2 Samba Unix/Linux SMB client library
3 Distributed SMB/CIFS Server Management Utility
4 Copyright (C) 2001 Andrew Bartlett (abartlet@samba.org)
5 Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
6 Copyright (C) 2004,2008 Guenther Deschner (gd@samba.org)
7 Copyright (C) 2005 Jeremy Allison (jra@samba.org)
8 Copyright (C) 2006 Jelmer Vernooij (jelmer@samba.org)
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>. */
24 #include "utils/net.h"
25 #include "rpc_client/cli_pipe.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../librpc/gen_ndr/ndr_samr_c.h"
28 #include "rpc_client/cli_samr.h"
29 #include "rpc_client/init_samr.h"
30 #include "../librpc/gen_ndr/ndr_lsa_c.h"
31 #include "rpc_client/cli_lsarpc.h"
32 #include "../librpc/gen_ndr/ndr_netlogon_c.h"
33 #include "../librpc/gen_ndr/ndr_srvsvc_c.h"
34 #include "../librpc/gen_ndr/ndr_spoolss.h"
35 #include "../librpc/gen_ndr/ndr_initshutdown_c.h"
36 #include "../librpc/gen_ndr/ndr_winreg_c.h"
38 #include "lib/netapi/netapi.h"
39 #include "lib/netapi/netapi_net.h"
40 #include "rpc_client/init_lsa.h"
41 #include "../libcli/security/security.h"
42 #include "libsmb/libsmb.h"
43 #include "libsmb/clirap.h"
44 #include "nsswitch/libwbclient/wbclient.h"
46 #include "../libcli/smb/smbXcli_base.h"
48 static int net_mode_share
;
49 static NTSTATUS
sync_files(struct copy_clistate
*cp_clistate
, const char *mask
);
54 * @brief RPC based subcommands for the 'net' utility.
56 * This file should contain much of the functionality that used to
57 * be found in rpcclient, execpt that the commands should change
58 * less often, and the fucntionality should be sane (the user is not
59 * expected to know a rid/sid before they conduct an operation etc.)
61 * @todo Perhaps eventually these should be split out into a number
62 * of files, as this could get quite big.
67 * Many of the RPC functions need the domain sid. This function gets
68 * it at the start of every run
70 * @param cli A cli_state already connected to the remote machine
72 * @return The Domain SID of the remote machine.
75 NTSTATUS
net_get_remote_domain_sid(struct cli_state
*cli
, TALLOC_CTX
*mem_ctx
,
76 struct dom_sid
**domain_sid
,
77 const char **domain_name
)
79 struct rpc_pipe_client
*lsa_pipe
= NULL
;
80 struct policy_handle pol
;
81 NTSTATUS status
, result
;
82 union lsa_PolicyInformation
*info
= NULL
;
83 struct dcerpc_binding_handle
*b
;
85 status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
87 if (!NT_STATUS_IS_OK(status
)) {
88 d_fprintf(stderr
, _("Could not initialise lsa pipe\n"));
92 b
= lsa_pipe
->binding_handle
;
94 status
= rpccli_lsa_open_policy(lsa_pipe
, mem_ctx
, false,
95 SEC_FLAG_MAXIMUM_ALLOWED
,
97 if (!NT_STATUS_IS_OK(status
)) {
98 d_fprintf(stderr
, "open_policy %s: %s\n",
104 status
= dcerpc_lsa_QueryInfoPolicy(b
, mem_ctx
,
106 LSA_POLICY_INFO_ACCOUNT_DOMAIN
,
109 if (!NT_STATUS_IS_OK(status
)) {
110 d_fprintf(stderr
, "lsaquery %s: %s\n",
115 if (!NT_STATUS_IS_OK(result
)) {
116 d_fprintf(stderr
, "lsaquery %s: %s\n",
122 *domain_name
= info
->account_domain
.name
.string
;
123 *domain_sid
= info
->account_domain
.sid
;
125 dcerpc_lsa_Close(b
, mem_ctx
, &pol
, &result
);
126 TALLOC_FREE(lsa_pipe
);
132 * Run a single RPC command, from start to finish.
134 * @param pipe_name the pipe to connect to (usually a PIPE_ constant)
135 * @param conn_flag a NET_FLAG_ combination. Passed to
136 * net_make_ipc_connection.
137 * @param argc Standard main() style argc.
138 * @param argv Standard main() style argv. Initial components are already
140 * @return A shell status integer (0 for success).
143 int run_rpc_command(struct net_context
*c
,
144 struct cli_state
*cli_arg
,
145 const struct ndr_interface_table
*table
,
151 struct cli_state
*cli
= NULL
;
152 struct rpc_pipe_client
*pipe_hnd
= NULL
;
155 struct dom_sid
*domain_sid
;
156 const char *domain_name
;
159 /* make use of cli_state handed over as an argument, if possible */
161 nt_status
= net_make_ipc_connection(c
, conn_flags
, &cli
);
162 if (!NT_STATUS_IS_OK(nt_status
)) {
163 DEBUG(1, ("failed to make ipc connection: %s\n",
164 nt_errstr(nt_status
)));
177 if (!(mem_ctx
= talloc_init("run_rpc_command"))) {
178 DEBUG(0, ("talloc_init() failed\n"));
182 nt_status
= net_get_remote_domain_sid(cli
, mem_ctx
, &domain_sid
,
184 if (!NT_STATUS_IS_OK(nt_status
)) {
188 if (!(conn_flags
& NET_FLAGS_NO_PIPE
)) {
189 if (lp_client_schannel()
190 && (ndr_syntax_id_equal(&table
->syntax_id
,
191 &ndr_table_netlogon
.syntax_id
))) {
192 /* Always try and create an schannel netlogon pipe. */
193 nt_status
= cli_rpc_pipe_open_schannel(
194 cli
, &table
->syntax_id
, NCACN_NP
,
195 DCERPC_AUTH_LEVEL_PRIVACY
, domain_name
,
197 if (!NT_STATUS_IS_OK(nt_status
)) {
198 DEBUG(0, ("Could not initialise schannel netlogon pipe. Error was %s\n",
199 nt_errstr(nt_status
) ));
203 if (conn_flags
& NET_FLAGS_SEAL
) {
204 nt_status
= cli_rpc_pipe_open_generic_auth(
206 (conn_flags
& NET_FLAGS_TCP
) ?
207 NCACN_IP_TCP
: NCACN_NP
,
208 DCERPC_AUTH_TYPE_NTLMSSP
,
209 DCERPC_AUTH_LEVEL_PRIVACY
,
210 smbXcli_conn_remote_name(cli
->conn
),
211 lp_workgroup(), c
->opt_user_name
,
212 c
->opt_password
, &pipe_hnd
);
214 nt_status
= cli_rpc_pipe_open_noauth(
215 cli
, &table
->syntax_id
,
218 if (!NT_STATUS_IS_OK(nt_status
)) {
219 DEBUG(0, ("Could not initialise pipe %s. Error was %s\n",
221 nt_errstr(nt_status
) ));
227 nt_status
= fn(c
, domain_sid
, domain_name
, cli
, pipe_hnd
, mem_ctx
, argc
, argv
);
229 if (!NT_STATUS_IS_OK(nt_status
)) {
230 DEBUG(1, ("rpc command function failed! (%s)\n", nt_errstr(nt_status
)));
233 DEBUG(5, ("rpc command function succedded\n"));
236 if (!(conn_flags
& NET_FLAGS_NO_PIPE
)) {
238 TALLOC_FREE(pipe_hnd
);
243 /* close the connection only if it was opened here */
248 talloc_destroy(mem_ctx
);
253 * Force a change of the trust acccount password.
255 * All parameters are provided by the run_rpc_command function, except for
256 * argc, argv which are passed through.
258 * @param domain_sid The domain sid acquired from the remote server.
259 * @param cli A cli_state connected to the server.
260 * @param mem_ctx Talloc context, destroyed on completion of the function.
261 * @param argc Standard main() style argc.
262 * @param argv Standard main() style argv. Initial components are already
265 * @return Normal NTSTATUS return.
268 static NTSTATUS
rpc_changetrustpw_internals(struct net_context
*c
,
269 const struct dom_sid
*domain_sid
,
270 const char *domain_name
,
271 struct cli_state
*cli
,
272 struct rpc_pipe_client
*pipe_hnd
,
279 status
= trust_pw_find_change_and_store_it(pipe_hnd
, mem_ctx
, c
->opt_target_workgroup
);
280 if (!NT_STATUS_IS_OK(status
)) {
281 d_fprintf(stderr
, _("Failed to change machine account password: %s\n"),
290 * Force a change of the trust acccount password.
292 * @param argc Standard main() style argc.
293 * @param argv Standard main() style argv. Initial components are already
296 * @return A shell status integer (0 for success).
299 int net_rpc_changetrustpw(struct net_context
*c
, int argc
, const char **argv
)
301 if (c
->display_usage
) {
303 "net rpc changetrustpw\n"
306 _("Change the machine trust password"));
310 return run_rpc_command(c
, NULL
, &ndr_table_netlogon
,
311 NET_FLAGS_ANONYMOUS
| NET_FLAGS_PDC
,
312 rpc_changetrustpw_internals
,
317 * Join a domain, the old way.
319 * This uses 'machinename' as the inital password, and changes it.
321 * The password should be created with 'server manager' or equiv first.
323 * All parameters are provided by the run_rpc_command function, except for
324 * argc, argv which are passed through.
326 * @param domain_sid The domain sid acquired from the remote server.
327 * @param cli A cli_state connected to the server.
328 * @param mem_ctx Talloc context, destroyed on completion of the function.
329 * @param argc Standard main() style argc.
330 * @param argv Standard main() style argv. Initial components are already
333 * @return Normal NTSTATUS return.
336 static NTSTATUS
rpc_oldjoin_internals(struct net_context
*c
,
337 const struct dom_sid
*domain_sid
,
338 const char *domain_name
,
339 struct cli_state
*cli
,
340 struct rpc_pipe_client
*pipe_hnd
,
346 fstring trust_passwd
;
347 unsigned char orig_trust_passwd_hash
[16];
349 enum netr_SchannelType sec_channel_type
;
351 result
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_netlogon
.syntax_id
,
353 if (!NT_STATUS_IS_OK(result
)) {
354 DEBUG(0,("rpc_oldjoin_internals: netlogon pipe open to machine %s failed. "
356 smbXcli_conn_remote_name(cli
->conn
),
357 nt_errstr(result
) ));
362 check what type of join - if the user want's to join as
363 a BDC, the server must agree that we are a BDC.
366 sec_channel_type
= get_sec_channel_type(argv
[0]);
368 sec_channel_type
= get_sec_channel_type(NULL
);
371 fstrcpy(trust_passwd
, lp_netbios_name());
372 if (!strlower_m(trust_passwd
)) {
373 return NT_STATUS_UNSUCCESSFUL
;
377 * Machine names can be 15 characters, but the max length on
378 * a password is 14. --jerry
381 trust_passwd
[14] = '\0';
383 E_md4hash(trust_passwd
, orig_trust_passwd_hash
);
385 result
= trust_pw_change_and_store_it(pipe_hnd
, mem_ctx
, c
->opt_target_workgroup
,
387 orig_trust_passwd_hash
,
390 if (NT_STATUS_IS_OK(result
))
391 printf(_("Joined domain %s.\n"), c
->opt_target_workgroup
);
394 if (!secrets_store_domain_sid(c
->opt_target_workgroup
, domain_sid
)) {
395 DEBUG(0, ("error storing domain sid for %s\n", c
->opt_target_workgroup
));
396 result
= NT_STATUS_UNSUCCESSFUL
;
403 * Join a domain, the old way.
405 * @param argc Standard main() style argc.
406 * @param argv Standard main() style argv. Initial components are already
409 * @return A shell status integer (0 for success).
412 static int net_rpc_perform_oldjoin(struct net_context
*c
, int argc
, const char **argv
)
414 return run_rpc_command(c
, NULL
, &ndr_table_netlogon
,
415 NET_FLAGS_NO_PIPE
| NET_FLAGS_ANONYMOUS
| NET_FLAGS_PDC
,
416 rpc_oldjoin_internals
,
421 * Join a domain, the old way. This function exists to allow
422 * the message to be displayed when oldjoin was explicitly
423 * requested, but not when it was implied by "net rpc join".
425 * @param argc Standard main() style argc.
426 * @param argv Standard main() style argv. Initial components are already
429 * @return A shell status integer (0 for success).
432 static int net_rpc_oldjoin(struct net_context
*c
, int argc
, const char **argv
)
436 if (c
->display_usage
) {
441 _("Join a domain the old way"));
445 rc
= net_rpc_perform_oldjoin(c
, argc
, argv
);
448 d_fprintf(stderr
, _("Failed to join domain\n"));
455 * 'net rpc join' entrypoint.
456 * @param argc Standard main() style argc.
457 * @param argv Standard main() style argv. Initial components are already
460 * Main 'net_rpc_join()' (where the admin username/password is used) is
462 * Try to just change the password, but if that doesn't work, use/prompt
463 * for a username/password.
466 int net_rpc_join(struct net_context
*c
, int argc
, const char **argv
)
468 if (c
->display_usage
) {
471 _("net rpc join -U <username>[%%password] <type>\n"
473 " username\tName of the admin user"
474 " password\tPassword of the admin user, will "
475 "prompt if not specified\n"
476 " type\tCan be one of the following:\n"
477 "\t\tMEMBER\tJoin as member server (default)\n"
478 "\t\tBDC\tJoin as BDC\n"
479 "\t\tPDC\tJoin as PDC\n"));
483 if (lp_server_role() == ROLE_STANDALONE
) {
484 d_printf(_("cannot join as standalone machine\n"));
488 if (strlen(lp_netbios_name()) > 15) {
489 d_printf(_("Our netbios name can be at most 15 chars long, "
490 "\"%s\" is %u chars long\n"),
491 lp_netbios_name(), (unsigned int)strlen(lp_netbios_name()));
495 if ((net_rpc_perform_oldjoin(c
, argc
, argv
) == 0))
498 return net_rpc_join_newstyle(c
, argc
, argv
);
502 * display info about a rpc domain
504 * All parameters are provided by the run_rpc_command function, except for
505 * argc, argv which are passed through.
507 * @param domain_sid The domain sid acquired from the remote server
508 * @param cli A cli_state connected to the server.
509 * @param mem_ctx Talloc context, destroyed on completion of the function.
510 * @param argc Standard main() style argc.
511 * @param argv Standard main() style argv. Initial components are already
514 * @return Normal NTSTATUS return.
517 NTSTATUS
rpc_info_internals(struct net_context
*c
,
518 const struct dom_sid
*domain_sid
,
519 const char *domain_name
,
520 struct cli_state
*cli
,
521 struct rpc_pipe_client
*pipe_hnd
,
526 struct policy_handle connect_pol
, domain_pol
;
527 NTSTATUS status
, result
;
528 union samr_DomainInfo
*info
= NULL
;
530 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
532 sid_to_fstring(sid_str
, domain_sid
);
534 /* Get sam policy handle */
535 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
537 MAXIMUM_ALLOWED_ACCESS
,
540 if (!NT_STATUS_IS_OK(status
)) {
541 d_fprintf(stderr
, _("Could not connect to SAM: %s\n"),
546 if (!NT_STATUS_IS_OK(result
)) {
548 d_fprintf(stderr
, _("Could not connect to SAM: %s\n"),
553 /* Get domain policy handle */
554 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
556 MAXIMUM_ALLOWED_ACCESS
,
557 discard_const_p(struct dom_sid2
, domain_sid
),
560 if (!NT_STATUS_IS_OK(status
)) {
561 d_fprintf(stderr
, _("Could not open domain: %s\n"),
565 if (!NT_STATUS_IS_OK(result
)) {
567 d_fprintf(stderr
, _("Could not open domain: %s\n"),
572 status
= dcerpc_samr_QueryDomainInfo(b
, mem_ctx
,
577 if (!NT_STATUS_IS_OK(status
)) {
581 if (NT_STATUS_IS_OK(result
)) {
582 d_printf(_("Domain Name: %s\n"),
583 info
->general
.domain_name
.string
);
584 d_printf(_("Domain SID: %s\n"), sid_str
);
585 d_printf(_("Sequence number: %llu\n"),
586 (unsigned long long)info
->general
.sequence_num
);
587 d_printf(_("Num users: %u\n"), info
->general
.num_users
);
588 d_printf(_("Num domain groups: %u\n"),info
->general
.num_groups
);
589 d_printf(_("Num local groups: %u\n"),info
->general
.num_aliases
);
597 * 'net rpc info' entrypoint.
598 * @param argc Standard main() style argc.
599 * @param argv Standard main() style argv. Initial components are already
603 int net_rpc_info(struct net_context
*c
, int argc
, const char **argv
)
605 if (c
->display_usage
) {
610 _("Display information about the domain"));
614 return run_rpc_command(c
, NULL
, &ndr_table_samr
,
615 NET_FLAGS_PDC
, rpc_info_internals
,
620 * Fetch domain SID into the local secrets.tdb.
622 * All parameters are provided by the run_rpc_command function, except for
623 * argc, argv which are passed through.
625 * @param domain_sid The domain sid acquired from the remote server.
626 * @param cli A cli_state connected to the server.
627 * @param mem_ctx Talloc context, destroyed on completion of the function.
628 * @param argc Standard main() style argc.
629 * @param argv Standard main() style argv. Initial components are already
632 * @return Normal NTSTATUS return.
635 static NTSTATUS
rpc_getsid_internals(struct net_context
*c
,
636 const struct dom_sid
*domain_sid
,
637 const char *domain_name
,
638 struct cli_state
*cli
,
639 struct rpc_pipe_client
*pipe_hnd
,
646 sid_to_fstring(sid_str
, domain_sid
);
647 d_printf(_("Storing SID %s for Domain %s in secrets.tdb\n"),
648 sid_str
, domain_name
);
650 if (!secrets_store_domain_sid(domain_name
, domain_sid
)) {
651 DEBUG(0,("Can't store domain SID\n"));
652 return NT_STATUS_UNSUCCESSFUL
;
659 * 'net rpc getsid' entrypoint.
660 * @param argc Standard main() style argc.
661 * @param argv Standard main() style argv. Initial components are already
665 int net_rpc_getsid(struct net_context
*c
, int argc
, const char **argv
)
667 int conn_flags
= NET_FLAGS_PDC
;
669 if (!c
->opt_user_specified
) {
670 conn_flags
|= NET_FLAGS_ANONYMOUS
;
673 if (c
->display_usage
) {
678 _("Fetch domain SID into local secrets.tdb"));
682 return run_rpc_command(c
, NULL
, &ndr_table_samr
,
684 rpc_getsid_internals
,
688 /****************************************************************************/
691 * Basic usage function for 'net rpc user'.
692 * @param argc Standard main() style argc.
693 * @param argv Standard main() style argv. Initial components are already
697 static int rpc_user_usage(struct net_context
*c
, int argc
, const char **argv
)
699 return net_user_usage(c
, argc
, argv
);
703 * Add a new user to a remote RPC server.
705 * @param argc Standard main() style argc.
706 * @param argv Standard main() style argv. Initial components are already
709 * @return A shell status integer (0 for success).
712 static int rpc_user_add(struct net_context
*c
, int argc
, const char **argv
)
714 NET_API_STATUS status
;
715 struct USER_INFO_1 info1
;
716 uint32_t parm_error
= 0;
718 if (argc
< 1 || c
->display_usage
) {
719 rpc_user_usage(c
, argc
, argv
);
725 info1
.usri1_name
= argv
[0];
727 info1
.usri1_password
= argv
[1];
730 status
= NetUserAdd(c
->opt_host
, 1, (uint8_t *)&info1
, &parm_error
);
733 d_fprintf(stderr
,_("Failed to add user '%s' with error: %s.\n"),
734 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
738 d_printf(_("Added user '%s'.\n"), argv
[0]);
745 * Rename a user on a remote RPC server.
747 * @param argc Standard main() style argc.
748 * @param argv Standard main() style argv. Initial components are already
751 * @return A shell status integer (0 for success).
754 static int rpc_user_rename(struct net_context
*c
, int argc
, const char **argv
)
756 NET_API_STATUS status
;
757 struct USER_INFO_0 u0
;
758 uint32_t parm_err
= 0;
760 if (argc
!= 2 || c
->display_usage
) {
761 rpc_user_usage(c
, argc
, argv
);
765 u0
.usri0_name
= argv
[1];
767 status
= NetUserSetInfo(c
->opt_host
, argv
[0],
768 0, (uint8_t *)&u0
, &parm_err
);
771 _("Failed to rename user from %s to %s - %s\n"),
773 libnetapi_get_error_string(c
->netapi_ctx
, status
));
775 d_printf(_("Renamed user from %s to %s\n"), argv
[0], argv
[1]);
782 * Set a user's primary group
784 * @param argc Standard main() style argc.
785 * @param argv Standard main() style argv. Initial components are already
788 * @return A shell status integer (0 for success).
791 static int rpc_user_setprimarygroup(struct net_context
*c
, int argc
,
794 NET_API_STATUS status
;
796 struct GROUP_INFO_2
*g2
;
797 struct USER_INFO_1051 u1051
;
798 uint32_t parm_err
= 0;
800 if (argc
!= 2 || c
->display_usage
) {
801 rpc_user_usage(c
, argc
, argv
);
805 status
= NetGroupGetInfo(c
->opt_host
, argv
[1], 2, &buffer
);
807 d_fprintf(stderr
, _("Failed to find group name %s -- %s\n"),
809 libnetapi_get_error_string(c
->netapi_ctx
, status
));
812 g2
= (struct GROUP_INFO_2
*)buffer
;
814 u1051
.usri1051_primary_group_id
= g2
->grpi2_group_id
;
816 NetApiBufferFree(buffer
);
818 status
= NetUserSetInfo(c
->opt_host
, argv
[0], 1051,
819 (uint8_t *)&u1051
, &parm_err
);
822 _("Failed to set user's primary group %s to %s - "
823 "%s\n"), argv
[0], argv
[1],
824 libnetapi_get_error_string(c
->netapi_ctx
, status
));
826 d_printf(_("Set primary group of user %s to %s\n"), argv
[0],
833 * Delete a user from a remote RPC server.
835 * @param argc Standard main() style argc.
836 * @param argv Standard main() style argv. Initial components are already
839 * @return A shell status integer (0 for success).
842 static int rpc_user_delete(struct net_context
*c
, int argc
, const char **argv
)
844 NET_API_STATUS status
;
846 if (argc
< 1 || c
->display_usage
) {
847 rpc_user_usage(c
, argc
, argv
);
851 status
= NetUserDel(c
->opt_host
, argv
[0]);
854 d_fprintf(stderr
, _("Failed to delete user '%s' with: %s.\n"),
856 libnetapi_get_error_string(c
->netapi_ctx
, status
));
859 d_printf(_("Deleted user '%s'.\n"), argv
[0]);
866 * Set a user's password on a remote RPC server.
868 * @param argc Standard main() style argc.
869 * @param argv Standard main() style argv. Initial components are already
872 * @return A shell status integer (0 for success).
875 static int rpc_user_password(struct net_context
*c
, int argc
, const char **argv
)
877 NET_API_STATUS status
;
879 struct USER_INFO_1003 u1003
;
880 uint32_t parm_err
= 0;
883 if (argc
< 1 || c
->display_usage
) {
884 rpc_user_usage(c
, argc
, argv
);
889 u1003
.usri1003_password
= argv
[1];
892 ret
= asprintf(&prompt
, _("Enter new password for %s:"),
898 ret
= samba_getpass(prompt
, pwd
, sizeof(pwd
), false, false);
904 u1003
.usri1003_password
= talloc_strdup(c
, pwd
);
905 if (u1003
.usri1003_password
== NULL
) {
910 status
= NetUserSetInfo(c
->opt_host
, argv
[0], 1003, (uint8_t *)&u1003
, &parm_err
);
912 /* Display results */
915 _("Failed to set password for '%s' with error: %s.\n"),
916 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
925 * List a user's groups from a remote RPC server.
927 * @param argc Standard main() style argc.
928 * @param argv Standard main() style argv. Initial components are already
931 * @return A shell status integer (0 for success)
934 static int rpc_user_info(struct net_context
*c
, int argc
, const char **argv
)
937 NET_API_STATUS status
;
938 struct GROUP_USERS_INFO_0
*u0
= NULL
;
939 uint32_t entries_read
= 0;
940 uint32_t total_entries
= 0;
944 if (argc
< 1 || c
->display_usage
) {
945 rpc_user_usage(c
, argc
, argv
);
949 status
= NetUserGetGroups(c
->opt_host
,
952 (uint8_t **)(void *)&u0
,
958 _("Failed to get groups for '%s' with error: %s.\n"),
959 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
964 for (i
=0; i
< entries_read
; i
++) {
965 printf("%s\n", u0
->grui0_name
);
973 * List users on a remote RPC server.
975 * All parameters are provided by the run_rpc_command function, except for
976 * argc, argv which are passed through.
978 * @param domain_sid The domain sid acquired from the remote server.
979 * @param cli A cli_state connected to the server.
980 * @param mem_ctx Talloc context, destroyed on completion of the function.
981 * @param argc Standard main() style argc.
982 * @param argv Standard main() style argv. Initial components are already
985 * @return Normal NTSTATUS return.
988 static int rpc_user_list(struct net_context
*c
, int argc
, const char **argv
)
990 NET_API_STATUS status
;
991 uint32_t start_idx
=0, num_entries
, i
, loop_count
= 0;
992 struct NET_DISPLAY_USER
*info
= NULL
;
995 /* Query domain users */
996 if (c
->opt_long_list_entries
)
997 d_printf(_("\nUser name Comment"
998 "\n-----------------------------\n"));
1000 uint32_t max_entries
, max_size
;
1002 dcerpc_get_query_dispinfo_params(
1003 loop_count
, &max_entries
, &max_size
);
1005 status
= NetQueryDisplayInformation(c
->opt_host
,
1012 if (status
!= 0 && status
!= ERROR_MORE_DATA
) {
1016 info
= (struct NET_DISPLAY_USER
*)buffer
;
1018 for (i
= 0; i
< num_entries
; i
++) {
1020 if (c
->opt_long_list_entries
)
1021 printf("%-21.21s %s\n", info
->usri1_name
,
1022 info
->usri1_comment
);
1024 printf("%s\n", info
->usri1_name
);
1028 NetApiBufferFree(buffer
);
1031 start_idx
+= num_entries
;
1033 } while (status
== ERROR_MORE_DATA
);
1039 * 'net rpc user' entrypoint.
1040 * @param argc Standard main() style argc.
1041 * @param argv Standard main() style argv. Initial components are already
1045 int net_rpc_user(struct net_context
*c
, int argc
, const char **argv
)
1047 NET_API_STATUS status
;
1049 struct functable func
[] = {
1054 N_("Add specified user"),
1055 N_("net rpc user add\n"
1056 " Add specified user")
1062 N_("List domain groups of user"),
1063 N_("net rpc user info\n"
1064 " List domain groups of user")
1070 N_("Remove specified user"),
1071 N_("net rpc user delete\n"
1072 " Remove specified user")
1078 N_("Change user password"),
1079 N_("net rpc user password\n"
1080 " Change user password")
1086 N_("Rename specified user"),
1087 N_("net rpc user rename\n"
1088 " Rename specified user")
1092 rpc_user_setprimarygroup
,
1094 "Set a user's primary group",
1095 "net rpc user setprimarygroup\n"
1096 " Set a user's primary group"
1098 {NULL
, NULL
, 0, NULL
, NULL
}
1101 status
= libnetapi_net_init(&c
->netapi_ctx
);
1105 libnetapi_set_username(c
->netapi_ctx
, c
->opt_user_name
);
1106 libnetapi_set_password(c
->netapi_ctx
, c
->opt_password
);
1107 if (c
->opt_kerberos
) {
1108 libnetapi_set_use_kerberos(c
->netapi_ctx
);
1112 if (c
->display_usage
) {
1117 _("List all users"));
1118 net_display_usage_from_functable(func
);
1122 return rpc_user_list(c
, argc
, argv
);
1125 return net_run_function(c
, argc
, argv
, "net rpc user", func
);
1128 static NTSTATUS
rpc_sh_user_list(struct net_context
*c
,
1129 TALLOC_CTX
*mem_ctx
,
1130 struct rpc_sh_ctx
*ctx
,
1131 struct rpc_pipe_client
*pipe_hnd
,
1132 int argc
, const char **argv
)
1134 return werror_to_ntstatus(W_ERROR(rpc_user_list(c
, argc
, argv
)));
1137 static NTSTATUS
rpc_sh_user_info(struct net_context
*c
,
1138 TALLOC_CTX
*mem_ctx
,
1139 struct rpc_sh_ctx
*ctx
,
1140 struct rpc_pipe_client
*pipe_hnd
,
1141 int argc
, const char **argv
)
1143 return werror_to_ntstatus(W_ERROR(rpc_user_info(c
, argc
, argv
)));
1146 static NTSTATUS
rpc_sh_handle_user(struct net_context
*c
,
1147 TALLOC_CTX
*mem_ctx
,
1148 struct rpc_sh_ctx
*ctx
,
1149 struct rpc_pipe_client
*pipe_hnd
,
1150 int argc
, const char **argv
,
1152 struct net_context
*c
,
1153 TALLOC_CTX
*mem_ctx
,
1154 struct rpc_sh_ctx
*ctx
,
1155 struct rpc_pipe_client
*pipe_hnd
,
1156 struct policy_handle
*user_hnd
,
1157 int argc
, const char **argv
))
1159 struct policy_handle connect_pol
, domain_pol
, user_pol
;
1160 NTSTATUS status
, result
;
1163 enum lsa_SidType type
;
1164 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
1167 d_fprintf(stderr
, "%s %s <username>\n", _("Usage:"),
1169 return NT_STATUS_INVALID_PARAMETER
;
1172 ZERO_STRUCT(connect_pol
);
1173 ZERO_STRUCT(domain_pol
);
1174 ZERO_STRUCT(user_pol
);
1176 status
= net_rpc_lookup_name(c
, mem_ctx
, rpc_pipe_np_smb_conn(pipe_hnd
),
1177 argv
[0], NULL
, NULL
, &sid
, &type
);
1178 if (!NT_STATUS_IS_OK(status
)) {
1179 d_fprintf(stderr
, _("Could not lookup %s: %s\n"), argv
[0],
1184 if (type
!= SID_NAME_USER
) {
1185 d_fprintf(stderr
, _("%s is a %s, not a user\n"), argv
[0],
1186 sid_type_lookup(type
));
1187 status
= NT_STATUS_NO_SUCH_USER
;
1191 if (!sid_peek_check_rid(ctx
->domain_sid
, &sid
, &rid
)) {
1192 d_fprintf(stderr
, _("%s is not in our domain\n"), argv
[0]);
1193 status
= NT_STATUS_NO_SUCH_USER
;
1197 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
1199 MAXIMUM_ALLOWED_ACCESS
,
1202 if (!NT_STATUS_IS_OK(status
)) {
1205 if (!NT_STATUS_IS_OK(result
)) {
1210 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
1212 MAXIMUM_ALLOWED_ACCESS
,
1216 if (!NT_STATUS_IS_OK(status
)) {
1219 if (!NT_STATUS_IS_OK(result
)) {
1224 status
= dcerpc_samr_OpenUser(b
, mem_ctx
,
1226 MAXIMUM_ALLOWED_ACCESS
,
1230 if (!NT_STATUS_IS_OK(status
)) {
1233 if (!NT_STATUS_IS_OK(result
)) {
1238 status
= fn(c
, mem_ctx
, ctx
, pipe_hnd
, &user_pol
, argc
-1, argv
+1);
1241 if (is_valid_policy_hnd(&user_pol
)) {
1242 dcerpc_samr_Close(b
, mem_ctx
, &user_pol
, &result
);
1244 if (is_valid_policy_hnd(&domain_pol
)) {
1245 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
1247 if (is_valid_policy_hnd(&connect_pol
)) {
1248 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
1253 static NTSTATUS
rpc_sh_user_show_internals(struct net_context
*c
,
1254 TALLOC_CTX
*mem_ctx
,
1255 struct rpc_sh_ctx
*ctx
,
1256 struct rpc_pipe_client
*pipe_hnd
,
1257 struct policy_handle
*user_hnd
,
1258 int argc
, const char **argv
)
1260 NTSTATUS status
, result
;
1261 union samr_UserInfo
*info
= NULL
;
1262 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
1265 d_fprintf(stderr
, "%s %s show <username>\n", _("Usage:"),
1267 return NT_STATUS_INVALID_PARAMETER
;
1270 status
= dcerpc_samr_QueryUserInfo(b
, mem_ctx
,
1275 if (!NT_STATUS_IS_OK(status
)) {
1278 if (!NT_STATUS_IS_OK(result
)) {
1282 d_printf(_("user rid: %d, group rid: %d\n"),
1284 info
->info21
.primary_gid
);
1289 static NTSTATUS
rpc_sh_user_show(struct net_context
*c
,
1290 TALLOC_CTX
*mem_ctx
,
1291 struct rpc_sh_ctx
*ctx
,
1292 struct rpc_pipe_client
*pipe_hnd
,
1293 int argc
, const char **argv
)
1295 return rpc_sh_handle_user(c
, mem_ctx
, ctx
, pipe_hnd
, argc
, argv
,
1296 rpc_sh_user_show_internals
);
1299 #define FETCHSTR(name, rec) \
1300 do { if (strequal(ctx->thiscmd, name)) { \
1301 oldval = talloc_strdup(mem_ctx, info->info21.rec.string); } \
1304 #define SETSTR(name, rec, flag) \
1305 do { if (strequal(ctx->thiscmd, name)) { \
1306 init_lsa_String(&(info->info21.rec), argv[0]); \
1307 info->info21.fields_present |= SAMR_FIELD_##flag; } \
1310 static NTSTATUS
rpc_sh_user_str_edit_internals(struct net_context
*c
,
1311 TALLOC_CTX
*mem_ctx
,
1312 struct rpc_sh_ctx
*ctx
,
1313 struct rpc_pipe_client
*pipe_hnd
,
1314 struct policy_handle
*user_hnd
,
1315 int argc
, const char **argv
)
1317 NTSTATUS status
, result
;
1318 const char *username
;
1319 const char *oldval
= "";
1320 union samr_UserInfo
*info
= NULL
;
1321 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
1324 d_fprintf(stderr
, "%s %s <username> [new value|NULL]\n",
1325 _("Usage:"), ctx
->whoami
);
1326 return NT_STATUS_INVALID_PARAMETER
;
1329 status
= dcerpc_samr_QueryUserInfo(b
, mem_ctx
,
1334 if (!NT_STATUS_IS_OK(status
)) {
1337 if (!NT_STATUS_IS_OK(result
)) {
1341 username
= talloc_strdup(mem_ctx
, info
->info21
.account_name
.string
);
1343 FETCHSTR("fullname", full_name
);
1344 FETCHSTR("homedir", home_directory
);
1345 FETCHSTR("homedrive", home_drive
);
1346 FETCHSTR("logonscript", logon_script
);
1347 FETCHSTR("profilepath", profile_path
);
1348 FETCHSTR("description", description
);
1351 d_printf(_("%s's %s: [%s]\n"), username
, ctx
->thiscmd
, oldval
);
1355 if (strcmp(argv
[0], "NULL") == 0) {
1359 ZERO_STRUCT(info
->info21
);
1361 SETSTR("fullname", full_name
, FULL_NAME
);
1362 SETSTR("homedir", home_directory
, HOME_DIRECTORY
);
1363 SETSTR("homedrive", home_drive
, HOME_DRIVE
);
1364 SETSTR("logonscript", logon_script
, LOGON_SCRIPT
);
1365 SETSTR("profilepath", profile_path
, PROFILE_PATH
);
1366 SETSTR("description", description
, DESCRIPTION
);
1368 status
= dcerpc_samr_SetUserInfo(b
, mem_ctx
,
1373 if (!NT_STATUS_IS_OK(status
)) {
1379 d_printf(_("Set %s's %s from [%s] to [%s]\n"), username
,
1380 ctx
->thiscmd
, oldval
, argv
[0]);
1387 #define HANDLEFLG(name, rec) \
1388 do { if (strequal(ctx->thiscmd, name)) { \
1389 oldval = (oldflags & ACB_##rec) ? "yes" : "no"; \
1391 newflags = oldflags | ACB_##rec; \
1393 newflags = oldflags & ~ACB_##rec; \
1396 static NTSTATUS
rpc_sh_user_str_edit(struct net_context
*c
,
1397 TALLOC_CTX
*mem_ctx
,
1398 struct rpc_sh_ctx
*ctx
,
1399 struct rpc_pipe_client
*pipe_hnd
,
1400 int argc
, const char **argv
)
1402 return rpc_sh_handle_user(c
, mem_ctx
, ctx
, pipe_hnd
, argc
, argv
,
1403 rpc_sh_user_str_edit_internals
);
1406 static NTSTATUS
rpc_sh_user_flag_edit_internals(struct net_context
*c
,
1407 TALLOC_CTX
*mem_ctx
,
1408 struct rpc_sh_ctx
*ctx
,
1409 struct rpc_pipe_client
*pipe_hnd
,
1410 struct policy_handle
*user_hnd
,
1411 int argc
, const char **argv
)
1413 NTSTATUS status
, result
;
1414 const char *username
;
1415 const char *oldval
= "unknown";
1416 uint32 oldflags
, newflags
;
1418 union samr_UserInfo
*info
= NULL
;
1419 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
1422 ((argc
== 1) && !strequal(argv
[0], "yes") &&
1423 !strequal(argv
[0], "no"))) {
1424 /* TRANSATORS: The yes|no here are program keywords. Please do
1426 d_fprintf(stderr
, _("Usage: %s <username> [yes|no]\n"),
1428 return NT_STATUS_INVALID_PARAMETER
;
1431 newval
= strequal(argv
[0], "yes");
1433 status
= dcerpc_samr_QueryUserInfo(b
, mem_ctx
,
1438 if (!NT_STATUS_IS_OK(status
)) {
1441 if (!NT_STATUS_IS_OK(result
)) {
1445 username
= talloc_strdup(mem_ctx
, info
->info21
.account_name
.string
);
1446 oldflags
= info
->info21
.acct_flags
;
1447 newflags
= info
->info21
.acct_flags
;
1449 HANDLEFLG("disabled", DISABLED
);
1450 HANDLEFLG("pwnotreq", PWNOTREQ
);
1451 HANDLEFLG("autolock", AUTOLOCK
);
1452 HANDLEFLG("pwnoexp", PWNOEXP
);
1455 d_printf(_("%s's %s flag: %s\n"), username
, ctx
->thiscmd
,
1460 ZERO_STRUCT(info
->info21
);
1462 info
->info21
.acct_flags
= newflags
;
1463 info
->info21
.fields_present
= SAMR_FIELD_ACCT_FLAGS
;
1465 status
= dcerpc_samr_SetUserInfo(b
, mem_ctx
,
1470 if (!NT_STATUS_IS_OK(status
)) {
1474 if (NT_STATUS_IS_OK(result
)) {
1475 d_printf(_("Set %s's %s flag from [%s] to [%s]\n"), username
,
1476 ctx
->thiscmd
, oldval
, argv
[0]);
1484 static NTSTATUS
rpc_sh_user_flag_edit(struct net_context
*c
,
1485 TALLOC_CTX
*mem_ctx
,
1486 struct rpc_sh_ctx
*ctx
,
1487 struct rpc_pipe_client
*pipe_hnd
,
1488 int argc
, const char **argv
)
1490 return rpc_sh_handle_user(c
, mem_ctx
, ctx
, pipe_hnd
, argc
, argv
,
1491 rpc_sh_user_flag_edit_internals
);
1494 struct rpc_sh_cmd
*net_rpc_user_edit_cmds(struct net_context
*c
,
1495 TALLOC_CTX
*mem_ctx
,
1496 struct rpc_sh_ctx
*ctx
)
1498 static struct rpc_sh_cmd cmds
[] = {
1500 { "fullname", NULL
, &ndr_table_samr
, rpc_sh_user_str_edit
,
1501 N_("Show/Set a user's full name") },
1503 { "homedir", NULL
, &ndr_table_samr
, rpc_sh_user_str_edit
,
1504 N_("Show/Set a user's home directory") },
1506 { "homedrive", NULL
, &ndr_table_samr
, rpc_sh_user_str_edit
,
1507 N_("Show/Set a user's home drive") },
1509 { "logonscript", NULL
, &ndr_table_samr
, rpc_sh_user_str_edit
,
1510 N_("Show/Set a user's logon script") },
1512 { "profilepath", NULL
, &ndr_table_samr
, rpc_sh_user_str_edit
,
1513 N_("Show/Set a user's profile path") },
1515 { "description", NULL
, &ndr_table_samr
, rpc_sh_user_str_edit
,
1516 N_("Show/Set a user's description") },
1518 { "disabled", NULL
, &ndr_table_samr
, rpc_sh_user_flag_edit
,
1519 N_("Show/Set whether a user is disabled") },
1521 { "autolock", NULL
, &ndr_table_samr
, rpc_sh_user_flag_edit
,
1522 N_("Show/Set whether a user locked out") },
1524 { "pwnotreq", NULL
, &ndr_table_samr
, rpc_sh_user_flag_edit
,
1525 N_("Show/Set whether a user does not need a password") },
1527 { "pwnoexp", NULL
, &ndr_table_samr
, rpc_sh_user_flag_edit
,
1528 N_("Show/Set whether a user's password does not expire") },
1530 { NULL
, NULL
, 0, NULL
, NULL
}
1536 struct rpc_sh_cmd
*net_rpc_user_cmds(struct net_context
*c
,
1537 TALLOC_CTX
*mem_ctx
,
1538 struct rpc_sh_ctx
*ctx
)
1540 static struct rpc_sh_cmd cmds
[] = {
1542 { "list", NULL
, &ndr_table_samr
, rpc_sh_user_list
,
1543 N_("List available users") },
1545 { "info", NULL
, &ndr_table_samr
, rpc_sh_user_info
,
1546 N_("List the domain groups a user is member of") },
1548 { "show", NULL
, &ndr_table_samr
, rpc_sh_user_show
,
1549 N_("Show info about a user") },
1551 { "edit", net_rpc_user_edit_cmds
, 0, NULL
,
1552 N_("Show/Modify a user's fields") },
1554 { NULL
, NULL
, 0, NULL
, NULL
}
1560 /****************************************************************************/
1563 * Basic usage function for 'net rpc group'.
1564 * @param argc Standard main() style argc.
1565 * @param argv Standard main() style argv. Initial components are already
1569 static int rpc_group_usage(struct net_context
*c
, int argc
, const char **argv
)
1571 return net_group_usage(c
, argc
, argv
);
1575 * Delete group on a remote RPC server.
1577 * All parameters are provided by the run_rpc_command function, except for
1578 * argc, argv which are passed through.
1580 * @param domain_sid The domain sid acquired from the remote server.
1581 * @param cli A cli_state connected to the server.
1582 * @param mem_ctx Talloc context, destroyed on completion of the function.
1583 * @param argc Standard main() style argc.
1584 * @param argv Standard main() style argv. Initial components are already
1587 * @return Normal NTSTATUS return.
1590 static NTSTATUS
rpc_group_delete_internals(struct net_context
*c
,
1591 const struct dom_sid
*domain_sid
,
1592 const char *domain_name
,
1593 struct cli_state
*cli
,
1594 struct rpc_pipe_client
*pipe_hnd
,
1595 TALLOC_CTX
*mem_ctx
,
1599 struct policy_handle connect_pol
, domain_pol
, group_pol
, user_pol
;
1600 bool group_is_primary
= false;
1601 NTSTATUS status
, result
;
1603 struct samr_RidAttrArray
*rids
= NULL
;
1606 /* struct samr_RidWithAttribute *user_gids; */
1607 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
1609 struct samr_Ids group_rids
, name_types
;
1610 struct lsa_String lsa_acct_name
;
1611 union samr_UserInfo
*info
= NULL
;
1613 if (argc
< 1 || c
->display_usage
) {
1614 rpc_group_usage(c
, argc
,argv
);
1615 return NT_STATUS_OK
; /* ok? */
1618 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
1620 MAXIMUM_ALLOWED_ACCESS
,
1623 if (!NT_STATUS_IS_OK(status
)) {
1624 d_fprintf(stderr
, _("Request samr_Connect2 failed\n"));
1628 if (!NT_STATUS_IS_OK(result
)) {
1630 d_fprintf(stderr
, _("Request samr_Connect2 failed\n"));
1634 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
1636 MAXIMUM_ALLOWED_ACCESS
,
1637 discard_const_p(struct dom_sid2
, domain_sid
),
1640 if (!NT_STATUS_IS_OK(status
)) {
1641 d_fprintf(stderr
, _("Request open_domain failed\n"));
1645 if (!NT_STATUS_IS_OK(result
)) {
1647 d_fprintf(stderr
, _("Request open_domain failed\n"));
1651 init_lsa_String(&lsa_acct_name
, argv
[0]);
1653 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
1660 if (!NT_STATUS_IS_OK(status
)) {
1661 d_fprintf(stderr
, _("Lookup of '%s' failed\n"),argv
[0]);
1665 if (!NT_STATUS_IS_OK(result
)) {
1667 d_fprintf(stderr
, _("Lookup of '%s' failed\n"),argv
[0]);
1671 switch (name_types
.ids
[0])
1673 case SID_NAME_DOM_GRP
:
1674 status
= dcerpc_samr_OpenGroup(b
, mem_ctx
,
1676 MAXIMUM_ALLOWED_ACCESS
,
1680 if (!NT_STATUS_IS_OK(status
)) {
1681 d_fprintf(stderr
, _("Request open_group failed"));
1685 if (!NT_STATUS_IS_OK(result
)) {
1687 d_fprintf(stderr
, _("Request open_group failed"));
1691 group_rid
= group_rids
.ids
[0];
1693 status
= dcerpc_samr_QueryGroupMember(b
, mem_ctx
,
1697 if (!NT_STATUS_IS_OK(status
)) {
1699 _("Unable to query group members of %s"),
1704 if (!NT_STATUS_IS_OK(result
)) {
1707 _("Unable to query group members of %s"),
1712 if (c
->opt_verbose
) {
1714 _("Domain Group %s (rid: %d) has %d members\n"),
1715 argv
[0],group_rid
, rids
->count
);
1718 /* Check if group is anyone's primary group */
1719 for (i
= 0; i
< rids
->count
; i
++)
1721 status
= dcerpc_samr_OpenUser(b
, mem_ctx
,
1723 MAXIMUM_ALLOWED_ACCESS
,
1727 if (!NT_STATUS_IS_OK(status
)) {
1729 _("Unable to open group member %d\n"),
1734 if (!NT_STATUS_IS_OK(result
)) {
1737 _("Unable to open group member %d\n"),
1742 status
= dcerpc_samr_QueryUserInfo(b
, mem_ctx
,
1747 if (!NT_STATUS_IS_OK(status
)) {
1749 _("Unable to lookup userinfo for group "
1755 if (!NT_STATUS_IS_OK(result
)) {
1758 _("Unable to lookup userinfo for group "
1764 if (info
->info21
.primary_gid
== group_rid
) {
1765 if (c
->opt_verbose
) {
1766 d_printf(_("Group is primary group "
1768 info
->info21
.account_name
.string
);
1770 group_is_primary
= true;
1773 dcerpc_samr_Close(b
, mem_ctx
, &user_pol
, &result
);
1776 if (group_is_primary
) {
1777 d_fprintf(stderr
, _("Unable to delete group because "
1778 "some of it's members have it as primary "
1780 status
= NT_STATUS_MEMBERS_PRIMARY_GROUP
;
1784 /* remove all group members */
1785 for (i
= 0; i
< rids
->count
; i
++)
1788 d_printf(_("Remove group member %d..."),
1790 status
= dcerpc_samr_DeleteGroupMember(b
, mem_ctx
,
1794 if (!NT_STATUS_IS_OK(status
)) {
1798 if (NT_STATUS_IS_OK(result
)) {
1800 d_printf(_("ok\n"));
1803 d_printf("%s\n", _("failed"));
1808 status
= dcerpc_samr_DeleteDomainGroup(b
, mem_ctx
,
1811 if (!NT_STATUS_IS_OK(status
)) {
1818 /* removing a local group is easier... */
1819 case SID_NAME_ALIAS
:
1820 status
= dcerpc_samr_OpenAlias(b
, mem_ctx
,
1822 MAXIMUM_ALLOWED_ACCESS
,
1826 if (!NT_STATUS_IS_OK(status
)) {
1827 d_fprintf(stderr
, _("Request open_alias failed\n"));
1830 if (!NT_STATUS_IS_OK(result
)) {
1832 d_fprintf(stderr
, _("Request open_alias failed\n"));
1836 status
= dcerpc_samr_DeleteDomAlias(b
, mem_ctx
,
1839 if (!NT_STATUS_IS_OK(status
)) {
1847 d_fprintf(stderr
, _("%s is of type %s. This command is only "
1848 "for deleting local or global groups\n"),
1849 argv
[0],sid_type_lookup(name_types
.ids
[0]));
1850 status
= NT_STATUS_UNSUCCESSFUL
;
1854 if (NT_STATUS_IS_OK(status
)) {
1856 d_printf(_("Deleted %s '%s'\n"),
1857 sid_type_lookup(name_types
.ids
[0]), argv
[0]);
1859 d_fprintf(stderr
, _("Deleting of %s failed: %s\n"), argv
[0],
1860 get_friendly_nt_error_msg(status
));
1868 static int rpc_group_delete(struct net_context
*c
, int argc
, const char **argv
)
1870 return run_rpc_command(c
, NULL
, &ndr_table_samr
, 0,
1871 rpc_group_delete_internals
, argc
,argv
);
1874 static int rpc_group_add_internals(struct net_context
*c
, int argc
, const char **argv
)
1876 NET_API_STATUS status
;
1877 struct GROUP_INFO_1 info1
;
1878 uint32_t parm_error
= 0;
1880 if (argc
!= 1 || c
->display_usage
) {
1881 rpc_group_usage(c
, argc
, argv
);
1887 info1
.grpi1_name
= argv
[0];
1888 if (c
->opt_comment
&& strlen(c
->opt_comment
) > 0) {
1889 info1
.grpi1_comment
= c
->opt_comment
;
1892 status
= NetGroupAdd(c
->opt_host
, 1, (uint8_t *)&info1
, &parm_error
);
1896 _("Failed to add group '%s' with error: %s.\n"),
1897 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
1901 d_printf(_("Added group '%s'.\n"), argv
[0]);
1907 static int rpc_alias_add_internals(struct net_context
*c
, int argc
, const char **argv
)
1909 NET_API_STATUS status
;
1910 struct LOCALGROUP_INFO_1 info1
;
1911 uint32_t parm_error
= 0;
1913 if (argc
!= 1 || c
->display_usage
) {
1914 rpc_group_usage(c
, argc
, argv
);
1920 info1
.lgrpi1_name
= argv
[0];
1921 if (c
->opt_comment
&& strlen(c
->opt_comment
) > 0) {
1922 info1
.lgrpi1_comment
= c
->opt_comment
;
1925 status
= NetLocalGroupAdd(c
->opt_host
, 1, (uint8_t *)&info1
, &parm_error
);
1929 _("Failed to add alias '%s' with error: %s.\n"),
1930 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
1934 d_printf(_("Added alias '%s'.\n"), argv
[0]);
1940 static int rpc_group_add(struct net_context
*c
, int argc
, const char **argv
)
1942 if (c
->opt_localgroup
)
1943 return rpc_alias_add_internals(c
, argc
, argv
);
1945 return rpc_group_add_internals(c
, argc
, argv
);
1948 static NTSTATUS
get_sid_from_name(struct cli_state
*cli
,
1949 TALLOC_CTX
*mem_ctx
,
1951 struct dom_sid
*sid
,
1952 enum lsa_SidType
*type
)
1954 struct dom_sid
*sids
= NULL
;
1955 enum lsa_SidType
*types
= NULL
;
1956 struct rpc_pipe_client
*pipe_hnd
= NULL
;
1957 struct policy_handle lsa_pol
;
1958 NTSTATUS status
, result
;
1959 struct dcerpc_binding_handle
*b
;
1961 status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
1963 if (!NT_STATUS_IS_OK(status
)) {
1967 b
= pipe_hnd
->binding_handle
;
1969 status
= rpccli_lsa_open_policy(pipe_hnd
, mem_ctx
, false,
1970 SEC_FLAG_MAXIMUM_ALLOWED
, &lsa_pol
);
1972 if (!NT_STATUS_IS_OK(status
)) {
1976 status
= rpccli_lsa_lookup_names(pipe_hnd
, mem_ctx
, &lsa_pol
, 1,
1977 &name
, NULL
, 1, &sids
, &types
);
1979 if (NT_STATUS_IS_OK(status
)) {
1980 sid_copy(sid
, &sids
[0]);
1984 dcerpc_lsa_Close(b
, mem_ctx
, &lsa_pol
, &result
);
1988 TALLOC_FREE(pipe_hnd
);
1991 if (!NT_STATUS_IS_OK(status
) && (strncasecmp_m(name
, "S-", 2) == 0)) {
1993 /* Try as S-1-5-whatever */
1995 struct dom_sid tmp_sid
;
1997 if (string_to_sid(&tmp_sid
, name
)) {
1998 sid_copy(sid
, &tmp_sid
);
1999 *type
= SID_NAME_UNKNOWN
;
2000 status
= NT_STATUS_OK
;
2007 static NTSTATUS
rpc_add_groupmem(struct rpc_pipe_client
*pipe_hnd
,
2008 TALLOC_CTX
*mem_ctx
,
2009 const struct dom_sid
*group_sid
,
2012 struct policy_handle connect_pol
, domain_pol
;
2013 NTSTATUS status
, result
;
2015 struct policy_handle group_pol
;
2016 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
2018 struct samr_Ids rids
, rid_types
;
2019 struct lsa_String lsa_acct_name
;
2023 sid_copy(&sid
, group_sid
);
2025 if (!sid_split_rid(&sid
, &group_rid
)) {
2026 return NT_STATUS_UNSUCCESSFUL
;
2029 /* Get sam policy handle */
2030 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
2032 MAXIMUM_ALLOWED_ACCESS
,
2035 if (!NT_STATUS_IS_OK(status
)) {
2038 if (!NT_STATUS_IS_OK(result
)) {
2042 /* Get domain policy handle */
2043 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2045 MAXIMUM_ALLOWED_ACCESS
,
2049 if (!NT_STATUS_IS_OK(status
)) {
2052 if (!NT_STATUS_IS_OK(result
)) {
2056 init_lsa_String(&lsa_acct_name
, member
);
2058 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
2065 if (!NT_STATUS_IS_OK(status
)) {
2066 d_fprintf(stderr
, _("Could not lookup up group member %s\n"),
2071 if (!NT_STATUS_IS_OK(result
)) {
2073 d_fprintf(stderr
, _("Could not lookup up group member %s\n"),
2078 status
= dcerpc_samr_OpenGroup(b
, mem_ctx
,
2080 MAXIMUM_ALLOWED_ACCESS
,
2084 if (!NT_STATUS_IS_OK(status
)) {
2088 if (!NT_STATUS_IS_OK(result
)) {
2093 status
= dcerpc_samr_AddGroupMember(b
, mem_ctx
,
2096 0x0005, /* unknown flags */
2098 if (!NT_STATUS_IS_OK(status
)) {
2105 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2109 static NTSTATUS
rpc_add_aliasmem(struct rpc_pipe_client
*pipe_hnd
,
2110 TALLOC_CTX
*mem_ctx
,
2111 const struct dom_sid
*alias_sid
,
2114 struct policy_handle connect_pol
, domain_pol
;
2115 NTSTATUS status
, result
;
2117 struct policy_handle alias_pol
;
2118 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
2120 struct dom_sid member_sid
;
2121 enum lsa_SidType member_type
;
2125 sid_copy(&sid
, alias_sid
);
2127 if (!sid_split_rid(&sid
, &alias_rid
)) {
2128 return NT_STATUS_UNSUCCESSFUL
;
2131 result
= get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd
), mem_ctx
,
2132 member
, &member_sid
, &member_type
);
2134 if (!NT_STATUS_IS_OK(result
)) {
2135 d_fprintf(stderr
, _("Could not lookup up group member %s\n"),
2140 /* Get sam policy handle */
2141 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
2143 MAXIMUM_ALLOWED_ACCESS
,
2146 if (!NT_STATUS_IS_OK(status
)) {
2149 if (!NT_STATUS_IS_OK(result
)) {
2154 /* Get domain policy handle */
2155 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2157 MAXIMUM_ALLOWED_ACCESS
,
2161 if (!NT_STATUS_IS_OK(status
)) {
2164 if (!NT_STATUS_IS_OK(result
)) {
2169 status
= dcerpc_samr_OpenAlias(b
, mem_ctx
,
2171 MAXIMUM_ALLOWED_ACCESS
,
2175 if (!NT_STATUS_IS_OK(status
)) {
2178 if (!NT_STATUS_IS_OK(result
)) {
2182 status
= dcerpc_samr_AddAliasMember(b
, mem_ctx
,
2186 if (!NT_STATUS_IS_OK(status
)) {
2193 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2197 static NTSTATUS
rpc_group_addmem_internals(struct net_context
*c
,
2198 const struct dom_sid
*domain_sid
,
2199 const char *domain_name
,
2200 struct cli_state
*cli
,
2201 struct rpc_pipe_client
*pipe_hnd
,
2202 TALLOC_CTX
*mem_ctx
,
2206 struct dom_sid group_sid
;
2207 enum lsa_SidType group_type
;
2209 if (argc
!= 2 || c
->display_usage
) {
2212 _("net rpc group addmem <group> <member>\n"
2213 " Add a member to a group\n"
2214 " group\tGroup to add member to\n"
2215 " member\tMember to add to group\n"));
2216 return NT_STATUS_UNSUCCESSFUL
;
2219 if (!NT_STATUS_IS_OK(get_sid_from_name(cli
, mem_ctx
, argv
[0],
2220 &group_sid
, &group_type
))) {
2221 d_fprintf(stderr
, _("Could not lookup group name %s\n"),
2223 return NT_STATUS_UNSUCCESSFUL
;
2226 if (group_type
== SID_NAME_DOM_GRP
) {
2227 NTSTATUS result
= rpc_add_groupmem(pipe_hnd
, mem_ctx
,
2228 &group_sid
, argv
[1]);
2230 if (!NT_STATUS_IS_OK(result
)) {
2231 d_fprintf(stderr
, _("Could not add %s to %s: %s\n"),
2232 argv
[1], argv
[0], nt_errstr(result
));
2237 if (group_type
== SID_NAME_ALIAS
) {
2238 NTSTATUS result
= rpc_add_aliasmem(pipe_hnd
, mem_ctx
,
2239 &group_sid
, argv
[1]);
2241 if (!NT_STATUS_IS_OK(result
)) {
2242 d_fprintf(stderr
, _("Could not add %s to %s: %s\n"),
2243 argv
[1], argv
[0], nt_errstr(result
));
2248 d_fprintf(stderr
, _("Can only add members to global or local groups "
2249 "which %s is not\n"), argv
[0]);
2251 return NT_STATUS_UNSUCCESSFUL
;
2254 static int rpc_group_addmem(struct net_context
*c
, int argc
, const char **argv
)
2256 return run_rpc_command(c
, NULL
, &ndr_table_samr
, 0,
2257 rpc_group_addmem_internals
,
2261 static NTSTATUS
rpc_del_groupmem(struct net_context
*c
,
2262 struct rpc_pipe_client
*pipe_hnd
,
2263 TALLOC_CTX
*mem_ctx
,
2264 const struct dom_sid
*group_sid
,
2267 struct policy_handle connect_pol
, domain_pol
;
2268 NTSTATUS status
, result
;
2270 struct policy_handle group_pol
;
2271 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
2273 struct samr_Ids rids
, rid_types
;
2274 struct lsa_String lsa_acct_name
;
2278 sid_copy(&sid
, group_sid
);
2280 if (!sid_split_rid(&sid
, &group_rid
))
2281 return NT_STATUS_UNSUCCESSFUL
;
2283 /* Get sam policy handle */
2284 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
2286 MAXIMUM_ALLOWED_ACCESS
,
2289 if (!NT_STATUS_IS_OK(status
)) {
2292 if (!NT_STATUS_IS_OK(result
)) {
2297 /* Get domain policy handle */
2298 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2300 MAXIMUM_ALLOWED_ACCESS
,
2304 if (!NT_STATUS_IS_OK(status
)) {
2307 if (!NT_STATUS_IS_OK(result
)) {
2311 init_lsa_String(&lsa_acct_name
, member
);
2313 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
2320 if (!NT_STATUS_IS_OK(status
)) {
2321 d_fprintf(stderr
, _("Could not lookup up group member %s\n"),
2326 if (!NT_STATUS_IS_OK(result
)) {
2328 d_fprintf(stderr
, _("Could not lookup up group member %s\n"),
2333 status
= dcerpc_samr_OpenGroup(b
, mem_ctx
,
2335 MAXIMUM_ALLOWED_ACCESS
,
2339 if (!NT_STATUS_IS_OK(status
)) {
2342 if (!NT_STATUS_IS_OK(result
)) {
2347 status
= dcerpc_samr_DeleteGroupMember(b
, mem_ctx
,
2351 if (!NT_STATUS_IS_OK(status
)) {
2357 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2361 static NTSTATUS
rpc_del_aliasmem(struct rpc_pipe_client
*pipe_hnd
,
2362 TALLOC_CTX
*mem_ctx
,
2363 const struct dom_sid
*alias_sid
,
2366 struct policy_handle connect_pol
, domain_pol
;
2367 NTSTATUS status
, result
;
2369 struct policy_handle alias_pol
;
2370 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
2372 struct dom_sid member_sid
;
2373 enum lsa_SidType member_type
;
2377 sid_copy(&sid
, alias_sid
);
2379 if (!sid_split_rid(&sid
, &alias_rid
))
2380 return NT_STATUS_UNSUCCESSFUL
;
2382 result
= get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd
), mem_ctx
,
2383 member
, &member_sid
, &member_type
);
2385 if (!NT_STATUS_IS_OK(result
)) {
2386 d_fprintf(stderr
, _("Could not lookup up group member %s\n"),
2391 /* Get sam policy handle */
2392 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
2394 MAXIMUM_ALLOWED_ACCESS
,
2397 if (!NT_STATUS_IS_OK(status
)) {
2400 if (!NT_STATUS_IS_OK(result
)) {
2405 /* Get domain policy handle */
2406 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2408 MAXIMUM_ALLOWED_ACCESS
,
2412 if (!NT_STATUS_IS_OK(status
)) {
2415 if (!NT_STATUS_IS_OK(result
)) {
2420 status
= dcerpc_samr_OpenAlias(b
, mem_ctx
,
2422 MAXIMUM_ALLOWED_ACCESS
,
2426 if (!NT_STATUS_IS_OK(status
)) {
2430 if (!NT_STATUS_IS_OK(result
)) {
2434 status
= dcerpc_samr_DeleteAliasMember(b
, mem_ctx
,
2439 if (!NT_STATUS_IS_OK(status
)) {
2446 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2450 static NTSTATUS
rpc_group_delmem_internals(struct net_context
*c
,
2451 const struct dom_sid
*domain_sid
,
2452 const char *domain_name
,
2453 struct cli_state
*cli
,
2454 struct rpc_pipe_client
*pipe_hnd
,
2455 TALLOC_CTX
*mem_ctx
,
2459 struct dom_sid group_sid
;
2460 enum lsa_SidType group_type
;
2462 if (argc
!= 2 || c
->display_usage
) {
2465 _("net rpc group delmem <group> <member>\n"
2466 " Delete a member from a group\n"
2467 " group\tGroup to delete member from\n"
2468 " member\tMember to delete from group\n"));
2469 return NT_STATUS_UNSUCCESSFUL
;
2472 if (!NT_STATUS_IS_OK(get_sid_from_name(cli
, mem_ctx
, argv
[0],
2473 &group_sid
, &group_type
))) {
2474 d_fprintf(stderr
, _("Could not lookup group name %s\n"),
2476 return NT_STATUS_UNSUCCESSFUL
;
2479 if (group_type
== SID_NAME_DOM_GRP
) {
2480 NTSTATUS result
= rpc_del_groupmem(c
, pipe_hnd
, mem_ctx
,
2481 &group_sid
, argv
[1]);
2483 if (!NT_STATUS_IS_OK(result
)) {
2484 d_fprintf(stderr
, _("Could not del %s from %s: %s\n"),
2485 argv
[1], argv
[0], nt_errstr(result
));
2490 if (group_type
== SID_NAME_ALIAS
) {
2491 NTSTATUS result
= rpc_del_aliasmem(pipe_hnd
, mem_ctx
,
2492 &group_sid
, argv
[1]);
2494 if (!NT_STATUS_IS_OK(result
)) {
2495 d_fprintf(stderr
, _("Could not del %s from %s: %s\n"),
2496 argv
[1], argv
[0], nt_errstr(result
));
2501 d_fprintf(stderr
, _("Can only delete members from global or local "
2502 "groups which %s is not\n"), argv
[0]);
2504 return NT_STATUS_UNSUCCESSFUL
;
2507 static int rpc_group_delmem(struct net_context
*c
, int argc
, const char **argv
)
2509 return run_rpc_command(c
, NULL
, &ndr_table_samr
, 0,
2510 rpc_group_delmem_internals
,
2515 * List groups on a remote RPC server.
2517 * All parameters are provided by the run_rpc_command function, except for
2518 * argc, argv which are passes through.
2520 * @param domain_sid The domain sid acquired from the remote server.
2521 * @param cli A cli_state connected to the server.
2522 * @param mem_ctx Talloc context, destroyed on completion of the function.
2523 * @param argc Standard main() style argc.
2524 * @param argv Standard main() style argv. Initial components are already
2527 * @return Normal NTSTATUS return.
2530 static NTSTATUS
rpc_group_list_internals(struct net_context
*c
,
2531 const struct dom_sid
*domain_sid
,
2532 const char *domain_name
,
2533 struct cli_state
*cli
,
2534 struct rpc_pipe_client
*pipe_hnd
,
2535 TALLOC_CTX
*mem_ctx
,
2539 struct policy_handle connect_pol
, domain_pol
;
2540 NTSTATUS status
, result
;
2541 uint32 start_idx
=0, max_entries
=250, num_entries
, i
, loop_count
= 0;
2542 struct samr_SamArray
*groups
= NULL
;
2543 bool global
= false;
2545 bool builtin
= false;
2546 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
2548 if (c
->display_usage
) {
2551 _("net rpc group list [global] [local] [builtin]\n"
2552 " List groups on RPC server\n"
2553 " global\tList global groups\n"
2554 " local\tList local groups\n"
2555 " builtin\tList builtin groups\n"
2556 " If none of global, local or builtin is "
2557 "specified, all three options are considered "
2559 return NT_STATUS_OK
;
2568 for (i
=0; i
<argc
; i
++) {
2569 if (strequal(argv
[i
], "global"))
2572 if (strequal(argv
[i
], "local"))
2575 if (strequal(argv
[i
], "builtin"))
2579 /* Get sam policy handle */
2581 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
2583 MAXIMUM_ALLOWED_ACCESS
,
2586 if (!NT_STATUS_IS_OK(status
)) {
2589 if (!NT_STATUS_IS_OK(result
)) {
2594 /* Get domain policy handle */
2596 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2598 MAXIMUM_ALLOWED_ACCESS
,
2599 discard_const_p(struct dom_sid2
, domain_sid
),
2602 if (!NT_STATUS_IS_OK(status
)) {
2605 if (!NT_STATUS_IS_OK(result
)) {
2610 /* Query domain groups */
2611 if (c
->opt_long_list_entries
)
2612 d_printf(_("\nGroup name Comment"
2613 "\n-----------------------------\n"));
2615 uint32_t max_size
, total_size
, returned_size
;
2616 union samr_DispInfo info
;
2620 dcerpc_get_query_dispinfo_params(
2621 loop_count
, &max_entries
, &max_size
);
2623 status
= dcerpc_samr_QueryDisplayInfo(b
, mem_ctx
,
2633 if (!NT_STATUS_IS_OK(status
)) {
2636 num_entries
= info
.info3
.count
;
2637 start_idx
+= info
.info3
.count
;
2639 if (!NT_STATUS_IS_OK(result
) &&
2640 !NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
))
2643 for (i
= 0; i
< num_entries
; i
++) {
2645 const char *group
= NULL
;
2646 const char *desc
= NULL
;
2648 group
= info
.info3
.entries
[i
].account_name
.string
;
2649 desc
= info
.info3
.entries
[i
].description
.string
;
2651 if (c
->opt_long_list_entries
)
2652 printf("%-21.21s %-50.50s\n",
2655 printf("%s\n", group
);
2657 } while (NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
2658 /* query domain aliases */
2663 status
= dcerpc_samr_EnumDomainAliases(b
, mem_ctx
,
2670 if (!NT_STATUS_IS_OK(status
)) {
2673 if (!NT_STATUS_IS_OK(result
) &&
2674 !NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
))
2677 for (i
= 0; i
< num_entries
; i
++) {
2679 const char *description
= NULL
;
2681 if (c
->opt_long_list_entries
) {
2683 struct policy_handle alias_pol
;
2684 union samr_AliasInfo
*info
= NULL
;
2687 status
= dcerpc_samr_OpenAlias(b
, mem_ctx
,
2690 groups
->entries
[i
].idx
,
2693 if (NT_STATUS_IS_OK(status
) && NT_STATUS_IS_OK(_result
)) {
2694 status
= dcerpc_samr_QueryAliasInfo(b
, mem_ctx
,
2699 if (NT_STATUS_IS_OK(status
) && NT_STATUS_IS_OK(_result
)) {
2700 status
= dcerpc_samr_Close(b
, mem_ctx
,
2703 if (NT_STATUS_IS_OK(status
) && NT_STATUS_IS_OK(_result
)) {
2704 description
= info
->description
.string
;
2710 if (description
!= NULL
) {
2711 printf("%-21.21s %-50.50s\n",
2712 groups
->entries
[i
].name
.string
,
2715 printf("%s\n", groups
->entries
[i
].name
.string
);
2718 } while (NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
2719 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
2720 /* Get builtin policy handle */
2722 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2724 MAXIMUM_ALLOWED_ACCESS
,
2725 discard_const_p(struct dom_sid2
, &global_sid_Builtin
),
2728 if (!NT_STATUS_IS_OK(status
)) {
2731 if (!NT_STATUS_IS_OK(result
)) {
2736 /* query builtin aliases */
2739 if (!builtin
) break;
2741 status
= dcerpc_samr_EnumDomainAliases(b
, mem_ctx
,
2748 if (!NT_STATUS_IS_OK(status
)) {
2751 if (!NT_STATUS_IS_OK(result
) &&
2752 !NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
)) {
2757 for (i
= 0; i
< num_entries
; i
++) {
2759 const char *description
= NULL
;
2761 if (c
->opt_long_list_entries
) {
2763 struct policy_handle alias_pol
;
2764 union samr_AliasInfo
*info
= NULL
;
2767 status
= dcerpc_samr_OpenAlias(b
, mem_ctx
,
2770 groups
->entries
[i
].idx
,
2773 if (NT_STATUS_IS_OK(status
) && NT_STATUS_IS_OK(_result
)) {
2774 status
= dcerpc_samr_QueryAliasInfo(b
, mem_ctx
,
2779 if (NT_STATUS_IS_OK(status
) && NT_STATUS_IS_OK(_result
)) {
2780 status
= dcerpc_samr_Close(b
, mem_ctx
,
2783 if (NT_STATUS_IS_OK(status
) && NT_STATUS_IS_OK(_result
)) {
2784 description
= info
->description
.string
;
2790 if (description
!= NULL
) {
2791 printf("%-21.21s %-50.50s\n",
2792 groups
->entries
[i
].name
.string
,
2795 printf("%s\n", groups
->entries
[i
].name
.string
);
2798 } while (NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
2806 static int rpc_group_list(struct net_context
*c
, int argc
, const char **argv
)
2808 return run_rpc_command(c
, NULL
, &ndr_table_samr
, 0,
2809 rpc_group_list_internals
,
2813 static NTSTATUS
rpc_list_group_members(struct net_context
*c
,
2814 struct rpc_pipe_client
*pipe_hnd
,
2815 TALLOC_CTX
*mem_ctx
,
2816 const char *domain_name
,
2817 const struct dom_sid
*domain_sid
,
2818 struct policy_handle
*domain_pol
,
2821 NTSTATUS result
, status
;
2822 struct policy_handle group_pol
;
2823 uint32 num_members
, *group_rids
;
2825 struct samr_RidAttrArray
*rids
= NULL
;
2826 struct lsa_Strings names
;
2827 struct samr_Ids types
;
2828 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
2831 sid_to_fstring(sid_str
, domain_sid
);
2833 status
= dcerpc_samr_OpenGroup(b
, mem_ctx
,
2835 MAXIMUM_ALLOWED_ACCESS
,
2839 if (!NT_STATUS_IS_OK(status
)) {
2842 if (!NT_STATUS_IS_OK(result
)) {
2846 status
= dcerpc_samr_QueryGroupMember(b
, mem_ctx
,
2850 if (!NT_STATUS_IS_OK(status
)) {
2853 if (!NT_STATUS_IS_OK(result
)) {
2857 num_members
= rids
->count
;
2858 group_rids
= rids
->rids
;
2860 while (num_members
> 0) {
2861 int this_time
= 512;
2863 if (num_members
< this_time
)
2864 this_time
= num_members
;
2866 status
= dcerpc_samr_LookupRids(b
, mem_ctx
,
2873 if (!NT_STATUS_IS_OK(status
)) {
2876 if (!NT_STATUS_IS_OK(result
)) {
2880 /* We only have users as members, but make the output
2881 the same as the output of alias members */
2883 for (i
= 0; i
< this_time
; i
++) {
2885 if (c
->opt_long_list_entries
) {
2886 printf("%s-%d %s\\%s %d\n", sid_str
,
2887 group_rids
[i
], domain_name
,
2888 names
.names
[i
].string
,
2891 printf("%s\\%s\n", domain_name
,
2892 names
.names
[i
].string
);
2896 num_members
-= this_time
;
2900 return NT_STATUS_OK
;
2903 static NTSTATUS
rpc_list_alias_members(struct net_context
*c
,
2904 struct rpc_pipe_client
*pipe_hnd
,
2905 TALLOC_CTX
*mem_ctx
,
2906 struct policy_handle
*domain_pol
,
2909 NTSTATUS result
, status
;
2910 struct rpc_pipe_client
*lsa_pipe
;
2911 struct policy_handle alias_pol
, lsa_pol
;
2913 struct dom_sid
*alias_sids
;
2916 enum lsa_SidType
*types
;
2918 struct lsa_SidArray sid_array
;
2919 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
2921 status
= dcerpc_samr_OpenAlias(b
, mem_ctx
,
2923 MAXIMUM_ALLOWED_ACCESS
,
2927 if (!NT_STATUS_IS_OK(status
)) {
2930 if (!NT_STATUS_IS_OK(result
)) {
2934 status
= dcerpc_samr_GetMembersInAlias(b
, mem_ctx
,
2938 if (!NT_STATUS_IS_OK(status
)) {
2939 d_fprintf(stderr
, _("Couldn't list alias members\n"));
2942 if (!NT_STATUS_IS_OK(result
)) {
2943 d_fprintf(stderr
, _("Couldn't list alias members\n"));
2947 num_members
= sid_array
.num_sids
;
2949 if (num_members
== 0) {
2950 return NT_STATUS_OK
;
2953 result
= cli_rpc_pipe_open_noauth(rpc_pipe_np_smb_conn(pipe_hnd
),
2954 &ndr_table_lsarpc
.syntax_id
,
2956 if (!NT_STATUS_IS_OK(result
)) {
2957 d_fprintf(stderr
, _("Couldn't open LSA pipe. Error was %s\n"),
2958 nt_errstr(result
) );
2962 result
= rpccli_lsa_open_policy(lsa_pipe
, mem_ctx
, true,
2963 SEC_FLAG_MAXIMUM_ALLOWED
, &lsa_pol
);
2965 if (!NT_STATUS_IS_OK(result
)) {
2966 d_fprintf(stderr
, _("Couldn't open LSA policy handle\n"));
2967 TALLOC_FREE(lsa_pipe
);
2971 alias_sids
= talloc_zero_array(mem_ctx
, struct dom_sid
, num_members
);
2973 d_fprintf(stderr
, _("Out of memory\n"));
2974 TALLOC_FREE(lsa_pipe
);
2975 return NT_STATUS_NO_MEMORY
;
2978 for (i
=0; i
<num_members
; i
++) {
2979 sid_copy(&alias_sids
[i
], sid_array
.sids
[i
].sid
);
2982 result
= rpccli_lsa_lookup_sids(lsa_pipe
, mem_ctx
, &lsa_pol
,
2983 num_members
, alias_sids
,
2984 &domains
, &names
, &types
);
2986 if (!NT_STATUS_IS_OK(result
) &&
2987 !NT_STATUS_EQUAL(result
, STATUS_SOME_UNMAPPED
)) {
2988 d_fprintf(stderr
, _("Couldn't lookup SIDs\n"));
2989 TALLOC_FREE(lsa_pipe
);
2993 for (i
= 0; i
< num_members
; i
++) {
2995 sid_to_fstring(sid_str
, &alias_sids
[i
]);
2997 if (c
->opt_long_list_entries
) {
2998 printf("%s %s\\%s %d\n", sid_str
,
2999 domains
[i
] ? domains
[i
] : _("*unknown*"),
3000 names
[i
] ? names
[i
] : _("*unknown*"), types
[i
]);
3003 printf("%s\\%s\n", domains
[i
], names
[i
]);
3005 printf("%s\n", sid_str
);
3009 TALLOC_FREE(lsa_pipe
);
3010 return NT_STATUS_OK
;
3013 static NTSTATUS
rpc_group_members_internals(struct net_context
*c
,
3014 const struct dom_sid
*domain_sid
,
3015 const char *domain_name
,
3016 struct cli_state
*cli
,
3017 struct rpc_pipe_client
*pipe_hnd
,
3018 TALLOC_CTX
*mem_ctx
,
3022 NTSTATUS result
, status
;
3023 struct policy_handle connect_pol
, domain_pol
;
3024 struct samr_Ids rids
, rid_types
;
3025 struct lsa_String lsa_acct_name
;
3026 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
3028 /* Get sam policy handle */
3030 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
3032 MAXIMUM_ALLOWED_ACCESS
,
3035 if (!NT_STATUS_IS_OK(status
)) {
3038 if (!NT_STATUS_IS_OK(result
)) {
3042 /* Get domain policy handle */
3044 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
3046 MAXIMUM_ALLOWED_ACCESS
,
3047 discard_const_p(struct dom_sid2
, domain_sid
),
3050 if (!NT_STATUS_IS_OK(status
)) {
3053 if (!NT_STATUS_IS_OK(result
)) {
3057 init_lsa_String(&lsa_acct_name
, argv
[0]); /* sure? */
3059 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
3066 if (!NT_STATUS_IS_OK(status
)) {
3070 if (!NT_STATUS_IS_OK(result
)) {
3072 /* Ok, did not find it in the global sam, try with builtin */
3074 struct dom_sid sid_Builtin
;
3076 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
3078 sid_copy(&sid_Builtin
, &global_sid_Builtin
);
3080 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
3082 MAXIMUM_ALLOWED_ACCESS
,
3086 if (!NT_STATUS_IS_OK(status
)) {
3089 if (!NT_STATUS_IS_OK(result
)) {
3090 d_fprintf(stderr
, _("Couldn't find group %s\n"),
3095 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
3102 if (!NT_STATUS_IS_OK(status
)) {
3105 if (!NT_STATUS_IS_OK(result
)) {
3106 d_fprintf(stderr
, _("Couldn't find group %s\n"),
3112 if (rids
.count
!= 1) {
3113 d_fprintf(stderr
, _("Couldn't find group %s\n"),
3118 if (rid_types
.ids
[0] == SID_NAME_DOM_GRP
) {
3119 return rpc_list_group_members(c
, pipe_hnd
, mem_ctx
, domain_name
,
3120 domain_sid
, &domain_pol
,
3124 if (rid_types
.ids
[0] == SID_NAME_ALIAS
) {
3125 return rpc_list_alias_members(c
, pipe_hnd
, mem_ctx
, &domain_pol
,
3129 return NT_STATUS_NO_SUCH_GROUP
;
3132 static int rpc_group_members(struct net_context
*c
, int argc
, const char **argv
)
3134 if (argc
!= 1 || c
->display_usage
) {
3135 return rpc_group_usage(c
, argc
, argv
);
3138 return run_rpc_command(c
, NULL
, &ndr_table_samr
, 0,
3139 rpc_group_members_internals
,
3143 static int rpc_group_rename_internals(struct net_context
*c
, int argc
, const char **argv
)
3145 NET_API_STATUS status
;
3146 struct GROUP_INFO_0 g0
;
3150 d_printf(_("Usage:\n"));
3151 d_printf("net rpc group rename group newname\n");
3155 g0
.grpi0_name
= argv
[1];
3157 status
= NetGroupSetInfo(c
->opt_host
,
3164 d_fprintf(stderr
, _("Renaming group %s failed with: %s\n"),
3165 argv
[0], libnetapi_get_error_string(c
->netapi_ctx
,
3173 static int rpc_group_rename(struct net_context
*c
, int argc
, const char **argv
)
3175 if (argc
!= 2 || c
->display_usage
) {
3176 return rpc_group_usage(c
, argc
, argv
);
3179 return rpc_group_rename_internals(c
, argc
, argv
);
3183 * 'net rpc group' entrypoint.
