source4/scripting/bin/renamedc

   1 #!/usr/bin/env python
   2 # vim: expandtab
   3 #
   4 # Copyright (C) Matthieu Patou <mat@matws.net> 2011
   5 #
   6 # This program is free software; you can redistribute it and/or modify
   7 # it under the terms of the GNU General Public License as published by
   8 # the Free Software Foundation; either version 3 of the License, or
   9 # (at your option) any later version.
  10 #
  11 # This program is distributed in the hope that it will be useful,
  12 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  13 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14 # GNU General Public License for more details.
  15 #
  16 # You should have received a copy of the GNU General Public License
  17 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18
  19
  20 import optparse
  21 import sys
  22 # Allow to run from s4 source directory (without installing samba)
  23 sys.path.insert(0, "bin/python")
  24
  25 import ldb
  26 import samba
  27 import samba.getopt as options
  28 import os
  29
  30 from samba.credentials import DONT_USE_KERBEROS
  31 from samba.auth import system_session
  32 from samba import param
  33 from samba.provision import find_provision_key_parameters, secretsdb_self_join
  34 from samba.upgradehelpers import get_ldbs, get_paths
  35
  36
  37 __docformat__ = "restructuredText"
  38
  39 parser = optparse.OptionParser("provision [options]")
  40 sambaopts = options.SambaOptions(parser)
  41 parser.add_option_group(sambaopts)
  42 parser.add_option_group(options.VersionOptions(parser))
  43 credopts = options.CredentialsOptions(parser)
  44 parser.add_option_group(credopts)
  45 parser.add_option("--oldname",
  46                   help="Old DC name")
  47 parser.add_option("--newname",
  48                   help="New DC name")
  49
  50 opts = parser.parse_args()[0]
  51
  52 if len(sys.argv) == 1:
  53     opts.interactive = True
  54 lp = sambaopts.get_loadparm()
  55 smbconf = lp.configfile
  56
  57 creds = credopts.get_credentials(lp)
  58 creds.set_kerberos_state(DONT_USE_KERBEROS)
  59
  60
  61 if __name__ == '__main__':
  62     global defSDmodified
  63     defSDmodified = False
  64    # 1) First get files paths
  65     paths = get_paths(param, smbconf=smbconf)
  66     # Get ldbs with the system session, it is needed for searching
  67     # provision parameters
  68     session = system_session()
  69
  70     ldbs = get_ldbs(paths, creds, session, lp)
  71     ldbs.sam.transaction_start()
  72     ldbs.secrets.transaction_start()
  73
  74     if opts.oldname is None or opts.newname is None:
  75         raise Exception("Option oldname or newname is missing")
  76     res = ldbs.sam.search(expression="(&(name=%s)(serverReferenceBL=*))" % opts.oldname)
  77     if res is None or len(res) != 1:
  78         raise Exception("Wrong number of result returned, are you sure of the old name %s" %
  79                 opts.oldname)
  80
  81     # Ok got it then check that the new name is not used as well
  82     res2 = ldbs.sam.search(expression="(&(name=%s)(objectclass=computer))" % opts.newname)
  83     if len(res2) != 0:
  84         raise Exception("Seems that %s is a name that already exists, pick another one" %
  85                 opts.newname)
  86
  87     names = find_provision_key_parameters(ldbs.sam, ldbs.secrets, ldbs.idmap,
  88                                             paths, smbconf, lp)
  89
  90     # First rename the entry
  91     # provision put the name in upper case so let's do it too !
  92     newdn = str(res[0].dn).replace("CN=%s" % opts.oldname, "CN=%s" % opts.newname.upper())
  93     dnobj = ldb.Dn(ldbs.sam, newdn)
  94     ldbs.sam.rename(res[0].dn, dnobj)
  95
  96     # Then change password and samaccountname and dnshostname
  97     msg = ldb.Message(dnobj)
  98     machinepass = samba.generate_random_password(128, 255)
  99     mputf16 = machinepass.encode('utf-16-le')
 100
 101     account = "%s$" % opts.newname.upper()
 102     msg["clearTextPassword"] = ldb.MessageElement(mputf16,
 103                                             ldb.FLAG_MOD_REPLACE,
 104                                             "clearTextPassword")
 105
 106     msg["sAMAccountName"] = ldb.MessageElement(account,
 107                                             ldb.FLAG_MOD_REPLACE,
 108                                             "sAMAccountName")
 109
 110     msg["dNSHostName"] = ldb.MessageElement("%s.%s" % (opts.newname,
 111                                             names.dnsdomain),
 112                                             ldb.FLAG_MOD_REPLACE,
 113                                             "dNSHostName")
 114     ldbs.sam.modify(msg)
 115
 116     # Do a self join one more time to resync the secrets file
 117     res = ldbs.sam.search(expression=("distinguishedName=%s" % newdn),
 118             attrs=["msDs-keyVersionNumber", "serverReferenceBL"])
 119     assert(len(res) == 1)
 120     kvno = int(str(res[0]["msDs-keyVersionNumber"]))
 121     serverbldn = ldb.Dn(ldbs.sam, str(res[0]["serverReferenceBL"]))
 122
 123     secrets_msg = ldbs.secrets.search(expression="sAMAccountName=%s$" %
 124                                             opts.oldname.upper(),
 125                                             attrs=["secureChannelType"])
 126
 127     secChanType = int(secrets_msg[0]["secureChannelType"][0])
 128
 129     secretsdb_self_join(ldbs.secrets, domain=names.domain,
 130                 realm=names.realm,
 131                 domainsid=names.domainsid,
 132                 dnsdomain=names.dnsdomain,
 133                 netbiosname=opts.newname.upper(),
 134                 machinepass=machinepass,
 135                 key_version_number=kvno,
 136                 secure_channel_type=secChanType)
 137
 138     # Update RID set reference as there is no back link for the moment.
 139
 140     res = ldbs.sam.search(expression="(objectClass=rIDSet)", base=newdn, attrs=[])
 141     assert(len(res) == 1)
 142     newridset = str(res[0].dn)
 143     msg = ldb.Message(dnobj)
 144
 145     msg["rIDSetReferences"] = ldb.MessageElement(newridset,
 146                                             ldb.FLAG_MOD_REPLACE,
 147                                             "rIDSetReferences")
 148     ldbs.sam.modify(msg)
 149
 150     # Update the server's sites configuration
 151     if False:
 152         # Desactivated for the moment we have a couple of issues with site
 153         # renaming first one is that it's currently forbidden
 154         # second one is that a lot of links are not backlinked
 155         # and so won't be updated when the DN change (ie. fmsowner ...)
 156         serverbl = str(serverbldn)
 157         dnparts = serverbl.split(",")
 158         dnparts[0] = "CN=%s" % opts.newname.upper()
 159         newserverref = ",".join(dnparts)
 160
 161         newserverrefdn = ldb.Dn(ldbs.sam, newserverref)
 162
 163         ldbs.sam.rename(serverbldn, newserverrefdn)
 164
 165         msg = ldb.Message(newserverrefdn)
 166         msg["dNSHostName"] = ldb.MessageElement("%s.%s" % (opts.newname,
 167                                                 names.dnsdomain),
 168                                                 ldb.FLAG_MOD_REPLACE,
 169                                                 "dNSHostName")
 170         ldbs.sam.modify(msg)
 171
 172     try:
 173         ldbs.sam.transaction_prepare_commit()
 174         ldbs.secrets.transaction_prepare_commit()
 175     except Exception:
 176         ldbs.sam.rollback()
 177         ldbs.secrets.rollback()
 178         sys.exit(1)
 179
 180     try:
 181         ldbs.sam.transaction_commit()
 182         ldbs.secrets.transaction_commit()
 183     except Exception:
 184         ldbs.sam.rollback()
 185         ldbs.secrets.rollback()
 186
 187     # All good so far
 188     #print lp.get("private dir")
 189     cf = open(lp.configfile)
 190     ncfname = "%s.new" % lp.configfile
 191     newconf = open(ncfname, 'w')
 192     for l in cf.readlines():
 193         if l.find("netbios name") > 0:
 194              newconf.write("\tnetbios name = %s\n" % opts.newname.upper())
 195         else:
 196             newconf.write(l)
 197     newconf.close()
 198     cf.close()
 199     os.rename(ncfname, lp.configfile)
 200