source4/scripting/python/samba/provision/__init__.py

   1
   2 # Unix SMB/CIFS implementation.
   3 # backend code for provisioning a Samba4 server
   4
   5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2010
   6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008-2009
   7 # Copyright (C) Oliver Liebel <oliver@itc.li> 2008-2009
   8 #
   9 # Based on the original in EJS:
  10 # Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
  11 #
  12 # This program is free software; you can redistribute it and/or modify
  13 # it under the terms of the GNU General Public License as published by
  14 # the Free Software Foundation; either version 3 of the License, or
  15 # (at your option) any later version.
  16 #
  17 # This program is distributed in the hope that it will be useful,
  18 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  19 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20 # GNU General Public License for more details.
  21 #
  22 # You should have received a copy of the GNU General Public License
  23 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 #
  25
  26 """Functions for setting up a Samba configuration."""
  27
  28 __docformat__ = "restructuredText"
  29
  30 from base64 import b64encode
  31 import os
  32 import re
  33 import pwd
  34 import grp
  35 import logging
  36 import time
  37 import uuid
  38 import socket
  39 import urllib
  40 import shutil
  41 import string
  42
  43 import ldb
  44
  45 from samba.auth import system_session, admin_session
  46 import samba
  47 from samba.dsdb import DS_DOMAIN_FUNCTION_2000
  48 from samba import (
  49     Ldb,
  50     check_all_substituted,
  51     read_and_sub_file,
  52     setup_file,
  53     substitute_var,
  54     valid_netbios_name,
  55     version,
  56     )
  57 from samba.dcerpc import security, misc
  58 from samba.dcerpc.misc import (
  59     SEC_CHAN_BDC,
  60     SEC_CHAN_WKSTA,
  61     )
  62 from samba.dsdb import (
  63     DS_DOMAIN_FUNCTION_2003,
  64     DS_DOMAIN_FUNCTION_2008_R2,
  65     ENC_ALL_TYPES,
  66     )
  67 from samba.idmap import IDmapDB
  68 from samba.ms_display_specifiers import read_ms_ldif
  69 from samba.ntacls import setntacl, dsacl2fsacl
  70 from samba.ndr import ndr_pack, ndr_unpack
  71 from samba.provision.backend import (
  72     ExistingBackend,
  73     FDSBackend,
  74     LDBBackend,
  75     OpenLDAPBackend,
  76     )
  77 from samba.provision.sambadns import setup_ad_dns
  78
  79 import samba.param
  80 import samba.registry
  81 from samba.schema import Schema
  82 from samba.samdb import SamDB
  83 from samba.dbchecker import dbcheck
  84
  85
  86 VALID_NETBIOS_CHARS = " !#$%&'()-.@^_{}~"
  87 DEFAULT_POLICY_GUID = "31B2F340-016D-11D2-945F-00C04FB984F9"
  88 DEFAULT_DC_POLICY_GUID = "6AC1786C-016F-11D2-945F-00C04fB984F9"
  89 DEFAULTSITE = "Default-First-Site-Name"
  90 LAST_PROVISION_USN_ATTRIBUTE = "lastProvisionUSN"
  91
  92
  93 def setup_path(file):
  94     """Return an absolute path to the provision tempate file specified by file"""
  95     return os.path.join(samba.param.setup_dir(), file)
  96
  97 # Descriptors of naming contexts and other important objects
  98
  99 # "get_schema_descriptor" is located in "schema.py"
 100
 101 def get_config_descriptor(domain_sid):
 102     sddl = "O:EAG:EAD:(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
 103            "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
 104            "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
 105            "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
 106            "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
 107            "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
 108            "(A;;RPLCLORC;;;AU)(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;EA)" \
 109            "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;CIIO;RPWPCRCCLCLORCWOWDSDSW;;;DA)" \
 110            "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
 111            "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;ED)" \
 112            "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
 113            "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;BA)" \
 114            "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ER)" \
 115            "S:(AU;SA;WPWOWD;;;WD)(AU;SA;CR;;;BA)(AU;SA;CR;;;DU)" \
 116            "(OU;SA;CR;45ec5156-db7e-47bb-b53f-dbeb2d03c40f;;WD)"
 117     sec = security.descriptor.from_sddl(sddl, domain_sid)
 118     return ndr_pack(sec)
 119
 120
 121 def get_domain_descriptor(domain_sid):
 122     sddl= "O:BAG:BAD:AI(OA;CIIO;RP;4c164200-20c0-11d0-a768-00aa006e0529;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)" \
 123         "(OA;CIIO;RP;4c164200-20c0-11d0-a768-00aa006e0529;bf967aba-0de6-11d0-a285-00aa003049e2;RU)" \
 124     "(OA;CIIO;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)" \
 125     "(OA;CIIO;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)" \
 126     "(OA;CIIO;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)" \
 127     "(OA;CIIO;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)" \
 128     "(OA;CIIO;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)" \
 129     "(OA;CIIO;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)" \
 130     "(OA;CIIO;RP;037088f8-0ae1-11d2-b422-00a0c968f939;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)" \
 131     "(OA;CIIO;RP;037088f8-0ae1-11d2-b422-00a0c968f939;bf967aba-0de6-11d0-a285-00aa003049e2;RU)" \
 132     "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ER)" \
 133     "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;DD)" \
 134     "(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a86-0de6-11d0-a285-00aa003049e2;ED)" \
 135     "(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a9c-0de6-11d0-a285-00aa003049e2;ED)" \
 136     "(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967aba-0de6-11d0-a285-00aa003049e2;ED)" \
 137     "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;BA)" \
 138     "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
 139     "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
 140     "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
 141     "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
 142     "(OA;;CR;1131f6ae-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
 143     "(OA;;CR;e2a36dc9-ae17-47c3-b58b-be34c55ba633;;IF)" \
 144     "(OA;;RP;c7407360-20bf-11d0-a768-00aa006e0529;;RU)" \
 145     "(OA;;RP;b8119fd0-04f6-4762-ab7a-4986c76b3f9a;;RU)" \
 146     "(OA;CIIO;RPLCLORC;;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)" \
 147     "(OA;CIIO;RPLCLORC;;bf967a9c-0de6-11d0-a285-00aa003049e2;RU)" \
 148     "(OA;CIIO;RPLCLORC;;bf967aba-0de6-11d0-a285-00aa003049e2;RU)" \
 149     "(OA;;CR;05c74c5e-4deb-43b4-bd9f-86664c2a7fd5;;AU)" \
 150     "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;ED)" \
 151     "(OA;;CR;ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501;;AU)" \
 152     "(OA;;CR;280f369c-67c7-438e-ae98-1d46f3c6f541;;AU)" \
 153     "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
 154     "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
 155     "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
 156     "(OA;;CR;1131f6ae-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
 157     "(OA;;RP;b8119fd0-04f6-4762-ab7a-4986c76b3f9a;;AU)" \
 158     "(OA;CIIO;RPWPCR;91e647de-d96f-4b70-9557-d63ff4f3ccd8;;PS)" \
 159     "(A;;RPWPCRCCLCLORCWOWDSW;;;DA)" \
 160     "(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;EA)" \
 161     "(A;;RPRC;;;RU)" \
 162     "(A;CI;LC;;;RU)" \
 163     "(A;CI;RPWPCRCCLCLORCWOWDSDSW;;;BA)" \
 164     "(A;;RP;;;WD)" \
 165     "(A;;RPLCLORC;;;ED)" \
 166     "(A;;RPLCLORC;;;AU)" \
 167     "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)" \
 168     "S:AI(OU;CISA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)" \
 169     "(OU;CISA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)" \
 170     "(AU;SA;CR;;;DU)(AU;SA;CR;;;BA)(AU;SA;WPWOWD;;;WD)"
 171     sec = security.descriptor.from_sddl(sddl, domain_sid)
 172     return ndr_pack(sec)
 173
 174
 175 class ProvisionPaths(object):
 176
 177     def __init__(self):
 178         self.shareconf = None
 179         self.hklm = None
 180         self.hkcu = None
 181         self.hkcr = None
 182         self.hku = None
 183         self.hkpd = None
 184         self.hkpt = None
 185         self.samdb = None
 186         self.idmapdb = None
 187         self.secrets = None
 188         self.keytab = None
 189         self.dns_keytab = None
 190         self.dns = None
 191         self.winsdb = None
 192         self.private_dir = None
 193
 194
 195 class ProvisionNames(object):
 196
 197     def __init__(self):
 198         self.rootdn = None
 199         self.domaindn = None
 200         self.configdn = None
 201         self.schemadn = None
 202         self.ldapmanagerdn = None
 203         self.dnsdomain = None
 204         self.realm = None
 205         self.netbiosname = None
 206         self.domain = None
 207         self.hostname = None
 208         self.sitename = None
 209         self.smbconf = None
 210
 211 def find_provision_key_parameters(samdb, secretsdb, idmapdb, paths, smbconf, lp):
 212     """Get key provision parameters (realm, domain, ...) from a given provision
 213
 214     :param samdb: An LDB object connected to the sam.ldb file
 215     :param secretsdb: An LDB object connected to the secrets.ldb file
 216     :param idmapdb: An LDB object connected to the idmap.ldb file
 217     :param paths: A list of path to provision object
 218     :param smbconf: Path to the smb.conf file
 219     :param lp: A LoadParm object
 220     :return: A list of key provision parameters
 221     """
 222     names = ProvisionNames()
 223     names.adminpass = None
 224
 225     # NT domain, kerberos realm, root dn, domain dn, domain dns name
 226     names.domain = string.upper(lp.get("workgroup"))
 227     names.realm = lp.get("realm")
 228     names.dnsdomain = names.realm.lower()
 229     basedn = samba.dn_from_dns_name(names.dnsdomain)
 230     names.realm = string.upper(names.realm)
 231     # netbiosname
 232     # Get the netbiosname first (could be obtained from smb.conf in theory)
 233     res = secretsdb.search(expression="(flatname=%s)" %
 234                             names.domain,base="CN=Primary Domains",
 235                             scope=ldb.SCOPE_SUBTREE, attrs=["sAMAccountName"])
 236     names.netbiosname = str(res[0]["sAMAccountName"]).replace("$","")
 237
 238     names.smbconf = smbconf
 239
 240     # That's a bit simplistic but it's ok as long as we have only 3
 241     # partitions
 242     current = samdb.search(expression="(objectClass=*)",
 243         base="", scope=ldb.SCOPE_BASE,
 244         attrs=["defaultNamingContext", "schemaNamingContext",
 245                "configurationNamingContext","rootDomainNamingContext"])
 246
 247     names.configdn = current[0]["configurationNamingContext"]
 248     configdn = str(names.configdn)
 249     names.schemadn = current[0]["schemaNamingContext"]
 250     if not (ldb.Dn(samdb, basedn) == (ldb.Dn(samdb,
 251                                        current[0]["defaultNamingContext"][0]))):
 252         raise ProvisioningError(("basedn in %s (%s) and from %s (%s)"
 253                                  "is not the same ..." % (paths.samdb,
 254                                     str(current[0]["defaultNamingContext"][0]),
 255                                     paths.smbconf, basedn)))
 256
 257     names.domaindn=current[0]["defaultNamingContext"]
 258     names.rootdn=current[0]["rootDomainNamingContext"]
 259     # default site name
 260     res3 = samdb.search(expression="(objectClass=site)",
 261         base="CN=Sites," + configdn, scope=ldb.SCOPE_ONELEVEL, attrs=["cn"])
 262     names.sitename = str(res3[0]["cn"])
 263
 264     # dns hostname and server dn
 265     res4 = samdb.search(expression="(CN=%s)" % names.netbiosname,
 266                             base="OU=Domain Controllers,%s" % basedn,
 267                             scope=ldb.SCOPE_ONELEVEL, attrs=["dNSHostName"])
 268     names.hostname = str(res4[0]["dNSHostName"]).replace("." + names.dnsdomain,"")
 269
 270     server_res = samdb.search(expression="serverReference=%s" % res4[0].dn,
 271                                 attrs=[], base=configdn)
 272     names.serverdn = server_res[0].dn
 273
 274     # invocation id/objectguid
 275     res5 = samdb.search(expression="(objectClass=*)",
 276             base="CN=NTDS Settings,%s" % str(names.serverdn), scope=ldb.SCOPE_BASE,
 277             attrs=["invocationID", "objectGUID"])
 278     names.invocation = str(ndr_unpack(misc.GUID, res5[0]["invocationId"][0]))
 279     names.ntdsguid = str(ndr_unpack(misc.GUID, res5[0]["objectGUID"][0]))
 280
 281     # domain guid/sid
 282     res6 = samdb.search(expression="(objectClass=*)", base=basedn,
 283             scope=ldb.SCOPE_BASE, attrs=["objectGUID",
 284                 "objectSid","msDS-Behavior-Version" ])
 285     names.domainguid = str(ndr_unpack(misc.GUID, res6[0]["objectGUID"][0]))
 286     names.domainsid = ndr_unpack( security.dom_sid, res6[0]["objectSid"][0])
 287     if res6[0].get("msDS-Behavior-Version") is None or \
 288         int(res6[0]["msDS-Behavior-Version"][0]) < DS_DOMAIN_FUNCTION_2000:
 289         names.domainlevel = DS_DOMAIN_FUNCTION_2000
 290     else:
 291         names.domainlevel = int(res6[0]["msDS-Behavior-Version"][0])
 292
 293     # policy guid
 294     res7 = samdb.search(expression="(displayName=Default Domain Policy)",
 295                         base="CN=Policies,CN=System," + basedn,
 296                         scope=ldb.SCOPE_ONELEVEL, attrs=["cn","displayName"])
 297     names.policyid = str(res7[0]["cn"]).replace("{","").replace("}","")
 298     # dc policy guid
 299     res8 = samdb.search(expression="(displayName=Default Domain Controllers"
 300                                    " Policy)",
 301                             base="CN=Policies,CN=System," + basedn,
 302                             scope=ldb.SCOPE_ONELEVEL, attrs=["cn","displayName"])
 303     if len(res8) == 1:
 304         names.policyid_dc = str(res8[0]["cn"]).replace("{","").replace("}","")
 305     else:
 306         names.policyid_dc = None
 307     res9 = idmapdb.search(expression="(cn=%s)" %
 308                             (security.SID_BUILTIN_ADMINISTRATORS),
 309                             attrs=["xidNumber"])
 310     if len(res9) == 1:
 311         names.wheel_gid = res9[0]["xidNumber"]
 312     else:
 313         raise ProvisioningError("Unable to find uid/gid for Domain Admins rid")
 314     return names
 315
 316 def update_provision_usn(samdb, low, high, id, replace=False):
 317     """Update the field provisionUSN in sam.ldb
 318
 319     This field is used to track range of USN modified by provision and
 320     upgradeprovision.
 321     This value is used afterward by next provision to figure out if
 322     the field have been modified since last provision.
 323
 324     :param samdb: An LDB object connect to sam.ldb
 325     :param low: The lowest USN modified by this upgrade
 326     :param high: The highest USN modified by this upgrade
 327     :param id: The invocation id of the samba's dc
 328     :param replace: A boolean indicating if the range should replace any
 329                     existing one or appended (default)
 330     """
 331
 332     tab = []
 333     if not replace:
 334         entry = samdb.search(base="@PROVISION",
 335                              scope=ldb.SCOPE_BASE,
 336                              attrs=[LAST_PROVISION_USN_ATTRIBUTE, "dn"])
 337         for e in entry[0][LAST_PROVISION_USN_ATTRIBUTE]:
 338             if not re.search(';', e):
 339                 e = "%s;%s" % (e, id)
 340             tab.append(str(e))
 341
 342     tab.append("%s-%s;%s" % (low, high, id))
 343     delta = ldb.Message()
 344     delta.dn = ldb.Dn(samdb, "@PROVISION")
 345     delta[LAST_PROVISION_USN_ATTRIBUTE] = ldb.MessageElement(tab,
 346         ldb.FLAG_MOD_REPLACE, LAST_PROVISION_USN_ATTRIBUTE)
 347     entry = samdb.search(expression='provisionnerID=*',
 348                          base="@PROVISION", scope=ldb.SCOPE_BASE,
 349                          attrs=["provisionnerID"])
 350     if len(entry) == 0 or len(entry[0]) == 0:
 351         delta["provisionnerID"] = ldb.MessageElement(id, ldb.FLAG_MOD_ADD, "provisionnerID")
 352     samdb.modify(delta)
 353
 354
 355 def set_provision_usn(samdb, low, high, id):
 356     """Set the field provisionUSN in sam.ldb
 357     This field is used to track range of USN modified by provision and
 358     upgradeprovision.
 359     This value is used afterward by next provision to figure out if
 360     the field have been modified since last provision.
 361
 362     :param samdb: An LDB object connect to sam.ldb
 363     :param low: The lowest USN modified by this upgrade
 364     :param high: The highest USN modified by this upgrade
 365     :param id: The invocationId of the provision"""
 366
 367     tab = []
 368     tab.append("%s-%s;%s" % (low, high, id))
 369
 370     delta = ldb.Message()
 371     delta.dn = ldb.Dn(samdb, "@PROVISION")
 372     delta[LAST_PROVISION_USN_ATTRIBUTE] = ldb.MessageElement(tab,
 373         ldb.FLAG_MOD_ADD, LAST_PROVISION_USN_ATTRIBUTE)
 374     samdb.add(delta)
 375
 376
 377 def get_max_usn(samdb,basedn):
 378     """ This function return the biggest USN present in the provision
 379
 380     :param samdb: A LDB object pointing to the sam.ldb
 381     :param basedn: A string containing the base DN of the provision
 382                     (ie. DC=foo, DC=bar)
 383     :return: The biggest USN in the provision"""
 384
 385     res = samdb.search(expression="objectClass=*",base=basedn,
 386                          scope=ldb.SCOPE_SUBTREE,attrs=["uSNChanged"],
 387                          controls=["search_options:1:2",
 388                                    "server_sort:1:1:uSNChanged",
 389                                    "paged_results:1:1"])
 390     return res[0]["uSNChanged"]
 391
 392
 393 def get_last_provision_usn(sam):
 394     """Get USNs ranges modified by a provision or an upgradeprovision
 395
 396     :param sam: An LDB object pointing to the sam.ldb
 397     :return: a dictionnary which keys are invocation id and values are an array
 398              of integer representing the different ranges
 399     """
 400     try:
 401         entry = sam.search(expression="%s=*" % LAST_PROVISION_USN_ATTRIBUTE,
 402                            base="@PROVISION", scope=ldb.SCOPE_BASE,
 403                            attrs=[LAST_PROVISION_USN_ATTRIBUTE, "provisionnerID"])
 404     except ldb.LdbError, (ecode, emsg):
 405         if ecode == ldb.ERR_NO_SUCH_OBJECT:
 406             return None
 407         raise
 408     if len(entry):
 409         myids = []
 410         range = {}
 411         p = re.compile(r'-')
 412         if entry[0].get("provisionnerID"):
 413             for e in entry[0]["provisionnerID"]:
 414                 myids.append(str(e))
 415         for r in entry[0][LAST_PROVISION_USN_ATTRIBUTE]:
 416             tab1 = str(r).split(';')
 417             if len(tab1) == 2:
 418                 id = tab1[1]
 419             else:
 420                 id = "default"
 421             if (len(myids) > 0 and id not in myids):
 422                 continue
 423             tab2 = p.split(tab1[0])
 424             if range.get(id) == None:
 425                 range[id] = []
 426             range[id].append(tab2[0])
 427             range[id].append(tab2[1])
 428         return range
 429     else:
 430         return None
 431
 432
 433 class ProvisionResult(object):
 434
 435     def __init__(self):
 436         self.paths = None
 437         self.domaindn = None
 438         self.lp = None
 439         self.samdb = None
 440         self.idmap = None
 441
 442
 443 def check_install(lp, session_info, credentials):
 444     """Check whether the current install seems ok.
 445
 446     :param lp: Loadparm context
 447     :param session_info: Session information
 448     :param credentials: Credentials
 449     """
 450     if lp.get("realm") == "":
 451         raise Exception("Realm empty")
 452     samdb = Ldb(lp.samdb_url(), session_info=session_info,
 453             credentials=credentials, lp=lp)
 454     if len(samdb.search("(cn=Administrator)")) != 1:
 455         raise ProvisioningError("No administrator account found")
 456
 457
 458 def findnss(nssfn, names):
 459     """Find a user or group from a list of possibilities.
 460
 461     :param nssfn: NSS Function to try (should raise KeyError if not found)
 462     :param names: Names to check.
 463     :return: Value return by first names list.
 464     """
 465     for name in names:
 466         try:
 467             return nssfn(name)
 468         except KeyError:
 469             pass
 470     raise KeyError("Unable to find user/group in %r" % names)
 471
 472
 473 findnss_uid = lambda names: findnss(pwd.getpwnam, names)[2]
 474 findnss_gid = lambda names: findnss(grp.getgrnam, names)[2]
 475
 476
 477 def setup_add_ldif(ldb, ldif_path, subst_vars=None,controls=["relax:0"]):
 478     """Setup a ldb in the private dir.
 479
 480     :param ldb: LDB file to import data into
 481     :param ldif_path: Path of the LDIF file to load
 482     :param subst_vars: Optional variables to subsitute in LDIF.
 483     :param nocontrols: Optional list of controls, can be None for no controls
 484     """
 485     assert isinstance(ldif_path, str)
 486     data = read_and_sub_file(ldif_path, subst_vars)
 487     ldb.add_ldif(data, controls)
 488
 489
 490 def setup_modify_ldif(ldb, ldif_path, subst_vars=None,controls=["relax:0"]):
 491     """Modify a ldb in the private dir.
 492
 493     :param ldb: LDB object.
 494     :param ldif_path: LDIF file path.
 495     :param subst_vars: Optional dictionary with substitution variables.
 496     """
 497     data = read_and_sub_file(ldif_path, subst_vars)
 498     ldb.modify_ldif(data, controls)
 499
 500
 501 def setup_ldb(ldb, ldif_path, subst_vars):
 502     """Import a LDIF a file into a LDB handle, optionally substituting
 503     variables.
 504
 505     :note: Either all LDIF data will be added or none (using transactions).
 506
 507     :param ldb: LDB file to import into.
 508     :param ldif_path: Path to the LDIF file.
 509     :param subst_vars: Dictionary with substitution variables.
 510     """
 511     assert ldb is not None
 512     ldb.transaction_start()
 513     try:
 514         setup_add_ldif(ldb, ldif_path, subst_vars)
 515     except Exception:
 516         ldb.transaction_cancel()
 517         raise
 518     else:
 519         ldb.transaction_commit()
 520
 521
 522 def provision_paths_from_lp(lp, dnsdomain):
 523     """Set the default paths for provisioning.
 524
 525     :param lp: Loadparm context.
 526     :param dnsdomain: DNS Domain name
 527     """
 528     paths = ProvisionPaths()
 529     paths.private_dir = lp.get("private dir")
 530
 531     # This is stored without path prefix for the "privateKeytab" attribute in
 532     # "secrets_dns.ldif".
 533     paths.dns_keytab = "dns.keytab"
 534     paths.keytab = "secrets.keytab"
 535
 536     paths.shareconf = os.path.join(paths.private_dir, "share.ldb")
 537     paths.samdb = os.path.join(paths.private_dir, "sam.ldb")
 538     paths.idmapdb = os.path.join(paths.private_dir, "idmap.ldb")
 539     paths.secrets = os.path.join(paths.private_dir, "secrets.ldb")
 540     paths.privilege = os.path.join(paths.private_dir, "privilege.ldb")
 541     paths.dns = os.path.join(paths.private_dir, "dns", dnsdomain + ".zone")
 542     paths.dns_update_list = os.path.join(paths.private_dir, "dns_update_list")
 543     paths.spn_update_list = os.path.join(paths.private_dir, "spn_update_list")
 544     paths.namedconf = os.path.join(paths.private_dir, "named.conf")
 545     paths.namedconf_update = os.path.join(paths.private_dir, "named.conf.update")
 546     paths.namedtxt = os.path.join(paths.private_dir, "named.txt")
 547     paths.krb5conf = os.path.join(paths.private_dir, "krb5.conf")
 548     paths.winsdb = os.path.join(paths.private_dir, "wins.ldb")
 549     paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
 550     paths.phpldapadminconfig = os.path.join(paths.private_dir,
 551                                             "phpldapadmin-config.php")
 552     paths.hklm = "hklm.ldb"
 553     paths.hkcr = "hkcr.ldb"
 554     paths.hkcu = "hkcu.ldb"
 555     paths.hku = "hku.ldb"
 556     paths.hkpd = "hkpd.ldb"
 557     paths.hkpt = "hkpt.ldb"
 558     paths.sysvol = lp.get("path", "sysvol")
 559     paths.netlogon = lp.get("path", "netlogon")
 560     paths.smbconf = lp.configfile
 561     return paths
 562
 563
 564 def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None,
 565                 serverrole=None, rootdn=None, domaindn=None, configdn=None,
 566                 schemadn=None, serverdn=None, sitename=None):
 567     """Guess configuration settings to use."""
 568
 569     if hostname is None:
 570         hostname = socket.gethostname().split(".")[0]
 571
 572     netbiosname = lp.get("netbios name")
 573     if netbiosname is None:
 574         netbiosname = hostname
 575         # remove forbidden chars
 576         newnbname = ""
 577         for x in netbiosname:
 578             if x.isalnum() or x in VALID_NETBIOS_CHARS:
 579                 newnbname = "%s%c" % (newnbname, x)
 580         # force the length to be <16
 581         netbiosname = newnbname[0:15]
 582     assert netbiosname is not None
 583     netbiosname = netbiosname.upper()
 584     if not valid_netbios_name(netbiosname):
 585         raise InvalidNetbiosName(netbiosname)
 586
 587     if dnsdomain is None:
 588         dnsdomain = lp.get("realm")
 589         if dnsdomain is None or dnsdomain == "":
 590             raise ProvisioningError("guess_names: 'realm' not specified in supplied %s!", lp.configfile)
 591
 592     dnsdomain = dnsdomain.lower()
 593
 594     if serverrole is None:
 595         serverrole = lp.get("server role")
 596         if serverrole is None:
 597             raise ProvisioningError("guess_names: 'server role' not specified in supplied %s!" % lp.configfile)
 598
 599     serverrole = serverrole.lower()
 600
 601     realm = dnsdomain.upper()
 602
 603     if lp.get("realm") == "":
 604         raise ProvisioningError("guess_names: 'realm =' was not specified in supplied %s.  Please remove the smb.conf file and let provision generate it" % lp.configfile)
 605
 606     if lp.get("realm").upper() != realm:
 607         raise ProvisioningError("guess_names: 'realm=%s' in %s must match chosen realm '%s'!  Please remove the smb.conf file and let provision generate it" % (lp.get("realm").upper(), realm, lp.configfile))
 608
 609     if lp.get("server role").lower() != serverrole:
 610         raise ProvisioningError("guess_names: 'server role=%s' in %s must match chosen server role '%s'!  Please remove the smb.conf file and let provision generate it" % (lp.get("server role"), serverrole, lp.configfile))
 611
 612     if serverrole == "domain controller":
 613         if domain is None:
 614             # This will, for better or worse, default to 'WORKGROUP'
 615             domain = lp.get("workgroup")
 616         domain = domain.upper()
 617
 618         if lp.get("workgroup").upper() != domain:
 619             raise ProvisioningError("guess_names: Workgroup '%s' in smb.conf must match chosen domain '%s'!  Please remove the %s file and let provision generate it" % (lp.get("workgroup").upper(), domain, lp.configfile))
 620
 621         if domaindn is None:
 622             domaindn = samba.dn_from_dns_name(dnsdomain)
 623
 624         if domain == netbiosname:
 625             raise ProvisioningError("guess_names: Domain '%s' must not be equal to short host name '%s'!" % (domain, netbiosname))
 626     else:
 627         domain = netbiosname
 628         if domaindn is None:
 629             domaindn = "DC=" + netbiosname
 630
 631     if not valid_netbios_name(domain):
 632         raise InvalidNetbiosName(domain)
 633
 634     if hostname.upper() == realm:
 635         raise ProvisioningError("guess_names: Realm '%s' must not be equal to hostname '%s'!" % (realm, hostname))
 636     if netbiosname.upper() == realm:
 637         raise ProvisioningError("guess_names: Realm '%s' must not be equal to netbios hostname '%s'!" % (realm, netbiosname))
 638     if domain == realm:
 639         raise ProvisioningError("guess_names: Realm '%s' must not be equal to short domain name '%s'!" % (realm, domain))
 640
 641     if rootdn is None:
 642        rootdn = domaindn
 643
 644     if configdn is None:
 645         configdn = "CN=Configuration," + rootdn
 646     if schemadn is None:
 647         schemadn = "CN=Schema," + configdn
 648
 649     if sitename is None:
 650         sitename=DEFAULTSITE
 651
 652     names = ProvisionNames()
 653     names.rootdn = rootdn
 654     names.domaindn = domaindn
 655     names.configdn = configdn
 656     names.schemadn = schemadn
 657     names.ldapmanagerdn = "CN=Manager," + rootdn
 658     names.dnsdomain = dnsdomain
 659     names.domain = domain
 660     names.realm = realm
 661     names.netbiosname = netbiosname
 662     names.hostname = hostname
 663     names.sitename = sitename
 664     names.serverdn = "CN=%s,CN=Servers,CN=%s,CN=Sites,%s" % (
 665         netbiosname, sitename, configdn)
 666
 667     return names
 668
 669
 670 def make_smbconf(smbconf, hostname, domain, realm, serverrole,
 671                  targetdir, sid_generator="internal", eadb=False, lp=None):
 672     """Create a new smb.conf file based on a couple of basic settings.
 673     """
 674     assert smbconf is not None
 675     if hostname is None:
 676         hostname = socket.gethostname().split(".")[0]
 677         netbiosname = hostname.upper()
 678         # remove forbidden chars
 679         newnbname = ""
 680         for x in netbiosname:
 681             if x.isalnum() or x in VALID_NETBIOS_CHARS:
 682                 newnbname = "%s%c" % (newnbname, x)
 683         #force the length to be <16
 684         netbiosname = newnbname[0:15]
 685     else:
 686         netbiosname = hostname.upper()
 687
 688     if serverrole is None:
 689         serverrole = "standalone"
 690
 691     assert serverrole in ("domain controller", "member server", "standalone")
 692     if serverrole == "domain controller":
 693         smbconfsuffix = "dc"
 694     elif serverrole == "member server":
 695         smbconfsuffix = "member"
 696     elif serverrole == "standalone":
 697         smbconfsuffix = "standalone"
 698
 699     if sid_generator is None:
 700         sid_generator = "internal"
 701
 702     assert domain is not None
 703     domain = domain.upper()
 704
 705     assert realm is not None
 706     realm = realm.upper()
 707
 708     if lp is None:
 709         lp = samba.param.LoadParm()
 710     #Load non-existant file
 711     if os.path.exists(smbconf):
 712         lp.load(smbconf)
 713     if eadb and not lp.get("posix:eadb"):
 714         if targetdir is not None:
 715             privdir = os.path.join(targetdir, "private")
 716         else:
 717             privdir = lp.get("private dir")
 718         lp.set("posix:eadb", os.path.abspath(os.path.join(privdir, "eadb.tdb")))
 719
 720     if targetdir is not None:
 721         privatedir_line = "private dir = " + os.path.abspath(os.path.join(targetdir, "private"))
 722         lockdir_line = "lock dir = " + os.path.abspath(targetdir)
 723         statedir_line = "state directory = " + os.path.abspath(targetdir)
 724         cachedir_line = "cache directory = " + os.path.abspath(targetdir)
 725
 726         lp.set("lock dir", os.path.abspath(targetdir))
 727         lp.set("state directory", os.path.abspath(targetdir))
 728         lp.set("cache directory", os.path.abspath(targetdir))
 729     else:
 730         privatedir_line = ""
 731         lockdir_line = ""
 732         statedir_line = ""
 733         cachedir_line = ""
 734
 735     sysvol = os.path.join(lp.get("state directory"), "sysvol")
 736     netlogon = os.path.join(sysvol, realm.lower(), "scripts")
 737
 738     setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix),
 739                smbconf, {
 740             "NETBIOS_NAME": netbiosname,
 741             "DOMAIN": domain,
 742             "REALM": realm,
 743             "SERVERROLE": serverrole,
 744             "NETLOGONPATH": netlogon,
 745             "SYSVOLPATH": sysvol,
 746             "PRIVATEDIR_LINE": privatedir_line,
 747             "LOCKDIR_LINE": lockdir_line,
 748             "STATEDIR_LINE": statedir_line,
 749             "CACHEDIR_LINE": cachedir_line
 750             })
 751
 752     # reload the smb.conf
 753     lp.load(smbconf)
 754
 755     # and dump it without any values that are the default
 756     # this ensures that any smb.conf parameters that were set
 757     # on the provision/join command line are set in the resulting smb.conf
 758     f = open(smbconf, mode='w')
 759     lp.dump(f, False)
 760     f.close()
 761
 762
 763
 764 def setup_name_mappings(samdb, idmap, sid, domaindn, root_uid, nobody_uid,
 765                         users_gid, wheel_gid):
 766     """setup reasonable name mappings for sam names to unix names.
 767
 768     :param samdb: SamDB object.
 769     :param idmap: IDmap db object.
 770     :param sid: The domain sid.
 771     :param domaindn: The domain DN.
 772     :param root_uid: uid of the UNIX root user.
 773     :param nobody_uid: uid of the UNIX nobody user.
 774     :param users_gid: gid of the UNIX users group.
 775     :param wheel_gid: gid of the UNIX wheel group.
 776     """
 777     idmap.setup_name_mapping("S-1-5-7", idmap.TYPE_UID, nobody_uid)
 778     idmap.setup_name_mapping("S-1-5-32-544", idmap.TYPE_GID, wheel_gid)
 779
 780     idmap.setup_name_mapping(sid + "-500", idmap.TYPE_UID, root_uid)
 781     idmap.setup_name_mapping(sid + "-513", idmap.TYPE_GID, users_gid)
 782
 783
 784 def setup_samdb_partitions(samdb_path, logger, lp, session_info,
 785                            provision_backend, names, schema, serverrole,
 786                            erase=False):
 787     """Setup the partitions for the SAM database.
 788
 789     Alternatively, provision() may call this, and then populate the database.
 790
 791     :note: This will wipe the Sam Database!
 792
 793     :note: This function always removes the local SAM LDB file. The erase
 794         parameter controls whether to erase the existing data, which
 795         may not be stored locally but in LDAP.
 796
 797     """
 798     assert session_info is not None
 799
 800     # We use options=["modules:"] to stop the modules loading - we
 801     # just want to wipe and re-initialise the database, not start it up
 802
 803     try:
 804         os.unlink(samdb_path)
 805     except OSError:
 806         pass
 807
 808     samdb = Ldb(url=samdb_path, session_info=session_info,
 809                 lp=lp, options=["modules:"])
 810
 811     ldap_backend_line = "# No LDAP backend"
 812     if provision_backend.type is not "ldb":
 813         ldap_backend_line = "ldapBackend: %s" % provision_backend.ldap_uri
 814
 815     samdb.transaction_start()
 816     try:
 817         logger.info("Setting up sam.ldb partitions and settings")
 818         setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), {
 819                 "LDAP_BACKEND_LINE": ldap_backend_line
 820         })
 821
 822
 823         setup_add_ldif(samdb, setup_path("provision_init.ldif"), {
 824                 "BACKEND_TYPE": provision_backend.type,
 825                 "SERVER_ROLE": serverrole
 826                 })
 827
 828         logger.info("Setting up sam.ldb rootDSE")
 829         setup_samdb_rootdse(samdb, names)
 830     except Exception:
 831         samdb.transaction_cancel()
 832         raise
 833     else:
 834         samdb.transaction_commit()
 835
 836
 837 def secretsdb_self_join(secretsdb, domain,
 838                         netbiosname, machinepass, domainsid=None,
 839                         realm=None, dnsdomain=None,
 840                         keytab_path=None,
 841                         key_version_number=1,
 842                         secure_channel_type=SEC_CHAN_WKSTA):
 843     """Add domain join-specific bits to a secrets database.
 844
 845     :param secretsdb: Ldb Handle to the secrets database
 846     :param machinepass: Machine password
 847     """
 848     attrs = ["whenChanged",
 849            "secret",
 850            "priorSecret",
 851            "priorChanged",
 852            "krb5Keytab",
 853            "privateKeytab"]
 854
 855     if realm is not None:
 856         if dnsdomain is None:
 857             dnsdomain = realm.lower()
 858         dnsname = '%s.%s' % (netbiosname.lower(), dnsdomain.lower())
 859     else:
 860         dnsname = None
 861     shortname = netbiosname.lower()
 862
 863     # We don't need to set msg["flatname"] here, because rdn_name will handle
 864     # it, and it causes problems for modifies anyway
 865     msg = ldb.Message(ldb.Dn(secretsdb, "flatname=%s,cn=Primary Domains" % domain))
 866     msg["secureChannelType"] = [str(secure_channel_type)]
 867     msg["objectClass"] = ["top", "primaryDomain"]
 868     if dnsname is not None:
 869         msg["objectClass"] = ["top", "primaryDomain", "kerberosSecret"]
 870         msg["realm"] = [realm]
 871         msg["saltPrincipal"] = ["host/%s@%s" % (dnsname, realm.upper())]
 872         msg["msDS-KeyVersionNumber"] = [str(key_version_number)]
 873         msg["privateKeytab"] = ["secrets.keytab"]
 874
 875     msg["secret"] = [machinepass]
 876     msg["samAccountName"] = ["%s$" % netbiosname]
 877     msg["secureChannelType"] = [str(secure_channel_type)]
 878     if domainsid is not None:
 879         msg["objectSid"] = [ndr_pack(domainsid)]
 880
 881     # This complex expression tries to ensure that we don't have more
 882     # than one record for this SID, realm or netbios domain at a time,
 883     # but we don't delete the old record that we are about to modify,
 884     # because that would delete the keytab and previous password.
 885     res = secretsdb.search(base="cn=Primary Domains", attrs=attrs,
 886         expression=("(&(|(flatname=%s)(realm=%s)(objectSid=%s))(objectclass=primaryDomain)(!(dn=%s)))" % (domain, realm, str(domainsid), str(msg.dn))),
 887         scope=ldb.SCOPE_ONELEVEL)
 888
 889     for del_msg in res:
 890         secretsdb.delete(del_msg.dn)
 891
 892     res = secretsdb.search(base=msg.dn, attrs=attrs, scope=ldb.SCOPE_BASE)
 893
 894     if len(res) == 1:
 895         msg["priorSecret"] = [res[0]["secret"][0]]
 896         msg["priorWhenChanged"] = [res[0]["whenChanged"][0]]
 897
 898         try:
 899             msg["privateKeytab"] = [res[0]["privateKeytab"][0]]
 900         except KeyError:
 901             pass
 902
 903         try:
 904             msg["krb5Keytab"] = [res[0]["krb5Keytab"][0]]
 905         except KeyError:
 906             pass
 907
 908         for el in msg:
 909             if el != 'dn':
 910                 msg[el].set_flags(ldb.FLAG_MOD_REPLACE)
 911         secretsdb.modify(msg)
 912         secretsdb.rename(res[0].dn, msg.dn)
 913     else:
 914         spn = [ 'HOST/%s' % shortname ]
 915         if secure_channel_type == SEC_CHAN_BDC and dnsname is not None:
 916             # we are a domain controller then we add servicePrincipalName
 917             # entries for the keytab code to update.
 918             spn.extend([ 'HOST/%s' % dnsname ])
 919         msg["servicePrincipalName"] = spn
 920
 921         secretsdb.add(msg)
 922
 923
 924 def secretsdb_setup_dns(secretsdb, names, private_dir, realm,
 925                         dnsdomain, dns_keytab_path, dnspass):
 926     """Add DNS specific bits to a secrets database.
 927
 928     :param secretsdb: Ldb Handle to the secrets database
 929     :param machinepass: Machine password
 930     """
 931     try:
 932         os.unlink(os.path.join(private_dir, dns_keytab_path))
 933     except OSError:
 934         pass
 935
 936     setup_ldb(secretsdb, setup_path("secrets_dns.ldif"), {
 937             "REALM": realm,
 938             "DNSDOMAIN": dnsdomain,
 939             "DNS_KEYTAB": dns_keytab_path,
 940             "DNSPASS_B64": b64encode(dnspass),
 941             "HOSTNAME": names.hostname,
 942             "DNSNAME" : '%s.%s' % (
 943                 names.netbiosname.lower(), names.dnsdomain.lower())
 944             })
 945
 946
 947 def setup_secretsdb(paths, session_info, backend_credentials, lp):
 948     """Setup the secrets database.
 949
 950    :note: This function does not handle exceptions and transaction on purpose,
 951        it's up to the caller to do this job.
 952
 953     :param path: Path to the secrets database.
 954     :param session_info: Session info.
 955     :param credentials: Credentials
 956     :param lp: Loadparm context
 957     :return: LDB handle for the created secrets database
 958     """
 959     if os.path.exists(paths.secrets):
 960         os.unlink(paths.secrets)
 961
 962     keytab_path = os.path.join(paths.private_dir, paths.keytab)
 963     if os.path.exists(keytab_path):
 964         os.unlink(keytab_path)
 965
 966     dns_keytab_path = os.path.join(paths.private_dir, paths.dns_keytab)
 967     if os.path.exists(dns_keytab_path):
 968         os.unlink(dns_keytab_path)
 969
 970     path = paths.secrets
 971
 972     secrets_ldb = Ldb(path, session_info=session_info,
 973                       lp=lp)
 974     secrets_ldb.erase()
 975     secrets_ldb.load_ldif_file_add(setup_path("secrets_init.ldif"))
 976     secrets_ldb = Ldb(path, session_info=session_info,
 977                       lp=lp)
 978     secrets_ldb.transaction_start()
 979     try:
 980         secrets_ldb.load_ldif_file_add(setup_path("secrets.ldif"))
 981
 982         if (backend_credentials is not None and
 983             backend_credentials.authentication_requested()):
 984             if backend_credentials.get_bind_dn() is not None:
 985                 setup_add_ldif(secrets_ldb,
 986                     setup_path("secrets_simple_ldap.ldif"), {
 987                         "LDAPMANAGERDN": backend_credentials.get_bind_dn(),
 988                         "LDAPMANAGERPASS_B64": b64encode(backend_credentials.get_password())
 989                         })
 990             else:
 991                 setup_add_ldif(secrets_ldb,
 992                     setup_path("secrets_sasl_ldap.ldif"), {
 993                         "LDAPADMINUSER": backend_credentials.get_username(),
 994                         "LDAPADMINREALM": backend_credentials.get_realm(),
 995                         "LDAPADMINPASS_B64": b64encode(backend_credentials.get_password())
 996                         })
 997
 998         return secrets_ldb
 999     except Exception:
1000         secrets_ldb.transaction_cancel()
1001         raise
1002
1003
1004 def setup_privileges(path, session_info, lp):
1005     """Setup the privileges database.
1006
1007     :param path: Path to the privileges database.
1008     :param session_info: Session info.
1009     :param credentials: Credentials
1010     :param lp: Loadparm context
1011     :return: LDB handle for the created secrets database
1012     """
1013     if os.path.exists(path):
1014         os.unlink(path)
1015     privilege_ldb = Ldb(path, session_info=session_info, lp=lp)
1016     privilege_ldb.erase()
1017     privilege_ldb.load_ldif_file_add(setup_path("provision_privilege.ldif"))
1018
1019
1020 def setup_registry(path, session_info, lp):
1021     """Setup the registry.
1022
1023     :param path: Path to the registry database
1024     :param session_info: Session information
1025     :param credentials: Credentials
1026     :param lp: Loadparm context
1027     """
1028     reg = samba.registry.Registry()
1029     hive = samba.registry.open_ldb(path, session_info=session_info, lp_ctx=lp)
1030     reg.mount_hive(hive, samba.registry.HKEY_LOCAL_MACHINE)
1031     provision_reg = setup_path("provision.reg")
1032     assert os.path.exists(provision_reg)
1033     reg.diff_apply(provision_reg)
1034
1035
1036 def setup_idmapdb(path, session_info, lp):
1037     """Setup the idmap database.
1038
1039     :param path: path to the idmap database
1040     :param session_info: Session information
1041     :param credentials: Credentials
1042     :param lp: Loadparm context
1043     """
1044     if os.path.exists(path):
1045         os.unlink(path)
1046
1047     idmap_ldb = IDmapDB(path, session_info=session_info, lp=lp)
1048     idmap_ldb.erase()
1049     idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif"))
1050     return idmap_ldb
1051
1052
1053 def setup_samdb_rootdse(samdb, names):
1054     """Setup the SamDB rootdse.
1055
1056     :param samdb: Sam Database handle
1057     """
1058     setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
1059         "SCHEMADN": names.schemadn,
1060         "DOMAINDN": names.domaindn,
1061         "ROOTDN"  : names.rootdn,
1062         "CONFIGDN": names.configdn,
1063         "SERVERDN": names.serverdn,
1064         })
1065
1066
1067 def setup_self_join(samdb, names, machinepass, dnspass,
1068                     domainsid, next_rid, invocationid,
1069                     policyguid, policyguid_dc, domainControllerFunctionality,
1070                     ntdsguid, dc_rid=None):
1071     """Join a host to its own domain."""
1072     assert isinstance(invocationid, str)
1073     if ntdsguid is not None:
1074         ntdsguid_line = "objectGUID: %s\n"%ntdsguid
1075     else:
1076         ntdsguid_line = ""
1077
1078     if dc_rid is None:
1079         dc_rid = next_rid
1080
1081     setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), {
1082               "CONFIGDN": names.configdn,
1083               "SCHEMADN": names.schemadn,
1084               "DOMAINDN": names.domaindn,
1085               "SERVERDN": names.serverdn,
1086               "INVOCATIONID": invocationid,
1087               "NETBIOSNAME": names.netbiosname,
1088               "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
1089               "MACHINEPASS_B64": b64encode(machinepass.encode('utf-16-le')),
1090               "DOMAINSID": str(domainsid),
1091               "DCRID": str(dc_rid),
1092               "SAMBA_VERSION_STRING": version,
1093               "NTDSGUID": ntdsguid_line,
1094               "DOMAIN_CONTROLLER_FUNCTIONALITY": str(
1095                   domainControllerFunctionality)})
1096
1097     setup_add_ldif(samdb, setup_path("provision_group_policy.ldif"), {
1098               "POLICYGUID": policyguid,
1099               "POLICYGUID_DC": policyguid_dc,
1100               "DNSDOMAIN": names.dnsdomain,
1101               "DOMAINDN": names.domaindn})
1102
1103     # add the NTDSGUID based SPNs
1104     ntds_dn = "CN=NTDS Settings,%s" % names.serverdn
1105     names.ntdsguid = samdb.searchone(basedn=ntds_dn, attribute="objectGUID",
1106                                      expression="", scope=ldb.SCOPE_BASE)
1107     assert isinstance(names.ntdsguid, str)
1108
1109     # Setup fSMORoleOwner entries to point at the newly created DC entry
1110     setup_modify_ldif(samdb, setup_path("provision_self_join_modify.ldif"), {
1111               "DOMAINDN": names.domaindn,
1112               "CONFIGDN": names.configdn,
1113               "SCHEMADN": names.schemadn,
1114               "DEFAULTSITE": names.sitename,
1115               "SERVERDN": names.serverdn,
1116               "NETBIOSNAME": names.netbiosname,
1117               "RIDALLOCATIONSTART": str(next_rid + 100),
1118               "RIDALLOCATIONEND": str(next_rid + 100 + 499),
1119               })
1120
1121     # This is Samba4 specific and should be replaced by the correct
1122     # DNS AD-style setup
1123     setup_add_ldif(samdb, setup_path("provision_dns_add_samba.ldif"), {
1124               "DNSDOMAIN": names.dnsdomain,
1125               "DOMAINDN": names.domaindn,
1126               "DNSPASS_B64": b64encode(dnspass.encode('utf-16-le')),
1127               "HOSTNAME" : names.hostname,
1128               "DNSNAME" : '%s.%s' % (
1129                   names.netbiosname.lower(), names.dnsdomain.lower())
1130               })
1131
1132
1133 def getpolicypath(sysvolpath, dnsdomain, guid):
1134     """Return the physical path of policy given its guid.
1135
1136     :param sysvolpath: Path to the sysvol folder
1137     :param dnsdomain: DNS name of the AD domain
1138     :param guid: The GUID of the policy
1139     :return: A string with the complete path to the policy folder
1140     """
1141
1142     if guid[0] != "{":
1143         guid = "{%s}" % guid
1144     policy_path = os.path.join(sysvolpath, dnsdomain, "Policies", guid)
1145     return policy_path
1146
1147
1148 def create_gpo_struct(policy_path):
1149     if not os.path.exists(policy_path):
1150         os.makedirs(policy_path, 0775)
1151     open(os.path.join(policy_path, "GPT.INI"), 'w').write(
1152                       "[General]\r\nVersion=0")
1153     p = os.path.join(policy_path, "MACHINE")
1154     if not os.path.exists(p):
1155         os.makedirs(p, 0775)
1156     p = os.path.join(policy_path, "USER")
1157     if not os.path.exists(p):
1158         os.makedirs(p, 0775)
1159
1160
1161 def create_default_gpo(sysvolpath, dnsdomain, policyguid, policyguid_dc):
1162     """Create the default GPO for a domain
1163
1164     :param sysvolpath: Physical path for the sysvol folder
1165     :param dnsdomain: DNS domain name of the AD domain
1166     :param policyguid: GUID of the default domain policy
1167     :param policyguid_dc: GUID of the default domain controler policy
1168     """
1169     policy_path = getpolicypath(sysvolpath,dnsdomain,policyguid)
1170     create_gpo_struct(policy_path)
1171
1172     policy_path = getpolicypath(sysvolpath,dnsdomain,policyguid_dc)
1173     create_gpo_struct(policy_path)
1174
1175
1176 def setup_samdb(path, session_info, provision_backend, lp, names,
1177         logger, domainsid, domainguid, policyguid, policyguid_dc, fill,
1178         adminpass, krbtgtpass, machinepass, invocationid, dnspass, ntdsguid,
1179         serverrole, am_rodc=False, dom_for_fun_level=None, schema=None,
1180         next_rid=None, dc_rid=None):
1181     """Setup a complete SAM Database.
1182
1183     :note: This will wipe the main SAM database file!
1184     """
1185
1186     if next_rid is None:
1187         next_rid = 1000
1188
1189     # Provision does not make much sense values larger than 1000000000
1190     # as the upper range of the rIDAvailablePool is 1073741823 and
1191     # we don't want to create a domain that cannot allocate rids.
1192     if next_rid < 1000 or next_rid > 1000000000:
1193         error = "You want to run SAMBA 4 with a next_rid of %u, " % (next_rid)
1194         error += "the valid range is %u-%u. The default is %u." % (
1195             1000, 1000000000, 1000)
1196         raise ProvisioningError(error)
1197
1198     # ATTENTION: Do NOT change these default values without discussion with the
1199     # team and/or release manager. They have a big impact on the whole program!
1200     domainControllerFunctionality = DS_DOMAIN_FUNCTION_2008_R2
1201
1202     if dom_for_fun_level is None:
1203         dom_for_fun_level = DS_DOMAIN_FUNCTION_2003
1204
1205     if dom_for_fun_level > domainControllerFunctionality:
1206         raise ProvisioningError("You want to run SAMBA 4 on a domain and forest function level which itself is higher than its actual DC function level (2008_R2). This won't work!")
1207
1208     domainFunctionality = dom_for_fun_level
1209     forestFunctionality = dom_for_fun_level
1210
1211     # Also wipes the database
1212     setup_samdb_partitions(path, logger=logger, lp=lp,
1213         provision_backend=provision_backend, session_info=session_info,
1214         names=names, serverrole=serverrole, schema=schema)
1215
1216     if schema is None:
1217         schema = Schema(domainsid, schemadn=names.schemadn)
1218
1219     # Load the database, but don's load the global schema and don't connect
1220     # quite yet
1221     samdb = SamDB(session_info=session_info, url=None, auto_connect=False,
1222                   credentials=provision_backend.credentials, lp=lp,
1223                   global_schema=False, am_rodc=am_rodc)
1224
1225     logger.info("Pre-loading the Samba 4 and AD schema")
1226
1227     # Load the schema from the one we computed earlier
1228     samdb.set_schema(schema)
1229
1230     # Set the NTDS settings DN manually - in order to have it already around
1231     # before the provisioned tree exists and we connect
1232     samdb.set_ntds_settings_dn("CN=NTDS Settings,%s" % names.serverdn)
1233
1234     # And now we can connect to the DB - the schema won't be loaded from the
1235     # DB
1236     samdb.connect(path)
1237
1238     if fill == FILL_DRS:
1239         return samdb
1240
1241     samdb.transaction_start()
1242     try:
1243         # Set the domain functionality levels onto the database.
1244         # Various module (the password_hash module in particular) need
1245         # to know what level of AD we are emulating.
1246
1247         # These will be fixed into the database via the database
1248         # modifictions below, but we need them set from the start.
1249         samdb.set_opaque_integer("domainFunctionality", domainFunctionality)
1250         samdb.set_opaque_integer("forestFunctionality", forestFunctionality)
1251         samdb.set_opaque_integer("domainControllerFunctionality",
1252             domainControllerFunctionality)
1253
1254         samdb.set_domain_sid(str(domainsid))
1255         samdb.set_invocation_id(invocationid)
1256
1257         logger.info("Adding DomainDN: %s" % names.domaindn)
1258
1259         # impersonate domain admin
1260         admin_session_info = admin_session(lp, str(domainsid))
1261         samdb.set_session_info(admin_session_info)
1262         if domainguid is not None:
1263             domainguid_line = "objectGUID: %s\n-" % domainguid
1264         else:
1265             domainguid_line = ""
1266
1267         descr = b64encode(get_domain_descriptor(domainsid))
1268         setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
1269                 "DOMAINDN": names.domaindn,
1270                 "DOMAINSID": str(domainsid),
1271                 "DESCRIPTOR": descr,
1272                 "DOMAINGUID": domainguid_line
1273                 })
1274
1275         setup_modify_ldif(samdb, setup_path("provision_basedn_modify.ldif"), {
1276             "DOMAINDN": names.domaindn,
1277             "CREATTIME": str(samba.unix2nttime(int(time.time()))),
1278             "NEXTRID": str(next_rid),
1279             "DEFAULTSITE": names.sitename,
1280             "CONFIGDN": names.configdn,
1281             "POLICYGUID": policyguid,
1282             "DOMAIN_FUNCTIONALITY": str(domainFunctionality),
1283             "SAMBA_VERSION_STRING": version
1284             })
1285
1286         logger.info("Adding configuration container")
1287         descr = b64encode(get_config_descriptor(domainsid))
1288         setup_add_ldif(samdb, setup_path("provision_configuration_basedn.ldif"), {
1289             "CONFIGDN": names.configdn,
1290             "DESCRIPTOR": descr,
1291             })
1292
1293         # Now register this container in the root of the forest
1294         msg = ldb.Message(ldb.Dn(samdb, names.domaindn))
1295         msg["subRefs"] = ldb.MessageElement(names.configdn , ldb.FLAG_MOD_ADD,
1296                     "subRefs")
1297
1298         # The LDIF here was created when the Schema object was constructed
1299         logger.info("Setting up sam.ldb schema")
1300         samdb.add_ldif(schema.schema_dn_add, controls=["relax:0"])
1301         samdb.modify_ldif(schema.schema_dn_modify)
1302         samdb.write_prefixes_from_schema()
1303         samdb.add_ldif(schema.schema_data, controls=["relax:0"])
1304         setup_add_ldif(samdb, setup_path("aggregate_schema.ldif"),
1305                        {"SCHEMADN": names.schemadn})
1306
1307         logger.info("Reopening sam.ldb with new schema")
1308     except Exception:
1309         samdb.transaction_cancel()
1310         raise
1311     else:
1312         samdb.transaction_commit()
1313
1314     samdb = SamDB(session_info=admin_session_info, auto_connect=False,
1315                 credentials=provision_backend.credentials, lp=lp,
1316                 global_schema=False, am_rodc=am_rodc)
1317
1318     # Set the NTDS settings DN manually - in order to have it already around
1319     # before the provisioned tree exists and we connect
1320     samdb.set_ntds_settings_dn("CN=NTDS Settings,%s" % names.serverdn)
1321     samdb.connect(path)
1322
1323     samdb.transaction_start()
1324     try:
1325         samdb.invocation_id = invocationid
1326
1327         logger.info("Setting up sam.ldb configuration data")
1328         setup_add_ldif(samdb, setup_path("provision_configuration.ldif"), {
1329             "CONFIGDN": names.configdn,
1330             "NETBIOSNAME": names.netbiosname,
1331             "DEFAULTSITE": names.sitename,
1332             "DNSDOMAIN": names.dnsdomain,
1333             "DOMAIN": names.domain,
1334             "SCHEMADN": names.schemadn,
1335             "DOMAINDN": names.domaindn,
1336             "SERVERDN": names.serverdn,
1337             "FOREST_FUNCTIONALITY": str(forestFunctionality),
1338             "DOMAIN_FUNCTIONALITY": str(domainFunctionality),
1339             })
1340
1341         logger.info("Setting up display specifiers")
1342         display_specifiers_ldif = read_ms_ldif(
1343             setup_path('display-specifiers/DisplaySpecifiers-Win2k8R2.txt'))
1344         display_specifiers_ldif = substitute_var(display_specifiers_ldif,
1345             {"CONFIGDN": names.configdn})
1346         check_all_substituted(display_specifiers_ldif)
1347         samdb.add_ldif(display_specifiers_ldif)
1348
1349         logger.info("Adding users container")
1350         setup_add_ldif(samdb, setup_path("provision_users_add.ldif"), {
1351                 "DOMAINDN": names.domaindn})
1352         logger.info("Modifying users container")
1353         setup_modify_ldif(samdb, setup_path("provision_users_modify.ldif"), {
1354                 "DOMAINDN": names.domaindn})
1355         logger.info("Adding computers container")
1356         setup_add_ldif(samdb, setup_path("provision_computers_add.ldif"), {
1357                 "DOMAINDN": names.domaindn})
1358         logger.info("Modifying computers container")
1359         setup_modify_ldif(samdb,
1360             setup_path("provision_computers_modify.ldif"), {
1361                 "DOMAINDN": names.domaindn})
1362         logger.info("Setting up sam.ldb data")
1363         setup_add_ldif(samdb, setup_path("provision.ldif"), {
1364             "CREATTIME": str(samba.unix2nttime(int(time.time()))),
1365             "DOMAINDN": names.domaindn,
1366             "NETBIOSNAME": names.netbiosname,
1367             "DEFAULTSITE": names.sitename,
1368             "CONFIGDN": names.configdn,
1369             "SERVERDN": names.serverdn,
1370             "RIDAVAILABLESTART": str(next_rid + 600),
1371             "POLICYGUID_DC": policyguid_dc
1372             })
1373
1374         setup_modify_ldif(samdb,
1375             setup_path("provision_basedn_references.ldif"), {
1376                 "DOMAINDN": names.domaindn})
1377
1378         setup_modify_ldif(samdb,
1379             setup_path("provision_configuration_references.ldif"), {
1380                 "CONFIGDN": names.configdn,
1381                 "SCHEMADN": names.schemadn})
1382         if fill == FILL_FULL:
1383             logger.info("Setting up sam.ldb users and groups")
1384             setup_add_ldif(samdb, setup_path("provision_users.ldif"), {
1385                 "DOMAINDN": names.domaindn,
1386                 "DOMAINSID": str(domainsid),
1387                 "CONFIGDN": names.configdn,
1388                 "ADMINPASS_B64": b64encode(adminpass.encode('utf-16-le')),
1389                 "KRBTGTPASS_B64": b64encode(krbtgtpass.encode('utf-16-le'))
1390                 })
1391
1392             logger.info("Setting up self join")
1393             setup_self_join(samdb, names=names, invocationid=invocationid,
1394                             dnspass=dnspass,
1395                             machinepass=machinepass,
1396                             domainsid=domainsid,
1397                             next_rid=next_rid,
1398                             dc_rid=dc_rid,
1399                             policyguid=policyguid,
1400                             policyguid_dc=policyguid_dc,
1401                             domainControllerFunctionality=domainControllerFunctionality,
1402                             ntdsguid=ntdsguid)
1403
1404             ntds_dn = "CN=NTDS Settings,%s" % names.serverdn
1405             names.ntdsguid = samdb.searchone(basedn=ntds_dn,
1406                 attribute="objectGUID", expression="", scope=ldb.SCOPE_BASE)
1407             assert isinstance(names.ntdsguid, str)
1408     except Exception:
1409         samdb.transaction_cancel()
1410         raise
1411     else:
1412         samdb.transaction_commit()
1413         return samdb
1414
1415
1416 FILL_FULL = "FULL"
1417 FILL_NT4SYNC = "NT4SYNC"
1418 FILL_DRS = "DRS"
1419 SYSVOL_ACL = "O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)"
1420 POLICIES_ACL = "O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001301bf;;;PA)"
1421
1422
1423 def set_dir_acl(path, acl, lp, domsid):
1424     setntacl(lp, path, acl, domsid)
1425     for root, dirs, files in os.walk(path, topdown=False):
1426         for name in files:
1427             setntacl(lp, os.path.join(root, name), acl, domsid)
1428         for name in dirs:
1429             setntacl(lp, os.path.join(root, name), acl, domsid)
1430
1431
1432 def set_gpos_acl(sysvol, dnsdomain, domainsid, domaindn, samdb, lp):
1433     """Set ACL on the sysvol/<dnsname>/Policies folder and the policy
1434     folders beneath.
1435
1436     :param sysvol: Physical path for the sysvol folder
1437     :param dnsdomain: The DNS name of the domain
1438     :param domainsid: The SID of the domain
1439     :param domaindn: The DN of the domain (ie. DC=...)
1440     :param samdb: An LDB object on the SAM db
1441     :param lp: an LP object
1442     """
1443
1444     # Set ACL for GPO root folder
1445     root_policy_path = os.path.join(sysvol, dnsdomain, "Policies")
1446     setntacl(lp, root_policy_path, POLICIES_ACL, str(domainsid))
1447
1448     res = samdb.search(base="CN=Policies,CN=System,%s"%(domaindn),
1449                         attrs=["cn", "nTSecurityDescriptor"],
1450                         expression="", scope=ldb.SCOPE_ONELEVEL)
1451
1452     for policy in res:
1453         acl = ndr_unpack(security.descriptor,
1454                          str(policy["nTSecurityDescriptor"])).as_sddl()
1455         policy_path = getpolicypath(sysvol, dnsdomain, str(policy["cn"]))
1456         set_dir_acl(policy_path, dsacl2fsacl(acl, str(domainsid)), lp,
1457                     str(domainsid))
1458
1459
1460 def setsysvolacl(samdb, netlogon, sysvol, gid, domainsid, dnsdomain, domaindn,
1461     lp):
1462     """Set the ACL for the sysvol share and the subfolders
1463
1464     :param samdb: An LDB object on the SAM db
1465     :param netlogon: Physical path for the netlogon folder
1466     :param sysvol: Physical path for the sysvol folder
1467     :param gid: The GID of the "Domain adminstrators" group
1468     :param domainsid: The SID of the domain
1469     :param dnsdomain: The DNS name of the domain
1470     :param domaindn: The DN of the domain (ie. DC=...)
1471     """
1472
1473     try:
1474         os.chown(sysvol, -1, gid)
1475     except OSError:
1476         canchown = False
1477     else:
1478         canchown = True
1479
1480     # Set the SYSVOL_ACL on the sysvol folder and subfolder (first level)
1481     setntacl(lp,sysvol, SYSVOL_ACL, str(domainsid))
1482     for root, dirs, files in os.walk(sysvol, topdown=False):
1483         for name in files:
1484             if canchown:
1485                 os.chown(os.path.join(root, name), -1, gid)
1486             setntacl(lp, os.path.join(root, name), SYSVOL_ACL, str(domainsid))
1487         for name in dirs:
1488             if canchown:
1489                 os.chown(os.path.join(root, name), -1, gid)
1490             setntacl(lp, os.path.join(root, name), SYSVOL_ACL, str(domainsid))
1491
1492     # Set acls on Policy folder and policies folders
1493     set_gpos_acl(sysvol, dnsdomain, domainsid, domaindn, samdb, lp)
1494
1495
1496 def interface_ips_v4(lp):
1497     '''return only IPv4 IPs'''
1498     ips = samba.interface_ips(lp, False)
1499     ret = []
1500     for i in ips:
1501         if i.find(':') == -1:
1502             ret.append(i)
1503     return ret
1504
1505 def interface_ips_v6(lp, linklocal=False):
1506     '''return only IPv6 IPs'''
1507     ips = samba.interface_ips(lp, False)
1508     ret = []
1509     for i in ips:
1510         if i.find(':') != -1 and (linklocal or i.find('%') == -1):
1511             ret.append(i)
1512     return ret
1513
1514
1515 def provision(logger, session_info, credentials, smbconf=None,
1516         targetdir=None, samdb_fill=FILL_FULL, realm=None, rootdn=None,
1517         domaindn=None, schemadn=None, configdn=None, serverdn=None,
1518         domain=None, hostname=None, hostip=None, hostip6=None, domainsid=None,
1519         next_rid=1000, dc_rid=None, adminpass=None, ldapadminpass=None, krbtgtpass=None,
1520         domainguid=None, policyguid=None, policyguid_dc=None,
1521         invocationid=None, machinepass=None, ntdsguid=None, dnspass=None,
1522         root=None, nobody=None, users=None, wheel=None, backup=None, aci=None,
1523         serverrole=None, dom_for_fun_level=None, ldap_backend_extra_port=None,
1524         ldap_backend_forced_uri=None, backend_type=None, sitename=None,
1525         ol_mmr_urls=None, ol_olc=None, setup_ds_path=None, slapd_path=None,
1526         nosync=False, ldap_dryrun_mode=False, useeadb=False, am_rodc=False,
1527         lp=None):
1528     """Provision samba4
1529
1530     :note: caution, this wipes all existing data!
1531     """
1532
1533     if domainsid is None:
1534         domainsid = security.random_sid()
1535     else:
1536         domainsid = security.dom_sid(domainsid)
1537
1538     # create/adapt the group policy GUIDs
1539     # Default GUID for default policy are described at
1540     # "How Core Group Policy Works"
1541     # http://technet.microsoft.com/en-us/library/cc784268%28WS.10%29.aspx
1542     if policyguid is None:
1543         policyguid = DEFAULT_POLICY_GUID
1544     policyguid = policyguid.upper()
1545     if policyguid_dc is None:
1546         policyguid_dc = DEFAULT_DC_POLICY_GUID
1547     policyguid_dc = policyguid_dc.upper()
1548
1549     if adminpass is None:
1550         adminpass = samba.generate_random_password(12, 32)
1551     if krbtgtpass is None:
1552         krbtgtpass = samba.generate_random_password(128, 255)
1553     if machinepass is None:
1554         machinepass  = samba.generate_random_password(128, 255)
1555     if dnspass is None:
1556         dnspass = samba.generate_random_password(128, 255)
1557     if ldapadminpass is None:
1558         # Make a new, random password between Samba and it's LDAP server
1559         ldapadminpass=samba.generate_random_password(128, 255)
1560
1561     if backend_type is None:
1562         backend_type = "ldb"
1563
1564     sid_generator = "internal"
1565     if backend_type == "fedora-ds":
1566         sid_generator = "backend"
1567
1568     root_uid = findnss_uid([root or "root"])
1569     nobody_uid = findnss_uid([nobody or "nobody"])
1570     users_gid = findnss_gid([users or "users", 'users', 'other', 'staff'])
1571     if wheel is None:
1572         wheel_gid = findnss_gid(["wheel", "adm"])
1573     else:
1574         wheel_gid = findnss_gid([wheel])
1575     try:
1576         bind_gid = findnss_gid(["bind", "named"])
1577     except KeyError:
1578         bind_gid = None
1579
1580     if targetdir is not None:
1581         smbconf = os.path.join(targetdir, "etc", "smb.conf")
1582     elif smbconf is None:
1583         smbconf = samba.param.default_path()
1584     if not os.path.exists(os.path.dirname(smbconf)):
1585         os.makedirs(os.path.dirname(smbconf))
1586
1587     # only install a new smb.conf if there isn't one there already
1588     if os.path.exists(smbconf):
1589         # if Samba Team members can't figure out the weird errors
1590         # loading an empty smb.conf gives, then we need to be smarter.
1591         # Pretend it just didn't exist --abartlet
1592         data = open(smbconf, 'r').read()
1593         data = data.lstrip()
1594         if data is None or data == "":
1595             make_smbconf(smbconf, hostname, domain, realm,
1596                          serverrole, targetdir, sid_generator, useeadb,
1597                          lp=lp)
1598     else:
1599         make_smbconf(smbconf, hostname, domain, realm, serverrole,
1600                      targetdir, sid_generator, useeadb, lp=lp)
1601
1602     if lp is None:
1603         lp = samba.param.LoadParm()
1604     lp.load(smbconf)
1605     names = guess_names(lp=lp, hostname=hostname, domain=domain,
1606         dnsdomain=realm, serverrole=serverrole, domaindn=domaindn,
1607         configdn=configdn, schemadn=schemadn, serverdn=serverdn,
1608         sitename=sitename, rootdn=rootdn)
1609     paths = provision_paths_from_lp(lp, names.dnsdomain)
1610
1611     paths.bind_gid = bind_gid
1612
1613     if hostip is None:
1614         logger.info("Looking up IPv4 addresses")
1615         hostips = interface_ips_v4(lp)
1616         if len(hostips) > 0:
1617             hostip = hostips[0]
1618             if len(hostips) > 1:
1619                 logger.warning("More than one IPv4 address found. Using %s",
1620                     hostip)
1621     if hostip == "127.0.0.1":
1622         hostip = None
1623     if hostip is None:
1624         logger.warning("No IPv4 address will be assigned")
1625
1626     if hostip6 is None:
1627         logger.info("Looking up IPv6 addresses")
1628         hostips = interface_ips_v6(lp, linklocal=False)
1629         if hostips:
1630             hostip6 = hostips[0]
1631         if len(hostips) > 1:
1632             logger.warning("More than one IPv6 address found. Using %s", hostip6)
1633     if hostip6 is None:
1634         logger.warning("No IPv6 address will be assigned")
1635
1636     if serverrole is None:
1637         serverrole = lp.get("server role")
1638
1639     assert serverrole in ("domain controller", "member server", "standalone")
1640     if invocationid is None:
1641         invocationid = str(uuid.uuid4())
1642
1643     if not os.path.exists(paths.private_dir):
1644         os.mkdir(paths.private_dir)
1645     if not os.path.exists(os.path.join(paths.private_dir, "tls")):
1646         os.mkdir(os.path.join(paths.private_dir, "tls"))
1647
1648     ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
1649
1650     schema = Schema(domainsid, invocationid=invocationid,
1651         schemadn=names.schemadn)
1652
1653     if backend_type == "ldb":
1654         provision_backend = LDBBackend(backend_type, paths=paths,
1655             lp=lp, credentials=credentials,
1656             names=names, logger=logger)
1657     elif backend_type == "existing":
1658         provision_backend = ExistingBackend(backend_type, paths=paths,
1659             lp=lp, credentials=credentials,
1660             names=names, logger=logger,
1661             ldap_backend_forced_uri=ldap_backend_forced_uri)
1662     elif backend_type == "fedora-ds":
1663         provision_backend = FDSBackend(backend_type, paths=paths,
1664             lp=lp, credentials=credentials,
1665             names=names, logger=logger, domainsid=domainsid,
1666             schema=schema, hostname=hostname, ldapadminpass=ldapadminpass,
1667             slapd_path=slapd_path,
1668             ldap_backend_extra_port=ldap_backend_extra_port,
1669             ldap_dryrun_mode=ldap_dryrun_mode, root=root,
1670             setup_ds_path=setup_ds_path,
1671             ldap_backend_forced_uri=ldap_backend_forced_uri)
1672     elif backend_type == "openldap":
1673         provision_backend = OpenLDAPBackend(backend_type, paths=paths,
1674             lp=lp, credentials=credentials,
1675             names=names, logger=logger, domainsid=domainsid,
1676             schema=schema, hostname=hostname, ldapadminpass=ldapadminpass,
1677             slapd_path=slapd_path,
1678             ldap_backend_extra_port=ldap_backend_extra_port,
1679             ldap_dryrun_mode=ldap_dryrun_mode, ol_mmr_urls=ol_mmr_urls,
1680             nosync=nosync,
1681             ldap_backend_forced_uri=ldap_backend_forced_uri)
1682     else:
1683         raise ValueError("Unknown LDAP backend type selected")
1684
1685     provision_backend.init()
1686     provision_backend.start()
1687
1688     # only install a new shares config db if there is none
1689     if not os.path.exists(paths.shareconf):
1690         logger.info("Setting up share.ldb")
1691         share_ldb = Ldb(paths.shareconf, session_info=session_info,
1692                         lp=lp)
1693         share_ldb.load_ldif_file_add(setup_path("share.ldif"))
1694
1695     logger.info("Setting up secrets.ldb")
1696     secrets_ldb = setup_secretsdb(paths,
1697         session_info=session_info,
1698         backend_credentials=provision_backend.secrets_credentials, lp=lp)
1699
1700     try:
1701         logger.info("Setting up the registry")
1702         setup_registry(paths.hklm, session_info,
1703                        lp=lp)
1704
1705         logger.info("Setting up the privileges database")
1706         setup_privileges(paths.privilege, session_info, lp=lp)
1707
1708         logger.info("Setting up idmap db")
1709         idmap = setup_idmapdb(paths.idmapdb,
1710             session_info=session_info, lp=lp)
1711
1712         logger.info("Setting up SAM db")
1713         samdb = setup_samdb(paths.samdb, session_info,
1714             provision_backend, lp, names, logger=logger,
1715             domainsid=domainsid, schema=schema, domainguid=domainguid,
1716             policyguid=policyguid, policyguid_dc=policyguid_dc,
1717             fill=samdb_fill, adminpass=adminpass, krbtgtpass=krbtgtpass,
1718             invocationid=invocationid, machinepass=machinepass,
1719             dnspass=dnspass, ntdsguid=ntdsguid, serverrole=serverrole,
1720             dom_for_fun_level=dom_for_fun_level, am_rodc=am_rodc,
1721             next_rid=next_rid, dc_rid=dc_rid)
1722
1723         if serverrole == "domain controller":
1724             if paths.netlogon is None:
1725                 logger.info("Existing smb.conf does not have a [netlogon] share, but you are configuring a DC.")
1726                 logger.info("Please either remove %s or see the template at %s" %
1727                         (paths.smbconf, setup_path("provision.smb.conf.dc")))
1728                 assert paths.netlogon is not None
1729
1730             if paths.sysvol is None:
1731                 logger.info("Existing smb.conf does not have a [sysvol] share, but you"
1732                         " are configuring a DC.")
1733                 logger.info("Please either remove %s or see the template at %s" %
1734                         (paths.smbconf, setup_path("provision.smb.conf.dc")))
1735                 assert paths.sysvol is not None
1736
1737             if not os.path.isdir(paths.netlogon):
1738                 os.makedirs(paths.netlogon, 0755)
1739
1740         if samdb_fill == FILL_FULL:
1741             setup_name_mappings(samdb, idmap, str(domainsid), names.domaindn,
1742                                 root_uid=root_uid, nobody_uid=nobody_uid,
1743                                 users_gid=users_gid, wheel_gid=wheel_gid)
1744
1745             if serverrole == "domain controller":
1746                 # Set up group policies (domain policy and domain controller
1747                 # policy)
1748                 create_default_gpo(paths.sysvol, names.dnsdomain, policyguid,
1749                     policyguid_dc)
1750                 setsysvolacl(samdb, paths.netlogon, paths.sysvol, wheel_gid,
1751                     domainsid, names.dnsdomain, names.domaindn, lp)
1752
1753             logger.info("Setting up sam.ldb rootDSE marking as synchronized")
1754             setup_modify_ldif(samdb, setup_path("provision_rootdse_modify.ldif"),
1755                               { 'NTDSGUID' : names.ntdsguid })
1756
1757             secretsdb_self_join(secrets_ldb, domain=names.domain,
1758                 realm=names.realm, dnsdomain=names.dnsdomain,
1759                 netbiosname=names.netbiosname, domainsid=domainsid,
1760                 machinepass=machinepass, secure_channel_type=SEC_CHAN_BDC)
1761
1762             # Now set up the right msDS-SupportedEncryptionTypes into the DB
1763             # In future, this might be determined from some configuration
1764             kerberos_enctypes = str(ENC_ALL_TYPES)
1765
1766             try:
1767                 msg = ldb.Message(ldb.Dn(samdb,
1768                     samdb.searchone("distinguishedName",
1769                         expression="samAccountName=%s$" % names.netbiosname,
1770                         scope=ldb.SCOPE_SUBTREE)))
1771                 msg["msDS-SupportedEncryptionTypes"] = ldb.MessageElement(
1772                     elements=kerberos_enctypes, flags=ldb.FLAG_MOD_REPLACE,
1773                     name="msDS-SupportedEncryptionTypes")
1774                 samdb.modify(msg)
1775             except ldb.LdbError, (enum, estr):
1776                 if enum != ldb.ERR_NO_SUCH_ATTRIBUTE:
1777                     # It might be that this attribute does not exist in this schema
1778                     raise
1779
1780             if serverrole == "domain controller":
1781                 secretsdb_setup_dns(secrets_ldb, names,
1782                     paths.private_dir, realm=names.realm,
1783                     dnsdomain=names.dnsdomain,
1784                     dns_keytab_path=paths.dns_keytab, dnspass=dnspass)
1785
1786                 setup_ad_dns(samdb, names=names, hostip=hostip, hostip6=hostip6)
1787
1788                 domainguid = samdb.searchone(basedn=domaindn,
1789                     attribute="objectGUID")
1790                 assert isinstance(domainguid, str)
1791
1792                 # Only make a zone file on the first DC, it should be
1793                 # replicated with DNS replication
1794                 create_zone_file(lp, logger, paths, targetdir,
1795                     dnsdomain=names.dnsdomain, hostip=hostip, hostip6=hostip6,
1796                     hostname=names.hostname, realm=names.realm,
1797                     domainguid=domainguid, ntdsguid=names.ntdsguid)
1798
1799                 create_named_conf(paths, realm=names.realm,
1800                     dnsdomain=names.dnsdomain, private_dir=paths.private_dir)
1801
1802                 create_named_txt(paths.namedtxt,
1803                     realm=names.realm, dnsdomain=names.dnsdomain,
1804                     dnsname = "%s.%s" % (names.hostname, names.dnsdomain),
1805                     private_dir=paths.private_dir,
1806                     keytab_name=paths.dns_keytab)
1807                 logger.info("See %s for an example configuration include file for BIND", paths.namedconf)
1808                 logger.info("and %s for further documentation required for secure DNS "
1809                         "updates", paths.namedtxt)
1810
1811             lastProvisionUSNs = get_last_provision_usn(samdb)
1812             maxUSN = get_max_usn(samdb, str(names.rootdn))
1813             if lastProvisionUSNs is not None:
1814                 update_provision_usn(samdb, 0, maxUSN, invocationid, 1)
1815             else:
1816                 set_provision_usn(samdb, 0, maxUSN, invocationid)
1817
1818         create_krb5_conf(paths.krb5conf,
1819                          dnsdomain=names.dnsdomain, hostname=names.hostname,
1820                          realm=names.realm)
1821         logger.info("A Kerberos configuration suitable for Samba 4 has been "
1822                     "generated at %s", paths.krb5conf)
1823
1824         if serverrole == "domain controller":
1825             create_dns_update_list(lp, logger, paths)
1826
1827         provision_backend.post_setup()
1828         provision_backend.shutdown()
1829
1830         create_phpldapadmin_config(paths.phpldapadminconfig,
1831                                    ldapi_url)
1832     except Exception:
1833         secrets_ldb.transaction_cancel()
1834         raise
1835
1836     # Now commit the secrets.ldb to disk
1837     secrets_ldb.transaction_commit()
1838
1839     # the commit creates the dns.keytab, now chown it
1840     dns_keytab_path = os.path.join(paths.private_dir, paths.dns_keytab)
1841     if os.path.isfile(dns_keytab_path) and paths.bind_gid is not None:
1842         try:
1843             os.chmod(dns_keytab_path, 0640)
1844             os.chown(dns_keytab_path, -1, paths.bind_gid)
1845         except OSError:
1846             if not os.environ.has_key('SAMBA_SELFTEST'):
1847                 logger.info("Failed to chown %s to bind gid %u",
1848                             dns_keytab_path, paths.bind_gid)
1849
1850     if samdb_fill != FILL_DRS:
1851         # fix any dangling GUIDs from the provision
1852         logger.info("Fixing provision GUIDs")
1853         chk = dbcheck(samdb, samdb_schema=samdb,  verbose=False, fix=True, yes=True, quiet=True)
1854         samdb.transaction_start()
1855         # a small number of GUIDs are missing because of ordering issues in the
1856         # provision code
1857         for schema_obj in ['CN=Domain', 'CN=Organizational-Person', 'CN=Contact', 'CN=inetOrgPerson']:
1858             chk.check_database(DN="%s,%s" % (schema_obj, names.schemadn),
1859                                scope=ldb.SCOPE_BASE, attrs=['defaultObjectCategory'])
1860         chk.check_database(DN="CN=IP Security,CN=System,%s" % names.domaindn,
1861                            scope=ldb.SCOPE_ONELEVEL,
1862                            attrs=['ipsecOwnersReference',
1863                                   'ipsecFilterReference',
1864                                   'ipsecISAKMPReference',
1865                                   'ipsecNegotiationPolicyReference',
1866                                   'ipsecNFAReference'])
1867         samdb.transaction_commit()
1868
1869
1870     logger.info("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php",
1871             paths.phpldapadminconfig)
1872
1873     logger.info("Once the above files are installed, your Samba4 server will be ready to use")
1874     logger.info("Server Role:           %s" % serverrole)
1875     logger.info("Hostname:              %s" % names.hostname)
1876     logger.info("NetBIOS Domain:        %s" % names.domain)
1877     logger.info("DNS Domain:            %s" % names.dnsdomain)
1878     logger.info("DOMAIN SID:            %s" % str(domainsid))
1879     if samdb_fill == FILL_FULL:
1880         logger.info("Admin password:        %s" % adminpass)
1881     if provision_backend.type is not "ldb":
1882         if provision_backend.credentials.get_bind_dn() is not None:
1883             logger.info("LDAP Backend Admin DN: %s" %
1884                 provision_backend.credentials.get_bind_dn())
1885         else:
1886             logger.info("LDAP Admin User:       %s" %
1887                 provision_backend.credentials.get_username())
1888
1889         logger.info("LDAP Admin Password:   %s" %
1890             provision_backend.credentials.get_password())
1891
1892         if provision_backend.slapd_command_escaped is not None:
1893             # now display slapd_command_file.txt to show how slapd must be
1894             # started next time
1895             logger.info("Use later the following commandline to start slapd, then Samba:")
1896             logger.info(provision_backend.slapd_command_escaped)
1897             logger.info("This slapd-Commandline is also stored under: %s/ldap_backend_startup.sh",
1898                     provision_backend.ldapdir)
1899
1900     result = ProvisionResult()
1901     result.domaindn = domaindn
1902     result.paths = paths
1903     result.lp = lp
1904     result.samdb = samdb
1905     result.idmap = idmap
1906     return result
1907
1908
1909 def provision_become_dc(smbconf=None, targetdir=None,
1910         realm=None, rootdn=None, domaindn=None, schemadn=None, configdn=None,
1911         serverdn=None, domain=None, hostname=None, domainsid=None,
1912         adminpass=None, krbtgtpass=None, domainguid=None, policyguid=None,
1913         policyguid_dc=None, invocationid=None, machinepass=None, dnspass=None,
1914         root=None, nobody=None, users=None, wheel=None, backup=None,
1915         serverrole=None, ldap_backend=None, ldap_backend_type=None,
1916         sitename=None, debuglevel=1):
1917
1918     logger = logging.getLogger("provision")
1919     samba.set_debug_level(debuglevel)
1920
1921     res = provision(logger, system_session(), None,
1922         smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS,
1923         realm=realm, rootdn=rootdn, domaindn=domaindn, schemadn=schemadn,
1924         configdn=configdn, serverdn=serverdn, domain=domain,
1925         hostname=hostname, hostip=None, domainsid=domainsid,
1926         machinepass=machinepass, serverrole="domain controller",
1927         sitename=sitename)
1928     res.lp.set("debuglevel", str(debuglevel))
1929     return res
1930
1931
1932 def create_phpldapadmin_config(path, ldapi_uri):
1933     """Create a PHP LDAP admin configuration file.
1934
1935     :param path: Path to write the configuration to.
1936     """
1937     setup_file(setup_path("phpldapadmin-config.php"), path,
1938             {"S4_LDAPI_URI": ldapi_uri})
1939
1940
1941 def create_zone_file(lp, logger, paths, targetdir, dnsdomain,
1942                      hostip, hostip6, hostname, realm, domainguid,
1943                      ntdsguid):
1944     """Write out a DNS zone file, from the info in the current database.
1945
1946     :param paths: paths object
1947     :param dnsdomain: DNS Domain name
1948     :param domaindn: DN of the Domain
1949     :param hostip: Local IPv4 IP
1950     :param hostip6: Local IPv6 IP
1951     :param hostname: Local hostname
1952     :param realm: Realm name
1953     :param domainguid: GUID of the domain.
1954     :param ntdsguid: GUID of the hosts nTDSDSA record.
1955     """
1956     assert isinstance(domainguid, str)
1957
1958     if hostip6 is not None:
1959         hostip6_base_line = "            IN AAAA    " + hostip6
1960         hostip6_host_line = hostname + "        IN AAAA    " + hostip6
1961         gc_msdcs_ip6_line = "gc._msdcs               IN AAAA    " + hostip6
1962     else:
1963         hostip6_base_line = ""
1964         hostip6_host_line = ""
1965         gc_msdcs_ip6_line = ""
1966
1967     if hostip is not None:
1968         hostip_base_line = "            IN A    " + hostip
1969         hostip_host_line = hostname + "        IN A    " + hostip
1970         gc_msdcs_ip_line = "gc._msdcs               IN A    " + hostip
1971     else:
1972         hostip_base_line = ""
1973         hostip_host_line = ""
1974         gc_msdcs_ip_line = ""
1975
1976     dns_dir = os.path.dirname(paths.dns)
1977
1978     try:
1979         shutil.rmtree(dns_dir, True)
1980     except OSError:
1981         pass
1982
1983     os.mkdir(dns_dir, 0775)
1984
1985     # we need to freeze the zone while we update the contents
1986     if targetdir is None:
1987         rndc = ' '.join(lp.get("rndc command"))
1988         os.system(rndc + " freeze " + lp.get("realm"))
1989
1990     setup_file(setup_path("provision.zone"), paths.dns, {
1991             "HOSTNAME": hostname,
1992             "DNSDOMAIN": dnsdomain,
1993             "REALM": realm,
1994             "HOSTIP_BASE_LINE": hostip_base_line,
1995             "HOSTIP_HOST_LINE": hostip_host_line,
1996             "DOMAINGUID": domainguid,
1997             "DATESTRING": time.strftime("%Y%m%d%H"),
1998             "DEFAULTSITE": DEFAULTSITE,
1999             "NTDSGUID": ntdsguid,
2000             "HOSTIP6_BASE_LINE": hostip6_base_line,
2001             "HOSTIP6_HOST_LINE": hostip6_host_line,
2002             "GC_MSDCS_IP_LINE": gc_msdcs_ip_line,
2003             "GC_MSDCS_IP6_LINE": gc_msdcs_ip6_line,
2004         })
2005
2006     # note that we use no variable substitution on this file
2007     # the substitution is done at runtime by samba_dnsupdate
2008     setup_file(setup_path("dns_update_list"), paths.dns_update_list, None)
2009
2010     # and the SPN update list
2011     setup_file(setup_path("spn_update_list"), paths.spn_update_list, None)
2012
2013     if paths.bind_gid is not None:
2014         try:
2015             os.chown(dns_dir, -1, paths.bind_gid)
2016             os.chown(paths.dns, -1, paths.bind_gid)
2017             # chmod needed to cope with umask
2018             os.chmod(dns_dir, 0775)
2019             os.chmod(paths.dns, 0664)
2020         except OSError:
2021             if not os.environ.has_key('SAMBA_SELFTEST'):
2022                 logger.error("Failed to chown %s to bind gid %u" % (
2023                     dns_dir, paths.bind_gid))
2024
2025     if targetdir is None:
2026         os.system(rndc + " unfreeze " + lp.get("realm"))
2027
2028
2029 def create_dns_update_list(lp, logger, paths):
2030     """Write out a dns_update_list file"""
2031     # note that we use no variable substitution on this file
2032     # the substitution is done at runtime by samba_dnsupdate
2033     setup_file(setup_path("dns_update_list"), paths.dns_update_list, None)
2034     setup_file(setup_path("spn_update_list"), paths.spn_update_list, None)
2035
2036
2037 def create_named_conf(paths, realm, dnsdomain,
2038                       private_dir):
2039     """Write out a file containing zone statements suitable for inclusion in a
2040     named.conf file (including GSS-TSIG configuration).
2041
2042     :param paths: all paths
2043     :param realm: Realm name
2044     :param dnsdomain: DNS Domain name
2045     :param private_dir: Path to private directory
2046     :param keytab_name: File name of DNS keytab file
2047     """
2048
2049     setup_file(setup_path("named.conf"), paths.namedconf, {
2050             "DNSDOMAIN": dnsdomain,
2051             "REALM": realm,
2052             "ZONE_FILE": paths.dns,
2053             "REALM_WC": "*." + ".".join(realm.split(".")[1:]),
2054             "NAMED_CONF": paths.namedconf,
2055             "NAMED_CONF_UPDATE": paths.namedconf_update
2056             })
2057
2058     setup_file(setup_path("named.conf.update"), paths.namedconf_update)
2059
2060
2061 def create_named_txt(path, realm, dnsdomain, dnsname, private_dir,
2062     keytab_name):
2063     """Write out a file containing zone statements suitable for inclusion in a
2064     named.conf file (including GSS-TSIG configuration).
2065
2066     :param path: Path of the new named.conf file.
2067     :param realm: Realm name
2068     :param dnsdomain: DNS Domain name
2069     :param private_dir: Path to private directory
2070     :param keytab_name: File name of DNS keytab file
2071     """
2072     setup_file(setup_path("named.txt"), path, {
2073             "DNSDOMAIN": dnsdomain,
2074             "DNSNAME" : dnsname,
2075             "REALM": realm,
2076             "DNS_KEYTAB": keytab_name,
2077             "DNS_KEYTAB_ABS": os.path.join(private_dir, keytab_name),
2078             "PRIVATE_DIR": private_dir
2079         })
2080
2081
2082 def create_krb5_conf(path, dnsdomain, hostname, realm):
2083     """Write out a file containing zone statements suitable for inclusion in a
2084     named.conf file (including GSS-TSIG configuration).
2085
2086     :param path: Path of the new named.conf file.
2087     :param dnsdomain: DNS Domain name
2088     :param hostname: Local hostname
2089     :param realm: Realm name
2090     """
2091     setup_file(setup_path("krb5.conf"), path, {
2092             "DNSDOMAIN": dnsdomain,
2093             "HOSTNAME": hostname,
2094             "REALM": realm,
2095         })
2096
2097
2098 class ProvisioningError(Exception):
2099     """A generic provision error."""
2100
2101     def __init__(self, value):
2102         self.value = value
2103
2104     def __str__(self):
2105         return "ProvisioningError: " + self.value
2106
2107
2108 class InvalidNetbiosName(Exception):
2109     """A specified name was not a valid NetBIOS name."""
2110     def __init__(self, name):
2111         super(InvalidNetbiosName, self).__init__(
2112             "The name '%r' is not a valid NetBIOS name" % name)