3 # Unix SMB/CIFS implementation.
4 # provision a Samba4 server
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
8 # Based on the original in EJS:
9 # Copyright (C) Andrew Tridgell 2005
11 # This program is free software; you can redistribute it and/or modify
12 # it under the terms of the GNU General Public License as published by
13 # the Free Software Foundation; either version 3 of the License, or
14 # (at your option) any later version.
16 # This program is distributed in the hope that it will be useful,
17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 # GNU General Public License for more details.
21 # You should have received a copy of the GNU General Public License
22 # along with this program. If not, see <http://www.gnu.org/licenses/>.
30 # Find right directory when running from source tree
31 sys
.path
.insert(0, "bin/python")
35 from samba
.credentials
import DONT_USE_KERBEROS
36 from samba
.auth
import system_session
37 import samba
.getopt
as options
38 from samba
.provision
import provision
, FILL_FULL
, FILL_NT4SYNC
, FILL_DRS
, find_setup_dir
40 # how do we make this case insensitive??
42 parser
= optparse
.OptionParser("provision [options]")
43 sambaopts
= options
.SambaOptions(parser
)
44 parser
.add_option_group(sambaopts
)
45 parser
.add_option_group(options
.VersionOptions(parser
))
46 credopts
= options
.CredentialsOptions(parser
)
47 parser
.add_option_group(credopts
)
48 parser
.add_option("--interactive", help="Ask for names", action
="store_true")
49 parser
.add_option("--setupdir", type="string", metavar
="DIR",
50 help="directory with setup files")
51 parser
.add_option("--realm", type="string", metavar
="REALM", help="set realm")
52 parser
.add_option("--domain", type="string", metavar
="DOMAIN",
54 parser
.add_option("--domain-guid", type="string", metavar
="GUID",
55 help="set domainguid (otherwise random)")
56 parser
.add_option("--domain-sid", type="string", metavar
="SID",
57 help="set domainsid (otherwise random)")
58 parser
.add_option("--policy-guid", type="string", metavar
="GUID",
59 help="set guid for domain policy")
60 parser
.add_option("--policy-guid-dc", type="string", metavar
="GUID",
61 help="set guid for domain controller policy")
62 parser
.add_option("--ntds-guid", type="string", metavar
="GUID",
63 help="set NTDS object GUID (otherwise random)")
64 parser
.add_option("--invocationid", type="string", metavar
="GUID",
65 help="set invocationid (otherwise random)")
66 parser
.add_option("--host-name", type="string", metavar
="HOSTNAME",
68 parser
.add_option("--host-ip", type="string", metavar
="IPADDRESS",
69 help="set IPv4 ipaddress")
70 parser
.add_option("--host-ip6", type="string", metavar
="IP6ADDRESS",
71 help="set IPv6 ipaddress")
72 parser
.add_option("--adminpass", type="string", metavar
="PASSWORD",
73 help="choose admin password (otherwise random)")
74 parser
.add_option("--krbtgtpass", type="string", metavar
="PASSWORD",
75 help="choose krbtgt password (otherwise random)")
76 parser
.add_option("--machinepass", type="string", metavar
="PASSWORD",
77 help="choose machine password (otherwise random)")
78 parser
.add_option("--dnspass", type="string", metavar
="PASSWORD",
79 help="choose dns password (otherwise random)")
80 parser
.add_option("--ldapadminpass", type="string", metavar
="PASSWORD",
81 help="choose password to set between Samba and it's LDAP backend (otherwise random)")
82 parser
.add_option("--root", type="string", metavar
="USERNAME",
83 help="choose 'root' unix username")
84 parser
.add_option("--nobody", type="string", metavar
="USERNAME",
85 help="choose 'nobody' user")
86 parser
.add_option("--wheel", type="string", metavar
="GROUPNAME",
87 help="choose 'wheel' privileged group")
88 parser
.add_option("--users", type="string", metavar
="GROUPNAME",
89 help="choose 'users' group")
90 parser
.add_option("--quiet", help="Be quiet", action
="store_true")
91 parser
.add_option("--blank", action
="store_true",
92 help="do not add users or groups, just the structure")
93 parser
.add_option("--ldap-backend-extra-port", type="int", metavar
="LDAP-BACKEND-EXTRA-PORT",
94 help="Additional TCP port for LDAP backend server (to use for replication)")
95 parser
.add_option("--ldap-backend-type", type="choice", metavar
="LDAP-BACKEND-TYPE",
96 help="LDAP backend type (fedora-ds or openldap)",
97 choices
=["fedora-ds", "openldap"])
98 parser
.add_option("--ldap-backend-nosync", help="Configure LDAP backend not to call fsync() (for performance in test environments)", action
="store_true")
99 parser
.add_option("--server-role", type="choice", metavar
="ROLE",
100 choices
=["domain controller", "dc", "member server", "member", "standalone"],
101 help="The server role (domain controller | dc | member server | member | standalone). Default is standalone.")
102 parser
.add_option("--function-level", type="choice", metavar
="FOR-FUN-LEVEL",
103 choices
=["2003", "2008", "2008_R2"],
104 help="The domain and forest function level (2003 | 2008 | 2008_R2). Default is (Windows) 2003 (Native).")
105 parser
.add_option("--partitions-only",
106 help="Configure Samba's partitions, but do not modify them (ie, join a BDC)", action
="store_true")
107 parser
.add_option("--targetdir", type="string", metavar
="DIR",
108 help="Set target directory")
109 parser
.add_option("--ol-mmr-urls", type="string", metavar
="LDAPSERVER",
110 help="List of LDAP-URLS [ ldap://<FQHN>:<PORT>/ (where <PORT> has to be different than 389!) ] separated with whitespaces for use with OpenLDAP-MMR (Multi-Master-Replication)")
111 parser
.add_option("--slapd-path", type="string", metavar
="SLAPD-PATH",
112 help="Path to slapd for LDAP backend [e.g.:'/usr/local/libexec/slapd']. Required for Setup with LDAP-Backend. OpenLDAP Version >= 2.4.17 should be used.")
113 parser
.add_option("--setup-ds-path", type="string", metavar
="SETUP_DS-PATH",
114 help="Path to setup-ds.pl script for Fedora DS LDAP backend [e.g.:'/usr/sbin/setup-ds.pl']. Required for Setup with Fedora DS backend.")
115 parser
.add_option("--nosync", help="Configure LDAP backend not to call fsync() (for performance in test environments)", action
="store_true")
116 parser
.add_option("--use-xattrs", type="choice", choices
=["yes","no","auto"], help="Define if we should use the native fs capabilities or a tdb file for storing attributes likes ntacl, auto tries to make an inteligent guess based on the user rights and system capabilities")
117 parser
.add_option("--ldap-dryrun-mode", help="Configure LDAP backend, but do not run any binaries and exit early. Used only for the test environment. DO NOT USE", action
="store_true")
119 opts
= parser
.parse_args()[0]
122 """print a message if quiet is not set."""
126 if len(sys
.argv
) == 1:
127 opts
.interactive
= True
130 from getpass
import getpass
132 def ask(prompt
, default
=None):
133 if default
is not None:
134 print "%s [%s]: " % (prompt
,default
),
136 print "%s: " % (prompt
,),
137 return sys
.stdin
.readline().rstrip("\n") or default
139 default
= socket
.getfqdn().split(".", 1)[1].upper()
142 opts
.realm
= ask("Realm", default
)
143 if opts
.realm
in (None, ""):
144 print >>sys
.stderr
, "No realm set!"
148 default
= opts
.realm
.split(".")[0]
151 opts
.domain
= ask("Domain", default
)
152 if opts
.domain
is None:
153 print >> sys
.stderr
, "No domain set!"
