python/samba/upgrade.py

   1 # backend code for upgrading from Samba3
   2 # Copyright Jelmer Vernooij 2005-2007
   3 # Copyright Andrew Bartlett 2011
   4 #
   5 # This program is free software; you can redistribute it and/or modify
   6 # it under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation; either version 3 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 #
  18
  19 """Support code for upgrading from Samba 3 to Samba 4."""
  20
  21 __docformat__ = "restructuredText"
  22
  23 import ldb
  24 import time
  25 import pwd
  26
  27 from samba import Ldb, registry
  28 from samba.param import LoadParm
  29 from samba.provision import provision, ProvisioningError, setsysvolacl
  30 from samba.provision.common import FILL_FULL
  31 from samba.samba3 import passdb
  32 from samba.samba3 import param as s3param
  33 from samba.dcerpc import lsa, samr, security
  34 from samba.dcerpc.security import dom_sid
  35 from samba.credentials import Credentials
  36 from samba import dsdb
  37 from samba.ndr import ndr_pack
  38 from samba import unix2nttime
  39 from samba import generate_random_password
  40
  41
  42 def import_sam_policy(samdb, policy, logger):
  43     """Import a Samba 3 policy.
  44
  45     :param samdb: Samba4 SAM database
  46     :param policy: Samba3 account policy
  47     :param logger: Logger object
  48     """
  49
  50     # Following entries are used -
  51     #    min password length, password history, minimum password age,
  52     #    maximum password age, lockout duration
  53     #
  54     # Following entries are not used -
  55     #    reset count minutes, user must logon to change password,
  56     #    bad lockout minutes, disconnect time
  57
  58     m = ldb.Message()
  59     m.dn = samdb.get_default_basedn()
  60
  61     if 'min password length' in policy:
  62         m['a01'] = ldb.MessageElement(str(policy['min password length']),
  63             ldb.FLAG_MOD_REPLACE, 'minPwdLength')
  64
  65     if 'password history' in policy:
  66         m['a02'] = ldb.MessageElement(str(policy['password history']),
  67             ldb.FLAG_MOD_REPLACE, 'pwdHistoryLength')
  68
  69     if 'minimum password age' in policy:
  70         min_pw_age_unix = policy['minimum password age']
  71         min_pw_age_nt = int(-min_pw_age_unix * (1e7))
  72         m['a03'] = ldb.MessageElement(str(min_pw_age_nt), ldb.FLAG_MOD_REPLACE,
  73             'minPwdAge')
  74
  75     if 'maximum password age' in policy:
  76         max_pw_age_unix = policy['maximum password age']
  77         if max_pw_age_unix == -1 or max_pw_age_unix == 0:
  78             max_pw_age_nt = -0x8000000000000000
  79         else:
  80             max_pw_age_nt = int(-max_pw_age_unix * (1e7))
  81
  82         m['a04'] = ldb.MessageElement(str(max_pw_age_nt), ldb.FLAG_MOD_REPLACE,
  83                                       'maxPwdAge')
  84
  85     if 'lockout duration' in policy:
  86         lockout_duration_mins = policy['lockout duration']
  87         lockout_duration_nt = unix2nttime(lockout_duration_mins * 60)
  88
  89         m['a05'] = ldb.MessageElement(str(lockout_duration_nt),
  90             ldb.FLAG_MOD_REPLACE, 'lockoutDuration')
  91
  92     try:
  93         samdb.modify(m)
  94     except ldb.LdbError, e:
  95         logger.warn("Could not set account policy, (%s)", str(e))
  96
  97
  98 def add_posix_attrs(logger, samdb, sid, name, nisdomain, xid_type, home=None,
  99         shell=None, pgid=None):
 100     """Add posix attributes for the user/group
 101
 102     :param samdb: Samba4 sam.ldb database
 103     :param sid: user/group sid
 104     :param sid: user/group name
 105     :param nisdomain: name of the (fake) NIS domain
 106     :param xid_type: type of id (ID_TYPE_UID/ID_TYPE_GID)
 107     :param home: user homedir (Unix homepath)
 108     :param shell: user shell
 109     :param pgid: users primary group id
 110     """
 111
 112     try:
 113         m = ldb.Message()
 114         m.dn = ldb.Dn(samdb, "<SID=%s>" % str(sid))
 115         if xid_type == "ID_TYPE_UID":
 116             m['unixHomeDirectory'] = ldb.MessageElement(
 117                 str(home), ldb.FLAG_MOD_REPLACE, 'unixHomeDirectory')
 118             m['loginShell'] = ldb.MessageElement(
 119                 str(shell), ldb.FLAG_MOD_REPLACE, 'loginShell')
 120             m['gidNumber'] = ldb.MessageElement(
 121                 str(pgid), ldb.FLAG_MOD_REPLACE, 'gidNumber')
 122
 123         m['msSFU30NisDomain'] = ldb.MessageElement(
 124             str(nisdomain), ldb.FLAG_MOD_REPLACE, 'msSFU30NisDomain')
 125
 126         samdb.modify(m)
 127     except ldb.LdbError, e:
 128         logger.warn(
 129             'Could not add posix attrs for AD entry for sid=%s, (%s)',
 130             str(sid), str(e))
 131
 132 def add_ad_posix_idmap_entry(samdb, sid, xid, xid_type, logger):
 133     """Create idmap entry
 134
 135     :param samdb: Samba4 sam.ldb database
