume_handle
= 0;
2998 uint32_t i
, level
= 1;
3000 if (c
->display_usage
) {
3002 "net rpc share list\n"
3003 " List shares on remote server\n");
3007 status
= NetShareEnum(c
->opt_host
,
3009 (uint8_t **)(void *)&i1
,
3018 /* Display results */
3020 if (c
->opt_long_list_entries
) {
3022 "\nEnumerating shared resources (exports) on remote server:\n\n"
3023 "\nShare name Type Description\n"
3024 "---------- ---- -----------\n");
3026 for (i
= 0; i
< entries_read
; i
++)
3027 display_share_info_1(c
, &i1
[i
]);
3032 static bool check_share_availability(struct cli_state
*cli
, const char *netname
)
3034 if (!NT_STATUS_IS_OK(cli_tcon_andx(cli
, netname
, "A:", "", 0))) {
3035 d_printf("skipping [%s]: not a file share.\n", netname
);
3045 static bool check_share_sanity(struct net_context
*c
, struct cli_state
*cli
,
3046 const char *netname
, uint32 type
)
3048 /* only support disk shares */
3049 if (! ( type
== STYPE_DISKTREE
|| type
== (STYPE_DISKTREE
| STYPE_HIDDEN
)) ) {
3050 printf("share [%s] is not a diskshare (type: %x)\n", netname
, type
);
3054 /* skip builtin shares */
3055 /* FIXME: should print$ be added too ? */
3056 if (strequal(netname
,"IPC$") || strequal(netname
,"ADMIN$") ||
3057 strequal(netname
,"global"))
3060 if (c
->opt_exclude
&& in_list(netname
, c
->opt_exclude
, false)) {
3061 printf("excluding [%s]\n", netname
);
3065 return check_share_availability(cli
, netname
);
3069 * Migrate shares from a remote RPC server to the local RPC server.
3071 * All parameters are provided by the run_rpc_command function, except for
3072 * argc, argv which are passed through.
3074 * @param domain_sid The domain sid acquired from the remote server.
3075 * @param cli A cli_state connected to the server.
3076 * @param mem_ctx Talloc context, destroyed on completion of the function.
3077 * @param argc Standard main() style argc.
3078 * @param argv Standard main() style argv. Initial components are already
3081 * @return Normal NTSTATUS return.
3084 static NTSTATUS
rpc_share_migrate_shares_internals(struct net_context
*c
,
3085 const DOM_SID
*domain_sid
,
3086 const char *domain_name
,
3087 struct cli_state
*cli
,
3088 struct rpc_pipe_client
*pipe_hnd
,
3089 TALLOC_CTX
*mem_ctx
,
3094 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
3095 struct srvsvc_NetShareInfoCtr ctr_src
;
3097 struct rpc_pipe_client
*srvsvc_pipe
= NULL
;
3098 struct cli_state
*cli_dst
= NULL
;
3099 uint32 level
= 502; /* includes secdesc */
3100 uint32_t parm_error
= 0;
3102 result
= get_share_info(c
, pipe_hnd
, mem_ctx
, level
, argc
, argv
,
3104 if (!W_ERROR_IS_OK(result
))
3107 /* connect destination PI_SRVSVC */
3108 nt_status
= connect_dst_pipe(c
, &cli_dst
, &srvsvc_pipe
,
3109 &ndr_table_srvsvc
.syntax_id
);
3110 if (!NT_STATUS_IS_OK(nt_status
))
3114 for (i
= 0; i
< ctr_src
.ctr
.ctr502
->count
; i
++) {
3116 union srvsvc_NetShareInfo info
;
3117 struct srvsvc_NetShareInfo502 info502
=
3118 ctr_src
.ctr
.ctr502
->array
[i
];
3120 /* reset error-code */
3121 nt_status
= NT_STATUS_UNSUCCESSFUL
;
3123 if (!check_share_sanity(c
, cli
, info502
.name
, info502
.type
))
3126 /* finally add the share on the dst server */
3128 printf("migrating: [%s], path: %s, comment: %s, without share-ACLs\n",
3129 info502
.name
, info502
.path
, info502
.comment
);
3131 info
.info502
= &info502
;
3133 nt_status
= rpccli_srvsvc_NetShareAdd(srvsvc_pipe
, mem_ctx
,
3134 srvsvc_pipe
->desthost
,
3140 if (W_ERROR_V(result
) == W_ERROR_V(WERR_FILE_EXISTS
)) {
3141 printf(" [%s] does already exist\n",
3146 if (!NT_STATUS_IS_OK(nt_status
) || !W_ERROR_IS_OK(result
)) {
3147 printf("cannot add share: %s\n", win_errstr(result
));
3153 nt_status
= NT_STATUS_OK
;
3157 cli_shutdown(cli_dst
);
3165 * Migrate shares from a RPC server to another.
3167 * @param argc Standard main() style argc.
3168 * @param argv Standard main() style argv. Initial components are already
3171 * @return A shell status integer (0 for success).
3173 static int rpc_share_migrate_shares(struct net_context
*c
, int argc
,
3176 if (c
->display_usage
) {
3178 "net rpc share migrate shares\n"
3179 " Migrate shares to local server\n");
3184 printf("no server to migrate\n");
3188 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
.syntax_id
, 0,
3189 rpc_share_migrate_shares_internals
,
3196 * @param f file_info
3197 * @param mask current search mask
3198 * @param state arg-pointer
3201 static void copy_fn(const char *mnt
, file_info
*f
,
3202 const char *mask
, void *state
)
3204 static NTSTATUS nt_status
;
3205 static struct copy_clistate
*local_state
;
3206 static fstring filename
, new_mask
;
3209 struct net_context
*c
;
3211 local_state
= (struct copy_clistate
*)state
;
3212 nt_status
= NT_STATUS_UNSUCCESSFUL
;
3216 if (strequal(f
->name
, ".") || strequal(f
->name
, ".."))
3219 DEBUG(3,("got mask: %s, name: %s\n", mask
, f
->name
));
3222 if (f
->mode
& aDIR
) {
3224 DEBUG(3,("got dir: %s\n", f
->name
));
3226 fstrcpy(dir
, local_state
->cwd
);
3228 fstrcat(dir
, f
->name
);
3230 switch (net_mode_share
)
3232 case NET_MODE_SHARE_MIGRATE
:
3233 /* create that directory */
3234 nt_status
= net_copy_file(c
, local_state
->mem_ctx
,
3235 local_state
->cli_share_src
,
3236 local_state
->cli_share_dst
,
3238 c
->opt_acls
? true : false,
3239 c
->opt_attrs
? true : false,
3240 c
->opt_timestamps
? true:false,
3244 d_fprintf(stderr
, "Unsupported mode %d\n", net_mode_share
);
3248 if (!NT_STATUS_IS_OK(nt_status
))
3249 printf("could not handle dir %s: %s\n",
3250 dir
, nt_errstr(nt_status
));
3252 /* search below that directory */
3253 fstrcpy(new_mask
, dir
);
3254 fstrcat(new_mask
, "\\*");
3256 old_dir
= local_state
->cwd
;
3257 local_state
->cwd
= dir
;
3258 if (!sync_files(local_state
, new_mask
, c
->auth_info
))
3259 printf("could not handle files\n");
3260 local_state
->cwd
= old_dir
;
3267 fstrcpy(filename
, local_state
->cwd
);
3268 fstrcat(filename
, "\\");
3269 fstrcat(filename
, f
->name
);
3271 DEBUG(3,("got file: %s\n", filename
));
3273 switch (net_mode_share
)
3275 case NET_MODE_SHARE_MIGRATE
:
3276 nt_status
= net_copy_file(c
, local_state
->mem_ctx
,
3277 local_state
->cli_share_src
,
3278 local_state
->cli_share_dst
,
3280 c
->opt_acls
? true : false,
3281 c
->opt_attrs
? true : false,
3282 c
->opt_timestamps
? true: false,
3286 d_fprintf(stderr
, "Unsupported file mode %d\n", net_mode_share
);
3290 if (!NT_STATUS_IS_OK(nt_status
))
3291 printf("could not handle file %s: %s\n",
3292 filename
, nt_errstr(nt_status
));
3297 * sync files, can be called recursivly to list files
3298 * and then call copy_fn for each file
3300 * @param cp_clistate pointer to the copy_clistate we work with
3301 * @param mask the current search mask
3303 * @return Boolean result
3305 static bool sync_files(struct copy_clistate
*cp_clistate
, const char *mask
,
3306 const struct user_auth_info
*auth_info
)
3308 struct cli_state
*targetcli
;
3309 char *targetpath
= NULL
;
3311 DEBUG(3,("calling cli_list with mask: %s\n", mask
));
3314 if ( !cli_resolve_path(talloc_tos(), "", auth_info
,
3315 cp_clistate
->cli_share_src
, mask
, &targetcli
,
3317 d_fprintf(stderr
, "cli_resolve_path %s failed with error: %s\n",
3318 mask
, cli_errstr(cp_clistate
->cli_share_src
));
3322 if (cli_list(targetcli
, targetpath
, cp_clistate
->attribute
, copy_fn
, cp_clistate
) == -1) {
3323 d_fprintf(stderr
, "listing %s failed with error: %s\n",
3324 mask
, cli_errstr(targetcli
));
3333 * Set the top level directory permissions before we do any further copies.
3334 * Should set up ACL inheritance.
3337 bool copy_top_level_perms(struct net_context
*c
,
3338 struct copy_clistate
*cp_clistate
,
3339 const char *sharename
)
3341 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
3343 switch (net_mode_share
) {
3344 case NET_MODE_SHARE_MIGRATE
:
3345 DEBUG(3,("calling net_copy_fileattr for '.' directory in share %s\n", sharename
));
3346 nt_status
= net_copy_fileattr(c
,
3347 cp_clistate
->mem_ctx
,
3348 cp_clistate
->cli_share_src
,
3349 cp_clistate
->cli_share_dst
,
3351 c
->opt_acls
? true : false,
3352 c
->opt_attrs
? true : false,
3353 c
->opt_timestamps
? true: false,
3357 d_fprintf(stderr
, "Unsupported mode %d\n", net_mode_share
);
3361 if (!NT_STATUS_IS_OK(nt_status
)) {
3362 printf("Could handle directory attributes for top level directory of share %s. Error %s\n",
3363 sharename
, nt_errstr(nt_status
));
3371 * Sync all files inside a remote share to another share (over smb).
3373 * All parameters are provided by the run_rpc_command function, except for
3374 * argc, argv which are passed through.
3376 * @param domain_sid The domain sid acquired from the remote server.
3377 * @param cli A cli_state connected to the server.
3378 * @param mem_ctx Talloc context, destroyed on completion of the function.
3379 * @param argc Standard main() style argc.
3380 * @param argv Standard main() style argv. Initial components are already
3383 * @return Normal NTSTATUS return.
3386 static NTSTATUS
rpc_share_migrate_files_internals(struct net_context
*c
,
3387 const DOM_SID
*domain_sid
,
3388 const char *domain_name
,
3389 struct cli_state
*cli
,
3390 struct rpc_pipe_client
*pipe_hnd
,
3391 TALLOC_CTX
*mem_ctx
,
3396 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
3397 struct srvsvc_NetShareInfoCtr ctr_src
;
3400 struct copy_clistate cp_clistate
;
3401 bool got_src_share
= false;
3402 bool got_dst_share
= false;
3403 const char *mask
= "\\*";
3406 dst
= SMB_STRDUP(c
->opt_destination
?c
->opt_destination
:"127.0.0.1");
3408 nt_status
= NT_STATUS_NO_MEMORY
;
3412 result
= get_share_info(c
, pipe_hnd
, mem_ctx
, level
, argc
, argv
,
3415 if (!W_ERROR_IS_OK(result
))
3418 for (i
= 0; i
< ctr_src
.ctr
.ctr502
->count
; i
++) {
3420 struct srvsvc_NetShareInfo502 info502
=
3421 ctr_src
.ctr
.ctr502
->array
[i
];
3423 if (!check_share_sanity(c
, cli
, info502
.name
, info502
.type
))
3426 /* one might not want to mirror whole discs :) */
3427 if (strequal(info502
.name
, "print$") || info502
.name
[1] == '$') {
3428 d_printf("skipping [%s]: builtin/hidden share\n", info502
.name
);
3432 switch (net_mode_share
)
3434 case NET_MODE_SHARE_MIGRATE
:
3438 d_fprintf(stderr
, "Unsupported mode %d\n", net_mode_share
);
3441 printf(" [%s] files and directories %s ACLs, %s DOS Attributes %s\n",
3443 c
->opt_acls
? "including" : "without",
3444 c
->opt_attrs
? "including" : "without",
3445 c
->opt_timestamps
? "(preserving timestamps)" : "");
3447 cp_clistate
.mem_ctx
= mem_ctx
;
3448 cp_clistate
.cli_share_src
= NULL
;
3449 cp_clistate
.cli_share_dst
= NULL
;
3450 cp_clistate
.cwd
= NULL
;
3451 cp_clistate
.attribute
= aSYSTEM
| aHIDDEN
| aDIR
;
3454 /* open share source */
3455 nt_status
= connect_to_service(c
, &cp_clistate
.cli_share_src
,
3456 &cli
->dest_ss
, cli
->desthost
,
3457 info502
.name
, "A:");
3458 if (!NT_STATUS_IS_OK(nt_status
))
3461 got_src_share
= true;
3463 if (net_mode_share
== NET_MODE_SHARE_MIGRATE
) {
3464 /* open share destination */
3465 nt_status
= connect_to_service(c
, &cp_clistate
.cli_share_dst
,
3466 NULL
, dst
, info502
.name
, "A:");
3467 if (!NT_STATUS_IS_OK(nt_status
))
3470 got_dst_share
= true;
3473 if (!copy_top_level_perms(c
, &cp_clistate
, info502
.name
)) {
3474 d_fprintf(stderr
, "Could not handle the top level directory permissions for the share: %s\n", info502
.name
);
3475 nt_status
= NT_STATUS_UNSUCCESSFUL
;
3479 if (!sync_files(&cp_clistate
, mask
, c
->auth_info
)) {
3480 d_fprintf(stderr
, "could not handle files for share: %s\n", info502
.name
);
3481 nt_status
= NT_STATUS_UNSUCCESSFUL
;
3486 nt_status
= NT_STATUS_OK
;
3491 cli_shutdown(cp_clistate
.cli_share_src
);
3494 cli_shutdown(cp_clistate
.cli_share_dst
);
3501 static int rpc_share_migrate_files(struct net_context
*c
, int argc
, const char **argv
)
3503 if (c
->display_usage
) {
3505 "net share migrate files\n"
3506 " Migrate files to local server\n");
3511 d_printf("no server to migrate\n");
3515 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
.syntax_id
, 0,
3516 rpc_share_migrate_files_internals
,
3521 * Migrate share-ACLs from a remote RPC server to the local RPC server.
3523 * All parameters are provided by the run_rpc_command function, except for
3524 * argc, argv which are passed through.
3526 * @param domain_sid The domain sid acquired from the remote server.
3527 * @param cli A cli_state connected to the server.
3528 * @param mem_ctx Talloc context, destroyed on completion of the function.
3529 * @param argc Standard main() style argc.
3530 * @param argv Standard main() style argv. Initial components are already
3533 * @return Normal NTSTATUS return.
3536 static NTSTATUS
rpc_share_migrate_security_internals(struct net_context
*c
,
3537 const DOM_SID
*domain_sid
,
3538 const char *domain_name
,
3539 struct cli_state
*cli
,
3540 struct rpc_pipe_client
*pipe_hnd
,
3541 TALLOC_CTX
*mem_ctx
,
3546 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
3547 struct srvsvc_NetShareInfoCtr ctr_src
;
3548 union srvsvc_NetShareInfo info
;
3550 struct rpc_pipe_client
*srvsvc_pipe
= NULL
;
3551 struct cli_state
*cli_dst
= NULL
;
3552 uint32 level
= 502; /* includes secdesc */
3553 uint32_t parm_error
= 0;
3555 result
= get_share_info(c
, pipe_hnd
, mem_ctx
, level
, argc
, argv
,
3558 if (!W_ERROR_IS_OK(result
))
3561 /* connect destination PI_SRVSVC */
3562 nt_status
= connect_dst_pipe(c
, &cli_dst
, &srvsvc_pipe
,
3563 &ndr_table_srvsvc
.syntax_id
);
3564 if (!NT_STATUS_IS_OK(nt_status
))
3568 for (i
= 0; i
< ctr_src
.ctr
.ctr502
->count
; i
++) {
3570 struct srvsvc_NetShareInfo502 info502
=
3571 ctr_src
.ctr
.ctr502
->array
[i
];
3573 /* reset error-code */
3574 nt_status
= NT_STATUS_UNSUCCESSFUL
;
3576 if (!check_share_sanity(c
, cli
, info502
.name
, info502
.type
))
3579 printf("migrating: [%s], path: %s, comment: %s, including share-ACLs\n",
3580 info502
.name
, info502
.path
, info502
.comment
);
3583 display_sec_desc(info502
.sd_buf
.sd
);
3585 /* FIXME: shouldn't we be able to just set the security descriptor ? */
3586 info
.info502
= &info502
;
3588 /* finally modify the share on the dst server */
3589 nt_status
= rpccli_srvsvc_NetShareSetInfo(srvsvc_pipe
, mem_ctx
,
3590 srvsvc_pipe
->desthost
,
3596 if (!NT_STATUS_IS_OK(nt_status
) || !W_ERROR_IS_OK(result
)) {
3597 printf("cannot set share-acl: %s\n", win_errstr(result
));
3603 nt_status
= NT_STATUS_OK
;
3607 cli_shutdown(cli_dst
);
3615 * Migrate share-acls from a RPC server to another.
3617 * @param argc Standard main() style argc.
3618 * @param argv Standard main() style argv. Initial components are already
3621 * @return A shell status integer (0 for success).
3623 static int rpc_share_migrate_security(struct net_context
*c
, int argc
,
3626 if (c
->display_usage
) {
3628 "net rpc share migrate security\n"
3629 " Migrate share-acls to local server\n");
3634 d_printf("no server to migrate\n");
3638 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
.syntax_id
, 0,
3639 rpc_share_migrate_security_internals
,
3644 * Migrate shares (including share-definitions, share-acls and files with acls/attrs)
3645 * from one server to another.
3647 * @param argc Standard main() style argc.
3648 * @param argv Standard main() style argv. Initial components are already
3651 * @return A shell status integer (0 for success).
3654 static int rpc_share_migrate_all(struct net_context
*c
, int argc
,
3659 if (c
->display_usage
) {
3661 "net rpc share migrate all\n"
3662 " Migrates shares including all share settings\n");
3667 d_printf("no server to migrate\n");
3671 /* order is important. we don't want to be locked out by the share-acl
3672 * before copying files - gd */
3674 ret
= run_rpc_command(c
, NULL
, &ndr_table_srvsvc
.syntax_id
, 0,
3675 rpc_share_migrate_shares_internals
, argc
, argv
);
3679 ret
= run_rpc_command(c
, NULL
, &ndr_table_srvsvc
.syntax_id
, 0,
3680 rpc_share_migrate_files_internals
, argc
, argv
);
3684 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
.syntax_id
, 0,
3685 rpc_share_migrate_security_internals
, argc
,
3691 * 'net rpc share migrate' entrypoint.
3692 * @param argc Standard main() style argc.
3693 * @param argv Standard main() style argv. Initial components are already
3696 static int rpc_share_migrate(struct net_context
*c
, int argc
, const char **argv
)
3699 struct functable func
[] = {
3702 rpc_share_migrate_all
,
3704 "Migrate shares from remote to local server",
3705 "net rpc share migrate all\n"
3706 " Migrate shares from remote to local server"
3710 rpc_share_migrate_files
,
3712 "Migrate files from remote to local server",
3713 "net rpc share migrate files\n"
3714 " Migrate files from remote to local server"
3718 rpc_share_migrate_security
,
3720 "Migrate share-ACLs from remote to local server",
3721 "net rpc share migrate security\n"
3722 " Migrate share-ACLs from remote to local server"
3726 rpc_share_migrate_shares
,
3728 "Migrate shares from remote to local server",
3729 "net rpc share migrate shares\n"
3730 " Migrate shares from remote to local server"
3732 {NULL
, NULL
, 0, NULL
, NULL
}
3735 net_mode_share
= NET_MODE_SHARE_MIGRATE
;
3737 return net_run_function(c
, argc
, argv
, "net rpc share migrate", func
);
3746 static int num_server_aliases
;
3747 static struct full_alias
*server_aliases
;
3750 * Add an alias to the static list.
3752 static void push_alias(TALLOC_CTX
*mem_ctx
, struct full_alias
*alias
)
3754 if (server_aliases
== NULL
)
3755 server_aliases
= SMB_MALLOC_ARRAY(struct full_alias
, 100);
3757 server_aliases
[num_server_aliases
] = *alias
;
3758 num_server_aliases
+= 1;
3762 * For a specific domain on the server, fetch all the aliases
3763 * and their members. Add all of them to the server_aliases.
3766 static NTSTATUS
rpc_fetch_domain_aliases(struct rpc_pipe_client
*pipe_hnd
,
3767 TALLOC_CTX
*mem_ctx
,
3768 struct policy_handle
*connect_pol
,
3769 const DOM_SID
*domain_sid
)
3771 uint32 start_idx
, max_entries
, num_entries
, i
;
3772 struct samr_SamArray
*groups
= NULL
;
3774 struct policy_handle domain_pol
;
3776 /* Get domain policy handle */
3778 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
3780 MAXIMUM_ALLOWED_ACCESS
,
3781 CONST_DISCARD(struct dom_sid2
*, domain_sid
),
3783 if (!NT_STATUS_IS_OK(result
))
3790 result
= rpccli_samr_EnumDomainAliases(pipe_hnd
, mem_ctx
,
3796 for (i
= 0; i
< num_entries
; i
++) {
3798 struct policy_handle alias_pol
;
3799 struct full_alias alias
;
3800 struct lsa_SidArray sid_array
;
3803 result
= rpccli_samr_OpenAlias(pipe_hnd
, mem_ctx
,
3805 MAXIMUM_ALLOWED_ACCESS
,
3806 groups
->entries
[i
].idx
,
3808 if (!NT_STATUS_IS_OK(result
))
3811 result
= rpccli_samr_GetMembersInAlias(pipe_hnd
, mem_ctx
,
3814 if (!NT_STATUS_IS_OK(result
))
3817 alias
.num_members
= sid_array
.num_sids
;
3819 result
= rpccli_samr_Close(pipe_hnd
, mem_ctx
, &alias_pol
);
3820 if (!NT_STATUS_IS_OK(result
))
3823 alias
.members
= NULL
;
3825 if (alias
.num_members
> 0) {
3826 alias
.members
= SMB_MALLOC_ARRAY(DOM_SID
, alias
.num_members
);
3828 for (j
= 0; j
< alias
.num_members
; j
++)
3829 sid_copy(&alias
.members
[j
],
3830 sid_array
.sids
[j
].sid
);
3833 sid_copy(&alias
.sid
, domain_sid
);
3834 sid_append_rid(&alias
.sid
, groups
->entries
[i
].idx
);
3836 push_alias(mem_ctx
, &alias
);
3838 } while (NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
3840 result
= NT_STATUS_OK
;
3843 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &domain_pol
);
3849 * Dump server_aliases as names for debugging purposes.
3852 static NTSTATUS
rpc_aliaslist_dump(struct net_context
*c
,
3853 const DOM_SID
*domain_sid
,
3854 const char *domain_name
,
3855 struct cli_state
*cli
,
3856 struct rpc_pipe_client
*pipe_hnd
,
3857 TALLOC_CTX
*mem_ctx
,
3863 struct policy_handle lsa_pol
;
3865 result
= rpccli_lsa_open_policy(pipe_hnd
, mem_ctx
, true,
3866 SEC_FLAG_MAXIMUM_ALLOWED
,
3868 if (!NT_STATUS_IS_OK(result
))
3871 for (i
=0; i
<num_server_aliases
; i
++) {
3874 enum lsa_SidType
*types
;
3877 struct full_alias
*alias
= &server_aliases
[i
];
3879 result
= rpccli_lsa_lookup_sids(pipe_hnd
, mem_ctx
, &lsa_pol
, 1,
3881 &domains
, &names
, &types
);
3882 if (!NT_STATUS_IS_OK(result
))
3885 DEBUG(1, ("%s\\%s %d: ", domains
[0], names
[0], types
[0]));
3887 if (alias
->num_members
== 0) {
3892 result
= rpccli_lsa_lookup_sids(pipe_hnd
, mem_ctx
, &lsa_pol
,
3895 &domains
, &names
, &types
);
3897 if (!NT_STATUS_IS_OK(result
) &&
3898 !NT_STATUS_EQUAL(result
, STATUS_SOME_UNMAPPED
))
3901 for (j
=0; j
<alias
->num_members
; j
++)
3902 DEBUG(1, ("%s\\%s (%d); ",
3903 domains
[j
] ? domains
[j
] : "*unknown*",
3904 names
[j
] ? names
[j
] : "*unknown*",types
[j
]));
3908 rpccli_lsa_Close(pipe_hnd
, mem_ctx
, &lsa_pol
);
3910 return NT_STATUS_OK
;
3914 * Fetch a list of all server aliases and their members into
3918 static NTSTATUS
rpc_aliaslist_internals(struct net_context
*c
,
3919 const DOM_SID
*domain_sid
,
3920 const char *domain_name
,
3921 struct cli_state
*cli
,
3922 struct rpc_pipe_client
*pipe_hnd
,
3923 TALLOC_CTX
*mem_ctx
,
3928 struct policy_handle connect_pol
;
3930 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
3932 MAXIMUM_ALLOWED_ACCESS
,
3935 if (!NT_STATUS_IS_OK(result
))
3938 result
= rpc_fetch_domain_aliases(pipe_hnd
, mem_ctx
, &connect_pol
,
3939 &global_sid_Builtin
);
3941 if (!NT_STATUS_IS_OK(result
))
3944 result
= rpc_fetch_domain_aliases(pipe_hnd
, mem_ctx
, &connect_pol
,
3947 rpccli_samr_Close(pipe_hnd
, mem_ctx
, &connect_pol
);
3952 static void init_user_token(NT_USER_TOKEN
*token
, DOM_SID
*user_sid
)
3954 token
->num_sids
= 4;
3956 if (!(token
->user_sids
= SMB_MALLOC_ARRAY(DOM_SID
, 4))) {
3957 d_fprintf(stderr
, "malloc failed\n");
3958 token
->num_sids
= 0;
3962 token
->user_sids
[0] = *user_sid
;
3963 sid_copy(&token
->user_sids
[1], &global_sid_World
);
3964 sid_copy(&token
->user_sids
[2], &global_sid_Network
);
3965 sid_copy(&token
->user_sids
[3], &global_sid_Authenticated_Users
);
3968 static void free_user_token(NT_USER_TOKEN
*token
)
3970 SAFE_FREE(token
->user_sids
);
3973 static void add_sid_to_token(NT_USER_TOKEN
*token
, DOM_SID
*sid
)
3975 if (is_sid_in_token(token
, sid
))
3978 token
->user_sids
= SMB_REALLOC_ARRAY(token
->user_sids
, DOM_SID
, token
->num_sids
+1);
3979 if (!token
->user_sids
) {
3983 sid_copy(&token
->user_sids
[token
->num_sids
], sid
);
3985 token
->num_sids
+= 1;
3990 NT_USER_TOKEN token
;
3993 static void dump_user_token(struct user_token
*token
)
3997 d_printf("%s\n", token
->name
);
3999 for (i
=0; i
<token
->token
.num_sids
; i
++) {
4000 d_printf(" %s\n", sid_string_tos(&token
->token
.user_sids
[i
]));
4004 static bool is_alias_member(DOM_SID
*sid
, struct full_alias
*alias
)
4008 for (i
=0; i
<alias
->num_members
; i
++) {
4009 if (sid_compare(sid
, &alias
->members
[i
]) == 0)
4016 static void collect_sid_memberships(NT_USER_TOKEN
*token
, DOM_SID sid
)
4020 for (i
=0; i
<num_server_aliases
; i
++) {
4021 if (is_alias_member(&sid
, &server_aliases
[i
]))
4022 add_sid_to_token(token
, &server_aliases
[i
].sid
);
4027 * We got a user token with all the SIDs we can know about without asking the
4028 * server directly. These are the user and domain group sids. All of these can
4029 * be members of aliases. So scan the list of aliases for each of the SIDs and
4030 * add them to the token.
4033 static void collect_alias_memberships(NT_USER_TOKEN
*token
)
4035 int num_global_sids
= token
->num_sids
;
4038 for (i
=0; i
<num_global_sids
; i
++) {
4039 collect_sid_memberships(token
, token
->user_sids
[i
]);
4043 static bool get_user_sids(const char *domain
, const char *user
, NT_USER_TOKEN
*token
)
4045 wbcErr wbc_status
= WBC_ERR_UNKNOWN_FAILURE
;
4046 enum wbcSidType type
;
4048 struct wbcDomainSid wsid
;
4049 char *sid_str
= NULL
;
4051 uint32_t num_groups
;
4052 gid_t
*groups
= NULL
;
4055 fstr_sprintf(full_name
, "%s%c%s",
4056 domain
, *lp_winbind_separator(), user
);
4058 /* First let's find out the user sid */
4060 wbc_status
= wbcLookupName(domain
, user
, &wsid
, &type
);
4062 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4063 DEBUG(1, ("winbind could not find %s: %s\n",
4064 full_name
, wbcErrorString(wbc_status
)));
4068 wbc_status
= wbcSidToString(&wsid
, &sid_str
);
4069 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4073 if (type
!= SID_NAME_USER
) {
4074 wbcFreeMemory(sid_str
);
4075 DEBUG(1, ("%s is not a user\n", full_name
));
4079 if (!string_to_sid(&user_sid
, sid_str
)) {
4080 DEBUG(1,("Could not convert sid %s from string\n", sid_str
));
4084 wbcFreeMemory(sid_str
);
4087 init_user_token(token
, &user_sid
);
4089 /* And now the groups winbind knows about */
4091 wbc_status
= wbcGetGroups(full_name
, &num_groups
, &groups
);
4092 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4093 DEBUG(1, ("winbind could not get groups of %s: %s\n",
4094 full_name
, wbcErrorString(wbc_status
)));
4098 for (i
= 0; i
< num_groups
; i
++) {
4099 gid_t gid
= groups
[i
];
4102 wbc_status
= wbcGidToSid(gid
, &wsid
);
4103 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4104 DEBUG(1, ("winbind could not find SID of gid %u: %s\n",
4105 (unsigned int)gid
, wbcErrorString(wbc_status
)));
4106 wbcFreeMemory(groups
);
4110 wbc_status
= wbcSidToString(&wsid
, &sid_str
);
4111 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4112 wbcFreeMemory(groups
);
4116 DEBUG(3, (" %s\n", sid_str
));
4118 string_to_sid(&sid
, sid_str
);
4119 wbcFreeMemory(sid_str
);
4122 add_sid_to_token(token
, &sid
);
4124 wbcFreeMemory(groups
);
4130 * Get a list of all user tokens we want to look at
4133 static bool get_user_tokens(struct net_context
*c
, int *num_tokens
,
4134 struct user_token
**user_tokens
)
4136 wbcErr wbc_status
= WBC_ERR_UNKNOWN_FAILURE
;
4137 uint32_t i
, num_users
;
4139 struct user_token
*result
;
4140 TALLOC_CTX
*frame
= NULL
;
4142 if (lp_winbind_use_default_domain() &&
4143 (c
->opt_target_workgroup
== NULL
)) {
4144 d_fprintf(stderr
, "winbind use default domain = yes set, "
4145 "please specify a workgroup\n");
4149 /* Send request to winbind daemon */
4151 wbc_status
= wbcListUsers(NULL
, &num_users
, &users
);
4152 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4153 DEBUG(1, ("winbind could not list users: %s\n",
4154 wbcErrorString(wbc_status
)));
4158 result
= SMB_MALLOC_ARRAY(struct user_token
, num_users
);
4160 if (result
== NULL
) {
4161 DEBUG(1, ("Could not malloc sid array\n"));
4162 wbcFreeMemory(users
);
4166 frame
= talloc_stackframe();
4167 for (i
=0; i
< num_users
; i
++) {
4168 fstring domain
, user
;
4171 fstrcpy(result
[i
].name
, users
[i
]);
4173 p
= strchr(users
[i
], *lp_winbind_separator());
4175 DEBUG(3, ("%s\n", users
[i
]));
4178 fstrcpy(domain
, c
->opt_target_workgroup
);
4179 fstrcpy(user
, users
[i
]);
4182 fstrcpy(domain
, users
[i
]);
4187 get_user_sids(domain
, user
, &(result
[i
].token
));
4191 wbcFreeMemory(users
);
4193 *num_tokens
= num_users
;
4194 *user_tokens
= result
;
4199 static bool get_user_tokens_from_file(FILE *f
,
4201 struct user_token
**tokens
)
4203 struct user_token
*token
= NULL
;
4208 if (fgets(line
, sizeof(line
)-1, f
) == NULL
) {
4212 if (line
[strlen(line
)-1] == '\n')
4213 line
[strlen(line
)-1] = '\0';
4215 if (line
[0] == ' ') {
4219 if(!string_to_sid(&sid
, &line
[1])) {
4220 DEBUG(1,("get_user_tokens_from_file: Could "
4221 "not convert sid %s \n",&line
[1]));
4225 if (token
== NULL
) {
4226 DEBUG(0, ("File does not begin with username"));
4230 add_sid_to_token(&token
->token
, &sid
);
4234 /* And a new user... */
4237 *tokens
= SMB_REALLOC_ARRAY(*tokens
, struct user_token
, *num_tokens
);
4238 if (*tokens
== NULL
) {
4239 DEBUG(0, ("Could not realloc tokens\n"));
4243 token
= &((*tokens
)[*num_tokens
-1]);
4245 fstrcpy(token
->name
, line
);
4246 token
->token
.num_sids
= 0;
4247 token
->token
.user_sids
= NULL
;
4256 * Show the list of all users that have access to a share
4259 static void show_userlist(struct rpc_pipe_client
*pipe_hnd
,
4260 TALLOC_CTX
*mem_ctx
,
4261 const char *netname
,
4263 struct user_token
*tokens
)
4266 SEC_DESC
*share_sd
= NULL
;
4267 SEC_DESC
*root_sd
= NULL
;
4268 struct cli_state
*cli
= rpc_pipe_np_smb_conn(pipe_hnd
);
4270 union srvsvc_NetShareInfo info
;
4275 status
= rpccli_srvsvc_NetShareGetInfo(pipe_hnd
, mem_ctx
,
4282 if (!NT_STATUS_IS_OK(status
) || !W_ERROR_IS_OK(result
)) {
4283 DEBUG(1, ("Coult not query secdesc for share %s\n",
4288 share_sd
= info
.info502
->sd_buf
.sd
;
4289 if (share_sd
== NULL
) {
4290 DEBUG(1, ("Got no secdesc for share %s\n",
4296 if (!NT_STATUS_IS_OK(cli_tcon_andx(cli
, netname
, "A:", "", 0))) {
4300 if (!NT_STATUS_IS_OK(cli_ntcreate(cli
, "\\", 0, READ_CONTROL_ACCESS
, 0,
4301 FILE_SHARE_READ
|FILE_SHARE_WRITE
, FILE_OPEN
, 0x0, 0x0, &fnum
))) {
4302 root_sd
= cli_query_secdesc(cli
, fnum
, mem_ctx
);
4305 for (i
=0; i
<num_tokens
; i
++) {
4308 if (share_sd
!= NULL
) {
4309 status
= se_access_check(share_sd
, &tokens
[i
].token
,
4312 if (!NT_STATUS_IS_OK(status
)) {
4313 DEBUG(1, ("Could not check share_sd for "
4320 if (root_sd
== NULL
) {
4321 d_printf(" %s\n", tokens
[i
].name
);
4325 status
= se_access_check(root_sd
, &tokens
[i
].token
,
4327 if (!NT_STATUS_IS_OK(status
)) {
4328 DEBUG(1, ("Could not check root_sd for user %s\n",
4332 d_printf(" %s\n", tokens
[i
].name
);
4335 if (fnum
!= (uint16_t)-1)
4336 cli_close(cli
, fnum
);
4348 static void collect_share(const char *name
, uint32 m
,
4349 const char *comment
, void *state
)
4351 struct share_list
*share_list
= (struct share_list
*)state
;
4353 if (m
!= STYPE_DISKTREE
)
4356 share_list
->num_shares
+= 1;
4357 share_list
->shares
= SMB_REALLOC_ARRAY(share_list
->shares
, char *, share_list
->num_shares
);
4358 if (!share_list
->shares
) {
4359 share_list
->num_shares
= 0;
4362 share_list
->shares
[share_list
->num_shares
-1] = SMB_STRDUP(name
);
4366 * List shares on a remote RPC server, including the security descriptors.
4368 * All parameters are provided by the run_rpc_command function, except for
4369 * argc, argv which are passed through.
4371 * @param domain_sid The domain sid acquired from the remote server.
4372 * @param cli A cli_state connected to the server.
4373 * @param mem_ctx Talloc context, destroyed on completion of the function.
4374 * @param argc Standard main() style argc.
4375 * @param argv Standard main() style argv. Initial components are already
4378 * @return Normal NTSTATUS return.
4381 static NTSTATUS
rpc_share_allowedusers_internals(struct net_context
*c
,
4382 const DOM_SID
*domain_sid
,
4383 const char *domain_name
,
4384 struct cli_state
*cli
,
4385 struct rpc_pipe_client
*pipe_hnd
,
4386 TALLOC_CTX
*mem_ctx
,
4395 struct user_token
*tokens
= NULL
;
4398 struct share_list share_list
;
4403 f
= fopen(argv
[0], "r");
4407 DEBUG(0, ("Could not open userlist: %s\n", strerror(errno
)));
4408 return NT_STATUS_UNSUCCESSFUL
;
4411 r
= get_user_tokens_from_file(f
, &num_tokens
, &tokens
);
4417 DEBUG(0, ("Could not read users from file\n"));
4418 return NT_STATUS_UNSUCCESSFUL
;
4421 for (i
=0; i
<num_tokens
; i
++)
4422 collect_alias_memberships(&tokens
[i
].token
);
4424 share_list
.num_shares
= 0;
4425 share_list
.shares
= NULL
;
4427 ret
= cli_RNetShareEnum(cli
, collect_share
, &share_list
);
4430 DEBUG(0, ("Error returning browse list: %s\n",
4435 for (i
= 0; i
< share_list
.num_shares
; i
++) {
4436 char *netname
= share_list
.shares
[i
];
4438 if (netname
[strlen(netname
)-1] == '$')
4441 d_printf("%s\n", netname
);
4443 show_userlist(pipe_hnd
, mem_ctx
, netname
,
4444 num_tokens
, tokens
);
4447 for (i
=0; i
<num_tokens
; i
++) {
4448 free_user_token(&tokens
[i
].token
);
4451 SAFE_FREE(share_list
.shares
);
4453 return NT_STATUS_OK
;
4456 static int rpc_share_allowedusers(struct net_context
*c
, int argc
,
4461 if (c
->display_usage
) {
4463 "net rpc share allowedusers\n"
4464 " List allowed users\n");
4468 result
= run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
, 0,
4469 rpc_aliaslist_internals
,
4474 result
= run_rpc_command(c
, NULL
, &ndr_table_lsarpc
.syntax_id
, 0,
4480 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
.syntax_id
, 0,
4481 rpc_share_allowedusers_internals
,
4485 int net_usersidlist(struct net_context
*c
, int argc
, const char **argv
)
4488 struct user_token
*tokens
= NULL
;
4492 net_usersidlist_usage(c
, argc
, argv
);
4496 if (!get_user_tokens(c
, &num_tokens
, &tokens
)) {
4497 DEBUG(0, ("Could not get the user/sid list\n"));
4501 for (i
=0; i
<num_tokens
; i
++) {
4502 dump_user_token(&tokens
[i
]);
4503 free_user_token(&tokens
[i
].token
);
4510 int net_usersidlist_usage(struct net_context
*c
, int argc
, const char **argv
)
4512 d_printf("net usersidlist\n"
4513 "\tprints out a list of all users the running winbind knows\n"
4514 "\tabout, together with all their SIDs. This is used as\n"
4515 "\tinput to the 'net rpc share allowedusers' command.\n\n");
4517 net_common_flags_usage(c
, argc
, argv
);
4522 * 'net rpc share' entrypoint.
4523 * @param argc Standard main() style argc.
4524 * @param argv Standard main() style argv. Initial components are already
4528 int net_rpc_share(struct net_context
*c
, int argc
, const char **argv
)
4530 NET_API_STATUS status
;
4532 struct functable func
[] = {
4538 "net rpc share add\n"
4546 "net rpc share delete\n"
4551 rpc_share_allowedusers
,
4553 "Modify allowed users",
4554 "net rpc share allowedusers\n"
4555 " Modify allowed users"
4561 "Migrate share to local server",
4562 "net rpc share migrate\n"
4563 " Migrate share to local server"
4570 "net rpc share list\n"
4573 {NULL
, NULL
, 0, NULL
, NULL
}
4576 status
= libnetapi_init(&c
->netapi_ctx
);
4580 set_cmdline_auth_info_getpass(c
->auth_info
);
4581 libnetapi_set_username(c
->netapi_ctx
,
4582 get_cmdline_auth_info_username(c
->auth_info
));
4583 libnetapi_set_password(c
->netapi_ctx
,
4584 get_cmdline_auth_info_password(c
->auth_info
));
4585 if (get_cmdline_auth_info_use_kerberos(c
->auth_info
)) {
4586 libnetapi_set_use_kerberos(c
->netapi_ctx
);
4590 if (c
->display_usage
) {
4594 " Alias for net rpc share list\n");
4595 net_display_usage_from_functable(func
);
4599 return rpc_share_list(c
, argc
, argv
);
4602 return net_run_function(c
, argc
, argv
, "net rpc share", func
);
4605 static NTSTATUS
rpc_sh_share_list(struct net_context
*c
,
4606 TALLOC_CTX
*mem_ctx
,
4607 struct rpc_sh_ctx
*ctx
,
4608 struct rpc_pipe_client
*pipe_hnd
,
4609 int argc
, const char **argv
)
4612 return werror_to_ntstatus(W_ERROR(rpc_share_list(c
, argc
, argv
)));
4615 static NTSTATUS
rpc_sh_share_add(struct net_context
*c
,
4616 TALLOC_CTX
*mem_ctx
,
4617 struct rpc_sh_ctx
*ctx
,
4618 struct rpc_pipe_client
*pipe_hnd
,
4619 int argc
, const char **argv
)
4621 NET_API_STATUS status
;
4622 uint32_t parm_err
= 0;
4623 struct SHARE_INFO_2 i2
;
4625 if ((argc
< 2) || (argc
> 3)) {
4626 d_fprintf(stderr
, "usage: %s <share> <path> [comment]\n",
4628 return NT_STATUS_INVALID_PARAMETER
;
4631 i2
.shi2_netname
= argv
[0];
4632 i2
.shi2_type
= STYPE_DISKTREE
;
4633 i2
.shi2_remark
= (argc
== 3) ? argv
[2] : "";
4634 i2
.shi2_permissions
= 0;
4635 i2
.shi2_max_uses
= 0;
4636 i2
.shi2_current_uses
= 0;
4637 i2
.shi2_path
= argv
[1];
4638 i2
.shi2_passwd
= NULL
;
4640 status
= NetShareAdd(pipe_hnd
->desthost
,
4645 return werror_to_ntstatus(W_ERROR(status
));
4648 static NTSTATUS
rpc_sh_share_delete(struct net_context
*c
,
4649 TALLOC_CTX
*mem_ctx
,
4650 struct rpc_sh_ctx
*ctx
,
4651 struct rpc_pipe_client
*pipe_hnd
,
4652 int argc
, const char **argv
)
4655 d_fprintf(stderr
, "usage: %s <share>\n", ctx
->whoami
);
4656 return NT_STATUS_INVALID_PARAMETER
;
4659 return werror_to_ntstatus(W_ERROR(NetShareDel(pipe_hnd
->desthost
, argv
[0], 0)));
4662 static NTSTATUS
rpc_sh_share_info(struct net_context
*c
,
4663 TALLOC_CTX
*mem_ctx
,
4664 struct rpc_sh_ctx
*ctx
,
4665 struct rpc_pipe_client
*pipe_hnd
,
4666 int argc
, const char **argv
)
4668 union srvsvc_NetShareInfo info
;
4673 d_fprintf(stderr
, "usage: %s <share>\n", ctx
->whoami
);
4674 return NT_STATUS_INVALID_PARAMETER
;
4677 status
= rpccli_srvsvc_NetShareGetInfo(pipe_hnd
, mem_ctx
,
4683 if (!NT_STATUS_IS_OK(status
) || !W_ERROR_IS_OK(result
)) {
4687 d_printf("Name: %s\n", info
.info2
->name
);
4688 d_printf("Comment: %s\n", info
.info2
->comment
);
4689 d_printf("Path: %s\n", info
.info2
->path
);
4690 d_printf("Password: %s\n", info
.info2
->password
);
4693 return werror_to_ntstatus(result
);
4696 struct rpc_sh_cmd
*net_rpc_share_cmds(struct net_context
*c
, TALLOC_CTX
*mem_ctx
,
4697 struct rpc_sh_ctx
*ctx
)
4699 static struct rpc_sh_cmd cmds
[] = {
4701 { "list", NULL
, &ndr_table_srvsvc
.syntax_id
, rpc_sh_share_list
,
4702 "List available shares" },
4704 { "add", NULL
, &ndr_table_srvsvc
.syntax_id
, rpc_sh_share_add
,
4707 { "delete", NULL
, &ndr_table_srvsvc
.syntax_id
, rpc_sh_share_delete
,
4710 { "info", NULL
, &ndr_table_srvsvc
.syntax_id
, rpc_sh_share_info
,
4711 "Get information about a share" },
4713 { NULL
, NULL
, 0, NULL
, NULL
}
4719 /****************************************************************************/
4721 static int rpc_file_usage(struct net_context
*c
, int argc
, const char **argv
)
4723 return net_file_usage(c
, argc
, argv
);
4727 * Close a file on a remote RPC server.
4729 * @param argc Standard main() style argc.
4730 * @param argv Standard main() style argv. Initial components are already
4733 * @return A shell status integer (0 for success).
4735 static int rpc_file_close(struct net_context
*c
, int argc
, const char **argv
)
4737 if (argc
< 1 || c
->display_usage
) {
4738 return rpc_file_usage(c
, argc
, argv
);
4741 return NetFileClose(c
->opt_host
, atoi(argv
[0]));
4745 * Formatted print of open file info
4747 * @param r struct FILE_INFO_3 contents
4750 static void display_file_info_3(struct FILE_INFO_3
*r
)
4752 d_printf("%-7.1d %-20.20s 0x%-4.2x %-6.1d %s\n",
4753 r
->fi3_id
, r
->fi3_username
, r
->fi3_permissions
,
4754 r
->fi3_num_locks
, r
->fi3_pathname
);
4758 * List files for a user on a remote RPC server.
4760 * @param argc Standard main() style argc.
4761 * @param argv Standard main() style argv. Initial components are already
4764 * @return A shell status integer (0 for success)..
4767 static int rpc_file_user(struct net_context
*c
, int argc
, const char **argv
)
4769 NET_API_STATUS status
;
4770 uint32 preferred_len
= 0xffffffff, i
;
4771 const char *username
=NULL
;
4772 uint32_t total_entries
= 0;
4773 uint32_t entries_read
= 0;
4774 uint32_t resume_handle
= 0;
4775 struct FILE_INFO_3
*i3
= NULL
;
4777 if (c
->display_usage
) {
4778 return rpc_file_usage(c
, argc
, argv
);
4781 /* if argc > 0, must be user command */
4783 username
= smb_xstrdup(argv
[0]);
4786 status
= NetFileEnum(c
->opt_host
,
4790 (uint8_t **)(void *)&i3
,
4800 /* Display results */
4803 "\nEnumerating open files on remote server:\n\n"
4804 "\nFileId Opened by Perms Locks Path"
4805 "\n------ --------- ----- ----- ---- \n");
4806 for (i
= 0; i
< entries_read
; i
++) {
4807 display_file_info_3(&i3
[i
]);
4814 * 'net rpc file' entrypoint.
4815 * @param argc Standard main() style argc.
4816 * @param argv Standard main() style argv. Initial components are already
4820 int net_rpc_file(struct net_context
*c
, int argc
, const char **argv
)
4822 NET_API_STATUS status
;
4824 struct functable func
[] = {
4829 "Close opened file",
4830 "net rpc file close\n"
4831 " Close opened file"
4837 "List files opened by user",
4838 "net rpc file user\n"
4839 " List files opened by user"
4846 "Display information about opened file",
4847 "net rpc file info\n"
4848 " Display information about opened file"
4851 {NULL
, NULL
, 0, NULL
, NULL
}
4854 status
= libnetapi_init(&c
->netapi_ctx
);
4858 set_cmdline_auth_info_getpass(c
->auth_info
);
4859 libnetapi_set_username(c
->netapi_ctx
,
4860 get_cmdline_auth_info_username(c
->auth_info
));
4861 libnetapi_set_password(c
->netapi_ctx
,
4862 get_cmdline_auth_info_password(c
->auth_info
));
4863 if (get_cmdline_auth_info_use_kerberos(c
->auth_info
)) {
4864 libnetapi_set_use_kerberos(c
->netapi_ctx
);
4868 if (c
->display_usage
) {
4869 d_printf("Usage:\n");
4870 d_printf("net rpc file\n"
4871 " List opened files\n");
4872 net_display_usage_from_functable(func
);
4876 return rpc_file_user(c
, argc
, argv
);
4879 return net_run_function(c
, argc
, argv
, "net rpc file", func
);
4883 * ABORT the shutdown of a remote RPC Server, over initshutdown pipe.
4885 * All parameters are provided by the run_rpc_command function, except for
4886 * argc, argv which are passed through.
4888 * @param c A net_context structure.
4889 * @param domain_sid The domain sid acquired from the remote server.
4890 * @param cli A cli_state connected to the server.
4891 * @param mem_ctx Talloc context, destroyed on completion of the function.
4892 * @param argc Standard main() style argc.
4893 * @param argv Standard main() style argv. Initial components are already
4896 * @return Normal NTSTATUS return.
4899 static NTSTATUS
rpc_shutdown_abort_internals(struct net_context
*c
,
4900 const DOM_SID
*domain_sid
,
4901 const char *domain_name
,
4902 struct cli_state
*cli
,
4903 struct rpc_pipe_client
*pipe_hnd
,
4904 TALLOC_CTX
*mem_ctx
,
4908 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
4910 result
= rpccli_initshutdown_Abort(pipe_hnd
, mem_ctx
, NULL
, NULL
);
4912 if (NT_STATUS_IS_OK(result
)) {
4913 d_printf("\nShutdown successfully aborted\n");
4914 DEBUG(5,("cmd_shutdown_abort: query succeeded\n"));
4916 DEBUG(5,("cmd_shutdown_abort: query failed\n"));
4922 * ABORT the shutdown of a remote RPC Server, over winreg pipe.
4924 * All parameters are provided by the run_rpc_command function, except for
4925 * argc, argv which are passed through.
4927 * @param c A net_context structure.
4928 * @param domain_sid The domain sid acquired from the remote server.
4929 * @param cli A cli_state connected to the server.
4930 * @param mem_ctx Talloc context, destroyed on completion of the function.
4931 * @param argc Standard main() style argc.
4932 * @param argv Standard main() style argv. Initial components are already
4935 * @return Normal NTSTATUS return.
4938 static NTSTATUS
rpc_reg_shutdown_abort_internals(struct net_context
*c
,
4939 const DOM_SID
*domain_sid
,
4940 const char *domain_name
,
4941 struct cli_state
*cli
,
4942 struct rpc_pipe_client
*pipe_hnd
,
4943 TALLOC_CTX
*mem_ctx
,
4947 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
4949 result
= rpccli_winreg_AbortSystemShutdown(pipe_hnd
, mem_ctx
, NULL
, NULL
);
4951 if (NT_STATUS_IS_OK(result
)) {
4952 d_printf("\nShutdown successfully aborted\n");
4953 DEBUG(5,("cmd_reg_abort_shutdown: query succeeded\n"));
4955 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
4961 * ABORT the shutdown of a remote RPC server.
4963 * @param argc Standard main() style argc.
4964 * @param argv Standard main() style argv. Initial components are already
4967 * @return A shell status integer (0 for success).
4970 static int rpc_shutdown_abort(struct net_context
*c
, int argc
,
4975 if (c
->display_usage
) {
4977 "net rpc abortshutdown\n"
4978 " Abort a scheduled shutdown\n");
4982 rc
= run_rpc_command(c
, NULL
, &ndr_table_initshutdown
.syntax_id
, 0,
4983 rpc_shutdown_abort_internals
, argc
, argv
);
4988 DEBUG(1, ("initshutdown pipe didn't work, trying winreg pipe\n"));
4990 return run_rpc_command(c
, NULL
, &ndr_table_winreg
.syntax_id
, 0,
4991 rpc_reg_shutdown_abort_internals
,
4996 * Shut down a remote RPC Server via initshutdown pipe.
4998 * All parameters are provided by the run_rpc_command function, except for
4999 * argc, argv which are passed through.
5001 * @param c A net_context structure.
5002 * @param domain_sid The domain sid acquired from the remote server.
5003 * @param cli A cli_state connected to the server.
5004 * @param mem_ctx Talloc context, destroyed on completion of the function.
5005 * @param argc Standard main() style argc.
5006 * @param argv Standard main() style argv. Initial components are already
5009 * @return Normal NTSTATUS return.
5012 NTSTATUS
rpc_init_shutdown_internals(struct net_context
*c
,
5013 const DOM_SID
*domain_sid
,
5014 const char *domain_name
,
5015 struct cli_state
*cli
,
5016 struct rpc_pipe_client
*pipe_hnd
,
5017 TALLOC_CTX
*mem_ctx
,
5021 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
5022 const char *msg
= "This machine will be shutdown shortly";
5023 uint32 timeout
= 20;
5024 struct lsa_StringLarge msg_string
;
5026 if (c
->opt_comment
) {
5027 msg
= c
->opt_comment
;
5029 if (c
->opt_timeout
) {
5030 timeout
= c
->opt_timeout
;
5033 msg_string
.string
= msg
;
5035 /* create an entry */
5036 result
= rpccli_initshutdown_Init(pipe_hnd
, mem_ctx
, NULL
,
5037 &msg_string
, timeout
, c
->opt_force
, c
->opt_reboot
,
5040 if (NT_STATUS_IS_OK(result
)) {
5041 d_printf("\nShutdown of remote machine succeeded\n");
5042 DEBUG(5,("Shutdown of remote machine succeeded\n"));
5044 DEBUG(1,("Shutdown of remote machine failed!\n"));
5050 * Shut down a remote RPC Server via winreg pipe.
5052 * All parameters are provided by the run_rpc_command function, except for
5053 * argc, argv which are passed through.
5055 * @param c A net_context structure.
5056 * @param domain_sid The domain sid acquired from the remote server.
5057 * @param cli A cli_state connected to the server.
5058 * @param mem_ctx Talloc context, destroyed on completion of the function.
5059 * @param argc Standard main() style argc.
5060 * @param argv Standard main() style argv. Initial components are already
5063 * @return Normal NTSTATUS return.
5066 NTSTATUS
rpc_reg_shutdown_internals(struct net_context
*c
,
5067 const DOM_SID
*domain_sid
,
5068 const char *domain_name
,
5069 struct cli_state
*cli
,
5070 struct rpc_pipe_client
*pipe_hnd
,
5071 TALLOC_CTX
*mem_ctx
,
5075 const char *msg
= "This machine will be shutdown shortly";
5076 uint32 timeout
= 20;
5077 struct lsa_StringLarge msg_string
;
5081 if (c
->opt_comment
) {
5082 msg
= c
->opt_comment
;
5084 msg_string
.string
= msg
;
5086 if (c
->opt_timeout
) {
5087 timeout
= c
->opt_timeout
;
5090 /* create an entry */
5091 result
= rpccli_winreg_InitiateSystemShutdown(pipe_hnd
, mem_ctx
, NULL
,
5092 &msg_string
, timeout
, c
->opt_force
, c
->opt_reboot
,
5095 if (NT_STATUS_IS_OK(result
)) {
5096 d_printf("\nShutdown of remote machine succeeded\n");
5098 d_fprintf(stderr
, "\nShutdown of remote machine failed\n");
5099 if ( W_ERROR_EQUAL(werr
, WERR_MACHINE_LOCKED
) )
5100 d_fprintf(stderr
, "\nMachine locked, use -f switch to force\n");
5102 d_fprintf(stderr
, "\nresult was: %s\n", win_errstr(werr
));
5109 * Shut down a remote RPC server.
5111 * @param argc Standard main() style argc.
5112 * @param argv Standard main() style argv. Initial components are already
5115 * @return A shell status integer (0 for success).
5118 static int rpc_shutdown(struct net_context
*c
, int argc
, const char **argv
)
5122 if (c
->display_usage
) {
5124 "net rpc shutdown\n"
5125 " Shut down a remote RPC server\n");
5129 rc
= run_rpc_command(c
, NULL
, &ndr_table_initshutdown
.syntax_id
, 0,
5130 rpc_init_shutdown_internals
, argc
, argv
);
5133 DEBUG(1, ("initshutdown pipe failed, trying winreg pipe\n"));
5134 rc
= run_rpc_command(c
, NULL
, &ndr_table_winreg
.syntax_id
, 0,
5135 rpc_reg_shutdown_internals
, argc
, argv
);
5141 /***************************************************************************
5142 NT Domain trusts code (i.e. 'net rpc trustdom' functionality)
5143 ***************************************************************************/
5146 * Add interdomain trust account to the RPC server.
5147 * All parameters (except for argc and argv) are passed by run_rpc_command
5150 * @param c A net_context structure.
5151 * @param domain_sid The domain sid acquired from the server.
5152 * @param cli A cli_state connected to the server.
5153 * @param mem_ctx Talloc context, destroyed on completion of the function.
5154 * @param argc Standard main() style argc.
5155 * @param argv Standard main() style argv. Initial components are already
5158 * @return normal NTSTATUS return code.
5161 static NTSTATUS
rpc_trustdom_add_internals(struct net_context
*c
,
5162 const DOM_SID
*domain_sid
,
5163 const char *domain_name
,
5164 struct cli_state
*cli
,
5165 struct rpc_pipe_client
*pipe_hnd
,
5166 TALLOC_CTX
*mem_ctx
,
5170 struct policy_handle connect_pol
, domain_pol
, user_pol
;
5171 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
5173 struct lsa_String lsa_acct_name
;
5175 uint32 acct_flags
=0;
5177 uint32_t access_granted
= 0;
5178 union samr_UserInfo info
;
5179 unsigned int orig_timeout
;
5182 d_printf("Usage: net rpc trustdom add <domain_name> "
5183 "<trust password>\n");
5184 return NT_STATUS_INVALID_PARAMETER
;
5188 * Make valid trusting domain account (ie. uppercased and with '$' appended)
5191 if (asprintf(&acct_name
, "%s$", argv
[0]) < 0) {
5192 return NT_STATUS_NO_MEMORY
;
5195 strupper_m(acct_name
);
5197 init_lsa_String(&lsa_acct_name
, acct_name
);
5199 /* Get samr policy handle */
5200 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
5202 MAXIMUM_ALLOWED_ACCESS
,
5204 if (!NT_STATUS_IS_OK(result
)) {
5208 /* Get domain policy handle */
5209 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
5211 MAXIMUM_ALLOWED_ACCESS
,
5212 CONST_DISCARD(struct dom_sid2
*, domain_sid
),
5214 if (!NT_STATUS_IS_OK(result
)) {
5218 /* This call can take a long time - allow the server to time out.
5219 * 35 seconds should do it. */
5221 orig_timeout
= rpccli_set_timeout(pipe_hnd
, 35000);
5223 /* Create trusting domain's account */
5224 acb_info
= ACB_NORMAL
;
5225 acct_flags
= SEC_GENERIC_READ
| SEC_GENERIC_WRITE
| SEC_GENERIC_EXECUTE
|
5226 SEC_STD_WRITE_DAC
| SEC_STD_DELETE
|
5227 SAMR_USER_ACCESS_SET_PASSWORD
|
5228 SAMR_USER_ACCESS_GET_ATTRIBUTES
|
5229 SAMR_USER_ACCESS_SET_ATTRIBUTES
;
5231 result
= rpccli_samr_CreateUser2(pipe_hnd
, mem_ctx
,
5240 /* And restore our original timeout. */
5241 rpccli_set_timeout(pipe_hnd
, orig_timeout
);
5243 if (!NT_STATUS_IS_OK(result
)) {
5244 d_printf("net rpc trustdom add: create user %s failed %s\n",
5245 acct_name
, nt_errstr(result
));
5250 struct samr_CryptPassword crypt_pwd
;
5252 ZERO_STRUCT(info
.info23
);
5254 init_samr_CryptPassword(argv
[1],
5255 &cli
->user_session_key
,
5258 info
.info23
.info
.fields_present
= SAMR_FIELD_ACCT_FLAGS
|
5259 SAMR_FIELD_NT_PASSWORD_PRESENT
;
5260 info
.info23
.info
.acct_flags
= ACB_DOMTRUST
;
5261 info
.info23
.password
= crypt_pwd
;
5263 result
= rpccli_samr_SetUserInfo2(pipe_hnd
, mem_ctx
,
5268 if (!NT_STATUS_IS_OK(result
)) {
5269 DEBUG(0,("Could not set trust account password: %s\n",
5270 nt_errstr(result
)));
5276 SAFE_FREE(acct_name
);
5281 * Create interdomain trust account for a remote domain.
5283 * @param argc Standard argc.
5284 * @param argv Standard argv without initial components.
5286 * @return Integer status (0 means success).
5289 static int rpc_trustdom_add(struct net_context
*c
, int argc
, const char **argv
)
5291 if (argc
> 0 && !c
->display_usage
) {
5292 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
, 0,
5293 rpc_trustdom_add_internals
, argc
, argv
);
5296 "net rpc trustdom add <domain_name> <trust password>\n");
5303 * Remove interdomain trust account from the RPC server.
5304 * All parameters (except for argc and argv) are passed by run_rpc_command
5307 * @param c A net_context structure.
5308 * @param domain_sid The domain sid acquired from the server.
5309 * @param cli A cli_state connected to the server.
5310 * @param mem_ctx Talloc context, destroyed on completion of the function.
5311 * @param argc Standard main() style argc.
5312 * @param argv Standard main() style argv. Initial components are already
5315 * @return normal NTSTATUS return code.
5318 static NTSTATUS
rpc_trustdom_del_internals(struct net_context
*c
,
5319 const DOM_SID
*domain_sid
,
5320 const char *domain_name
,
5321 struct cli_state
*cli
,
5322 struct rpc_pipe_client
*pipe_hnd
,
5323 TALLOC_CTX
*mem_ctx
,
5327 struct policy_handle connect_pol
, domain_pol
, user_pol
;
5328 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
5330 DOM_SID trust_acct_sid
;
5331 struct samr_Ids user_rids
, name_types
;
5332 struct lsa_String lsa_acct_name
;
5335 d_printf("Usage: net rpc trustdom del <domain_name>\n");
5336 return NT_STATUS_INVALID_PARAMETER
;
5340 * Make valid trusting domain account (ie. uppercased and with '$' appended)
5342 acct_name
= talloc_asprintf(mem_ctx
, "%s$", argv
[0]);
5344 if (acct_name
== NULL
)
5345 return NT_STATUS_NO_MEMORY
;
5347 strupper_m(acct_name
);
5349 /* Get samr policy handle */
5350 result
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
5352 MAXIMUM_ALLOWED_ACCESS
,
5354 if (!NT_STATUS_IS_OK(result
)) {
5358 /* Get domain policy handle */
5359 result
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
5361 MAXIMUM_ALLOWED_ACCESS
,
5362 CONST_DISCARD(struct dom_sid2
*, domain_sid
),
5364 if (!NT_STATUS_IS_OK(result
)) {
5368 init_lsa_String(&lsa_acct_name
, acct_name
);
5370 result
= rpccli_samr_LookupNames(pipe_hnd
, mem_ctx
,
5377 if (!NT_STATUS_IS_OK(result
)) {
5378 d_printf("net rpc trustdom del: LookupNames on user %s failed %s\n",
5379 acct_name
, nt_errstr(result
) );
5383 result
= rpccli_samr_OpenUser(pipe_hnd
, mem_ctx
,
5385 MAXIMUM_ALLOWED_ACCESS
,
5389 if (!NT_STATUS_IS_OK(result
)) {
5390 d_printf("net rpc trustdom del: OpenUser on user %s failed %s\n",
5391 acct_name
, nt_errstr(result
) );
5395 /* append the rid to the domain sid */
5396 sid_copy(&trust_acct_sid
, domain_sid
);
5397 if (!sid_append_rid(&trust_acct_sid
, user_rids
.ids
[0])) {
5401 /* remove the sid */
5403 result
= rpccli_samr_RemoveMemberFromForeignDomain(pipe_hnd
, mem_ctx
,
5406 if (!NT_STATUS_IS_OK(result
)) {
5407 d_printf("net rpc trustdom del: RemoveMemberFromForeignDomain on user %s failed %s\n",
5408 acct_name
, nt_errstr(result
) );
5414 result
= rpccli_samr_DeleteUser(pipe_hnd
, mem_ctx
,
5417 if (!NT_STATUS_IS_OK(result
)) {
5418 d_printf("net rpc trustdom del: DeleteUser on user %s failed %s\n",
5419 acct_name
, nt_errstr(result
) );
5423 if (!NT_STATUS_IS_OK(result
)) {
5424 d_printf("Could not set trust account password: %s\n",
5434 * Delete interdomain trust account for a remote domain.
5436 * @param argc Standard argc.
5437 * @param argv Standard argv without initial components.
5439 * @return Integer status (0 means success).
5442 static int rpc_trustdom_del(struct net_context
*c
, int argc
, const char **argv
)
5444 if (argc
> 0 && !c
->display_usage
) {
5445 return run_rpc_command(c
, NULL
, &ndr_table_samr
.syntax_id
, 0,
5446 rpc_trustdom_del_internals
, argc
, argv
);
5449 "net rpc trustdom del <domain>\n");
5454 static NTSTATUS
rpc_trustdom_get_pdc(struct net_context
*c
,
5455 struct cli_state
*cli
,
5456 TALLOC_CTX
*mem_ctx
,
5457 const char *domain_name
)
5459 char *dc_name
= NULL
;
5460 const char *buffer
= NULL
;
5461 struct rpc_pipe_client
*netr
;
5464 /* Use NetServerEnum2 */
5466 if (cli_get_pdc_name(cli
, domain_name
, &dc_name
)) {
5468 return NT_STATUS_OK
;
5471 DEBUG(1,("NetServerEnum2 error: Couldn't find primary domain controller\
5472 for domain %s\n", domain_name
));
5474 /* Try netr_GetDcName */
5476 status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_netlogon
.syntax_id
,
5478 if (!NT_STATUS_IS_OK(status
)) {
5482 status
= rpccli_netr_GetDcName(netr
, mem_ctx
,
5489 if (NT_STATUS_IS_OK(status
)) {
5493 DEBUG(1,("netr_GetDcName error: Couldn't find primary domain controller\
5494 for domain %s\n", domain_name
));
5500 * Establish trust relationship to a trusting domain.
5501 * Interdomain account must already be created on remote PDC.
5503 * @param c A net_context structure.
5504 * @param argc Standard argc.
5505 * @param argv Standard argv without initial components.
5507 * @return Integer status (0 means success).
5510 static int rpc_trustdom_establish(struct net_context
*c
, int argc
,
5513 struct cli_state
*cli
= NULL
;
5514 struct sockaddr_storage server_ss
;
5515 struct rpc_pipe_client
*pipe_hnd
= NULL
;
5516 struct policy_handle connect_hnd
;
5517 TALLOC_CTX
*mem_ctx
;
5519 DOM_SID
*domain_sid
;
5524 union lsa_PolicyInformation
*info
= NULL
;
5527 * Connect to \\server\ipc$ as 'our domain' account with password
5530 if (argc
!= 1 || c
->display_usage
) {
5532 "net rpc trustdom establish <domain_name>\n");
5536 domain_name
= smb_xstrdup(argv
[0]);
5537 strupper_m(domain_name
);
5539 /* account name used at first is our domain's name with '$' */
5540 if (asprintf(&acct_name
, "%s$", lp_workgroup()) == -1) {
5543 strupper_m(acct_name
);
5546 * opt_workgroup will be used by connection functions further,
5547 * hence it should be set to remote domain name instead of ours
5549 if (c
->opt_workgroup
) {
5550 c
->opt_workgroup
= smb_xstrdup(domain_name
);
5553 set_cmdline_auth_info_username(c
->auth_info
, acct_name
);
5555 /* find the domain controller */
5556 if (!net_find_pdc(&server_ss
, pdc_name
, domain_name
)) {
5557 DEBUG(0, ("Couldn't find domain controller for domain %s\n", domain_name
));
5561 /* connect to ipc$ as username/password */
5562 nt_status
= connect_to_ipc(c
, &cli
, &server_ss
, pdc_name
);
5563 if (!NT_STATUS_EQUAL(nt_status
, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT
)) {
5565 /* Is it trusting domain account for sure ? */
5566 DEBUG(0, ("Couldn't verify trusting domain account. Error was %s\n",
5567 nt_errstr(nt_status
)));
5571 /* store who we connected to */
5573 saf_store( domain_name
, pdc_name
);
5576 * Connect to \\server\ipc$ again (this time anonymously)
5579 nt_status
= connect_to_ipc_anonymous(c
, &cli
, &server_ss
,
5582 if (NT_STATUS_IS_ERR(nt_status
)) {
5583 DEBUG(0, ("Couldn't connect to domain %s controller. Error was %s.\n",
5584 domain_name
, nt_errstr(nt_status
)));
5588 if (!(mem_ctx
= talloc_init("establishing trust relationship to "
5589 "domain %s", domain_name
))) {
5590 DEBUG(0, ("talloc_init() failed\n"));
5595 /* Make sure we're talking to a proper server */
5597 nt_status
= rpc_trustdom_get_pdc(c
, cli
, mem_ctx
, domain_name
);
5598 if (!NT_STATUS_IS_OK(nt_status
)) {
5600 talloc_destroy(mem_ctx
);
5605 * Call LsaOpenPolicy and LsaQueryInfo
5608 nt_status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
5610 if (!NT_STATUS_IS_OK(nt_status
)) {
5611 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n", nt_errstr(nt_status
) ));
5613 talloc_destroy(mem_ctx
);
5617 nt_status
= rpccli_lsa_open_policy2(pipe_hnd
, mem_ctx
, true, KEY_QUERY_VALUE
,
5619 if (NT_STATUS_IS_ERR(nt_status
)) {
5620 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
5621 nt_errstr(nt_status
)));
5623 talloc_destroy(mem_ctx
);
5627 /* Querying info level 5 */
5629 nt_status
= rpccli_lsa_QueryInfoPolicy(pipe_hnd
, mem_ctx
,
5631 LSA_POLICY_INFO_ACCOUNT_DOMAIN
,
5633 if (NT_STATUS_IS_ERR(nt_status
)) {
5634 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
5635 nt_errstr(nt_status
)));
5637 talloc_destroy(mem_ctx
);
5641 domain_sid
= info
->account_domain
.sid
;
5643 /* There should be actually query info level 3 (following nt serv behaviour),
5644 but I still don't know if it's _really_ necessary */
5647 * Store the password in secrets db
5650 if (!pdb_set_trusteddom_pw(domain_name
,
5651 get_cmdline_auth_info_password(c
->auth_info
),
5653 DEBUG(0, ("Storing password for trusted domain failed.\n"));
5655 talloc_destroy(mem_ctx
);
5660 * Close the pipes and clean up
5663 nt_status
= rpccli_lsa_Close(pipe_hnd
, mem_ctx
, &connect_hnd
);
5664 if (NT_STATUS_IS_ERR(nt_status
)) {
5665 DEBUG(0, ("Couldn't close LSA pipe. Error was %s\n",
5666 nt_errstr(nt_status
)));
5668 talloc_destroy(mem_ctx
);
5674 talloc_destroy(mem_ctx
);
5676 d_printf("Trust to domain %s established\n", domain_name
);
5681 * Revoke trust relationship to the remote domain.
5683 * @param c A net_context structure.
5684 * @param argc Standard argc.
5685 * @param argv Standard argv without initial components.
5687 * @return Integer status (0 means success).
5690 static int rpc_trustdom_revoke(struct net_context
*c
, int argc
,
5696 if (argc
< 1 || c
->display_usage
) {
5698 "net rpc trustdom revoke <domain_name>\n"
5699 " Revoke trust relationship\n"
5700 " domain_name\tName of domain to revoke trust\n");
5704 /* generate upper cased domain name */
5705 domain_name
= smb_xstrdup(argv
[0]);
5706 strupper_m(domain_name
);
5708 /* delete password of the trust */
5709 if (!pdb_del_trusteddom_pw(domain_name
)) {
5710 DEBUG(0, ("Failed to revoke relationship to the trusted domain %s\n",
5717 SAFE_FREE(domain_name
);
5721 static NTSTATUS
rpc_query_domain_sid(struct net_context
*c
,
5722 const DOM_SID
*domain_sid
,
5723 const char *domain_name
,
5724 struct cli_state
*cli
,
5725 struct rpc_pipe_client
*pipe_hnd
,
5726 TALLOC_CTX
*mem_ctx
,
5731 sid_to_fstring(str_sid
, domain_sid
);
5732 d_printf("%s\n", str_sid
);
5733 return NT_STATUS_OK
;
5736 static void print_trusted_domain(DOM_SID
*dom_sid
, const char *trusted_dom_name
)
5738 fstring ascii_sid
, padding
;
5739 int pad_len
, col_len
= 20;
5741 /* convert sid into ascii string */
5742 sid_to_fstring(ascii_sid
, dom_sid
);
5744 /* calculate padding space for d_printf to look nicer */
5745 pad_len
= col_len
- strlen(trusted_dom_name
);
5746 padding
[pad_len
] = 0;
5747 do padding
[--pad_len
] = ' '; while (pad_len
);
5749 d_printf("%s%s%s\n", trusted_dom_name
, padding
, ascii_sid
);
5752 static NTSTATUS
vampire_trusted_domain(struct rpc_pipe_client
*pipe_hnd
,
5753 TALLOC_CTX
*mem_ctx
,
5754 struct policy_handle
*pol
,
5756 const char *trusted_dom_name
)
5759 union lsa_TrustedDomainInfo
*info
= NULL
;
5760 char *cleartextpwd
= NULL
;
5761 uint8_t session_key
[16];
5762 DATA_BLOB session_key_blob
;
5763 DATA_BLOB data
= data_blob_null
;
5765 nt_status
= rpccli_lsa_QueryTrustedDomainInfoBySid(pipe_hnd
, mem_ctx
,
5768 LSA_TRUSTED_DOMAIN_INFO_PASSWORD
,
5770 if (NT_STATUS_IS_ERR(nt_status
)) {
5771 DEBUG(0,("Could not query trusted domain info. Error was %s\n",
5772 nt_errstr(nt_status
)));
5776 data
= data_blob(info
->password
.password
->data
,
5777 info
->password
.password
->length
);
5779 if (!rpccli_get_pwd_hash(pipe_hnd
, session_key
)) {
5780 DEBUG(0, ("Could not retrieve password hash\n"));
5784 session_key_blob
= data_blob_const(session_key
, sizeof(session_key
));
5785 cleartextpwd
= sess_decrypt_string(mem_ctx
, &data
, &session_key_blob
);
5787 if (cleartextpwd
== NULL
) {
5788 DEBUG(0,("retrieved NULL password\n"));
5789 nt_status
= NT_STATUS_UNSUCCESSFUL
;
5793 if (!pdb_set_trusteddom_pw(trusted_dom_name
, cleartextpwd
, &dom_sid
)) {
5794 DEBUG(0, ("Storing password for trusted domain failed.\n"));
5795 nt_status
= NT_STATUS_UNSUCCESSFUL
;
5799 #ifdef DEBUG_PASSWORD
5800 DEBUG(100,("successfully vampired trusted domain [%s], sid: [%s], "
5801 "password: [%s]\n", trusted_dom_name
,
5802 sid_string_dbg(&dom_sid
), cleartextpwd
));
5806 SAFE_FREE(cleartextpwd
);
5807 data_blob_free(&data
);
5812 static int rpc_trustdom_vampire(struct net_context
*c
, int argc
,
5815 /* common variables */
5816 TALLOC_CTX
* mem_ctx
;
5817 struct cli_state
*cli
= NULL
;
5818 struct rpc_pipe_client
*pipe_hnd
= NULL
;
5820 const char *domain_name
= NULL
;
5821 DOM_SID
*queried_dom_sid
;
5822 struct policy_handle connect_hnd
;
5823 union lsa_PolicyInformation
*info
= NULL
;
5825 /* trusted domains listing variables */
5826 unsigned int enum_ctx
= 0;
5828 struct lsa_DomainList dom_list
;
5831 if (c
->display_usage
) {
5833 "net rpc trustdom vampire\n"
5834 " Vampire trust relationship from remote server\n");
5839 * Listing trusted domains (stored in secrets.tdb, if local)
5842 mem_ctx
= talloc_init("trust relationships vampire");
5845 * set domain and pdc name to local samba server (default)
5846 * or to remote one given in command line
5849 if (StrCaseCmp(c
->opt_workgroup
, lp_workgroup())) {
5850 domain_name
= c
->opt_workgroup
;
5851 c
->opt_target_workgroup
= c
->opt_workgroup
;
5853 fstrcpy(pdc_name
, global_myname());
5854 domain_name
= talloc_strdup(mem_ctx
, lp_workgroup());
5855 c
->opt_target_workgroup
= domain_name
;
5858 /* open \PIPE\lsarpc and open policy handle */
5859 nt_status
= net_make_ipc_connection(c
, NET_FLAGS_PDC
, &cli
);
5860 if (!NT_STATUS_IS_OK(nt_status
)) {
5861 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
5862 nt_errstr(nt_status
)));
5863 talloc_destroy(mem_ctx
);
5867 nt_status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
5869 if (!NT_STATUS_IS_OK(nt_status
)) {
5870 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
5871 nt_errstr(nt_status
) ));
5873 talloc_destroy(mem_ctx
);
5877 nt_status
= rpccli_lsa_open_policy2(pipe_hnd
, mem_ctx
, false, KEY_QUERY_VALUE
,
5879 if (NT_STATUS_IS_ERR(nt_status
)) {
5880 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
5881 nt_errstr(nt_status
)));
5883 talloc_destroy(mem_ctx
);
5887 /* query info level 5 to obtain sid of a domain being queried */
5888 nt_status
= rpccli_lsa_QueryInfoPolicy(pipe_hnd
, mem_ctx
,
5890 LSA_POLICY_INFO_ACCOUNT_DOMAIN
,
5893 if (NT_STATUS_IS_ERR(nt_status
)) {
5894 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
5895 nt_errstr(nt_status
)));
5897 talloc_destroy(mem_ctx
);
5901 queried_dom_sid
= info
->account_domain
.sid
;
5904 * Keep calling LsaEnumTrustdom over opened pipe until
5905 * the end of enumeration is reached
5908 d_printf("Vampire trusted domains:\n\n");
5911 nt_status
= rpccli_lsa_EnumTrustDom(pipe_hnd
, mem_ctx
,
5916 if (NT_STATUS_IS_ERR(nt_status
)) {
5917 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
5918 nt_errstr(nt_status
)));
5920 talloc_destroy(mem_ctx
);
5924 for (i
= 0; i
< dom_list
.count
; i
++) {
5926 print_trusted_domain(dom_list
.domains
[i
].sid
,
5927 dom_list
.domains
[i
].name
.string
);
5929 nt_status
= vampire_trusted_domain(pipe_hnd
, mem_ctx
, &connect_hnd
,
5930 *dom_list
.domains
[i
].sid
,
5931 dom_list
.domains
[i
].name
.string
);
5932 if (!NT_STATUS_IS_OK(nt_status
)) {
5934 talloc_destroy(mem_ctx
);
5940 * in case of no trusted domains say something rather
5941 * than just display blank line
5943 if (!dom_list
.count
) d_printf("none\n");
5945 } while (NT_STATUS_EQUAL(nt_status
, STATUS_MORE_ENTRIES
));
5947 /* close this connection before doing next one */
5948 nt_status
= rpccli_lsa_Close(pipe_hnd
, mem_ctx
, &connect_hnd
);
5949 if (NT_STATUS_IS_ERR(nt_status
)) {
5950 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
5951 nt_errstr(nt_status
)));
5953 talloc_destroy(mem_ctx
);
5957 /* close lsarpc pipe and connection to IPC$ */
5960 talloc_destroy(mem_ctx
);
5964 static int rpc_trustdom_list(struct net_context
*c
, int argc
, const char **argv
)
5966 /* common variables */
5967 TALLOC_CTX
* mem_ctx
;
5968 struct cli_state
*cli
= NULL
, *remote_cli
= NULL
;
5969 struct rpc_pipe_client
*pipe_hnd
= NULL
;
5971 const char *domain_name
= NULL
;
5972 DOM_SID
*queried_dom_sid
;
5974 int ascii_dom_name_len
;
5975 struct policy_handle connect_hnd
;
5976 union lsa_PolicyInformation
*info
= NULL
;
5978 /* trusted domains listing variables */
5979 unsigned int num_domains
, enum_ctx
= 0;
5980 int i
, pad_len
, col_len
= 20;
5981 struct lsa_DomainList dom_list
;
5984 /* trusting domains listing variables */
5985 struct policy_handle domain_hnd
;
5986 struct samr_SamArray
*trusts
= NULL
;
5988 if (c
->display_usage
) {
5990 "net rpc trustdom list\n"
5991 " List trust relationships\n");
5996 * Listing trusted domains (stored in secrets.tdb, if local)
5999 mem_ctx
= talloc_init("trust relationships listing");
6002 * set domain and pdc name to local samba server (default)
6003 * or to remote one given in command line
6006 if (StrCaseCmp(c
->opt_workgroup
, lp_workgroup())) {
6007 domain_name
= c
->opt_workgroup
;
6008 c
->opt_target_workgroup
= c
->opt_workgroup
;
6010 fstrcpy(pdc_name
, global_myname());
6011 domain_name
= talloc_strdup(mem_ctx
, lp_workgroup());
6012 c
->opt_target_workgroup
= domain_name
;
6015 /* open \PIPE\lsarpc and open policy handle */
6016 nt_status
= net_make_ipc_connection(c
, NET_FLAGS_PDC
, &cli
);
6017 if (!NT_STATUS_IS_OK(nt_status
)) {
6018 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
6019 nt_errstr(nt_status
)));
6020 talloc_destroy(mem_ctx
);
6024 nt_status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
6026 if (!NT_STATUS_IS_OK(nt_status
)) {
6027 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
6028 nt_errstr(nt_status
) ));
6030 talloc_destroy(mem_ctx
);
6034 nt_status
= rpccli_lsa_open_policy2(pipe_hnd
, mem_ctx
, false, KEY_QUERY_VALUE
,
6036 if (NT_STATUS_IS_ERR(nt_status
)) {
6037 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6038 nt_errstr(nt_status
)));
6040 talloc_destroy(mem_ctx
);
6044 /* query info level 5 to obtain sid of a domain being queried */
6045 nt_status
= rpccli_lsa_QueryInfoPolicy(pipe_hnd
, mem_ctx
,
6047 LSA_POLICY_INFO_ACCOUNT_DOMAIN
,
6050 if (NT_STATUS_IS_ERR(nt_status
)) {
6051 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6052 nt_errstr(nt_status
)));
6054 talloc_destroy(mem_ctx
);
6058 queried_dom_sid
= info
->account_domain
.sid
;
6061 * Keep calling LsaEnumTrustdom over opened pipe until
6062 * the end of enumeration is reached
6065 d_printf("Trusted domains list:\n\n");
6068 nt_status
= rpccli_lsa_EnumTrustDom(pipe_hnd
, mem_ctx
,
6073 if (NT_STATUS_IS_ERR(nt_status
)) {
6074 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6075 nt_errstr(nt_status
)));
6077 talloc_destroy(mem_ctx
);
6081 for (i
= 0; i
< dom_list
.count
; i
++) {
6082 print_trusted_domain(dom_list
.domains
[i
].sid
,
6083 dom_list
.domains
[i
].name
.string
);
6087 * in case of no trusted domains say something rather
6088 * than just display blank line
6090 if (!dom_list
.count
) d_printf("none\n");
6092 } while (NT_STATUS_EQUAL(nt_status
, STATUS_MORE_ENTRIES
));
6094 /* close this connection before doing next one */
6095 nt_status
= rpccli_lsa_Close(pipe_hnd
, mem_ctx
, &connect_hnd
);
6096 if (NT_STATUS_IS_ERR(nt_status
)) {
6097 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
6098 nt_errstr(nt_status
)));
6100 talloc_destroy(mem_ctx
);
6104 TALLOC_FREE(pipe_hnd
);
6107 * Listing trusting domains (stored in passdb backend, if local)
6110 d_printf("\nTrusting domains list:\n\n");
6113 * Open \PIPE\samr and get needed policy handles
6115 nt_status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_samr
.syntax_id
,
6117 if (!NT_STATUS_IS_OK(nt_status
)) {
6118 DEBUG(0, ("Could not initialise samr pipe. Error was %s\n", nt_errstr(nt_status
)));
6120 talloc_destroy(mem_ctx
);
6125 nt_status
= rpccli_samr_Connect2(pipe_hnd
, mem_ctx
,
6127 SAMR_ACCESS_LOOKUP_DOMAIN
,
6129 if (!NT_STATUS_IS_OK(nt_status
)) {
6130 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
6131 nt_errstr(nt_status
)));
6133 talloc_destroy(mem_ctx
);
6137 /* SamrOpenDomain - we have to open domain policy handle in order to be
6138 able to enumerate accounts*/
6139 nt_status
= rpccli_samr_OpenDomain(pipe_hnd
, mem_ctx
,
6141 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS
,
6144 if (!NT_STATUS_IS_OK(nt_status
)) {
6145 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
6146 nt_errstr(nt_status
)));
6148 talloc_destroy(mem_ctx
);
6153 * perform actual enumeration
6156 enum_ctx
= 0; /* reset enumeration context from last enumeration */
6159 nt_status
= rpccli_samr_EnumDomainUsers(pipe_hnd
, mem_ctx
,
6166 if (NT_STATUS_IS_ERR(nt_status
)) {
6167 DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
6168 nt_errstr(nt_status
)));
6170 talloc_destroy(mem_ctx
);
6174 for (i
= 0; i
< num_domains
; i
++) {
6176 char *str
= CONST_DISCARD(char *, trusts
->entries
[i
].name
.string
);
6179 * get each single domain's sid (do we _really_ need this ?):
6180 * 1) connect to domain's pdc
6181 * 2) query the pdc for domain's sid
6184 /* get rid of '$' tail */
6185 ascii_dom_name_len
= strlen(str
);
6186 if (ascii_dom_name_len
&& ascii_dom_name_len
< FSTRING_LEN
)
6187 str
[ascii_dom_name_len
- 1] = '\0';
6189 /* calculate padding space for d_printf to look nicer */
6190 pad_len
= col_len
- strlen(str
);
6191 padding
[pad_len
] = 0;
6192 do padding
[--pad_len
] = ' '; while (pad_len
);
6194 /* set opt_* variables to remote domain */
6196 c
->opt_workgroup
= talloc_strdup(mem_ctx
, str
);
6197 c
->opt_target_workgroup
= c
->opt_workgroup
;
6199 d_printf("%s%s", str
, padding
);
6201 /* connect to remote domain controller */
6202 nt_status
= net_make_ipc_connection(c
,
6203 NET_FLAGS_PDC
| NET_FLAGS_ANONYMOUS
,
6205 if (NT_STATUS_IS_OK(nt_status
)) {
6206 /* query for domain's sid */
6207 if (run_rpc_command(
6209 &ndr_table_lsarpc
.syntax_id
, 0,
6210 rpc_query_domain_sid
, argc
,
6212 d_fprintf(stderr
, "couldn't get domain's sid\n");
6214 cli_shutdown(remote_cli
);
6217 d_fprintf(stderr
, "domain controller is not "
6219 nt_errstr(nt_status
));
6223 if (!num_domains
) d_printf("none\n");
6225 } while (NT_STATUS_EQUAL(nt_status
, STATUS_MORE_ENTRIES
));
6227 /* close opened samr and domain policy handles */
6228 nt_status
= rpccli_samr_Close(pipe_hnd
, mem_ctx
, &domain_hnd
);
6229 if (!NT_STATUS_IS_OK(nt_status
)) {
6230 DEBUG(0, ("Couldn't properly close domain policy handle for domain %s\n", domain_name
));
6233 nt_status
= rpccli_samr_Close(pipe_hnd
, mem_ctx
, &connect_hnd
);
6234 if (!NT_STATUS_IS_OK(nt_status
)) {
6235 DEBUG(0, ("Couldn't properly close samr policy handle for domain %s\n", domain_name
));
6238 /* close samr pipe and connection to IPC$ */
6241 talloc_destroy(mem_ctx
);
6246 * Entrypoint for 'net rpc trustdom' code.
6248 * @param argc Standard argc.
6249 * @param argv Standard argv without initial components.
6251 * @return Integer status (0 means success).
6254 static int rpc_trustdom(struct net_context
*c
, int argc
, const char **argv
)
6256 struct functable func
[] = {
6261 "Add trusted domain's account",
6262 "net rpc trustdom add\n"
6263 " Add trusted domain's account"
6269 "Remove trusted domain's account",
6270 "net rpc trustdom del\n"
6271 " Remove trusted domain's account"
6275 rpc_trustdom_establish
,
6277 "Establish trust relationship",
6278 "net rpc trustdom establish\n"
6279 " Establish trust relationship"
6283 rpc_trustdom_revoke
,
6285 "Revoke trust relationship",
6286 "net rpc trustdom revoke\n"
6287 " Revoke trust relationship"
6293 "List domain trusts",
6294 "net rpc trustdom list\n"
6295 " List domain trusts"
6299 rpc_trustdom_vampire
,
6301 "Vampire trusts from remote server",
6302 "net rpc trustdom vampire\n"
6303 " Vampire trusts from remote server"
6305 {NULL
, NULL
, 0, NULL
, NULL
}
6308 return net_run_function(c
, argc
, argv
, "net rpc trustdom", func
);
6312 * Check if a server will take rpc commands
6313 * @param flags Type of server to connect to (PDC, DMB, localhost)
6314 * if the host is not explicitly specified
6315 * @return bool (true means rpc supported)
6317 bool net_rpc_check(struct net_context
*c
, unsigned flags
)
6319 struct cli_state
*cli
;
6321 struct sockaddr_storage server_ss
;
6322 char *server_name
= NULL
;
6325 /* flags (i.e. server type) may depend on command */
6326 if (!net_find_server(c
, NULL
, flags
, &server_ss
, &server_name
))
6329 if ((cli
= cli_initialise()) == NULL
) {
6333 status
= cli_connect(cli
, server_name
, &server_ss
);
6334 if (!NT_STATUS_IS_OK(status
))
6336 if (!attempt_netbios_session_request(&cli
, global_myname(),
6337 server_name
, &server_ss
))
6339 status
= cli_negprot(cli
);
6340 if (!NT_STATUS_IS_OK(status
))
6342 if (cli
->protocol
< PROTOCOL_NT1
)
6351 /* dump sam database via samsync rpc calls */
6352 static int rpc_samdump(struct net_context
*c
, int argc
, const char **argv
) {
6353 if (c
->display_usage
) {
6356 " Dump remote SAM database\n");
6360 return run_rpc_command(c
, NULL
, &ndr_table_netlogon
.syntax_id
,
6361 NET_FLAGS_ANONYMOUS
,
6362 rpc_samdump_internals
, argc
, argv
);
6365 /* syncronise sam database via samsync rpc calls */
6366 static int rpc_vampire(struct net_context
*c
, int argc
, const char **argv
)
6368 struct functable func
[] = {
6373 "Dump remote SAM database to ldif",
6374 "net rpc vampire ldif\n"
6375 " Dump remote SAM database to LDIF file or stdout"
6381 "Dump remote SAM database to Kerberos Keytab",
6382 "net rpc vampire keytab\n"
6383 " Dump remote SAM database to Kerberos keytab file"
6389 "Dump remote SAM database to passdb",
6390 "net rpc vampire passdb\n"
6391 " Dump remote SAM database to passdb"
6394 {NULL
, NULL
, 0, NULL
, NULL
}
6398 if (c
->display_usage
) {
6401 " Vampire remote SAM database\n");
6405 return run_rpc_command(c
, NULL
, &ndr_table_netlogon
.syntax_id
,
6406 NET_FLAGS_ANONYMOUS
,
6407 rpc_vampire_internals
,
6411 return net_run_function(c
, argc
, argv
, "net rpc vampire", func
);
6415 * Migrate everything from a print server.
6417 * @param c A net_context structure.
6418 * @param argc Standard main() style argc.
6419 * @param argv Standard main() style argv. Initial components are already
6422 * @return A shell status integer (0 for success).
6424 * The order is important !
6425 * To successfully add drivers the print queues have to exist !
6426 * Applying ACLs should be the last step, because you're easily locked out.
6429 static int rpc_printer_migrate_all(struct net_context
*c
, int argc
,
6434 if (c
->display_usage
) {
6436 "net rpc printer migrate all\n"
6437 " Migrate everything from a print server\n");
6442 d_printf("no server to migrate\n");
6446 ret
= run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6447 rpc_printer_migrate_printers_internals
, argc
,
6452 ret
= run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6453 rpc_printer_migrate_drivers_internals
, argc
,
6458 ret
= run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6459 rpc_printer_migrate_forms_internals
, argc
, argv
);
6463 ret
= run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6464 rpc_printer_migrate_settings_internals
, argc
,
6469 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6470 rpc_printer_migrate_security_internals
, argc
,
6476 * Migrate print drivers from a print server.
6478 * @param c A net_context structure.
6479 * @param argc Standard main() style argc.
6480 * @param argv Standard main() style argv. Initial components are already
6483 * @return A shell status integer (0 for success).
6485 static int rpc_printer_migrate_drivers(struct net_context
*c
, int argc
,
6488 if (c
->display_usage
) {
6490 "net rpc printer migrate drivers\n"
6491 " Migrate print-drivers from a print-server\n");
6496 d_printf("no server to migrate\n");
6500 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6501 rpc_printer_migrate_drivers_internals
,
6506 * Migrate print-forms from a print-server.
6508 * @param c A net_context structure.
6509 * @param argc Standard main() style argc.
6510 * @param argv Standard main() style argv. Initial components are already
6513 * @return A shell status integer (0 for success).
6515 static int rpc_printer_migrate_forms(struct net_context
*c
, int argc
,
6518 if (c
->display_usage
) {
6520 "net rpc printer migrate forms\n"
6521 " Migrate print-forms from a print-server\n");
6526 d_printf("no server to migrate\n");
6530 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6531 rpc_printer_migrate_forms_internals
,
6536 * Migrate printers from a print-server.
6538 * @param c A net_context structure.
6539 * @param argc Standard main() style argc.
6540 * @param argv Standard main() style argv. Initial components are already
6543 * @return A shell status integer (0 for success).
6545 static int rpc_printer_migrate_printers(struct net_context
*c
, int argc
,
6548 if (c
->display_usage
) {
6550 "net rpc printer migrate printers\n"
6551 " Migrate printers from a print-server\n");
6556 d_printf("no server to migrate\n");
6560 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6561 rpc_printer_migrate_printers_internals
,
6566 * Migrate printer-ACLs from a print-server
6568 * @param c A net_context structure.
6569 * @param argc Standard main() style argc.
6570 * @param argv Standard main() style argv. Initial components are already
6573 * @return A shell status integer (0 for success).
6575 static int rpc_printer_migrate_security(struct net_context
*c
, int argc
,
6578 if (c
->display_usage
) {
6580 "net rpc printer migrate security\n"
6581 " Migrate printer-ACLs from a print-server\n");
6586 d_printf("no server to migrate\n");
6590 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6591 rpc_printer_migrate_security_internals
,
6596 * Migrate printer-settings from a print-server.
6598 * @param c A net_context structure.
6599 * @param argc Standard main() style argc.
6600 * @param argv Standard main() style argv. Initial components are already
6603 * @return A shell status integer (0 for success).
6605 static int rpc_printer_migrate_settings(struct net_context
*c
, int argc
,
6608 if (c
->display_usage
) {
6610 "net rpc printer migrate settings\n"
6611 " Migrate printer-settings from a print-server\n");
6616 d_printf("no server to migrate\n");
6620 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6621 rpc_printer_migrate_settings_internals
,
6626 * 'net rpc printer' entrypoint.
6628 * @param c A net_context structure.
6629 * @param argc Standard main() style argc.
6630 * @param argv Standard main() style argv. Initial components are already
6634 int rpc_printer_migrate(struct net_context
*c
, int argc
, const char **argv
)
6637 /* ouch: when addriver and setdriver are called from within
6638 rpc_printer_migrate_drivers_internals, the printer-queue already
6641 struct functable func
[] = {
6644 rpc_printer_migrate_all
,
6646 "Migrate all from remote to local print server",
6647 "net rpc printer migrate all\n"
6648 " Migrate all from remote to local print server"
6652 rpc_printer_migrate_drivers
,
6654 "Migrate drivers to local server",
6655 "net rpc printer migrate drivers\n"
6656 " Migrate drivers to local server"
6660 rpc_printer_migrate_forms
,
6662 "Migrate froms to local server",
6663 "net rpc printer migrate forms\n"
6664 " Migrate froms to local server"
6668 rpc_printer_migrate_printers
,
6670 "Migrate printers to local server",
6671 "net rpc printer migrate printers\n"
6672 " Migrate printers to local server"
6676 rpc_printer_migrate_security
,
6678 "Mirgate printer ACLs to local server",
6679 "net rpc printer migrate security\n"
6680 " Mirgate printer ACLs to local server"
6684 rpc_printer_migrate_settings
,
6686 "Migrate printer settings to local server",
6687 "net rpc printer migrate settings\n"
6688 " Migrate printer settings to local server"
6690 {NULL
, NULL
, 0, NULL
, NULL
}
6693 return net_run_function(c
, argc
, argv
, "net rpc printer migrate",func
);
6698 * List printers on a remote RPC server.
6700 * @param c A net_context structure.
6701 * @param argc Standard main() style argc.
6702 * @param argv Standard main() style argv. Initial components are already
6705 * @return A shell status integer (0 for success).
6707 static int rpc_printer_list(struct net_context
*c
, int argc
, const char **argv
)
6709 if (c
->display_usage
) {
6711 "net rpc printer list\n"
6712 " List printers on a remote RPC server\n");
6716 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6717 rpc_printer_list_internals
,
6722 * List printer-drivers on a remote RPC server.
6724 * @param c A net_context structure.
6725 * @param argc Standard main() style argc.
6726 * @param argv Standard main() style argv. Initial components are already
6729 * @return A shell status integer (0 for success).
6731 static int rpc_printer_driver_list(struct net_context
*c
, int argc
,
6734 if (c
->display_usage
) {
6736 "net rpc printer driver\n"
6737 " List printer-drivers on a remote RPC server\n");
6741 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6742 rpc_printer_driver_list_internals
,
6747 * Publish printer in ADS via MSRPC.
6749 * @param c A net_context structure.
6750 * @param argc Standard main() style argc.
6751 * @param argv Standard main() style argv. Initial components are already
6754 * @return A shell status integer (0 for success).
6756 static int rpc_printer_publish_publish(struct net_context
*c
, int argc
,
6759 if (c
->display_usage
) {
6761 "net rpc printer publish publish\n"
6762 " Publish printer in ADS via MSRPC\n");
6766 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6767 rpc_printer_publish_publish_internals
,
6772 * Update printer in ADS via MSRPC.
6774 * @param c A net_context structure.
6775 * @param argc Standard main() style argc.
6776 * @param argv Standard main() style argv. Initial components are already
6779 * @return A shell status integer (0 for success).
6781 static int rpc_printer_publish_update(struct net_context
*c
, int argc
, const char **argv
)
6783 if (c
->display_usage
) {
6785 "net rpc printer publish update\n"
6786 " Update printer in ADS via MSRPC\n");
6790 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6791 rpc_printer_publish_update_internals
,
6796 * UnPublish printer in ADS via MSRPC.
6798 * @param c A net_context structure.
6799 * @param argc Standard main() style argc.
6800 * @param argv Standard main() style argv. Initial components are already
6803 * @return A shell status integer (0 for success).
6805 static int rpc_printer_publish_unpublish(struct net_context
*c
, int argc
,
6808 if (c
->display_usage
) {
6810 "net rpc printer publish unpublish\n"
6811 " UnPublish printer in ADS via MSRPC\n");
6815 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6816 rpc_printer_publish_unpublish_internals
,
6821 * List published printers via MSRPC.
6823 * @param c A net_context structure.
6824 * @param argc Standard main() style argc.
6825 * @param argv Standard main() style argv. Initial components are already
6828 * @return A shell status integer (0 for success).
6830 static int rpc_printer_publish_list(struct net_context
*c
, int argc
,
6833 if (c
->display_usage
) {
6835 "net rpc printer publish list\n"
6836 " List published printers via MSRPC\n");
6840 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6841 rpc_printer_publish_list_internals
,
6847 * Publish printer in ADS.
6849 * @param c A net_context structure.
6850 * @param argc Standard main() style argc.
6851 * @param argv Standard main() style argv. Initial components are already
6854 * @return A shell status integer (0 for success).
6856 static int rpc_printer_publish(struct net_context
*c
, int argc
,
6860 struct functable func
[] = {
6863 rpc_printer_publish_publish
,
6865 "Publish printer in AD",
6866 "net rpc printer publish publish\n"
6867 " Publish printer in AD"
6871 rpc_printer_publish_update
,
6873 "Update printer in AD",
6874 "net rpc printer publish update\n"
6875 " Update printer in AD"
6879 rpc_printer_publish_unpublish
,
6881 "Unpublish printer",
6882 "net rpc printer publish unpublish\n"
6883 " Unpublish printer"
6887 rpc_printer_publish_list
,
6889 "List published printers",
6890 "net rpc printer publish list\n"
6891 " List published printers"
6893 {NULL
, NULL
, 0, NULL
, NULL
}
6897 if (c
->display_usage
) {
6898 d_printf("Usage:\n");
6899 d_printf("net rpc printer publish\n"
6900 " List published printers\n"
6901 " Alias of net rpc printer publish list\n");
6902 net_display_usage_from_functable(func
);
6905 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
6906 rpc_printer_publish_list_internals
,
6910 return net_run_function(c
, argc
, argv
, "net rpc printer publish",func
);
6916 * Display rpc printer help page.
6918 * @param c A net_context structure.
6919 * @param argc Standard main() style argc.
6920 * @param argv Standard main() style argv. Initial components are already
6923 int rpc_printer_usage(struct net_context
*c
, int argc
, const char **argv
)
6925 d_printf("net rpc printer LIST [printer] [misc. options] [targets]\n"
6926 "\tlists all printers on print-server\n\n");
6927 d_printf("net rpc printer DRIVER [printer] [misc. options] [targets]\n"
6928 "\tlists all printer-drivers on print-server\n\n");
6929 d_printf("net rpc printer PUBLISH action [printer] [misc. options] [targets]\n"
6930 "\tpublishes printer settings in Active Directory\n"
6931 "\taction can be one of PUBLISH, UPDATE, UNPUBLISH or LIST\n\n");
6932 d_printf("net rpc printer MIGRATE PRINTERS [printer] [misc. options] [targets]"
6933 "\n\tmigrates printers from remote to local server\n\n");
6934 d_printf("net rpc printer MIGRATE SETTINGS [printer] [misc. options] [targets]"
6935 "\n\tmigrates printer-settings from remote to local server\n\n");
6936 d_printf("net rpc printer MIGRATE DRIVERS [printer] [misc. options] [targets]"
6937 "\n\tmigrates printer-drivers from remote to local server\n\n");
6938 d_printf("net rpc printer MIGRATE FORMS [printer] [misc. options] [targets]"
6939 "\n\tmigrates printer-forms from remote to local server\n\n");
6940 d_printf("net rpc printer MIGRATE SECURITY [printer] [misc. options] [targets]"
6941 "\n\tmigrates printer-ACLs from remote to local server\n\n");
6942 d_printf("net rpc printer MIGRATE ALL [printer] [misc. options] [targets]"
6943 "\n\tmigrates drivers, forms, queues, settings and acls from\n"
6944 "\tremote to local print-server\n\n");
6945 net_common_methods_usage(c
, argc
, argv
);
6946 net_common_flags_usage(c
, argc
, argv
);
6948 "\t-v or --verbose\t\t\tgive verbose output\n"
6949 "\t --destination\t\tmigration target server (default: localhost)\n");
6955 * 'net rpc printer' entrypoint.
6957 * @param c A net_context structure.
6958 * @param argc Standard main() style argc.
6959 * @param argv Standard main() style argv. Initial components are already
6962 int net_rpc_printer(struct net_context
*c
, int argc
, const char **argv
)
6964 struct functable func
[] = {
6969 "List all printers on print server",
6970 "net rpc printer list\n"
6971 " List all printers on print server"
6975 rpc_printer_migrate
,
6977 "Migrate printer to local server",
6978 "net rpc printer migrate\n"
6979 " Migrate printer to local server"
6983 rpc_printer_driver_list
,
6985 "List printer drivers",
6986 "net rpc printer driver\n"
6987 " List printer drivers"
6991 rpc_printer_publish
,
6993 "Publish printer in AD",
6994 "net rpc printer publish\n"
6995 " Publish printer in AD"
6997 {NULL
, NULL
, 0, NULL
, NULL
}
7001 if (c
->display_usage
) {
7002 d_printf("Usage:\n");
7003 d_printf("net rpc printer\n"
7004 " List printers\n");
7005 net_display_usage_from_functable(func
);
7008 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
.syntax_id
, 0,
7009 rpc_printer_list_internals
,
7013 return net_run_function(c
, argc
, argv
, "net rpc printer", func
);
7017 * 'net rpc' entrypoint.
7019 * @param c A net_context structure.
7020 * @param argc Standard main() style argc.
7021 * @param argv Standard main() style argv. Initial components are already
7025 int net_rpc(struct net_context
*c
, int argc
, const char **argv
)
7027 NET_API_STATUS status
;
7029 struct functable func
[] = {
7034 "Modify global audit settings",
7036 " Modify global audit settings"
7042 "Show basic info about a domain",
7044 " Show basic info about a domain"
7058 "Join a domain created in server manager",
7060 " Join a domain created in server manager"
7066 "Test that a join is valid",
7067 "net rpc testjoin\n"
7068 " Test that a join is valid"
7074 "List/modify users",
7076 " List/modify users"
7082 "Change a user password",
7083 "net rpc password\n"
7084 " Change a user password\n"
7085 " Alias for net rpc user password"
7091 "List/modify groups",
7093 " List/modify groups"
7099 "List/modify shares",
7101 " List/modify shares"
7115 "List/modify printers",
7117 " List/modify printers"
7121 net_rpc_changetrustpw
,
7123 "Change trust account password",
7124 "net rpc changetrustpw\n"
7125 " Change trust account password"
7131 "Modify domain trusts",
7132 "net rpc trustdom\n"
7133 " Modify domain trusts"
7139 "Abort a remote shutdown",
7140 "net rpc abortshutdown\n"
7141 " Abort a remote shutdown"
7147 "Shutdown a remote server",
7148 "net rpc shutdown\n"
7149 " Shutdown a remote server"
7155 "Dump SAM data of remote NT PDC",
7157 " Dump SAM data of remote NT PDC"
7163 "Sync a remote NT PDC's data into local passdb",
7165 " Sync a remote NT PDC's data into local passdb"
7171 "Fetch the domain sid into local secrets.tdb",
7173 " Fetch the domain sid into local secrets.tdb"
7179 "Manage privileges assigned to SID",
7181 " Manage privileges assigned to SID"
7187 "Start/stop/query remote services",
7189 " Start/stop/query remote services"
7195 "Manage registry hives",
7196 "net rpc registry\n"
7197 " Manage registry hives"
7203 "Open interactive shell on remote server",
7205 " Open interactive shell on remote server"
7207 {NULL
, NULL
, 0, NULL
, NULL
}
7210 status
= libnetapi_init(&c
->netapi_ctx
);
7214 set_cmdline_auth_info_getpass(c
->auth_info
);
7215 libnetapi_set_username(c
->netapi_ctx
,
7216 get_cmdline_auth_info_username(c
->auth_info
));
7217 libnetapi_set_password(c
->netapi_ctx
,
7218 get_cmdline_auth_info_password(c
->auth_info
));
7219 if (get_cmdline_auth_info_use_kerberos(c
->auth_info
)) {
7220 libnetapi_set_use_kerberos(c
->netapi_ctx
);
7223 return net_run_function(c
, argc
, argv
, "net rpc", func
);