2 # Unix SMB/CIFS implementation.
3 # backend code for provisioning a Samba4 server
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008-2009
7 # Copyright (C) Oliver Liebel <oliver@itc.li> 2008-2009
9 # Based on the original in EJS:
10 # Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
12 # This program is free software; you can redistribute it and/or modify
13 # it under the terms of the GNU General Public License as published by
14 # the Free Software Foundation; either version 3 of the License, or
15 # (at your option) any later version.
17 # This program is distributed in the hope that it will be useful,
18 # but WITHOUT ANY WARRANTY; without even the implied warranty of
19 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 # GNU General Public License for more details.
22 # You should have received a copy of the GNU General Public License
23 # along with this program. If not, see <http://www.gnu.org/licenses/>.
26 """Functions for setting up a Samba configuration."""
28 from base64
import b64encode
43 from auth
import system_session
, admin_session
44 from samba
import version
, Ldb
, substitute_var
, valid_netbios_name
, setup_file
45 from samba
import check_all_substituted
, read_and_sub_file
46 from samba
import DS_DOMAIN_FUNCTION_2003
, DS_DOMAIN_FUNCTION_2008
, DS_DC_FUNCTION_2008
47 from samba
.samdb
import SamDB
48 from samba
.idmap
import IDmapDB
49 from samba
.dcerpc
import security
50 from samba
.misc
import setntacl
,dsacl2fsacl
51 from samba
.ndr
import ndr_pack
,ndr_unpack
53 from ldb
import SCOPE_SUBTREE
, SCOPE_ONELEVEL
, SCOPE_BASE
, LdbError
54 from ms_display_specifiers
import read_ms_ldif
55 from schema
import Schema
56 from provisionbackend
import LDBBackend
, ExistingBackend
, FDSBackend
, OpenLDAPBackend
57 from provisionexceptions
import ProvisioningError
, InvalidNetbiosName
58 from signal
import SIGTERM
59 from dcerpc
.misc
import SEC_CHAN_BDC
, SEC_CHAN_WKSTA
60 __docformat__
= "restructuredText"
63 """Find the setup directory used by provision."""
64 dirname
= os
.path
.dirname(__file__
)
65 if "/site-packages/" in dirname
:
66 prefix
= "/".join(dirname
[:dirname
.index("/site-packages/")].split("/")[:-2])
67 for suffix
in ["share/setup", "share/samba/setup", "setup"]:
68 ret
= os
.path
.join(prefix
, suffix
)
69 if os
.path
.isdir(ret
):
72 ret
= os
.path
.join(dirname
, "../../../setup")
73 if os
.path
.isdir(ret
):
75 raise Exception("Unable to find setup directory.")
77 # descriptors of the naming contexts
78 # hard coded at this point, but will probably be changed when
79 # we enable different fsmo roles
81 def get_config_descriptor(domain_sid
):
82 sddl
= "O:EAG:EAD:(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
83 "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
84 "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
85 "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
86 "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
87 "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
88 "(A;;RPLCLORC;;;AU)(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;EA)" \
89 "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;CIIO;RPWPCRCCLCLORCWOWDSDSW;;;DA)" \
90 "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
91 "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;ED)" \
92 "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
93 "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;BA)" \
94 "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ER)" \
95 "S:(AU;SA;WPWOWD;;;WD)(AU;SA;CR;;;BA)(AU;SA;CR;;;DU)" \
96 "(OU;SA;CR;45ec5156-db7e-47bb-b53f-dbeb2d03c40f;;WD)"
97 sec
= security
.descriptor
.from_sddl(sddl
, domain_sid
)
100 def get_domain_descriptor(domain_sid
):
101 sddl
= "O:BAG:BAD:AI(OA;CIIO;RP;4c164200-20c0-11d0-a768-00aa006e0529;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)" \
102 "(OA;CIIO;RP;4c164200-20c0-11d0-a768-00aa006e0529;bf967aba-0de6-11d0-a285-00aa003049e2;RU)" \
103 "(OA;CIIO;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)" \
104 "(OA;CIIO;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)" \
105 "(OA;CIIO;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)" \
106 "(OA;CIIO;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)" \
107 "(OA;CIIO;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)" \
108 "(OA;CIIO;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)" \
109 "(OA;CIIO;RP;037088f8-0ae1-11d2-b422-00a0c968f939;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)" \
110 "(OA;CIIO;RP;037088f8-0ae1-11d2-b422-00a0c968f939;bf967aba-0de6-11d0-a285-00aa003049e2;RU)" \
111 "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ER)" \
112 "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;DD)" \
113 "(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a86-0de6-11d0-a285-00aa003049e2;ED)" \
114 "(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a9c-0de6-11d0-a285-00aa003049e2;ED)" \
115 "(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967aba-0de6-11d0-a285-00aa003049e2;ED)" \
116 "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;BA)" \
117 "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
118 "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
119 "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
120 "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
121 "(OA;;CR;1131f6ae-9c07-11d1-f79f-00c04fc2dcd2;;BA)" \
122 "(OA;;CR;e2a36dc9-ae17-47c3-b58b-be34c55ba633;;IF)" \
123 "(OA;;RP;c7407360-20bf-11d0-a768-00aa006e0529;;RU)" \
124 "(OA;;RP;b8119fd0-04f6-4762-ab7a-4986c76b3f9a;;RU)" \
125 "(OA;CIIO;RPLCLORC;;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)" \
126 "(OA;CIIO;RPLCLORC;;bf967a9c-0de6-11d0-a285-00aa003049e2;RU)" \
127 "(OA;CIIO;RPLCLORC;;bf967aba-0de6-11d0-a285-00aa003049e2;RU)" \
128 "(OA;;CR;05c74c5e-4deb-43b4-bd9f-86664c2a7fd5;;AU)" \
129 "(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;ED)" \
130 "(OA;;CR;ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501;;AU)" \
131 "(OA;;CR;280f369c-67c7-438e-ae98-1d46f3c6f541;;AU)" \
132 "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
133 "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
134 "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
135 "(OA;;CR;1131f6ae-9c07-11d1-f79f-00c04fc2dcd2;;ED)" \
136 "(OA;;RP;b8119fd0-04f6-4762-ab7a-4986c76b3f9a;;AU)" \
137 "(OA;CIIO;RPWPCR;91e647de-d96f-4b70-9557-d63ff4f3ccd8;;PS)" \
138 "(A;;RPWPCRCCLCLORCWOWDSW;;;DA)" \
139 "(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;EA)" \
142 "(A;CI;RPWPCRCCLCLORCWOWDSDSW;;;BA)" \
144 "(A;;RPLCLORC;;;ED)" \
145 "(A;;RPLCLORC;;;AU)" \
146 "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)" \
147 "S:AI(OU;CISA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)" \
148 "(OU;CISA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)" \
149 "(AU;SA;CR;;;DU)(AU;SA;CR;;;BA)(AU;SA;WPWOWD;;;WD)"
150 sec
= security
.descriptor
.from_sddl(sddl
, domain_sid
)
153 DEFAULTSITE
= "Default-First-Site-Name"
157 class ProvisionPaths(object):
159 self
.shareconf
= None
170 self
.dns_keytab
= None
173 self
.private_dir
= None
175 self
.slapdconf
= None
176 self
.modulesconf
= None
177 self
.memberofconf
= None
179 self
.olmmrserveridsconf
= None
180 self
.olmmrsyncreplconf
= None
183 self
.olcseedldif
= None
186 class ProvisionNames(object):
192 self
.ldapmanagerdn
= None
193 self
.dnsdomain
= None
195 self
.netbiosname
= None
202 class ProvisionResult(object):
209 def check_install(lp
, session_info
, credentials
):
210 """Check whether the current install seems ok.
212 :param lp: Loadparm context
213 :param session_info: Session information
214 :param credentials: Credentials
216 if lp
.get("realm") == "":
217 raise Exception("Realm empty")
218 ldb
= Ldb(lp
.get("sam database"), session_info
=session_info
,
219 credentials
=credentials
, lp
=lp
)
220 if len(ldb
.search("(cn=Administrator)")) != 1:
221 raise ProvisioningError("No administrator account found")
224 def findnss(nssfn
, names
):
225 """Find a user or group from a list of possibilities.
227 :param nssfn: NSS Function to try (should raise KeyError if not found)
228 :param names: Names to check.
229 :return: Value return by first names list.
236 raise KeyError("Unable to find user/group %r" % names
)
239 findnss_uid
= lambda names
: findnss(pwd
.getpwnam
, names
)[2]
240 findnss_gid
= lambda names
: findnss(grp
.getgrnam
, names
)[2]
243 def setup_add_ldif(ldb
, ldif_path
, subst_vars
=None,controls
=["relax:0"]):
244 """Setup a ldb in the private dir.
246 :param ldb: LDB file to import data into
247 :param ldif_path: Path of the LDIF file to load
248 :param subst_vars: Optional variables to subsitute in LDIF.
249 :param nocontrols: Optional list of controls, can be None for no controls
251 assert isinstance(ldif_path
, str)
252 data
= read_and_sub_file(ldif_path
, subst_vars
)
253 ldb
.add_ldif(data
,controls
)
256 def setup_modify_ldif(ldb
, ldif_path
, subst_vars
=None):
257 """Modify a ldb in the private dir.
259 :param ldb: LDB object.
260 :param ldif_path: LDIF file path.
261 :param subst_vars: Optional dictionary with substitution variables.
263 data
= read_and_sub_file(ldif_path
, subst_vars
)
265 ldb
.modify_ldif(data
)
268 def setup_ldb(ldb
, ldif_path
, subst_vars
):
269 """Import a LDIF a file into a LDB handle, optionally substituting variables.
271 :note: Either all LDIF data will be added or none (using transactions).
273 :param ldb: LDB file to import into.
274 :param ldif_path: Path to the LDIF file.
275 :param subst_vars: Dictionary with substitution variables.
277 assert ldb
is not None
278 ldb
.transaction_start()
280 setup_add_ldif(ldb
, ldif_path
, subst_vars
)
282 ldb
.transaction_cancel()
284 ldb
.transaction_commit()
287 def provision_paths_from_lp(lp
, dnsdomain
):
288 """Set the default paths for provisioning.
290 :param lp: Loadparm context.
291 :param dnsdomain: DNS Domain name
293 paths
= ProvisionPaths()
294 paths
.private_dir
= lp
.get("private dir")
295 paths
.dns_keytab
= "dns.keytab"
297 paths
.shareconf
= os
.path
.join(paths
.private_dir
, "share.ldb")
298 paths
.samdb
= os
.path
.join(paths
.private_dir
, lp
.get("sam database") or "samdb.ldb")
299 paths
.idmapdb
= os
.path
.join(paths
.private_dir
, lp
.get("idmap database") or "idmap.ldb")
300 paths
.secrets
= os
.path
.join(paths
.private_dir
, lp
.get("secrets database") or "secrets.ldb")
301 paths
.privilege
= os
.path
.join(paths
.private_dir
, "privilege.ldb")
302 paths
.dns
= os
.path
.join(paths
.private_dir
, dnsdomain
+ ".zone")
303 paths
.namedconf
= os
.path
.join(paths
.private_dir
, "named.conf")
304 paths
.namedtxt
= os
.path
.join(paths
.private_dir
, "named.txt")
305 paths
.krb5conf
= os
.path
.join(paths
.private_dir
, "krb5.conf")
306 paths
.winsdb
= os
.path
.join(paths
.private_dir
, "wins.ldb")
307 paths
.s4_ldapi_path
= os
.path
.join(paths
.private_dir
, "ldapi")
308 paths
.phpldapadminconfig
= os
.path
.join(paths
.private_dir
,
309 "phpldapadmin-config.php")
310 paths
.ldapdir
= os
.path
.join(paths
.private_dir
,
312 paths
.slapdconf
= os
.path
.join(paths
.ldapdir
,
314 paths
.slapdpid
= os
.path
.join(paths
.ldapdir
,
316 paths
.modulesconf
= os
.path
.join(paths
.ldapdir
,
318 paths
.memberofconf
= os
.path
.join(paths
.ldapdir
,
320 paths
.olmmrserveridsconf
= os
.path
.join(paths
.ldapdir
,
321 "mmr_serverids.conf")
322 paths
.olmmrsyncreplconf
= os
.path
.join(paths
.ldapdir
,
324 paths
.olcdir
= os
.path
.join(paths
.ldapdir
,
326 paths
.olcseedldif
= os
.path
.join(paths
.ldapdir
,
328 paths
.hklm
= "hklm.ldb"
329 paths
.hkcr
= "hkcr.ldb"
330 paths
.hkcu
= "hkcu.ldb"
331 paths
.hku
= "hku.ldb"
332 paths
.hkpd
= "hkpd.ldb"
333 paths
.hkpt
= "hkpt.ldb"
335 paths
.sysvol
= lp
.get("path", "sysvol")
337 paths
.netlogon
= lp
.get("path", "netlogon")
339 paths
.smbconf
= lp
.configfile
344 def guess_names(lp
=None, hostname
=None, domain
=None, dnsdomain
=None,
345 serverrole
=None, rootdn
=None, domaindn
=None, configdn
=None,
346 schemadn
=None, serverdn
=None, sitename
=None):
347 """Guess configuration settings to use."""
350 hostname
= socket
.gethostname().split(".")[0]
352 netbiosname
= lp
.get("netbios name")
353 if netbiosname
is None:
354 netbiosname
= hostname
355 assert netbiosname
is not None
356 netbiosname
= netbiosname
.upper()
357 if not valid_netbios_name(netbiosname
):
358 raise InvalidNetbiosName(netbiosname
)
360 if dnsdomain
is None:
361 dnsdomain
= lp
.get("realm")
362 if dnsdomain
is None or dnsdomain
== "":
363 raise ProvisioningError("guess_names: 'realm' not specified in supplied smb.conf!")
365 dnsdomain
= dnsdomain
.lower()
367 if serverrole
is None:
368 serverrole
= lp
.get("server role")
369 if serverrole
is None:
370 raise ProvisioningError("guess_names: 'server role' not specified in supplied smb.conf!")
372 serverrole
= serverrole
.lower()
374 realm
= dnsdomain
.upper()
376 if lp
.get("realm").upper() != realm
:
377 raise ProvisioningError("guess_names: Realm '%s' in smb.conf must match chosen realm '%s'!", lp
.get("realm").upper(), realm
)
379 if lp
.get("server role").lower() != serverrole
:
380 raise ProvisioningError("guess_names: server role '%s' in smb.conf must match chosen server role '%s'!", lp
.get("server role").upper(), serverrole
)
382 if serverrole
== "domain controller":
384 domain
= lp
.get("workgroup")
386 raise ProvisioningError("guess_names: 'workgroup' not specified in supplied smb.conf!")
387 domain
= domain
.upper()
389 if lp
.get("workgroup").upper() != domain
:
390 raise ProvisioningError("guess_names: Workgroup '%s' in smb.conf must match chosen domain '%s'!", lp
.get("workgroup").upper(), domain
)
393 domaindn
= "DC=" + dnsdomain
.replace(".", ",DC=")
397 domaindn
= "DC=" + netbiosname
399 if not valid_netbios_name(domain
):
400 raise InvalidNetbiosName(domain
)
402 if hostname
.upper() == realm
:
403 raise ProvisioningError("guess_names: Realm '%s' must not be equal to hostname '%s'!", realm
, hostname
)
404 if netbiosname
== realm
:
405 raise ProvisioningError("guess_names: Realm '%s' must not be equal to netbios hostname '%s'!", realm
, netbiosname
)
407 raise ProvisioningError("guess_names: Realm '%s' must not be equal to short domain name '%s'!", realm
, domain
)
413 configdn
= "CN=Configuration," + rootdn
415 schemadn
= "CN=Schema," + configdn
420 names
= ProvisionNames()
421 names
.rootdn
= rootdn
422 names
.domaindn
= domaindn
423 names
.configdn
= configdn
424 names
.schemadn
= schemadn
425 names
.ldapmanagerdn
= "CN=Manager," + rootdn
426 names
.dnsdomain
= dnsdomain
427 names
.domain
= domain
429 names
.netbiosname
= netbiosname
430 names
.hostname
= hostname
431 names
.sitename
= sitename
432 names
.serverdn
= "CN=%s,CN=Servers,CN=%s,CN=Sites,%s" % (netbiosname
, sitename
, configdn
)
437 def make_smbconf(smbconf
, setup_path
, hostname
, domain
, realm
, serverrole
,
438 targetdir
, sid_generator
):
439 """Create a new smb.conf file based on a couple of basic settings.
441 assert smbconf
is not None
443 hostname
= socket
.gethostname().split(".")[0]
444 netbiosname
= hostname
.upper()
446 if serverrole
is None:
447 serverrole
= "standalone"
449 assert serverrole
in ("domain controller", "member server", "standalone")
450 if serverrole
== "domain controller":
452 elif serverrole
== "member server":
453 smbconfsuffix
= "member"
454 elif serverrole
== "standalone":
455 smbconfsuffix
= "standalone"
457 if sid_generator
is None:
458 sid_generator
= "internal"
460 assert domain
is not None
461 domain
= domain
.upper()
463 assert realm
is not None
464 realm
= realm
.upper()
466 default_lp
= param
.LoadParm()
467 #Load non-existant file
468 if os
.path
.exists(smbconf
):
469 default_lp
.load(smbconf
)
471 if targetdir
is not None:
472 privatedir_line
= "private dir = " + os
.path
.abspath(os
.path
.join(targetdir
, "private"))
473 lockdir_line
= "lock dir = " + os
.path
.abspath(targetdir
)
475 default_lp
.set("lock dir", os
.path
.abspath(targetdir
))
480 if sid_generator
== "internal":
481 sid_generator_line
= ""
483 sid_generator_line
= "sid generator = " + sid_generator
485 sysvol
= os
.path
.join(default_lp
.get("lock dir"), "sysvol")
486 netlogon
= os
.path
.join(sysvol
, realm
.lower(), "scripts")
488 setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix
),
490 "NETBIOS_NAME": netbiosname
,
493 "SERVERROLE": serverrole
,
494 "NETLOGONPATH": netlogon
,
495 "SYSVOLPATH": sysvol
,
496 "SIDGENERATOR_LINE": sid_generator_line
,
497 "PRIVATEDIR_LINE": privatedir_line
,
498 "LOCKDIR_LINE": lockdir_line
502 def setup_name_mappings(samdb
, idmap
, sid
, domaindn
, root_uid
, nobody_uid
,
503 users_gid
, wheel_gid
):
504 """setup reasonable name mappings for sam names to unix names.
506 :param samdb: SamDB object.
507 :param idmap: IDmap db object.
508 :param sid: The domain sid.
509 :param domaindn: The domain DN.
510 :param root_uid: uid of the UNIX root user.
511 :param nobody_uid: uid of the UNIX nobody user.
512 :param users_gid: gid of the UNIX users group.
513 :param wheel_gid: gid of the UNIX wheel group."""
515 idmap
.setup_name_mapping("S-1-5-7", idmap
.TYPE_UID
, nobody_uid
)
516 idmap
.setup_name_mapping("S-1-5-32-544", idmap
.TYPE_GID
, wheel_gid
)
518 idmap
.setup_name_mapping(sid
+ "-500", idmap
.TYPE_UID
, root_uid
)
519 idmap
.setup_name_mapping(sid
+ "-513", idmap
.TYPE_GID
, users_gid
)
521 def setup_samdb_partitions(samdb_path
, setup_path
, message
, lp
, session_info
,
522 provision_backend
, names
, schema
,
525 """Setup the partitions for the SAM database.
527 Alternatively, provision() may call this, and then populate the database.
529 :note: This will wipe the Sam Database!
531 :note: This function always removes the local SAM LDB file. The erase
532 parameter controls whether to erase the existing data, which
533 may not be stored locally but in LDAP.
536 assert session_info
is not None
538 old_partitions
= None
539 new_partitions
= None
541 # We use options=["modules:"] to stop the modules loading - we
542 # just want to wipe and re-initialise the database, not start it up
545 os
.unlink(samdb_path
)
549 samdb
= Ldb(url
=samdb_path
, session_info
=session_info
,
550 lp
=lp
, options
=["modules:"])
552 ldap_backend_line
= "# No LDAP backend"
553 if provision_backend
.type is not "ldb":
554 ldap_backend_line
= "ldapBackend: %s" % provision_backend
.ldapi_uri
556 samdb
.transaction_start()
558 message("Setting up sam.ldb partitions and settings")
559 setup_add_ldif(samdb
, setup_path("provision_partitions.ldif"), {
560 "SCHEMADN": ldb
.Dn(schema
.ldb
, names
.schemadn
).get_casefold(),
561 "CONFIGDN": ldb
.Dn(schema
.ldb
, names
.configdn
).get_casefold(),
562 "DOMAINDN": ldb
.Dn(schema
.ldb
, names
.domaindn
).get_casefold(),
563 "LDAP_BACKEND_LINE": ldap_backend_line
,
567 setup_add_ldif(samdb
, setup_path("provision_init.ldif"), {
568 "BACKEND_TYPE": provision_backend
.type,
569 "SERVER_ROLE": serverrole
572 message("Setting up sam.ldb rootDSE")
573 setup_samdb_rootdse(samdb
, setup_path
, names
)
576 samdb
.transaction_cancel()
579 samdb
.transaction_commit()
582 def secretsdb_self_join(secretsdb
, domain
,
583 netbiosname
, machinepass
, domainsid
=None,
584 realm
=None, dnsdomain
=None,
586 key_version_number
=1,
587 secure_channel_type
=SEC_CHAN_WKSTA
):
588 """Add domain join-specific bits to a secrets database.
590 :param secretsdb: Ldb Handle to the secrets database
591 :param machinepass: Machine password
593 attrs
=["whenChanged",
601 msg
= ldb
.Message(ldb
.Dn(secretsdb
, "flatname=%s,cn=Primary Domains" % domain
));
602 msg
["secureChannelType"] = str(secure_channel_type
)
603 msg
["flatname"] = [domain
]
604 msg
["objectClass"] = ["top", "primaryDomain"]
605 if realm
is not None:
606 if dnsdomain
is None:
607 dnsdomain
= realm
.lower()
608 msg
["objectClass"] = ["top", "primaryDomain", "kerberosSecret"]
610 msg
["saltPrincipal"] = "host/%s.%s@%s" % (netbiosname
.lower(), dnsdomain
.lower(), realm
.upper())
611 msg
["msDS-KeyVersionNumber"] = [str(key_version_number
)]
612 msg
["privateKeytab"] = ["secrets.keytab"];
615 msg
["secret"] = [machinepass
]
616 msg
["samAccountName"] = ["%s$" % netbiosname
]
617 msg
["secureChannelType"] = [str(secure_channel_type
)]
618 if domainsid
is not None:
619 msg
["objectSid"] = [ndr_pack(domainsid
)]
621 res
= secretsdb
.search(base
="cn=Primary Domains",
623 expression
=("(&(|(flatname=%s)(realm=%s)(objectSid=%s))(objectclass=primaryDomain))" % (domain
, realm
, str(domainsid
))),
624 scope
=SCOPE_ONELEVEL
)
627 if del_msg
.dn
is not msg
.dn
:
628 secretsdb
.delete(del_msg
.dn
)
630 res
= secretsdb
.search(base
=msg
.dn
, attrs
=attrs
, scope
=SCOPE_BASE
)
633 msg
["priorSecret"] = res
[0]["secret"]
634 msg
["priorWhenChanged"] = res
[0]["whenChanged"]
636 if res
["privateKeytab"] is not None:
637 msg
["privateKeytab"] = res
[0]["privateKeytab"]
639 if res
["krb5Keytab"] is not None:
640 msg
["krb5Keytab"] = res
[0]["krb5Keytab"]
643 el
.set_flags(ldb
.FLAG_MOD_REPLACE
)
644 secretsdb
.modify(msg
)
649 def secretsdb_setup_dns(secretsdb
, setup_path
, realm
, dnsdomain
,
650 dns_keytab_path
, dnspass
):
651 """Add DNS specific bits to a secrets database.
653 :param secretsdb: Ldb Handle to the secrets database
654 :param setup_path: Setup path function
655 :param machinepass: Machine password
657 setup_ldb(secretsdb
, setup_path("secrets_dns.ldif"), {
659 "DNSDOMAIN": dnsdomain
,
660 "DNS_KEYTAB": dns_keytab_path
,
661 "DNSPASS_B64": b64encode(dnspass
),
665 def setup_secretsdb(path
, setup_path
, session_info
, backend_credentials
, lp
):
666 """Setup the secrets database.
668 :param path: Path to the secrets database.
669 :param setup_path: Get the path to a setup file.
670 :param session_info: Session info.
671 :param credentials: Credentials
672 :param lp: Loadparm context
673 :return: LDB handle for the created secrets database
675 if os
.path
.exists(path
):
677 secrets_ldb
= Ldb(path
, session_info
=session_info
,
680 secrets_ldb
.load_ldif_file_add(setup_path("secrets_init.ldif"))
681 secrets_ldb
= Ldb(path
, session_info
=session_info
,
683 secrets_ldb
.transaction_start()
684 secrets_ldb
.load_ldif_file_add(setup_path("secrets.ldif"))
686 if backend_credentials
is not None and backend_credentials
.authentication_requested():
687 if backend_credentials
.get_bind_dn() is not None:
688 setup_add_ldif(secrets_ldb
, setup_path("secrets_simple_ldap.ldif"), {
689 "LDAPMANAGERDN": backend_credentials
.get_bind_dn(),
690 "LDAPMANAGERPASS_B64": b64encode(backend_credentials
.get_password())
693 setup_add_ldif(secrets_ldb
, setup_path("secrets_sasl_ldap.ldif"), {
694 "LDAPADMINUSER": backend_credentials
.get_username(),
695 "LDAPADMINREALM": backend_credentials
.get_realm(),
696 "LDAPADMINPASS_B64": b64encode(backend_credentials
.get_password())
701 def setup_privileges(path
, setup_path
, session_info
, lp
):
702 """Setup the privileges database.
704 :param path: Path to the privileges database.
705 :param setup_path: Get the path to a setup file.
706 :param session_info: Session info.
707 :param credentials: Credentials
708 :param lp: Loadparm context
709 :return: LDB handle for the created secrets database
711 if os
.path
.exists(path
):
713 privilege_ldb
= Ldb(path
, session_info
=session_info
, lp
=lp
)
714 privilege_ldb
.erase()
715 privilege_ldb
.load_ldif_file_add(setup_path("provision_privilege.ldif"))
718 def setup_registry(path
, setup_path
, session_info
, lp
):
719 """Setup the registry.
721 :param path: Path to the registry database
722 :param setup_path: Function that returns the path to a setup.
723 :param session_info: Session information
724 :param credentials: Credentials
725 :param lp: Loadparm context
727 reg
= registry
.Registry()
728 hive
= registry
.open_ldb(path
, session_info
=session_info
,
730 reg
.mount_hive(hive
, registry
.HKEY_LOCAL_MACHINE
)
731 provision_reg
= setup_path("provision.reg")
732 assert os
.path
.exists(provision_reg
)
733 reg
.diff_apply(provision_reg
)
736 def setup_idmapdb(path
, setup_path
, session_info
, lp
):
737 """Setup the idmap database.
739 :param path: path to the idmap database
740 :param setup_path: Function that returns a path to a setup file
741 :param session_info: Session information
742 :param credentials: Credentials
743 :param lp: Loadparm context
745 if os
.path
.exists(path
):
748 idmap_ldb
= IDmapDB(path
, session_info
=session_info
,
752 idmap_ldb
.load_ldif_file_add(setup_path("idmap_init.ldif"))
756 def setup_samdb_rootdse(samdb
, setup_path
, names
):
757 """Setup the SamDB rootdse.
759 :param samdb: Sam Database handle
760 :param setup_path: Obtain setup path
762 setup_add_ldif(samdb
, setup_path("provision_rootdse_add.ldif"), {
763 "SCHEMADN": names
.schemadn
,
764 "NETBIOSNAME": names
.netbiosname
,
765 "DNSDOMAIN": names
.dnsdomain
,
766 "REALM": names
.realm
,
767 "DNSNAME": "%s.%s" % (names
.hostname
, names
.dnsdomain
),
768 "DOMAINDN": names
.domaindn
,
769 "ROOTDN": names
.rootdn
,
770 "CONFIGDN": names
.configdn
,
771 "SERVERDN": names
.serverdn
,
775 def setup_self_join(samdb
, names
,
776 machinepass
, dnspass
,
777 domainsid
, invocationid
, setup_path
,
778 policyguid
, policyguid_dc
, domainControllerFunctionality
,
780 """Join a host to its own domain."""
781 assert isinstance(invocationid
, str)
782 if ntdsguid
is not None:
783 ntdsguid_line
= "objectGUID: %s\n"%ntdsguid
786 setup_add_ldif(samdb
, setup_path("provision_self_join.ldif"), {
787 "CONFIGDN": names
.configdn
,
788 "SCHEMADN": names
.schemadn
,
789 "DOMAINDN": names
.domaindn
,
790 "SERVERDN": names
.serverdn
,
791 "INVOCATIONID": invocationid
,
792 "NETBIOSNAME": names
.netbiosname
,
793 "DEFAULTSITE": names
.sitename
,
794 "DNSNAME": "%s.%s" % (names
.hostname
, names
.dnsdomain
),
795 "MACHINEPASS_B64": b64encode(machinepass
),
796 "REALM": names
.realm
,
797 "DOMAIN": names
.domain
,
798 "DOMAINSID": str(domainsid
),
799 "DNSDOMAIN": names
.dnsdomain
,
800 "SAMBA_VERSION_STRING": version
,
801 "NTDSGUID": ntdsguid_line
,
802 "DOMAIN_CONTROLLER_FUNCTIONALITY": str(domainControllerFunctionality
)})
804 setup_add_ldif(samdb
, setup_path("provision_group_policy.ldif"), {
805 "POLICYGUID": policyguid
,
806 "POLICYGUID_DC": policyguid_dc
,
807 "DNSDOMAIN": names
.dnsdomain
,
808 "DOMAINSID": str(domainsid
),
809 "DOMAINDN": names
.domaindn
})
811 # add the NTDSGUID based SPNs
812 ntds_dn
= "CN=NTDS Settings,CN=%s,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,%s" % (names
.hostname
, names
.domaindn
)
813 names
.ntdsguid
= samdb
.searchone(basedn
=ntds_dn
, attribute
="objectGUID",
814 expression
="", scope
=SCOPE_BASE
)
815 assert isinstance(names
.ntdsguid
, str)
817 # Setup fSMORoleOwner entries to point at the newly created DC entry
818 setup_modify_ldif(samdb
, setup_path("provision_self_join_modify.ldif"), {
819 "DOMAIN": names
.domain
,
820 "DNSDOMAIN": names
.dnsdomain
,
821 "DOMAINDN": names
.domaindn
,
822 "CONFIGDN": names
.configdn
,
823 "SCHEMADN": names
.schemadn
,
824 "DEFAULTSITE": names
.sitename
,
825 "SERVERDN": names
.serverdn
,
826 "NETBIOSNAME": names
.netbiosname
,
827 "NTDSGUID": names
.ntdsguid
,
828 "DNSPASS_B64": b64encode(dnspass
),
832 def setup_gpo(paths
,names
,samdb
,policyguid
,policyguid_dc
,domainsid
):
833 policy_path
= os
.path
.join(paths
.sysvol
, names
.dnsdomain
, "Policies",
834 "{" + policyguid
+ "}")
835 os
.makedirs(policy_path
, 0755)
836 open(os
.path
.join(policy_path
, "GPT.INI"), 'w').write(
837 "[General]\r\nVersion=65543")
838 os
.makedirs(os
.path
.join(policy_path
, "MACHINE"), 0755)
839 os
.makedirs(os
.path
.join(policy_path
, "USER"), 0755)
841 policy_path_dc
= os
.path
.join(paths
.sysvol
, names
.dnsdomain
, "Policies",
842 "{" + policyguid_dc
+ "}")
843 os
.makedirs(policy_path_dc
, 0755)
844 open(os
.path
.join(policy_path_dc
, "GPT.INI"), 'w').write(
845 "[General]\r\nVersion=2")
846 os
.makedirs(os
.path
.join(policy_path_dc
, "MACHINE"), 0755)
847 os
.makedirs(os
.path
.join(policy_path_dc
, "USER"), 0755)
850 def setup_samdb(path
, setup_path
, session_info
, provision_backend
, lp
,
852 domainsid
, domainguid
, policyguid
, policyguid_dc
,
853 fill
, adminpass
, krbtgtpass
,
854 machinepass
, invocationid
, dnspass
, ntdsguid
,
855 serverrole
, dom_for_fun_level
=None,
857 """Setup a complete SAM Database.
859 :note: This will wipe the main SAM database file!
862 # ATTENTION: Do NOT change these default values without discussion with the
863 # team and/or release manager. They have a big impact on the whole program!
864 domainControllerFunctionality
= DS_DC_FUNCTION_2008
866 if dom_for_fun_level
is None:
867 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2003
868 if dom_for_fun_level
< DS_DOMAIN_FUNCTION_2003
:
869 message("You want to run SAMBA 4 on a domain and forest function level lower than Windows 2003 (Native). This is not recommended")
871 if dom_for_fun_level
> domainControllerFunctionality
:
872 raise ProvisioningError("You want to run SAMBA 4 on a domain and forest function level which itself is higher than its actual DC function level (2008). This won't work!")
874 domainFunctionality
= dom_for_fun_level
875 forestFunctionality
= dom_for_fun_level
877 # Also wipes the database
878 setup_samdb_partitions(path
, setup_path
, message
=message
, lp
=lp
,
879 provision_backend
=provision_backend
, session_info
=session_info
,
881 serverrole
=serverrole
, schema
=schema
)
884 schema
= Schema(setup_path
, domainsid
, schemadn
=names
.schemadn
, serverdn
=names
.serverdn
)
886 # Load the database, but importantly, use Ldb not SamDB as we don't want to load the global schema
887 samdb
= Ldb(session_info
=session_info
,
888 credentials
=provision_backend
.credentials
, lp
=lp
)
890 message("Pre-loading the Samba 4 and AD schema")
892 # Load the schema from the one we computed earlier
893 samdb
.set_schema_from_ldb(schema
.ldb
)
895 # And now we can connect to the DB - the schema won't be loaded from the DB
901 samdb
.transaction_start()
903 # Set the domain functionality levels onto the database.
904 # Various module (the password_hash module in particular) need
905 # to know what level of AD we are emulating.
907 # These will be fixed into the database via the database
908 # modifictions below, but we need them set from the start.
909 samdb
.set_opaque_integer("domainFunctionality", domainFunctionality
)
910 samdb
.set_opaque_integer("forestFunctionality", forestFunctionality
)
911 samdb
.set_opaque_integer("domainControllerFunctionality", domainControllerFunctionality
)
913 samdb
.set_domain_sid(str(domainsid
))
914 samdb
.set_invocation_id(invocationid
)
916 message("Adding DomainDN: %s" % names
.domaindn
)
918 #impersonate domain admin
919 admin_session_info
= admin_session(lp
, str(domainsid
))
920 samdb
.set_session_info(admin_session_info
)
921 if domainguid
is not None:
922 domainguid_line
= "objectGUID: %s\n-" % domainguid
926 descr
= b64encode(get_domain_descriptor(domainsid
))
927 setup_add_ldif(samdb
, setup_path("provision_basedn.ldif"), {
928 "DOMAINDN": names
.domaindn
,
929 "DOMAINGUID": domainguid_line
,
934 setup_modify_ldif(samdb
, setup_path("provision_basedn_modify.ldif"), {
935 "CREATTIME": str(int(time
.time() * 1e7
)), # seconds -> ticks
936 "DOMAINSID": str(domainsid
),
937 "SCHEMADN": names
.schemadn
,
938 "NETBIOSNAME": names
.netbiosname
,
939 "DEFAULTSITE": names
.sitename
,
940 "CONFIGDN": names
.configdn
,
941 "SERVERDN": names
.serverdn
,
942 "POLICYGUID": policyguid
,
943 "DOMAINDN": names
.domaindn
,
944 "DOMAIN_FUNCTIONALITY": str(domainFunctionality
),
945 "SAMBA_VERSION_STRING": version
948 message("Adding configuration container")
949 descr
= b64encode(get_config_descriptor(domainsid
))
950 setup_add_ldif(samdb
, setup_path("provision_configuration_basedn.ldif"), {
951 "CONFIGDN": names
.configdn
,
955 # The LDIF here was created when the Schema object was constructed
956 message("Setting up sam.ldb schema")
957 samdb
.add_ldif(schema
.schema_dn_add
, controls
=["relax:0"])
958 samdb
.modify_ldif(schema
.schema_dn_modify
)
959 samdb
.write_prefixes_from_schema()
960 samdb
.add_ldif(schema
.schema_data
, controls
=["relax:0"])
961 setup_add_ldif(samdb
, setup_path("aggregate_schema.ldif"),
962 {"SCHEMADN": names
.schemadn
})
964 message("Reopening sam.ldb with new schema");
965 samdb
.transaction_commit()
966 samdb
= Ldb(session_info
=admin_session_info
,
967 credentials
=provision_backend
.credentials
, lp
=lp
)
969 samdb
.transaction_start()
970 samdb
.set_invocation_id(invocationid
)
972 message("Setting up sam.ldb configuration data")
973 setup_add_ldif(samdb
, setup_path("provision_configuration.ldif"), {
974 "CONFIGDN": names
.configdn
,
975 "NETBIOSNAME": names
.netbiosname
,
976 "DEFAULTSITE": names
.sitename
,
977 "DNSDOMAIN": names
.dnsdomain
,
978 "DOMAIN": names
.domain
,
979 "SCHEMADN": names
.schemadn
,
980 "DOMAINDN": names
.domaindn
,
981 "SERVERDN": names
.serverdn
,
982 "FOREST_FUNCTIONALALITY": str(forestFunctionality
)
985 message("Setting up display specifiers")
986 display_specifiers_ldif
= read_ms_ldif(setup_path('display-specifiers/DisplaySpecifiers-Win2k8R2.txt'))
987 display_specifiers_ldif
= substitute_var(display_specifiers_ldif
, {"CONFIGDN": names
.configdn
})
988 check_all_substituted(display_specifiers_ldif
)
989 samdb
.add_ldif(display_specifiers_ldif
)
991 message("Adding users container")
992 setup_add_ldif(samdb
, setup_path("provision_users_add.ldif"), {
993 "DOMAINDN": names
.domaindn
})
994 message("Modifying users container")
995 setup_modify_ldif(samdb
, setup_path("provision_users_modify.ldif"), {
996 "DOMAINDN": names
.domaindn
})
997 message("Adding computers container")
998 setup_add_ldif(samdb
, setup_path("provision_computers_add.ldif"), {
999 "DOMAINDN": names
.domaindn
})
1000 message("Modifying computers container")
1001 setup_modify_ldif(samdb
, setup_path("provision_computers_modify.ldif"), {
1002 "DOMAINDN": names
.domaindn
})
1003 message("Setting up sam.ldb data")
1004 setup_add_ldif(samdb
, setup_path("provision.ldif"), {
1005 "CREATTIME": str(int(time
.time() * 1e7
)), # seconds -> ticks
1006 "DOMAINDN": names
.domaindn
,
1007 "NETBIOSNAME": names
.netbiosname
,
1008 "DEFAULTSITE": names
.sitename
,
1009 "CONFIGDN": names
.configdn
,
1010 "SERVERDN": names
.serverdn
,
1011 "POLICYGUID_DC": policyguid_dc
1014 setup_modify_ldif(samdb
, setup_path("provision_basedn_references.ldif"), {
1015 "DOMAINDN": names
.domaindn
})
1017 setup_modify_ldif(samdb
, setup_path("provision_configuration_references.ldif"), {
1018 "CONFIGDN": names
.configdn
,
1019 "SCHEMADN": names
.schemadn
})
1020 if fill
== FILL_FULL
:
1021 message("Setting up sam.ldb users and groups")
1022 setup_add_ldif(samdb
, setup_path("provision_users.ldif"), {
1023 "DOMAINDN": names
.domaindn
,
1024 "DOMAINSID": str(domainsid
),
1025 "CONFIGDN": names
.configdn
,
1026 "ADMINPASS_B64": b64encode(adminpass
),
1027 "KRBTGTPASS_B64": b64encode(krbtgtpass
),
1030 message("Setting up self join")
1031 setup_self_join(samdb
, names
=names
, invocationid
=invocationid
,
1033 machinepass
=machinepass
,
1034 domainsid
=domainsid
, policyguid
=policyguid
,
1035 policyguid_dc
=policyguid_dc
,
1036 setup_path
=setup_path
,
1037 domainControllerFunctionality
=domainControllerFunctionality
,
1040 ntds_dn
= "CN=NTDS Settings,CN=%s,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,%s" % (names
.hostname
, names
.domaindn
)
1041 names
.ntdsguid
= samdb
.searchone(basedn
=ntds_dn
,
1042 attribute
="objectGUID", expression
="", scope
=SCOPE_BASE
)
1043 assert isinstance(names
.ntdsguid
, str)
1046 samdb
.transaction_cancel()
1049 samdb
.transaction_commit()
1054 FILL_NT4SYNC
= "NT4SYNC"
1056 SYSVOL_ACL
= "O:${DOMAINSID}-500G:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;S-1-5-32-549)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)"
1057 POLICIES_ACL
= "O:${DOMAINSID}-500G:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;S-1-5-32-549)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001301bf;;;${DOMAINSID}-520)"
1059 def set_gpo_acl(path
,acl
):
1061 for root
, dirs
, files
in os
.walk(path
, topdown
=False):
1063 setntacl(os
.path
.join(root
, name
),acl
)
1065 setntacl(os
.path
.join(root
, name
),acl
)
1067 def setdiracl(samdb
,names
,netlogon
,sysvol
,gid
,domainsid
):
1068 acl
= SYSVOL_ACL
.replace("${DOMAINSID}",str(domainsid
))
1069 os
.chown(sysvol
,-1,gid
)
1070 setntacl(sysvol
,acl
)
1071 for root
, dirs
, files
in os
.walk(sysvol
, topdown
=False):
1073 os
.chown(os
.path
.join(root
, name
),-1,gid
)
1074 setntacl(os
.path
.join(root
, name
),acl
)
1076 os
.chown(os
.path
.join(root
, name
),-1,gid
)
1077 setntacl(os
.path
.join(root
, name
),acl
)
1080 policy_path
= os
.path
.join(sysvol
, names
.dnsdomain
, "Policies")
1081 acl
= POLICIES_ACL
.replace("${DOMAINSID}",str(domainsid
))
1082 set_gpo_acl(policy_path
,dsacl2fsacl(acl
))
1083 res
= samdb
.search(base
="CN=Policies,CN=System,%s"%(names
.domaindn
),
1084 attrs
=["cn","nTSecurityDescriptor"],
1085 expression
="", scope
=SCOPE_ONELEVEL
)
1086 security
.dom_sid("S-1-5-21-1")
1088 acl
= ndr_unpack(security
.descriptor
,str(policy
["nTSecurityDescriptor"])).as_sddl()
1089 policy_path
= os
.path
.join(sysvol
, names
.dnsdomain
, "Policies",
1091 set_gpo_acl(policy_path
,dsacl2fsacl(acl
))
1095 def provision(setup_dir
, message
, session_info
,
1096 credentials
, smbconf
=None, targetdir
=None, samdb_fill
=FILL_FULL
,
1098 rootdn
=None, domaindn
=None, schemadn
=None, configdn
=None,
1100 domain
=None, hostname
=None, hostip
=None, hostip6
=None,
1101 domainsid
=None, adminpass
=None, ldapadminpass
=None,
1102 krbtgtpass
=None, domainguid
=None,
1103 policyguid
=None, policyguid_dc
=None, invocationid
=None,
1104 machinepass
=None, ntdsguid
=None,
1105 dnspass
=None, root
=None, nobody
=None, users
=None,
1106 wheel
=None, backup
=None, aci
=None, serverrole
=None,
1107 dom_for_fun_level
=None,
1108 ldap_backend_extra_port
=None, backend_type
=None,
1110 ol_mmr_urls
=None, ol_olc
=None,
1111 setup_ds_path
=None, slapd_path
=None, nosync
=False,
1112 ldap_dryrun_mode
=False,setfileacl
=False):
1115 :note: caution, this wipes all existing data!
1118 def setup_path(file):
1119 return os
.path
.join(setup_dir
, file)
1121 if domainsid
is None:
1122 domainsid
= security
.random_sid()
1124 domainsid
= security
.dom_sid(domainsid
)
1126 # create/adapt the group policy GUIDs
1127 if policyguid
is None:
1128 policyguid
= str(uuid
.uuid4())
1129 policyguid
= policyguid
.upper()
1130 if policyguid_dc
is None:
1131 policyguid_dc
= str(uuid
.uuid4())
1132 policyguid_dc
= policyguid_dc
.upper()
1134 if adminpass
is None:
1135 adminpass
= glue
.generate_random_str(12)
1136 if krbtgtpass
is None:
1137 krbtgtpass
= glue
.generate_random_str(12)
1138 if machinepass
is None:
1139 machinepass
= glue
.generate_random_str(12)
1141 dnspass
= glue
.generate_random_str(12)
1142 if ldapadminpass
is None:
1143 #Make a new, random password between Samba and it's LDAP server
1144 ldapadminpass
=glue
.generate_random_str(12)
1146 if backend_type
is None:
1147 backend_type
= "ldb"
1149 sid_generator
= "internal"
1150 if backend_type
== "fedora-ds":
1151 sid_generator
= "backend"
1153 root_uid
= findnss_uid([root
or "root"])
1154 nobody_uid
= findnss_uid([nobody
or "nobody"])
1155 users_gid
= findnss_gid([users
or "users"])
1157 wheel_gid
= findnss_gid(["wheel", "adm"])
1159 wheel_gid
= findnss_gid([wheel
])
1161 if targetdir
is not None:
1162 if (not os
.path
.exists(os
.path
.join(targetdir
, "etc"))):
1163 os
.makedirs(os
.path
.join(targetdir
, "etc"))
1164 smbconf
= os
.path
.join(targetdir
, "etc", "smb.conf")
1165 elif smbconf
is None:
1166 smbconf
= param
.default_path()
1168 # only install a new smb.conf if there isn't one there already
1169 if not os
.path
.exists(smbconf
):
1170 make_smbconf(smbconf
, setup_path
, hostname
, domain
, realm
, serverrole
,
1171 targetdir
, sid_generator
)
1173 lp
= param
.LoadParm()
1176 names
= guess_names(lp
=lp
, hostname
=hostname
, domain
=domain
,
1177 dnsdomain
=realm
, serverrole
=serverrole
,
1178 domaindn
=domaindn
, configdn
=configdn
, schemadn
=schemadn
,
1179 serverdn
=serverdn
, sitename
=sitename
)
1181 paths
= provision_paths_from_lp(lp
, names
.dnsdomain
)
1185 hostip
= socket
.getaddrinfo(names
.hostname
, None, socket
.AF_INET
, socket
.AI_CANONNAME
, socket
.IPPROTO_IP
)[0][-1][0]
1186 except socket
.gaierror
, (socket
.EAI_NODATA
, msg
):
1191 hostip6
= socket
.getaddrinfo(names
.hostname
, None, socket
.AF_INET6
, socket
.AI_CANONNAME
, socket
.IPPROTO_IP
)[0][-1][0]
1192 except socket
.gaierror
, (socket
.EAI_NODATA
, msg
):
1195 if serverrole
is None:
1196 serverrole
= lp
.get("server role")
1198 assert serverrole
in ("domain controller", "member server", "standalone")
1199 if invocationid
is None:
1200 invocationid
= str(uuid
.uuid4())
1202 if not os
.path
.exists(paths
.private_dir
):
1203 os
.mkdir(paths
.private_dir
)
1204 if not os
.path
.exists(os
.path
.join(paths
.private_dir
,"tls")):
1205 os
.mkdir(os
.path
.join(paths
.private_dir
,"tls"))
1207 ldapi_url
= "ldapi://%s" % urllib
.quote(paths
.s4_ldapi_path
, safe
="")
1209 schema
= Schema(setup_path
, domainsid
, schemadn
=names
.schemadn
, serverdn
=names
.serverdn
)
1211 if backend_type
== "ldb":
1212 provision_backend
= LDBBackend(backend_type
,
1213 paths
=paths
, setup_path
=setup_path
,
1214 lp
=lp
, credentials
=credentials
,
1217 elif backend_type
== "existing":
1218 provision_backend
= ExistingBackend(backend_type
,
1219 paths
=paths
, setup_path
=setup_path
,
1220 lp
=lp
, credentials
=credentials
,
1223 elif backend_type
== "fedora-ds":
1224 provision_backend
= FDSBackend(backend_type
,
1225 paths
=paths
, setup_path
=setup_path
,
1226 lp
=lp
, credentials
=credentials
,
1229 domainsid
=domainsid
,
1232 ldapadminpass
=ldapadminpass
,
1233 slapd_path
=slapd_path
,
1234 ldap_backend_extra_port
=ldap_backend_extra_port
,
1235 ldap_dryrun_mode
=ldap_dryrun_mode
,
1237 setup_ds_path
=setup_ds_path
)
1238 elif backend_type
== "openldap":
1239 provision_backend
= OpenLDAPBackend(backend_type
,
1240 paths
=paths
, setup_path
=setup_path
,
1241 lp
=lp
, credentials
=credentials
,
1244 domainsid
=domainsid
,
1247 ldapadminpass
=ldapadminpass
,
1248 slapd_path
=slapd_path
,
1249 ldap_backend_extra_port
=ldap_backend_extra_port
,
1250 ldap_dryrun_mode
=ldap_dryrun_mode
,
1251 ol_mmr_urls
=ol_mmr_urls
,
1254 raise ProvisioningError("Unknown LDAP backend type selected")
1256 provision_backend
.init()
1257 provision_backend
.start()
1259 # only install a new shares config db if there is none
1260 if not os
.path
.exists(paths
.shareconf
):
1261 message("Setting up share.ldb")
1262 share_ldb
= Ldb(paths
.shareconf
, session_info
=session_info
,
1264 share_ldb
.load_ldif_file_add(setup_path("share.ldif"))
1267 message("Setting up secrets.ldb")
1268 secrets_ldb
= setup_secretsdb(paths
.secrets
, setup_path
,
1269 session_info
=session_info
,
1270 backend_credentials
=provision_backend
.secrets_credentials
, lp
=lp
)
1272 message("Setting up the registry")
1273 setup_registry(paths
.hklm
, setup_path
, session_info
,
1276 message("Setting up the privileges database")
1277 setup_privileges(paths
.privilege
, setup_path
, session_info
, lp
=lp
)
1279 message("Setting up idmap db")
1280 idmap
= setup_idmapdb(paths
.idmapdb
, setup_path
, session_info
=session_info
,
1283 message("Setting up SAM db")
1284 samdb
= setup_samdb(paths
.samdb
, setup_path
, session_info
,
1285 provision_backend
, lp
, names
,
1287 domainsid
=domainsid
,
1288 schema
=schema
, domainguid
=domainguid
,
1289 policyguid
=policyguid
, policyguid_dc
=policyguid_dc
,
1291 adminpass
=adminpass
, krbtgtpass
=krbtgtpass
,
1292 invocationid
=invocationid
,
1293 machinepass
=machinepass
, dnspass
=dnspass
,
1294 ntdsguid
=ntdsguid
, serverrole
=serverrole
,
1295 dom_for_fun_level
=dom_for_fun_level
)
1297 if serverrole
== "domain controller":
1298 if paths
.netlogon
is None:
1299 message("Existing smb.conf does not have a [netlogon] share, but you are configuring a DC.")
1300 message("Please either remove %s or see the template at %s" %
1301 ( paths
.smbconf
, setup_path("provision.smb.conf.dc")))
1302 assert(paths
.netlogon
is not None)
1304 if paths
.sysvol
is None:
1305 message("Existing smb.conf does not have a [sysvol] share, but you are configuring a DC.")
1306 message("Please either remove %s or see the template at %s" %
1307 (paths
.smbconf
, setup_path("provision.smb.conf.dc")))
1308 assert(paths
.sysvol
is not None)
1311 if not os
.path
.isdir(paths
.netlogon
):
1312 os
.makedirs(paths
.netlogon
, 0755)
1314 if samdb_fill
== FILL_FULL
:
1315 setup_name_mappings(samdb
, idmap
, str(domainsid
), names
.domaindn
,
1316 root_uid
=root_uid
, nobody_uid
=nobody_uid
,
1317 users_gid
=users_gid
, wheel_gid
=wheel_gid
)
1319 setup_gpo(paths
,names
,samdb
,policyguid
,policyguid_dc
,domainsid
)
1322 setdiracl(samdb
,names
,paths
.netlogon
,paths
.sysvol
,wheel_gid
,domainsid
)
1323 # Set up group policies (domain policy and domain controller policy)
1325 message("Setting up sam.ldb rootDSE marking as synchronized")
1326 setup_modify_ldif(samdb
, setup_path("provision_rootdse_modify.ldif"))
1328 secretsdb_self_join(secrets_ldb
, domain
=names
.domain
,
1330 dnsdomain
=names
.dnsdomain
,
1331 netbiosname
=names
.netbiosname
,
1332 domainsid
=domainsid
,
1333 machinepass
=machinepass
,
1334 secure_channel_type
=SEC_CHAN_BDC
)
1336 if serverrole
== "domain controller":
1337 secretsdb_setup_dns(secrets_ldb
, setup_path
,
1338 realm
=names
.realm
, dnsdomain
=names
.dnsdomain
,
1339 dns_keytab_path
=paths
.dns_keytab
,
1342 domainguid
= samdb
.searchone(basedn
=domaindn
, attribute
="objectGUID")
1343 assert isinstance(domainguid
, str)
1345 # Only make a zone file on the first DC, it should be replicated
1346 # with DNS replication
1347 create_zone_file(paths
.dns
, setup_path
, dnsdomain
=names
.dnsdomain
,
1349 hostip6
=hostip6
, hostname
=names
.hostname
,
1351 domainguid
=domainguid
, ntdsguid
=names
.ntdsguid
)
1353 create_named_conf(paths
.namedconf
, setup_path
, realm
=names
.realm
,
1354 dnsdomain
=names
.dnsdomain
, private_dir
=paths
.private_dir
)
1356 create_named_txt(paths
.namedtxt
, setup_path
, realm
=names
.realm
,
1357 dnsdomain
=names
.dnsdomain
, private_dir
=paths
.private_dir
,
1358 keytab_name
=paths
.dns_keytab
)
1359 message("See %s for an example configuration include file for BIND" % paths
.namedconf
)
1360 message("and %s for further documentation required for secure DNS updates" % paths
.namedtxt
)
1362 create_krb5_conf(paths
.krb5conf
, setup_path
,
1363 dnsdomain
=names
.dnsdomain
, hostname
=names
.hostname
,
1365 message("A Kerberos configuration suitable for Samba 4 has been generated at %s" % paths
.krb5conf
)
1367 provision_backend
.post_setup()
1368 provision_backend
.shutdown()
1370 create_phpldapadmin_config(paths
.phpldapadminconfig
, setup_path
,
1373 #Now commit the secrets.ldb to disk
1374 secrets_ldb
.transaction_commit()
1376 message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths
.phpldapadminconfig
)
1378 message("Once the above files are installed, your Samba4 server will be ready to use")
1379 message("Server Role: %s" % serverrole
)
1380 message("Hostname: %s" % names
.hostname
)
1381 message("NetBIOS Domain: %s" % names
.domain
)
1382 message("DNS Domain: %s" % names
.dnsdomain
)
1383 message("DOMAIN SID: %s" % str(domainsid
))
1384 if samdb_fill
== FILL_FULL
:
1385 message("Admin password: %s" % adminpass
)
1386 if provision_backend
.type is not "ldb":
1387 if provision_backend
.credentials
.get_bind_dn() is not None:
1388 message("LDAP Backend Admin DN: %s" % provision_backend
.credentials
.get_bind_dn())
1390 message("LDAP Admin User: %s" % provision_backend
.credentials
.get_username())
1392 message("LDAP Admin Password: %s" % provision_backend
.credentials
.get_password())
1394 if provision_backend
.slapd_command_escaped
is not None:
1395 # now display slapd_command_file.txt to show how slapd must be started next time
1396 message("Use later the following commandline to start slapd, then Samba:")
1397 message(provision_backend
.slapd_command_escaped
)
1398 message("This slapd-Commandline is also stored under: " + paths
.ldapdir
+ "/ldap_backend_startup.sh")
1401 result
= ProvisionResult()
1402 result
.domaindn
= domaindn
1403 result
.paths
= paths
1405 result
.samdb
= samdb
1410 def provision_become_dc(setup_dir
=None,
1411 smbconf
=None, targetdir
=None, realm
=None,
1412 rootdn
=None, domaindn
=None, schemadn
=None,
1413 configdn
=None, serverdn
=None,
1414 domain
=None, hostname
=None, domainsid
=None,
1415 adminpass
=None, krbtgtpass
=None, domainguid
=None,
1416 policyguid
=None, policyguid_dc
=None, invocationid
=None,
1418 dnspass
=None, root
=None, nobody
=None, users
=None,
1419 wheel
=None, backup
=None, serverrole
=None,
1420 ldap_backend
=None, ldap_backend_type
=None,
1421 sitename
=None, debuglevel
=1):
1424 """print a message if quiet is not set."""
1427 glue
.set_debug_level(debuglevel
)
1429 return provision(setup_dir
, message
, system_session(), None,
1430 smbconf
=smbconf
, targetdir
=targetdir
, samdb_fill
=FILL_DRS
,
1431 realm
=realm
, rootdn
=rootdn
, domaindn
=domaindn
, schemadn
=schemadn
,
1432 configdn
=configdn
, serverdn
=serverdn
, domain
=domain
,
1433 hostname
=hostname
, hostip
="127.0.0.1", domainsid
=domainsid
,
1434 machinepass
=machinepass
, serverrole
="domain controller",
1438 def create_phpldapadmin_config(path
, setup_path
, ldapi_uri
):
1439 """Create a PHP LDAP admin configuration file.
1441 :param path: Path to write the configuration to.
1442 :param setup_path: Function to generate setup paths.
1444 setup_file(setup_path("phpldapadmin-config.php"), path
,
1445 {"S4_LDAPI_URI": ldapi_uri
})
1448 def create_zone_file(path
, setup_path
, dnsdomain
,
1449 hostip
, hostip6
, hostname
, realm
, domainguid
,
1451 """Write out a DNS zone file, from the info in the current database.
1453 :param path: Path of the new zone file.
1454 :param setup_path: Setup path function.
1455 :param dnsdomain: DNS Domain name
1456 :param domaindn: DN of the Domain
1457 :param hostip: Local IPv4 IP
1458 :param hostip6: Local IPv6 IP
1459 :param hostname: Local hostname
1460 :param realm: Realm name
1461 :param domainguid: GUID of the domain.
1462 :param ntdsguid: GUID of the hosts nTDSDSA record.
1464 assert isinstance(domainguid
, str)
1466 if hostip6
is not None:
1467 hostip6_base_line
= " IN AAAA " + hostip6
1468 hostip6_host_line
= hostname
+ " IN AAAA " + hostip6
1470 hostip6_base_line
= ""
1471 hostip6_host_line
= ""
1473 if hostip
is not None:
1474 hostip_base_line
= " IN A " + hostip
1475 hostip_host_line
= hostname
+ " IN A " + hostip
1477 hostip_base_line
= ""
1478 hostip_host_line
= ""
1480 setup_file(setup_path("provision.zone"), path
, {
1481 "HOSTNAME": hostname
,
1482 "DNSDOMAIN": dnsdomain
,
1484 "HOSTIP_BASE_LINE": hostip_base_line
,
1485 "HOSTIP_HOST_LINE": hostip_host_line
,
1486 "DOMAINGUID": domainguid
,
1487 "DATESTRING": time
.strftime("%Y%m%d%H"),
1488 "DEFAULTSITE": DEFAULTSITE
,
1489 "NTDSGUID": ntdsguid
,
1490 "HOSTIP6_BASE_LINE": hostip6_base_line
,
1491 "HOSTIP6_HOST_LINE": hostip6_host_line
,
1495 def create_named_conf(path
, setup_path
, realm
, dnsdomain
,
1497 """Write out a file containing zone statements suitable for inclusion in a
1498 named.conf file (including GSS-TSIG configuration).
1500 :param path: Path of the new named.conf file.
1501 :param setup_path: Setup path function.
1502 :param realm: Realm name
1503 :param dnsdomain: DNS Domain name
1504 :param private_dir: Path to private directory
1505 :param keytab_name: File name of DNS keytab file
1508 setup_file(setup_path("named.conf"), path
, {
1509 "DNSDOMAIN": dnsdomain
,
1511 "REALM_WC": "*." + ".".join(realm
.split(".")[1:]),
1512 "PRIVATE_DIR": private_dir
1515 def create_named_txt(path
, setup_path
, realm
, dnsdomain
,
1516 private_dir
, keytab_name
):
1517 """Write out a file containing zone statements suitable for inclusion in a
1518 named.conf file (including GSS-TSIG configuration).
1520 :param path: Path of the new named.conf file.
1521 :param setup_path: Setup path function.
1522 :param realm: Realm name
1523 :param dnsdomain: DNS Domain name
1524 :param private_dir: Path to private directory
1525 :param keytab_name: File name of DNS keytab file
1528 setup_file(setup_path("named.txt"), path
, {
1529 "DNSDOMAIN": dnsdomain
,
1531 "DNS_KEYTAB": keytab_name
,
1532 "DNS_KEYTAB_ABS": os
.path
.join(private_dir
, keytab_name
),
1533 "PRIVATE_DIR": private_dir
1536 def create_krb5_conf(path
, setup_path
, dnsdomain
, hostname
, realm
):
1537 """Write out a file containing zone statements suitable for inclusion in a
1538 named.conf file (including GSS-TSIG configuration).
1540 :param path: Path of the new named.conf file.
1541 :param setup_path: Setup path function.
1542 :param dnsdomain: DNS Domain name
1543 :param hostname: Local hostname
1544 :param realm: Realm name
1547 setup_file(setup_path("krb5.conf"), path
, {
1548 "DNSDOMAIN": dnsdomain
,
1549 "HOSTNAME": hostname
,