3 # Unix SMB/CIFS implementation.
4 # provision a Samba4 server
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
8 # Based on the original in EJS:
9 # Copyright (C) Andrew Tridgell 2005
11 # This program is free software; you can redistribute it and/or modify
12 # it under the terms of the GNU General Public License as published by
13 # the Free Software Foundation; either version 3 of the License, or
14 # (at your option) any later version.
16 # This program is distributed in the hope that it will be useful,
17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 # GNU General Public License for more details.
21 # You should have received a copy of the GNU General Public License
22 # along with this program. If not, see <http://www.gnu.org/licenses/>.
30 # Find right directory when running from source tree
31 sys
.path
.insert(0, "bin/python")
35 from samba
.credentials
import DONT_USE_KERBEROS
36 from samba
.auth
import system_session
37 import samba
.getopt
as options
38 from samba
.provision
import provision
, FILL_FULL
, FILL_NT4SYNC
, FILL_DRS
, find_setup_dir
, ProvisioningError
39 from samba
.dsdb
import (
40 DS_DOMAIN_FUNCTION_2000
,
41 DS_DOMAIN_FUNCTION_2003
,
42 DS_DOMAIN_FUNCTION_2008
,
43 DS_DOMAIN_FUNCTION_2008_R2
,
46 # how do we make this case insensitive??
48 parser
= optparse
.OptionParser("provision [options]")
49 sambaopts
= options
.SambaOptions(parser
)
50 parser
.add_option_group(sambaopts
)
51 parser
.add_option_group(options
.VersionOptions(parser
))
52 credopts
= options
.CredentialsOptions(parser
)
53 parser
.add_option_group(credopts
)
54 parser
.add_option("--interactive", help="Ask for names", action
="store_true")
55 parser
.add_option("--setupdir", type="string", metavar
="DIR",
56 help="directory with setup files")
57 parser
.add_option("--domain", type="string", metavar
="DOMAIN",
59 parser
.add_option("--domain-guid", type="string", metavar
="GUID",
60 help="set domainguid (otherwise random)")
61 parser
.add_option("--domain-sid", type="string", metavar
="SID",
62 help="set domainsid (otherwise random)")
63 parser
.add_option("--policy-guid", type="string", metavar
="GUID",
64 help="set guid for domain policy")
65 parser
.add_option("--policy-guid-dc", type="string", metavar
="GUID",
66 help="set guid for domain controller policy")
67 parser
.add_option("--ntds-guid", type="string", metavar
="GUID",
68 help="set NTDS object GUID (otherwise random)")
69 parser
.add_option("--invocationid", type="string", metavar
="GUID",
70 help="set invocationid (otherwise random)")
71 parser
.add_option("--host-name", type="string", metavar
="HOSTNAME",
73 parser
.add_option("--host-ip", type="string", metavar
="IPADDRESS",
74 help="set IPv4 ipaddress")
75 parser
.add_option("--host-ip6", type="string", metavar
="IP6ADDRESS",
76 help="set IPv6 ipaddress")
77 parser
.add_option("--adminpass", type="string", metavar
="PASSWORD",
78 help="choose admin password (otherwise random)")
79 parser
.add_option("--krbtgtpass", type="string", metavar
="PASSWORD",
80 help="choose krbtgt password (otherwise random)")
81 parser
.add_option("--machinepass", type="string", metavar
="PASSWORD",
82 help="choose machine password (otherwise random)")
83 parser
.add_option("--dnspass", type="string", metavar
="PASSWORD",
84 help="choose dns password (otherwise random)")
85 parser
.add_option("--ldapadminpass", type="string", metavar
="PASSWORD",
86 help="choose password to set between Samba and it's LDAP backend (otherwise random)")
87 parser
.add_option("--root", type="string", metavar
="USERNAME",
88 help="choose 'root' unix username")
89 parser
.add_option("--nobody", type="string", metavar
="USERNAME",
90 help="choose 'nobody' user")
91 parser
.add_option("--wheel", type="string", metavar
="GROUPNAME",
92 help="choose 'wheel' privileged group")
93 parser
.add_option("--users", type="string", metavar
="GROUPNAME",
94 help="choose 'users' group")
95 parser
.add_option("--quiet", help="Be quiet", action
="store_true")
96 parser
.add_option("--blank", action
="store_true",
97 help="do not add users or groups, just the structure")
98 parser
.add_option("--ldap-backend-extra-port", type="int", metavar
="LDAP-BACKEND-EXTRA-PORT",
99 help="Additional TCP port for LDAP backend server (to use for replication)")
100 parser
.add_option("--ldap-backend-type", type="choice", metavar
="LDAP-BACKEND-TYPE",
101 help="LDAP backend type (fedora-ds or openldap)",
102 choices
=["fedora-ds", "openldap"])
103 parser
.add_option("--ldap-backend-nosync", help="Configure LDAP backend not to call fsync() (for performance in test environments)", action
="store_true")
104 parser
.add_option("--server-role", type="choice", metavar
="ROLE",
105 choices
=["domain controller", "dc", "member server", "member", "standalone"],
106 help="The server role (domain controller | dc | member server | member | standalone). Default is standalone.")
