3 # Unix SMB/CIFS implementation.
4 # provision a Samba4 server
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
8 # Based on the original in EJS:
9 # Copyright (C) Andrew Tridgell 2005
11 # This program is free software; you can redistribute it and/or modify
12 # it under the terms of the GNU General Public License as published by
13 # the Free Software Foundation; either version 3 of the License, or
14 # (at your option) any later version.
16 # This program is distributed in the hope that it will be useful,
17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 # GNU General Public License for more details.
21 # You should have received a copy of the GNU General Public License
22 # along with this program. If not, see <http://www.gnu.org/licenses/>.
30 # Find right directory when running from source tree
31 sys
.path
.insert(0, "bin/python")
35 from samba
.credentials
import DONT_USE_KERBEROS
36 from samba
.auth
import system_session
37 import samba
.getopt
as options
38 from samba
.provision
import (
45 from samba
.dsdb
import (
46 DS_DOMAIN_FUNCTION_2000
,
47 DS_DOMAIN_FUNCTION_2003
,
48 DS_DOMAIN_FUNCTION_2008
,
49 DS_DOMAIN_FUNCTION_2008_R2
,
52 # how do we make this case insensitive??
54 parser
= optparse
.OptionParser("provision [options]")
55 sambaopts
= options
.SambaOptions(parser
)
56 parser
.add_option_group(sambaopts
)
57 parser
.add_option_group(options
.VersionOptions(parser
))
58 credopts
= options
.CredentialsOptions(parser
)
59 parser
.add_option_group(credopts
)
60 parser
.add_option("--interactive", help="Ask for names", action
="store_true")
61 parser
.add_option("--domain", type="string", metavar
="DOMAIN",
63 parser
.add_option("--domain-guid", type="string", metavar
="GUID",
64 help="set domainguid (otherwise random)")
65 parser
.add_option("--domain-sid", type="string", metavar
="SID",
66 help="set domainsid (otherwise random)")
67 parser
.add_option("--ntds-guid", type="string", metavar
="GUID",
68 help="set NTDS object GUID (otherwise random)")
69 parser
.add_option("--invocationid", type="string", metavar
="GUID",
70 help="set invocationid (otherwise random)")
71 parser
.add_option("--host-name", type="string", metavar
="HOSTNAME",
73 parser
.add_option("--host-ip", type="string", metavar
="IPADDRESS",
74 help="set IPv4 ipaddress")
75 parser
.add_option("--host-ip6", type="string", metavar
="IP6ADDRESS",
76 help="set IPv6 ipaddress")
77 parser
.add_option("--adminpass", type="string", metavar
="PASSWORD",
78 help="choose admin password (otherwise random)")
79 parser
.add_option("--krbtgtpass", type="string", metavar
="PASSWORD",
80 help="choose krbtgt password (otherwise random)")
81 parser
.add_option("--machinepass", type="string", metavar
="PASSWORD",
82 help="choose machine password (otherwise random)")
83 parser
.add_option("--dns-backend", type="choice", metavar
="NAMESERVER-BACKEND",
84 choices
=["SAMBA", "BIND9", "BIND9_DLZ"],
85 help="The DNS server backend. SAMBA is the builtin name server (experimental), BIND9 uses bind9 text database to store zone information (default), BIND9_DLZ uses samba4 AD to store zone information (recommended)")
86 parser
.add_option("--dnspass", type="string", metavar
="PASSWORD",
87 help="choose dns password (otherwise random)")
88 parser
.add_option("--ldapadminpass", type="string", metavar
="PASSWORD",
89 help="choose password to set between Samba and it's LDAP backend (otherwise random)")
90 parser
.add_option("--root", type="string", metavar
="USERNAME",
91 help="choose 'root' unix username")
92 parser
.add_option("--nobody", type="string", metavar
="USERNAME",
93 help="choose 'nobody' user")
94 parser
.add_option("--wheel", type="string", metavar
="GROUPNAME",
95 help="choose 'wheel' privileged group")
96 parser
.add_option("--users", type="string", metavar
="GROUPNAME",
97 help="choose 'users' group")
98 parser
.add_option("--quiet", help="Be quiet", action
="store_true")
99 parser
.add_option("--blank", action
="store_true",
100 help="do not add users or groups, just the structure")
101 parser
.add_option("--ldap-backend-extra-port", type="int", metavar
="LDAP-BACKEND-EXTRA-PORT",
102 help="Additional TCP port for LDAP backend server (to use for replication)")
103 parser
.add_option("--ldap-backend-forced-uri", type="string", metavar
="LDAP-BACKEND-FORCED-URI",
104 help="Force the LDAP backend connection to be to a particular URI. Use this ONLY for 'existing' backends, or when debugging the interaction with the LDAP backend and you need to intercept the LDAP traffic")
105 parser
.add_option("--ldap-backend-type", type="choice", metavar
="LDAP-BACKEND-TYPE",
106 help="LDAP backend type (fedora-ds or openldap)",
107 choices
=["fedora-ds", "openldap"])
108 parser
.add_option("--ldap-backend-nosync", help="Configure LDAP backend not to call fsync() (for performance in test environments)", action
="store_true")
109 parser
.add_option("--server-role", type="choice", metavar
="ROLE",
110 choices
=["domain controller", "dc", "member server", "member", "standalone"],
111 help="The server role (domain controller | dc | member server | member | standalone). Default is standalone.")
112 parser
.add_option("--function-level", type="choice", metavar
="FOR-FUN-LEVEL",
113 choices
=["2000", "2003", "2008", "2008_R2"],
114 help="The domain and forest function level (2000 | 2003 | 2008 | 2008_R2 - always native). Default is (Windows) 2003 Native.")
115 parser
.add_option("--next-rid", type="int", metavar
="NEXTRID", default
=1000,
116 help="The initial nextRid value (only needed for upgrades). Default is 1000.")
117 parser
.add_option("--partitions-only",
118 help="Configure Samba's partitions, but do not modify them (ie, join a BDC)", action
="store_true")
119 parser
.add_option("--targetdir", type="string", metavar
="DIR",
120 help="Set target directory")
121 parser
.add_option("--ol-mmr-urls", type="string", metavar
="LDAPSERVER",
122 help="List of LDAP-URLS [ ldap://<FQHN>:<PORT>/ (where <PORT> has to be different than 389!) ] separated with comma (\",\") for use with OpenLDAP-MMR (Multi-Master-Replication), e.g.: \"ldap://s4dc1:9000,ldap://s4dc2:9000\"")
123 parser
.add_option("--slapd-path", type="string", metavar
="SLAPD-PATH",
124 help="Path to slapd for LDAP backend [e.g.:'/usr/local/libexec/slapd']. Required for Setup with LDAP-Backend. OpenLDAP Version >= 2.4.17 should be used.")
125 parser
.add_option("--setup-ds-path", type="string", metavar
="SETUP_DS-PATH",
126 help="Path to setup-ds.pl script for Fedora DS LDAP backend [e.g.:'/usr/sbin/setup-ds.pl']. Required for Setup with Fedora DS backend.")
127 parser
.add_option("--use-xattrs", type="choice", choices
=["yes", "no", "auto"], help="Define if we should use the native fs capabilities or a tdb file for storing attributes likes ntacl, auto tries to make an inteligent guess based on the user rights and system capabilities", default
="auto")
128 parser
.add_option("--ldap-dryrun-mode", help="Configure LDAP backend, but do not run any binaries and exit early. Used only for the test environment. DO NOT USE", action
="store_true")
130 opts
= parser
.parse_args()[0]
132 logger
= logging
.getLogger("provision")
133 logger
.addHandler(logging
.StreamHandler(sys
.stdout
))
135 logger
.setLevel(logging
.WARNING
)
137 logger
.setLevel(logging
.INFO
)
139 if len(sys
.argv
) == 1:
140 opts
.interactive
= True
143 from getpass
import getpass
146 def ask(prompt
, default
=None):
147 if default
is not None:
148 print "%s [%s]: " % (prompt
, default
),
150 print "%s: " % (prompt
,),
151 return sys
.stdin
.readline().rstrip("\n") or default
153 default
= socket
.getfqdn().split(".", 1)[1].upper()
156 opts
.realm
= ask("Realm", default
)
157 if opts
.realm
in (None, ""):
158 print >>sys
.stderr
, "No realm set!"
162 default
= opts
.realm
.split(".")[0]
165 opts
.domain
= ask("Domain", default
)
166 if opts
.domain
is None:
167 print >> sys
.stderr
, "No domain set!"
170 opts
.server_role
= ask("Server Role (dc, member, standalone)", "dc")
172 opts
.adminpass
= getpass("Administrator password: ")
173 if not opts
.adminpass
:
174 print >>sys
.stderr
, "Invalid administrator password."
178 if opts
.realm
in (None, ""):
179 opts
.realm
= sambaopts
._lp
.get('realm')
180 if opts
.realm
is None or opts
.domain
is None:
181 if opts
.realm
is None:
182 print >>sys
.stderr
, "No realm set!"
183 if opts
.domain
is None:
184 print >> sys
.stderr
, "No domain set!"
188 if not opts
.adminpass
:
189 logger
.info("Administrator password will be set randomly!")
191 lp
= sambaopts
.get_loadparm()
192 smbconf
= lp
.configfile
194 if opts
.server_role
== "dc":
195 server_role
= "domain controller"
196 elif opts
.server_role
== "member":
197 server_role
= "member server"
199 server_role
= opts
.server_role
201 if opts
.function_level
is None:
202 dom_for_fun_level
= None
203 elif opts
.function_level
== "2000":
204 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2000
205 elif opts
.function_level
== "2003":
206 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2003
207 elif opts
.function_level
== "2008":
208 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2008
209 elif opts
.function_level
== "2008_R2":
210 dom_for_fun_level
= DS_DOMAIN_FUNCTION_2008_R2
212 creds
= credopts
.get_credentials(lp
)
214 creds
.set_kerberos_state(DONT_USE_KERBEROS
)
216 samdb_fill
= FILL_FULL
218 samdb_fill
= FILL_NT4SYNC
219 elif opts
.partitions_only
:
220 samdb_fill
= FILL_DRS
223 if opts
.use_xattrs
== "yes":
225 elif opts
.use_xattrs
== "auto" and not lp
.get("posix:eadb"):
226 file = tempfile
.NamedTemporaryFile()
228 samba
.ntacls
.setntacl(lp
, file.name
,
229 "O:S-1-5-32G:S-1-5-32", "S-1-5-32", "native")
232 logger
.info("You are not root or your system do not support xattr, using tdb backend for attributes. "
233 "If you intend to use this provision in production, rerun the script as root on a system supporting xattrs.")
237 if opts
.ldap_backend_type
== "existing":
238 if opts
.ldap_backend_forced_uri
is not None:
239 logger
.warn("You have specified to use an existing LDAP server as the backend, please make sure an LDAP server is running at %s" % opts
.ldap_backend_forced_uri
)
241 logger
.info("You have specified to use an existing LDAP server as the backend, please make sure an LDAP server is running at the default location")
243 if opts
.ldap_backend_forced_uri
is not None:
244 logger
.warn("You have specified to use an fixed URI %s for connecting to your LDAP server backend. This is NOT RECOMMENDED, as our default communiation over ldapi:// is more secure and much less prone to unexpected failure or interaction" % opts
.ldap_backend_forced_uri
)
246 session
= system_session()
249 session
, creds
, smbconf
=smbconf
, targetdir
=opts
.targetdir
,
250 samdb_fill
=samdb_fill
, realm
=opts
.realm
, domain
=opts
.domain
,
251 domainguid
=opts
.domain_guid
, domainsid
=opts
.domain_sid
,
252 hostname
=opts
.host_name
,
253 hostip
=opts
.host_ip
, hostip6
=opts
.host_ip6
,
254 ntdsguid
=opts
.ntds_guid
,
255 invocationid
=opts
.invocationid
, adminpass
=opts
.adminpass
,
256 krbtgtpass
=opts
.krbtgtpass
, machinepass
=opts
.machinepass
,
257 dns_backend
=opts
.dns_backend
,
258 dnspass
=opts
.dnspass
, root
=opts
.root
, nobody
=opts
.nobody
,
259 wheel
=opts
.wheel
, users
=opts
.users
,
260 serverrole
=server_role
, dom_for_fun_level
=dom_for_fun_level
,
261 ldap_backend_extra_port
=opts
.ldap_backend_extra_port
,
262 ldap_backend_forced_uri
=opts
.ldap_backend_forced_uri
,
263 backend_type
=opts
.ldap_backend_type
,
264 ldapadminpass
=opts
.ldapadminpass
, ol_mmr_urls
=opts
.ol_mmr_urls
,
265 slapd_path
=opts
.slapd_path
, setup_ds_path
=opts
.setup_ds_path
,
266 nosync
=opts
.ldap_backend_nosync
, ldap_dryrun_mode
=opts
.ldap_dryrun_mode
,
267 useeadb
=eadb
, next_rid
=opts
.next_rid
, lp
=lp
)
268 except ProvisioningError
, e
: