2 Samba Unix/Linux SMB client library
4 Copyright (C) 2001 Andrew Tridgell (tridge@samba.org)
5 Copyright (C) 2001 Remus Koos (remuskoos@yahoo.com)
6 Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
7 Copyright (C) 2006 Gerald (Jerry) Carter (jerry@samba.org)
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 #include "utils/net.h"
29 int net_ads_usage(int argc
, const char **argv
)
31 d_printf("join [createupn[=principal]] [createcomputer=<org_unit>]\n");
32 d_printf(" Join the local machine to a ADS realm\n");
34 d_printf(" Remove the local machine from a ADS realm\n");
35 d_printf("testjoin\n");
36 d_printf(" Validates the machine account in the domain\n");
38 d_printf(" List, add, or delete users in the realm\n");
40 d_printf(" List, add, or delete groups in the realm\n");
42 d_printf(" Displays details regarding a specific AD server\n");
44 d_printf(" Display details regarding the machine's account in AD\n");
46 d_printf(" Performs CLDAP query of AD domain controllers\n");
47 d_printf("password <username@realm> <password> -Uadmin_username@realm%%admin_pass\n");
48 d_printf(" Change a user's password using an admin account\n");
49 d_printf(" (note: use realm in UPPERCASE, prompts if password is obmitted)\n");
50 d_printf("changetrustpw\n");
51 d_printf(" Change the trust account password of this machine in the AD tree\n");
52 d_printf("printer [info | publish | remove] <printername> <servername>\n");
53 d_printf(" Lookup, add, or remove directory entry for a printer\n");
54 d_printf("{search,dn,sid}\n");
55 d_printf(" Issue LDAP search queries using a general filter, by DN, or by SID\n");
57 d_printf(" Manage a local keytab file based on the machine account in AD\n");
59 d_printf(" Issue a dynamic DNS update request the server's hostname\n");
60 d_printf(" (using the machine credentials)\n");
65 /* when we do not have sufficient input parameters to contact a remote domain
66 * we always fall back to our own realm - Guenther*/
68 static const char *assume_own_realm(void)
70 if (!opt_host
&& strequal(lp_workgroup(), opt_target_workgroup
)) {
78 do a cldap netlogon query
80 static int net_ads_cldap_netlogon(ADS_STRUCT
*ads
)
82 struct cldap_netlogon_reply reply
;
84 if ( !ads_cldap_netlogon( inet_ntoa(ads
->ldap_ip
), ads
->server
.realm
, &reply
) ) {
85 d_fprintf(stderr
, "CLDAP query failed!\n");
89 d_printf("Information for Domain Controller: %s\n\n",
90 inet_ntoa(ads
->ldap_ip
));
92 d_printf("Response Type: ");
94 case SAMLOGON_AD_UNK_R
:
95 d_printf("SAMLOGON\n");
98 d_printf("SAMLOGON_USER\n");
101 d_printf("0x%x\n", reply
.type
);
104 d_printf("GUID: %s\n",
105 smb_uuid_string_static(smb_uuid_unpack_static(reply
.guid
)));
108 "\tIs a GC of the forest: %s\n"
109 "\tIs an LDAP server: %s\n"
110 "\tSupports DS: %s\n"
111 "\tIs running a KDC: %s\n"
112 "\tIs running time services: %s\n"
113 "\tIs the closest DC: %s\n"
114 "\tIs writable: %s\n"
115 "\tHas a hardware clock: %s\n"
116 "\tIs a non-domain NC serviced by LDAP server: %s\n",
117 (reply
.flags
& ADS_PDC
) ? "yes" : "no",
118 (reply
.flags
& ADS_GC
) ? "yes" : "no",
119 (reply
.flags
& ADS_LDAP
) ? "yes" : "no",
120 (reply
.flags
& ADS_DS
) ? "yes" : "no",
121 (reply
.flags
& ADS_KDC
) ? "yes" : "no",
122 (reply
.flags
& ADS_TIMESERV
) ? "yes" : "no",
123 (reply
.flags
& ADS_CLOSEST
) ? "yes" : "no",
124 (reply
.flags
& ADS_WRITABLE
) ? "yes" : "no",
125 (reply
.flags
& ADS_GOOD_TIMESERV
) ? "yes" : "no",
126 (reply
.flags
& ADS_NDNC
) ? "yes" : "no");
128 printf("Forest:\t\t\t%s\n", reply
.forest
);
129 printf("Domain:\t\t\t%s\n", reply
.domain
);
130 printf("Domain Controller:\t%s\n", reply
.hostname
);
132 printf("Pre-Win2k Domain:\t%s\n", reply
.netbios_domain
);
133 printf("Pre-Win2k Hostname:\t%s\n", reply
.netbios_hostname
);
135 if (*reply
.unk
) printf("Unk:\t\t\t%s\n", reply
.unk
);
136 if (*reply
.user_name
) printf("User name:\t%s\n", reply
.user_name
);
138 printf("Server Site Name :\t\t%s\n", reply
.server_site_name
);
139 printf("Client Site Name :\t\t%s\n", reply
.client_site_name
);
141 d_printf("NT Version: %d\n", reply
.version
);
142 d_printf("LMNT Token: %.2x\n", reply
.lmnt_token
);
143 d_printf("LM20 Token: %.2x\n", reply
.lm20_token
);
150 this implements the CLDAP based netlogon lookup requests
151 for finding the domain controller of a ADS domain
153 static int net_ads_lookup(int argc
, const char **argv
)
157 if (!ADS_ERR_OK(ads_startup_nobind(False
, &ads
))) {
158 d_fprintf(stderr
, "Didn't find the cldap server!\n");
162 if (!ads
->config
.realm
) {
163 ads
->config
.realm
= CONST_DISCARD(char *, opt_target_workgroup
);
164 ads
->ldap_port
= 389;
167 return net_ads_cldap_netlogon(ads
);
172 static int net_ads_info(int argc
, const char **argv
)
176 if (!ADS_ERR_OK(ads_startup_nobind(False
, &ads
))) {
177 d_fprintf(stderr
, "Didn't find the ldap server!\n");
181 if (!ads
|| !ads
->config
.realm
) {
182 d_fprintf(stderr
, "Didn't find the ldap server!\n");
186 /* Try to set the server's current time since we didn't do a full
187 TCP LDAP session initially */
189 if ( !ADS_ERR_OK(ads_current_time( ads
)) ) {
190 d_fprintf( stderr
, "Failed to get server's current time!\n");
193 d_printf("LDAP server: %s\n", inet_ntoa(ads
->ldap_ip
));
194 d_printf("LDAP server name: %s\n", ads
->config
.ldap_server_name
);
195 d_printf("Realm: %s\n", ads
->config
.realm
);
196 d_printf("Bind Path: %s\n", ads
->config
.bind_path
);
197 d_printf("LDAP port: %d\n", ads
->ldap_port
);
198 d_printf("Server time: %s\n", http_timestring(ads
->config
.current_time
));
200 d_printf("KDC server: %s\n", ads
->auth
.kdc_server
);
201 d_printf("Server time offset: %d\n", ads
->auth
.time_offset
);
206 static void use_in_memory_ccache(void) {
207 /* Use in-memory credentials cache so we do not interfere with
208 * existing credentials */
209 setenv(KRB5_ENV_CCNAME
, "MEMORY:net_ads", 1);
212 static ADS_STATUS
ads_startup_int(BOOL only_own_domain
, uint32 auth_flags
, ADS_STRUCT
**ads_ret
)
214 ADS_STRUCT
*ads
= NULL
;
216 BOOL need_password
= False
;
217 BOOL second_time
= False
;
219 const char *realm
= NULL
;
220 BOOL tried_closest_dc
= False
;
222 /* lp_realm() should be handled by a command line param,
223 However, the join requires that realm be set in smb.conf
224 and compares our realm with the remote server's so this is
225 ok until someone needs more flexibility */
230 if (only_own_domain
) {
233 realm
= assume_own_realm();
236 ads
= ads_init(realm
, opt_target_workgroup
, opt_host
);
238 if (!opt_user_name
) {
239 opt_user_name
= "administrator";
242 if (opt_user_specified
) {
243 need_password
= True
;
247 if (!opt_password
&& need_password
&& !opt_machine_pass
) {
249 asprintf(&prompt
,"%s's password: ", opt_user_name
);
252 return ADS_ERROR(LDAP_NO_MEMORY
);
254 opt_password
= getpass(prompt
);
259 use_in_memory_ccache();
260 SAFE_FREE(ads
->auth
.password
);
261 ads
->auth
.password
= smb_xstrdup(opt_password
);
264 ads
->auth
.flags
|= auth_flags
;
265 SAFE_FREE(ads
->auth
.user_name
);
266 ads
->auth
.user_name
= smb_xstrdup(opt_user_name
);
269 * If the username is of the form "name@realm",
270 * extract the realm and convert to upper case.
271 * This is only used to establish the connection.
273 if ((cp
= strchr_m(ads
->auth
.user_name
, '@'))!=0) {
275 SAFE_FREE(ads
->auth
.realm
);
276 ads
->auth
.realm
= smb_xstrdup(cp
);
277 strupper_m(ads
->auth
.realm
);
280 status
= ads_connect(ads
);
282 if (!ADS_ERR_OK(status
)) {
284 if (NT_STATUS_EQUAL(ads_ntstatus(status
),
285 NT_STATUS_NO_LOGON_SERVERS
)) {
286 DEBUG(0,("ads_connect: %s\n", ads_errstr(status
)));
291 if (!need_password
&& !second_time
&& !(auth_flags
& ADS_AUTH_NO_BIND
)) {
292 need_password
= True
;
301 /* when contacting our own domain, make sure we use the closest DC.
302 * This is done by reconnecting to ADS because only the first call to
303 * ads_connect will give us our own sitename */
305 if ((only_own_domain
|| !opt_host
) && !tried_closest_dc
) {
307 tried_closest_dc
= True
; /* avoid loop */
309 if (!ads_closest_dc(ads
)) {
311 namecache_delete(ads
->server
.realm
, 0x1C);
312 namecache_delete(ads
->server
.workgroup
, 0x1C);
325 ADS_STATUS
ads_startup(BOOL only_own_domain
, ADS_STRUCT
**ads
)
327 return ads_startup_int(only_own_domain
, 0, ads
);
330 ADS_STATUS
ads_startup_nobind(BOOL only_own_domain
, ADS_STRUCT
**ads
)
332 return ads_startup_int(only_own_domain
, ADS_AUTH_NO_BIND
, ads
);
336 Check to see if connection can be made via ads.
337 ads_startup() stores the password in opt_password if it needs to so
338 that rpc or rap can use it without re-prompting.
340 static int net_ads_check_int(const char *realm
, const char *workgroup
, const char *host
)
345 if ( (ads
= ads_init( realm
, workgroup
, host
)) == NULL
) {
349 ads
->auth
.flags
|= ADS_AUTH_NO_BIND
;
351 status
= ads_connect(ads
);
352 if ( !ADS_ERR_OK(status
) ) {
360 int net_ads_check_our_domain(void)
362 return net_ads_check_int(lp_realm(), lp_workgroup(), NULL
);
365 int net_ads_check(void)
367 return net_ads_check_int(NULL
, opt_workgroup
, opt_host
);
370 determine the netbios workgroup name for a domain
372 static int net_ads_workgroup(int argc
, const char **argv
)
375 struct cldap_netlogon_reply reply
;
377 if (!ADS_ERR_OK(ads_startup_nobind(False
, &ads
))) {
378 d_fprintf(stderr
, "Didn't find the cldap server!\n");
382 if (!ads
->config
.realm
) {
383 ads
->config
.realm
= CONST_DISCARD(char *, opt_target_workgroup
);
384 ads
->ldap_port
= 389;
387 if ( !ads_cldap_netlogon( inet_ntoa(ads
->ldap_ip
), ads
->server
.realm
, &reply
) ) {
388 d_fprintf(stderr
, "CLDAP query failed!\n");
392 d_printf("Workgroup: %s\n", reply
.netbios_domain
);
401 static BOOL
usergrp_display(char *field
, void **values
, void *data_area
)
403 char **disp_fields
= (char **) data_area
;
405 if (!field
) { /* must be end of record */
406 if (disp_fields
[0]) {
407 if (!strchr_m(disp_fields
[0], '$')) {
409 d_printf("%-21.21s %s\n",
410 disp_fields
[0], disp_fields
[1]);
412 d_printf("%s\n", disp_fields
[0]);
415 SAFE_FREE(disp_fields
[0]);
416 SAFE_FREE(disp_fields
[1]);
419 if (!values
) /* must be new field, indicate string field */
421 if (StrCaseCmp(field
, "sAMAccountName") == 0) {
422 disp_fields
[0] = SMB_STRDUP((char *) values
[0]);
424 if (StrCaseCmp(field
, "description") == 0)
425 disp_fields
[1] = SMB_STRDUP((char *) values
[0]);
429 static int net_ads_user_usage(int argc
, const char **argv
)
431 return net_help_user(argc
, argv
);
434 static int ads_user_add(int argc
, const char **argv
)
439 LDAPMessage
*res
=NULL
;
443 if (argc
< 1) return net_ads_user_usage(argc
, argv
);
445 if (!ADS_ERR_OK(ads_startup(False
, &ads
))) {
449 status
= ads_find_user_acct(ads
, &res
, argv
[0]);
451 if (!ADS_ERR_OK(status
)) {
452 d_fprintf(stderr
, "ads_user_add: %s\n", ads_errstr(status
));
456 if (ads_count_replies(ads
, res
)) {
457 d_fprintf(stderr
, "ads_user_add: User %s already exists\n", argv
[0]);
462 ou_str
= SMB_STRDUP(opt_container
);
464 ou_str
= ads_default_ou_string(ads
, WELL_KNOWN_GUID_USERS
);
467 status
= ads_add_user_acct(ads
, argv
[0], ou_str
, opt_comment
);
469 if (!ADS_ERR_OK(status
)) {
470 d_fprintf(stderr
, "Could not add user %s: %s\n", argv
[0],
475 /* if no password is to be set, we're done */
477 d_printf("User %s added\n", argv
[0]);
482 /* try setting the password */
483 asprintf(&upn
, "%s@%s", argv
[0], ads
->config
.realm
);
484 status
= ads_krb5_set_password(ads
->auth
.kdc_server
, upn
, argv
[1],
485 ads
->auth
.time_offset
);
487 if (ADS_ERR_OK(status
)) {
488 d_printf("User %s added\n", argv
[0]);
493 /* password didn't set, delete account */
494 d_fprintf(stderr
, "Could not add user %s. Error setting password %s\n",
495 argv
[0], ads_errstr(status
));
496 ads_msgfree(ads
, res
);
497 status
=ads_find_user_acct(ads
, &res
, argv
[0]);
498 if (ADS_ERR_OK(status
)) {
499 userdn
= ads_get_dn(ads
, res
);
500 ads_del_dn(ads
, userdn
);
501 ads_memfree(ads
, userdn
);
506 ads_msgfree(ads
, res
);
512 static int ads_user_info(int argc
, const char **argv
)
517 const char *attrs
[] = {"memberOf", NULL
};
518 char *searchstring
=NULL
;
523 return net_ads_user_usage(argc
, argv
);
526 escaped_user
= escape_ldap_string_alloc(argv
[0]);
529 d_fprintf(stderr
, "ads_user_info: failed to escape user %s\n", argv
[0]);
533 if (!ADS_ERR_OK(ads_startup(False
, &ads
))) {
534 SAFE_FREE(escaped_user
);
538 asprintf(&searchstring
, "(sAMAccountName=%s)", escaped_user
);
539 rc
= ads_search(ads
, &res
, searchstring
, attrs
);
540 safe_free(searchstring
);
542 if (!ADS_ERR_OK(rc
)) {
543 d_fprintf(stderr
, "ads_search: %s\n", ads_errstr(rc
));
545 SAFE_FREE(escaped_user
);
549 grouplist
= ldap_get_values((LDAP
*)ads
->ld
,
550 (LDAPMessage
*)res
, "memberOf");
555 for (i
=0;grouplist
[i
];i
++) {
556 groupname
= ldap_explode_dn(grouplist
[i
], 1);
557 d_printf("%s\n", groupname
[0]);
558 ldap_value_free(groupname
);
560 ldap_value_free(grouplist
);
563 ads_msgfree(ads
, res
);
565 SAFE_FREE(escaped_user
);
569 static int ads_user_delete(int argc
, const char **argv
)
573 LDAPMessage
*res
= NULL
;
577 return net_ads_user_usage(argc
, argv
);
580 if (!ADS_ERR_OK(ads_startup(False
, &ads
))) {
584 rc
= ads_find_user_acct(ads
, &res
, argv
[0]);
585 if (!ADS_ERR_OK(rc
) || ads_count_replies(ads
, res
) != 1) {
586 d_printf("User %s does not exist.\n", argv
[0]);
587 ads_msgfree(ads
, res
);
591 userdn
= ads_get_dn(ads
, res
);
592 ads_msgfree(ads
, res
);
593 rc
= ads_del_dn(ads
, userdn
);
594 ads_memfree(ads
, userdn
);
595 if (ADS_ERR_OK(rc
)) {
596 d_printf("User %s deleted\n", argv
[0]);
600 d_fprintf(stderr
, "Error deleting user %s: %s\n", argv
[0],
606 int net_ads_user(int argc
, const char **argv
)
608 struct functable func
[] = {
609 {"ADD", ads_user_add
},
610 {"INFO", ads_user_info
},
611 {"DELETE", ads_user_delete
},
616 const char *shortattrs
[] = {"sAMAccountName", NULL
};
617 const char *longattrs
[] = {"sAMAccountName", "description", NULL
};
618 char *disp_fields
[2] = {NULL
, NULL
};
621 if (!ADS_ERR_OK(ads_startup(False
, &ads
))) {
625 if (opt_long_list_entries
)
626 d_printf("\nUser name Comment"\
627 "\n-----------------------------\n");
629 rc
= ads_do_search_all_fn(ads
, ads
->config
.bind_path
,
631 "(objectCategory=user)",
632 opt_long_list_entries
? longattrs
:
633 shortattrs
, usergrp_display
,
636 return ADS_ERR_OK(rc
) ? 0 : -1;
639 return net_run_function(argc
, argv
, func
, net_ads_user_usage
);
642 static int net_ads_group_usage(int argc
, const char **argv
)
644 return net_help_group(argc
, argv
);
647 static int ads_group_add(int argc
, const char **argv
)
651 LDAPMessage
*res
=NULL
;
656 return net_ads_group_usage(argc
, argv
);
659 if (!ADS_ERR_OK(ads_startup(False
, &ads
))) {
663 status
= ads_find_user_acct(ads
, &res
, argv
[0]);
665 if (!ADS_ERR_OK(status
)) {
666 d_fprintf(stderr
, "ads_group_add: %s\n", ads_errstr(status
));
670 if (ads_count_replies(ads
, res
)) {
671 d_fprintf(stderr
, "ads_group_add: Group %s already exists\n", argv
[0]);
676 ou_str
= SMB_STRDUP(opt_container
);
678 ou_str
= ads_default_ou_string(ads
, WELL_KNOWN_GUID_USERS
);
681 status
= ads_add_group_acct(ads
, argv
[0], ou_str
, opt_comment
);
683 if (ADS_ERR_OK(status
)) {
684 d_printf("Group %s added\n", argv
[0]);
687 d_fprintf(stderr
, "Could not add group %s: %s\n", argv
[0],
693 ads_msgfree(ads
, res
);
699 static int ads_group_delete(int argc
, const char **argv
)
703 LDAPMessage
*res
= NULL
;
707 return net_ads_group_usage(argc
, argv
);
710 if (!ADS_ERR_OK(ads_startup(False
, &ads
))) {
714 rc
= ads_find_user_acct(ads
, &res
, argv
[0]);
715 if (!ADS_ERR_OK(rc
) || ads_count_replies(ads
, res
) != 1) {
716 d_printf("Group %s does not exist.\n", argv
[0]);
717 ads_msgfree(ads
, res
);
721 groupdn
= ads_get_dn(ads
, res
);
722 ads_msgfree(ads
, res
);
723 rc
= ads_del_dn(ads
, groupdn
);
724 ads_memfree(ads
, groupdn
);
725 if (ADS_ERR_OK(rc
)) {
726 d_printf("Group %s deleted\n", argv
[0]);
730 d_fprintf(stderr
, "Error deleting group %s: %s\n", argv
[0],
736 int net_ads_group(int argc
, const char **argv
)
738 struct functable func
[] = {
739 {"ADD", ads_group_add
},
740 {"DELETE", ads_group_delete
},
745 const char *shortattrs
[] = {"sAMAccountName", NULL
};
746 const char *longattrs
[] = {"sAMAccountName", "description", NULL
};
747 char *disp_fields
[2] = {NULL
, NULL
};
750 if (!ADS_ERR_OK(ads_startup(False
, &ads
))) {
754 if (opt_long_list_entries
)
755 d_printf("\nGroup name Comment"\
756 "\n-----------------------------\n");
757 rc
= ads_do_search_all_fn(ads
, ads
->config
.bind_path
,
759 "(objectCategory=group)",
760 opt_long_list_entries
? longattrs
:
761 shortattrs
, usergrp_display
,
765 return ADS_ERR_OK(rc
) ? 0 : -1;
767 return net_run_function(argc
, argv
, func
, net_ads_group_usage
);
770 static int net_ads_status(int argc
, const char **argv
)
776 if (!ADS_ERR_OK(ads_startup(True
, &ads
))) {
780 rc
= ads_find_machine_acct(ads
, &res
, global_myname());
781 if (!ADS_ERR_OK(rc
)) {
782 d_fprintf(stderr
, "ads_find_machine_acct: %s\n", ads_errstr(rc
));
787 if (ads_count_replies(ads
, res
) == 0) {
788 d_fprintf(stderr
, "No machine account for '%s' found\n", global_myname());
798 /*******************************************************************
799 Leave an AD domain. Windows XP disables the machine account.
800 We'll try the same. The old code would do an LDAP delete.
801 That only worked using the machine creds because added the machine
802 with full control to the computer object's ACL.
803 *******************************************************************/
805 static int net_ads_leave(int argc
, const char **argv
)
807 ADS_STRUCT
*ads
= NULL
;
811 struct cli_state
*cli
= NULL
;
813 DOM_SID
*dom_sid
= NULL
;
814 char *short_domain_name
= NULL
;
816 if (!secrets_init()) {
817 DEBUG(1,("Failed to initialise secrets database\n"));
821 if (!(ctx
= talloc_init("net_ads_leave"))) {
822 d_fprintf(stderr
, "Could not initialise talloc context.\n");
826 /* The finds a DC and takes care of getting the
827 user creds if necessary */
829 if (!ADS_ERR_OK(ads_startup(True
, &ads
))) {
833 /* make RPC calls here */
835 if ( !NT_STATUS_IS_OK(connect_to_ipc_krb5(&cli
, &ads
->ldap_ip
,
836 ads
->config
.ldap_server_name
)) )
841 if ( !NT_STATUS_IS_OK(netdom_get_domain_sid( ctx
, cli
, &short_domain_name
, &dom_sid
)) ) {
845 saf_delete( short_domain_name
);
847 status
= netdom_leave_domain(ctx
, cli
, dom_sid
);
849 /* Try and delete it via LDAP - the old way we used to. */
851 adsret
= ads_leave_realm(ads
, global_myname());
852 if (ADS_ERR_OK(adsret
)) {
853 d_printf("Deleted account for '%s' in realm '%s'\n",
854 global_myname(), ads
->config
.realm
);
857 /* We couldn't delete it - see if the disable succeeded. */
858 if (NT_STATUS_IS_OK(status
)) {
859 d_printf("Disabled account for '%s' in realm '%s'\n",
860 global_myname(), ads
->config
.realm
);
863 d_fprintf(stderr
, "Failed to disable machine account for '%s' in realm '%s'\n",
864 global_myname(), ads
->config
.realm
);
879 static NTSTATUS
net_ads_join_ok(void)
881 ADS_STRUCT
*ads
= NULL
;
884 if (!secrets_init()) {
885 DEBUG(1,("Failed to initialise secrets database\n"));
886 return NT_STATUS_ACCESS_DENIED
;
889 net_use_krb_machine_account();
891 status
= ads_startup(True
, &ads
);
892 if (!ADS_ERR_OK(status
)) {
893 return ads_ntstatus(status
);
901 check that an existing join is OK
903 int net_ads_testjoin(int argc
, const char **argv
)
906 use_in_memory_ccache();
908 /* Display success or failure */
909 status
= net_ads_join_ok();
910 if (!NT_STATUS_IS_OK(status
)) {
911 fprintf(stderr
,"Join to domain is not valid: %s\n",
912 get_friendly_nt_error_msg(status
));
916 printf("Join is OK\n");
920 /*******************************************************************
921 Simple configu checks before beginning the join
922 ********************************************************************/
924 static NTSTATUS
check_ads_config( void )
926 if (lp_server_role() != ROLE_DOMAIN_MEMBER
) {
927 d_printf("Host is not configured as a member server.\n");
928 return NT_STATUS_INVALID_DOMAIN_ROLE
;
931 if (strlen(global_myname()) > 15) {
932 d_printf("Our netbios name can be at most 15 chars long, "
933 "\"%s\" is %u chars long\n", global_myname(),
934 (unsigned int)strlen(global_myname()));
935 return NT_STATUS_NAME_TOO_LONG
;
938 if ( lp_security() == SEC_ADS
&& !*lp_realm()) {
939 d_fprintf(stderr
, "realm must be set in in %s for ADS "
940 "join to succeed.\n", dyn_CONFIGFILE
);
941 return NT_STATUS_INVALID_PARAMETER
;
944 if (!secrets_init()) {
945 DEBUG(1,("Failed to initialise secrets database\n"));
946 /* This is a good bet for failure of secrets_init ... */
947 return NT_STATUS_ACCESS_DENIED
;
953 /*******************************************************************
955 ********************************************************************/
957 static NTSTATUS
net_join_domain(TALLOC_CTX
*ctx
, const char *servername
,
958 struct in_addr
*ip
, char **domain
,
960 const char *password
)
962 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
963 struct cli_state
*cli
= NULL
;
965 ret
= connect_to_ipc_krb5(&cli
, ip
, servername
);
966 if ( !NT_STATUS_IS_OK(ret
) ) {
970 ret
= netdom_get_domain_sid( ctx
, cli
, domain
, dom_sid
);
971 if ( !NT_STATUS_IS_OK(ret
) ) {
975 /* cli->server_domain is not filled in when using krb5
978 saf_store( *domain
, cli
->desthost
);
980 ret
= netdom_join_domain( ctx
, cli
, *dom_sid
, password
, ND_TYPE_AD
);
989 /*******************************************************************
990 Set a machines dNSHostName and servicePrincipalName attributes
991 ********************************************************************/
993 static ADS_STATUS
net_set_machine_spn(TALLOC_CTX
*ctx
, ADS_STRUCT
*ads_s
)
995 ADS_STATUS status
= ADS_ERROR(LDAP_SERVER_DOWN
);
998 const char *servicePrincipalName
[3] = {NULL
, NULL
, NULL
};
1001 LDAPMessage
*res
= NULL
;
1002 char *dn_string
= NULL
;
1003 const char *machine_name
= global_myname();
1006 if ( !machine_name
) {
1007 return ADS_ERROR(LDAP_NO_MEMORY
);
1012 status
= ads_find_machine_acct(ads_s
, &res
, machine_name
);
1013 if (!ADS_ERR_OK(status
))
1016 if ( (count
= ads_count_replies(ads_s
, res
)) != 1 ) {
1017 DEBUG(1,("net_set_machine_spn: %d entries returned!\n", count
));
1018 return ADS_ERROR(LDAP_NO_MEMORY
);
1021 if ( (dn_string
= ads_get_dn(ads_s
, res
)) == NULL
) {
1022 DEBUG(1, ("ads_add_machine_acct: ads_get_dn returned NULL (malloc failure?)\n"));
1026 new_dn
= talloc_strdup(ctx
, dn_string
);
1027 ads_memfree(ads_s
, dn_string
);
1029 return ADS_ERROR(LDAP_NO_MEMORY
);
1032 /* Windows only creates HOST/shortname & HOST/fqdn. */
1034 if ( !(psp
= talloc_asprintf(ctx
, "HOST/%s", machine_name
)) )
1037 servicePrincipalName
[0] = psp
;
1039 name_to_fqdn(my_fqdn
, machine_name
);
1040 strlower_m(my_fqdn
);
1041 if ( !(psp
= talloc_asprintf(ctx
, "HOST/%s", my_fqdn
)) )
1043 servicePrincipalName
[1] = psp
;
1045 if (!(mods
= ads_init_mods(ctx
))) {
1049 /* fields of primary importance */
1051 ads_mod_str(ctx
, &mods
, "dNSHostName", my_fqdn
);
1052 ads_mod_strlist(ctx
, &mods
, "servicePrincipalName", servicePrincipalName
);
1054 status
= ads_gen_mod(ads_s
, new_dn
, mods
);
1057 ads_msgfree(ads_s
, res
);
1062 /*******************************************************************
1063 Set a machines dNSHostName and servicePrincipalName attributes
1064 ********************************************************************/
1066 static ADS_STATUS
net_set_machine_upn(TALLOC_CTX
*ctx
, ADS_STRUCT
*ads_s
, const char *upn
)
1068 ADS_STATUS status
= ADS_ERROR(LDAP_SERVER_DOWN
);
1071 LDAPMessage
*res
= NULL
;
1072 char *dn_string
= NULL
;
1073 const char *machine_name
= global_myname();
1076 if ( !machine_name
) {
1077 return ADS_ERROR(LDAP_NO_MEMORY
);
1082 status
= ads_find_machine_acct(ads_s
, &res
, machine_name
);
1083 if (!ADS_ERR_OK(status
))
1086 if ( (count
= ads_count_replies(ads_s
, res
)) != 1 ) {
1087 DEBUG(1,("net_set_machine_spn: %d entries returned!\n", count
));
1088 return ADS_ERROR(LDAP_NO_MEMORY
);
1091 if ( (dn_string
= ads_get_dn(ads_s
, res
)) == NULL
) {
1092 DEBUG(1, ("ads_add_machine_acct: ads_get_dn returned NULL (malloc failure?)\n"));
1096 new_dn
= talloc_strdup(ctx
, dn_string
);
1097 ads_memfree(ads_s
, dn_string
);
1099 return ADS_ERROR(LDAP_NO_MEMORY
);
1102 /* now do the mods */
1104 if (!(mods
= ads_init_mods(ctx
))) {
1108 /* fields of primary importance */
1110 ads_mod_str(ctx
, &mods
, "userPrincipalName", upn
);
1112 status
= ads_gen_mod(ads_s
, new_dn
, mods
);
1115 ads_msgfree(ads_s
, res
);
1120 /*******************************************************************
1121 Set a machines dNSHostName and servicePrincipalName attributes
1122 ********************************************************************/
1124 static ADS_STATUS
net_set_os_attributes(TALLOC_CTX
*ctx
, ADS_STRUCT
*ads_s
,
1125 const char *os_name
, const char *os_version
)
1127 ADS_STATUS status
= ADS_ERROR(LDAP_SERVER_DOWN
);
1130 LDAPMessage
*res
= NULL
;
1131 char *dn_string
= NULL
;
1132 const char *machine_name
= global_myname();
1136 if ( !os_name
|| !os_version
) {
1137 return ADS_ERROR(LDAP_NO_MEMORY
);
1142 status
= ads_find_machine_acct(ads_s
, &res
, machine_name
);
1143 if (!ADS_ERR_OK(status
))
1146 if ( (count
= ads_count_replies(ads_s
, res
)) != 1 ) {
1147 DEBUG(1,("net_set_machine_spn: %d entries returned!\n", count
));
1148 return ADS_ERROR(LDAP_NO_MEMORY
);
1151 if ( (dn_string
= ads_get_dn(ads_s
, res
)) == NULL
) {
1152 DEBUG(1, ("ads_add_machine_acct: ads_get_dn returned NULL (malloc failure?)\n"));
1156 new_dn
= talloc_strdup(ctx
, dn_string
);
1157 ads_memfree(ads_s
, dn_string
);
1159 return ADS_ERROR(LDAP_NO_MEMORY
);
1162 /* now do the mods */
1164 if (!(mods
= ads_init_mods(ctx
))) {
1168 os_sp
= talloc_asprintf( ctx
, "Samba %s", SAMBA_VERSION_STRING
);
1170 /* fields of primary importance */
1172 ads_mod_str(ctx
, &mods
, "operatingSystem", os_name
);
1173 ads_mod_str(ctx
, &mods
, "operatingSystemVersion", os_version
);
1175 ads_mod_str(ctx
, &mods
, "operatingSystemServicePack", os_sp
);
1177 status
= ads_gen_mod(ads_s
, new_dn
, mods
);
1180 ads_msgfree(ads_s
, res
);
1181 TALLOC_FREE( os_sp
);
1186 /*******************************************************************
1187 join a domain using ADS (LDAP mods)
1188 ********************************************************************/
1190 static ADS_STATUS
net_precreate_machine_acct( ADS_STRUCT
*ads
, const char *ou
)
1192 ADS_STATUS rc
= ADS_ERROR(LDAP_SERVER_DOWN
);
1194 LDAPMessage
*res
= NULL
;
1196 ou_str
= ads_ou_string(ads
, ou
);
1197 if ((asprintf(&dn
, "%s,%s", ou_str
, ads
->config
.bind_path
)) == -1) {
1199 return ADS_ERROR(LDAP_NO_MEMORY
);
1202 rc
= ads_search_dn(ads
, &res
, dn
, NULL
);
1203 ads_msgfree(ads
, res
);
1205 if (ADS_ERR_OK(rc
)) {
1206 /* Attempt to create the machine account and bail if this fails.
1207 Assume that the admin wants exactly what they requested */
1209 rc
= ads_create_machine_acct( ads
, global_myname(), dn
);
1210 if ( rc
.error_type
== ENUM_ADS_ERROR_LDAP
&& rc
.err
.rc
== LDAP_ALREADY_EXISTS
) {
1215 SAFE_FREE( ou_str
);
1221 /************************************************************************
1222 ************************************************************************/
1224 static BOOL
net_derive_salting_principal( TALLOC_CTX
*ctx
, ADS_STRUCT
*ads
)
1230 LDAPMessage
*res
= NULL
;
1231 const char *machine_name
= global_myname();
1233 status
= ads_domain_func_level( ads
, &domain_func
);
1234 if ( !ADS_ERR_OK(status
) ) {
1235 DEBUG(2,("Failed to determine domain functional level!\n"));
1239 /* go ahead and setup the default salt */
1241 if ( (std_salt
= kerberos_standard_des_salt()) == NULL
) {
1242 d_fprintf(stderr
, "net_derive_salting_principal: failed to obtain stanard DES salt\n");
1246 fstrcpy( salt
, std_salt
);
1247 SAFE_FREE( std_salt
);
1249 /* if it's a Windows functional domain, we have to look for the UPN */
1251 if ( domain_func
== DS_DOMAIN_FUNCTION_2000
) {
1255 status
= ads_find_machine_acct(ads
, &res
, machine_name
);
1256 if (!ADS_ERR_OK(status
)) {
1260 if ( (count
= ads_count_replies(ads
, res
)) != 1 ) {
1261 DEBUG(1,("net_set_machine_spn: %d entries returned!\n", count
));
1265 upn
= ads_pull_string(ads
, ctx
, res
, "userPrincipalName");
1267 fstrcpy( salt
, upn
);
1270 ads_msgfree(ads
, res
);
1273 return kerberos_secrets_store_des_salt( salt
);
1276 /*******************************************************************
1277 Send a DNS update request
1278 *******************************************************************/
1280 #if defined(WITH_DNS_UPDATES)
1282 DNS_ERROR
DoDNSUpdate(char *pszServerName
,
1283 const char *pszDomainName
,
1284 const char *pszHostName
,
1285 const struct in_addr
*iplist
, int num_addrs
);
1288 static NTSTATUS
net_update_dns_internal(TALLOC_CTX
*ctx
, ADS_STRUCT
*ads
,
1289 const char *machine_name
,
1290 const struct in_addr
*addrs
,
1293 struct dns_rr_ns
*nameservers
= NULL
;
1295 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
1298 const char *dnsdomain
= NULL
;
1299 char *root_domain
= NULL
;
1301 if ( (dnsdomain
= strchr_m( machine_name
, '.')) == NULL
) {
1302 d_printf("No DNS domain configured for %s. "
1303 "Unable to perform DNS Update.\n", machine_name
);
1304 status
= NT_STATUS_INVALID_PARAMETER
;
1309 status
= ads_dns_lookup_ns( ctx
, dnsdomain
, &nameservers
, &ns_count
);
1310 if ( !NT_STATUS_IS_OK(status
) || (ns_count
== 0)) {
1311 /* Child domains often do not have NS records. Look
1312 for the NS record for the forest root domain
1313 (rootDomainNamingContext in therootDSE) */
1315 const char *rootname_attrs
[] = { "rootDomainNamingContext", NULL
};
1316 LDAPMessage
*msg
= NULL
;
1318 ADS_STATUS ads_status
;
1321 ads_status
= ads_connect( ads
);
1322 if ( !ADS_ERR_OK(ads_status
) ) {
1323 DEBUG(0,("net_update_dns_internal: Failed to connect to our DC!\n"));
1328 ads_status
= ads_do_search(ads
, "", LDAP_SCOPE_BASE
,
1329 "(objectclass=*)", rootname_attrs
, &msg
);
1330 if (!ADS_ERR_OK(ads_status
)) {
1334 root_dn
= ads_pull_string(ads
, ctx
, msg
, "rootDomainNamingContext");
1336 ads_msgfree( ads
, msg
);
1340 root_domain
= ads_build_domain( root_dn
);
1343 ads_msgfree( ads
, msg
);
1345 /* try again for NS servers */
1347 status
= ads_dns_lookup_ns( ctx
, root_domain
, &nameservers
, &ns_count
);
1349 if ( !NT_STATUS_IS_OK(status
) || (ns_count
== 0)) {
1350 DEBUG(3,("net_ads_join: Failed to find name server for the %s "
1351 "realm\n", ads
->config
.realm
));
1355 dnsdomain
= root_domain
;
1359 /* Now perform the dns update - we'll try non-secure and if we fail,
1360 we'll follow it up with a secure update */
1362 fstrcpy( dns_server
, nameservers
[0].hostname
);
1364 dns_err
= DoDNSUpdate(dns_server
, dnsdomain
, machine_name
, addrs
, num_addrs
);
1365 if (!ERR_DNS_IS_OK(dns_err
)) {
1366 status
= NT_STATUS_UNSUCCESSFUL
;
1371 SAFE_FREE( root_domain
);
1376 static NTSTATUS
net_update_dns(TALLOC_CTX
*mem_ctx
, ADS_STRUCT
*ads
)
1379 struct in_addr
*iplist
= NULL
;
1380 fstring machine_name
;
1383 name_to_fqdn( machine_name
, global_myname() );
1384 strlower_m( machine_name
);
1386 /* Get our ip address (not the 127.0.0.x address but a real ip
1389 num_addrs
= get_my_ip_address( &iplist
);
1390 if ( num_addrs
<= 0 ) {
1391 DEBUG(4,("net_ads_join: Failed to find my non-loopback IP "
1393 return NT_STATUS_INVALID_PARAMETER
;
1396 status
= net_update_dns_internal(mem_ctx
, ads
, machine_name
,
1398 SAFE_FREE( iplist
);
1404 /*******************************************************************
1405 utility function to parse an integer parameter from
1407 **********************************************************/
1408 static char* get_string_param( const char* param
)
1412 if ( (p
= strchr( param
, '=' )) == NULL
)
1418 /*******************************************************************
1419 ********************************************************************/
1421 static int net_ads_join_usage(int argc
, const char **argv
)
1423 d_printf("net ads join [options]\n");
1424 d_printf("Valid options:\n");
1425 d_printf(" createupn[=UPN] Set the userPrincipalName attribute during the join.\n");
1426 d_printf(" The deault UPN is in the form host/netbiosname@REALM.\n");
1427 d_printf(" createcomputer=OU Precreate the computer account in a specific OU.\n");
1428 d_printf(" The OU string read from top to bottom without RDNs and delimited by a '/'.\n");
1429 d_printf(" E.g. \"createcomputer=Computers/Servers/Unix\"\n");
1430 d_printf(" NB: A backslash '\\' is used as escape at multiple levels and may\n");
1431 d_printf(" need to be doubled or even quadrupled. It is not used as a separator");
1436 /*******************************************************************
1437 ********************************************************************/
1439 int net_ads_join(int argc
, const char **argv
)
1441 ADS_STRUCT
*ads
= NULL
;
1444 char *machine_account
= NULL
;
1445 char *short_domain_name
= NULL
;
1446 char *tmp_password
, *password
;
1447 TALLOC_CTX
*ctx
= NULL
;
1448 DOM_SID
*domain_sid
= NULL
;
1449 BOOL createupn
= False
;
1450 const char *machineupn
= NULL
;
1451 const char *create_in_ou
= NULL
;
1454 struct in_addr dcip
;
1455 const char *os_name
= NULL
;
1456 const char *os_version
= NULL
;
1458 nt_status
= check_ads_config();
1459 if (!NT_STATUS_IS_OK(nt_status
)) {
1460 d_fprintf(stderr
, "Invalid configuration. Exiting....\n");
1464 /* find a DC to initialize the server affinity cache */
1466 get_dc_name( lp_workgroup(), lp_realm(), dc_name
, &dcip
);
1468 status
= ads_startup(True
, &ads
);
1469 if (!ADS_ERR_OK(status
)) {
1470 DEBUG(1, ("error on ads_startup: %s\n", ads_errstr(status
)));
1471 nt_status
= ads_ntstatus(status
);
1475 if (strcmp(ads
->config
.realm
, lp_realm()) != 0) {
1476 d_fprintf(stderr
, "realm of remote server (%s) and realm in %s "
1477 "(%s) DO NOT match. Aborting join\n", ads
->config
.realm
,
1478 dyn_CONFIGFILE
, lp_realm());
1479 nt_status
= NT_STATUS_INVALID_PARAMETER
;
1483 if (!(ctx
= talloc_init("net_ads_join"))) {
1484 d_fprintf(stderr
, "Could not initialise talloc context.\n");
1485 nt_status
= NT_STATUS_NO_MEMORY
;
1489 /* process additional command line args */
1491 for ( i
=0; i
<argc
; i
++ ) {
1492 if ( !StrnCaseCmp(argv
[i
], "createupn", strlen("createupn")) ) {
1494 machineupn
= get_string_param(argv
[i
]);
1496 else if ( !StrnCaseCmp(argv
[i
], "createcomputer", strlen("createcomputer")) ) {
1497 if ( (create_in_ou
= get_string_param(argv
[i
])) == NULL
) {
1498 d_fprintf(stderr
, "Please supply a valid OU path.\n");
1499 nt_status
= NT_STATUS_INVALID_PARAMETER
;
1503 else if ( !StrnCaseCmp(argv
[i
], "osName", strlen("osName")) ) {
1504 if ( (os_name
= get_string_param(argv
[i
])) == NULL
) {
1505 d_fprintf(stderr
, "Please supply a operating system name.\n");
1506 nt_status
= NT_STATUS_INVALID_PARAMETER
;
1510 else if ( !StrnCaseCmp(argv
[i
], "osVer", strlen("osVer")) ) {
1511 if ( (os_version
= get_string_param(argv
[i
])) == NULL
) {
1512 d_fprintf(stderr
, "Please supply a valid operating system version.\n");
1513 nt_status
= NT_STATUS_INVALID_PARAMETER
;
1518 d_fprintf(stderr
, "Bad option: %s\n", argv
[i
]);
1519 nt_status
= NT_STATUS_INVALID_PARAMETER
;
1524 /* If we were given an OU, try to create the machine in
1525 the OU account first and then do the normal RPC join */
1527 if ( create_in_ou
) {
1528 status
= net_precreate_machine_acct( ads
, create_in_ou
);
1529 if ( !ADS_ERR_OK(status
) ) {
1530 d_fprintf( stderr
, "Failed to pre-create the machine object "
1531 "in OU %s.\n", argv
[0]);
1532 DEBUG(1, ("error calling net_precreate_machine_acct: %s\n",
1533 ads_errstr(status
)));
1534 nt_status
= ads_ntstatus(status
);
1539 /* Do the domain join here */
1541 tmp_password
= generate_random_str(DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH
);
1542 password
= talloc_strdup(ctx
, tmp_password
);
1544 nt_status
= net_join_domain(ctx
, ads
->config
.ldap_server_name
,
1545 &ads
->ldap_ip
, &short_domain_name
, &domain_sid
, password
);
1546 if ( !NT_STATUS_IS_OK(nt_status
) ) {
1547 DEBUG(1, ("call of net_join_domain failed: %s\n",
1548 get_friendly_nt_error_msg(nt_status
)));
1552 /* Check the short name of the domain */
1554 if ( !strequal(lp_workgroup(), short_domain_name
) ) {
1555 d_printf("The workgroup in %s does not match the short\n", dyn_CONFIGFILE
);
1556 d_printf("domain name obtained from the server.\n");
1557 d_printf("Using the name [%s] from the server.\n", short_domain_name
);
1558 d_printf("You should set \"workgroup = %s\" in %s.\n",
1559 short_domain_name
, dyn_CONFIGFILE
);
1562 d_printf("Using short domain name -- %s\n", short_domain_name
);
1564 /* HACK ALERT! Store the sid and password under both the lp_workgroup()
1565 value from smb.conf and the string returned from the server. The former is
1566 neede to bootstrap winbindd's first connection to the DC to get the real
1567 short domain name --jerry */
1569 if ( (netdom_store_machine_account( lp_workgroup(), domain_sid
, password
) == -1)
1570 || (netdom_store_machine_account( short_domain_name
, domain_sid
, password
) == -1) )
1572 /* issue an internal error here for now.
1573 * everything else would mean changing tdb routines. */
1574 nt_status
= NT_STATUS_INTERNAL_ERROR
;
1578 saf_join_store(ads
->server
.workgroup
, ads
->config
.ldap_server_name
);
1579 saf_join_store(ads
->server
.realm
, ads
->config
.ldap_server_name
);
1581 /* Verify that everything is ok */
1583 if ( net_rpc_join_ok(short_domain_name
, ads
->config
.ldap_server_name
, &ads
->ldap_ip
) != 0 ) {
1584 d_fprintf(stderr
, "Failed to verify membership in domain!\n");
1588 /* create the dNSHostName & servicePrincipalName values */
1590 status
= net_set_machine_spn( ctx
, ads
);
1591 if ( !ADS_ERR_OK(status
) ) {
1593 d_fprintf(stderr
, "Failed to set servicePrincipalNames. Please ensure that\n");
1594 d_fprintf(stderr
, "the DNS domain of this server matches the AD domain,\n");
1595 d_fprintf(stderr
, "Or rejoin with using Domain Admin credentials.\n");
1597 /* Disable the machine account in AD. Better to fail than to leave
1598 a confused admin. */
1600 if ( net_ads_leave( 0, NULL
) != 0 ) {
1601 d_fprintf( stderr
, "Failed to disable machine account in AD. Please do so manually.\n");
1604 /* clear out the machine password */
1606 netdom_store_machine_account( lp_workgroup(), domain_sid
, "" );
1607 netdom_store_machine_account( short_domain_name
, domain_sid
, "" );
1609 nt_status
= ads_ntstatus(status
);
1613 if ( !net_derive_salting_principal( ctx
, ads
) ) {
1614 DEBUG(1,("Failed to determine salting principal\n"));
1621 /* default to using the short UPN name */
1622 if ( !machineupn
) {
1623 snprintf( upn
, sizeof(upn
), "host/%s@%s", global_myname(),
1624 ads
->config
.realm
);
1628 status
= net_set_machine_upn( ctx
, ads
, machineupn
);
1629 if ( !ADS_ERR_OK(status
) ) {
1630 d_fprintf(stderr
, "Failed to set userPrincipalName. Are you a Domain Admin?\n");
1634 /* Try to set the operatingSystem attributes if asked */
1636 if ( os_name
&& os_version
) {
1637 status
= net_set_os_attributes( ctx
, ads
, os_name
, os_version
);
1638 if ( !ADS_ERR_OK(status
) ) {
1639 d_fprintf(stderr
, "Failed to set operatingSystem attributes. "
1640 "Are you a Domain Admin?\n");
1644 /* Now build the keytab, using the same ADS connection */
1646 if (lp_use_kerberos_keytab() && ads_keytab_create_default(ads
)) {
1647 DEBUG(1,("Error creating host keytab!\n"));
1650 #if defined(WITH_DNS_UPDATES)
1651 /* We enter this block with user creds */
1652 ads_kdestroy( NULL
);
1656 if ( (ads
= ads_init( lp_realm(), NULL
, NULL
)) != NULL
) {
1657 /* kinit with the machine password */
1659 use_in_memory_ccache();
1660 asprintf( &ads
->auth
.user_name
, "%s$", global_myname() );
1661 ads
->auth
.password
= secrets_fetch_machine_password(
1662 lp_workgroup(), NULL
, NULL
);
1663 ads
->auth
.realm
= SMB_STRDUP( lp_realm() );
1664 ads_kinit_password( ads
);
1667 if ( !ads
|| !NT_STATUS_IS_OK(net_update_dns( ctx
, ads
)) ) {
1668 d_fprintf( stderr
, "DNS update failed!\n" );
1671 /* exit from this block using machine creds */
1674 d_printf("Joined '%s' to realm '%s'\n", global_myname(), ads
->server
.realm
);
1676 SAFE_FREE(machine_account
);
1683 /* issue an overall failure message at the end. */
1684 d_printf("Failed to join domain: %s\n", get_friendly_nt_error_msg(nt_status
));
1686 SAFE_FREE(machine_account
);
1694 /*******************************************************************
1695 ********************************************************************/
1697 static int net_ads_dns_usage(int argc
, const char **argv
)
1699 #if defined(WITH_DNS_UPDATES)
1700 d_printf("net ads dns <command>\n");
1701 d_printf("Valid commands:\n");
1702 d_printf(" register Issue a dynamic DNS update request for our hostname\n");
1706 d_fprintf(stderr
, "DNS update support not enabled at compile time!\n");
1711 /*******************************************************************
1712 ********************************************************************/
1714 static int net_ads_dns_register(int argc
, const char **argv
)
1716 #if defined(WITH_DNS_UPDATES)
1722 talloc_enable_leak_report();
1726 d_fprintf(stderr
, "net ads dns register\n");
1730 if (!(ctx
= talloc_init("net_ads_dns"))) {
1731 d_fprintf(stderr
, "Could not initialise talloc context\n");
1735 status
= ads_startup(True
, &ads
);
1736 if ( !ADS_ERR_OK(status
) ) {
1737 DEBUG(1, ("error on ads_startup: %s\n", ads_errstr(status
)));
1742 if ( !NT_STATUS_IS_OK(net_update_dns(ctx
, ads
)) ) {
1743 d_fprintf( stderr
, "DNS update failed!\n" );
1744 ads_destroy( &ads
);
1749 d_fprintf( stderr
, "Successfully registered hostname with DNS\n" );
1756 d_fprintf(stderr
, "DNS update support not enabled at compile time!\n");
1761 #if defined(WITH_DNS_UPDATES)
1762 DNS_ERROR
do_gethostbyname(const char *server
, const char *host
);
1765 static int net_ads_dns_gethostbyname(int argc
, const char **argv
)
1767 #if defined(WITH_DNS_UPDATES)
1771 talloc_enable_leak_report();
1775 d_fprintf(stderr
, "net ads dns gethostbyname <server> "
1780 err
= do_gethostbyname(argv
[0], argv
[1]);
1782 d_printf("do_gethostbyname returned %d\n", ERROR_DNS_V(err
));
1787 static int net_ads_dns(int argc
, const char *argv
[])
1789 struct functable func
[] = {
1790 {"REGISTER", net_ads_dns_register
},
1791 {"GETHOSTBYNAME", net_ads_dns_gethostbyname
},
1795 return net_run_function(argc
, argv
, func
, net_ads_dns_usage
);
1798 /*******************************************************************
1799 ********************************************************************/
1801 int net_ads_printer_usage(int argc
, const char **argv
)
1804 "\nnet ads printer search <printer>"
1805 "\n\tsearch for a printer in the directory\n"
1806 "\nnet ads printer info <printer> <server>"
1807 "\n\tlookup info in directory for printer on server"
1808 "\n\t(note: printer defaults to \"*\", server defaults to local)\n"
1809 "\nnet ads printer publish <printername>"
1810 "\n\tpublish printer in directory"
1811 "\n\t(note: printer name is required)\n"
1812 "\nnet ads printer remove <printername>"
1813 "\n\tremove printer from directory"
1814 "\n\t(note: printer name is required)\n");
1818 /*******************************************************************
1819 ********************************************************************/
1821 static int net_ads_printer_search(int argc
, const char **argv
)
1825 LDAPMessage
*res
= NULL
;
1827 if (!ADS_ERR_OK(ads_startup(False
, &ads
))) {
1831 rc
= ads_find_printers(ads
, &res
);
1833 if (!ADS_ERR_OK(rc
)) {
1834 d_fprintf(stderr
, "ads_find_printer: %s\n", ads_errstr(rc
));
1835 ads_msgfree(ads
, res
);
1840 if (ads_count_replies(ads
, res
) == 0) {
1841 d_fprintf(stderr
, "No results found\n");
1842 ads_msgfree(ads
, res
);
1848 ads_msgfree(ads
, res
);
1853 static int net_ads_printer_info(int argc
, const char **argv
)
1857 const char *servername
, *printername
;
1858 LDAPMessage
*res
= NULL
;
1860 if (!ADS_ERR_OK(ads_startup(False
, &ads
))) {
1865 printername
= argv
[0];
1871 servername
= argv
[1];
1873 servername
= global_myname();
1876 rc
= ads_find_printer_on_server(ads
, &res
, printername
, servername
);
1878 if (!ADS_ERR_OK(rc
)) {
1879 d_fprintf(stderr
, "Server '%s' not found: %s\n",
1880 servername
, ads_errstr(rc
));
1881 ads_msgfree(ads
, res
);
1886 if (ads_count_replies(ads
, res
) == 0) {
1887 d_fprintf(stderr
, "Printer '%s' not found\n", printername
);
1888 ads_msgfree(ads
, res
);
1894 ads_msgfree(ads
, res
);
1900 void do_drv_upgrade_printer(int msg_type
, struct process_id src
,
1901 void *buf
, size_t len
, void *private_data
)
1906 static int net_ads_printer_publish(int argc
, const char **argv
)
1910 const char *servername
, *printername
;
1911 struct cli_state
*cli
;
1912 struct rpc_pipe_client
*pipe_hnd
;
1913 struct in_addr server_ip
;
1915 TALLOC_CTX
*mem_ctx
= talloc_init("net_ads_printer_publish");
1916 ADS_MODLIST mods
= ads_init_mods(mem_ctx
);
1917 char *prt_dn
, *srv_dn
, **srv_cn
;
1918 char *srv_cn_escaped
= NULL
, *printername_escaped
= NULL
;
1919 LDAPMessage
*res
= NULL
;
1921 if (!ADS_ERR_OK(ads_startup(True
, &ads
))) {
1922 talloc_destroy(mem_ctx
);
1927 talloc_destroy(mem_ctx
);
1928 return net_ads_printer_usage(argc
, argv
);
1931 printername
= argv
[0];
1934 servername
= argv
[1];
1936 servername
= global_myname();
1939 /* Get printer data from SPOOLSS */
1941 resolve_name(servername
, &server_ip
, 0x20);
1943 nt_status
= cli_full_connection(&cli
, global_myname(), servername
,
1946 opt_user_name
, opt_workgroup
,
1947 opt_password
? opt_password
: "",
1948 CLI_FULL_CONNECTION_USE_KERBEROS
,
1951 if (NT_STATUS_IS_ERR(nt_status
)) {
1952 d_fprintf(stderr
, "Unable to open a connnection to %s to obtain data "
1953 "for %s\n", servername
, printername
);
1955 talloc_destroy(mem_ctx
);
1959 /* Publish on AD server */
1961 ads_find_machine_acct(ads
, &res
, servername
);
1963 if (ads_count_replies(ads
, res
) == 0) {
1964 d_fprintf(stderr
, "Could not find machine account for server %s\n",
1967 talloc_destroy(mem_ctx
);
1971 srv_dn
= ldap_get_dn((LDAP
*)ads
->ld
, (LDAPMessage
*)res
);
1972 srv_cn
= ldap_explode_dn(srv_dn
, 1);
1974 srv_cn_escaped
= escape_rdn_val_string_alloc(srv_cn
[0]);
1975 printername_escaped
= escape_rdn_val_string_alloc(printername
);
1976 if (!srv_cn_escaped
|| !printername_escaped
) {
1977 SAFE_FREE(srv_cn_escaped
);
1978 SAFE_FREE(printername_escaped
);
1979 d_fprintf(stderr
, "Internal error, out of memory!");
1981 talloc_destroy(mem_ctx
);
1985 asprintf(&prt_dn
, "cn=%s-%s,%s", srv_cn_escaped
, printername_escaped
, srv_dn
);
1987 SAFE_FREE(srv_cn_escaped
);
1988 SAFE_FREE(printername_escaped
);
1990 pipe_hnd
= cli_rpc_pipe_open_noauth(cli
, PI_SPOOLSS
, &nt_status
);
1992 d_fprintf(stderr
, "Unable to open a connnection to the spoolss pipe on %s\n",
1996 talloc_destroy(mem_ctx
);
2000 if (!W_ERROR_IS_OK(get_remote_printer_publishing_data(pipe_hnd
, mem_ctx
, &mods
,
2004 talloc_destroy(mem_ctx
);
2008 rc
= ads_add_printer_entry(ads
, prt_dn
, mem_ctx
, &mods
);
2009 if (!ADS_ERR_OK(rc
)) {
2010 d_fprintf(stderr
, "ads_publish_printer: %s\n", ads_errstr(rc
));
2013 talloc_destroy(mem_ctx
);
2017 d_printf("published printer\n");
2020 talloc_destroy(mem_ctx
);
2025 static int net_ads_printer_remove(int argc
, const char **argv
)
2029 const char *servername
;
2031 LDAPMessage
*res
= NULL
;
2033 if (!ADS_ERR_OK(ads_startup(True
, &ads
))) {
2038 return net_ads_printer_usage(argc
, argv
);
2042 servername
= argv
[1];
2044 servername
= global_myname();
2047 rc
= ads_find_printer_on_server(ads
, &res
, argv
[0], servername
);
2049 if (!ADS_ERR_OK(rc
)) {
2050 d_fprintf(stderr
, "ads_find_printer_on_server: %s\n", ads_errstr(rc
));
2051 ads_msgfree(ads
, res
);
2056 if (ads_count_replies(ads
, res
) == 0) {
2057 d_fprintf(stderr
, "Printer '%s' not found\n", argv
[1]);
2058 ads_msgfree(ads
, res
);
2063 prt_dn
= ads_get_dn(ads
, res
);
2064 ads_msgfree(ads
, res
);
2065 rc
= ads_del_dn(ads
, prt_dn
);
2066 ads_memfree(ads
, prt_dn
);
2068 if (!ADS_ERR_OK(rc
)) {
2069 d_fprintf(stderr
, "ads_del_dn: %s\n", ads_errstr(rc
));
2078 static int net_ads_printer(int argc
, const char **argv
)
2080 struct functable func
[] = {
2081 {"SEARCH", net_ads_printer_search
},
2082 {"INFO", net_ads_printer_info
},
2083 {"PUBLISH", net_ads_printer_publish
},
2084 {"REMOVE", net_ads_printer_remove
},
2088 return net_run_function(argc
, argv
, func
, net_ads_printer_usage
);
2092 static int net_ads_password(int argc
, const char **argv
)
2095 const char *auth_principal
= opt_user_name
;
2096 const char *auth_password
= opt_password
;
2098 char *new_password
= NULL
;
2103 if (opt_user_name
== NULL
|| opt_password
== NULL
) {
2104 d_fprintf(stderr
, "You must supply an administrator username/password\n");
2109 d_fprintf(stderr
, "ERROR: You must say which username to change password for\n");
2114 if (!strchr_m(user
, '@')) {
2115 asprintf(&c
, "%s@%s", argv
[0], lp_realm());
2119 use_in_memory_ccache();
2120 c
= strchr_m(auth_principal
, '@');
2127 /* use the realm so we can eventually change passwords for users
2128 in realms other than default */
2129 if (!(ads
= ads_init(realm
, opt_workgroup
, opt_host
))) {
2133 /* we don't actually need a full connect, but it's the easy way to
2134 fill in the KDC's addresss */
2137 if (!ads
|| !ads
->config
.realm
) {
2138 d_fprintf(stderr
, "Didn't find the kerberos server!\n");
2143 new_password
= (char *)argv
[1];
2145 asprintf(&prompt
, "Enter new password for %s:", user
);
2146 new_password
= getpass(prompt
);
2150 ret
= kerberos_set_password(ads
->auth
.kdc_server
, auth_principal
,
2151 auth_password
, user
, new_password
, ads
->auth
.time_offset
);
2152 if (!ADS_ERR_OK(ret
)) {
2153 d_fprintf(stderr
, "Password change failed: %s\n", ads_errstr(ret
));
2158 d_printf("Password change for %s completed.\n", user
);
2164 int net_ads_changetrustpw(int argc
, const char **argv
)
2167 char *host_principal
;
2171 if (!secrets_init()) {
2172 DEBUG(1,("Failed to initialise secrets database\n"));
2176 net_use_krb_machine_account();
2178 use_in_memory_ccache();
2180 if (!ADS_ERR_OK(ads_startup(True
, &ads
))) {
2184 fstrcpy(my_name
, global_myname());
2185 strlower_m(my_name
);
2186 asprintf(&host_principal
, "%s$@%s", my_name
, ads
->config
.realm
);
2187 d_printf("Changing password for principal: %s\n", host_principal
);
2189 ret
= ads_change_trust_account_password(ads
, host_principal
);
2191 if (!ADS_ERR_OK(ret
)) {
2192 d_fprintf(stderr
, "Password change failed: %s\n", ads_errstr(ret
));
2194 SAFE_FREE(host_principal
);
2198 d_printf("Password change for principal %s succeeded.\n", host_principal
);
2200 if (lp_use_kerberos_keytab()) {
2201 d_printf("Attempting to update system keytab with new password.\n");
2202 if (ads_keytab_create_default(ads
)) {
2203 d_printf("Failed to update system keytab.\n");
2208 SAFE_FREE(host_principal
);
2214 help for net ads search
2216 static int net_ads_search_usage(int argc
, const char **argv
)
2219 "\nnet ads search <expression> <attributes...>\n"\
2220 "\nperform a raw LDAP search on a ADS server and dump the results\n"\
2221 "The expression is a standard LDAP search expression, and the\n"\
2222 "attributes are a list of LDAP fields to show in the results\n\n"\
2223 "Example: net ads search '(objectCategory=group)' sAMAccountName\n\n"
2225 net_common_flags_usage(argc
, argv
);
2231 general ADS search function. Useful in diagnosing problems in ADS
2233 static int net_ads_search(int argc
, const char **argv
)
2237 const char *ldap_exp
;
2239 LDAPMessage
*res
= NULL
;
2242 return net_ads_search_usage(argc
, argv
);
2245 if (!ADS_ERR_OK(ads_startup(False
, &ads
))) {
2252 rc
= ads_do_search_all(ads
, ads
->config
.bind_path
,
2254 ldap_exp
, attrs
, &res
);
2255 if (!ADS_ERR_OK(rc
)) {
2256 d_fprintf(stderr
, "search failed: %s\n", ads_errstr(rc
));
2261 d_printf("Got %d replies\n\n", ads_count_replies(ads
, res
));
2263 /* dump the results */
2266 ads_msgfree(ads
, res
);
2274 help for net ads search
2276 static int net_ads_dn_usage(int argc
, const char **argv
)
2279 "\nnet ads dn <dn> <attributes...>\n"\
2280 "\nperform a raw LDAP search on a ADS server and dump the results\n"\
2281 "The DN standard LDAP DN, and the attributes are a list of LDAP fields \n"\
2282 "to show in the results\n\n"\
2283 "Example: net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' sAMAccountName\n\n"
2284 "Note: the DN must be provided properly escaped. See RFC 4514 for details\n\n"
2286 net_common_flags_usage(argc
, argv
);
2292 general ADS search function. Useful in diagnosing problems in ADS
2294 static int net_ads_dn(int argc
, const char **argv
)
2300 LDAPMessage
*res
= NULL
;
2303 return net_ads_dn_usage(argc
, argv
);
2306 if (!ADS_ERR_OK(ads_startup(False
, &ads
))) {
2313 rc
= ads_do_search_all(ads
, dn
,
2315 "(objectclass=*)", attrs
, &res
);
2316 if (!ADS_ERR_OK(rc
)) {
2317 d_fprintf(stderr
, "search failed: %s\n", ads_errstr(rc
));
2322 d_printf("Got %d replies\n\n", ads_count_replies(ads
, res
));
2324 /* dump the results */
2327 ads_msgfree(ads
, res
);
2334 help for net ads sid search
2336 static int net_ads_sid_usage(int argc
, const char **argv
)
2339 "\nnet ads sid <sid> <attributes...>\n"\
2340 "\nperform a raw LDAP search on a ADS server and dump the results\n"\
2341 "The SID is in string format, and the attributes are a list of LDAP fields \n"\
2342 "to show in the results\n\n"\
2343 "Example: net ads sid 'S-1-5-32' distinguishedName\n\n"
2345 net_common_flags_usage(argc
, argv
);
2351 general ADS search function. Useful in diagnosing problems in ADS
2353 static int net_ads_sid(int argc
, const char **argv
)
2357 const char *sid_string
;
2359 LDAPMessage
*res
= NULL
;
2363 return net_ads_sid_usage(argc
, argv
);
2366 if (!ADS_ERR_OK(ads_startup(False
, &ads
))) {
2370 sid_string
= argv
[0];
2373 if (!string_to_sid(&sid
, sid_string
)) {
2374 d_fprintf(stderr
, "could not convert sid\n");
2379 rc
= ads_search_retry_sid(ads
, &res
, &sid
, attrs
);
2380 if (!ADS_ERR_OK(rc
)) {
2381 d_fprintf(stderr
, "search failed: %s\n", ads_errstr(rc
));
2386 d_printf("Got %d replies\n\n", ads_count_replies(ads
, res
));
2388 /* dump the results */
2391 ads_msgfree(ads
, res
);
2398 static int net_ads_keytab_usage(int argc
, const char **argv
)
2401 "net ads keytab <COMMAND>\n"\
2402 "<COMMAND> can be either:\n"\
2403 " CREATE Creates a fresh keytab\n"\
2404 " ADD Adds new service principal\n"\
2405 " FLUSH Flushes out all keytab entries\n"\
2406 " HELP Prints this help message\n"\
2407 "The ADD command will take arguments, the other commands\n"\
2408 "will not take any arguments. The arguments given to ADD\n"\
2409 "should be a list of principals to add. For example, \n"\
2410 " net ads keytab add srv1 srv2\n"\
2411 "will add principals for the services srv1 and srv2 to the\n"\
2412 "system's keytab.\n"\
2418 static int net_ads_keytab_flush(int argc
, const char **argv
)
2423 if (!ADS_ERR_OK(ads_startup(True
, &ads
))) {
2426 ret
= ads_keytab_flush(ads
);
2431 static int net_ads_keytab_add(int argc
, const char **argv
)
2437 d_printf("Processing principals to add...\n");
2438 if (!ADS_ERR_OK(ads_startup(True
, &ads
))) {
2441 for (i
= 0; i
< argc
; i
++) {
2442 ret
|= ads_keytab_add_entry(ads
, argv
[i
]);
2448 static int net_ads_keytab_create(int argc
, const char **argv
)
2453 if (!ADS_ERR_OK(ads_startup(True
, &ads
))) {
2456 ret
= ads_keytab_create_default(ads
);
2461 int net_ads_keytab(int argc
, const char **argv
)
2463 struct functable func
[] = {
2464 {"CREATE", net_ads_keytab_create
},
2465 {"ADD", net_ads_keytab_add
},
2466 {"FLUSH", net_ads_keytab_flush
},
2467 {"HELP", net_ads_keytab_usage
},
2471 if (!lp_use_kerberos_keytab()) {
2472 d_printf("\nWarning: \"use kerberos keytab\" must be set to \"true\" in order to \
2473 use keytab functions.\n");
2476 return net_run_function(argc
, argv
, func
, net_ads_keytab_usage
);
2479 int net_ads_help(int argc
, const char **argv
)
2481 struct functable func
[] = {
2482 {"USER", net_ads_user_usage
},
2483 {"GROUP", net_ads_group_usage
},
2484 {"PRINTER", net_ads_printer_usage
},
2485 {"SEARCH", net_ads_search_usage
},
2486 {"INFO", net_ads_info
},
2487 {"JOIN", net_ads_join_usage
},
2488 {"DNS", net_ads_dns_usage
},
2489 {"LEAVE", net_ads_leave
},
2490 {"STATUS", net_ads_status
},
2491 {"PASSWORD", net_ads_password
},
2492 {"CHANGETRUSTPW", net_ads_changetrustpw
},
2496 return net_run_function(argc
, argv
, func
, net_ads_usage
);
2499 int net_ads(int argc
, const char **argv
)
2501 struct functable func
[] = {
2502 {"INFO", net_ads_info
},
2503 {"JOIN", net_ads_join
},
2504 {"TESTJOIN", net_ads_testjoin
},
2505 {"LEAVE", net_ads_leave
},
2506 {"STATUS", net_ads_status
},
2507 {"USER", net_ads_user
},
2508 {"GROUP", net_ads_group
},
2509 {"DNS", net_ads_dns
},
2510 {"PASSWORD", net_ads_password
},
2511 {"CHANGETRUSTPW", net_ads_changetrustpw
},
2512 {"PRINTER", net_ads_printer
},
2513 {"SEARCH", net_ads_search
},
2515 {"SID", net_ads_sid
},
2516 {"WORKGROUP", net_ads_workgroup
},
2517 {"LOOKUP", net_ads_lookup
},
2518 {"KEYTAB", net_ads_keytab
},
2519 {"GPO", net_ads_gpo
},
2520 {"HELP", net_ads_help
},
2524 return net_run_function(argc
, argv
, func
, net_ads_usage
);
2529 static int net_ads_noads(void)
2531 d_fprintf(stderr
, "ADS support not compiled in\n");
2535 int net_ads_keytab(int argc
, const char **argv
)
2537 return net_ads_noads();
2540 int net_ads_usage(int argc
, const char **argv
)
2542 return net_ads_noads();
2545 int net_ads_help(int argc
, const char **argv
)
2547 return net_ads_noads();
2550 int net_ads_changetrustpw(int argc
, const char **argv
)
2552 return net_ads_noads();
2555 int net_ads_join(int argc
, const char **argv
)
2557 return net_ads_noads();
2560 int net_ads_user(int argc
, const char **argv
)
2562 return net_ads_noads();
2565 int net_ads_group(int argc
, const char **argv
)
2567 return net_ads_noads();
2570 /* this one shouldn't display a message */
2571 int net_ads_check(void)
2576 int net_ads_check_our_domain(void)
2581 int net_ads(int argc
, const char **argv
)
2583 return net_ads_usage(argc
, argv
);
2586 #endif /* WITH_ADS */