107 parser
.add_option("--function-level", type="choice", metavar
="FOR-FUN-LEVEL",
108 choices
=["2000", "2003", "2008", "2008_R2"],
109 help="The domain and forest function level (2003 | 2008 | 2008_R2). Default is (Windows) 2003 (Native).")
110 parser
.add_option("--partitions-only",
111 help="Configure Samba's partitions, but do not modify them (ie, join a BDC)", action
="store_true")
112 parser
.add_option("--targetdir", type="string", metavar
="DIR",
113 help="Set target directory")
114 parser
.add_option("--ol-mmr-urls", type="string", metavar
="LDAPSERVER",
115 help="List of LDAP-URLS [ ldap://<FQHN>:<PORT>/ (where <PORT> has to be different than 389!) ] separated with comma (\",\") for use with OpenLDAP-MMR (Multi-Master-Replication), e.g.: \"ldap://s4dc1:9000,ldap://s4dc2:9000\"")
116 parser
.add_option("--slapd-path", type="string", metavar
="SLAPD-PATH",
117 help="Path to slapd for LDAP backend [e.g.:'/usr/local/libexec/slapd']. Required for Setup with LDAP-Backend. OpenLDAP Version >= 2.4.17 should be used.")
118 parser
.add_option("--setup-ds-path", type="string", metavar
="SETUP_DS-PATH",
119 help="Path to setup-ds.pl script for Fedora DS LDAP backend [e.g.:'/usr/sbin/setup-ds.pl']. Required for Setup with Fedora DS backend.")
120 parser
.add_option("--nosync", help="Configure LDAP backend not to call fsync() (for performance in test environments)", action
="store_true")
121 parser
.add_option("--use-xattrs", type="choice", choices
=["yes","no","auto"], help="Define if we should use the native fs capabilities or a tdb file for storing attributes likes ntacl, auto tries to make an inteligent guess based on the user rights and system capabilities", default
="auto")
122 parser
.add_option("--ldap-dryrun-mode", help="Configure LDAP backend, but do not run any binaries and exit early. Used only for the test environment. DO NOT USE", action
="store_true")
124 opts
= parser
.parse_args()[0]
126 logger
= logging
.getLogger("provision")
127 logger
.addHandler(logging
.StreamHandler(sys
.stdout
))
129 logger
.setLevel(logging
.WARNING
)
131 logger
.setLevel(logging
.INFO
)
133 if len(sys
.argv
) == 1:
134 opts
.interactive
= True
137 from getpass
import getpass
139 def ask(prompt
, default
=None):
140 if default
is not None:
141 print "%s [%s]: " % (prompt
,default
),
143 print "%s: " % (prompt
,),
144 return sys
.stdin
.readline().rstrip("\n") or default
146 default
= socket
.getfqdn().split(".", 1)[1].upper()
149 opts
.realm
= ask("Realm", default
)
150 if opts
.realm
in (None, ""):
151 print >>sys
.stderr
, "No realm set!"
155 default
= opts
.realm
.split(".")[0]
158 opts
.domain
= ask("Domain", default
)
159 if opts
.domain
is None:
160 print >> sys
.stderr
, "No domain set!"
163 opts
.server_role
= ask("Server Role (dc, member, standalone)", "dc")
165 opts
.adminpass
= getpass("Administrator password: ")
166 if not opts
.adminpass
:
167 print >>sys
.stderr
, "Invalid administrator password."
171 if opts
.realm
in (None, ""):
172 opts
.realm
= sambaopts
._lp
.get('realm')
173 if opts
.realm
is None or opts
.domain
is None:
174 if opts
.realm
is None:
175 print >>sys
.stderr
, "No realm set!"
176 if opts
.domain
is None:
177 print >> sys
.stderr
, "No domain set!"
181 if not opts
.adminpass
:
182 logger
.info("Administrator password will be set randomly!")
184 lp
= sambaopts
.get_loadparm()
185 smbconf
= lp
.configfile
187 if opts
.server_role
== "dc":
188 server_role
= "domain controller"
189 elif opts
.server_role
== "member":
190 server_role
= "member server"
192 server_role
= opts
.server_role
194 if opts
.function_level
is None:
195 dom_for_fun_level
= None
196 elif opts
.function_level
== "2000":
197 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2000
198 elif opts
.function_level
== "2003":
199 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2003
200 elif opts
.function_level
== "2008":
201 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2008
202 elif opts
.function_level
== "2008_R2":
203 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2008_R2
205 creds
= credopts
.get_credentials(lp
)
207 creds
.set_kerberos_state(DONT_USE_KERBEROS
)
209 setup_dir
= opts
.setupdir
210 if setup_dir
is None:
211 setup_dir
= find_setup_dir()
213 samdb_fill
= FILL_FULL
215 samdb_fill
= FILL_NT4SYNC
216 elif opts
.partitions_only
:
217 samdb_fill
= FILL_DRS
220 if opts
.use_xattrs
== "yes":
222 elif opts
.use_xattrs
== "auto":
223 file = tempfile
.NamedTemporaryFile()
225 samba
.ntacls
.setntacl(lp
, file.name
,
226 "O:S-1-5-32G:S-1-5-32", "S-1-5-32", "native")
229 # XXX: Should catch a specific exception here
230 if lp
.get("posix:eadb") is None:
231 logger
.info("You are not root or your system do not support xattr, using tdb backend for attributes. "
232 "If you intend to use this provision in production, rerun the script as root on a system supporting xattrs.")
236 session
= system_session()
238 provision(setup_dir
, logger
,
239 session
, creds
, smbconf
=smbconf
, targetdir
=opts
.targetdir
,
240 samdb_fill
=samdb_fill
, realm
=opts
.realm
, domain
=opts
.domain
,
241 domainguid
=opts
.domain_guid
, domainsid
=opts
.domain_sid
,
242 policyguid
=opts
.policy_guid
, policyguid_dc
=opts
.policy_guid_dc
,
243 hostname
=opts
.host_name
,
244 hostip
=opts
.host_ip
, hostip6
=opts
.host_ip6
,
245 ntdsguid
=opts
.ntds_guid
,
246 invocationid
=opts
.invocationid
, adminpass
=opts
.adminpass
,
247 krbtgtpass
=opts
.krbtgtpass
, machinepass
=opts
.machinepass
,
248 dnspass
=opts
.dnspass
, root
=opts
.root
, nobody
=opts
.nobody
,
249 wheel
=opts
.wheel
, users
=opts
.users
,
250 serverrole
=server_role
, dom_for_fun_level
=dom_for_fun_level
,
251 ldap_backend_extra_port
=opts
.ldap_backend_extra_port
,
252 backend_type
=opts
.ldap_backend_type
,
253 ldapadminpass
=opts
.ldapadminpass
, ol_mmr_urls
=opts
.ol_mmr_urls
,
254 slapd_path
=opts
.slapd_path
, setup_ds_path
=opts
.setup_ds_path
,
255 nosync
=opts
.nosync
, ldap_dryrun_mode
=opts
.ldap_dryrun_mode
,
257 except ProvisioningError
, e
: