3 # Unix SMB/CIFS implementation.
4 # provision a Samba4 server
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
8 # Based on the original in EJS:
9 # Copyright (C) Andrew Tridgell 2005
11 # This program is free software; you can redistribute it and/or modify
12 # it under the terms of the GNU General Public License as published by
13 # the Free Software Foundation; either version 3 of the License, or
14 # (at your option) any later version.
16 # This program is distributed in the hope that it will be useful,
17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 # GNU General Public License for more details.
21 # You should have received a copy of the GNU General Public License
22 # along with this program. If not, see <http://www.gnu.org/licenses/>.
30 # Find right directory when running from source tree
31 sys
.path
.insert(0, "bin/python")
36 from samba
.credentials
import DONT_USE_KERBEROS
37 from samba
.auth
import system_session
38 import samba
.getopt
as options
39 from samba
.provision
import (
46 from samba
.dsdb
import (
47 DS_DOMAIN_FUNCTION_2000
,
48 DS_DOMAIN_FUNCTION_2003
,
49 DS_DOMAIN_FUNCTION_2008
,
50 DS_DOMAIN_FUNCTION_2008_R2
,
53 # how do we make this case insensitive??
55 parser
= optparse
.OptionParser("provision [options]")
56 sambaopts
= options
.SambaOptions(parser
)
57 parser
.add_option_group(sambaopts
)
58 parser
.add_option_group(options
.VersionOptions(parser
))
59 credopts
= options
.CredentialsOptions(parser
)
60 parser
.add_option_group(credopts
)
61 parser
.add_option("--interactive", help="Ask for names", action
="store_true")
62 parser
.add_option("--domain", type="string", metavar
="DOMAIN",
64 parser
.add_option("--domain-guid", type="string", metavar
="GUID",
65 help="set domainguid (otherwise random)")
66 parser
.add_option("--domain-sid", type="string", metavar
="SID",
67 help="set domainsid (otherwise random)")
68 parser
.add_option("--ntds-guid", type="string", metavar
="GUID",
69 help="set NTDS object GUID (otherwise random)")
70 parser
.add_option("--invocationid", type="string", metavar
="GUID",
71 help="set invocationid (otherwise random)")
72 parser
.add_option("--host-name", type="string", metavar
="HOSTNAME",
74 parser
.add_option("--host-ip", type="string", metavar
="IPADDRESS",
75 help="set IPv4 ipaddress")
76 parser
.add_option("--host-ip6", type="string", metavar
="IP6ADDRESS",
77 help="set IPv6 ipaddress")
78 parser
.add_option("--adminpass", type="string", metavar
="PASSWORD",
79 help="choose admin password (otherwise random)")
80 parser
.add_option("--krbtgtpass", type="string", metavar
="PASSWORD",
81 help="choose krbtgt password (otherwise random)")
82 parser
.add_option("--machinepass", type="string", metavar
="PASSWORD",
83 help="choose machine password (otherwise random)")
84 parser
.add_option("--dns-backend", type="choice", metavar
="NAMESERVER-BACKEND",
85 choices
=["SAMBA", "BIND9_FLATFILE", "BIND9_DLZ"],
86 help="The DNS server backend. SAMBA is the builtin name server (experimental), BIND9_FLATFILE uses bind9 text database to store zone information (default), BIND9_DLZ uses samba4 AD to store zone information (recommended)")
87 parser
.add_option("--dnspass", type="string", metavar
="PASSWORD",
88 help="choose dns password (otherwise random)")
89 parser
.add_option("--ldapadminpass", type="string", metavar
="PASSWORD",
90 help="choose password to set between Samba and it's LDAP backend (otherwise random)")
91 parser
.add_option("--root", type="string", metavar
="USERNAME",
92 help="choose 'root' unix username")
93 parser
.add_option("--nobody", type="string", metavar
="USERNAME",
94 help="choose 'nobody' user")
95 parser
.add_option("--wheel", type="string", metavar
="GROUPNAME",
96 help="choose 'wheel' privileged group")
97 parser
.add_option("--users", type="string", metavar
="GROUPNAME",
98 help="choose 'users' group")
99 parser
.add_option("--quiet", help="Be quiet", action
="store_true")
100 parser
.add_option("--blank", action
="store_true",
101 help="do not add users or groups, just the structure")
102 parser
.add_option("--ldap-backend-extra-port", type="int", metavar
="LDAP-BACKEND-EXTRA-PORT",
103 help="Additional TCP port for LDAP backend server (to use for replication)")
104 parser
.add_option("--ldap-backend-forced-uri", type="string", metavar
="LDAP-BACKEND-FORCED-URI",
105 help="Force the LDAP backend connection to be to a particular URI. Use this ONLY for 'existing' backends, or when debugging the interaction with the LDAP backend and you need to intercept the LDAP traffic")
106 parser
.add_option("--ldap-backend-type", type="choice", metavar
="LDAP-BACKEND-TYPE",
107 help="LDAP backend type (fedora-ds or openldap)",
108 choices
=["fedora-ds", "openldap"])
109 parser
.add_option("--ldap-backend-nosync", help="Configure LDAP backend not to call fsync() (for performance in test environments)", action
="store_true")
110 parser
.add_option("--server-role", type="choice", metavar
="ROLE",
111 choices
=["domain controller", "dc", "member server", "member", "standalone"],
112 help="The server role (domain controller | dc | member server | member | standalone). Default is dc.")
113 parser
.add_option("--function-level", type="choice", metavar
="FOR-FUN-LEVEL",
114 choices
=["2000", "2003", "2008", "2008_R2"],
115 help="The domain and forest function level (2000 | 2003 | 2008 | 2008_R2 - always native). Default is (Windows) 2003 Native.")
116 parser
.add_option("--next-rid", type="int", metavar
="NEXTRID", default
=1000,
117 help="The initial nextRid value (only needed for upgrades). Default is 1000.")
118 parser
.add_option("--partitions-only",
119 help="Configure Samba's partitions, but do not modify them (ie, join a BDC)", action
="store_true")
120 parser
.add_option("--targetdir", type="string", metavar
="DIR",
121 help="Set target directory")
122 parser
.add_option("--ol-mmr-urls", type="string", metavar
="LDAPSERVER",
123 help="List of LDAP-URLS [ ldap://<FQHN>:<PORT>/ (where <PORT> has to be different than 389!) ] separated with comma (\",\") for use with OpenLDAP-MMR (Multi-Master-Replication), e.g.: \"ldap://s4dc1:9000,ldap://s4dc2:9000\"")
124 parser
.add_option("--slapd-path", type="string", metavar
="SLAPD-PATH",
125 help="Path to slapd for LDAP backend [e.g.:'/usr/local/libexec/slapd']. Required for Setup with LDAP-Backend. OpenLDAP Version >= 2.4.17 should be used.")
126 parser
.add_option("--setup-ds-path", type="string", metavar
="SETUP_DS-PATH",
127 help="Path to setup-ds.pl script for Fedora DS LDAP backend [e.g.:'/usr/sbin/setup-ds.pl']. Required for Setup with Fedora DS backend.")
128 parser
.add_option("--use-xattrs", type="choice", choices
=["yes", "no", "auto"], help="Define if we should use the native fs capabilities or a tdb file for storing attributes likes ntacl, auto tries to make an inteligent guess based on the user rights and system capabilities", default
="auto")
129 parser
.add_option("--ldap-dryrun-mode", help="Configure LDAP backend, but do not run any binaries and exit early. Used only for the test environment. DO NOT USE", action
="store_true")
131 opts
= parser
.parse_args()[0]
133 logger
= logging
.getLogger("provision")
134 logger
.addHandler(logging
.StreamHandler(sys
.stdout
))
136 logger
.setLevel(logging
.WARNING
)
138 logger
.setLevel(logging
.INFO
)
140 if len(sys
.argv
) == 1:
141 opts
.interactive
= True
144 from getpass
import getpass
147 def ask(prompt
, default
=None):
148 if default
is not None:
149 print "%s [%s]: " % (prompt
, default
),
151 print "%s: " % (prompt
,),
152 return sys
.stdin
.readline().rstrip("\n") or default
154 default
= socket
.getfqdn().split(".", 1)[1].upper()
157 opts
.realm
= ask("Realm", default
)
158 if opts
.realm
in (None, ""):
159 print >>sys
.stderr
, "No realm set!"
163 default
= opts
.realm
.split(".")[0]
166 opts
.domain
= ask("Domain", default
)
167 if opts
.domain
is None:
168 print >> sys
.stderr
, "No domain set!"
171 opts
.server_role
= ask("Server Role (dc, member, standalone)", "dc")
173 opts
.adminpass
= getpass("Administrator password: ")
174 if not opts
.adminpass
:
175 print >>sys
.stderr
, "Invalid administrator password."
179 if opts
.realm
in (None, ""):
180 opts
.realm
= sambaopts
._lp
.get('realm')
181 if opts
.realm
is None or opts
.domain
is None:
182 if opts
.realm
is None:
183 print >>sys
.stderr
, "No realm set!"
184 if opts
.domain
is None:
185 print >> sys
.stderr
, "No domain set!"
189 if not opts
.adminpass
:
190 logger
.info("Administrator password will be set randomly!")
192 lp
= sambaopts
.get_loadparm()
193 smbconf
= lp
.configfile
195 if opts
.server_role
== "dc":
196 server_role
= "domain controller"
197 elif opts
.server_role
== "member":
198 server_role
= "member server"
200 server_role
= opts
.server_role
202 if server_role
is None:
203 server_role
= "domain controller"
205 if opts
.function_level
is None:
206 dom_for_fun_level
= None
207 elif opts
.function_level
== "2000":
208 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2000
209 elif opts
.function_level
== "2003":
210 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2003
211 elif opts
.function_level
== "2008":
212 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2008
213 elif opts
.function_level
== "2008_R2":
214 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2008_R2
216 creds
= credopts
.get_credentials(lp
)
218 creds
.set_kerberos_state(DONT_USE_KERBEROS
)
220 samdb_fill
= FILL_FULL
222 samdb_fill
= FILL_NT4SYNC
223 elif opts
.partitions_only
:
224 samdb_fill
= FILL_DRS
227 if opts
.use_xattrs
== "yes":
229 elif opts
.use_xattrs
== "auto" and not lp
.get("posix:eadb"):
231 file = tempfile
.NamedTemporaryFile(prefix
=os
.path
.abspath(opts
.targetdir
))
233 file = tempfile
.NamedTemporaryFile(prefix
=os
.path
.abspath(os
.path
.dirname(lp
.get("private dir"))))
235 samba
.ntacls
.setntacl(lp
, file.name
,
236 "O:S-1-5-32G:S-1-5-32", "S-1-5-32", "native")
239 logger
.info("You are not root or your system do not support xattr, using tdb backend for attributes. "
240 "If you intend to use this provision in production, rerun the script as root on a system supporting xattrs.")
244 if opts
.ldap_backend_type
== "existing":
245 if opts
.ldap_backend_forced_uri
is not None:
246 logger
.warn("You have specified to use an existing LDAP server as the backend, please make sure an LDAP server is running at %s" % opts
.ldap_backend_forced_uri
)
248 logger
.info("You have specified to use an existing LDAP server as the backend, please make sure an LDAP server is running at the default location")
250 if opts
.ldap_backend_forced_uri
is not None:
251 logger
.warn("You have specified to use an fixed URI %s for connecting to your LDAP server backend. This is NOT RECOMMENDED, as our default communiation over ldapi:// is more secure and much less prone to unexpected failure or interaction" % opts
.ldap_backend_forced_uri
)
253 session
= system_session()
256 session
, creds
, smbconf
=smbconf
, targetdir
=opts
.targetdir
,
257 samdb_fill
=samdb_fill
, realm
=opts
.realm
, domain
=opts
.domain
,
258 domainguid
=opts
.domain_guid
, domainsid
=opts
.domain_sid
,
259 hostname
=opts
.host_name
,
260 hostip
=opts
.host_ip
, hostip6
=opts
.host_ip6
,
261 ntdsguid
=opts
.ntds_guid
,
262 invocationid
=opts
.invocationid
, adminpass
=opts
.adminpass
,
263 krbtgtpass
=opts
.krbtgtpass
, machinepass
=opts
.machinepass
,
264 dns_backend
=opts
.dns_backend
,
265 dnspass
=opts
.dnspass
, root
=opts
.root
, nobody
=opts
.nobody
,
266 wheel
=opts
.wheel
, users
=opts
.users
,
267 serverrole
=server_role
, dom_for_fun_level
=dom_for_fun_level
,
268 ldap_backend_extra_port
=opts
.ldap_backend_extra_port
,
269 ldap_backend_forced_uri
=opts
.ldap_backend_forced_uri
,
270 backend_type
=opts
.ldap_backend_type
,
271 ldapadminpass
=opts
.ldapadminpass
, ol_mmr_urls
=opts
.ol_mmr_urls
,
272 slapd_path
=opts
.slapd_path
, setup_ds_path
=opts
.setup_ds_path
,
273 nosync
=opts
.ldap_backend_nosync
, ldap_dryrun_mode
=opts
.ldap_dryrun_mode
,
274 useeadb
=eadb
, next_rid
=opts
.next_rid
, lp
=lp
)
275 except ProvisioningError
, e
: