source4/setup/pwsettings

   1 #!/usr/bin/python
   2 #
   3 #       Sets password settings (Password complexity, history length,
   4 #       minimum password length, the minimum and maximum password age) on a
   5 #       Samba4 server
   6 #
   7 #       Copyright Jelmer Vernooij 2008
   8 #       Copyright Matthias Dieter Wallnoefer 2009
   9 #       Copyright Andrew Kroeger 2009
  10 #       Released under the GNU GPL version 3 or later
  11 #
  12 import os, sys
  13
  14 sys.path.insert(0, os.path.join(os.path.dirname(sys.argv[0]), "../bin/python"))
  15
  16 import samba.getopt as options
  17 import optparse
  18 import pwd
  19 import ldb
  20
  21 from samba.auth import system_session
  22 from samba.samdb import SamDB
  23 from samba.dcerpc.samr import DOMAIN_PASSWORD_COMPLEX
  24
  25 parser = optparse.OptionParser("pwsettings (show | set <options>)")
  26 sambaopts = options.SambaOptions(parser)
  27 parser.add_option_group(sambaopts)
  28 parser.add_option_group(options.VersionOptions(parser))
  29 credopts = options.CredentialsOptions(parser)
  30 parser.add_option_group(credopts)
  31 parser.add_option("--quiet", help="Be quiet", action="store_true")
  32 parser.add_option("-H", help="LDB URL for database or target server", type=str)
  33 parser.add_option("--complexity",
  34   help="The password complexity (on | off | default). Default is 'on'", type=str)
  35 parser.add_option("--history-length",
  36   help="The password history length (<integer> | default).  Default is 24.", type=str)
  37 parser.add_option("--min-pwd-length",
  38   help="The minimum password length (<integer> | default).  Default is 7.", type=str)
  39 parser.add_option("--min-pwd-age",
  40   help="The minimum password age (<integer in days> | default).  Default is 0.", type=str)
  41 parser.add_option("--max-pwd-age",
  42   help="The maximum password age (<integer in days> | default).  Default is 43.", type=str)
  43
  44 opts, args = parser.parse_args()
  45
  46 #
  47 #  print a message if quiet is not set
  48 #
  49 def message(text):
  50         if not opts.quiet:
  51                 print text
  52
  53 if len(args) == 0:
  54         parser.print_usage()
  55         sys.exit(1)
  56
  57 lp = sambaopts.get_loadparm()
  58
  59 creds = credopts.get_credentials(lp)
  60
  61 if opts.H is not None:
  62         url = opts.H
  63 else:
  64         url = lp.get("sam database")
  65
  66 samdb = SamDB(url=url, session_info=system_session(),
  67               credentials=creds, lp=lp)
  68
  69 domain_dn = SamDB.domain_dn(samdb)
  70 res = samdb.search(domain_dn, scope=ldb.SCOPE_BASE,
  71   attrs=["pwdProperties", "pwdHistoryLength", "minPwdLength", "minPwdAge",
  72   "maxPwdAge"])
  73 assert(len(res) == 1)
  74 try:
  75         pwd_props = int(res[0]["pwdProperties"][0])
  76         pwd_hist_len = int(res[0]["pwdHistoryLength"][0])
  77         min_pwd_len = int(res[0]["minPwdLength"][0])
  78         # ticks -> days
  79         min_pwd_age = int(abs(int(res[0]["minPwdAge"][0])) / (1e7 * 60 * 60 * 24))
  80         max_pwd_age = int(abs(int(res[0]["maxPwdAge"][0])) / (1e7 * 60 * 60 * 24))
  81 except:
  82         print "ERROR: Could not retrieve password properties!"
  83         if args[0] == "show":
  84                 print "So no settings can be displayed!"
  85         sys.exit(1)
  86
  87 if args[0] == "show":
  88         message("Password informations for domain '" + domain_dn + "'")
  89         message("")
  90         if pwd_props & DOMAIN_PASSWORD_COMPLEX != 0:
  91                 message("Password complexity: on")
  92         else:
  93                 message("Password complexity: off")
  94         message("Password history length: " + str(pwd_hist_len))
  95         message("Minimum password length: " + str(min_pwd_len))
  96         message("Minimum password age (days): " + str(min_pwd_age))
  97         message("Maximum password age (days): " + str(max_pwd_age))
  98
  99 elif args[0] == "set":
 100
 101         msgs = []
 102         m = ldb.Message()
 103         m.dn = ldb.Dn(samdb, domain_dn)
 104
 105         if opts.complexity is not None:
 106                 if opts.complexity == "on" or opts.complexity == "default":
 107                         pwd_props = pwd_props | DOMAIN_PASSWORD_COMPLEX
 108                         msgs.append("Password complexity activated!")
 109                 elif opts.complexity == "off":
 110                         pwd_props = pwd_props & (~DOMAIN_PASSWORD_COMPLEX)
 111                         msgs.append("Password complexity deactivated!")
 112                 else:
 113                         print "ERROR: Wrong argument '" + opts.complexity + "'!"
 114                         sys.exit(1)
 115
 116                 m["pwdProperties"] = ldb.MessageElement(str(pwd_props),
 117                   ldb.FLAG_MOD_REPLACE, "pwdProperties")
 118
 119         if opts.history_length is not None:
 120                 if opts.history_length == "default":
 121                         pwd_hist_len = 24
 122                 else:
 123                         pwd_hist_len = int(opts.history_length)
 124
 125                 if pwd_hist_len < 0 or pwd_hist_len > 24:
 126                         print "ERROR: Password history length must be in the range of 0 to 24!"
 127                         sys.exit(1)
 128
 129                 m["pwdHistoryLength"] = ldb.MessageElement(str(pwd_hist_len),
 130                   ldb.FLAG_MOD_REPLACE, "pwdHistoryLength")
 131                 msgs.append("Password history length changed!")
 132
 133         if opts.min_pwd_length is not None:
 134                 if opts.min_pwd_length == "default":
 135                         min_pwd_len = 7
 136                 else:
 137                         min_pwd_len = int(opts.min_pwd_length)
 138
 139                 if min_pwd_len < 0 or min_pwd_len > 14:
 140                         print "ERROR: Minimum password length must be in the range of 0 to 14!"
 141                         sys.exit(1)
 142
 143                 m["minPwdLength"] = ldb.MessageElement(str(min_pwd_len),
 144                   ldb.FLAG_MOD_REPLACE, "minPwdLength")
 145                 msgs.append("Minimum password length changed!")
 146
 147         if opts.min_pwd_age is not None:
 148                 if opts.min_pwd_age == "default":
 149                         min_pwd_age = 0
 150                 else:
 151                         min_pwd_age = int(opts.min_pwd_age)
 152
 153                 if min_pwd_age < 0 or min_pwd_age > 998:
 154                         print "ERROR: Minimum password age must be in the range of 0 to 998!"
 155                         sys.exit(1)
 156
 157                 # days -> ticks
 158                 min_pwd_age_ticks = -int(min_pwd_age * (24 * 60 * 60 * 1e7))
 159
 160                 m["minPwdAge"] = ldb.MessageElement(str(min_pwd_age_ticks),
 161                   ldb.FLAG_MOD_REPLACE, "minPwdAge")
 162                 msgs.append("Minimum password age changed!")
 163
 164         if opts.max_pwd_age is not None:
 165                 if opts.max_pwd_age == "default":
 166                         max_pwd_age = 43
 167                 else:
 168                         max_pwd_age = int(opts.max_pwd_age)
 169
 170                 if max_pwd_age < 0 or max_pwd_age > 999:
 171                         print "ERROR: Maximum password age must be in the range of 0 to 999!"
 172                         sys.exit(1)
 173
 174                 # days -> ticks
 175                 max_pwd_age_ticks = -int(max_pwd_age * (24 * 60 * 60 * 1e7))
 176
 177                 m["maxPwdAge"] = ldb.MessageElement(str(max_pwd_age_ticks),
 178                   ldb.FLAG_MOD_REPLACE, "maxPwdAge")
 179                 msgs.append("Maximum password age changed!")
 180
 181         if max_pwd_age > 0 and min_pwd_age >= max_pwd_age:
 182                 print "ERROR: Maximum password age (%d) must be greater than minimum password age (%d)!" % (max_pwd_age, min_pwd_age)
 183                 sys.exit(1)
 184
 185         samdb.modify(m)
 186
 187         msgs.append("All changes applied successfully!")
 188
 189         message("\n".join(msgs))
 190 else:
 191         print "ERROR: Wrong argument '" + args[0] + "'!"
 192         sys.exit(1)