 136     :param sid: user/group sid
 137     :param xid: user/group id
 138     :param xid_type: type of id (ID_TYPE_UID/ID_TYPE_GID)
 139     :param logger: Logger object
 140     """
 141
 142     try:
 143         m = ldb.Message()
 144         m.dn = ldb.Dn(samdb, "<SID=%s>" % str(sid))
 145         if xid_type == "ID_TYPE_UID":
 146             m['uidNumber'] = ldb.MessageElement(
 147                 str(xid), ldb.FLAG_MOD_REPLACE, 'uidNumber')
 148             m['objectClass'] = ldb.MessageElement(
 149                 "posixAccount", ldb.FLAG_MOD_ADD, 'objectClass')
 150         elif xid_type == "ID_TYPE_GID":
 151             m['gidNumber'] = ldb.MessageElement(
 152                 str(xid), ldb.FLAG_MOD_REPLACE, 'gidNumber')
 153             m['objectClass'] = ldb.MessageElement(
 154                 "posixGroup", ldb.FLAG_MOD_ADD, 'objectClass')
 155
 156         samdb.modify(m)
 157     except ldb.LdbError, e:
 158         logger.warn(
 159             'Could not modify AD idmap entry for sid=%s, id=%s, type=%s (%s)',
 160             str(sid), str(xid), xid_type, str(e))
 161
 162
 163 def add_idmap_entry(idmapdb, sid, xid, xid_type, logger):
 164     """Create idmap entry
 165
 166     :param idmapdb: Samba4 IDMAP database
 167     :param sid: user/group sid
 168     :param xid: user/group id
 169     :param xid_type: type of id (ID_TYPE_UID/ID_TYPE_GID)
 170     :param logger: Logger object
 171     """
 172
 173     # First try to see if we already have this entry
 174     found = False
 175     msg = idmapdb.search(expression='objectSid=%s' % str(sid))
 176     if msg.count == 1:
 177         found = True
 178
 179     if found:
 180         try:
 181             m = ldb.Message()
 182             m.dn = msg[0]['dn']
 183             m['xidNumber'] = ldb.MessageElement(
 184                 str(xid), ldb.FLAG_MOD_REPLACE, 'xidNumber')
 185             m['type'] = ldb.MessageElement(
 186                 xid_type, ldb.FLAG_MOD_REPLACE, 'type')
 187             idmapdb.modify(m)
 188         except ldb.LdbError, e:
 189             logger.warn(
 190                 'Could not modify idmap entry for sid=%s, id=%s, type=%s (%s)',
 191                 str(sid), str(xid), xid_type, str(e))
 192     else:
 193         try:
 194             idmapdb.add({"dn": "CN=%s" % str(sid),
 195                         "cn": str(sid),
 196                         "objectClass": "sidMap",
 197                         "objectSid": ndr_pack(sid),
 198                         "type": xid_type,
 199                         "xidNumber": str(xid)})
 200         except ldb.LdbError, e:
 201             logger.warn(
 202                 'Could not add idmap entry for sid=%s, id=%s, type=%s (%s)',
 203                 str(sid), str(xid), xid_type, str(e))
 204
 205
 206 def import_idmap(idmapdb, samba3, logger):
 207     """Import idmap data.
 208
 209     :param idmapdb: Samba4 IDMAP database
 210     :param samba3_idmap: Samba3 IDMAP database to import from
 211     :param logger: Logger object
 212     """
 213
 214     try:
 215         samba3_idmap = samba3.get_idmap_db()
 216     except IOError, e:
 217         logger.warn('Cannot open idmap database, Ignoring: %s', str(e))
 218         return
 219
 220     currentxid = max(samba3_idmap.get_user_hwm(), samba3_idmap.get_group_hwm())
 221     lowerbound = currentxid
 222     # FIXME: upperbound
 223
 224     m = ldb.Message()
 225     m.dn = ldb.Dn(idmapdb, 'CN=CONFIG')
 226     m['lowerbound'] = ldb.MessageElement(
 227         str(lowerbound), ldb.FLAG_MOD_REPLACE, 'lowerBound')
 228     m['xidNumber'] = ldb.MessageElement(
 229         str(currentxid), ldb.FLAG_MOD_REPLACE, 'xidNumber')
 230     idmapdb.modify(m)
 231
 232     for id_type, xid in samba3_idmap.ids():
 233         if id_type == 'UID':
 234             xid_type = 'ID_TYPE_UID'
 235         elif id_type == 'GID':
 236             xid_type = 'ID_TYPE_GID'
 237         else:
 238             logger.warn('Wrong type of entry in idmap (%s), Ignoring', id_type)
 239             continue
 240
 241         sid = samba3_idmap.get_sid(xid, id_type)
 242         add_idmap_entry(idmapdb, dom_sid(sid), xid, xid_type, logger)
 243
 244
 245 def add_group_from_mapping_entry(samdb, groupmap, logger):
 246     """Add or modify group from group mapping entry
 247
 248     param samdb: Samba4 SAM database
 249     param groupmap: Groupmap entry
 250     param logger: Logger object
 251     """
 252
 253     # First try to see if we already have this entry
 254     try:
 255         msg = samdb.search(
 256             base='<SID=%s>' % str(groupmap.sid), scope=ldb.SCOPE_BASE)
 257         found = True
 258     except ldb.LdbError, (ecode, emsg):
 259         if ecode == ldb.ERR_NO_SUCH_OBJECT:
 260             found = False
 261         else:
 262             raise ldb.LdbError(ecode, emsg)
 263
 264     if found:
 265         logger.warn('Group already exists sid=%s, groupname=%s existing_groupname=%s, Ignoring.',
 266                             str(groupmap.sid), groupmap.nt_name, msg[0]['sAMAccountName'][0])
 267     else:
 268         if groupmap.sid_name_use == lsa.SID_NAME_WKN_GRP:
 269             # In a lot of Samba3 databases, aliases are marked as well known groups
 270             (group_dom_sid, rid) = groupmap.sid.split()
 271             if (group_dom_sid != security.dom_sid(security.SID_BUILTIN)):
 272                 return
 273
 274         m = ldb.Message()
 275         m.dn = ldb.Dn(samdb, "CN=%s,CN=Users,%s" % (groupmap.nt_name, samdb.get_default_basedn()))
 276         m['cn'] = ldb.MessageElement(groupmap.nt_name, ldb.FLAG_MOD_ADD, 'cn')
 277         m['objectClass'] = ldb.MessageElement('group', ldb.FLAG_MOD_ADD, 'objectClass')
 278         m['objectSid'] = ldb.MessageElement(ndr_pack(groupmap.sid), ldb.FLAG_MOD_ADD,
 279             'objectSid')
 280         m['sAMAccountName'] = ldb.MessageElement(groupmap.nt_name, ldb.FLAG_MOD_ADD,
 281             'sAMAccountName')
 282
 283         if groupmap.comment:
 284             m['description'] = ldb.MessageElement(groupmap.comment, ldb.FLAG_MOD_ADD,
 285                 'description')
 286
 287         # Fix up incorrect 'well known' groups that are actually builtin (per test above) to be aliases
 288         if groupmap.sid_name_use == lsa.SID_NAME_ALIAS or groupmap.sid_name_use == lsa.SID_NAME_WKN_GRP:
 289             m['groupType'] = ldb.MessageElement(str(dsdb.GTYPE_SECURITY_DOMAIN_LOCAL_GROUP),
 290                 ldb.FLAG_MOD_ADD, 'groupType')
 291
 292         try:
 293             samdb.add(m, controls=["relax:0"])
 294         except ldb.LdbError, e:
 295             logger.warn('Could not add group name=%s (%s)', groupmap.nt_name, str(e))
 296
 297
 298 def add_users_to_group(samdb, group, members, logger):
 299     """Add user/member to group/alias
 300
 301     param samdb: Samba4 SAM database
 302     param group: Groupmap object
 303     param members: List of member SIDs
 304     param logger: Logger object
 305     """
 306     for member_sid in members:
 307         m = ldb.Message()
 308         m.dn = ldb.Dn(samdb, "<SID=%s>" % str(group.sid))
 309         m['a01'] = ldb.MessageElement("<SID=%s>" % str(member_sid), ldb.FLAG_MOD_ADD, 'member')
 310
 311         try:
 312             samdb.modify(m)
 313         except ldb.LdbError, (ecode, emsg):
 314             if ecode == ldb.ERR_ENTRY_ALREADY_EXISTS:
 315                 logger.debug("skipped re-adding member '%s' to group '%s': %s", member_sid, group.sid, emsg)
 316             elif ecode == ldb.ERR_NO_SUCH_OBJECT:
 317                 raise ProvisioningError("Could not add member '%s' to group '%s' as either group or user record doesn't exist: %s" % (member_sid, group.sid, emsg))
 318             else:
 319                 raise ProvisioningError("Could not add member '%s' to group '%s': %s" % (member_sid, group.sid, emsg))
 320
 321
 322 def import_wins(samba4_winsdb, samba3_winsdb):
 323     """Import settings from a Samba3 WINS database.
 324
 325     :param samba4_winsdb: WINS database to import to
 326     :param samba3_winsdb: WINS database to import from
 327     """
 328
 329     version_id = 0
 330
 331     for (name, (ttl, ips, nb_flags)) in samba3_winsdb.items():
 332         version_id += 1
 333
 334         type = int(name.split("#", 1)[1], 16)
 335
 336         if type == 0x1C:
 337             rType = 0x2
 338         elif type & 0x80:
 339             if len(ips) > 1:
 340                 rType = 0x2
 341             else:
 342                 rType = 0x1
 343         else:
 344             if len(ips) > 1:
 345                 rType = 0x3
 346             else:
 347                 rType = 0x0
 348
 349         if ttl > time.time():
 350             rState = 0x0 # active
 351         else:
 352             rState = 0x1 # released
 353
 354         nType = ((nb_flags & 0x60) >> 5)
 355
 356         samba4_winsdb.add({"dn": "name=%s,type=0x%s" % tuple(name.split("#")),
 357                            "type": name.split("#")[1],
 358                            "name": name.split("#")[0],
 359                            "objectClass": "winsRecord",
 360                            "recordType": str(rType),
 361                            "recordState": str(rState),
 362                            "nodeType": str(nType),
 363                            "expireTime": ldb.timestring(ttl),
 364                            "isStatic": "0",
 365                            "versionID": str(version_id),
 366                            "address": ips})
 367
 368     samba4_winsdb.add({"dn": "cn=VERSION",
 369                        "cn": "VERSION",
 370                        "objectClass": "winsMaxVersion",
 371                        "maxVersion": str(version_id)})
 372
 373
 374 def enable_samba3sam(samdb, ldapurl):
 375     """Enable Samba 3 LDAP URL database.
 376
 377     :param samdb: SAM Database.
 378     :param ldapurl: Samba 3 LDAP URL
 379     """
 380     samdb.modify_ldif("""
 381 dn: @MODULES
 382 changetype: modify
 383 replace: @LIST
 384 @LIST: samldb,operational,objectguid,rdn_name,samba3sam
 385 """)
 386
 387     samdb.add({"dn": "@MAP=samba3sam", "@MAP_URL": ldapurl})
 388
 389
 390 smbconf_keep = [
 391     "dos charset",
 392     "unix charset",
 393     "display charset",
 394     "comment",
 395     "path",
 396     "directory",
 397     "workgroup",
 398     "realm",
 399     "netbios name",
 400     "netbios aliases",
 401     "netbios scope",
 402     "server string",
 403     "interfaces",
 404     "bind interfaces only",
 405     "security",
 406     "auth methods",
 407     "encrypt passwords",
 408     "null passwords",
 409     "obey pam restrictions",
 410     "password server",
 411     "smb passwd file",
 412     "private dir",
 413     "passwd chat",
 414     "lanman auth",
 415     "ntlm auth",
 416     "client NTLMv2 auth",
 417     "client lanman auth",
 418     "client plaintext auth",
 419     "read only",
 420     "hosts allow",
 421     "hosts deny",
 422     "log level",
 423     "debuglevel",
 424     "log file",
 425     "smb ports",
 426     "large readwrite",
 427     "max protocol",
 428     "min protocol",
 429     "unicode",
 430     "read raw",
 431     "write raw",
 432     "disable netbios",
 433     "nt status support",
 434     "max mux",
 435     "max xmit",
 436     "name resolve order",
 437     "max wins ttl",
 438     "min wins ttl",
 439     "time server",
 440     "unix extensions",
 441     "use spnego",
 442     "server signing",
 443     "client signing",
 444     "max connections",
 445     "paranoid server security",
 446     "socket options",
 447     "strict sync",
 448     "max print jobs",
 449     "printable",
 450     "print ok",
 451     "printer name",
 452     "printer",
 453     "map system",
 454     "map hidden",
 455     "map archive",
 456     "preferred master",
 457     "prefered master",
 458     "local master",
 459     "browseable",
 460     "browsable",
 461     "wins server",
 462     "wins support",
 463     "csc policy",
 464     "strict locking",
 465     "preload",
 466     "auto services",
 467     "lock dir",
 468     "lock directory",
 469     "pid directory",
 470     "socket address",
 471     "copy",
 472     "include",
 473     "available",
 474     "volume",
 475     "fstype",
 476     "panic action",
 477     "msdfs root",
 478     "host msdfs",
 479     "winbind separator"]
 480
 481
 482 def upgrade_smbconf(oldconf, mark):
 483     """Remove configuration variables not present in Samba4
 484
 485     :param oldconf: Old configuration structure
 486     :param mark: Whether removed configuration variables should be
 487         kept in the new configuration as "samba3:<name>"
 488     """
 489     data = oldconf.data()
 490     newconf = LoadParm()
 491
 492     for s in data:
 493         for p in data[s]:
 494             keep = False
 495             for k in smbconf_keep:
 496                 if smbconf_keep[k] == p:
 497                     keep = True
 498                     break
 499
 500             if keep:
 501                 newconf.set(s, p, oldconf.get(s, p))
 502             elif mark:
 503                 newconf.set(s, "samba3:" + p, oldconf.get(s, p))
 504
 505     return newconf
 506
 507 SAMBA3_PREDEF_NAMES = {
 508         'HKLM': registry.HKEY_LOCAL_MACHINE,
 509 }
 510
 511
 512 def import_registry(samba4_registry, samba3_regdb):
 513     """Import a Samba 3 registry database into the Samba 4 registry.
 514
 515     :param samba4_registry: Samba 4 registry handle.
 516     :param samba3_regdb: Samba 3 registry database handle.
 517     """
 518     def ensure_key_exists(keypath):
 519         (predef_name, keypath) = keypath.split("/", 1)
 520         predef_id = SAMBA3_PREDEF_NAMES[predef_name]
 521         keypath = keypath.replace("/", "\\")
 522         return samba4_registry.create_key(predef_id, keypath)
 523
 524     for key in samba3_regdb.keys():
 525         key_handle = ensure_key_exists(key)
 526         for subkey in samba3_regdb.subkeys(key):
 527             ensure_key_exists(subkey)
 528         for (value_name, (value_type, value_data)) in samba3_regdb.values(key).items():
 529             key_handle.set_value(value_name, value_type, value_data)
 530
 531 def get_posix_attr_from_ldap_backend(logger, ldb_object, base_dn, user, attr):
 532     """Get posix attributes from a samba3 ldap backend
 533     :param ldbs: a list of ldb connection objects
 534     :param base_dn: the base_dn of the connection
 535     :param user: the user to get the attribute for
 536     :param attr: the attribute to be retrieved
 537     """
 538     try:
 539         msg = ldb_object.search(base_dn, scope=ldb.SCOPE_SUBTREE,
 540                         expression=("(&(objectClass=posixAccount)(uid=%s))"
 541                         % (user)), attrs=[attr])
 542     except ldb.LdbError, e:
 543         raise ProvisioningError("Failed to retrieve attribute %s for user %s, the error is: %s", attr, user, e)
 544     else:
 545         if msg.count <= 1:
 546             # This will raise KeyError (which is what we want) if there isn't a entry for this user
 547             return msg[0][attr][0]
 548         else:
 549             logger.warning("LDAP entry for user %s contains more than one %s", user, attr)
 550             raise KeyError
 551
 552
 553 def upgrade_from_samba3(samba3, logger, targetdir, session_info=None,
 554         useeadb=False, dns_backend=None, use_ntvfs=False):
 555     """Upgrade from samba3 database to samba4 AD database
 556
 557     :param samba3: samba3 object
 558     :param logger: Logger object
 559     :param targetdir: samba4 database directory
 560     :param session_info: Session information
 561     """
 562     serverrole = samba3.lp.server_role()
 563
 564     domainname = samba3.lp.get("workgroup")
 565     realm = samba3.lp.get("realm")
 566     netbiosname = samba3.lp.get("netbios name")
 567
 568     if samba3.lp.get("ldapsam:trusted") is None:
 569         samba3.lp.set("ldapsam:trusted", "yes")
 570
 571     # secrets db
 572     try:
 573         secrets_db = samba3.get_secrets_db()
 574     except IOError, e:
 575         raise ProvisioningError("Could not open '%s', the Samba3 secrets database: %s.  Perhaps you specified the incorrect smb.conf, --testparm or --dbdir option?" % (samba3.privatedir_path("secrets.tdb"), str(e)))
 576
 577     if not domainname:
 578         domainname = secrets_db.domains()[0]
 579         logger.warning("No workgroup specified in smb.conf file, assuming '%s'",
 580                 domainname)
 581
 582     if not realm:
 583         if serverrole == "ROLE_DOMAIN_BDC" or serverrole == "ROLE_DOMAIN_PDC":
 584             raise ProvisioningError("No realm specified in smb.conf file and being a DC. That upgrade path doesn't work! Please add a 'realm' directive to your old smb.conf to let us know which one you want to use (it is the DNS name of the AD domain you wish to create.")
 585         else:
 586             realm = domainname.upper()
 587             logger.warning("No realm specified in smb.conf file, assuming '%s'",
 588                     realm)
 589
 590     # Find machine account and password
 591     next_rid = 1000
 592
 593     try:
 594         machinepass = secrets_db.get_machine_password(netbiosname)
 595     except KeyError:
 596         machinepass = None
 597
 598     if samba3.lp.get("passdb backend").split(":")[0].strip() == "ldapsam":
 599         base_dn =  samba3.lp.get("ldap suffix")
 600         ldapuser = samba3.lp.get("ldap admin dn")
 601         ldappass = secrets_db.get_ldap_bind_pw(ldapuser)
 602         if ldappass is None:
 603             raise ProvisioningError("ldapsam passdb backend detected but no LDAP Bind PW found in secrets.tdb for user %s.  Please point this tool at the secrets.tdb that was used by the previous installation.")
 604         ldappass = ldappass.strip('\x00')
 605         ldap = True
 606     else:
 607         ldapuser = None
 608         ldappass = None
 609         ldap = False
 610
 611     # We must close the direct pytdb database before the C code loads it
 612     secrets_db.close()
 613
 614     # Connect to old password backend
 615     passdb.set_secrets_dir(samba3.lp.get("private dir"))
 616     s3db = samba3.get_sam_db()
 617
 618     # Get domain sid
 619     try:
 620         domainsid = passdb.get_global_sam_sid()
 621     except passdb.error:
 622         raise Exception("Can't find domain sid for '%s', Exiting." % domainname)
 623
 624     # Get machine account, sid, rid
 625     try:
 626         machineacct = s3db.getsampwnam('%s$' % netbiosname)
 627     except passdb.error:
 628         machinerid = None
 629         machinesid = None
 630     else:
 631         machinesid, machinerid = machineacct.user_sid.split()
 632
 633     # Export account policy
 634     logger.info("Exporting account policy")
 635     policy = s3db.get_account_policy()
 636
 637     # Export groups from old passdb backend
 638     logger.info("Exporting groups")
 639     grouplist = s3db.enum_group_mapping()
 640     groupmembers = {}
 641     for group in grouplist:
 642         sid, rid = group.sid.split()
 643         if sid == domainsid:
 644             if rid >= next_rid:
 645                 next_rid = rid + 1
 646
 647         # Get members for each group/alias
 648         if group.sid_name_use == lsa.SID_NAME_ALIAS:
 649             try:
 650                 members = s3db.enum_aliasmem(group.sid)
 651                 groupmembers[str(group.sid)] = members
 652             except passdb.error, e:
 653                 logger.warn("Ignoring group '%s' %s listed but then not found: %s",
 654                             group.nt_name, group.sid, e)
 655                 continue
 656         elif group.sid_name_use == lsa.SID_NAME_DOM_GRP:
 657             try:
 658                 members = s3db.enum_group_members(group.sid)
 659                 groupmembers[str(group.sid)] = members
 660             except passdb.error, e:
 661                 logger.warn("Ignoring group '%s' %s listed but then not found: %s",
 662                             group.nt_name, group.sid, e)
 663                 continue
 664         elif group.sid_name_use == lsa.SID_NAME_WKN_GRP:
 665             (group_dom_sid, rid) = group.sid.split()
 666             if (group_dom_sid != security.dom_sid(security.SID_BUILTIN)):
 667                 logger.warn("Ignoring 'well known' group '%s' (should already be in AD, and have no members)",
 668                             group.nt_name)
 669                 continue
 670             # A number of buggy databases mix up well known groups and aliases.
 671             try:
 672                 members = s3db.enum_aliasmem(group.sid)
 673                 groupmembers[str(group.sid)] = members
 674             except passdb.error, e:
 675                 logger.warn("Ignoring group '%s' %s listed but then not found: %s",
 676                             group.nt_name, group.sid, e)
 677                 continue
 678         else:
 679             logger.warn("Ignoring group '%s' %s with sid_name_use=%d",
 680                         group.nt_name, group.sid, group.sid_name_use)
 681             continue
 682
 683     # Export users from old passdb backend
 684     logger.info("Exporting users")
 685     userlist = s3db.search_users(0)
 686     userdata = {}
 687     uids = {}
 688     admin_user = None
 689     for entry in userlist:
 690         if machinerid and machinerid == entry['rid']:
 691             continue
 692         username = entry['account_name']
 693         if entry['rid'] < 1000:
 694             logger.info("  Skipping wellknown rid=%d (for username=%s)", entry['rid'], username)
 695             continue
 696         if entry['rid'] >= next_rid:
 697             next_rid = entry['rid'] + 1
 698
 699         user = s3db.getsampwnam(username)
 700         acct_type = (user.acct_ctrl & (samr.ACB_NORMAL|samr.ACB_WSTRUST|samr.ACB_SVRTRUST|samr.ACB_DOMTRUST))
 701         if acct_type == samr.ACB_SVRTRUST:
 702             logger.warn("  Demoting BDC account trust for %s, this DC must be elevated to an AD DC using 'samba-tool domain dcpromo'" % username[:-1])
 703             user.acct_ctrl = (user.acct_ctrl & ~samr.ACB_SVRTRUST) | samr.ACB_WSTRUST
 704
 705         elif acct_type == samr.ACB_DOMTRUST:
 706             logger.warn("  Skipping inter-domain trust from domain %s, this trust must be re-created as an AD trust" % username[:-1])
 707             continue
 708
 709         elif acct_type == (samr.ACB_WSTRUST) and username[-1] != '$':
 710             logger.warn("  Skipping account %s that has ACB_WSTRUST (W) set but does not end in $.  This account can not have worked, and is probably left over from a misconfiguration." % username)
 711             continue
 712
 713         elif acct_type == (samr.ACB_NORMAL|samr.ACB_WSTRUST) and username[-1] == '$':
 714             logger.warn("  Fixing account %s which had both ACB_NORMAL (U) and ACB_WSTRUST (W) set.  Account will be marked as ACB_WSTRUST (W), i.e. as a domain member" % username)
 715             user.acct_ctrl = (user.acct_ctrl & ~samr.ACB_NORMAL)
 716
 717         elif acct_type == (samr.ACB_NORMAL|samr.ACB_SVRTRUST) and username[-1] == '$':
 718             logger.warn("  Fixing account %s which had both ACB_NORMAL (U) and ACB_SVRTRUST (S) set.  Account will be marked as ACB_WSTRUST (S), i.e. as a domain member" % username)
 719             user.acct_ctrl = (user.acct_ctrl & ~samr.ACB_NORMAL)
 720
 721         elif acct_type == 0 and username[-1] != '$':
 722             user.acct_ctrl = (user.acct_ctrl | samr.ACB_NORMAL)
 723
 724         elif (acct_type == samr.ACB_NORMAL or acct_type == samr.ACB_WSTRUST):
 725             pass
 726
 727         else:
 728             raise ProvisioningError("""Failed to upgrade due to invalid account %s, account control flags 0x%08X must have exactly one of
 729 ACB_NORMAL (N, 0x%08X), ACB_WSTRUST (W 0x%08X), ACB_SVRTRUST (S 0x%08X) or ACB_DOMTRUST (D 0x%08X).
 730
 731 Please fix this account before attempting to upgrade again
 732 """
 733                                     % (username, user.acct_ctrl,
 734                                        samr.ACB_NORMAL, samr.ACB_WSTRUST, samr.ACB_SVRTRUST, samr.ACB_DOMTRUST))
 735
 736         userdata[username] = user
 737         try:
 738             uids[username] = s3db.sid_to_id(user.user_sid)[0]
 739         except passdb.error:
 740             try:
 741                 uids[username] = pwd.getpwnam(username).pw_uid
 742             except KeyError:
 743                 pass
 744
 745         if not admin_user and username.lower() == 'root':
 746             admin_user = username
 747         if username.lower() == 'administrator':
 748             admin_user = username
 749
 750         try:
 751             group_memberships = s3db.enum_group_memberships(user);
 752             for group in group_memberships:
 753                 if str(group) in groupmembers:
 754                     if user.user_sid not in groupmembers[str(group)]:
 755                         groupmembers[str(group)].append(user.user_sid)
 756                 else:
 757                     groupmembers[str(group)] = [user.user_sid];
 758         except passdb.error, e:
 759             logger.warn("Ignoring group memberships of '%s' %s: %s",
 760                         username, user.user_sid, e)
 761
 762     logger.info("Next rid = %d", next_rid)
 763
 764     # Check for same username/groupname
 765     group_names = set([g.nt_name for g in grouplist])
 766     user_names = set([u['account_name'] for u in userlist])
 767     common_names = group_names.intersection(user_names)
 768     if common_names:
 769         logger.error("Following names are both user names and group names:")
 770         for name in common_names:
 771             logger.error("   %s" % name)
 772         raise ProvisioningError("Please remove common user/group names before upgrade.")
 773
 774     # Check for same user sid/group sid
 775     group_sids = set([str(g.sid) for g in grouplist])
 776     if len(grouplist) != len(group_sids):
 777         raise ProvisioningError("Please remove duplicate group sid entries before upgrade.")
 778     user_sids = set(["%s-%u" % (domainsid, u['rid']) for u in userlist])
 779     if len(userlist) != len(user_sids):
 780         raise ProvisioningError("Please remove duplicate user sid entries before upgrade.")
 781     common_sids = group_sids.intersection(user_sids)
 782     if common_sids:
 783         logger.error("Following sids are both user and group sids:")
 784         for sid in common_sids:
 785             logger.error("   %s" % str(sid))
 786         raise ProvisioningError("Please remove duplicate sid entries before upgrade.")
 787
 788     # Get posix attributes from ldap or the os
 789     homes = {}
 790     shells = {}
 791     pgids = {}
 792     if ldap:
 793         creds = Credentials()
 794         creds.guess(samba3.lp)
 795         creds.set_bind_dn(ldapuser)
 796         creds.set_password(ldappass)
 797         urls = samba3.lp.get("passdb backend").split(":",1)[1].strip('"')
 798         for url in urls.split():
 799             try:
 800                 ldb_object = Ldb(url, credentials=creds)
 801             except ldb.LdbError, e:
 802                 raise ProvisiongError("Could not open ldb connection to %s, the error message is: %s" % (url, e))
 803             else:
 804                 break
 805     logger.info("Exporting posix attributes")
 806     userlist = s3db.search_users(0)
 807     for entry in userlist:
 808         username = entry['account_name']
 809         if username in uids.keys():
 810             try:
 811                 if ldap:
 812                     homes[username] = get_posix_attr_from_ldap_backend(logger, ldb_object, base_dn, username, "homeDirectory")
 813                 else:
 814                     homes[username] = pwd.getpwnam(username).pw_dir
 815             except KeyError:
 816                 pass
 817             except IndexError:
 818                 pass
 819
 820             try:
 821                 if ldap:
 822                     shells[username] = get_posix_attr_from_ldap_backend(logger, ldb_object, base_dn, username, "loginShell")
 823                 else:
 824                     shells[username] = pwd.getpwnam(username).pw_shell
 825             except KeyError:
 826                 pass
 827             except IndexError:
 828                 pass
 829
 830             try:
 831                 if ldap:
 832                     pgids[username] = get_posix_attr_from_ldap_backend(logger, ldb_object, base_dn, username, "gidNumber")
 833                 else:
 834                     pgids[username] = pwd.getpwnam(username).pw_gid
 835             except KeyError:
 836                 pass
 837             except IndexError:
 838                 pass
 839
 840     logger.info("Reading WINS database")
 841     samba3_winsdb = None
 842     try:
 843         samba3_winsdb = samba3.get_wins_db()
 844     except IOError, e:
 845         logger.warn('Cannot open wins database, Ignoring: %s', str(e))
 846
 847     if not (serverrole == "ROLE_DOMAIN_BDC" or serverrole == "ROLE_DOMAIN_PDC"):
 848         dns_backend = "NONE"
 849
 850     # If we found an admin user, set a fake pw that we will override.
 851     # This avoids us printing out an admin password that we won't actually
 852     # set.
 853     if admin_user:
 854         adminpass = generate_random_password(12, 32)
 855     else:
 856         adminpass = None
 857
 858     # Do full provision
 859     result = provision(logger, session_info,
 860                        targetdir=targetdir, realm=realm, domain=domainname,
 861                        domainsid=str(domainsid), next_rid=next_rid,
 862                        dc_rid=machinerid, adminpass = adminpass,
 863                        dom_for_fun_level=dsdb.DS_DOMAIN_FUNCTION_2003,
 864                        hostname=netbiosname.lower(), machinepass=machinepass,
 865                        serverrole=serverrole, samdb_fill=FILL_FULL,
 866                        useeadb=useeadb, dns_backend=dns_backend, use_rfc2307=True,
 867                        use_ntvfs=use_ntvfs, skip_sysvolacl=True)
 868     result.report_logger(logger)
 869
 870     # Import WINS database
 871     logger.info("Importing WINS database")
 872
 873     if samba3_winsdb:
 874         import_wins(Ldb(result.paths.winsdb), samba3_winsdb)
 875
 876     # Set Account policy
 877     logger.info("Importing Account policy")
 878     import_sam_policy(result.samdb, policy, logger)
 879
 880     # Migrate IDMAP database
 881     logger.info("Importing idmap database")
 882     import_idmap(result.idmap, samba3, logger)
 883
 884     # Set the s3 context for samba4 configuration
 885     new_lp_ctx = s3param.get_context()
 886     new_lp_ctx.load(result.lp.configfile)
 887     new_lp_ctx.set("private dir", result.lp.get("private dir"))
 888     new_lp_ctx.set("state directory", result.lp.get("state directory"))
 889     new_lp_ctx.set("lock directory", result.lp.get("lock directory"))
 890
 891     # Connect to samba4 backend
 892     s4_passdb = passdb.PDB(new_lp_ctx.get("passdb backend"))
 893
 894     # Start a new transaction (should speed this up a little, due to index churn)
 895     result.samdb.transaction_start()
 896
 897     logger.info("Adding groups")
 898     try:
 899         # Export groups to samba4 backend
 900         logger.info("Importing groups")
 901         for g in grouplist:
 902             # Ignore uninitialized groups (gid = -1)
 903             if g.gid != -1:
 904                 add_group_from_mapping_entry(result.samdb, g, logger)
 905                 add_ad_posix_idmap_entry(result.samdb, g.sid, g.gid, "ID_TYPE_GID", logger)
 906                 add_posix_attrs(samdb=result.samdb, sid=g.sid, name=g.nt_name, nisdomain=domainname.lower(), xid_type="ID_TYPE_GID", logger=logger)
 907
 908     except:
 909         # We need this, so that we do not give even more errors due to not cancelling the transaction
 910         result.samdb.transaction_cancel()
 911         raise
 912
 913     logger.info("Commiting 'add groups' transaction to disk")
 914     result.samdb.transaction_commit()
 915
 916     logger.info("Adding users")
 917     # Start a new transaction (should speed this up a little, due to index churn)
 918     result.samdb.transaction_start()
 919
 920     try:
 921         # Export users to samba4 backend
 922         logger.info("Importing users")
 923         for username in userdata:
 924             if username.lower() == 'administrator':
 925                 if userdata[username].user_sid != dom_sid(str(domainsid) + "-500"):
 926                     logger.error("User 'Administrator' in your existing directory has SID %s, expected it to be %s" % (userdata[username].user_sid, dom_sid(str(domainsid) + "-500")))
 927                     raise ProvisioningError("User 'Administrator' in your existing directory does not have SID ending in -500")
 928             if username.lower() == 'root':
 929                 if userdata[username].user_sid == dom_sid(str(domainsid) + "-500"):
 930                     logger.warn('User root has been replaced by Administrator')
 931                 else:
 932                     logger.warn('User root has been kept in the directory, it should be removed in favour of the Administrator user')
 933
 934             s4_passdb.add_sam_account(userdata[username])
 935             if username in uids:
 936                 add_ad_posix_idmap_entry(result.samdb, userdata[username].user_sid, uids[username], "ID_TYPE_UID", logger)
 937                 if (username in homes) and (homes[username] is not None) and \
 938                    (username in shells) and (shells[username] is not None) and \
 939                    (username in pgids) and (pgids[username] is not None):
 940                     add_posix_attrs(samdb=result.samdb, sid=userdata[username].user_sid, name=username, nisdomain=domainname.lower(), xid_type="ID_TYPE_UID", home=homes[username], shell=shells[username], pgid=pgids[username], logger=logger)
 941
 942     except:
 943         # We need this, so that we do not give even more errors due to not cancelling the transaction
 944         result.samdb.transaction_cancel()
 945         raise
 946
 947     logger.info("Commiting 'add users' transaction to disk")
 948     result.samdb.transaction_commit()
 949
 950     logger.info("Adding users to groups")
 951     # Start a new transaction (should speed this up a little, due to index churn)
 952     result.samdb.transaction_start()
 953
 954     try:
 955         for g in grouplist:
 956             if str(g.sid) in groupmembers:
 957                 add_users_to_group(result.samdb, g, groupmembers[str(g.sid)], logger)
 958
 959     except:
 960         # We need this, so that we do not give even more errors due to not cancelling the transaction
 961         result.samdb.transaction_cancel()
 962         raise
 963
 964     logger.info("Commiting 'add users to groups' transaction to disk")
 965     result.samdb.transaction_commit()
 966
 967     # Set password for administrator
 968     if admin_user:
 969         logger.info("Setting password for administrator")
 970         admin_userdata = s4_passdb.getsampwnam("administrator")
 971         admin_userdata.nt_passwd = userdata[admin_user].nt_passwd
 972         if userdata[admin_user].lanman_passwd:
 973             admin_userdata.lanman_passwd = userdata[admin_user].lanman_passwd
 974         admin_userdata.pass_last_set_time = userdata[admin_user].pass_last_set_time
 975         if userdata[admin_user].pw_history:
 976             admin_userdata.pw_history = userdata[admin_user].pw_history
 977         s4_passdb.update_sam_account(admin_userdata)
 978         logger.info("Administrator password has been set to password of user '%s'", admin_user)
 979
 980     if result.server_role == "active directory domain controller":
 981         setsysvolacl(result.samdb, result.paths.netlogon, result.paths.sysvol,
 982                 result.paths.root_uid, result.paths.root_gid,
 983                 security.dom_sid(result.domainsid), result.names.dnsdomain,
 984                 result.names.domaindn, result.lp, use_ntvfs)
 985
 986     # FIXME: import_registry(registry.Registry(), samba3.get_registry())
 987     # FIXME: shares