156 opts
.server_role
= ask("Server Role (dc, member, standalone)", "dc")
158 opts
.adminpass
= getpass("Administrator password: ")
159 if not opts
.adminpass
:
160 print >>sys
.stderr
, "Invalid administrator password."
164 if opts
.realm
is None or opts
.domain
is None:
165 if opts
.realm
is None:
166 print >>sys
.stderr
, "No realm set!"
167 if opts
.domain
is None:
168 print >> sys
.stderr
, "No domain set!"
172 if not opts
.adminpass
:
173 message("Administrator password will be set randomly!")
175 lp
= sambaopts
.get_loadparm()
176 smbconf
= lp
.configfile
178 if opts
.server_role
== "dc":
179 server_role
= "domain controller"
180 elif opts
.server_role
== "member":
181 server_role
= "member server"
183 server_role
= opts
.server_role
185 if opts
.function_level
is None:
186 dom_for_fun_level
= None
187 elif opts
.function_level
== "2003":
188 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2003
189 elif opts
.function_level
== "2008":
190 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2008
191 elif opts
.function_level
== "2008_R2":
192 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2008_R2
194 creds
= credopts
.get_credentials(lp
)
196 creds
.set_kerberos_state(DONT_USE_KERBEROS
)
198 setup_dir
= opts
.setupdir
199 if setup_dir
is None:
200 setup_dir
= find_setup_dir()
202 samdb_fill
= FILL_FULL
204 samdb_fill
= FILL_NT4SYNC
205 elif opts
.partitions_only
:
206 samdb_fill
= FILL_DRS
208 if not opts
.use_xattrs
:
209 opts
.use_xattrs
="auto"
212 if opts
.use_xattrs
== "yes":
214 elif opts
.use_xattrs
== "auto":
215 file=tempfile
.NamedTemporaryFile()
217 samba
.ntacls
.setntacl(lp
,file.name
,"O:S-1-5-32G:S-1-5-32","S-1-5-32","native")
220 if lp
.get("posix:eadb") == None:
221 message("Notice: you are not root or your system do not support xattr, tdb backend for attributes has been selected")
222 message(" if you intend to use this provision in production you'd better rerun the script as root on a system supporting xattr")
226 session
= system_session()
227 provision(setup_dir
, message
,
228 session
, creds
, smbconf
=smbconf
, targetdir
=opts
.targetdir
,
229 samdb_fill
=samdb_fill
, realm
=opts
.realm
, domain
=opts
.domain
,
230 domainguid
=opts
.domain_guid
, domainsid
=opts
.domain_sid
,
231 policyguid
=opts
.policy_guid
, policyguid_dc
=opts
.policy_guid_dc
,
232 hostname
=opts
.host_name
,
233 hostip
=opts
.host_ip
, hostip6
=opts
.host_ip6
,
234 ntdsguid
=opts
.ntds_guid
,
235 invocationid
=opts
.invocationid
, adminpass
=opts
.adminpass
,
236 krbtgtpass
=opts
.krbtgtpass
, machinepass
=opts
.machinepass
,
237 dnspass
=opts
.dnspass
, root
=opts
.root
, nobody
=opts
.nobody
,
238 wheel
=opts
.wheel
, users
=opts
.users
,
239 serverrole
=server_role
, dom_for_fun_level
=dom_for_fun_level
,
240 ldap_backend_extra_port
=opts
.ldap_backend_extra_port
,
241 backend_type
=opts
.ldap_backend_type
,
242 ldapadminpass
=opts
.ldapadminpass
, ol_mmr_urls
=opts
.ol_mmr_urls
,
243 slapd_path
=opts
.slapd_path
, setup_ds_path
=opts
.setup_ds_path
,
244 nosync
=opts
.nosync
,ldap_dryrun_mode
=opts
.ldap_dryrun_mode
,useeadb
=eadb
)