3184 * @param argc Standard main() style argc.
3185 * @param argv Standard main() style argv. Initial components are already
3189 int net_rpc_group(struct net_context
*c
, int argc
, const char **argv
)
3191 NET_API_STATUS status
;
3193 struct functable func
[] = {
3198 N_("Create specified group"),
3199 N_("net rpc group add\n"
3200 " Create specified group")
3206 N_("Delete specified group"),
3207 N_("net rpc group delete\n"
3208 " Delete specified group")
3214 N_("Add member to group"),
3215 N_("net rpc group addmem\n"
3216 " Add member to group")
3222 N_("Remove member from group"),
3223 N_("net rpc group delmem\n"
3224 " Remove member from group")
3231 N_("net rpc group list\n"
3238 N_("List group members"),
3239 N_("net rpc group members\n"
3240 " List group members")
3247 N_("net rpc group rename\n"
3250 {NULL
, NULL
, 0, NULL
, NULL
}
3253 status
= libnetapi_net_init(&c
->netapi_ctx
);
3257 libnetapi_set_username(c
->netapi_ctx
, c
->opt_user_name
);
3258 libnetapi_set_password(c
->netapi_ctx
, c
->opt_password
);
3259 if (c
->opt_kerberos
) {
3260 libnetapi_set_use_kerberos(c
->netapi_ctx
);
3264 if (c
->display_usage
) {
3265 d_printf(_("Usage:\n"));
3266 d_printf(_("net rpc group\n"
3267 " Alias for net rpc group list global "
3268 "local builtin\n"));
3269 net_display_usage_from_functable(func
);
3273 return run_rpc_command(c
, NULL
, &ndr_table_samr
, 0,
3274 rpc_group_list_internals
,
3278 return net_run_function(c
, argc
, argv
, "net rpc group", func
);
3281 /****************************************************************************/
3283 static int rpc_share_usage(struct net_context
*c
, int argc
, const char **argv
)
3285 return net_share_usage(c
, argc
, argv
);
3289 * Add a share on a remote RPC server.
3291 * @param argc Standard main() style argc.
3292 * @param argv Standard main() style argv. Initial components are already
3295 * @return A shell status integer (0 for success).
3298 static int rpc_share_add(struct net_context
*c
, int argc
, const char **argv
)
3300 NET_API_STATUS status
;
3303 uint32 type
= STYPE_DISKTREE
; /* only allow disk shares to be added */
3304 uint32 num_users
=0, perms
=0;
3305 char *password
=NULL
; /* don't allow a share password */
3306 struct SHARE_INFO_2 i2
;
3307 uint32_t parm_error
= 0;
3309 if ((argc
< 1) || !strchr(argv
[0], '=') || c
->display_usage
) {
3310 return rpc_share_usage(c
, argc
, argv
);
3313 if ((sharename
= talloc_strdup(c
, argv
[0])) == NULL
) {
3317 path
= strchr(sharename
, '=');
3324 i2
.shi2_netname
= sharename
;
3325 i2
.shi2_type
= type
;
3326 i2
.shi2_remark
= c
->opt_comment
;
3327 i2
.shi2_permissions
= perms
;
3328 i2
.shi2_max_uses
= c
->opt_maxusers
;
3329 i2
.shi2_current_uses
= num_users
;
3330 i2
.shi2_path
= path
;
3331 i2
.shi2_passwd
= password
;
3333 status
= NetShareAdd(c
->opt_host
,
3338 printf(_("NetShareAdd failed with: %s\n"),
3339 libnetapi_get_error_string(c
->netapi_ctx
, status
));
3346 * Delete a share on a remote RPC server.
3348 * @param domain_sid The domain sid acquired from the remote server.
3349 * @param argc Standard main() style argc.
3350 * @param argv Standard main() style argv. Initial components are already
3353 * @return A shell status integer (0 for success).
3355 static int rpc_share_delete(struct net_context
*c
, int argc
, const char **argv
)
3357 if (argc
< 1 || c
->display_usage
) {
3358 return rpc_share_usage(c
, argc
, argv
);
3361 return NetShareDel(c
->opt_host
, argv
[0], 0);
3365 * Formatted print of share info
3367 * @param r pointer to SHARE_INFO_1 to format
3370 static void display_share_info_1(struct net_context
*c
,
3371 struct SHARE_INFO_1
*r
)
3373 if (c
->opt_long_list_entries
) {
3374 d_printf("%-12s %-8.8s %-50s\n",
3376 net_share_type_str(r
->shi1_type
& ~(STYPE_TEMPORARY
|STYPE_HIDDEN
)),
3379 d_printf("%s\n", r
->shi1_netname
);
3383 static WERROR
get_share_info(struct net_context
*c
,
3384 struct rpc_pipe_client
*pipe_hnd
,
3385 TALLOC_CTX
*mem_ctx
,
3389 struct srvsvc_NetShareInfoCtr
*info_ctr
)
3393 union srvsvc_NetShareInfo info
;
3394 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
3396 /* no specific share requested, enumerate all */
3399 uint32_t preferred_len
= 0xffffffff;
3400 uint32_t total_entries
= 0;
3401 uint32_t resume_handle
= 0;
3403 info_ctr
->level
= level
;
3405 status
= dcerpc_srvsvc_NetShareEnumAll(b
, mem_ctx
,
3412 if (!NT_STATUS_IS_OK(status
)) {
3413 return ntstatus_to_werror(status
);
3418 /* request just one share */
3419 status
= dcerpc_srvsvc_NetShareGetInfo(b
, mem_ctx
,
3426 if (!NT_STATUS_IS_OK(status
)) {
3427 result
= ntstatus_to_werror(status
);
3431 if (!W_ERROR_IS_OK(result
)) {
3436 ZERO_STRUCTP(info_ctr
);
3438 info_ctr
->level
= level
;
3443 struct srvsvc_NetShareCtr1
*ctr1
;
3445 ctr1
= talloc_zero(mem_ctx
, struct srvsvc_NetShareCtr1
);
3446 W_ERROR_HAVE_NO_MEMORY(ctr1
);
3449 ctr1
->array
= info
.info1
;
3451 info_ctr
->ctr
.ctr1
= ctr1
;
3457 struct srvsvc_NetShareCtr2
*ctr2
;
3459 ctr2
= talloc_zero(mem_ctx
, struct srvsvc_NetShareCtr2
);
3460 W_ERROR_HAVE_NO_MEMORY(ctr2
);
3463 ctr2
->array
= info
.info2
;
3465 info_ctr
->ctr
.ctr2
= ctr2
;
3471 struct srvsvc_NetShareCtr502
*ctr502
;
3473 ctr502
= talloc_zero(mem_ctx
, struct srvsvc_NetShareCtr502
);
3474 W_ERROR_HAVE_NO_MEMORY(ctr502
);
3477 ctr502
->array
= info
.info502
;
3479 info_ctr
->ctr
.ctr502
= ctr502
;
3489 * 'net rpc share list' entrypoint.
3490 * @param argc Standard main() style argc.
3491 * @param argv Standard main() style argv. Initial components are already
3494 static int rpc_share_list(struct net_context
*c
, int argc
, const char **argv
)
3496 NET_API_STATUS status
;
3497 struct SHARE_INFO_1
*i1
= NULL
;
3498 uint32_t entries_read
= 0;
3499 uint32_t total_entries
= 0;
3500 uint32_t resume_handle
= 0;
3501 uint32_t i
, level
= 1;
3503 if (c
->display_usage
) {
3505 "net rpc share list\n"
3508 _("List shares on remote server"));
3512 status
= NetShareEnum(c
->opt_host
,
3514 (uint8_t **)(void *)&i1
,
3523 /* Display results */
3525 if (c
->opt_long_list_entries
) {
3527 "\nEnumerating shared resources (exports) on remote server:\n\n"
3528 "\nShare name Type Description\n"
3529 "---------- ---- -----------\n"));
3531 for (i
= 0; i
< entries_read
; i
++)
3532 display_share_info_1(c
, &i1
[i
]);
3537 static bool check_share_availability(struct cli_state
*cli
, const char *netname
)
3541 status
= cli_tree_connect(cli
, netname
, "A:", "", 0);
3542 if (!NT_STATUS_IS_OK(status
)) {
3543 d_printf(_("skipping [%s]: not a file share.\n"), netname
);
3547 status
= cli_tdis(cli
);
3548 if (!NT_STATUS_IS_OK(status
)) {
3549 d_printf(_("cli_tdis returned %s\n"), nt_errstr(status
));
3556 static bool check_share_sanity(struct net_context
*c
, struct cli_state
*cli
,
3557 const char *netname
, uint32 type
)
3559 /* only support disk shares */
3560 if (! ( type
== STYPE_DISKTREE
|| type
== (STYPE_DISKTREE
| STYPE_HIDDEN
)) ) {
3561 printf(_("share [%s] is not a diskshare (type: %x)\n"), netname
,
3566 /* skip builtin shares */
3567 /* FIXME: should print$ be added too ? */
3568 if (strequal(netname
,"IPC$") || strequal(netname
,"ADMIN$") ||
3569 strequal(netname
,"global"))
3572 if (c
->opt_exclude
&& in_list(netname
, c
->opt_exclude
, false)) {
3573 printf(_("excluding [%s]\n"), netname
);
3577 return check_share_availability(cli
, netname
);
3581 * Migrate shares from a remote RPC server to the local RPC server.
3583 * All parameters are provided by the run_rpc_command function, except for
3584 * argc, argv which are passed through.
3586 * @param domain_sid The domain sid acquired from the remote server.
3587 * @param cli A cli_state connected to the server.
3588 * @param mem_ctx Talloc context, destroyed on completion of the function.
3589 * @param argc Standard main() style argc.
3590 * @param argv Standard main() style argv. Initial components are already
3593 * @return Normal NTSTATUS return.
3596 static NTSTATUS
rpc_share_migrate_shares_internals(struct net_context
*c
,
3597 const struct dom_sid
*domain_sid
,
3598 const char *domain_name
,
3599 struct cli_state
*cli
,
3600 struct rpc_pipe_client
*pipe_hnd
,
3601 TALLOC_CTX
*mem_ctx
,
3606 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
3607 struct srvsvc_NetShareInfoCtr ctr_src
;
3609 struct rpc_pipe_client
*srvsvc_pipe
= NULL
;
3610 struct cli_state
*cli_dst
= NULL
;
3611 uint32 level
= 502; /* includes secdesc */
3612 uint32_t parm_error
= 0;
3613 struct dcerpc_binding_handle
*b
;
3615 result
= get_share_info(c
, pipe_hnd
, mem_ctx
, level
, argc
, argv
,
3617 if (!W_ERROR_IS_OK(result
))
3620 /* connect destination PI_SRVSVC */
3621 nt_status
= connect_dst_pipe(c
, &cli_dst
, &srvsvc_pipe
,
3622 &ndr_table_srvsvc
.syntax_id
);
3623 if (!NT_STATUS_IS_OK(nt_status
))
3626 b
= srvsvc_pipe
->binding_handle
;
3628 for (i
= 0; i
< ctr_src
.ctr
.ctr502
->count
; i
++) {
3630 union srvsvc_NetShareInfo info
;
3631 struct srvsvc_NetShareInfo502 info502
=
3632 ctr_src
.ctr
.ctr502
->array
[i
];
3634 /* reset error-code */
3635 nt_status
= NT_STATUS_UNSUCCESSFUL
;
3637 if (!check_share_sanity(c
, cli
, info502
.name
, info502
.type
))
3640 /* finally add the share on the dst server */
3642 printf(_("migrating: [%s], path: %s, comment: %s, without "
3644 info502
.name
, info502
.path
, info502
.comment
);
3646 info
.info502
= &info502
;
3648 nt_status
= dcerpc_srvsvc_NetShareAdd(b
, mem_ctx
,
3649 srvsvc_pipe
->desthost
,
3654 if (!NT_STATUS_IS_OK(nt_status
)) {
3655 printf(_("cannot add share: %s\n"),
3656 nt_errstr(nt_status
));
3659 if (W_ERROR_V(result
) == W_ERROR_V(WERR_FILE_EXISTS
)) {
3660 printf(_(" [%s] does already exist\n"),
3665 if (!W_ERROR_IS_OK(result
)) {
3666 nt_status
= werror_to_ntstatus(result
);
3667 printf(_("cannot add share: %s\n"),
3668 win_errstr(result
));
3674 nt_status
= NT_STATUS_OK
;
3678 cli_shutdown(cli_dst
);
3686 * Migrate shares from a RPC server to another.
3688 * @param argc Standard main() style argc.
3689 * @param argv Standard main() style argv. Initial components are already
3692 * @return A shell status integer (0 for success).
3694 static int rpc_share_migrate_shares(struct net_context
*c
, int argc
,
3697 if (c
->display_usage
) {
3699 "net rpc share migrate shares\n"
3702 _("Migrate shares to local server"));
3707 printf(_("no server to migrate\n"));
3711 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
, 0,
3712 rpc_share_migrate_shares_internals
,
3719 * @param f file_info
3720 * @param mask current search mask
3721 * @param state arg-pointer
3724 static NTSTATUS
copy_fn(const char *mnt
, struct file_info
*f
,
3725 const char *mask
, void *state
)
3727 static NTSTATUS nt_status
;
3728 static struct copy_clistate
*local_state
;
3729 static fstring filename
, new_mask
;
3732 struct net_context
*c
;
3734 local_state
= (struct copy_clistate
*)state
;
3735 nt_status
= NT_STATUS_UNSUCCESSFUL
;
3739 if (strequal(f
->name
, ".") || strequal(f
->name
, ".."))
3740 return NT_STATUS_OK
;
3742 DEBUG(3,("got mask: %s, name: %s\n", mask
, f
->name
));
3745 if (f
->mode
& FILE_ATTRIBUTE_DIRECTORY
) {
3747 DEBUG(3,("got dir: %s\n", f
->name
));
3749 fstrcpy(dir
, local_state
->cwd
);
3751 fstrcat(dir
, f
->name
);
3753 switch (net_mode_share
)
3755 case NET_MODE_SHARE_MIGRATE
:
3756 /* create that directory */
3757 nt_status
= net_copy_file(c
, local_state
->mem_ctx
,
3758 local_state
->cli_share_src
,
3759 local_state
->cli_share_dst
,
3761 c
->opt_acls
? true : false,
3762 c
->opt_attrs
? true : false,
3763 c
->opt_timestamps
? true:false,
3767 d_fprintf(stderr
, _("Unsupported mode %d\n"), net_mode_share
);
3768 return NT_STATUS_INTERNAL_ERROR
;
3771 if (!NT_STATUS_IS_OK(nt_status
)) {
3772 printf(_("could not handle dir %s: %s\n"),
3773 dir
, nt_errstr(nt_status
));
3777 /* search below that directory */
3778 if (strlcpy(new_mask
, dir
, sizeof(new_mask
)) >= sizeof(new_mask
)) {
3779 return NT_STATUS_NO_MEMORY
;
3781 if (strlcat(new_mask
, "\\*", sizeof(new_mask
)) >= sizeof(new_mask
)) {
3782 return NT_STATUS_NO_MEMORY
;
3785 old_dir
= local_state
->cwd
;
3786 local_state
->cwd
= dir
;
3787 nt_status
= sync_files(local_state
, new_mask
);
3788 if (!NT_STATUS_IS_OK(nt_status
)) {
3789 printf(_("could not handle files\n"));
3791 local_state
->cwd
= old_dir
;
3798 fstrcpy(filename
, local_state
->cwd
);
3799 fstrcat(filename
, "\\");
3800 fstrcat(filename
, f
->name
);
3802 DEBUG(3,("got file: %s\n", filename
));
3804 switch (net_mode_share
)
3806 case NET_MODE_SHARE_MIGRATE
:
3807 nt_status
= net_copy_file(c
, local_state
->mem_ctx
,
3808 local_state
->cli_share_src
,
3809 local_state
->cli_share_dst
,
3811 c
->opt_acls
? true : false,
3812 c
->opt_attrs
? true : false,
3813 c
->opt_timestamps
? true: false,
3817 d_fprintf(stderr
, _("Unsupported file mode %d\n"),
3819 return NT_STATUS_INTERNAL_ERROR
;
3822 if (!NT_STATUS_IS_OK(nt_status
))
3823 printf(_("could not handle file %s: %s\n"),
3824 filename
, nt_errstr(nt_status
));
3829 * sync files, can be called recursivly to list files
3830 * and then call copy_fn for each file
3832 * @param cp_clistate pointer to the copy_clistate we work with
3833 * @param mask the current search mask
3835 * @return Boolean result
3837 static NTSTATUS
sync_files(struct copy_clistate
*cp_clistate
, const char *mask
)
3839 struct cli_state
*targetcli
;
3840 char *targetpath
= NULL
;
3843 DEBUG(3,("calling cli_list with mask: %s\n", mask
));
3845 status
= cli_resolve_path(talloc_tos(), "", NULL
,
3846 cp_clistate
->cli_share_src
,
3847 mask
, &targetcli
, &targetpath
);
3848 if (!NT_STATUS_IS_OK(status
)) {
3849 d_fprintf(stderr
, _("cli_resolve_path %s failed with error: "
3851 mask
, nt_errstr(status
));
3855 status
= cli_list(targetcli
, targetpath
, cp_clistate
->attribute
,
3856 copy_fn
, cp_clistate
);
3857 if (!NT_STATUS_IS_OK(status
)) {
3858 d_fprintf(stderr
, _("listing %s failed with error: %s\n"),
3859 mask
, nt_errstr(status
));
3867 * Set the top level directory permissions before we do any further copies.
3868 * Should set up ACL inheritance.
3871 bool copy_top_level_perms(struct net_context
*c
,
3872 struct copy_clistate
*cp_clistate
,
3873 const char *sharename
)
3875 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
3877 switch (net_mode_share
) {
3878 case NET_MODE_SHARE_MIGRATE
:
3879 DEBUG(3,("calling net_copy_fileattr for '.' directory in share %s\n", sharename
));
3880 nt_status
= net_copy_fileattr(c
,
3881 cp_clistate
->mem_ctx
,
3882 cp_clistate
->cli_share_src
,
3883 cp_clistate
->cli_share_dst
,
3885 c
->opt_acls
? true : false,
3886 c
->opt_attrs
? true : false,
3887 c
->opt_timestamps
? true: false,
3891 d_fprintf(stderr
, _("Unsupported mode %d\n"), net_mode_share
);
3895 if (!NT_STATUS_IS_OK(nt_status
)) {
3896 printf(_("Could handle directory attributes for top level "
3897 "directory of share %s. Error %s\n"),
3898 sharename
, nt_errstr(nt_status
));
3906 * Sync all files inside a remote share to another share (over smb).
3908 * All parameters are provided by the run_rpc_command function, except for
3909 * argc, argv which are passed through.
3911 * @param domain_sid The domain sid acquired from the remote server.
3912 * @param cli A cli_state connected to the server.
3913 * @param mem_ctx Talloc context, destroyed on completion of the function.
3914 * @param argc Standard main() style argc.
3915 * @param argv Standard main() style argv. Initial components are already
3918 * @return Normal NTSTATUS return.
3921 static NTSTATUS
rpc_share_migrate_files_internals(struct net_context
*c
,
3922 const struct dom_sid
*domain_sid
,
3923 const char *domain_name
,
3924 struct cli_state
*cli
,
3925 struct rpc_pipe_client
*pipe_hnd
,
3926 TALLOC_CTX
*mem_ctx
,
3931 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
3932 struct srvsvc_NetShareInfoCtr ctr_src
;
3935 struct copy_clistate cp_clistate
;
3936 bool got_src_share
= false;
3937 bool got_dst_share
= false;
3938 const char *mask
= "\\*";
3941 dst
= SMB_STRDUP(c
->opt_destination
?c
->opt_destination
:"127.0.0.1");
3943 nt_status
= NT_STATUS_NO_MEMORY
;
3947 result
= get_share_info(c
, pipe_hnd
, mem_ctx
, level
, argc
, argv
,
3950 if (!W_ERROR_IS_OK(result
))
3953 for (i
= 0; i
< ctr_src
.ctr
.ctr502
->count
; i
++) {
3955 struct srvsvc_NetShareInfo502 info502
=
3956 ctr_src
.ctr
.ctr502
->array
[i
];
3958 if (!check_share_sanity(c
, cli
, info502
.name
, info502
.type
))
3961 /* one might not want to mirror whole discs :) */
3962 if (strequal(info502
.name
, "print$") || info502
.name
[1] == '$') {
3963 d_printf(_("skipping [%s]: builtin/hidden share\n"),
3968 switch (net_mode_share
)
3970 case NET_MODE_SHARE_MIGRATE
:
3974 d_fprintf(stderr
, _("Unsupported mode %d\n"),
3978 printf(_(" [%s] files and directories %s ACLs, %s DOS "
3981 c
->opt_acls
? _("including") : _("without"),
3982 c
->opt_attrs
? _("including") : _("without"),
3983 c
->opt_timestamps
? _("(preserving timestamps)") : "");
3985 cp_clistate
.mem_ctx
= mem_ctx
;
3986 cp_clistate
.cli_share_src
= NULL
;
3987 cp_clistate
.cli_share_dst
= NULL
;
3988 cp_clistate
.cwd
= NULL
;
3989 cp_clistate
.attribute
= FILE_ATTRIBUTE_SYSTEM
| FILE_ATTRIBUTE_HIDDEN
| FILE_ATTRIBUTE_DIRECTORY
;
3992 /* open share source */
3993 nt_status
= connect_to_service(c
, &cp_clistate
.cli_share_src
,
3994 smbXcli_conn_remote_sockaddr(cli
->conn
),
3995 smbXcli_conn_remote_name(cli
->conn
),
3996 info502
.name
, "A:");
3997 if (!NT_STATUS_IS_OK(nt_status
))
4000 got_src_share
= true;
4002 if (net_mode_share
== NET_MODE_SHARE_MIGRATE
) {
4003 /* open share destination */
4004 nt_status
= connect_to_service(c
, &cp_clistate
.cli_share_dst
,
4005 NULL
, dst
, info502
.name
, "A:");
4006 if (!NT_STATUS_IS_OK(nt_status
))
4009 got_dst_share
= true;
4012 if (!copy_top_level_perms(c
, &cp_clistate
, info502
.name
)) {
4013 d_fprintf(stderr
, _("Could not handle the top level "
4014 "directory permissions for the "
4015 "share: %s\n"), info502
.name
);
4016 nt_status
= NT_STATUS_UNSUCCESSFUL
;
4020 nt_status
= sync_files(&cp_clistate
, mask
);
4021 if (!NT_STATUS_IS_OK(nt_status
)) {
4022 d_fprintf(stderr
, _("could not handle files for share: "
4023 "%s\n"), info502
.name
);
4028 nt_status
= NT_STATUS_OK
;
4033 cli_shutdown(cp_clistate
.cli_share_src
);
4036 cli_shutdown(cp_clistate
.cli_share_dst
);
4043 static int rpc_share_migrate_files(struct net_context
*c
, int argc
, const char **argv
)
4045 if (c
->display_usage
) {
4047 "net share migrate files\n"
4050 _("Migrate files to local server"));
4055 d_printf(_("no server to migrate\n"));
4059 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
, 0,
4060 rpc_share_migrate_files_internals
,
4065 * Migrate share-ACLs from a remote RPC server to the local RPC server.
4067 * All parameters are provided by the run_rpc_command function, except for
4068 * argc, argv which are passed through.
4070 * @param domain_sid The domain sid acquired from the remote server.
4071 * @param cli A cli_state connected to the server.
4072 * @param mem_ctx Talloc context, destroyed on completion of the function.
4073 * @param argc Standard main() style argc.
4074 * @param argv Standard main() style argv. Initial components are already
4077 * @return Normal NTSTATUS return.
4080 static NTSTATUS
rpc_share_migrate_security_internals(struct net_context
*c
,
4081 const struct dom_sid
*domain_sid
,
4082 const char *domain_name
,
4083 struct cli_state
*cli
,
4084 struct rpc_pipe_client
*pipe_hnd
,
4085 TALLOC_CTX
*mem_ctx
,
4090 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
4091 struct srvsvc_NetShareInfoCtr ctr_src
;
4092 union srvsvc_NetShareInfo info
;
4094 struct rpc_pipe_client
*srvsvc_pipe
= NULL
;
4095 struct cli_state
*cli_dst
= NULL
;
4096 uint32 level
= 502; /* includes secdesc */
4097 uint32_t parm_error
= 0;
4098 struct dcerpc_binding_handle
*b
;
4100 result
= get_share_info(c
, pipe_hnd
, mem_ctx
, level
, argc
, argv
,
4103 if (!W_ERROR_IS_OK(result
))
4106 /* connect destination PI_SRVSVC */
4107 nt_status
= connect_dst_pipe(c
, &cli_dst
, &srvsvc_pipe
,
4108 &ndr_table_srvsvc
.syntax_id
);
4109 if (!NT_STATUS_IS_OK(nt_status
))
4112 b
= srvsvc_pipe
->binding_handle
;
4114 for (i
= 0; i
< ctr_src
.ctr
.ctr502
->count
; i
++) {
4116 struct srvsvc_NetShareInfo502 info502
=
4117 ctr_src
.ctr
.ctr502
->array
[i
];
4119 /* reset error-code */
4120 nt_status
= NT_STATUS_UNSUCCESSFUL
;
4122 if (!check_share_sanity(c
, cli
, info502
.name
, info502
.type
))
4125 printf(_("migrating: [%s], path: %s, comment: %s, including "
4127 info502
.name
, info502
.path
, info502
.comment
);
4130 display_sec_desc(info502
.sd_buf
.sd
);
4132 /* FIXME: shouldn't we be able to just set the security descriptor ? */
4133 info
.info502
= &info502
;
4135 /* finally modify the share on the dst server */
4136 nt_status
= dcerpc_srvsvc_NetShareSetInfo(b
, mem_ctx
,
4137 srvsvc_pipe
->desthost
,
4143 if (!NT_STATUS_IS_OK(nt_status
)) {
4144 printf(_("cannot set share-acl: %s\n"),
4145 nt_errstr(nt_status
));
4148 if (!W_ERROR_IS_OK(result
)) {
4149 nt_status
= werror_to_ntstatus(result
);
4150 printf(_("cannot set share-acl: %s\n"),
4151 win_errstr(result
));
4157 nt_status
= NT_STATUS_OK
;
4161 cli_shutdown(cli_dst
);
4169 * Migrate share-acls from a RPC server to another.
4171 * @param argc Standard main() style argc.
4172 * @param argv Standard main() style argv. Initial components are already
4175 * @return A shell status integer (0 for success).
4177 static int rpc_share_migrate_security(struct net_context
*c
, int argc
,
4180 if (c
->display_usage
) {
4182 "net rpc share migrate security\n"
4185 _("Migrate share-acls to local server"));
4190 d_printf(_("no server to migrate\n"));
4194 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
, 0,
4195 rpc_share_migrate_security_internals
,
4200 * Migrate shares (including share-definitions, share-acls and files with acls/attrs)
4201 * from one server to another.
4203 * @param argc Standard main() style argc.
4204 * @param argv Standard main() style argv. Initial components are already
4207 * @return A shell status integer (0 for success).
4210 static int rpc_share_migrate_all(struct net_context
*c
, int argc
,
4215 if (c
->display_usage
) {
4217 "net rpc share migrate all\n"
4220 _("Migrates shares including all share settings"));
4225 d_printf(_("no server to migrate\n"));
4229 /* order is important. we don't want to be locked out by the share-acl
4230 * before copying files - gd */
4232 ret
= run_rpc_command(c
, NULL
, &ndr_table_srvsvc
, 0,
4233 rpc_share_migrate_shares_internals
, argc
, argv
);
4237 ret
= run_rpc_command(c
, NULL
, &ndr_table_srvsvc
, 0,
4238 rpc_share_migrate_files_internals
, argc
, argv
);
4242 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
, 0,
4243 rpc_share_migrate_security_internals
, argc
,
4249 * 'net rpc share migrate' entrypoint.
4250 * @param argc Standard main() style argc.
4251 * @param argv Standard main() style argv. Initial components are already
4254 static int rpc_share_migrate(struct net_context
*c
, int argc
, const char **argv
)
4257 struct functable func
[] = {
4260 rpc_share_migrate_all
,
4262 N_("Migrate shares from remote to local server"),
4263 N_("net rpc share migrate all\n"
4264 " Migrate shares from remote to local server")
4268 rpc_share_migrate_files
,
4270 N_("Migrate files from remote to local server"),
4271 N_("net rpc share migrate files\n"
4272 " Migrate files from remote to local server")
4276 rpc_share_migrate_security
,
4278 N_("Migrate share-ACLs from remote to local server"),
4279 N_("net rpc share migrate security\n"
4280 " Migrate share-ACLs from remote to local server")
4284 rpc_share_migrate_shares
,
4286 N_("Migrate shares from remote to local server"),
4287 N_("net rpc share migrate shares\n"
4288 " Migrate shares from remote to local server")
4290 {NULL
, NULL
, 0, NULL
, NULL
}
4293 net_mode_share
= NET_MODE_SHARE_MIGRATE
;
4295 return net_run_function(c
, argc
, argv
, "net rpc share migrate", func
);
4301 struct dom_sid
*members
;
4304 static int num_server_aliases
;
4305 static struct full_alias
*server_aliases
;
4308 * Add an alias to the static list.
4310 static void push_alias(TALLOC_CTX
*mem_ctx
, struct full_alias
*alias
)
4312 if (server_aliases
== NULL
)
4313 server_aliases
= SMB_MALLOC_ARRAY(struct full_alias
, 100);
4315 server_aliases
[num_server_aliases
] = *alias
;
4316 num_server_aliases
+= 1;
4320 * For a specific domain on the server, fetch all the aliases
4321 * and their members. Add all of them to the server_aliases.
4324 static NTSTATUS
rpc_fetch_domain_aliases(struct rpc_pipe_client
*pipe_hnd
,
4325 TALLOC_CTX
*mem_ctx
,
4326 struct policy_handle
*connect_pol
,
4327 const struct dom_sid
*domain_sid
)
4329 uint32 start_idx
, max_entries
, num_entries
, i
;
4330 struct samr_SamArray
*groups
= NULL
;
4331 NTSTATUS result
, status
;
4332 struct policy_handle domain_pol
;
4333 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
4335 /* Get domain policy handle */
4337 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
4339 MAXIMUM_ALLOWED_ACCESS
,
4340 discard_const_p(struct dom_sid2
, domain_sid
),
4343 if (!NT_STATUS_IS_OK(status
)) {
4346 if (!NT_STATUS_IS_OK(result
)) {
4354 status
= dcerpc_samr_EnumDomainAliases(b
, mem_ctx
,
4361 if (!NT_STATUS_IS_OK(status
)) {
4364 for (i
= 0; i
< num_entries
; i
++) {
4366 struct policy_handle alias_pol
;
4367 struct full_alias alias
;
4368 struct lsa_SidArray sid_array
;
4372 status
= dcerpc_samr_OpenAlias(b
, mem_ctx
,
4374 MAXIMUM_ALLOWED_ACCESS
,
4375 groups
->entries
[i
].idx
,
4378 if (!NT_STATUS_IS_OK(status
)) {
4381 if (!NT_STATUS_IS_OK(_result
)) {
4386 status
= dcerpc_samr_GetMembersInAlias(b
, mem_ctx
,
4390 if (!NT_STATUS_IS_OK(status
)) {
4393 if (!NT_STATUS_IS_OK(_result
)) {
4398 alias
.num_members
= sid_array
.num_sids
;
4400 status
= dcerpc_samr_Close(b
, mem_ctx
, &alias_pol
, &_result
);
4401 if (!NT_STATUS_IS_OK(status
)) {
4404 if (!NT_STATUS_IS_OK(_result
)) {
4409 alias
.members
= NULL
;
4411 if (alias
.num_members
> 0) {
4412 alias
.members
= SMB_MALLOC_ARRAY(struct dom_sid
, alias
.num_members
);
4414 for (j
= 0; j
< alias
.num_members
; j
++)
4415 sid_copy(&alias
.members
[j
],
4416 sid_array
.sids
[j
].sid
);
4419 sid_compose(&alias
.sid
, domain_sid
,
4420 groups
->entries
[i
].idx
);
4422 push_alias(mem_ctx
, &alias
);
4424 } while (NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
4426 status
= NT_STATUS_OK
;
4429 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
4435 * Dump server_aliases as names for debugging purposes.
4438 static NTSTATUS
rpc_aliaslist_dump(struct net_context
*c
,
4439 const struct dom_sid
*domain_sid
,
4440 const char *domain_name
,
4441 struct cli_state
*cli
,
4442 struct rpc_pipe_client
*pipe_hnd
,
4443 TALLOC_CTX
*mem_ctx
,
4449 struct policy_handle lsa_pol
;
4450 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
4452 result
= rpccli_lsa_open_policy(pipe_hnd
, mem_ctx
, true,
4453 SEC_FLAG_MAXIMUM_ALLOWED
,
4455 if (!NT_STATUS_IS_OK(result
))
4458 for (i
=0; i
<num_server_aliases
; i
++) {
4461 enum lsa_SidType
*types
;
4464 struct full_alias
*alias
= &server_aliases
[i
];
4466 result
= rpccli_lsa_lookup_sids(pipe_hnd
, mem_ctx
, &lsa_pol
, 1,
4468 &domains
, &names
, &types
);
4469 if (!NT_STATUS_IS_OK(result
))
4472 DEBUG(1, ("%s\\%s %d: ", domains
[0], names
[0], types
[0]));
4474 if (alias
->num_members
== 0) {
4479 result
= rpccli_lsa_lookup_sids(pipe_hnd
, mem_ctx
, &lsa_pol
,
4482 &domains
, &names
, &types
);
4484 if (!NT_STATUS_IS_OK(result
) &&
4485 !NT_STATUS_EQUAL(result
, STATUS_SOME_UNMAPPED
))
4488 for (j
=0; j
<alias
->num_members
; j
++)
4489 DEBUG(1, ("%s\\%s (%d); ",
4490 domains
[j
] ? domains
[j
] : "*unknown*",
4491 names
[j
] ? names
[j
] : "*unknown*",types
[j
]));
4495 dcerpc_lsa_Close(b
, mem_ctx
, &lsa_pol
, &result
);
4497 return NT_STATUS_OK
;
4501 * Fetch a list of all server aliases and their members into
4505 static NTSTATUS
rpc_aliaslist_internals(struct net_context
*c
,
4506 const struct dom_sid
*domain_sid
,
4507 const char *domain_name
,
4508 struct cli_state
*cli
,
4509 struct rpc_pipe_client
*pipe_hnd
,
4510 TALLOC_CTX
*mem_ctx
,
4514 NTSTATUS result
, status
;
4515 struct policy_handle connect_pol
;
4516 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
4518 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
4520 MAXIMUM_ALLOWED_ACCESS
,
4523 if (!NT_STATUS_IS_OK(status
)) {
4526 if (!NT_STATUS_IS_OK(result
)) {
4531 status
= rpc_fetch_domain_aliases(pipe_hnd
, mem_ctx
, &connect_pol
,
4532 &global_sid_Builtin
);
4533 if (!NT_STATUS_IS_OK(status
)) {
4537 status
= rpc_fetch_domain_aliases(pipe_hnd
, mem_ctx
, &connect_pol
,
4540 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
4545 static void init_user_token(struct security_token
*token
, struct dom_sid
*user_sid
)
4547 token
->num_sids
= 4;
4549 if (!(token
->sids
= SMB_MALLOC_ARRAY(struct dom_sid
, 4))) {
4550 d_fprintf(stderr
, "malloc %s\n",_("failed"));
4551 token
->num_sids
= 0;
4555 token
->sids
[0] = *user_sid
;
4556 sid_copy(&token
->sids
[1], &global_sid_World
);
4557 sid_copy(&token
->sids
[2], &global_sid_Network
);
4558 sid_copy(&token
->sids
[3], &global_sid_Authenticated_Users
);
4561 static void free_user_token(struct security_token
*token
)
4563 SAFE_FREE(token
->sids
);
4566 static void add_sid_to_token(struct security_token
*token
, struct dom_sid
*sid
)
4568 if (security_token_has_sid(token
, sid
))
4571 token
->sids
= SMB_REALLOC_ARRAY(token
->sids
, struct dom_sid
, token
->num_sids
+1);
4576 sid_copy(&token
->sids
[token
->num_sids
], sid
);
4578 token
->num_sids
+= 1;
4583 struct security_token token
;
4586 static void dump_user_token(struct user_token
*token
)
4590 d_printf("%s\n", token
->name
);
4592 for (i
=0; i
<token
->token
.num_sids
; i
++) {
4593 d_printf(" %s\n", sid_string_tos(&token
->token
.sids
[i
]));
4597 static bool is_alias_member(struct dom_sid
*sid
, struct full_alias
*alias
)
4601 for (i
=0; i
<alias
->num_members
; i
++) {
4602 if (dom_sid_compare(sid
, &alias
->members
[i
]) == 0)
4609 static void collect_sid_memberships(struct security_token
*token
, struct dom_sid sid
)
4613 for (i
=0; i
<num_server_aliases
; i
++) {
4614 if (is_alias_member(&sid
, &server_aliases
[i
]))
4615 add_sid_to_token(token
, &server_aliases
[i
].sid
);
4620 * We got a user token with all the SIDs we can know about without asking the
4621 * server directly. These are the user and domain group sids. All of these can
4622 * be members of aliases. So scan the list of aliases for each of the SIDs and
4623 * add them to the token.
4626 static void collect_alias_memberships(struct security_token
*token
)
4628 int num_global_sids
= token
->num_sids
;
4631 for (i
=0; i
<num_global_sids
; i
++) {
4632 collect_sid_memberships(token
, token
->sids
[i
]);
4636 static bool get_user_sids(const char *domain
, const char *user
, struct security_token
*token
)
4638 wbcErr wbc_status
= WBC_ERR_UNKNOWN_FAILURE
;
4639 enum wbcSidType type
;
4641 struct wbcDomainSid wsid
;
4642 char sid_str
[WBC_SID_STRING_BUFLEN
];
4643 struct dom_sid user_sid
;
4644 uint32_t num_groups
;
4645 gid_t
*groups
= NULL
;
4648 fstr_sprintf(full_name
, "%s%c%s",
4649 domain
, *lp_winbind_separator(), user
);
4651 /* First let's find out the user sid */
4653 wbc_status
= wbcLookupName(domain
, user
, &wsid
, &type
);
4655 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4656 DEBUG(1, ("winbind could not find %s: %s\n",
4657 full_name
, wbcErrorString(wbc_status
)));
4661 wbcSidToStringBuf(&wsid
, sid_str
, sizeof(sid_str
));
4663 if (type
!= WBC_SID_NAME_USER
) {
4664 DEBUG(1, ("%s is not a user\n", full_name
));
4668 if (!string_to_sid(&user_sid
, sid_str
)) {
4669 DEBUG(1,("Could not convert sid %s from string\n", sid_str
));
4673 init_user_token(token
, &user_sid
);
4675 /* And now the groups winbind knows about */
4677 wbc_status
= wbcGetGroups(full_name
, &num_groups
, &groups
);
4678 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4679 DEBUG(1, ("winbind could not get groups of %s: %s\n",
4680 full_name
, wbcErrorString(wbc_status
)));
4684 for (i
= 0; i
< num_groups
; i
++) {
4685 gid_t gid
= groups
[i
];
4689 wbc_status
= wbcGidToSid(gid
, &wsid
);
4690 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4691 DEBUG(1, ("winbind could not find SID of gid %u: %s\n",
4692 (unsigned int)gid
, wbcErrorString(wbc_status
)));
4693 wbcFreeMemory(groups
);
4697 wbcSidToStringBuf(&wsid
, sid_str
, sizeof(sid_str
));
4699 DEBUG(3, (" %s\n", sid_str
));
4701 ok
= string_to_sid(&sid
, sid_str
);
4703 DEBUG(1, ("Failed to convert string to SID\n"));
4704 wbcFreeMemory(groups
);
4707 add_sid_to_token(token
, &sid
);
4709 wbcFreeMemory(groups
);
4715 * Get a list of all user tokens we want to look at
4718 static bool get_user_tokens(struct net_context
*c
, int *num_tokens
,
4719 struct user_token
**user_tokens
)
4721 wbcErr wbc_status
= WBC_ERR_UNKNOWN_FAILURE
;
4722 uint32_t i
, num_users
;
4724 struct user_token
*result
;
4725 TALLOC_CTX
*frame
= NULL
;
4727 if (lp_winbind_use_default_domain() &&
4728 (c
->opt_target_workgroup
== NULL
)) {
4729 d_fprintf(stderr
, _("winbind use default domain = yes set, "
4730 "please specify a workgroup\n"));
4734 /* Send request to winbind daemon */
4736 wbc_status
= wbcListUsers(NULL
, &num_users
, &users
);
4737 if (!WBC_ERROR_IS_OK(wbc_status
)) {
4738 DEBUG(1, (_("winbind could not list users: %s\n"),
4739 wbcErrorString(wbc_status
)));
4743 result
= SMB_MALLOC_ARRAY(struct user_token
, num_users
);
4745 if (result
== NULL
) {
4746 DEBUG(1, ("Could not malloc sid array\n"));
4747 wbcFreeMemory(users
);
4751 frame
= talloc_stackframe();
4752 for (i
=0; i
< num_users
; i
++) {
4753 fstring domain
, user
;
4756 fstrcpy(result
[i
].name
, users
[i
]);
4758 p
= strchr(users
[i
], *lp_winbind_separator());
4760 DEBUG(3, ("%s\n", users
[i
]));
4763 fstrcpy(domain
, c
->opt_target_workgroup
);
4764 fstrcpy(user
, users
[i
]);
4767 fstrcpy(domain
, users
[i
]);
4768 if (!strupper_m(domain
)) {
4769 DEBUG(1, ("strupper_m %s failed\n", domain
));
4770 wbcFreeMemory(users
);
4776 get_user_sids(domain
, user
, &(result
[i
].token
));
4779 wbcFreeMemory(users
);
4781 *num_tokens
= num_users
;
4782 *user_tokens
= result
;
4787 static bool get_user_tokens_from_file(FILE *f
,
4789 struct user_token
**tokens
)
4791 struct user_token
*token
= NULL
;
4796 if (fgets(line
, sizeof(line
)-1, f
) == NULL
) {
4800 if ((strlen(line
) > 0) && (line
[strlen(line
)-1] == '\n')) {
4801 line
[strlen(line
)-1] = '\0';
4804 if (line
[0] == ' ') {
4808 if(!string_to_sid(&sid
, &line
[1])) {
4809 DEBUG(1,("get_user_tokens_from_file: Could "
4810 "not convert sid %s \n",&line
[1]));
4814 if (token
== NULL
) {
4815 DEBUG(0, ("File does not begin with username"));
4819 add_sid_to_token(&token
->token
, &sid
);
4823 /* And a new user... */
4826 *tokens
= SMB_REALLOC_ARRAY(*tokens
, struct user_token
, *num_tokens
);
4827 if (*tokens
== NULL
) {
4828 DEBUG(0, ("Could not realloc tokens\n"));
4832 token
= &((*tokens
)[*num_tokens
-1]);
4834 if (strlcpy(token
->name
, line
, sizeof(token
->name
)) >= sizeof(token
->name
)) {
4837 token
->token
.num_sids
= 0;
4838 token
->token
.sids
= NULL
;
4847 * Show the list of all users that have access to a share
4850 static void show_userlist(struct rpc_pipe_client
*pipe_hnd
,
4851 TALLOC_CTX
*mem_ctx
,
4852 const char *netname
,
4854 struct user_token
*tokens
)
4857 struct security_descriptor
*share_sd
= NULL
;
4858 struct security_descriptor
*root_sd
= NULL
;
4859 struct cli_state
*cli
= rpc_pipe_np_smb_conn(pipe_hnd
);
4861 union srvsvc_NetShareInfo info
;
4865 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
4867 status
= dcerpc_srvsvc_NetShareGetInfo(b
, mem_ctx
,
4874 if (!NT_STATUS_IS_OK(status
) || !W_ERROR_IS_OK(result
)) {
4875 DEBUG(1, ("Coult not query secdesc for share %s\n",
4880 share_sd
= info
.info502
->sd_buf
.sd
;
4881 if (share_sd
== NULL
) {
4882 DEBUG(1, ("Got no secdesc for share %s\n",
4886 cnum
= cli_state_get_tid(cli
);
4888 if (!NT_STATUS_IS_OK(cli_tree_connect(cli
, netname
, "A:", "", 0))) {
4892 if (!NT_STATUS_IS_OK(cli_ntcreate(cli
, "\\", 0, READ_CONTROL_ACCESS
, 0,
4893 FILE_SHARE_READ
|FILE_SHARE_WRITE
, FILE_OPEN
, 0x0, 0x0, &fnum
))) {
4894 cli_query_secdesc(cli
, fnum
, mem_ctx
, &root_sd
);
4897 for (i
=0; i
<num_tokens
; i
++) {
4900 if (share_sd
!= NULL
) {
4901 status
= se_access_check(share_sd
, &tokens
[i
].token
,
4904 if (!NT_STATUS_IS_OK(status
)) {
4905 DEBUG(1, ("Could not check share_sd for "
4912 if (root_sd
== NULL
) {
4913 d_printf(" %s\n", tokens
[i
].name
);
4917 status
= se_access_check(root_sd
, &tokens
[i
].token
,
4919 if (!NT_STATUS_IS_OK(status
)) {
4920 DEBUG(1, ("Could not check root_sd for user %s\n",
4924 d_printf(" %s\n", tokens
[i
].name
);
4927 if (fnum
!= (uint16_t)-1)
4928 cli_close(cli
, fnum
);
4930 cli_state_set_tid(cli
, cnum
);
4936 * List shares on a remote RPC server, including the security descriptors.
4938 * All parameters are provided by the run_rpc_command function, except for
4939 * argc, argv which are passed through.
4941 * @param domain_sid The domain sid acquired from the remote server.
4942 * @param cli A cli_state connected to the server.
4943 * @param mem_ctx Talloc context, destroyed on completion of the function.
4944 * @param argc Standard main() style argc.
4945 * @param argv Standard main() style argv. Initial components are already
4948 * @return Normal NTSTATUS return.
4951 static NTSTATUS
rpc_share_allowedusers_internals(struct net_context
*c
,
4952 const struct dom_sid
*domain_sid
,
4953 const char *domain_name
,
4954 struct cli_state
*cli
,
4955 struct rpc_pipe_client
*pipe_hnd
,
4956 TALLOC_CTX
*mem_ctx
,
4962 NTSTATUS nt_status
= NT_STATUS_OK
;
4963 uint32_t total_entries
= 0;
4964 uint32_t resume_handle
= 0;
4965 uint32_t preferred_len
= 0xffffffff;
4967 struct dcerpc_binding_handle
*b
= NULL
;
4968 struct srvsvc_NetShareInfoCtr info_ctr
;
4969 struct srvsvc_NetShareCtr1 ctr1
;
4972 struct user_token
*tokens
= NULL
;
4978 f
= fopen(argv
[0], "r");
4982 DEBUG(0, ("Could not open userlist: %s\n", strerror(errno
)));
4983 return NT_STATUS_UNSUCCESSFUL
;
4986 r
= get_user_tokens_from_file(f
, &num_tokens
, &tokens
);
4992 DEBUG(0, ("Could not read users from file\n"));
4993 return NT_STATUS_UNSUCCESSFUL
;
4996 for (i
=0; i
<num_tokens
; i
++)
4997 collect_alias_memberships(&tokens
[i
].token
);
4999 ZERO_STRUCT(info_ctr
);
5003 info_ctr
.ctr
.ctr1
= &ctr1
;
5005 b
= pipe_hnd
->binding_handle
;
5007 /* Issue the NetShareEnum RPC call and retrieve the response */
5008 nt_status
= dcerpc_srvsvc_NetShareEnumAll(b
,
5017 /* Was it successful? */
5018 if (!NT_STATUS_IS_OK(nt_status
)) {
5019 /* Nope. Go clean up. */
5023 if (!W_ERROR_IS_OK(result
)) {
5024 /* Nope. Go clean up. */
5025 nt_status
= werror_to_ntstatus(result
);
5029 if (total_entries
== 0) {
5033 /* For each returned entry... */
5034 for (i
= 0; i
< info_ctr
.ctr
.ctr1
->count
; i
++) {
5035 const char *netname
= info_ctr
.ctr
.ctr1
->array
[i
].name
;
5037 if (info_ctr
.ctr
.ctr1
->array
[i
].type
!= STYPE_DISKTREE
) {
5041 d_printf("%s\n", netname
);
5043 show_userlist(pipe_hnd
, mem_ctx
, netname
,
5044 num_tokens
, tokens
);
5047 for (i
=0; i
<num_tokens
; i
++) {
5048 free_user_token(&tokens
[i
].token
);
5055 static int rpc_share_allowedusers(struct net_context
*c
, int argc
,
5060 if (c
->display_usage
) {
5062 "net rpc share allowedusers\n"
5065 _("List allowed users"));
5069 result
= run_rpc_command(c
, NULL
, &ndr_table_samr
, 0,
5070 rpc_aliaslist_internals
,
5075 result
= run_rpc_command(c
, NULL
, &ndr_table_lsarpc
, 0,
5081 return run_rpc_command(c
, NULL
, &ndr_table_srvsvc
, 0,
5082 rpc_share_allowedusers_internals
,
5086 int net_usersidlist(struct net_context
*c
, int argc
, const char **argv
)
5089 struct user_token
*tokens
= NULL
;
5093 net_usersidlist_usage(c
, argc
, argv
);
5097 if (!get_user_tokens(c
, &num_tokens
, &tokens
)) {
5098 DEBUG(0, ("Could not get the user/sid list\n"));
5102 for (i
=0; i
<num_tokens
; i
++) {
5103 dump_user_token(&tokens
[i
]);
5104 free_user_token(&tokens
[i
].token
);
5111 int net_usersidlist_usage(struct net_context
*c
, int argc
, const char **argv
)
5113 d_printf(_("net usersidlist\n"
5114 "\tprints out a list of all users the running winbind knows\n"
5115 "\tabout, together with all their SIDs. This is used as\n"
5116 "\tinput to the 'net rpc share allowedusers' command.\n\n"));
5118 net_common_flags_usage(c
, argc
, argv
);
5123 * 'net rpc share' entrypoint.
5124 * @param argc Standard main() style argc.
5125 * @param argv Standard main() style argv. Initial components are already
5129 int net_rpc_share(struct net_context
*c
, int argc
, const char **argv
)
5131 NET_API_STATUS status
;
5133 struct functable func
[] = {
5139 N_("net rpc share add\n"
5147 N_("net rpc share delete\n"
5152 rpc_share_allowedusers
,
5154 N_("Modify allowed users"),
5155 N_("net rpc share allowedusers\n"
5156 " Modify allowed users")
5162 N_("Migrate share to local server"),
5163 N_("net rpc share migrate\n"
5164 " Migrate share to local server")
5171 N_("net rpc share list\n"
5174 {NULL
, NULL
, 0, NULL
, NULL
}
5177 status
= libnetapi_net_init(&c
->netapi_ctx
);
5181 libnetapi_set_username(c
->netapi_ctx
, c
->opt_user_name
);
5182 libnetapi_set_password(c
->netapi_ctx
, c
->opt_password
);
5183 if (c
->opt_kerberos
) {
5184 libnetapi_set_use_kerberos(c
->netapi_ctx
);
5188 if (c
->display_usage
) {
5193 " Alias for net rpc share list\n"));
5194 net_display_usage_from_functable(func
);
5198 return rpc_share_list(c
, argc
, argv
);
5201 return net_run_function(c
, argc
, argv
, "net rpc share", func
);
5204 static NTSTATUS
rpc_sh_share_list(struct net_context
*c
,
5205 TALLOC_CTX
*mem_ctx
,
5206 struct rpc_sh_ctx
*ctx
,
5207 struct rpc_pipe_client
*pipe_hnd
,
5208 int argc
, const char **argv
)
5211 return werror_to_ntstatus(W_ERROR(rpc_share_list(c
, argc
, argv
)));
5214 static NTSTATUS
rpc_sh_share_add(struct net_context
*c
,
5215 TALLOC_CTX
*mem_ctx
,
5216 struct rpc_sh_ctx
*ctx
,
5217 struct rpc_pipe_client
*pipe_hnd
,
5218 int argc
, const char **argv
)
5220 NET_API_STATUS status
;
5221 uint32_t parm_err
= 0;
5222 struct SHARE_INFO_2 i2
;
5224 if ((argc
< 2) || (argc
> 3)) {
5225 d_fprintf(stderr
, _("Usage: %s <share> <path> [comment]\n"),
5227 return NT_STATUS_INVALID_PARAMETER
;
5230 i2
.shi2_netname
= argv
[0];
5231 i2
.shi2_type
= STYPE_DISKTREE
;
5232 i2
.shi2_remark
= (argc
== 3) ? argv
[2] : "";
5233 i2
.shi2_permissions
= 0;
5234 i2
.shi2_max_uses
= 0;
5235 i2
.shi2_current_uses
= 0;
5236 i2
.shi2_path
= argv
[1];
5237 i2
.shi2_passwd
= NULL
;
5239 status
= NetShareAdd(pipe_hnd
->desthost
,
5244 return werror_to_ntstatus(W_ERROR(status
));
5247 static NTSTATUS
rpc_sh_share_delete(struct net_context
*c
,
5248 TALLOC_CTX
*mem_ctx
,
5249 struct rpc_sh_ctx
*ctx
,
5250 struct rpc_pipe_client
*pipe_hnd
,
5251 int argc
, const char **argv
)
5254 d_fprintf(stderr
, "%s %s <share>\n", _("Usage:"), ctx
->whoami
);
5255 return NT_STATUS_INVALID_PARAMETER
;
5258 return werror_to_ntstatus(W_ERROR(NetShareDel(pipe_hnd
->desthost
, argv
[0], 0)));
5261 static NTSTATUS
rpc_sh_share_info(struct net_context
*c
,
5262 TALLOC_CTX
*mem_ctx
,
5263 struct rpc_sh_ctx
*ctx
,
5264 struct rpc_pipe_client
*pipe_hnd
,
5265 int argc
, const char **argv
)
5267 union srvsvc_NetShareInfo info
;
5270 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
5273 d_fprintf(stderr
, "%s %s <share>\n", _("Usage:"), ctx
->whoami
);
5274 return NT_STATUS_INVALID_PARAMETER
;
5277 status
= dcerpc_srvsvc_NetShareGetInfo(b
, mem_ctx
,
5283 if (!NT_STATUS_IS_OK(status
)) {
5284 result
= ntstatus_to_werror(status
);
5287 if (!W_ERROR_IS_OK(result
)) {
5291 d_printf(_("Name: %s\n"), info
.info2
->name
);
5292 d_printf(_("Comment: %s\n"), info
.info2
->comment
);
5293 d_printf(_("Path: %s\n"), info
.info2
->path
);
5294 d_printf(_("Password: %s\n"), info
.info2
->password
);
5297 return werror_to_ntstatus(result
);
5300 struct rpc_sh_cmd
*net_rpc_share_cmds(struct net_context
*c
, TALLOC_CTX
*mem_ctx
,
5301 struct rpc_sh_ctx
*ctx
)
5303 static struct rpc_sh_cmd cmds
[] = {
5305 { "list", NULL
, &ndr_table_srvsvc
, rpc_sh_share_list
,
5306 N_("List available shares") },
5308 { "add", NULL
, &ndr_table_srvsvc
, rpc_sh_share_add
,
5309 N_("Add a share") },
5311 { "delete", NULL
, &ndr_table_srvsvc
, rpc_sh_share_delete
,
5312 N_("Delete a share") },
5314 { "info", NULL
, &ndr_table_srvsvc
, rpc_sh_share_info
,
5315 N_("Get information about a share") },
5317 { NULL
, NULL
, 0, NULL
, NULL
}
5323 /****************************************************************************/
5325 static int rpc_file_usage(struct net_context
*c
, int argc
, const char **argv
)
5327 return net_file_usage(c
, argc
, argv
);
5331 * Close a file on a remote RPC server.
5333 * @param argc Standard main() style argc.
5334 * @param argv Standard main() style argv. Initial components are already
5337 * @return A shell status integer (0 for success).
5339 static int rpc_file_close(struct net_context
*c
, int argc
, const char **argv
)
5341 if (argc
< 1 || c
->display_usage
) {
5342 return rpc_file_usage(c
, argc
, argv
);
5345 return NetFileClose(c
->opt_host
, atoi(argv
[0]));
5349 * Formatted print of open file info
5351 * @param r struct FILE_INFO_3 contents
5354 static void display_file_info_3(struct FILE_INFO_3
*r
)
5356 d_printf("%-7.1d %-20.20s 0x%-4.2x %-6.1d %s\n",
5357 r
->fi3_id
, r
->fi3_username
, r
->fi3_permissions
,
5358 r
->fi3_num_locks
, r
->fi3_pathname
);
5362 * List files for a user on a remote RPC server.
5364 * @param argc Standard main() style argc.
5365 * @param argv Standard main() style argv. Initial components are already
5368 * @return A shell status integer (0 for success)..
5371 static int rpc_file_user(struct net_context
*c
, int argc
, const char **argv
)
5373 NET_API_STATUS status
;
5374 uint32 preferred_len
= 0xffffffff, i
;
5375 char *username
=NULL
;
5376 uint32_t total_entries
= 0;
5377 uint32_t entries_read
= 0;
5378 uint32_t resume_handle
= 0;
5379 struct FILE_INFO_3
*i3
= NULL
;
5381 if (c
->display_usage
) {
5382 return rpc_file_usage(c
, argc
, argv
);
5385 /* if argc > 0, must be user command */
5387 username
= smb_xstrdup(argv
[0]);
5390 status
= NetFileEnum(c
->opt_host
,
5394 (uint8_t **)(void *)&i3
,
5404 /* Display results */
5407 "\nEnumerating open files on remote server:\n\n"
5408 "\nFileId Opened by Perms Locks Path"
5409 "\n------ --------- ----- ----- ---- \n"));
5410 for (i
= 0; i
< entries_read
; i
++) {
5411 display_file_info_3(&i3
[i
]);
5414 SAFE_FREE(username
);
5419 * 'net rpc file' entrypoint.
5420 * @param argc Standard main() style argc.
5421 * @param argv Standard main() style argv. Initial components are already
5425 int net_rpc_file(struct net_context
*c
, int argc
, const char **argv
)
5427 NET_API_STATUS status
;
5429 struct functable func
[] = {
5434 N_("Close opened file"),
5435 N_("net rpc file close\n"
5436 " Close opened file")
5442 N_("List files opened by user"),
5443 N_("net rpc file user\n"
5444 " List files opened by user")
5451 N_("Display information about opened file"),
5452 N_("net rpc file info\n"
5453 " Display information about opened file")
5456 {NULL
, NULL
, 0, NULL
, NULL
}
5459 status
= libnetapi_net_init(&c
->netapi_ctx
);
5463 libnetapi_set_username(c
->netapi_ctx
, c
->opt_user_name
);
5464 libnetapi_set_password(c
->netapi_ctx
, c
->opt_password
);
5465 if (c
->opt_kerberos
) {
5466 libnetapi_set_use_kerberos(c
->netapi_ctx
);
5470 if (c
->display_usage
) {
5471 d_printf(_("Usage:\n"));
5472 d_printf(_("net rpc file\n"
5473 " List opened files\n"));
5474 net_display_usage_from_functable(func
);
5478 return rpc_file_user(c
, argc
, argv
);
5481 return net_run_function(c
, argc
, argv
, "net rpc file", func
);
5485 * ABORT the shutdown of a remote RPC Server, over initshutdown pipe.
5487 * All parameters are provided by the run_rpc_command function, except for
5488 * argc, argv which are passed through.
5490 * @param c A net_context structure.
5491 * @param domain_sid The domain sid acquired from the remote server.
5492 * @param cli A cli_state connected to the server.
5493 * @param mem_ctx Talloc context, destroyed on completion of the function.
5494 * @param argc Standard main() style argc.
5495 * @param argv Standard main() style argv. Initial components are already
5498 * @return Normal NTSTATUS return.
5501 static NTSTATUS
rpc_shutdown_abort_internals(struct net_context
*c
,
5502 const struct dom_sid
*domain_sid
,
5503 const char *domain_name
,
5504 struct cli_state
*cli
,
5505 struct rpc_pipe_client
*pipe_hnd
,
5506 TALLOC_CTX
*mem_ctx
,
5510 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
5512 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
5514 status
= dcerpc_initshutdown_Abort(b
, mem_ctx
, NULL
, &result
);
5515 if (!NT_STATUS_IS_OK(status
)) {
5518 if (W_ERROR_IS_OK(result
)) {
5519 d_printf(_("\nShutdown successfully aborted\n"));
5520 DEBUG(5,("cmd_shutdown_abort: query succeeded\n"));
5522 DEBUG(5,("cmd_shutdown_abort: query failed\n"));
5524 return werror_to_ntstatus(result
);
5528 * ABORT the shutdown of a remote RPC Server, over winreg pipe.
5530 * All parameters are provided by the run_rpc_command function, except for
5531 * argc, argv which are passed through.
5533 * @param c A net_context structure.
5534 * @param domain_sid The domain sid acquired from the remote server.
5535 * @param cli A cli_state connected to the server.
5536 * @param mem_ctx Talloc context, destroyed on completion of the function.
5537 * @param argc Standard main() style argc.
5538 * @param argv Standard main() style argv. Initial components are already
5541 * @return Normal NTSTATUS return.
5544 static NTSTATUS
rpc_reg_shutdown_abort_internals(struct net_context
*c
,
5545 const struct dom_sid
*domain_sid
,
5546 const char *domain_name
,
5547 struct cli_state
*cli
,
5548 struct rpc_pipe_client
*pipe_hnd
,
5549 TALLOC_CTX
*mem_ctx
,
5553 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
5555 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
5557 result
= dcerpc_winreg_AbortSystemShutdown(b
, mem_ctx
, NULL
, &werr
);
5559 if (!NT_STATUS_IS_OK(result
)) {
5560 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
5563 if (W_ERROR_IS_OK(werr
)) {
5564 d_printf(_("\nShutdown successfully aborted\n"));
5565 DEBUG(5,("cmd_reg_abort_shutdown: query succeeded\n"));
5567 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
5569 return werror_to_ntstatus(werr
);
5573 * ABORT the shutdown of a remote RPC server.
5575 * @param argc Standard main() style argc.
5576 * @param argv Standard main() style argv. Initial components are already
5579 * @return A shell status integer (0 for success).
5582 static int rpc_shutdown_abort(struct net_context
*c
, int argc
,
5587 if (c
->display_usage
) {
5589 "net rpc abortshutdown\n"
5592 _("Abort a scheduled shutdown"));
5596 rc
= run_rpc_command(c
, NULL
, &ndr_table_initshutdown
, 0,
5597 rpc_shutdown_abort_internals
, argc
, argv
);
5602 DEBUG(1, ("initshutdown pipe didn't work, trying winreg pipe\n"));
5604 return run_rpc_command(c
, NULL
, &ndr_table_winreg
, 0,
5605 rpc_reg_shutdown_abort_internals
,
5610 * Shut down a remote RPC Server via initshutdown pipe.
5612 * All parameters are provided by the run_rpc_command function, except for
5613 * argc, argv which are passed through.
5615 * @param c A net_context structure.
5616 * @param domain_sid The domain sid acquired from the remote server.
5617 * @param cli A cli_state connected to the server.
5618 * @param mem_ctx Talloc context, destroyed on completion of the function.
5619 * @param argc Standard main() style argc.
5620 * @param argv Standard main() style argv. Initial components are already
5623 * @return Normal NTSTATUS return.
5626 NTSTATUS
rpc_init_shutdown_internals(struct net_context
*c
,
5627 const struct dom_sid
*domain_sid
,
5628 const char *domain_name
,
5629 struct cli_state
*cli
,
5630 struct rpc_pipe_client
*pipe_hnd
,
5631 TALLOC_CTX
*mem_ctx
,
5635 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
5637 const char *msg
= N_("This machine will be shutdown shortly");
5638 uint32 timeout
= 20;
5639 struct lsa_StringLarge msg_string
;
5640 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
5642 if (c
->opt_comment
) {
5643 msg
= c
->opt_comment
;
5645 if (c
->opt_timeout
) {
5646 timeout
= c
->opt_timeout
;
5649 msg_string
.string
= msg
;
5651 /* create an entry */
5652 status
= dcerpc_initshutdown_Init(b
, mem_ctx
, NULL
,
5653 &msg_string
, timeout
, c
->opt_force
, c
->opt_reboot
,
5655 if (!NT_STATUS_IS_OK(status
)) {
5658 if (W_ERROR_IS_OK(result
)) {
5659 d_printf(_("\nShutdown of remote machine succeeded\n"));
5660 DEBUG(5,("Shutdown of remote machine succeeded\n"));
5662 DEBUG(1,("Shutdown of remote machine failed!\n"));
5664 return werror_to_ntstatus(result
);
5668 * Shut down a remote RPC Server via winreg pipe.
5670 * All parameters are provided by the run_rpc_command function, except for
5671 * argc, argv which are passed through.
5673 * @param c A net_context structure.
5674 * @param domain_sid The domain sid acquired from the remote server.
5675 * @param cli A cli_state connected to the server.
5676 * @param mem_ctx Talloc context, destroyed on completion of the function.
5677 * @param argc Standard main() style argc.
5678 * @param argv Standard main() style argv. Initial components are already
5681 * @return Normal NTSTATUS return.
5684 NTSTATUS
rpc_reg_shutdown_internals(struct net_context
*c
,
5685 const struct dom_sid
*domain_sid
,
5686 const char *domain_name
,
5687 struct cli_state
*cli
,
5688 struct rpc_pipe_client
*pipe_hnd
,
5689 TALLOC_CTX
*mem_ctx
,
5693 const char *msg
= N_("This machine will be shutdown shortly");
5694 uint32 timeout
= 20;
5695 struct lsa_StringLarge msg_string
;
5698 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
5700 if (c
->opt_comment
) {
5701 msg
= c
->opt_comment
;
5703 msg_string
.string
= msg
;
5705 if (c
->opt_timeout
) {
5706 timeout
= c
->opt_timeout
;
5709 /* create an entry */
5710 result
= dcerpc_winreg_InitiateSystemShutdown(b
, mem_ctx
, NULL
,
5711 &msg_string
, timeout
, c
->opt_force
, c
->opt_reboot
,
5713 if (!NT_STATUS_IS_OK(result
)) {
5714 d_fprintf(stderr
, "\nShutdown of remote machine failed\n");
5718 if (W_ERROR_IS_OK(werr
)) {
5719 d_printf(_("\nShutdown of remote machine succeeded\n"));
5721 d_fprintf(stderr
, "\nShutdown of remote machine failed\n");
5722 if ( W_ERROR_EQUAL(werr
, WERR_MACHINE_LOCKED
) )
5723 d_fprintf(stderr
, "\nMachine locked, use -f switch to force\n");
5725 d_fprintf(stderr
, "\nresult was: %s\n", win_errstr(werr
));
5728 return werror_to_ntstatus(werr
);
5732 * Shut down a remote RPC server.
5734 * @param argc Standard main() style argc.
5735 * @param argv Standard main() style argv. Initial components are already
5738 * @return A shell status integer (0 for success).
5741 static int rpc_shutdown(struct net_context
*c
, int argc
, const char **argv
)
5745 if (c
->display_usage
) {
5747 "net rpc shutdown\n"
5750 _("Shut down a remote RPC server"));
5754 rc
= run_rpc_command(c
, NULL
, &ndr_table_initshutdown
, 0,
5755 rpc_init_shutdown_internals
, argc
, argv
);
5758 DEBUG(1, ("initshutdown pipe failed, trying winreg pipe\n"));
5759 rc
= run_rpc_command(c
, NULL
, &ndr_table_winreg
, 0,
5760 rpc_reg_shutdown_internals
, argc
, argv
);
5766 /***************************************************************************
5767 NT Domain trusts code (i.e. 'net rpc trustdom' functionality)
5768 ***************************************************************************/
5771 * Add interdomain trust account to the RPC server.
5772 * All parameters (except for argc and argv) are passed by run_rpc_command
5775 * @param c A net_context structure.
5776 * @param domain_sid The domain sid acquired from the server.
5777 * @param cli A cli_state connected to the server.
5778 * @param mem_ctx Talloc context, destroyed on completion of the function.
5779 * @param argc Standard main() style argc.
5780 * @param argv Standard main() style argv. Initial components are already
5783 * @return normal NTSTATUS return code.
5786 static NTSTATUS
rpc_trustdom_add_internals(struct net_context
*c
,
5787 const struct dom_sid
*domain_sid
,
5788 const char *domain_name
,
5789 struct cli_state
*cli
,
5790 struct rpc_pipe_client
*pipe_hnd
,
5791 TALLOC_CTX
*mem_ctx
,
5795 struct policy_handle connect_pol
, domain_pol
, user_pol
;
5796 NTSTATUS status
, result
;
5798 struct lsa_String lsa_acct_name
;
5800 uint32 acct_flags
=0;
5802 uint32_t access_granted
= 0;
5803 union samr_UserInfo info
;
5804 unsigned int orig_timeout
;
5805 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
5806 DATA_BLOB session_key
= data_blob_null
;
5811 _(" net rpc trustdom add <domain_name> "
5812 "<trust password>\n"));
5813 return NT_STATUS_INVALID_PARAMETER
;
5817 * Make valid trusting domain account (ie. uppercased and with '$' appended)
5820 if (asprintf(&acct_name
, "%s$", argv
[0]) < 0) {
5821 return NT_STATUS_NO_MEMORY
;
5824 if (!strupper_m(acct_name
)) {
5825 SAFE_FREE(acct_name
);
5826 return NT_STATUS_INVALID_PARAMETER
;
5829 init_lsa_String(&lsa_acct_name
, acct_name
);
5831 status
= cli_get_session_key(mem_ctx
, pipe_hnd
, &session_key
);
5832 if (!NT_STATUS_IS_OK(status
)) {
5833 DEBUG(0,("Error getting session_key of SAM pipe. Error was %s\n",
5834 nt_errstr(status
)));
5838 /* Get samr policy handle */
5839 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
5841 MAXIMUM_ALLOWED_ACCESS
,
5844 if (!NT_STATUS_IS_OK(status
)) {
5847 if (!NT_STATUS_IS_OK(result
)) {
5852 /* Get domain policy handle */
5853 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
5855 MAXIMUM_ALLOWED_ACCESS
,
5856 discard_const_p(struct dom_sid2
, domain_sid
),
5859 if (!NT_STATUS_IS_OK(status
)) {
5862 if (!NT_STATUS_IS_OK(result
)) {
5867 /* This call can take a long time - allow the server to time out.
5868 * 35 seconds should do it. */
5870 orig_timeout
= rpccli_set_timeout(pipe_hnd
, 35000);
5872 /* Create trusting domain's account */
5873 acb_info
= ACB_NORMAL
;
5874 acct_flags
= SEC_GENERIC_READ
| SEC_GENERIC_WRITE
| SEC_GENERIC_EXECUTE
|
5875 SEC_STD_WRITE_DAC
| SEC_STD_DELETE
|
5876 SAMR_USER_ACCESS_SET_PASSWORD
|
5877 SAMR_USER_ACCESS_GET_ATTRIBUTES
|
5878 SAMR_USER_ACCESS_SET_ATTRIBUTES
;
5880 status
= dcerpc_samr_CreateUser2(b
, mem_ctx
,
5889 if (!NT_STATUS_IS_OK(status
)) {
5892 /* And restore our original timeout. */
5893 rpccli_set_timeout(pipe_hnd
, orig_timeout
);
5895 if (!NT_STATUS_IS_OK(result
)) {
5897 d_printf(_("net rpc trustdom add: create user %s failed %s\n"),
5898 acct_name
, nt_errstr(result
));
5903 struct samr_CryptPassword crypt_pwd
;
5905 ZERO_STRUCT(info
.info23
);
5907 init_samr_CryptPassword(argv
[1],
5911 info
.info23
.info
.fields_present
= SAMR_FIELD_ACCT_FLAGS
|
5912 SAMR_FIELD_NT_PASSWORD_PRESENT
;
5913 info
.info23
.info
.acct_flags
= ACB_DOMTRUST
;
5914 info
.info23
.password
= crypt_pwd
;
5916 status
= dcerpc_samr_SetUserInfo2(b
, mem_ctx
,
5921 if (!NT_STATUS_IS_OK(status
)) {
5925 if (!NT_STATUS_IS_OK(result
)) {
5927 DEBUG(0,("Could not set trust account password: %s\n",
5928 nt_errstr(result
)));
5934 SAFE_FREE(acct_name
);
5935 data_blob_clear_free(&session_key
);
5940 * Create interdomain trust account for a remote domain.
5942 * @param argc Standard argc.
5943 * @param argv Standard argv without initial components.
5945 * @return Integer status (0 means success).
5948 static int rpc_trustdom_add(struct net_context
*c
, int argc
, const char **argv
)
5950 if (argc
> 0 && !c
->display_usage
) {
5951 return run_rpc_command(c
, NULL
, &ndr_table_samr
, 0,
5952 rpc_trustdom_add_internals
, argc
, argv
);
5956 _("net rpc trustdom add <domain_name> <trust "
5964 * Remove interdomain trust account from the RPC server.
5965 * All parameters (except for argc and argv) are passed by run_rpc_command
5968 * @param c A net_context structure.
5969 * @param domain_sid The domain sid acquired from the server.
5970 * @param cli A cli_state connected to the server.
5971 * @param mem_ctx Talloc context, destroyed on completion of the function.
5972 * @param argc Standard main() style argc.
5973 * @param argv Standard main() style argv. Initial components are already
5976 * @return normal NTSTATUS return code.
5979 static NTSTATUS
rpc_trustdom_del_internals(struct net_context
*c
,
5980 const struct dom_sid
*domain_sid
,
5981 const char *domain_name
,
5982 struct cli_state
*cli
,
5983 struct rpc_pipe_client
*pipe_hnd
,
5984 TALLOC_CTX
*mem_ctx
,
5988 struct policy_handle connect_pol
, domain_pol
, user_pol
;
5989 NTSTATUS status
, result
;
5991 struct dom_sid trust_acct_sid
;
5992 struct samr_Ids user_rids
, name_types
;
5993 struct lsa_String lsa_acct_name
;
5994 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
5999 _(" net rpc trustdom del <domain_name>\n"));
6000 return NT_STATUS_INVALID_PARAMETER
;
6004 * Make valid trusting domain account (ie. uppercased and with '$' appended)
6006 acct_name
= talloc_asprintf(mem_ctx
, "%s$", argv
[0]);
6008 if (acct_name
== NULL
)
6009 return NT_STATUS_NO_MEMORY
;
6011 if (!strupper_m(acct_name
)) {
6012 TALLOC_FREE(acct_name
);
6013 return NT_STATUS_INVALID_PARAMETER
;
6016 /* Get samr policy handle */
6017 status
= dcerpc_samr_Connect2(b
, mem_ctx
,
6019 MAXIMUM_ALLOWED_ACCESS
,
6022 if (!NT_STATUS_IS_OK(status
)) {
6025 if (!NT_STATUS_IS_OK(result
)) {
6030 /* Get domain policy handle */
6031 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
6033 MAXIMUM_ALLOWED_ACCESS
,
6034 discard_const_p(struct dom_sid2
, domain_sid
),
6037 if (!NT_STATUS_IS_OK(status
)) {
6040 if (!NT_STATUS_IS_OK(result
)) {
6045 init_lsa_String(&lsa_acct_name
, acct_name
);
6047 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
6054 if (!NT_STATUS_IS_OK(status
)) {
6055 d_printf(_("net rpc trustdom del: LookupNames on user %s "
6057 acct_name
, nt_errstr(status
));
6060 if (!NT_STATUS_IS_OK(result
)) {
6062 d_printf(_("net rpc trustdom del: LookupNames on user %s "
6064 acct_name
, nt_errstr(result
) );
6068 status
= dcerpc_samr_OpenUser(b
, mem_ctx
,
6070 MAXIMUM_ALLOWED_ACCESS
,
6074 if (!NT_STATUS_IS_OK(status
)) {
6075 d_printf(_("net rpc trustdom del: OpenUser on user %s failed "
6077 acct_name
, nt_errstr(status
) );
6081 if (!NT_STATUS_IS_OK(result
)) {
6083 d_printf(_("net rpc trustdom del: OpenUser on user %s failed "
6085 acct_name
, nt_errstr(result
) );
6089 /* append the rid to the domain sid */
6090 if (!sid_compose(&trust_acct_sid
, domain_sid
, user_rids
.ids
[0])) {
6094 /* remove the sid */
6096 status
= dcerpc_samr_RemoveMemberFromForeignDomain(b
, mem_ctx
,
6100 if (!NT_STATUS_IS_OK(status
)) {
6101 d_printf(_("net rpc trustdom del: RemoveMemberFromForeignDomain"
6102 " on user %s failed %s\n"),
6103 acct_name
, nt_errstr(status
));
6106 if (!NT_STATUS_IS_OK(result
)) {
6108 d_printf(_("net rpc trustdom del: RemoveMemberFromForeignDomain"
6109 " on user %s failed %s\n"),
6110 acct_name
, nt_errstr(result
) );
6117 status
= dcerpc_samr_DeleteUser(b
, mem_ctx
,
6120 if (!NT_STATUS_IS_OK(status
)) {
6121 d_printf(_("net rpc trustdom del: DeleteUser on user %s failed "
6123 acct_name
, nt_errstr(status
));
6127 if (!NT_STATUS_IS_OK(result
)) {
6129 d_printf(_("net rpc trustdom del: DeleteUser on user %s failed "
6131 acct_name
, nt_errstr(result
) );
6135 if (!NT_STATUS_IS_OK(result
)) {
6136 d_printf(_("Could not set trust account password: %s\n"),
6146 * Delete interdomain trust account for a remote domain.
6148 * @param argc Standard argc.
6149 * @param argv Standard argv without initial components.
6151 * @return Integer status (0 means success).
6154 static int rpc_trustdom_del(struct net_context
*c
, int argc
, const char **argv
)
6156 if (argc
> 0 && !c
->display_usage
) {
6157 return run_rpc_command(c
, NULL
, &ndr_table_samr
, 0,
6158 rpc_trustdom_del_internals
, argc
, argv
);
6162 _("net rpc trustdom del <domain>\n"));
6167 static NTSTATUS
rpc_trustdom_get_pdc(struct net_context
*c
,
6168 struct cli_state
*cli
,
6169 TALLOC_CTX
*mem_ctx
,
6170 const char *domain_name
)
6172 char *dc_name
= NULL
;
6173 const char *buffer
= NULL
;
6174 struct rpc_pipe_client
*netr
;
6177 struct dcerpc_binding_handle
*b
;
6179 /* Use NetServerEnum2 */
6181 if (cli_get_pdc_name(cli
, domain_name
, &dc_name
)) {
6183 return NT_STATUS_OK
;
6186 DEBUG(1,("NetServerEnum2 error: Couldn't find primary domain controller\
6187 for domain %s\n", domain_name
));
6189 /* Try netr_GetDcName */
6191 status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_netlogon
.syntax_id
,
6193 if (!NT_STATUS_IS_OK(status
)) {
6197 b
= netr
->binding_handle
;
6199 status
= dcerpc_netr_GetDcName(b
, mem_ctx
,
6206 if (NT_STATUS_IS_OK(status
) && W_ERROR_IS_OK(result
)) {
6210 DEBUG(1,("netr_GetDcName error: Couldn't find primary domain controller\
6211 for domain %s\n", domain_name
));
6213 if (!NT_STATUS_IS_OK(status
)) {
6217 return werror_to_ntstatus(result
);
6221 * Establish trust relationship to a trusting domain.
6222 * Interdomain account must already be created on remote PDC.
6224 * @param c A net_context structure.
6225 * @param argc Standard argc.
6226 * @param argv Standard argv without initial components.
6228 * @return Integer status (0 means success).
6231 static int rpc_trustdom_establish(struct net_context
*c
, int argc
,
6234 struct cli_state
*cli
= NULL
;
6235 struct sockaddr_storage server_ss
;
6236 struct rpc_pipe_client
*pipe_hnd
= NULL
;
6237 struct policy_handle connect_hnd
;
6238 TALLOC_CTX
*mem_ctx
;
6239 NTSTATUS nt_status
, result
;
6240 struct dom_sid
*domain_sid
;
6245 union lsa_PolicyInformation
*info
= NULL
;
6246 struct dcerpc_binding_handle
*b
;
6249 * Connect to \\server\ipc$ as 'our domain' account with password
6252 if (argc
!= 1 || c
->display_usage
) {
6255 _("net rpc trustdom establish <domain_name>\n"));
6259 domain_name
= smb_xstrdup(argv
[0]);
6260 if (!strupper_m(domain_name
)) {
6261 SAFE_FREE(domain_name
);
6265 /* account name used at first is our domain's name with '$' */
6266 if (asprintf(&acct_name
, "%s$", lp_workgroup()) == -1) {
6269 if (!strupper_m(acct_name
)) {
6270 SAFE_FREE(domain_name
);
6271 SAFE_FREE(acct_name
);
6276 * opt_workgroup will be used by connection functions further,
6277 * hence it should be set to remote domain name instead of ours
6279 if (c
->opt_workgroup
) {
6280 c
->opt_workgroup
= smb_xstrdup(domain_name
);
6283 c
->opt_user_name
= acct_name
;
6285 /* find the domain controller */
6286 if (!net_find_pdc(&server_ss
, pdc_name
, domain_name
)) {
6287 DEBUG(0, ("Couldn't find domain controller for domain %s\n", domain_name
));
6291 /* connect to ipc$ as username/password */
6292 nt_status
= connect_to_ipc(c
, &cli
, &server_ss
, pdc_name
);
6293 if (!NT_STATUS_EQUAL(nt_status
, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT
)) {
6295 /* Is it trusting domain account for sure ? */
6296 DEBUG(0, ("Couldn't verify trusting domain account. Error was %s\n",
6297 nt_errstr(nt_status
)));
6301 /* store who we connected to */
6303 saf_store( domain_name
, pdc_name
);
6306 * Connect to \\server\ipc$ again (this time anonymously)
6309 nt_status
= connect_to_ipc_anonymous(c
, &cli
, &server_ss
,
6312 if (NT_STATUS_IS_ERR(nt_status
)) {
6313 DEBUG(0, ("Couldn't connect to domain %s controller. Error was %s.\n",
6314 domain_name
, nt_errstr(nt_status
)));
6318 if (!(mem_ctx
= talloc_init("establishing trust relationship to "
6319 "domain %s", domain_name
))) {
6320 DEBUG(0, ("talloc_init() failed\n"));
6325 /* Make sure we're talking to a proper server */
6327 nt_status
= rpc_trustdom_get_pdc(c
, cli
, mem_ctx
, domain_name
);
6328 if (!NT_STATUS_IS_OK(nt_status
)) {
6330 talloc_destroy(mem_ctx
);
6335 * Call LsaOpenPolicy and LsaQueryInfo
6338 nt_status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
6340 if (!NT_STATUS_IS_OK(nt_status
)) {
6341 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n", nt_errstr(nt_status
) ));
6343 talloc_destroy(mem_ctx
);
6347 b
= pipe_hnd
->binding_handle
;
6349 nt_status
= rpccli_lsa_open_policy2(pipe_hnd
, mem_ctx
, true, KEY_QUERY_VALUE
,
6351 if (NT_STATUS_IS_ERR(nt_status
)) {
6352 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6353 nt_errstr(nt_status
)));
6355 talloc_destroy(mem_ctx
);
6359 /* Querying info level 5 */
6361 nt_status
= dcerpc_lsa_QueryInfoPolicy(b
, mem_ctx
,
6363 LSA_POLICY_INFO_ACCOUNT_DOMAIN
,
6366 if (NT_STATUS_IS_ERR(nt_status
)) {
6367 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6368 nt_errstr(nt_status
)));
6370 talloc_destroy(mem_ctx
);
6373 if (NT_STATUS_IS_ERR(result
)) {
6374 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6375 nt_errstr(result
)));
6377 talloc_destroy(mem_ctx
);
6381 domain_sid
= info
->account_domain
.sid
;
6383 /* There should be actually query info level 3 (following nt serv behaviour),
6384 but I still don't know if it's _really_ necessary */
6387 * Store the password in secrets db
6390 if (!pdb_set_trusteddom_pw(domain_name
, c
->opt_password
, domain_sid
)) {
6391 DEBUG(0, ("Storing password for trusted domain failed.\n"));
6393 talloc_destroy(mem_ctx
);
6398 * Close the pipes and clean up
6401 nt_status
= dcerpc_lsa_Close(b
, mem_ctx
, &connect_hnd
, &result
);
6402 if (NT_STATUS_IS_ERR(nt_status
)) {
6403 DEBUG(0, ("Couldn't close LSA pipe. Error was %s\n",
6404 nt_errstr(nt_status
)));
6406 talloc_destroy(mem_ctx
);
6412 talloc_destroy(mem_ctx
);
6414 d_printf(_("Trust to domain %s established\n"), domain_name
);
6419 * Revoke trust relationship to the remote domain.
6421 * @param c A net_context structure.
6422 * @param argc Standard argc.
6423 * @param argv Standard argv without initial components.
6425 * @return Integer status (0 means success).
6428 static int rpc_trustdom_revoke(struct net_context
*c
, int argc
,
6434 if (argc
< 1 || c
->display_usage
) {
6437 _("net rpc trustdom revoke <domain_name>\n"
6438 " Revoke trust relationship\n"
6439 " domain_name\tName of domain to revoke trust\n"));
6443 /* generate upper cased domain name */
6444 domain_name
= smb_xstrdup(argv
[0]);
6445 if (!strupper_m(domain_name
)) {
6446 SAFE_FREE(domain_name
);
6450 /* delete password of the trust */
6451 if (!pdb_del_trusteddom_pw(domain_name
)) {
6452 DEBUG(0, ("Failed to revoke relationship to the trusted domain %s\n",
6459 SAFE_FREE(domain_name
);
6463 static NTSTATUS
rpc_query_domain_sid(struct net_context
*c
,
6464 const struct dom_sid
*domain_sid
,
6465 const char *domain_name
,
6466 struct cli_state
*cli
,
6467 struct rpc_pipe_client
*pipe_hnd
,
6468 TALLOC_CTX
*mem_ctx
,
6473 if (!sid_to_fstring(str_sid
, domain_sid
)) {
6474 return NT_STATUS_UNSUCCESSFUL
;
6476 d_printf("%s\n", str_sid
);
6477 return NT_STATUS_OK
;
6480 static void print_trusted_domain(struct dom_sid
*dom_sid
, const char *trusted_dom_name
)
6484 /* convert sid into ascii string */
6485 sid_to_fstring(ascii_sid
, dom_sid
);
6487 d_printf("%-20s%s\n", trusted_dom_name
, ascii_sid
);
6490 static NTSTATUS
vampire_trusted_domain(struct rpc_pipe_client
*pipe_hnd
,
6491 TALLOC_CTX
*mem_ctx
,
6492 struct policy_handle
*pol
,
6493 struct dom_sid dom_sid
,
6494 const char *trusted_dom_name
)
6496 NTSTATUS nt_status
, result
;
6497 union lsa_TrustedDomainInfo
*info
= NULL
;
6498 char *cleartextpwd
= NULL
;
6499 DATA_BLOB session_key
;
6500 DATA_BLOB data
= data_blob_null
;
6501 struct dcerpc_binding_handle
*b
= pipe_hnd
->binding_handle
;
6503 nt_status
= dcerpc_lsa_QueryTrustedDomainInfoBySid(b
, mem_ctx
,
6506 LSA_TRUSTED_DOMAIN_INFO_PASSWORD
,
6509 if (NT_STATUS_IS_ERR(nt_status
)) {
6510 DEBUG(0,("Could not query trusted domain info. Error was %s\n",
6511 nt_errstr(nt_status
)));
6514 if (NT_STATUS_IS_ERR(result
)) {
6516 DEBUG(0,("Could not query trusted domain info. Error was %s\n",
6517 nt_errstr(result
)));
6521 data
= data_blob(info
->password
.password
->data
,
6522 info
->password
.password
->length
);
6524 nt_status
= cli_get_session_key(mem_ctx
, pipe_hnd
, &session_key
);
6525 if (!NT_STATUS_IS_OK(nt_status
)) {
6526 DEBUG(0, ("Could not retrieve session key: %s\n", nt_errstr(nt_status
)));
6530 cleartextpwd
= sess_decrypt_string(mem_ctx
, &data
, &session_key
);
6531 data_blob_free(&session_key
);
6533 if (cleartextpwd
== NULL
) {
6534 DEBUG(0,("retrieved NULL password\n"));
6535 nt_status
= NT_STATUS_UNSUCCESSFUL
;
6539 if (!pdb_set_trusteddom_pw(trusted_dom_name
, cleartextpwd
, &dom_sid
)) {
6540 DEBUG(0, ("Storing password for trusted domain failed.\n"));
6541 nt_status
= NT_STATUS_UNSUCCESSFUL
;
6545 #ifdef DEBUG_PASSWORD
6546 DEBUG(100,("successfully vampired trusted domain [%s], sid: [%s], "
6547 "password: [%s]\n", trusted_dom_name
,
6548 sid_string_dbg(&dom_sid
), cleartextpwd
));
6552 SAFE_FREE(cleartextpwd
);
6553 data_blob_free(&data
);
6558 static int rpc_trustdom_vampire(struct net_context
*c
, int argc
,
6561 /* common variables */
6562 TALLOC_CTX
* mem_ctx
;
6563 struct cli_state
*cli
= NULL
;
6564 struct rpc_pipe_client
*pipe_hnd
= NULL
;
6565 NTSTATUS nt_status
, result
;
6566 const char *domain_name
= NULL
;
6567 struct policy_handle connect_hnd
;
6568 union lsa_PolicyInformation
*info
= NULL
;
6570 /* trusted domains listing variables */
6571 unsigned int enum_ctx
= 0;
6573 struct lsa_DomainList dom_list
;
6575 struct dcerpc_binding_handle
*b
;
6577 if (c
->display_usage
) {
6579 "net rpc trustdom vampire\n"
6582 _("Vampire trust relationship from remote server"));
6587 * Listing trusted domains (stored in secrets.tdb, if local)
6590 mem_ctx
= talloc_init("trust relationships vampire");
6593 * set domain and pdc name to local samba server (default)
6594 * or to remote one given in command line
6597 if (strcasecmp_m(c
->opt_workgroup
, lp_workgroup())) {
6598 domain_name
= c
->opt_workgroup
;
6599 c
->opt_target_workgroup
= c
->opt_workgroup
;
6601 fstrcpy(pdc_name
, lp_netbios_name());
6602 domain_name
= talloc_strdup(mem_ctx
, lp_workgroup());
6603 c
->opt_target_workgroup
= domain_name
;
6606 /* open \PIPE\lsarpc and open policy handle */
6607 nt_status
= net_make_ipc_connection(c
, NET_FLAGS_PDC
, &cli
);
6608 if (!NT_STATUS_IS_OK(nt_status
)) {
6609 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
6610 nt_errstr(nt_status
)));
6611 talloc_destroy(mem_ctx
);
6615 nt_status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
6617 if (!NT_STATUS_IS_OK(nt_status
)) {
6618 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
6619 nt_errstr(nt_status
) ));
6621 talloc_destroy(mem_ctx
);
6625 b
= pipe_hnd
->binding_handle
;
6627 nt_status
= rpccli_lsa_open_policy2(pipe_hnd
, mem_ctx
, false, KEY_QUERY_VALUE
,
6629 if (NT_STATUS_IS_ERR(nt_status
)) {
6630 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6631 nt_errstr(nt_status
)));
6633 talloc_destroy(mem_ctx
);
6637 /* query info level 5 to obtain sid of a domain being queried */
6638 nt_status
= dcerpc_lsa_QueryInfoPolicy(b
, mem_ctx
,
6640 LSA_POLICY_INFO_ACCOUNT_DOMAIN
,
6644 if (NT_STATUS_IS_ERR(nt_status
)) {
6645 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6646 nt_errstr(nt_status
)));
6648 talloc_destroy(mem_ctx
);
6651 if (NT_STATUS_IS_ERR(result
)) {
6652 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6653 nt_errstr(result
)));
6655 talloc_destroy(mem_ctx
);
6660 * Keep calling LsaEnumTrustdom over opened pipe until
6661 * the end of enumeration is reached
6664 d_printf(_("Vampire trusted domains:\n\n"));
6667 nt_status
= dcerpc_lsa_EnumTrustDom(b
, mem_ctx
,
6673 if (NT_STATUS_IS_ERR(nt_status
)) {
6674 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6675 nt_errstr(nt_status
)));
6677 talloc_destroy(mem_ctx
);
6680 if (NT_STATUS_IS_ERR(result
)) {
6682 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6683 nt_errstr(result
)));
6685 talloc_destroy(mem_ctx
);
6690 for (i
= 0; i
< dom_list
.count
; i
++) {
6692 print_trusted_domain(dom_list
.domains
[i
].sid
,
6693 dom_list
.domains
[i
].name
.string
);
6695 nt_status
= vampire_trusted_domain(pipe_hnd
, mem_ctx
, &connect_hnd
,
6696 *dom_list
.domains
[i
].sid
,
6697 dom_list
.domains
[i
].name
.string
);
6698 if (!NT_STATUS_IS_OK(nt_status
)) {
6700 talloc_destroy(mem_ctx
);
6706 * in case of no trusted domains say something rather
6707 * than just display blank line
6709 if (!dom_list
.count
) d_printf(_("none\n"));
6711 } while (NT_STATUS_EQUAL(nt_status
, STATUS_MORE_ENTRIES
));
6713 /* close this connection before doing next one */
6714 nt_status
= dcerpc_lsa_Close(b
, mem_ctx
, &connect_hnd
, &result
);
6715 if (NT_STATUS_IS_ERR(nt_status
)) {
6716 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
6717 nt_errstr(nt_status
)));
6719 talloc_destroy(mem_ctx
);
6723 /* close lsarpc pipe and connection to IPC$ */
6726 talloc_destroy(mem_ctx
);
6730 static int rpc_trustdom_list(struct net_context
*c
, int argc
, const char **argv
)
6732 /* common variables */
6733 TALLOC_CTX
* mem_ctx
;
6734 struct cli_state
*cli
= NULL
, *remote_cli
= NULL
;
6735 struct rpc_pipe_client
*pipe_hnd
= NULL
;
6736 NTSTATUS nt_status
, result
;
6737 const char *domain_name
= NULL
;
6738 struct dom_sid
*queried_dom_sid
;
6739 int ascii_dom_name_len
;
6740 struct policy_handle connect_hnd
;
6741 union lsa_PolicyInformation
*info
= NULL
;
6742 struct dcerpc_binding_handle
*b
= NULL
;
6744 /* trusted domains listing variables */
6745 unsigned int num_domains
, enum_ctx
= 0;
6747 struct lsa_DomainList dom_list
;
6751 /* trusting domains listing variables */
6752 struct policy_handle domain_hnd
;
6753 struct samr_SamArray
*trusts
= NULL
;
6755 if (c
->display_usage
) {
6757 "net rpc trustdom list\n"
6760 _("List incoming and outgoing trust relationships"));
6765 * Listing trusted domains (stored in secrets.tdb, if local)
6768 mem_ctx
= talloc_init("trust relationships listing");
6771 * set domain and pdc name to local samba server (default)
6772 * or to remote one given in command line
6775 if (strcasecmp_m(c
->opt_workgroup
, lp_workgroup())) {
6776 domain_name
= c
->opt_workgroup
;
6777 c
->opt_target_workgroup
= c
->opt_workgroup
;
6779 fstrcpy(pdc_name
, lp_netbios_name());
6780 domain_name
= talloc_strdup(mem_ctx
, lp_workgroup());
6781 c
->opt_target_workgroup
= domain_name
;
6784 /* open \PIPE\lsarpc and open policy handle */
6785 nt_status
= net_make_ipc_connection(c
, NET_FLAGS_PDC
, &cli
);
6786 if (!NT_STATUS_IS_OK(nt_status
)) {
6787 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
6788 nt_errstr(nt_status
)));
6789 talloc_destroy(mem_ctx
);
6793 nt_status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
.syntax_id
,
6795 if (!NT_STATUS_IS_OK(nt_status
)) {
6796 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
6797 nt_errstr(nt_status
) ));
6799 talloc_destroy(mem_ctx
);
6803 b
= pipe_hnd
->binding_handle
;
6805 nt_status
= rpccli_lsa_open_policy2(pipe_hnd
, mem_ctx
, false, KEY_QUERY_VALUE
,
6807 if (NT_STATUS_IS_ERR(nt_status
)) {
6808 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6809 nt_errstr(nt_status
)));
6811 talloc_destroy(mem_ctx
);
6815 /* query info level 5 to obtain sid of a domain being queried */
6816 nt_status
= dcerpc_lsa_QueryInfoPolicy(b
, mem_ctx
,
6818 LSA_POLICY_INFO_ACCOUNT_DOMAIN
,
6822 if (NT_STATUS_IS_ERR(nt_status
)) {
6823 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6824 nt_errstr(nt_status
)));
6826 talloc_destroy(mem_ctx
);
6829 if (NT_STATUS_IS_ERR(result
)) {
6830 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6831 nt_errstr(result
)));
6833 talloc_destroy(mem_ctx
);
6837 queried_dom_sid
= info
->account_domain
.sid
;
6840 * Keep calling LsaEnumTrustdom over opened pipe until
6841 * the end of enumeration is reached
6844 d_printf(_("Trusted domains list:\n\n"));
6846 found_domain
= false;
6849 nt_status
= dcerpc_lsa_EnumTrustDom(b
, mem_ctx
,
6855 if (NT_STATUS_IS_ERR(nt_status
)) {
6856 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6857 nt_errstr(nt_status
)));
6859 talloc_destroy(mem_ctx
);
6862 if (NT_STATUS_IS_ERR(result
)) {
6863 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6864 nt_errstr(result
)));
6866 talloc_destroy(mem_ctx
);
6871 for (i
= 0; i
< dom_list
.count
; i
++) {
6872 print_trusted_domain(dom_list
.domains
[i
].sid
,
6873 dom_list
.domains
[i
].name
.string
);
6874 found_domain
= true;
6878 } while (NT_STATUS_EQUAL(nt_status
, STATUS_MORE_ENTRIES
));
6881 * in case of no trusted domains say something rather
6882 * than just display blank line
6884 if (!found_domain
) {
6885 d_printf(_("none\n"));
6888 /* close this connection before doing next one */
6889 nt_status
= dcerpc_lsa_Close(b
, mem_ctx
, &connect_hnd
, &result
);
6890 if (NT_STATUS_IS_ERR(nt_status
)) {
6891 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
6892 nt_errstr(nt_status
)));
6894 talloc_destroy(mem_ctx
);
6898 TALLOC_FREE(pipe_hnd
);
6901 * Listing trusting domains (stored in passdb backend, if local)
6904 d_printf(_("\nTrusting domains list:\n\n"));
6907 * Open \PIPE\samr and get needed policy handles
6909 nt_status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_samr
.syntax_id
,
6911 if (!NT_STATUS_IS_OK(nt_status
)) {
6912 DEBUG(0, ("Could not initialise samr pipe. Error was %s\n", nt_errstr(nt_status
)));
6914 talloc_destroy(mem_ctx
);
6918 b
= pipe_hnd
->binding_handle
;
6921 nt_status
= dcerpc_samr_Connect2(b
, mem_ctx
,
6923 SAMR_ACCESS_LOOKUP_DOMAIN
,
6926 if (!NT_STATUS_IS_OK(nt_status
)) {
6927 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
6928 nt_errstr(nt_status
)));
6930 talloc_destroy(mem_ctx
);
6933 if (!NT_STATUS_IS_OK(result
)) {
6935 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
6936 nt_errstr(result
)));
6938 talloc_destroy(mem_ctx
);
6942 /* SamrOpenDomain - we have to open domain policy handle in order to be
6943 able to enumerate accounts*/
6944 nt_status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
6946 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS
,
6950 if (!NT_STATUS_IS_OK(nt_status
)) {
6951 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
6952 nt_errstr(nt_status
)));
6954 talloc_destroy(mem_ctx
);
6957 if (!NT_STATUS_IS_OK(result
)) {
6959 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
6960 nt_errstr(result
)));
6962 talloc_destroy(mem_ctx
);
6967 * perform actual enumeration
6970 found_domain
= false;
6972 enum_ctx
= 0; /* reset enumeration context from last enumeration */
6975 nt_status
= dcerpc_samr_EnumDomainUsers(b
, mem_ctx
,
6983 if (NT_STATUS_IS_ERR(nt_status
)) {
6984 DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
6985 nt_errstr(nt_status
)));
6987 talloc_destroy(mem_ctx
);
6990 if (NT_STATUS_IS_ERR(result
)) {
6992 DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
6993 nt_errstr(result
)));
6995 talloc_destroy(mem_ctx
);
6999 for (i
= 0; i
< num_domains
; i
++) {
7001 char *str
= discard_const_p(char, trusts
->entries
[i
].name
.string
);
7003 found_domain
= true;
7006 * get each single domain's sid (do we _really_ need this ?):
7007 * 1) connect to domain's pdc
7008 * 2) query the pdc for domain's sid
7011 /* get rid of '$' tail */
7012 ascii_dom_name_len
= strlen(str
);
7013 if (ascii_dom_name_len
&& ascii_dom_name_len
< FSTRING_LEN
)
7014 str
[ascii_dom_name_len
- 1] = '\0';
7016 /* set opt_* variables to remote domain */
7017 if (!strupper_m(str
)) {
7019 talloc_destroy(mem_ctx
);
7022 c
->opt_workgroup
= talloc_strdup(mem_ctx
, str
);
7023 c
->opt_target_workgroup
= c
->opt_workgroup
;
7025 d_printf("%-20s", str
);
7027 /* connect to remote domain controller */
7028 nt_status
= net_make_ipc_connection(c
,
7029 NET_FLAGS_PDC
| NET_FLAGS_ANONYMOUS
,
7031 if (NT_STATUS_IS_OK(nt_status
)) {
7032 /* query for domain's sid */
7033 if (run_rpc_command(
7035 &ndr_table_lsarpc
, 0,
7036 rpc_query_domain_sid
, argc
,
7038 d_printf(_("strange - couldn't get domain's sid\n"));
7040 cli_shutdown(remote_cli
);
7043 d_fprintf(stderr
, _("domain controller is not "
7044 "responding: %s\n"),
7045 nt_errstr(nt_status
));
7046 d_printf(_("couldn't get domain's sid\n"));
7050 } while (NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
7052 if (!found_domain
) {
7056 /* close opened samr and domain policy handles */
7057 nt_status
= dcerpc_samr_Close(b
, mem_ctx
, &domain_hnd
, &result
);
7058 if (!NT_STATUS_IS_OK(nt_status
)) {
7059 DEBUG(0, ("Couldn't properly close domain policy handle for domain %s\n", domain_name
));
7062 nt_status
= dcerpc_samr_Close(b
, mem_ctx
, &connect_hnd
, &result
);
7063 if (!NT_STATUS_IS_OK(nt_status
)) {
7064 DEBUG(0, ("Couldn't properly close samr policy handle for domain %s\n", domain_name
));
7067 /* close samr pipe and connection to IPC$ */
7070 talloc_destroy(mem_ctx
);
7075 * Entrypoint for 'net rpc trustdom' code.
7077 * @param argc Standard argc.
7078 * @param argv Standard argv without initial components.
7080 * @return Integer status (0 means success).
7083 static int rpc_trustdom(struct net_context
*c
, int argc
, const char **argv
)
7085 struct functable func
[] = {
7090 N_("Add trusting domain's account"),
7091 N_("net rpc trustdom add\n"
7092 " Add trusting domain's account")
7098 N_("Remove trusting domain's account"),
7099 N_("net rpc trustdom del\n"
7100 " Remove trusting domain's account")
7104 rpc_trustdom_establish
,
7106 N_("Establish outgoing trust relationship"),
7107 N_("net rpc trustdom establish\n"
7108 " Establish outgoing trust relationship")
7112 rpc_trustdom_revoke
,
7114 N_("Revoke outgoing trust relationship"),
7115 N_("net rpc trustdom revoke\n"
7116 " Revoke outgoing trust relationship")
7122 N_("List in- and outgoing domain trusts"),
7123 N_("net rpc trustdom list\n"
7124 " List in- and outgoing domain trusts")
7128 rpc_trustdom_vampire
,
7130 N_("Vampire trusts from remote server"),
7131 N_("net rpc trustdom vampire\n"
7132 " Vampire trusts from remote server")
7134 {NULL
, NULL
, 0, NULL
, NULL
}
7137 return net_run_function(c
, argc
, argv
, "net rpc trustdom", func
);
7141 * Check if a server will take rpc commands
7142 * @param flags Type of server to connect to (PDC, DMB, localhost)
7143 * if the host is not explicitly specified
7144 * @return bool (true means rpc supported)
7146 bool net_rpc_check(struct net_context
*c
, unsigned flags
)
7148 struct cli_state
*cli
;
7150 struct sockaddr_storage server_ss
;
7151 char *server_name
= NULL
;
7154 /* flags (i.e. server type) may depend on command */
7155 if (!net_find_server(c
, NULL
, flags
, &server_ss
, &server_name
))
7158 status
= cli_connect_nb(server_name
, &server_ss
, 0, 0x20,
7159 lp_netbios_name(), SMB_SIGNING_DEFAULT
,
7161 if (!NT_STATUS_IS_OK(status
)) {
7164 status
= smbXcli_negprot(cli
->conn
, cli
->timeout
, PROTOCOL_CORE
,
7166 if (!NT_STATUS_IS_OK(status
))
7168 if (smbXcli_conn_protocol(cli
->conn
) < PROTOCOL_NT1
)
7177 /* dump sam database via samsync rpc calls */
7178 static int rpc_samdump(struct net_context
*c
, int argc
, const char **argv
) {
7179 if (c
->display_usage
) {
7184 _("Dump remote SAM database"));
7188 return run_rpc_command(c
, NULL
, &ndr_table_netlogon
,
7189 NET_FLAGS_ANONYMOUS
,
7190 rpc_samdump_internals
, argc
, argv
);
7193 /* syncronise sam database via samsync rpc calls */
7194 static int rpc_vampire(struct net_context
*c
, int argc
, const char **argv
)
7196 struct functable func
[] = {
7201 N_("Dump remote SAM database to ldif"),
7202 N_("net rpc vampire ldif\n"
7203 " Dump remote SAM database to LDIF file or "
7210 N_("Dump remote SAM database to Kerberos Keytab"),
7211 N_("net rpc vampire keytab\n"
7212 " Dump remote SAM database to Kerberos keytab "
7219 N_("Dump remote SAM database to passdb"),
7220 N_("net rpc vampire passdb\n"
7221 " Dump remote SAM database to passdb")
7224 {NULL
, NULL
, 0, NULL
, NULL
}
7228 if (c
->display_usage
) {
7233 _("Vampire remote SAM database"));
7237 return rpc_vampire_passdb(c
, argc
, argv
);
7240 return net_run_function(c
, argc
, argv
, "net rpc vampire", func
);
7244 * Migrate everything from a print server.
7246 * @param c A net_context structure.
7247 * @param argc Standard main() style argc.
7248 * @param argv Standard main() style argv. Initial components are already
7251 * @return A shell status integer (0 for success).
7253 * The order is important !
7254 * To successfully add drivers the print queues have to exist !
7255 * Applying ACLs should be the last step, because you're easily locked out.
7258 static int rpc_printer_migrate_all(struct net_context
*c
, int argc
,
7263 if (c
->display_usage
) {
7265 "net rpc printer migrate all\n"
7268 _("Migrate everything from a print server"));
7273 d_printf(_("no server to migrate\n"));
7277 ret
= run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7278 rpc_printer_migrate_printers_internals
, argc
,
7283 ret
= run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7284 rpc_printer_migrate_drivers_internals
, argc
,
7289 ret
= run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7290 rpc_printer_migrate_forms_internals
, argc
, argv
);
7294 ret
= run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7295 rpc_printer_migrate_settings_internals
, argc
,
7300 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7301 rpc_printer_migrate_security_internals
, argc
,
7307 * Migrate print drivers from a print server.
7309 * @param c A net_context structure.
7310 * @param argc Standard main() style argc.
7311 * @param argv Standard main() style argv. Initial components are already
7314 * @return A shell status integer (0 for success).
7316 static int rpc_printer_migrate_drivers(struct net_context
*c
, int argc
,
7319 if (c
->display_usage
) {
7321 "net rpc printer migrate drivers\n"
7324 _("Migrate print-drivers from a print-server"));
7329 d_printf(_("no server to migrate\n"));
7333 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7334 rpc_printer_migrate_drivers_internals
,
7339 * Migrate print-forms from a print-server.
7341 * @param c A net_context structure.
7342 * @param argc Standard main() style argc.
7343 * @param argv Standard main() style argv. Initial components are already
7346 * @return A shell status integer (0 for success).
7348 static int rpc_printer_migrate_forms(struct net_context
*c
, int argc
,
7351 if (c
->display_usage
) {
7353 "net rpc printer migrate forms\n"
7356 _("Migrate print-forms from a print-server"));
7361 d_printf(_("no server to migrate\n"));
7365 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7366 rpc_printer_migrate_forms_internals
,
7371 * Migrate printers from a print-server.
7373 * @param c A net_context structure.
7374 * @param argc Standard main() style argc.
7375 * @param argv Standard main() style argv. Initial components are already
7378 * @return A shell status integer (0 for success).
7380 static int rpc_printer_migrate_printers(struct net_context
*c
, int argc
,
7383 if (c
->display_usage
) {
7385 "net rpc printer migrate printers\n"
7388 _("Migrate printers from a print-server"));
7393 d_printf(_("no server to migrate\n"));
7397 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7398 rpc_printer_migrate_printers_internals
,
7403 * Migrate printer-ACLs from a print-server
7405 * @param c A net_context structure.
7406 * @param argc Standard main() style argc.
7407 * @param argv Standard main() style argv. Initial components are already
7410 * @return A shell status integer (0 for success).
7412 static int rpc_printer_migrate_security(struct net_context
*c
, int argc
,
7415 if (c
->display_usage
) {
7417 "net rpc printer migrate security\n"
7420 _("Migrate printer-ACLs from a print-server"));
7425 d_printf(_("no server to migrate\n"));
7429 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7430 rpc_printer_migrate_security_internals
,
7435 * Migrate printer-settings from a print-server.
7437 * @param c A net_context structure.
7438 * @param argc Standard main() style argc.
7439 * @param argv Standard main() style argv. Initial components are already
7442 * @return A shell status integer (0 for success).
7444 static int rpc_printer_migrate_settings(struct net_context
*c
, int argc
,
7447 if (c
->display_usage
) {
7449 "net rpc printer migrate settings\n"
7452 _("Migrate printer-settings from a "
7458 d_printf(_("no server to migrate\n"));
7462 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7463 rpc_printer_migrate_settings_internals
,
7468 * 'net rpc printer' entrypoint.
7470 * @param c A net_context structure.
7471 * @param argc Standard main() style argc.
7472 * @param argv Standard main() style argv. Initial components are already
7476 int rpc_printer_migrate(struct net_context
*c
, int argc
, const char **argv
)
7479 /* ouch: when addriver and setdriver are called from within
7480 rpc_printer_migrate_drivers_internals, the printer-queue already
7483 struct functable func
[] = {
7486 rpc_printer_migrate_all
,
7488 N_("Migrate all from remote to local print server"),
7489 N_("net rpc printer migrate all\n"
7490 " Migrate all from remote to local print server")
7494 rpc_printer_migrate_drivers
,
7496 N_("Migrate drivers to local server"),
7497 N_("net rpc printer migrate drivers\n"
7498 " Migrate drivers to local server")
7502 rpc_printer_migrate_forms
,
7504 N_("Migrate froms to local server"),
7505 N_("net rpc printer migrate forms\n"
7506 " Migrate froms to local server")
7510 rpc_printer_migrate_printers
,
7512 N_("Migrate printers to local server"),
7513 N_("net rpc printer migrate printers\n"
7514 " Migrate printers to local server")
7518 rpc_printer_migrate_security
,
7520 N_("Mirgate printer ACLs to local server"),
7521 N_("net rpc printer migrate security\n"
7522 " Mirgate printer ACLs to local server")
7526 rpc_printer_migrate_settings
,
7528 N_("Migrate printer settings to local server"),
7529 N_("net rpc printer migrate settings\n"
7530 " Migrate printer settings to local server")
7532 {NULL
, NULL
, 0, NULL
, NULL
}
7535 return net_run_function(c
, argc
, argv
, "net rpc printer migrate",func
);
7540 * List printers on a remote RPC server.
7542 * @param c A net_context structure.
7543 * @param argc Standard main() style argc.
7544 * @param argv Standard main() style argv. Initial components are already
7547 * @return A shell status integer (0 for success).
7549 static int rpc_printer_list(struct net_context
*c
, int argc
, const char **argv
)
7551 if (c
->display_usage
) {
7553 "net rpc printer list\n"
7556 _("List printers on a remote RPC server"));
7560 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7561 rpc_printer_list_internals
,
7566 * List printer-drivers on a remote RPC server.
7568 * @param c A net_context structure.
7569 * @param argc Standard main() style argc.
7570 * @param argv Standard main() style argv. Initial components are already
7573 * @return A shell status integer (0 for success).
7575 static int rpc_printer_driver_list(struct net_context
*c
, int argc
,
7578 if (c
->display_usage
) {
7580 "net rpc printer driver\n"
7583 _("List printer-drivers on a remote RPC server"));
7587 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7588 rpc_printer_driver_list_internals
,
7593 * Publish printer in ADS via MSRPC.
7595 * @param c A net_context structure.
7596 * @param argc Standard main() style argc.
7597 * @param argv Standard main() style argv. Initial components are already
7600 * @return A shell status integer (0 for success).
7602 static int rpc_printer_publish_publish(struct net_context
*c
, int argc
,
7605 if (c
->display_usage
) {
7607 "net rpc printer publish publish\n"
7610 _("Publish printer in ADS via MSRPC"));
7614 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7615 rpc_printer_publish_publish_internals
,
7620 * Update printer in ADS via MSRPC.
7622 * @param c A net_context structure.
7623 * @param argc Standard main() style argc.
7624 * @param argv Standard main() style argv. Initial components are already
7627 * @return A shell status integer (0 for success).
7629 static int rpc_printer_publish_update(struct net_context
*c
, int argc
, const char **argv
)
7631 if (c
->display_usage
) {
7633 "net rpc printer publish update\n"
7636 _("Update printer in ADS via MSRPC"));
7640 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7641 rpc_printer_publish_update_internals
,
7646 * UnPublish printer in ADS via MSRPC.
7648 * @param c A net_context structure.
7649 * @param argc Standard main() style argc.
7650 * @param argv Standard main() style argv. Initial components are already
7653 * @return A shell status integer (0 for success).
7655 static int rpc_printer_publish_unpublish(struct net_context
*c
, int argc
,
7658 if (c
->display_usage
) {
7660 "net rpc printer publish unpublish\n"
7663 _("UnPublish printer in ADS via MSRPC"));
7667 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7668 rpc_printer_publish_unpublish_internals
,
7673 * List published printers via MSRPC.
7675 * @param c A net_context structure.
7676 * @param argc Standard main() style argc.
7677 * @param argv Standard main() style argv. Initial components are already
7680 * @return A shell status integer (0 for success).
7682 static int rpc_printer_publish_list(struct net_context
*c
, int argc
,
7685 if (c
->display_usage
) {
7687 "net rpc printer publish list\n"
7690 _("List published printers via MSRPC"));
7694 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7695 rpc_printer_publish_list_internals
,
7701 * Publish printer in ADS.
7703 * @param c A net_context structure.
7704 * @param argc Standard main() style argc.
7705 * @param argv Standard main() style argv. Initial components are already
7708 * @return A shell status integer (0 for success).
7710 static int rpc_printer_publish(struct net_context
*c
, int argc
,
7714 struct functable func
[] = {
7717 rpc_printer_publish_publish
,
7719 N_("Publish printer in AD"),
7720 N_("net rpc printer publish publish\n"
7721 " Publish printer in AD")
7725 rpc_printer_publish_update
,
7727 N_("Update printer in AD"),
7728 N_("net rpc printer publish update\n"
7729 " Update printer in AD")
7733 rpc_printer_publish_unpublish
,
7735 N_("Unpublish printer"),
7736 N_("net rpc printer publish unpublish\n"
7737 " Unpublish printer")
7741 rpc_printer_publish_list
,
7743 N_("List published printers"),
7744 N_("net rpc printer publish list\n"
7745 " List published printers")
7747 {NULL
, NULL
, 0, NULL
, NULL
}
7751 if (c
->display_usage
) {
7752 d_printf(_("Usage:\n"));
7753 d_printf(_("net rpc printer publish\n"
7754 " List published printers\n"
7755 " Alias of net rpc printer publish "
7757 net_display_usage_from_functable(func
);
7760 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7761 rpc_printer_publish_list_internals
,
7765 return net_run_function(c
, argc
, argv
, "net rpc printer publish",func
);
7771 * Display rpc printer help page.
7773 * @param c A net_context structure.
7774 * @param argc Standard main() style argc.
7775 * @param argv Standard main() style argv. Initial components are already
7778 int rpc_printer_usage(struct net_context
*c
, int argc
, const char **argv
)
7780 d_printf(_("net rpc printer LIST [printer] [misc. options] [targets]\n"
7781 "\tlists all printers on print-server\n\n"));
7782 d_printf(_("net rpc printer DRIVER [printer] [misc. options] [targets]\n"
7783 "\tlists all printer-drivers on print-server\n\n"));
7784 d_printf(_("net rpc printer PUBLISH action [printer] [misc. options] [targets]\n"
7785 "\tpublishes printer settings in Active Directory\n"
7786 "\taction can be one of PUBLISH, UPDATE, UNPUBLISH or LIST\n\n"));
7787 d_printf(_("net rpc printer MIGRATE PRINTERS [printer] [misc. options] [targets]"
7788 "\n\tmigrates printers from remote to local server\n\n"));
7789 d_printf(_("net rpc printer MIGRATE SETTINGS [printer] [misc. options] [targets]"
7790 "\n\tmigrates printer-settings from remote to local server\n\n"));
7791 d_printf(_("net rpc printer MIGRATE DRIVERS [printer] [misc. options] [targets]"
7792 "\n\tmigrates printer-drivers from remote to local server\n\n"));
7793 d_printf(_("net rpc printer MIGRATE FORMS [printer] [misc. options] [targets]"
7794 "\n\tmigrates printer-forms from remote to local server\n\n"));
7795 d_printf(_("net rpc printer MIGRATE SECURITY [printer] [misc. options] [targets]"
7796 "\n\tmigrates printer-ACLs from remote to local server\n\n"));
7797 d_printf(_("net rpc printer MIGRATE ALL [printer] [misc. options] [targets]"
7798 "\n\tmigrates drivers, forms, queues, settings and acls from\n"
7799 "\tremote to local print-server\n\n"));
7800 net_common_methods_usage(c
, argc
, argv
);
7801 net_common_flags_usage(c
, argc
, argv
);
7803 "\t-v or --verbose\t\t\tgive verbose output\n"
7804 "\t --destination\t\tmigration target server (default: localhost)\n"));
7810 * 'net rpc printer' entrypoint.
7812 * @param c A net_context structure.
7813 * @param argc Standard main() style argc.
7814 * @param argv Standard main() style argv. Initial components are already
7817 int net_rpc_printer(struct net_context
*c
, int argc
, const char **argv
)
7819 struct functable func
[] = {
7824 N_("List all printers on print server"),
7825 N_("net rpc printer list\n"
7826 " List all printers on print server")
7830 rpc_printer_migrate
,
7832 N_("Migrate printer to local server"),
7833 N_("net rpc printer migrate\n"
7834 " Migrate printer to local server")
7838 rpc_printer_driver_list
,
7840 N_("List printer drivers"),
7841 N_("net rpc printer driver\n"
7842 " List printer drivers")
7846 rpc_printer_publish
,
7848 N_("Publish printer in AD"),
7849 N_("net rpc printer publish\n"
7850 " Publish printer in AD")
7852 {NULL
, NULL
, 0, NULL
, NULL
}
7856 if (c
->display_usage
) {
7857 d_printf(_("Usage:\n"));
7858 d_printf(_("net rpc printer\n"
7859 " List printers\n"));
7860 net_display_usage_from_functable(func
);
7863 return run_rpc_command(c
, NULL
, &ndr_table_spoolss
, 0,
7864 rpc_printer_list_internals
,
7868 return net_run_function(c
, argc
, argv
, "net rpc printer", func
);
7872 * 'net rpc' entrypoint.
7874 * @param c A net_context structure.
7875 * @param argc Standard main() style argc.
7876 * @param argv Standard main() style argv. Initial components are already
7880 int net_rpc(struct net_context
*c
, int argc
, const char **argv
)
7882 NET_API_STATUS status
;
7884 struct functable func
[] = {
7889 N_("Modify global audit settings"),
7890 N_("net rpc audit\n"
7891 " Modify global audit settings")
7897 N_("Show basic info about a domain"),
7899 " Show basic info about a domain")
7905 N_("Join a domain"),
7913 N_("Join a domain created in server manager"),
7914 N_("net rpc oldjoin\n"
7915 " Join a domain created in server manager")
7921 N_("Test that a join is valid"),
7922 N_("net rpc testjoin\n"
7923 " Test that a join is valid")
7929 N_("List/modify users"),
7931 " List/modify users")
7937 N_("Change a user password"),
7938 N_("net rpc password\n"
7939 " Change a user password\n"
7940 " Alias for net rpc user password")
7946 N_("List/modify groups"),
7947 N_("net rpc group\n"
7948 " List/modify groups")
7954 N_("List/modify shares"),
7955 N_("net rpc share\n"
7956 " List/modify shares")
7962 N_("List open files"),
7970 N_("List/modify printers"),
7971 N_("net rpc printer\n"
7972 " List/modify printers")
7976 net_rpc_changetrustpw
,
7978 N_("Change trust account password"),
7979 N_("net rpc changetrustpw\n"
7980 " Change trust account password")
7986 N_("Modify domain trusts"),
7987 N_("net rpc trustdom\n"
7988 " Modify domain trusts")
7994 N_("Abort a remote shutdown"),
7995 N_("net rpc abortshutdown\n"
7996 " Abort a remote shutdown")
8002 N_("Shutdown a remote server"),
8003 N_("net rpc shutdown\n"
8004 " Shutdown a remote server")
8010 N_("Dump SAM data of remote NT PDC"),
8011 N_("net rpc samdump\n"
8012 " Dump SAM data of remote NT PDC")
8018 N_("Sync a remote NT PDC's data into local passdb"),
8019 N_("net rpc vampire\n"
8020 " Sync a remote NT PDC's data into local passdb")
8026 N_("Fetch the domain sid into local secrets.tdb"),
8027 N_("net rpc getsid\n"
8028 " Fetch the domain sid into local secrets.tdb")
8034 N_("Manage privileges assigned to SID"),
8035 N_("net rpc rights\n"
8036 " Manage privileges assigned to SID")
8042 N_("Start/stop/query remote services"),
8043 N_("net rpc service\n"
8044 " Start/stop/query remote services")
8050 N_("Manage registry hives"),
8051 N_("net rpc registry\n"
8052 " Manage registry hives")
8058 N_("Open interactive shell on remote server"),
8059 N_("net rpc shell\n"
8060 " Open interactive shell on remote server")
8066 N_("Manage trusts"),
8067 N_("net rpc trust\n"
8074 N_("Configure a remote samba server"),
8076 " Configure a remote samba server")
8078 {NULL
, NULL
, 0, NULL
, NULL
}
8081 status
= libnetapi_net_init(&c
->netapi_ctx
);
8085 libnetapi_set_username(c
->netapi_ctx
, c
->opt_user_name
);
8086 libnetapi_set_password(c
->netapi_ctx
, c
->opt_password
);
8087 if (c
->opt_kerberos
) {
8088 libnetapi_set_use_kerberos(c
->netapi_ctx
);
8090 if (c
->opt_ccache
) {
8091 libnetapi_set_use_ccache(c
->netapi_ctx
);
8094 return net_run_function(c
, argc
, argv
, "net rpc", func
);