source4/scripting/bin/samba_upgradedns

   1 #!/usr/bin/env python
   2 #
   3 # Unix SMB/CIFS implementation.
   4 # Copyright (C) Amitay Isaacs <amitay@gmail.com> 2012
   5 #
   6 # Upgrade DNS provision from BIND9_FLATFILE to BIND9_DLZ or SAMBA_INTERNAL
   7 #
   8 # This program is free software; you can redistribute it and/or modify
   9 # it under the terms of the GNU General Public License as published by
  10 # the Free Software Foundation; either version 3 of the License, or
  11 # (at your option) any later version.
  12 #
  13 # This program is distributed in the hope that it will be useful,
  14 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 # GNU General Public License for more details.
  17 #
  18 # You should have received a copy of the GNU General Public License
  19 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20
  21 import sys
  22 import os
  23 import optparse
  24 import logging
  25 import grp
  26 from base64 import b64encode
  27 import shlex
  28
  29 sys.path.insert(0, "bin/python")
  30
  31 import ldb
  32 import samba
  33 from samba import param
  34 from samba.auth import system_session
  35 from samba.ndr import (
  36     ndr_pack,
  37     ndr_unpack )
  38 import samba.getopt as options
  39 from samba.upgradehelpers import (
  40     get_paths,
  41     get_ldbs )
  42 from samba.dsdb import DS_DOMAIN_FUNCTION_2003
  43 from samba.provision import (
  44     find_provision_key_parameters,
  45     interface_ips_v4,
  46     interface_ips_v6 )
  47 from samba.provision.common import (
  48     setup_path,
  49     setup_add_ldif )
  50 from samba.provision.sambadns import (
  51     ARecord,
  52     AAAARecord,
  53     CNameRecord,
  54     NSRecord,
  55     SOARecord,
  56     SRVRecord,
  57     TXTRecord,
  58     get_dnsadmins_sid,
  59     add_dns_accounts,
  60     create_dns_partitions,
  61     fill_dns_data_partitions,
  62     create_dns_dir,
  63     secretsdb_setup_dns,
  64     create_samdb_copy,
  65     create_named_conf,
  66     create_named_txt )
  67 from samba.dcerpc import security
  68
  69 samba.ensure_external_module("dns", "dnspython")
  70 import dns.zone, dns.rdatatype
  71
  72 __docformat__ = 'restructuredText'
  73
  74
  75 def find_bind_gid():
  76     """Find system group id for bind9
  77     """
  78     for name in ["bind", "named"]:
  79         try:
  80             return grp.getgrnam(name)[2]
  81         except KeyError:
  82             pass
  83     return None
  84
  85
  86 def fix_names(pnames):
  87     """Convert elements to strings from MessageElement
  88     """
  89     names = pnames
  90     names.rootdn = pnames.rootdn[0]
  91     names.domaindn = pnames.domaindn[0]
  92     names.configdn = pnames.configdn[0]
  93     names.schemadn = pnames.schemadn[0]
  94     names.wheel_gid = pnames.wheel_gid[0]
  95     names.serverdn = str(pnames.serverdn)
  96     return names
  97
  98
  99 def convert_dns_rdata(rdata, serial=1):
 100     """Convert resource records in dnsRecord format
 101     """
 102     if rdata.rdtype == dns.rdatatype.A:
 103         rec = ARecord(rdata.address, serial=serial)
 104     elif rdata.rdtype == dns.rdatatype.AAAA:
 105         rec = AAAARecord(rdata.address, serial=serial)
 106     elif rdata.rdtype == dns.rdatatype.CNAME:
 107         rec = CNameRecord(rdata.target.to_text(), serial=serial)
 108     elif rdata.rdtype == dns.rdatatype.NS:
 109         rec = NSRecord(rdata.target.to_text(), serial=serial)
 110     elif rdata.rdtype == dns.rdatatype.SRV:
 111         rec = SRVRecord(rdata.target.to_text(), int(rdata.port),
 112                         priority=int(rdata.priority), weight=int(rdata.weight),
 113                         serial=serial)
 114     elif rdata.rdtype == dns.rdatatype.TXT:
 115         slist = shlex.split(rdata.to_text())
 116         rec = TXTRecord(slist, serial=serial)
 117     elif rdata.rdtype == dns.rdatatype.SOA:
 118         rec = SOARecord(rdata.mname.to_text(), rdata.rname.to_text(),
 119                         serial=int(rdata.serial),
 120                         refresh=int(rdata.refresh), retry=int(rdata.retry),
 121                         expire=int(rdata.expire), minimum=int(rdata.minimum))
 122     else:
 123         rec = None
 124     return rec
 125
 126
 127 def import_zone_data(samdb, logger, zone, serial, domaindn, forestdn,
 128                      dnsdomain, dnsforest):
 129     """Insert zone data in DNS partitions
 130     """
 131     labels = dnsdomain.split('.')
 132     labels.append('')
 133     domain_root = dns.name.Name(labels)
 134     domain_prefix = "DC=%s,CN=MicrosoftDNS,DC=DomainDnsZones,%s" % (dnsdomain,
 135                                                                     domaindn)
 136
 137     tmp = "_msdcs.%s" % dnsforest
 138     labels = tmp.split('.')
 139     labels.append('')
 140     forest_root = dns.name.Name(labels)
 141     dnsmsdcs = "_msdcs.%s" % dnsforest
 142     forest_prefix = "DC=%s,CN=MicrosoftDNS,DC=ForestDnsZones,%s" % (dnsmsdcs,
 143                                                                     forestdn)
 144
 145     # Extract @ record
 146     at_record = zone.get_node(domain_root)
 147     zone.delete_node(domain_root)
 148
 149     # SOA record
 150     rdset = at_record.get_rdataset(dns.rdataclass.IN, dns.rdatatype.SOA)
 151     soa_rec = ndr_pack(convert_dns_rdata(rdset[0]))
 152     at_record.delete_rdataset(dns.rdataclass.IN, dns.rdatatype.SOA)
 153
 154     # NS record
 155     rdset = at_record.get_rdataset(dns.rdataclass.IN, dns.rdatatype.NS)
 156     ns_rec = ndr_pack(convert_dns_rdata(rdset[0]))
 157     at_record.delete_rdataset(dns.rdataclass.IN, dns.rdatatype.NS)
 158
 159     # A/AAAA records
 160     ip_recs = []
 161     for rdset in at_record:
 162         for r in rdset:
 163             rec = convert_dns_rdata(r)
 164             ip_recs.append(ndr_pack(rec))
 165
 166     # Add @ record for domain
 167     dns_rec = [soa_rec, ns_rec] + ip_recs
 168     msg = ldb.Message(ldb.Dn(samdb, 'DC=@,%s' % domain_prefix))
 169     msg["objectClass"] = ["top", "dnsNode"]
 170     msg["dnsRecord"] = ldb.MessageElement(dns_rec, ldb.FLAG_MOD_ADD,
 171                                           "dnsRecord")
 172     try:
 173         samdb.add(msg)
 174     except Exception:
 175         logger.error("Failed to add @ record for domain")
 176         raise
 177     logger.debug("Added @ record for domain")
 178
 179     # Add @ record for forest
 180     dns_rec = [soa_rec, ns_rec]
 181     msg = ldb.Message(ldb.Dn(samdb, 'DC=@,%s' % forest_prefix))
 182     msg["objectClass"] = ["top", "dnsNode"]
 183     msg["dnsRecord"] = ldb.MessageElement(dns_rec, ldb.FLAG_MOD_ADD,
 184                                           "dnsRecord")
 185     try:
 186         samdb.add(msg)
 187     except Exception:
 188         logger.error("Failed to add @ record for forest")
 189         raise
 190     logger.debug("Added @ record for forest")
 191
 192     # Add remaining records in domain and forest
 193     for node in zone.nodes:
 194         name = node.relativize(forest_root).to_text()
 195         if name == node.to_text():
 196             name = node.relativize(domain_root).to_text()
 197             dn = "DC=%s,%s" % (name, domain_prefix)
 198             fqdn = "%s.%s" % (name, dnsdomain)
 199         else:
 200             dn = "DC=%s,%s" % (name, forest_prefix)
 201             fqdn = "%s.%s" % (name, dnsmsdcs)
 202
 203         dns_rec = []
 204         for rdataset in zone.nodes[node]:
 205             for rdata in rdataset:
 206                 rec = convert_dns_rdata(rdata, serial)
 207                 if not rec:
 208                     logger.warn("Unsupported record type (%s) for %s, ignoring" %
 209                                 dns.rdatatype.to_text(rdata.rdatatype), name)
 210                 else:
 211                     dns_rec.append(ndr_pack(rec))
 212
 213         msg = ldb.Message(ldb.Dn(samdb, dn))
 214         msg["objectClass"] = ["top", "dnsNode"]
 215         msg["dnsRecord"] = ldb.MessageElement(dns_rec, ldb.FLAG_MOD_ADD,
 216                                               "dnsRecord")
 217         try:
 218             samdb.add(msg)
 219         except Exception:
 220             logger.error("Failed to add DNS record %s" % (fqdn))
 221             raise
 222         logger.debug("Added DNS record %s" % (fqdn))
 223
 224
 225 # dnsprovision creates application partitions for AD based DNS mainly if the existing
 226 # provision was created using earlier snapshots of samba4 which did not have support
 227 # for DNS partitions
 228
 229 if __name__ == '__main__':
 230
 231     # Setup command line parser
 232     parser = optparse.OptionParser("upgradedns [options]")
 233     sambaopts = options.SambaOptions(parser)
 234     credopts = options.CredentialsOptions(parser)
 235
 236     parser.add_option_group(options.VersionOptions(parser))
 237     parser.add_option_group(sambaopts)
 238     parser.add_option_group(credopts)
 239
 240     parser.add_option("--dns-backend", type="choice", metavar="<BIND9_DLZ|SAMBA_INTERNAL>",
 241                       choices=["SAMBA_INTERNAL", "BIND9_DLZ"], default="BIND9_DLZ",
 242                       help="The DNS server backend, default BIND9_DLZ")
 243     parser.add_option("--migrate", type="choice", metavar="<yes|no>",
 244                       choices=["yes","no"], default="yes",
 245                       help="Migrate existing zone data, default yes")
 246     parser.add_option("--verbose", help="Be verbose", action="store_true")
 247
 248     opts = parser.parse_args()[0]
 249
 250     if opts.dns_backend is None:
 251         opts.dns_backend = 'DLZ_BIND9'
 252
 253     if opts.migrate:
 254         autofill = False
 255     else:
 256         autofill = True
 257
 258     # Set up logger
 259     logger = logging.getLogger("upgradedns")
 260     logger.addHandler(logging.StreamHandler(sys.stdout))
 261     logger.setLevel(logging.INFO)
 262     if opts.verbose:
 263         logger.setLevel(logging.DEBUG)
 264
 265     lp = sambaopts.get_loadparm()
 266     lp.load(lp.configfile)
 267     creds = credopts.get_credentials(lp)
 268
 269     logger.info("Reading domain information")
 270     paths = get_paths(param, smbconf=lp.configfile)
 271     paths.bind_gid = find_bind_gid()
 272     ldbs = get_ldbs(paths, creds, system_session(), lp)
 273     pnames = find_provision_key_parameters(ldbs.sam, ldbs.secrets, ldbs.idmap,
 274                                            paths, lp.configfile, lp)
 275     names = fix_names(pnames)
 276
 277     if names.domainlevel < DS_DOMAIN_FUNCTION_2003:
 278         logger.error("Cannot create AD based DNS for OS level < 2003")
 279         sys.exit(1)
 280
 281     logger.info("Looking up IPv4 addresses")
 282     hostip = interface_ips_v4(lp)
 283     try:
 284         hostip.remove('127.0.0.1')
 285     except ValueError:
 286         pass
 287     if not hostip:
 288         logger.error("No IPv4 addresses found")
 289         sys.exit(1)
 290     else:
 291         hostip = hostip[0]
 292         logger.debug("IPv4 addresses: %s" % hostip)
 293
 294     logger.info("Looking up IPv6 addresses")
 295     hostip6 = interface_ips_v6(lp, linklocal=False)
 296     if not hostip6:
 297         hostip6 = None
 298     else:
 299         hostip6 = hostip6[0]
 300         logger.debug("IPv6 addresses: %s" % hostip6)
 301
 302     domaindn = names.domaindn
 303     forestdn = names.rootdn
 304
 305     dnsdomain = names.dnsdomain.lower()
 306     dnsforest = dnsdomain
 307
 308     site = names.sitename
 309     hostname = names.hostname
 310     dnsname = '%s.%s' % (hostname, dnsdomain)
 311
 312     domainsid = names.domainsid
 313     domainguid = names.domainguid
 314     ntdsguid = names.ntdsguid
 315
 316     # Check for DNS accounts and create them if required
 317     try:
 318         msg = ldbs.sam.search(base=domaindn, scope=ldb.SCOPE_DEFAULT,
 319                               expression='(sAMAccountName=DnsAdmins)',
 320                               attrs=['objectSid'])
 321         dnsadmins_sid = ndr_unpack(security.dom_sid, msg[0]['objectSid'][0])
 322     except Exception, e:
 323         logger.info("Adding DNS accounts")
 324         add_dns_accounts(ldbs.sam, domaindn)
 325         dnsadmins_sid = get_dnsadmins_sid(ldbs.sam, domaindn)
 326     else:
 327         logger.info("DNS accounts already exist")
 328
 329     # Import dns records from zone file
 330     if os.path.exists(paths.dns):
 331         logger.info("Reading records from zone file %s" % paths.dns)
 332         try:
 333             zone = dns.zone.from_file(paths.dns, relativize=False)
 334             rrset = zone.get_rdataset("%s." % dnsdomain, dns.rdatatype.SOA)
 335             serial = int(rrset[0].serial)
 336         except Exception, e:
 337             logger.warn("Error parsing DNS data from '%s' (%s)" % (paths.dns, str(e)))
 338             logger.warn("DNS records will be automatically created")
 339             autofill = True
 340     else:
 341         logger.info("No zone file %s" % paths.dns)
 342         logger.warn("DNS records will be automatically created")
 343         autofill = True
 344
 345     # Create DNS partitions if missing and fill DNS information
 346     try:
 347         expression = '(|(dnsRoot=DomainDnsZones.%s)(dnsRoot=ForestDnsZones.%s))' % \
 348                      (dnsdomain, dnsforest)
 349         msg = ldbs.sam.search(base=names.configdn, scope=ldb.SCOPE_DEFAULT,
 350                               expression=expression, attrs=['nCName'])
 351         ncname = msg[0]['nCName'][0]
 352     except Exception, e:
 353         logger.info("Creating DNS partitions")
 354         create_dns_partitions(ldbs.sam, domainsid, names, domaindn, forestdn,
 355                           dnsadmins_sid)
 356
 357         logger.info("Populating DNS partitions")
 358         fill_dns_data_partitions(ldbs.sam, domainsid, site, domaindn, forestdn,
 359                              dnsdomain, dnsforest, hostname, hostip, hostip6,
 360                              domainguid, ntdsguid, dnsadmins_sid,
 361                              autofill=autofill)
 362
 363         if not autofill:
 364             logger.info("Importing records from zone file")
 365             import_zone_data(ldbs.sam, logger, zone, serial, domaindn, forestdn,
 366                              dnsdomain, dnsforest)
 367     else:
 368         logger.info("DNS partitions already exist")
 369
 370     # Mark that we are hosting DNS partitions
 371     try:
 372         dns_nclist = [ 'DC=DomainDnsZones,%s' % domaindn,
 373                        'DC=ForestDnsZones,%s' % forestdn ]
 374
 375         msgs = ldbs.sam.search(base=names.serverdn, scope=ldb.SCOPE_DEFAULT,
 376                                expression='(objectclass=nTDSDSa)',
 377                                attrs=['hasPartialReplicaNCs',
 378                                       'msDS-hasMasterNCs'])
 379         msg = msgs[0]
 380
 381         master_nclist = []
 382         ncs = msg.get("msDS-hasMasterNCs")
 383         if ncs:
 384             for nc in ncs:
 385                 master_nclist.append(nc)
 386
 387         partial_nclist = []
 388         ncs = msg.get("hasPartialReplicaNCs")
 389         if ncs:
 390             for nc in ncs:
 391                 partial_nclist.append(nc)
 392
 393         modified_master = False
 394         modified_partial = False
 395         for nc in dns_nclist:
 396             if nc not in master_nclist:
 397                 master_nclist.append(nc)
 398                 modified_master = True
 399             if nc in partial_nclist:
 400                 partial_nclist.remove(nc)
 401                 modified_partial = True
 402
 403         if modified_master or modified_partial:
 404             logger.debug("Updating msDS-hasMasterNCs and hasPartialReplicaNCs attributes")
 405             m = ldb.Message()
 406             m.dn = msg.dn
 407             if modified_master:
 408                 m["msDS-hasMasterNCs"] = ldb.MessageElement(master_nclist,
 409                                                             ldb.FLAG_MOD_REPLACE,
 410                                                             "msDS-hasMasterNCs")
 411             if modified_partial:
 412                 if partial_nclist:
 413                     m["hasPartialReplicaNCs"] = ldb.MessageElement(partial_nclist,
 414                                                                    ldb.FLAG_MOD_REPLACE,
 415                                                                    "hasPartialReplicaNCs")
 416                 else:
 417                     m["hasPartialReplicaNCs"] = ldb.MessageElement(ncs,
 418                                                                    ldb.FLAG_MOD_DELETE,
 419                                                                    "hasPartialReplicaNCs")
 420             ldbs.sam.modify(m)
 421     except Exception:
 422         raise
 423
 424     # Special stuff for DLZ backend
 425     if opts.dns_backend == "BIND9_DLZ":
 426         # Check if dns-HOSTNAME account exists and create it if required
 427         try:
 428             dn = 'samAccountName=dns-%s,CN=Principals' % hostname
 429             msg = ldbs.secrets.search(expression='(dn=%s)' % dn, attrs=['secret'])
 430             dnssecret = msg[0]['secret'][0]
 431         except Exception:
 432             logger.info("Adding dns-%s account" % hostname)
 433
 434             try:
 435                 msg = ldbs.sam.search(base=domaindn, scope=ldb.SCOPE_DEFAULT,
 436                                       expression='(sAMAccountName=dns-%s)' % (hostname),
 437                                       attrs=['clearTextPassword'])
 438                 dn = msg[0].dn
 439                 ldbs.sam.delete(dn)
 440             except Exception:
 441                 pass
 442
 443             dnspass = samba.generate_random_password(128, 255)
 444             setup_add_ldif(ldbs.sam, setup_path("provision_dns_add_samba.ldif"), {
 445                     "DNSDOMAIN": dnsdomain,
 446                     "DOMAINDN": domaindn,
 447                     "DNSPASS_B64": b64encode(dnspass.encode('utf-16-le')),
 448                     "HOSTNAME" : hostname,
 449                     "DNSNAME" : dnsname }
 450                            )
 451
 452             secretsdb_setup_dns(ldbs.secrets, names,
 453                                 paths.private_dir, realm=names.realm,
 454                                 dnsdomain=names.dnsdomain,
 455                                 dns_keytab_path=paths.dns_keytab, dnspass=dnspass)
 456         else:
 457             logger.info("dns-%s account already exists" % hostname)
 458
 459         # This forces a re-creation of dns directory and all the files within
 460         # It's an overkill, but it's easier to re-create a samdb copy, rather
 461         # than trying to fix a broken copy.
 462         create_dns_dir(logger, paths)
 463
 464         # Setup a copy of SAM for BIND9
 465         create_samdb_copy(ldbs.sam, logger, paths, names, domainsid,
 466                           domainguid)
 467
 468         create_named_conf(paths, names.realm, dnsdomain, opts.dns_backend)
 469
 470         create_named_txt(paths.namedtxt, names.realm, dnsdomain, dnsname,
 471                          paths.private_dir, paths.dns_keytab)
 472         logger.info("See %s for an example configuration include file for BIND", paths.namedconf)
 473         logger.info("and %s for further documentation required for secure DNS "
 474                     "updates", paths.namedtxt)
 475
 476     logger.info("Finished upgrading DNS")