2 Unix SMB/CIFS implementation.
3 dump the remote SAM using rpc samsync operations
5 Copyright (C) Andrew Tridgell 2002
6 Copyright (C) Tim Potter 2001,2002
7 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2005
8 Modified by Volker Lendecke 2002
9 Copyright (C) Jeremy Allison 2005.
10 Copyright (C) Guenther Deschner 2008.
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #include "utils/net.h"
28 #include "../librpc/gen_ndr/ndr_netlogon.h"
29 #include "../librpc/gen_ndr/ndr_drsuapi.h"
30 #include "libnet/libnet_samsync.h"
31 #include "libnet/libnet_dssync.h"
32 #include "../libcli/security/security.h"
34 static void parse_samsync_partial_replication_objects(TALLOC_CTX
*mem_ctx
,
37 bool *do_single_object_replication
,
38 struct samsync_object
**objects
,
39 uint32_t *num_objects
)
44 *do_single_object_replication
= true;
47 for (i
=0; i
<argc
; i
++) {
49 struct samsync_object o
;
53 if (!StrnCaseCmp(argv
[i
], "user_rid=", strlen("user_rid="))) {
54 o
.object_identifier
.rid
= get_int_param(argv
[i
]);
55 o
.object_type
= NETR_DELTA_USER
;
56 o
.database_id
= SAM_DATABASE_DOMAIN
;
58 if (!StrnCaseCmp(argv
[i
], "group_rid=", strlen("group_rid="))) {
59 o
.object_identifier
.rid
= get_int_param(argv
[i
]);
60 o
.object_type
= NETR_DELTA_GROUP
;
61 o
.database_id
= SAM_DATABASE_DOMAIN
;
63 if (!StrnCaseCmp(argv
[i
], "group_member_rid=", strlen("group_member_rid="))) {
64 o
.object_identifier
.rid
= get_int_param(argv
[i
]);
65 o
.object_type
= NETR_DELTA_GROUP_MEMBER
;
66 o
.database_id
= SAM_DATABASE_DOMAIN
;
68 if (!StrnCaseCmp(argv
[i
], "alias_rid=", strlen("alias_rid="))) {
69 o
.object_identifier
.rid
= get_int_param(argv
[i
]);
70 o
.object_type
= NETR_DELTA_ALIAS
;
71 o
.database_id
= SAM_DATABASE_BUILTIN
;
73 if (!StrnCaseCmp(argv
[i
], "alias_member_rid=", strlen("alias_member_rid="))) {
74 o
.object_identifier
.rid
= get_int_param(argv
[i
]);
75 o
.object_type
= NETR_DELTA_ALIAS_MEMBER
;
76 o
.database_id
= SAM_DATABASE_BUILTIN
;
78 if (!StrnCaseCmp(argv
[i
], "account_sid=", strlen("account_sid="))) {
79 const char *sid_str
= get_string_param(argv
[i
]);
80 string_to_sid(&o
.object_identifier
.sid
, sid_str
);
81 o
.object_type
= NETR_DELTA_ACCOUNT
;
82 o
.database_id
= SAM_DATABASE_PRIVS
;
84 if (!StrnCaseCmp(argv
[i
], "policy_sid=", strlen("policy_sid="))) {
85 const char *sid_str
= get_string_param(argv
[i
]);
86 string_to_sid(&o
.object_identifier
.sid
, sid_str
);
87 o
.object_type
= NETR_DELTA_POLICY
;
88 o
.database_id
= SAM_DATABASE_PRIVS
;
90 if (!StrnCaseCmp(argv
[i
], "trustdom_sid=", strlen("trustdom_sid="))) {
91 const char *sid_str
= get_string_param(argv
[i
]);
92 string_to_sid(&o
.object_identifier
.sid
, sid_str
);
93 o
.object_type
= NETR_DELTA_TRUSTED_DOMAIN
;
94 o
.database_id
= SAM_DATABASE_PRIVS
;
96 if (!StrnCaseCmp(argv
[i
], "secret_name=", strlen("secret_name="))) {
97 o
.object_identifier
.name
= get_string_param(argv
[i
]);
98 o
.object_type
= NETR_DELTA_SECRET
;
99 o
.database_id
= SAM_DATABASE_PRIVS
;
102 if (o
.object_type
> 0) {
103 ADD_TO_ARRAY(mem_ctx
, struct samsync_object
, o
,
104 objects
, num_objects
);
109 /* dump sam database via samsync rpc calls */
110 NTSTATUS
rpc_samdump_internals(struct net_context
*c
,
111 const struct dom_sid
*domain_sid
,
112 const char *domain_name
,
113 struct cli_state
*cli
,
114 struct rpc_pipe_client
*pipe_hnd
,
119 struct samsync_context
*ctx
= NULL
;
122 status
= libnet_samsync_init_context(mem_ctx
,
125 if (!NT_STATUS_IS_OK(status
)) {
129 ctx
->mode
= NET_SAMSYNC_MODE_DUMP
;
131 ctx
->ops
= &libnet_samsync_display_ops
;
132 ctx
->domain_name
= domain_name
;
134 ctx
->force_full_replication
= c
->opt_force_full_repl
? true : false;
135 ctx
->clean_old_entries
= c
->opt_clean_old_entries
? true : false;
137 parse_samsync_partial_replication_objects(ctx
, argc
, argv
,
138 &ctx
->single_object_replication
,
142 libnet_samsync(SAM_DATABASE_DOMAIN
, ctx
);
144 libnet_samsync(SAM_DATABASE_BUILTIN
, ctx
);
146 libnet_samsync(SAM_DATABASE_PRIVS
, ctx
);
154 * Basic usage function for 'net rpc vampire'
156 * @param c A net_context structure
157 * @param argc Standard main() style argc
158 * @param argc Standard main() style argv. Initial components are already
162 int rpc_vampire_usage(struct net_context
*c
, int argc
, const char **argv
)
164 d_printf(_("net rpc vampire ([ldif [<ldif-filename>] | [keytab] "
165 "[<keytab-filename]) [options]\n"
166 "\t to pull accounts from a remote PDC where we are a BDC\n"
167 "\t\t no args puts accounts in local passdb from smb.conf\n"
168 "\t\t ldif - put accounts in ldif format (file defaults to "
170 "\t\t keytab - put account passwords in krb5 keytab "
171 "(defaults to system keytab)\n"));
173 net_common_flags_usage(c
, argc
, argv
);
178 /* dump sam database via samsync rpc calls */
179 NTSTATUS
rpc_vampire_internals(struct net_context
*c
,
180 const struct dom_sid
*domain_sid
,
181 const char *domain_name
,
182 struct cli_state
*cli
,
183 struct rpc_pipe_client
*pipe_hnd
,
189 struct samsync_context
*ctx
= NULL
;
191 if (!dom_sid_equal(domain_sid
, get_global_sam_sid())) {
192 d_printf(_("Cannot import users from %s at this time, "
193 "as the current domain:\n\t%s: %s\nconflicts "
194 "with the remote domain\n\t%s: %s\n"
195 "Perhaps you need to set: \n\n\tsecurity=user\n\t"
196 "workgroup=%s\n\n in your smb.conf?\n"),
198 get_global_sam_name(),
199 sid_string_dbg(get_global_sam_sid()),
201 sid_string_dbg(domain_sid
),
203 return NT_STATUS_UNSUCCESSFUL
;
206 result
= libnet_samsync_init_context(mem_ctx
,
209 if (!NT_STATUS_IS_OK(result
)) {
213 ctx
->mode
= NET_SAMSYNC_MODE_FETCH_PASSDB
;
215 ctx
->ops
= &libnet_samsync_passdb_ops
;
216 ctx
->domain_name
= domain_name
;
218 ctx
->force_full_replication
= c
->opt_force_full_repl
? true : false;
219 ctx
->clean_old_entries
= c
->opt_clean_old_entries
? true : false;
221 parse_samsync_partial_replication_objects(ctx
, argc
, argv
,
222 &ctx
->single_object_replication
,
227 result
= libnet_samsync(SAM_DATABASE_DOMAIN
, ctx
);
229 if (!NT_STATUS_IS_OK(result
) && ctx
->error_message
) {
230 d_fprintf(stderr
, "%s\n", ctx
->error_message
);
234 if (ctx
->result_message
) {
235 d_fprintf(stdout
, "%s\n", ctx
->result_message
);
239 ctx
->domain_sid
= dom_sid_dup(mem_ctx
, &global_sid_Builtin
);
240 ctx
->domain_sid_str
= sid_string_talloc(mem_ctx
, ctx
->domain_sid
);
241 result
= libnet_samsync(SAM_DATABASE_BUILTIN
, ctx
);
243 if (!NT_STATUS_IS_OK(result
) && ctx
->error_message
) {
244 d_fprintf(stderr
, "%s\n", ctx
->error_message
);
248 if (ctx
->result_message
) {
249 d_fprintf(stdout
, "%s\n", ctx
->result_message
);
257 int rpc_vampire_passdb(struct net_context
*c
, int argc
, const char **argv
)
259 if (c
->display_usage
) {
261 "net rpc vampire passdb\n"
264 _("Dump remote SAM database to passdb"));
268 return run_rpc_command(c
, NULL
, &ndr_table_netlogon
.syntax_id
, 0,
269 rpc_vampire_internals
, argc
, argv
);
272 NTSTATUS
rpc_vampire_ldif_internals(struct net_context
*c
,
273 const struct dom_sid
*domain_sid
,
274 const char *domain_name
,
275 struct cli_state
*cli
,
276 struct rpc_pipe_client
*pipe_hnd
,
282 struct samsync_context
*ctx
= NULL
;
284 status
= libnet_samsync_init_context(mem_ctx
,
287 if (!NT_STATUS_IS_OK(status
)) {
292 ctx
->output_filename
= argv
[0];
295 parse_samsync_partial_replication_objects(ctx
, argc
-1, argv
+1,
296 &ctx
->single_object_replication
,
301 ctx
->mode
= NET_SAMSYNC_MODE_FETCH_LDIF
;
303 ctx
->ops
= &libnet_samsync_ldif_ops
;
304 ctx
->domain_name
= domain_name
;
306 ctx
->force_full_replication
= c
->opt_force_full_repl
? true : false;
307 ctx
->clean_old_entries
= c
->opt_clean_old_entries
? true : false;
310 status
= libnet_samsync(SAM_DATABASE_DOMAIN
, ctx
);
312 if (!NT_STATUS_IS_OK(status
) && ctx
->error_message
) {
313 d_fprintf(stderr
, "%s\n", ctx
->error_message
);
317 if (ctx
->result_message
) {
318 d_fprintf(stdout
, "%s\n", ctx
->result_message
);
322 ctx
->domain_sid
= dom_sid_dup(mem_ctx
, &global_sid_Builtin
);
323 ctx
->domain_sid_str
= sid_string_talloc(mem_ctx
, ctx
->domain_sid
);
324 status
= libnet_samsync(SAM_DATABASE_BUILTIN
, ctx
);
326 if (!NT_STATUS_IS_OK(status
) && ctx
->error_message
) {
327 d_fprintf(stderr
, "%s\n", ctx
->error_message
);
331 if (ctx
->result_message
) {
332 d_fprintf(stdout
, "%s\n", ctx
->result_message
);
340 int rpc_vampire_ldif(struct net_context
*c
, int argc
, const char **argv
)
342 if (c
->display_usage
) {
344 "net rpc vampire ldif\n"
347 _("Dump remote SAM database to LDIF file or "
352 return run_rpc_command(c
, NULL
, &ndr_table_netlogon
.syntax_id
, 0,
353 rpc_vampire_ldif_internals
, argc
, argv
);
357 NTSTATUS
rpc_vampire_keytab_internals(struct net_context
*c
,
358 const struct dom_sid
*domain_sid
,
359 const char *domain_name
,
360 struct cli_state
*cli
,
361 struct rpc_pipe_client
*pipe_hnd
,
367 struct samsync_context
*ctx
= NULL
;
369 status
= libnet_samsync_init_context(mem_ctx
,
372 if (!NT_STATUS_IS_OK(status
)) {
377 /* the caller should ensure that a filename is provided */
378 return NT_STATUS_INVALID_PARAMETER
;
380 ctx
->output_filename
= argv
[0];
383 parse_samsync_partial_replication_objects(ctx
, argc
-1, argv
+1,
384 &ctx
->single_object_replication
,
389 ctx
->mode
= NET_SAMSYNC_MODE_FETCH_KEYTAB
;
391 ctx
->ops
= &libnet_samsync_keytab_ops
;
392 ctx
->domain_name
= domain_name
;
393 ctx
->username
= c
->opt_user_name
;
394 ctx
->password
= c
->opt_password
;
396 ctx
->force_full_replication
= c
->opt_force_full_repl
? true : false;
397 ctx
->clean_old_entries
= c
->opt_clean_old_entries
? true : false;
400 status
= libnet_samsync(SAM_DATABASE_DOMAIN
, ctx
);
402 if (!NT_STATUS_IS_OK(status
) && ctx
->error_message
) {
403 d_fprintf(stderr
, "%s\n", ctx
->error_message
);
407 if (ctx
->result_message
) {
408 d_fprintf(stdout
, "%s\n", ctx
->result_message
);
417 static NTSTATUS
rpc_vampire_keytab_ds_internals(struct net_context
*c
,
418 const struct dom_sid
*domain_sid
,
419 const char *domain_name
,
420 struct cli_state
*cli
,
421 struct rpc_pipe_client
*pipe_hnd
,
427 struct dssync_context
*ctx
= NULL
;
429 status
= libnet_dssync_init_context(mem_ctx
,
431 if (!NT_STATUS_IS_OK(status
)) {
435 ctx
->force_full_replication
= c
->opt_force_full_repl
? true : false;
436 ctx
->clean_old_entries
= c
->opt_clean_old_entries
? true : false;
439 /* the caller should ensure that a filename is provided */
440 return NT_STATUS_INVALID_PARAMETER
;
442 ctx
->output_filename
= argv
[0];
446 ctx
->object_dns
= &argv
[1];
447 ctx
->object_count
= argc
- 1;
448 ctx
->single_object_replication
= c
->opt_single_obj_repl
? true
453 ctx
->domain_name
= domain_name
;
454 ctx
->ops
= &libnet_dssync_keytab_ops
;
456 status
= libnet_dssync(mem_ctx
, ctx
);
457 if (!NT_STATUS_IS_OK(status
) && ctx
->error_message
) {
458 d_fprintf(stderr
, "%s\n", ctx
->error_message
);
462 if (ctx
->result_message
) {
463 d_fprintf(stdout
, "%s\n", ctx
->result_message
);
473 * Basic function for 'net rpc vampire keytab'
475 * @param c A net_context structure
476 * @param argc Standard main() style argc
477 * @param argc Standard main() style argv. Initial components are already
481 int rpc_vampire_keytab(struct net_context
*c
, int argc
, const char **argv
)
485 struct cli_state
*cli
= NULL
;
486 struct net_dc_info dc_info
;
488 if (c
->display_usage
|| (argc
< 1)) {
491 _("net rpc vampire keytab <keytabfile>\n"
492 " Dump remote SAM database to Kerberos keytab "
497 status
= net_make_ipc_connection(c
, 0, &cli
);
498 if (!NT_STATUS_IS_OK(status
)) {
502 status
= net_scan_dc(c
, cli
, &dc_info
);
503 if (!NT_STATUS_IS_OK(status
)) {
507 if (!dc_info
.is_ad
) {
508 printf(_("DC is not running Active Directory\n"));
509 ret
= run_rpc_command(c
, cli
, &ndr_table_netlogon
.syntax_id
,
511 rpc_vampire_keytab_internals
, argc
, argv
);
514 ret
= run_rpc_command(c
, cli
, &ndr_table_drsuapi
.syntax_id
,
515 NET_FLAGS_SEAL
| NET_FLAGS_TCP
,
516 rpc_vampire_keytab_ds_internals
, argc
, argv
);
517 if (ret
!= 0 && dc_info
.is_mixed_mode
) {
518 printf(_("Fallback to NT4 vampire on Mixed-Mode AD "
520 ret
= run_rpc_command(c
, cli
, &ndr_table_netlogon
.syntax_id
,
522 rpc_vampire_keytab_internals
, argc
, argv
);