source4/setup/provision

   1 #!/usr/bin/python
   2 #
   3 # Unix SMB/CIFS implementation.
   4 # provision a Samba4 server
   5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
   6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
   7 #
   8 # Based on the original in EJS:
   9 # Copyright (C) Andrew Tridgell 2005
  10 #
  11 # This program is free software; you can redistribute it and/or modify
  12 # it under the terms of the GNU General Public License as published by
  13 # the Free Software Foundation; either version 3 of the License, or
  14 # (at your option) any later version.
  15 #
  16 # This program is distributed in the hope that it will be useful,
  17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19 # GNU General Public License for more details.
  20 #
  21 # You should have received a copy of the GNU General Public License
  22 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 #
  24
  25 import optparse
  26 import sys
  27 import os
  28 import tempfile
  29
  30 # Find right directory when running from source tree
  31 sys.path.insert(0, "bin/python")
  32
  33 import samba
  34 import samba.ntacls
  35 from samba.credentials import DONT_USE_KERBEROS
  36 from samba.auth import system_session
  37 import samba.getopt as options
  38 from samba.provision import provision, FILL_FULL, FILL_NT4SYNC, FILL_DRS, find_setup_dir
  39
  40 # how do we make this case insensitive??
  41
  42 parser = optparse.OptionParser("provision [options]")
  43 sambaopts = options.SambaOptions(parser)
  44 parser.add_option_group(sambaopts)
  45 parser.add_option_group(options.VersionOptions(parser))
  46 credopts = options.CredentialsOptions(parser)
  47 parser.add_option_group(credopts)
  48 parser.add_option("--interactive", help="Ask for names", action="store_true")
  49 parser.add_option("--setupdir", type="string", metavar="DIR",
  50                 help="directory with setup files")
  51 parser.add_option("--realm", type="string", metavar="REALM", help="set realm")
  52 parser.add_option("--domain", type="string", metavar="DOMAIN",
  53                                   help="set domain")
  54 parser.add_option("--domain-guid", type="string", metavar="GUID",
  55                 help="set domainguid (otherwise random)")
  56 parser.add_option("--domain-sid", type="string", metavar="SID",
  57                 help="set domainsid (otherwise random)")
  58 parser.add_option("--policy-guid", type="string", metavar="GUID",
  59                                   help="set guid for domain policy")
  60 parser.add_option("--policy-guid-dc", type="string", metavar="GUID",
  61                                   help="set guid for domain controller policy")
  62 parser.add_option("--ntds-guid", type="string", metavar="GUID",
  63                   help="set NTDS object GUID (otherwise random)")
  64 parser.add_option("--invocationid", type="string", metavar="GUID",
  65                   help="set invocationid (otherwise random)")
  66 parser.add_option("--host-name", type="string", metavar="HOSTNAME",
  67                 help="set hostname")
  68 parser.add_option("--host-ip", type="string", metavar="IPADDRESS",
  69                 help="set IPv4 ipaddress")
  70 parser.add_option("--host-ip6", type="string", metavar="IP6ADDRESS",
  71                 help="set IPv6 ipaddress")
  72 parser.add_option("--adminpass", type="string", metavar="PASSWORD",
  73                 help="choose admin password (otherwise random)")
  74 parser.add_option("--krbtgtpass", type="string", metavar="PASSWORD",
  75                 help="choose krbtgt password (otherwise random)")
  76 parser.add_option("--machinepass", type="string", metavar="PASSWORD",
  77                 help="choose machine password (otherwise random)")
  78 parser.add_option("--dnspass", type="string", metavar="PASSWORD",
  79                 help="choose dns password (otherwise random)")
  80 parser.add_option("--ldapadminpass", type="string", metavar="PASSWORD",
  81                 help="choose password to set between Samba and it's LDAP backend (otherwise random)")
  82 parser.add_option("--root", type="string", metavar="USERNAME",
  83                 help="choose 'root' unix username")
  84 parser.add_option("--nobody", type="string", metavar="USERNAME",
  85                 help="choose 'nobody' user")
  86 parser.add_option("--wheel", type="string", metavar="GROUPNAME",
  87                 help="choose 'wheel' privileged group")
  88 parser.add_option("--users", type="string", metavar="GROUPNAME",
  89                 help="choose 'users' group")
  90 parser.add_option("--quiet", help="Be quiet", action="store_true")
  91 parser.add_option("--blank", action="store_true",
  92                 help="do not add users or groups, just the structure")
  93 parser.add_option("--ldap-backend-extra-port", type="int", metavar="LDAP-BACKEND-EXTRA-PORT",
  94                 help="Additional TCP port for LDAP backend server (to use for replication)")
  95 parser.add_option("--ldap-backend-type", type="choice", metavar="LDAP-BACKEND-TYPE",
  96                 help="LDAP backend type (fedora-ds or openldap)",
  97                 choices=["fedora-ds", "openldap"])
  98 parser.add_option("--ldap-backend-nosync", help="Configure LDAP backend not to call fsync() (for performance in test environments)", action="store_true")
  99 parser.add_option("--server-role", type="choice", metavar="ROLE",
 100                   choices=["domain controller", "dc", "member server", "member", "standalone"],
 101                 help="The server role (domain controller | dc | member server | member | standalone). Default is standalone.")
 102 parser.add_option("--function-level", type="choice", metavar="FOR-FUN-LEVEL",
 103                   choices=["2003", "2008", "2008_R2"],
 104                 help="The domain and forest function level (2003 | 2008 | 2008_R2). Default is (Windows) 2003 (Native).")
 105 parser.add_option("--partitions-only",
 106                 help="Configure Samba's partitions, but do not modify them (ie, join a BDC)", action="store_true")
 107 parser.add_option("--targetdir", type="string", metavar="DIR",
 108                           help="Set target directory")
 109 parser.add_option("--ol-mmr-urls", type="string", metavar="LDAPSERVER",
 110                 help="List of LDAP-URLS [ ldap://<FQHN>:<PORT>/  (where <PORT> has to be different than 389!) ] separated with whitespaces for use with OpenLDAP-MMR (Multi-Master-Replication)")
 111 parser.add_option("--slapd-path", type="string", metavar="SLAPD-PATH",
 112                 help="Path to slapd for LDAP backend [e.g.:'/usr/local/libexec/slapd']. Required for Setup with LDAP-Backend. OpenLDAP Version >= 2.4.17 should be used.")
 113 parser.add_option("--setup-ds-path", type="string", metavar="SETUP_DS-PATH",
 114                 help="Path to setup-ds.pl script for Fedora DS LDAP backend [e.g.:'/usr/sbin/setup-ds.pl']. Required for Setup with Fedora DS backend.")
 115 parser.add_option("--nosync", help="Configure LDAP backend not to call fsync() (for performance in test environments)", action="store_true")
 116 parser.add_option("--use-xattrs", type="choice", choices=["yes","no","auto"], help="Define if we should use the native fs capabilities or a tdb file for storing attributes likes ntacl, auto tries to make an inteligent guess based on the user rights and system capabilities")
 117 parser.add_option("--ldap-dryrun-mode", help="Configure LDAP backend, but do not run any binaries and exit early.  Used only for the test environment.  DO NOT USE", action="store_true")
 118
 119 opts = parser.parse_args()[0]
 120
 121 def message(text):
 122         """print a message if quiet is not set."""
 123         if not opts.quiet:
 124                 print text
 125
 126 if len(sys.argv) == 1:
 127         opts.interactive = True
 128
 129 if opts.interactive:
 130         from getpass import getpass
 131         import socket
 132         def ask(prompt, default=None):
 133                 if default is not None:
 134                         print "%s [%s]: " % (prompt,default),
 135                 else:
 136                         print "%s: " % (prompt,),
 137                 return sys.stdin.readline().rstrip("\n") or default
 138         try:
 139                 default = socket.getfqdn().split(".", 1)[1].upper()
 140         except IndexError:
 141                 default = None
 142         opts.realm = ask("Realm", default)
 143         if opts.realm in (None, ""):
 144                 print >>sys.stderr, "No realm set!"
 145                 sys.exit(1)
 146
 147         try:
 148                 default = opts.realm.split(".")[0]
 149         except IndexError:
 150                 default = None
 151         opts.domain = ask("Domain", default)
 152         if opts.domain is None:
 153                 print >> sys.stderr, "No domain set!"
 154                 sys.exit(1)
 155
 156         opts.server_role = ask("Server Role (dc, member, standalone)", "dc")
 157         for i in range(3):
 158                 opts.adminpass = getpass("Administrator password: ")
 159                 if not opts.adminpass:
 160                         print >>sys.stderr, "Invalid administrator password."
 161                 else:
 162                         break
 163 else:
 164         if opts.realm is None or opts.domain is None:
 165                 if opts.realm is None:
 166                         print >>sys.stderr, "No realm set!"
 167                 if opts.domain is None:
 168                         print >> sys.stderr, "No domain set!"
 169                 parser.print_usage()
 170                 sys.exit(1)
 171
 172 if not opts.adminpass:
 173         message("Administrator password will be set randomly!")
 174
 175 lp = sambaopts.get_loadparm()
 176 smbconf = lp.configfile
 177
 178 if opts.server_role == "dc":
 179         server_role = "domain controller"
 180 elif opts.server_role == "member":
 181         server_role = "member server"
 182 else:
 183         server_role = opts.server_role
 184
 185 if opts.function_level is None:
 186         dom_for_fun_level = None
 187 elif opts.function_level == "2003":
 188         dom_for_fun_level = DS_DOMAIN_FUNCTION_2003
 189 elif opts.function_level == "2008":
 190         dom_for_fun_level = DS_DOMAIN_FUNCTION_2008
 191 elif opts.function_level == "2008_R2":
 192         dom_for_fun_level = DS_DOMAIN_FUNCTION_2008_R2
 193
 194 creds = credopts.get_credentials(lp)
 195
 196 creds.set_kerberos_state(DONT_USE_KERBEROS)
 197
 198 setup_dir = opts.setupdir
 199 if setup_dir is None:
 200         setup_dir = find_setup_dir()
 201
 202 samdb_fill = FILL_FULL
 203 if opts.blank:
 204     samdb_fill = FILL_NT4SYNC
 205 elif opts.partitions_only:
 206     samdb_fill = FILL_DRS
 207
 208 if not opts.use_xattrs:
 209         opts.use_xattrs="auto"
 210
 211 eadb = True
 212 if opts.use_xattrs == "yes":
 213         eadb = False
 214 elif opts.use_xattrs == "auto":
 215         file=tempfile.NamedTemporaryFile()
 216         try:
 217                 samba.ntacls.setntacl(lp,file.name,"O:S-1-5-32G:S-1-5-32","S-1-5-32","native")
 218                 eadb = False
 219         except:
 220                 if lp.get("posix:eadb") == None:
 221                         message("Notice: you are not root or your system do not support xattr, tdb backend for attributes has been selected")
 222                         message(" if you intend to use this provision in production you'd better rerun the script as root on a system supporting xattr")
 223         file.close()
 224
 225
 226 session = system_session()
 227 provision(setup_dir, message,
 228           session, creds, smbconf=smbconf, targetdir=opts.targetdir,
 229           samdb_fill=samdb_fill, realm=opts.realm, domain=opts.domain,
 230           domainguid=opts.domain_guid, domainsid=opts.domain_sid,
 231           policyguid=opts.policy_guid, policyguid_dc=opts.policy_guid_dc,
 232           hostname=opts.host_name,
 233           hostip=opts.host_ip, hostip6=opts.host_ip6,
 234           ntdsguid=opts.ntds_guid,
 235           invocationid=opts.invocationid, adminpass=opts.adminpass,
 236           krbtgtpass=opts.krbtgtpass, machinepass=opts.machinepass,
 237           dnspass=opts.dnspass, root=opts.root, nobody=opts.nobody,
 238           wheel=opts.wheel, users=opts.users,
 239           serverrole=server_role, dom_for_fun_level=dom_for_fun_level,
 240           ldap_backend_extra_port=opts.ldap_backend_extra_port,
 241           backend_type=opts.ldap_backend_type,
 242           ldapadminpass=opts.ldapadminpass, ol_mmr_urls=opts.ol_mmr_urls,
 243           slapd_path=opts.slapd_path, setup_ds_path=opts.setup_ds_path,
 244           nosync=opts.nosync,ldap_dryrun_mode=opts.ldap_dryrun_mode,useeadb=eadb)