3 # Unix SMB/CIFS implementation.
4 # provision a Samba4 server
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
8 # Based on the original in EJS:
9 # Copyright (C) Andrew Tridgell 2005
11 # This program is free software; you can redistribute it and/or modify
12 # it under the terms of the GNU General Public License as published by
13 # the Free Software Foundation; either version 3 of the License, or
14 # (at your option) any later version.
16 # This program is distributed in the hope that it will be useful,
17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 # GNU General Public License for more details.
21 # You should have received a copy of the GNU General Public License
22 # along with this program. If not, see <http://www.gnu.org/licenses/>.
30 # Find right directory when running from source tree
31 sys
.path
.insert(0, "bin/python")
36 from samba
.credentials
import DONT_USE_KERBEROS
37 from samba
.auth
import system_session
38 import samba
.getopt
as options
39 from samba
.provision
import (
46 from samba
.dsdb
import (
47 DS_DOMAIN_FUNCTION_2000
,
48 DS_DOMAIN_FUNCTION_2003
,
49 DS_DOMAIN_FUNCTION_2008
,
50 DS_DOMAIN_FUNCTION_2008_R2
,
53 # how do we make this case insensitive??
55 parser
= optparse
.OptionParser("provision [options]")
56 sambaopts
= options
.SambaOptions(parser
)
57 parser
.add_option_group(sambaopts
)
58 parser
.add_option_group(options
.VersionOptions(parser
))
59 credopts
= options
.CredentialsOptions(parser
)
60 parser
.add_option_group(credopts
)
61 parser
.add_option("--interactive", help="Ask for names", action
="store_true")
62 parser
.add_option("--domain", type="string", metavar
="DOMAIN",
64 parser
.add_option("--domain-guid", type="string", metavar
="GUID",
65 help="set domainguid (otherwise random)")
66 parser
.add_option("--domain-sid", type="string", metavar
="SID",
67 help="set domainsid (otherwise random)")
68 parser
.add_option("--ntds-guid", type="string", metavar
="GUID",
69 help="set NTDS object GUID (otherwise random)")
70 parser
.add_option("--invocationid", type="string", metavar
="GUID",
71 help="set invocationid (otherwise random)")
72 parser
.add_option("--host-name", type="string", metavar
="HOSTNAME",
74 parser
.add_option("--host-ip", type="string", metavar
="IPADDRESS",
75 help="set IPv4 ipaddress")
76 parser
.add_option("--host-ip6", type="string", metavar
="IP6ADDRESS",
77 help="set IPv6 ipaddress")
78 parser
.add_option("--adminpass", type="string", metavar
="PASSWORD",
79 help="choose admin password (otherwise random)")
80 parser
.add_option("--krbtgtpass", type="string", metavar
="PASSWORD",
81 help="choose krbtgt password (otherwise random)")
82 parser
.add_option("--machinepass", type="string", metavar
="PASSWORD",
83 help="choose machine password (otherwise random)")
84 parser
.add_option("--dns-backend", type="choice", metavar
="NAMESERVER-BACKEND",
85 choices
=["SAMBA_INTERNAL", "BIND9_FLATFILE", "BIND9_DLZ", "NONE"],
86 help="The DNS server backend. SAMBA_INTERNAL is the builtin name server, " \
87 "BIND9_FLATFILE uses bind9 text database to store zone information (default), " \
88 "BIND9_DLZ uses samba4 AD to store zone information, " \
89 "NONE skips the DNS setup entirely (not recommended)")
90 parser
.add_option("--dnspass", type="string", metavar
="PASSWORD",
91 help="choose dns password (otherwise random)")
92 parser
.add_option("--ldapadminpass", type="string", metavar
="PASSWORD",
93 help="choose password to set between Samba and it's LDAP backend (otherwise random)")
94 parser
.add_option("--root", type="string", metavar
="USERNAME",
95 help="choose 'root' unix username")
96 parser
.add_option("--nobody", type="string", metavar
="USERNAME",
97 help="choose 'nobody' user")
98 parser
.add_option("--wheel", type="string", metavar
="GROUPNAME",
99 help="choose 'wheel' privileged group")
100 parser
.add_option("--users", type="string", metavar
="GROUPNAME",
101 help="choose 'users' group")
102 parser
.add_option("--quiet", help="Be quiet", action
="store_true")
103 parser
.add_option("--blank", action
="store_true",
104 help="do not add users or groups, just the structure")
105 parser
.add_option("--ldap-backend-extra-port", type="int", metavar
="LDAP-BACKEND-EXTRA-PORT",
106 help="Additional TCP port for LDAP backend server (to use for replication)")
107 parser
.add_option("--ldap-backend-forced-uri", type="string", metavar
="LDAP-BACKEND-FORCED-URI",
108 help="Force the LDAP backend connection to be to a particular URI. Use this ONLY for 'existing' backends, or when debugging the interaction with the LDAP backend and you need to intercept the LDAP traffic")
109 parser
.add_option("--ldap-backend-type", type="choice", metavar
="LDAP-BACKEND-TYPE",
110 help="LDAP backend type (fedora-ds or openldap)",
111 choices
=["fedora-ds", "openldap"])
112 parser
.add_option("--ldap-backend-nosync", help="Configure LDAP backend not to call fsync() (for performance in test environments)", action
="store_true")
113 parser
.add_option("--server-role", type="choice", metavar
="ROLE",
114 choices
=["domain controller", "dc", "member server", "member", "standalone"],
115 help="The server role (domain controller | dc | member server | member | standalone). Default is dc.")
116 parser
.add_option("--function-level", type="choice", metavar
="FOR-FUN-LEVEL",
117 choices
=["2000", "2003", "2008", "2008_R2"],
118 help="The domain and forest function level (2000 | 2003 | 2008 | 2008_R2 - always native). Default is (Windows) 2003 Native.")
119 parser
.add_option("--next-rid", type="int", metavar
="NEXTRID", default
=1000,
120 help="The initial nextRid value (only needed for upgrades). Default is 1000.")
121 parser
.add_option("--partitions-only",
122 help="Configure Samba's partitions, but do not modify them (ie, join a BDC)", action
="store_true")
123 parser
.add_option("--targetdir", type="string", metavar
="DIR",
124 help="Set target directory")
125 parser
.add_option("--ol-mmr-urls", type="string", metavar
="LDAPSERVER",
126 help="List of LDAP-URLS [ ldap://<FQHN>:<PORT>/ (where <PORT> has to be different than 389!) ] separated with comma (\",\") for use with OpenLDAP-MMR (Multi-Master-Replication), e.g.: \"ldap://s4dc1:9000,ldap://s4dc2:9000\"")
127 parser
.add_option("--slapd-path", type="string", metavar
="SLAPD-PATH",
128 help="Path to slapd for LDAP backend [e.g.:'/usr/local/libexec/slapd']. Required for Setup with LDAP-Backend. OpenLDAP Version >= 2.4.17 should be used.")
129 parser
.add_option("--setup-ds-path", type="string", metavar
="SETUP_DS-PATH",
130 help="Path to setup-ds.pl script for Fedora DS LDAP backend [e.g.:'/usr/sbin/setup-ds.pl']. Required for Setup with Fedora DS backend.")
131 parser
.add_option("--use-xattrs", type="choice", choices
=["yes", "no", "auto"], help="Define if we should use the native fs capabilities or a tdb file for storing attributes likes ntacl, auto tries to make an inteligent guess based on the user rights and system capabilities", default
="auto")
132 parser
.add_option("--ldap-dryrun-mode", help="Configure LDAP backend, but do not run any binaries and exit early. Used only for the test environment. DO NOT USE", action
="store_true")
134 opts
= parser
.parse_args()[0]
136 logger
= logging
.getLogger("provision")
137 logger
.addHandler(logging
.StreamHandler(sys
.stdout
))
139 logger
.setLevel(logging
.WARNING
)
141 logger
.setLevel(logging
.INFO
)
143 if len(sys
.argv
) == 1:
144 opts
.interactive
= True
147 from getpass
import getpass
150 def ask(prompt
, default
=None):
151 if default
is not None:
152 print "%s [%s]: " % (prompt
, default
),
154 print "%s: " % (prompt
,),
155 return sys
.stdin
.readline().rstrip("\n") or default
157 default
= socket
.getfqdn().split(".", 1)[1].upper()
160 opts
.realm
= ask("Realm", default
)
161 if opts
.realm
in (None, ""):
162 print >>sys
.stderr
, "No realm set!"
166 default
= opts
.realm
.split(".")[0]
169 opts
.domain
= ask("Domain", default
)
170 if opts
.domain
is None:
171 print >> sys
.stderr
, "No domain set!"
174 opts
.server_role
= ask("Server Role (dc, member, standalone)", "dc")
176 opts
.adminpass
= getpass("Administrator password: ")
177 if not opts
.adminpass
:
178 print >>sys
.stderr
, "Invalid administrator password."
182 if opts
.realm
in (None, ""):
183 opts
.realm
= sambaopts
._lp
.get('realm')
184 if opts
.realm
is None or opts
.domain
is None:
185 if opts
.realm
is None:
186 print >>sys
.stderr
, "No realm set!"
187 if opts
.domain
is None:
188 print >> sys
.stderr
, "No domain set!"
192 if not opts
.adminpass
:
193 logger
.info("Administrator password will be set randomly!")
195 lp
= sambaopts
.get_loadparm()
196 smbconf
= lp
.configfile
198 if opts
.server_role
== "dc":
199 server_role
= "domain controller"
200 elif opts
.server_role
== "member":
201 server_role
= "member server"
203 server_role
= opts
.server_role
205 if server_role
is None:
206 server_role
= "domain controller"
208 if opts
.function_level
is None:
209 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2003
210 elif opts
.function_level
== "2000":
211 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2000
212 elif opts
.function_level
== "2003":
213 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2003
214 elif opts
.function_level
== "2008":
215 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2008
216 elif opts
.function_level
== "2008_R2":
217 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2008_R2
219 if opts
.dns_backend
is None:
220 dns_backend
= "BIND9_FLATFILE"
222 dns_backend
= opts
.dns_backend
224 creds
= credopts
.get_credentials(lp
)
226 creds
.set_kerberos_state(DONT_USE_KERBEROS
)
228 samdb_fill
= FILL_FULL
230 samdb_fill
= FILL_NT4SYNC
231 elif opts
.partitions_only
:
232 samdb_fill
= FILL_DRS
235 if opts
.use_xattrs
== "yes":
237 elif opts
.use_xattrs
== "auto" and not lp
.get("posix:eadb"):
239 file = tempfile
.NamedTemporaryFile(prefix
=os
.path
.abspath(opts
.targetdir
))
241 file = tempfile
.NamedTemporaryFile(prefix
=os
.path
.abspath(os
.path
.dirname(lp
.get("private dir"))))
243 samba
.ntacls
.setntacl(lp
, file.name
,
244 "O:S-1-5-32G:S-1-5-32", "S-1-5-32", "native")
247 logger
.info("You are not root or your system do not support xattr, using tdb backend for attributes. "
248 "If you intend to use this provision in production, rerun the script as root on a system supporting xattrs.")
252 if opts
.ldap_backend_type
== "existing":
253 if opts
.ldap_backend_forced_uri
is not None:
254 logger
.warn("You have specified to use an existing LDAP server as the backend, please make sure an LDAP server is running at %s" % opts
.ldap_backend_forced_uri
)
256 logger
.info("You have specified to use an existing LDAP server as the backend, please make sure an LDAP server is running at the default location")
258 if opts
.ldap_backend_forced_uri
is not None:
259 logger
.warn("You have specified to use an fixed URI %s for connecting to your LDAP server backend. This is NOT RECOMMENDED, as our default communiation over ldapi:// is more secure and much less prone to unexpected failure or interaction" % opts
.ldap_backend_forced_uri
)
261 session
= system_session()
264 session
, creds
, smbconf
=smbconf
, targetdir
=opts
.targetdir
,
265 samdb_fill
=samdb_fill
, realm
=opts
.realm
, domain
=opts
.domain
,
266 domainguid
=opts
.domain_guid
, domainsid
=opts
.domain_sid
,
267 hostname
=opts
.host_name
,
268 hostip
=opts
.host_ip
, hostip6
=opts
.host_ip6
,
269 ntdsguid
=opts
.ntds_guid
,
270 invocationid
=opts
.invocationid
, adminpass
=opts
.adminpass
,
271 krbtgtpass
=opts
.krbtgtpass
, machinepass
=opts
.machinepass
,
272 dns_backend
=dns_backend
,
273 dnspass
=opts
.dnspass
, root
=opts
.root
, nobody
=opts
.nobody
,
274 wheel
=opts
.wheel
, users
=opts
.users
,
275 serverrole
=server_role
, dom_for_fun_level
=dom_for_fun_level
,
276 ldap_backend_extra_port
=opts
.ldap_backend_extra_port
,
277 ldap_backend_forced_uri
=opts
.ldap_backend_forced_uri
,
278 backend_type
=opts
.ldap_backend_type
,
279 ldapadminpass
=opts
.ldapadminpass
, ol_mmr_urls
=opts
.ol_mmr_urls
,
280 slapd_path
=opts
.slapd_path
, setup_ds_path
=opts
.setup_ds_path
,
281 nosync
=opts
.ldap_backend_nosync
, ldap_dryrun_mode
=opts
.ldap_dryrun_mode
,
282 useeadb
=eadb
, next_rid
=opts
.next_rid
, lp
=lp
)
283 except ProvisioningError
, e
: