2 Samba Unix/Linux SMB client library
3 Distributed SMB/CIFS Server Management Utility
4 Copyright (C) 2001 Steve French (sfrench@us.ibm.com)
5 Copyright (C) 2001 Jim McDonough (jmcd@us.ibm.com)
6 Copyright (C) 2001 Andrew Tridgell (tridge@samba.org)
7 Copyright (C) 2001 Andrew Bartlett (abartlet@samba.org)
8 Copyright (C) 2008 Kai Blin (kai@samba.org)
10 Originally written by Steve and Jim. Largely rewritten by tridge in
13 Reworked again by abartlet in December 2001
15 Another overhaul, moving functionality into plug-ins loaded on demand by Kai
18 This program is free software; you can redistribute it and/or modify
19 it under the terms of the GNU General Public License as published by
20 the Free Software Foundation; either version 3 of the License, or
21 (at your option) any later version.
23 This program is distributed in the hope that it will be useful,
24 but WITHOUT ANY WARRANTY; without even the implied warranty of
25 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
26 GNU General Public License for more details.
28 You should have received a copy of the GNU General Public License
29 along with this program. If not, see <http://www.gnu.org/licenses/>. */
31 /*****************************************************/
33 /* Distributed SMB/CIFS Server Management Utility */
35 /* The intent was to make the syntax similar */
36 /* to the NET utility (first developed in DOS */
37 /* with additional interesting & useful functions */
38 /* added in later SMB server network operating */
41 /*****************************************************/
44 #include "popt_common.h"
45 #include "utils/net.h"
47 #include "lib/netapi/netapi.h"
48 #include "../libcli/security/security.h"
50 #ifdef WITH_FAKE_KASERVER
51 #include "utils/net_afs.h"
54 /***********************************************************************/
55 /* end of internationalization section */
56 /***********************************************************************/
58 enum netr_SchannelType
get_sec_channel_type(const char *param
)
60 if (!(param
&& *param
)) {
61 return get_default_sec_channel();
63 if (strequal(param
, "PDC")) {
65 } else if (strequal(param
, "BDC")) {
67 } else if (strequal(param
, "MEMBER")) {
68 return SEC_CHAN_WKSTA
;
70 } else if (strequal(param
, "DOMAIN")) {
71 return SEC_CHAN_DOMAIN
;
74 return get_default_sec_channel();
79 static int net_changetrustpw(struct net_context
*c
, int argc
, const char **argv
)
81 if (net_ads_check_our_domain(c
) == 0)
82 return net_ads_changetrustpw(c
, argc
, argv
);
84 return net_rpc_changetrustpw(c
, argc
, argv
);
87 static void set_line_buffering(FILE *f
)
89 setvbuf(f
, NULL
, _IOLBF
, 0);
92 static int net_changesecretpw(struct net_context
*c
, int argc
,
96 enum netr_SchannelType sec_channel_type
= SEC_CHAN_WKSTA
;
100 set_line_buffering(stdin
);
101 set_line_buffering(stdout
);
102 set_line_buffering(stderr
);
105 trust_pw
= get_pass(_("Enter machine password: "), c
->opt_stdin
);
107 if (!secrets_store_machine_password(trust_pw
, lp_workgroup(), sec_channel_type
)) {
109 _("Unable to write the machine account password in the secrets database"));
113 d_printf(_("Modified trust account password in secrets database\n"));
117 d_printf(_("Machine account password change requires the -f flag.\n"
118 "Do NOT use this function unless you know what it does!\n"
119 "This function will change the ADS Domain member "
120 "machine account password in the secrets.tdb file!\n"));
127 * @brief Set the authorised user for winbindd access in secrets.tdb
129 static int net_setauthuser(struct net_context
*c
, int argc
, const char **argv
)
131 const char *password
= NULL
;
133 if (!secrets_init()) {
134 d_fprintf(stderr
, _("Failed to open secrets.tdb.\n"));
138 /* Delete the settings. */
140 if (strncmp(argv
[0], "delete", 6) != 0) {
141 d_fprintf(stderr
,_("Usage:\n"));
143 _(" net setauthuser -U user[%%password] \n"
144 " Set the auth user account to user"
145 "password. Prompt for password if not "
148 _(" net setauthuser delete\n"
149 " Delete the auth user setting.\n"));
152 secrets_delete(SECRETS_AUTH_USER
);
153 secrets_delete(SECRETS_AUTH_DOMAIN
);
154 secrets_delete(SECRETS_AUTH_PASSWORD
);
158 if (!c
->opt_user_specified
) {
159 d_fprintf(stderr
, _("Usage:\n"));
161 _(" net setauthuser -U user[%%password]\n"
162 " Set the auth user account to user"
163 "password. Prompt for password if not "
166 _(" net setauthuser delete\n"
167 " Delete the auth user setting.\n"));
171 password
= net_prompt_pass(c
, _("the auth user"));
172 if (password
== NULL
) {
173 d_fprintf(stderr
,_("Failed to get the auth users password.\n"));
177 if (!secrets_store(SECRETS_AUTH_USER
, c
->opt_user_name
,
178 strlen(c
->opt_user_name
) + 1)) {
179 d_fprintf(stderr
, _("error storing auth user name\n"));
183 if (!secrets_store(SECRETS_AUTH_DOMAIN
, c
->opt_workgroup
,
184 strlen(c
->opt_workgroup
) + 1)) {
185 d_fprintf(stderr
, _("error storing auth user domain\n"));
189 if (!secrets_store(SECRETS_AUTH_PASSWORD
, password
,
190 strlen(password
) + 1)) {
191 d_fprintf(stderr
, _("error storing auth user password\n"));
199 * @brief Get the auth user settings
201 static int net_getauthuser(struct net_context
*c
, int argc
, const char **argv
)
203 char *user
, *domain
, *password
;
205 /* Lift data from secrets file */
207 secrets_fetch_ipc_userpass(&user
, &domain
, &password
);
209 if ((!user
|| !*user
) && (!domain
|| !*domain
) &&
210 (!password
|| !*password
)){
215 d_printf(_("No authorised user configured\n"));
219 /* Pretty print authorised user info */
221 d_printf("%s%s%s%s%s\n", domain
? domain
: "",
222 domain
? lp_winbind_separator(): "", user
,
223 password
? "%" : "", password
? password
: "");
232 Retrieve our local SID or the SID for the specified name
234 static int net_getlocalsid(struct net_context
*c
, int argc
, const char **argv
)
244 name
= global_myname();
247 if(!initialize_password_db(false, NULL
)) {
248 DEBUG(0, ("WARNING: Could not open passdb - local sid may not reflect passdb\n"
249 "backend knowledge (such as the sid stored in LDAP)\n"));
252 /* first check to see if we can even access secrets, so we don't
253 panic when we can't. */
255 if (!secrets_init()) {
257 _("Unable to open secrets.tdb. Can't fetch domain "
258 "SID for name: %s\n"), name
);
262 /* Generate one, if it doesn't exist */
263 get_global_sam_sid();
265 if (!secrets_fetch_domain_sid(name
, &sid
)) {
266 DEBUG(0, ("Can't fetch domain SID for name: %s\n", name
));
269 sid_to_fstring(sid_str
, &sid
);
270 d_printf(_("SID for domain %s is: %s\n"), name
, sid_str
);
274 static int net_setlocalsid(struct net_context
*c
, int argc
, const char **argv
)
279 || (strncmp(argv
[0], "S-1-5-21-", strlen("S-1-5-21-")) != 0)
280 || (!string_to_sid(&sid
, argv
[0]))
281 || (sid
.num_auths
!= 4)) {
282 d_printf(_("Usage:"));
283 d_printf(" net setlocalsid S-1-5-21-x-y-z\n");
287 if (!secrets_store_domain_sid(global_myname(), &sid
)) {
288 DEBUG(0,("Can't store domain SID as a pdc/bdc.\n"));
295 static int net_setdomainsid(struct net_context
*c
, int argc
, const char **argv
)
300 || (strncmp(argv
[0], "S-1-5-21-", strlen("S-1-5-21-")) != 0)
301 || (!string_to_sid(&sid
, argv
[0]))
302 || (sid
.num_auths
!= 4)) {
303 d_printf(_("Usage:"));
304 d_printf(" net setdomainsid S-1-5-21-x-y-z\n");
308 if (!secrets_store_domain_sid(lp_workgroup(), &sid
)) {
309 DEBUG(0,("Can't store domain SID.\n"));
316 static int net_getdomainsid(struct net_context
*c
, int argc
, const char **argv
)
318 struct dom_sid domain_sid
;
322 d_printf(_("Usage:"));
323 d_printf(" net getdomainsid\n");
327 if(!initialize_password_db(false, NULL
)) {
328 DEBUG(0, ("WARNING: Could not open passdb - domain SID may "
329 "not reflect passdb\n"
330 "backend knowledge (such as the SID stored in "
334 /* first check to see if we can even access secrets, so we don't
335 panic when we can't. */
337 if (!secrets_init()) {
338 d_fprintf(stderr
, _("Unable to open secrets.tdb. Can't fetch "
339 "domain SID for name: %s\n"),
340 get_global_sam_name());
344 /* Generate one, if it doesn't exist */
345 get_global_sam_sid();
347 if (!secrets_fetch_domain_sid(global_myname(), &domain_sid
)) {
348 d_fprintf(stderr
, _("Could not fetch local SID\n"));
351 sid_to_fstring(sid_str
, &domain_sid
);
352 d_printf(_("SID for local machine %s is: %s\n"),
353 global_myname(), sid_str
);
355 if (!secrets_fetch_domain_sid(c
->opt_workgroup
, &domain_sid
)) {
356 d_fprintf(stderr
, _("Could not fetch domain SID\n"));
360 sid_to_fstring(sid_str
, &domain_sid
);
361 d_printf(_("SID for domain %s is: %s\n"), c
->opt_workgroup
, sid_str
);
366 static bool search_maxrid(struct pdb_search
*search
, const char *type
,
369 struct samr_displayentry
*entries
;
370 uint32 i
, num_entries
;
372 if (search
== NULL
) {
373 d_fprintf(stderr
, _("get_maxrid: Could not search %s\n"), type
);
377 num_entries
= pdb_search_entries(search
, 0, 0xffffffff, &entries
);
378 for (i
=0; i
<num_entries
; i
++)
379 *max_rid
= MAX(*max_rid
, entries
[i
].rid
);
384 static uint32
get_maxrid(void)
388 if (!search_maxrid(pdb_search_users(talloc_tos(), 0), "users", &max_rid
))
391 if (!search_maxrid(pdb_search_groups(talloc_tos()), "groups", &max_rid
))
394 if (!search_maxrid(pdb_search_aliases(talloc_tos(),
395 get_global_sam_sid()),
396 "aliases", &max_rid
))
402 static int net_maxrid(struct net_context
*c
, int argc
, const char **argv
)
407 d_fprintf(stderr
, "%s net maxrid\n", _("Usage:"));
411 if ((rid
= get_maxrid()) == 0) {
412 d_fprintf(stderr
, _("can't get current maximum rid\n"));
416 d_printf(_("Currently used maximum rid: %d\n"), rid
);
421 /* main function table */
422 static struct functable net_func
[] = {
427 N_("Run functions using RPC transport"),
428 N_(" Use 'net help rpc' to get more extensive information "
429 "about 'net rpc' commands.")
435 N_("Run functions using RAP transport"),
436 N_(" Use 'net help rap' to get more extensive information "
437 "about 'net rap' commands.")
443 N_("Run functions using ADS transport"),
444 N_(" Use 'net help ads' to get more extensive information "
445 "about 'net ads' commands.")
448 /* eventually these should auto-choose the transport ... */
452 NET_TRANSPORT_RPC
| NET_TRANSPORT_RAP
,
453 N_("Functions on remote opened files"),
454 N_(" Use 'net help file' to get more information about 'net "
460 NET_TRANSPORT_RPC
| NET_TRANSPORT_RAP
,
461 N_("Functions on shares"),
462 N_(" Use 'net help share' to get more information about 'net "
469 N_("Manage sessions"),
470 N_(" Use 'net help session' to get more information about "
471 "'net session' commands.")
477 N_("List servers in workgroup"),
478 N_(" Use 'net help server' to get more information about 'net "
485 N_("List domains/workgroups on network"),
486 N_(" Use 'net help domain' to get more information about 'net "
493 N_("Modify printer queue"),
494 N_(" Use 'net help printq' to get more information about 'net "
500 NET_TRANSPORT_ADS
| NET_TRANSPORT_RPC
| NET_TRANSPORT_RAP
,
502 N_(" Use 'net help user' to get more information about 'net "
508 NET_TRANSPORT_ADS
| NET_TRANSPORT_RPC
| NET_TRANSPORT_RAP
,
510 N_(" Use 'net help group' to get more information about 'net "
517 N_("Manage group mappings"),
518 N_(" Use 'net help groupmap' to get more information about "
519 "'net groupmap' commands.")
525 N_("Functions on the SAM database"),
526 N_(" Use 'net help sam' to get more information about 'net "
533 N_("Validate username and password"),
534 N_(" Use 'net help validate' to get more information about "
535 "'net validate' commands.")
541 N_("Modify group memberships"),
542 N_(" Use 'net help groupmember' to get more information about "
543 "'net groupmember' commands.")
548 N_("Execute remote command on a remote OS/2 server"),
549 N_(" Use 'net help admin' to get more information about 'net "
555 N_("List/modify running services"),
556 N_(" Use 'net help service' to get more information about "
557 "'net service' commands.")
563 N_("Change user password on target server"),
564 N_(" Use 'net help password' to get more information about "
565 "'net password' commands.")
569 NET_TRANSPORT_ADS
| NET_TRANSPORT_RPC
,
570 N_("Change the trust password"),
571 N_(" Use 'net help changetrustpw' to get more information "
572 "about 'net changetrustpw'.")
577 N_("Change the secret password"),
578 N_(" net [options] changesecretpw\n"
579 " Change the ADS domain member machine account password "
581 " Do NOT use this function unless you know what it does.\n"
582 " Requires the -f flag to work.")
588 N_("Set the winbind auth user"),
589 N_(" net -U user[%%password] [-W domain] setauthuser\n"
590 " Set the auth user, password (and optionally domain\n"
591 " Will prompt for password if not given.\n"
592 " net setauthuser delete\n"
593 " Delete the existing auth user settings.")
599 N_("Get the winbind auth user settings"),
600 N_(" net getauthuser\n"
601 " Get the current winbind auth user settings.")
607 N_(" Use 'net help time' to get more information about 'net "
613 N_("Look up host names/IP addresses"),
614 N_(" Use 'net help lookup' to get more information about 'net "
620 N_("Manipulate the global lock table"),
621 N_(" Use 'net help g_lock' to get more information about "
622 "'net g_lock' commands.")
626 NET_TRANSPORT_ADS
| NET_TRANSPORT_RPC
,
627 N_("Join a domain/AD"),
628 N_(" Use 'net help join' to get more information about 'net "
634 N_("Join/unjoin (remote) machines to/from a domain/AD"),
635 N_(" Use 'net help dom' to get more information about 'net "
641 N_("Operate on the cache tdb file"),
642 N_(" Use 'net help cache' to get more information about 'net "
648 N_("Get the SID for the local domain"),
649 N_(" net getlocalsid")
654 N_("Set the SID for the local domain"),
655 N_(" net setlocalsid S-1-5-21-x-y-z")
660 N_("Set domain SID on member servers"),
661 N_(" net setdomainsid S-1-5-21-x-y-z")
666 N_("Get domain SID on member servers"),
667 N_(" net getdomainsid")
672 N_("Display the maximul RID currently used"),
678 N_("IDmap functions"),
679 N_(" Use 'net help idmap to get more information about 'net "
685 N_("Display server status"),
686 N_(" Use 'net help status' to get more information about 'net "
692 N_("Manage user-modifiable shares"),
693 N_(" Use 'net help usershare to get more information about "
694 "'net usershare' commands.")
699 N_("Display list of all users with SID"),
700 N_(" Use 'net help usersidlist' to get more information about "
701 "'net usersidlist'.")
706 N_("Manage Samba registry based configuration"),
707 N_(" Use 'net help conf' to get more information about 'net "
713 N_("Manage the Samba registry"),
714 N_(" Use 'net help registry' to get more information about "
715 "'net registry' commands.")
720 N_("Process Win32 *.evt eventlog files"),
721 N_(" Use 'net help eventlog' to get more information about "
722 "'net eventlog' commands.")
727 N_("Process tdb printer files"),
728 N_(" Use 'net help printing' to get more information about "
729 "'net printing' commands.")
735 N_("Manage the serverid tdb"),
736 N_(" Use 'net help serverid' to get more information about "
737 "'net serverid' commands.")
740 #ifdef WITH_FAKE_KASERVER
744 N_("Manage AFS tokens"),
745 N_(" Use 'net help afs' to get more information about 'net "
753 N_("Print usage information"),
754 N_(" Use 'net help help' to list usage information for 'net' "
757 {NULL
, NULL
, 0, NULL
, NULL
}
761 /****************************************************************************
763 ****************************************************************************/
764 int main(int argc
, const char **argv
)
770 const char ** argv_new
;
772 TALLOC_CTX
*frame
= talloc_stackframe();
773 struct net_context
*c
= talloc_zero(frame
, struct net_context
);
775 struct poptOption long_options
[] = {
776 {"help", 'h', POPT_ARG_NONE
, 0, 'h'},
777 {"workgroup", 'w', POPT_ARG_STRING
, &c
->opt_target_workgroup
},
778 {"user", 'U', POPT_ARG_STRING
, &c
->opt_user_name
, 'U'},
779 {"ipaddress", 'I', POPT_ARG_STRING
, 0,'I'},
780 {"port", 'p', POPT_ARG_INT
, &c
->opt_port
},
781 {"myname", 'n', POPT_ARG_STRING
, &c
->opt_requester_name
},
782 {"server", 'S', POPT_ARG_STRING
, &c
->opt_host
},
783 {"encrypt", 'e', POPT_ARG_NONE
, NULL
, 'e', N_("Encrypt SMB transport (UNIX extended servers only)") },
784 {"container", 'c', POPT_ARG_STRING
, &c
->opt_container
},
785 {"comment", 'C', POPT_ARG_STRING
, &c
->opt_comment
},
786 {"maxusers", 'M', POPT_ARG_INT
, &c
->opt_maxusers
},
787 {"flags", 'F', POPT_ARG_INT
, &c
->opt_flags
},
788 {"long", 'l', POPT_ARG_NONE
, &c
->opt_long_list_entries
},
789 {"reboot", 'r', POPT_ARG_NONE
, &c
->opt_reboot
},
790 {"force", 'f', POPT_ARG_NONE
, &c
->opt_force
},
791 {"stdin", 'i', POPT_ARG_NONE
, &c
->opt_stdin
},
792 {"timeout", 't', POPT_ARG_INT
, &c
->opt_timeout
},
793 {"request-timeout",0,POPT_ARG_INT
, &c
->opt_request_timeout
},
794 {"machine-pass",'P', POPT_ARG_NONE
, &c
->opt_machine_pass
},
795 {"kerberos", 'k', POPT_ARG_NONE
, &c
->opt_kerberos
},
796 {"myworkgroup", 'W', POPT_ARG_STRING
, &c
->opt_workgroup
},
797 {"use-ccache", 0, POPT_ARG_NONE
, &c
->opt_ccache
},
798 {"verbose", 'v', POPT_ARG_NONE
, &c
->opt_verbose
},
799 {"test", 'T', POPT_ARG_NONE
, &c
->opt_testmode
},
800 /* Options for 'net groupmap set' */
801 {"local", 'L', POPT_ARG_NONE
, &c
->opt_localgroup
},
802 {"domain", 'D', POPT_ARG_NONE
, &c
->opt_domaingroup
},
803 {"ntname", 'N', POPT_ARG_STRING
, &c
->opt_newntname
},
804 {"rid", 'R', POPT_ARG_INT
, &c
->opt_rid
},
805 /* Options for 'net rpc share migrate' */
806 {"acls", 0, POPT_ARG_NONE
, &c
->opt_acls
},
807 {"attrs", 0, POPT_ARG_NONE
, &c
->opt_attrs
},
808 {"timestamps", 0, POPT_ARG_NONE
, &c
->opt_timestamps
},
809 {"exclude", 'X', POPT_ARG_STRING
, &c
->opt_exclude
},
810 {"destination", 0, POPT_ARG_STRING
, &c
->opt_destination
},
811 {"tallocreport", 0, POPT_ARG_NONE
, &c
->do_talloc_report
},
812 /* Options for 'net rpc vampire (keytab)' */
813 {"force-full-repl", 0, POPT_ARG_NONE
, &c
->opt_force_full_repl
},
814 {"single-obj-repl", 0, POPT_ARG_NONE
, &c
->opt_single_obj_repl
},
815 {"clean-old-entries", 0, POPT_ARG_NONE
, &c
->opt_clean_old_entries
},
821 zero_sockaddr(&c
->opt_dest_ip
);
823 setup_logging(argv
[0], DEBUG_STDERR
);
827 setlocale(LC_ALL
, "");
828 #if defined(HAVE_BINDTEXTDOMAIN)
829 bindtextdomain(MODULE_NAME
, dyn_LOCALEDIR
);
831 #if defined(HAVE_TEXTDOMAIN)
832 textdomain(MODULE_NAME
);
835 /* set default debug level to 0 regardless of what smb.conf sets */
836 lp_set_cmdline("log level", "0");
837 c
->private_data
= net_func
;
839 pc
= poptGetContext(NULL
, argc
, (const char **) argv
, long_options
,
840 POPT_CONTEXT_KEEP_FIRST
);
842 while((opt
= poptGetNextOpt(pc
)) != -1) {
845 c
->display_usage
= true;
848 c
->smb_encrypt
= true;
851 if (!interpret_string_addr(&c
->opt_dest_ip
,
852 poptGetOptArg(pc
), 0)) {
853 d_fprintf(stderr
, _("\nInvalid ip address specified\n"));
855 c
->opt_have_ip
= true;
859 c
->opt_user_specified
= true;
860 c
->opt_user_name
= SMB_STRDUP(c
->opt_user_name
);
861 p
= strchr(c
->opt_user_name
,'%');
864 c
->opt_password
= p
+1;
868 d_fprintf(stderr
, _("\nInvalid option %s: %s\n"),
869 poptBadOption(pc
, 0), poptStrerror(opt
));
870 net_help(c
, argc
, argv
);
875 lp_load(get_dyn_CONFIGFILE(), true, false, false, true);
877 argv_new
= (const char **)poptGetArgs(pc
);
880 for (i
=0; i
<argc
; i
++) {
881 if (argv_new
[i
] == NULL
) {
887 if (c
->do_talloc_report
) {
888 talloc_enable_leak_report();
891 if (c
->opt_requester_name
) {
892 set_global_myname(c
->opt_requester_name
);
895 if (!c
->opt_user_name
&& getenv("LOGNAME")) {
896 c
->opt_user_name
= getenv("LOGNAME");
899 if (!c
->opt_workgroup
) {
900 c
->opt_workgroup
= smb_xstrdup(lp_workgroup());
903 if (!c
->opt_target_workgroup
) {
904 c
->opt_target_workgroup
= smb_xstrdup(lp_workgroup());
912 /* this makes sure that when we do things like call scripts,
913 that it won't assert because we are not root */
916 if (c
->opt_machine_pass
) {
917 /* it is very useful to be able to make ads queries as the
918 machine account for testing purposes and for domain leave */
920 net_use_krb_machine_account(c
);
923 if (!c
->opt_password
) {
924 c
->opt_password
= getenv("PASSWD");
927 c
->msg_ctx
= messaging_init(c
, procid_self(),
928 event_context_init(c
));
929 if (c
->msg_ctx
== NULL
) {
933 rc
= net_run_function(c
, argc_new
-1, argv_new
+1, "net", net_func
);
935 DEBUG(2,("return code = %d\n", rc
));
937 gencache_stabilize();
939 libnetapi_free(c
->netapi_ctx
);