?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: add FILE_ATTRIBUTE_SPARSE to get_stat_dos_flags
[Samba/wip.git] / source3 / utils / net_ads.c
blobdaf26020fe76ae11de17b163247c76a6e4f1f206
1 /*
2 Samba Unix/Linux SMB client library
3 net ads commands
4 Copyright (C) 2001 Andrew Tridgell (tridge@samba.org)
5 Copyright (C) 2001 Remus Koos (remuskoos@yahoo.com)
6 Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
7 Copyright (C) 2006 Gerald (Jerry) Carter (jerry@samba.org)
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "utils/net.h"
25 #include "librpc/gen_ndr/ndr_krb5pac.h"
26 #include "../librpc/gen_ndr/cli_spoolss.h"
27 #include "nsswitch/libwbclient/wbclient.h"
28 #include "ads.h"
29 #include "libads/cldap.h"
30 #include "libads/dns.h"
31 #include "../libds/common/flags.h"
32 #include "librpc/gen_ndr/libnet_join.h"
33 #include "libnet/libnet_join.h"
34 #include "smb_krb5.h"
35 #include "secrets.h"
36 #include "krb5_env.h"
37 #include "../libcli/security/security.h"
38
39 #ifdef HAVE_ADS
40
41 /* when we do not have sufficient input parameters to contact a remote domain
42 * we always fall back to our own realm - Guenther*/
43
44 static const char *assume_own_realm(struct net_context *c)
45 {
46 if (!c->opt_host && strequal(lp_workgroup(), c->opt_target_workgroup)) {
47 return lp_realm();
48 }
49
50 return NULL;
51 }
52
53 /*
54 do a cldap netlogon query
55 */
56 static int net_ads_cldap_netlogon(struct net_context *c, ADS_STRUCT *ads)
57 {
58 char addr[INET6_ADDRSTRLEN];
59 struct NETLOGON_SAM_LOGON_RESPONSE_EX reply;
60
61 print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
62 if ( !ads_cldap_netlogon_5(talloc_tos(), addr, ads->server.realm, &reply ) ) {
63 d_fprintf(stderr, _("CLDAP query failed!\n"));
64 return -1;
65 }
66
67 d_printf(_("Information for Domain Controller: %s\n\n"),
68 addr);
69
70 d_printf(_("Response Type: "));
71 switch (reply.command) {
72 case LOGON_SAM_LOGON_USER_UNKNOWN_EX:
73 d_printf("LOGON_SAM_LOGON_USER_UNKNOWN_EX\n");
74 break;
75 case LOGON_SAM_LOGON_RESPONSE_EX:
76 d_printf("LOGON_SAM_LOGON_RESPONSE_EX\n");
77 break;
78 default:
79 d_printf("0x%x\n", reply.command);
80 break;
81 }
82
83 d_printf(_("GUID: %s\n"), GUID_string(talloc_tos(),&reply.domain_uuid));
84
85 d_printf(_("Flags:\n"
86 "\tIs a PDC: %s\n"
87 "\tIs a GC of the forest: %s\n"
88 "\tIs an LDAP server: %s\n"
89 "\tSupports DS: %s\n"
90 "\tIs running a KDC: %s\n"
91 "\tIs running time services: %s\n"
92 "\tIs the closest DC: %s\n"
93 "\tIs writable: %s\n"
94 "\tHas a hardware clock: %s\n"
95 "\tIs a non-domain NC serviced by LDAP server: %s\n"
96 "\tIs NT6 DC that has some secrets: %s\n"
97 "\tIs NT6 DC that has all secrets: %s\n"),
98 (reply.server_type & NBT_SERVER_PDC) ? _("yes") : _("no"),
99 (reply.server_type & NBT_SERVER_GC) ? _("yes") : _("no"),
100 (reply.server_type & NBT_SERVER_LDAP) ? _("yes") : _("no"),
101 (reply.server_type & NBT_SERVER_DS) ? _("yes") : _("no"),
102 (reply.server_type & NBT_SERVER_KDC) ? _("yes") : _("no"),
103 (reply.server_type & NBT_SERVER_TIMESERV) ? _("yes") : _("no"),
104 (reply.server_type & NBT_SERVER_CLOSEST) ? _("yes") : _("no"),
105 (reply.server_type & NBT_SERVER_WRITABLE) ? _("yes") : _("no"),
106 (reply.server_type & NBT_SERVER_GOOD_TIMESERV) ? _("yes") : _("no"),
107 (reply.server_type & NBT_SERVER_NDNC) ? _("yes") : _("no"),
108 (reply.server_type & NBT_SERVER_SELECT_SECRET_DOMAIN_6) ? _("yes") : _("no"),
109 (reply.server_type & NBT_SERVER_FULL_SECRET_DOMAIN_6) ? _("yes") : _("no"));
110
111
112 printf(_("Forest:\t\t\t%s\n"), reply.forest);
113 printf(_("Domain:\t\t\t%s\n"), reply.dns_domain);
114 printf(_("Domain Controller:\t%s\n"), reply.pdc_dns_name);
115
116 printf(_("Pre-Win2k Domain:\t%s\n"), reply.domain_name);
117 printf(_("Pre-Win2k Hostname:\t%s\n"), reply.pdc_name);
118
119 if (*reply.user_name) printf(_("User name:\t%s\n"), reply.user_name);
120
121 printf(_("Server Site Name :\t\t%s\n"), reply.server_site);
122 printf(_("Client Site Name :\t\t%s\n"), reply.client_site);
123
124 d_printf(_("NT Version: %d\n"), reply.nt_version);
125 d_printf(_("LMNT Token: %.2x\n"), reply.lmnt_token);
126 d_printf(_("LM20 Token: %.2x\n"), reply.lm20_token);
127
128 return 0;
129 }
130
131 /*
132 this implements the CLDAP based netlogon lookup requests
133 for finding the domain controller of a ADS domain
134 */
135 static int net_ads_lookup(struct net_context *c, int argc, const char **argv)
136 {
137 ADS_STRUCT *ads;
138 int ret;
139
140 if (c->display_usage) {
141 d_printf("%s\n"
142 "net ads lookup\n"
143 " %s",
144 _("Usage:"),
145 _("Find the ADS DC using CLDAP lookup.\n"));
146 return 0;
147 }
148
149 if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
150 d_fprintf(stderr, _("Didn't find the cldap server!\n"));
151 ads_destroy(&ads);
152 return -1;
153 }
154
155 if (!ads->config.realm) {
156 ads->config.realm = CONST_DISCARD(char *, c->opt_target_workgroup);
157 ads->ldap.port = 389;
158 }
159
160 ret = net_ads_cldap_netlogon(c, ads);
161 ads_destroy(&ads);
162 return ret;
163 }
164
165
166
167 static int net_ads_info(struct net_context *c, int argc, const char **argv)
168 {
169 ADS_STRUCT *ads;
170 char addr[INET6_ADDRSTRLEN];
171
172 if (c->display_usage) {
173 d_printf("%s\n"
174 "net ads info\n"
175 " %s",
176 _("Usage:"),
177 _("Display information about an Active Directory "
178 "server.\n"));
179 return 0;
180 }
181
182 if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
183 d_fprintf(stderr, _("Didn't find the ldap server!\n"));
184 return -1;
185 }
186
187 if (!ads || !ads->config.realm) {
188 d_fprintf(stderr, _("Didn't find the ldap server!\n"));
189 ads_destroy(&ads);
190 return -1;
191 }
192
193 /* Try to set the server's current time since we didn't do a full
194 TCP LDAP session initially */
195
196 if ( !ADS_ERR_OK(ads_current_time( ads )) ) {
197 d_fprintf( stderr, _("Failed to get server's current time!\n"));
198 }
199
200 print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
201
202 d_printf(_("LDAP server: %s\n"), addr);
203 d_printf(_("LDAP server name: %s\n"), ads->config.ldap_server_name);
204 d_printf(_("Realm: %s\n"), ads->config.realm);
205 d_printf(_("Bind Path: %s\n"), ads->config.bind_path);
206 d_printf(_("LDAP port: %d\n"), ads->ldap.port);
207 d_printf(_("Server time: %s\n"),
208 http_timestring(talloc_tos(), ads->config.current_time));
209
210 d_printf(_("KDC server: %s\n"), ads->auth.kdc_server );
211 d_printf(_("Server time offset: %d\n"), ads->auth.time_offset );
212
213 ads_destroy(&ads);
214 return 0;
215 }
216
217 static void use_in_memory_ccache(void) {
218 /* Use in-memory credentials cache so we do not interfere with
219 * existing credentials */
220 setenv(KRB5_ENV_CCNAME, "MEMORY:net_ads", 1);
221 }
222
223 static ADS_STATUS ads_startup_int(struct net_context *c, bool only_own_domain,
224 uint32 auth_flags, ADS_STRUCT **ads_ret)
225 {
226 ADS_STRUCT *ads = NULL;
227 ADS_STATUS status;
228 bool need_password = false;
229 bool second_time = false;
230 char *cp;
231 const char *realm = NULL;
232 bool tried_closest_dc = false;
233
234 /* lp_realm() should be handled by a command line param,
235 However, the join requires that realm be set in smb.conf
236 and compares our realm with the remote server's so this is
237 ok until someone needs more flexibility */
238
239 *ads_ret = NULL;
240
241 retry_connect:
242 if (only_own_domain) {
243 realm = lp_realm();
244 } else {
245 realm = assume_own_realm(c);
246 }
247
248 ads = ads_init(realm, c->opt_target_workgroup, c->opt_host);
249
250 if (!c->opt_user_name) {
251 c->opt_user_name = "administrator";
252 }
253
254 if (c->opt_user_specified) {
255 need_password = true;
256 }
257
258 retry:
259 if (!c->opt_password && need_password && !c->opt_machine_pass) {
260 c->opt_password = net_prompt_pass(c, c->opt_user_name);
261 if (!c->opt_password) {
262 ads_destroy(&ads);
263 return ADS_ERROR(LDAP_NO_MEMORY);
264 }
265 }
266
267 if (c->opt_password) {
268 use_in_memory_ccache();
269 SAFE_FREE(ads->auth.password);
270 ads->auth.password = smb_xstrdup(c->opt_password);
271 }
272
273 ads->auth.flags |= auth_flags;
274 SAFE_FREE(ads->auth.user_name);
275 ads->auth.user_name = smb_xstrdup(c->opt_user_name);
276
277 /*
278 * If the username is of the form "name@realm",
279 * extract the realm and convert to upper case.
280 * This is only used to establish the connection.
281 */
282 if ((cp = strchr_m(ads->auth.user_name, '@'))!=0) {
283 *cp++ = '\0';
284 SAFE_FREE(ads->auth.realm);
285 ads->auth.realm = smb_xstrdup(cp);
286 strupper_m(ads->auth.realm);
287 }
288
289 status = ads_connect(ads);
290
291 if (!ADS_ERR_OK(status)) {
292
293 if (NT_STATUS_EQUAL(ads_ntstatus(status),
294 NT_STATUS_NO_LOGON_SERVERS)) {
295 DEBUG(0,("ads_connect: %s\n", ads_errstr(status)));
296 ads_destroy(&ads);
297 return status;
298 }
299
300 if (!need_password && !second_time && !(auth_flags & ADS_AUTH_NO_BIND)) {
301 need_password = true;
302 second_time = true;
303 goto retry;
304 } else {
305 ads_destroy(&ads);
306 return status;
307 }
308 }
309
310 /* when contacting our own domain, make sure we use the closest DC.
311 * This is done by reconnecting to ADS because only the first call to
312 * ads_connect will give us our own sitename */
313
314 if ((only_own_domain || !c->opt_host) && !tried_closest_dc) {
315
316 tried_closest_dc = true; /* avoid loop */
317
318 if (!ads_closest_dc(ads)) {
319
320 namecache_delete(ads->server.realm, 0x1C);
321 namecache_delete(ads->server.workgroup, 0x1C);
322
323 ads_destroy(&ads);
324 ads = NULL;
325
326 goto retry_connect;
327 }
328 }
329
330 *ads_ret = ads;
331 return status;
332 }
333
334 ADS_STATUS ads_startup(struct net_context *c, bool only_own_domain, ADS_STRUCT **ads)
335 {
336 return ads_startup_int(c, only_own_domain, 0, ads);
337 }
338
339 ADS_STATUS ads_startup_nobind(struct net_context *c, bool only_own_domain, ADS_STRUCT **ads)
340 {
341 return ads_startup_int(c, only_own_domain, ADS_AUTH_NO_BIND, ads);
342 }
343
344 /*
345 Check to see if connection can be made via ads.
346 ads_startup() stores the password in opt_password if it needs to so
347 that rpc or rap can use it without re-prompting.
348 */
349 static int net_ads_check_int(const char *realm, const char *workgroup, const char *host)
350 {
351 ADS_STRUCT *ads;
352 ADS_STATUS status;
353
354 if ( (ads = ads_init( realm, workgroup, host )) == NULL ) {
355 return -1;
356 }
357
358 ads->auth.flags |= ADS_AUTH_NO_BIND;
359
360 status = ads_connect(ads);
361 if ( !ADS_ERR_OK(status) ) {
362 return -1;
363 }
364
365 ads_destroy(&ads);
366 return 0;
367 }
368
369 int net_ads_check_our_domain(struct net_context *c)
370 {
371 return net_ads_check_int(lp_realm(), lp_workgroup(), NULL);
372 }
373
374 int net_ads_check(struct net_context *c)
375 {
376 return net_ads_check_int(NULL, c->opt_workgroup, c->opt_host);
377 }
378
379 /*
380 determine the netbios workgroup name for a domain
381 */
382 static int net_ads_workgroup(struct net_context *c, int argc, const char **argv)
383 {
384 ADS_STRUCT *ads;
385 char addr[INET6_ADDRSTRLEN];
386 struct NETLOGON_SAM_LOGON_RESPONSE_EX reply;
387
388 if (c->display_usage) {
389 d_printf ("%s\n"
390 "net ads workgroup\n"
391 " %s\n",
392 _("Usage:"),
393 _("Print the workgroup name"));
394 return 0;
395 }
396
397 if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
398 d_fprintf(stderr, _("Didn't find the cldap server!\n"));
399 return -1;
400 }
401
402 if (!ads->config.realm) {
403 ads->config.realm = CONST_DISCARD(char *, c->opt_target_workgroup);
404 ads->ldap.port = 389;
405 }
406
407 print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
408 if ( !ads_cldap_netlogon_5(talloc_tos(), addr, ads->server.realm, &reply ) ) {
409 d_fprintf(stderr, _("CLDAP query failed!\n"));
410 ads_destroy(&ads);
411 return -1;
412 }
413
414 d_printf(_("Workgroup: %s\n"), reply.domain_name);
415
416 ads_destroy(&ads);
417
418 return 0;
419 }
420
421
422
423 static bool usergrp_display(ADS_STRUCT *ads, char *field, void **values, void *data_area)
424 {
425 char **disp_fields = (char **) data_area;
426
427 if (!field) { /* must be end of record */
428 if (disp_fields[0]) {
429 if (!strchr_m(disp_fields[0], '$')) {
430 if (disp_fields[1])
431 d_printf("%-21.21s %s\n",
432 disp_fields[0], disp_fields[1]);
433 else
434 d_printf("%s\n", disp_fields[0]);
435 }
436 }
437 SAFE_FREE(disp_fields[0]);
438 SAFE_FREE(disp_fields[1]);
439 return true;
440 }
441 if (!values) /* must be new field, indicate string field */
442 return true;
443 if (StrCaseCmp(field, "sAMAccountName") == 0) {
444 disp_fields[0] = SMB_STRDUP((char *) values[0]);
445 }
446 if (StrCaseCmp(field, "description") == 0)
447 disp_fields[1] = SMB_STRDUP((char *) values[0]);
448 return true;
449 }
450
451 static int net_ads_user_usage(struct net_context *c, int argc, const char **argv)
452 {
453 return net_user_usage(c, argc, argv);
454 }
455
456 static int ads_user_add(struct net_context *c, int argc, const char **argv)
457 {
458 ADS_STRUCT *ads;
459 ADS_STATUS status;
460 char *upn, *userdn;
461 LDAPMessage *res=NULL;
462 int rc = -1;
463 char *ou_str = NULL;
464
465 if (argc < 1 || c->display_usage)
466 return net_ads_user_usage(c, argc, argv);
467
468 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
469 return -1;
470 }
471
472 status = ads_find_user_acct(ads, &res, argv[0]);
473
474 if (!ADS_ERR_OK(status)) {
475 d_fprintf(stderr, _("ads_user_add: %s\n"), ads_errstr(status));
476 goto done;
477 }
478
479 if (ads_count_replies(ads, res)) {
480 d_fprintf(stderr, _("ads_user_add: User %s already exists\n"),
481 argv[0]);
482 goto done;
483 }
484
485 if (c->opt_container) {
486 ou_str = SMB_STRDUP(c->opt_container);
487 } else {
488 ou_str = ads_default_ou_string(ads, DS_GUID_USERS_CONTAINER);
489 }
490
491 status = ads_add_user_acct(ads, argv[0], ou_str, c->opt_comment);
492
493 if (!ADS_ERR_OK(status)) {
494 d_fprintf(stderr, _("Could not add user %s: %s\n"), argv[0],
495 ads_errstr(status));
496 goto done;
497 }
498
499 /* if no password is to be set, we're done */
500 if (argc == 1) {
501 d_printf(_("User %s added\n"), argv[0]);
502 rc = 0;
503 goto done;
504 }
505
506 /* try setting the password */
507 if (asprintf(&upn, "%s@%s", argv[0], ads->config.realm) == -1) {
508 goto done;
509 }
510 status = ads_krb5_set_password(ads->auth.kdc_server, upn, argv[1],
511 ads->auth.time_offset);
512 SAFE_FREE(upn);
513 if (ADS_ERR_OK(status)) {
514 d_printf(_("User %s added\n"), argv[0]);
515 rc = 0;
516 goto done;
517 }
518
519 /* password didn't set, delete account */
520 d_fprintf(stderr, _("Could not add user %s. "
521 "Error setting password %s\n"),
522 argv[0], ads_errstr(status));
523 ads_msgfree(ads, res);
524 status=ads_find_user_acct(ads, &res, argv[0]);
525 if (ADS_ERR_OK(status)) {
526 userdn = ads_get_dn(ads, talloc_tos(), res);
527 ads_del_dn(ads, userdn);
528 TALLOC_FREE(userdn);
529 }
530
531 done:
532 if (res)
533 ads_msgfree(ads, res);
534 ads_destroy(&ads);
535 SAFE_FREE(ou_str);
536 return rc;
537 }
538
539 static int ads_user_info(struct net_context *c, int argc, const char **argv)
540 {
541 ADS_STRUCT *ads = NULL;
542 ADS_STATUS rc;
543 LDAPMessage *res = NULL;
544 TALLOC_CTX *frame;
545 int ret = 0;
546 wbcErr wbc_status;
547 const char *attrs[] = {"memberOf", "primaryGroupID", NULL};
548 char *searchstring=NULL;
549 char **grouplist;
550 char *primary_group;
551 char *escaped_user;
552 struct dom_sid primary_group_sid;
553 uint32_t group_rid;
554 enum wbcSidType type;
555
556 if (argc < 1 || c->display_usage) {
557 return net_ads_user_usage(c, argc, argv);
558 }
559
560 frame = talloc_new(talloc_tos());
561 if (frame == NULL) {
562 return -1;
563 }
564
565 escaped_user = escape_ldap_string(frame, argv[0]);
566 if (!escaped_user) {
567 d_fprintf(stderr,
568 _("ads_user_info: failed to escape user %s\n"),
569 argv[0]);
570 return -1;
571 }
572
573 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
574 ret = -1;
575 goto error;
576 }
577
578 if (asprintf(&searchstring, "(sAMAccountName=%s)", escaped_user) == -1) {
579 ret =-1;
580 goto error;
581 }
582 rc = ads_search(ads, &res, searchstring, attrs);
583 SAFE_FREE(searchstring);
584
585 if (!ADS_ERR_OK(rc)) {
586 d_fprintf(stderr, _("ads_search: %s\n"), ads_errstr(rc));
587 ret = -1;
588 goto error;
589 }
590
591 if (!ads_pull_uint32(ads, res, "primaryGroupID", &group_rid)) {
592 d_fprintf(stderr, _("ads_pull_uint32 failed\n"));
593 ret = -1;
594 goto error;
595 }
596
597 rc = ads_domain_sid(ads, &primary_group_sid);
598 if (!ADS_ERR_OK(rc)) {
599 d_fprintf(stderr, _("ads_domain_sid: %s\n"), ads_errstr(rc));
600 ret = -1;
601 goto error;
602 }
603
604 sid_append_rid(&primary_group_sid, group_rid);
605
606 wbc_status = wbcLookupSid((struct wbcDomainSid *)&primary_group_sid,
607 NULL, /* don't look up domain */
608 &primary_group,
609 &type);
610 if (!WBC_ERROR_IS_OK(wbc_status)) {
611 d_fprintf(stderr, "wbcLookupSid: %s\n",
612 wbcErrorString(wbc_status));
613 ret = -1;
614 goto error;
615 }
616
617 d_printf("%s\n", primary_group);
618
619 wbcFreeMemory(primary_group);
620
621 grouplist = ldap_get_values((LDAP *)ads->ldap.ld,
622 (LDAPMessage *)res, "memberOf");
623
624 if (grouplist) {
625 int i;
626 char **groupname;
627 for (i=0;grouplist[i];i++) {
628 groupname = ldap_explode_dn(grouplist[i], 1);
629 d_printf("%s\n", groupname[0]);
630 ldap_value_free(groupname);
631 }
632 ldap_value_free(grouplist);
633 }
634
635 error:
636 if (res) ads_msgfree(ads, res);
637 if (ads) ads_destroy(&ads);
638 TALLOC_FREE(frame);
639 return ret;
640 }
641
642 static int ads_user_delete(struct net_context *c, int argc, const char **argv)
643 {
644 ADS_STRUCT *ads;
645 ADS_STATUS rc;
646 LDAPMessage *res = NULL;
647 char *userdn;
648
649 if (argc < 1) {
650 return net_ads_user_usage(c, argc, argv);
651 }
652
653 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
654 return -1;
655 }
656
657 rc = ads_find_user_acct(ads, &res, argv[0]);
658 if (!ADS_ERR_OK(rc) || ads_count_replies(ads, res) != 1) {
659 d_printf(_("User %s does not exist.\n"), argv[0]);
660 ads_msgfree(ads, res);
661 ads_destroy(&ads);
662 return -1;
663 }
664 userdn = ads_get_dn(ads, talloc_tos(), res);
665 ads_msgfree(ads, res);
666 rc = ads_del_dn(ads, userdn);
667 TALLOC_FREE(userdn);
668 if (ADS_ERR_OK(rc)) {
669 d_printf(_("User %s deleted\n"), argv[0]);
670 ads_destroy(&ads);
671 return 0;
672 }
673 d_fprintf(stderr, _("Error deleting user %s: %s\n"), argv[0],
674 ads_errstr(rc));
675 ads_destroy(&ads);
676 return -1;
677 }
678
679 int net_ads_user(struct net_context *c, int argc, const char **argv)
680 {
681 struct functable func[] = {
682 {
683 "add",
684 ads_user_add,
685 NET_TRANSPORT_ADS,
686 N_("Add an AD user"),
687 N_("net ads user add\n"
688 " Add an AD user")
689 },
690 {
691 "info",
692 ads_user_info,
693 NET_TRANSPORT_ADS,
694 N_("Display information about an AD user"),
695 N_("net ads user info\n"
696 " Display information about an AD user")
697 },
698 {
699 "delete",
700 ads_user_delete,
701 NET_TRANSPORT_ADS,
702 N_("Delete an AD user"),
703 N_("net ads user delete\n"
704 " Delete an AD user")
705 },
706 {NULL, NULL, 0, NULL, NULL}
707 };
708 ADS_STRUCT *ads;
709 ADS_STATUS rc;
710 const char *shortattrs[] = {"sAMAccountName", NULL};
711 const char *longattrs[] = {"sAMAccountName", "description", NULL};
712 char *disp_fields[2] = {NULL, NULL};
713
714 if (argc == 0) {
715 if (c->display_usage) {
716 d_printf( "%s\n"
717 "net ads user\n"
718 " %s\n",
719 _("Usage:"),
720 _("List AD users"));
721 net_display_usage_from_functable(func);
722 return 0;
723 }
724
725 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
726 return -1;
727 }
728
729 if (c->opt_long_list_entries)
730 d_printf(_("\nUser name Comment"
731 "\n-----------------------------\n"));
732
733 rc = ads_do_search_all_fn(ads, ads->config.bind_path,
734 LDAP_SCOPE_SUBTREE,
735 "(objectCategory=user)",
736 c->opt_long_list_entries ? longattrs :
737 shortattrs, usergrp_display,
738 disp_fields);
739 ads_destroy(&ads);
740 return ADS_ERR_OK(rc) ? 0 : -1;
741 }
742
743 return net_run_function(c, argc, argv, "net ads user", func);
744 }
745
746 static int net_ads_group_usage(struct net_context *c, int argc, const char **argv)
747 {
748 return net_group_usage(c, argc, argv);
749 }
750
751 static int ads_group_add(struct net_context *c, int argc, const char **argv)
752 {
753 ADS_STRUCT *ads;
754 ADS_STATUS status;
755 LDAPMessage *res=NULL;
756 int rc = -1;
757 char *ou_str = NULL;
758
759 if (argc < 1 || c->display_usage) {
760 return net_ads_group_usage(c, argc, argv);
761 }
762
763 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
764 return -1;
765 }
766
767 status = ads_find_user_acct(ads, &res, argv[0]);
768
769 if (!ADS_ERR_OK(status)) {
770 d_fprintf(stderr, _("ads_group_add: %s\n"), ads_errstr(status));
771 goto done;
772 }
773
774 if (ads_count_replies(ads, res)) {
775 d_fprintf(stderr, _("ads_group_add: Group %s already exists\n"), argv[0]);
776 goto done;
777 }
778
779 if (c->opt_container) {
780 ou_str = SMB_STRDUP(c->opt_container);
781 } else {
782 ou_str = ads_default_ou_string(ads, DS_GUID_USERS_CONTAINER);
783 }
784
785 status = ads_add_group_acct(ads, argv[0], ou_str, c->opt_comment);
786
787 if (ADS_ERR_OK(status)) {
788 d_printf(_("Group %s added\n"), argv[0]);
789 rc = 0;
790 } else {
791 d_fprintf(stderr, _("Could not add group %s: %s\n"), argv[0],
792 ads_errstr(status));
793 }
794
795 done:
796 if (res)
797 ads_msgfree(ads, res);
798 ads_destroy(&ads);
799 SAFE_FREE(ou_str);
800 return rc;
801 }
802
803 static int ads_group_delete(struct net_context *c, int argc, const char **argv)
804 {
805 ADS_STRUCT *ads;
806 ADS_STATUS rc;
807 LDAPMessage *res = NULL;
808 char *groupdn;
809
810 if (argc < 1 || c->display_usage) {
811 return net_ads_group_usage(c, argc, argv);
812 }
813
814 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
815 return -1;
816 }
817
818 rc = ads_find_user_acct(ads, &res, argv[0]);
819 if (!ADS_ERR_OK(rc) || ads_count_replies(ads, res) != 1) {
820 d_printf(_("Group %s does not exist.\n"), argv[0]);
821 ads_msgfree(ads, res);
822 ads_destroy(&ads);
823 return -1;
824 }
825 groupdn = ads_get_dn(ads, talloc_tos(), res);
826 ads_msgfree(ads, res);
827 rc = ads_del_dn(ads, groupdn);
828 TALLOC_FREE(groupdn);
829 if (ADS_ERR_OK(rc)) {
830 d_printf(_("Group %s deleted\n"), argv[0]);
831 ads_destroy(&ads);
832 return 0;
833 }
834 d_fprintf(stderr, _("Error deleting group %s: %s\n"), argv[0],
835 ads_errstr(rc));
836 ads_destroy(&ads);
837 return -1;
838 }
839
840 int net_ads_group(struct net_context *c, int argc, const char **argv)
841 {
842 struct functable func[] = {
843 {
844 "add",
845 ads_group_add,
846 NET_TRANSPORT_ADS,
847 N_("Add an AD group"),
848 N_("net ads group add\n"
849 " Add an AD group")
850 },
851 {
852 "delete",
853 ads_group_delete,
854 NET_TRANSPORT_ADS,
855 N_("Delete an AD group"),
856 N_("net ads group delete\n"
857 " Delete an AD group")
858 },
859 {NULL, NULL, 0, NULL, NULL}
860 };
861 ADS_STRUCT *ads;
862 ADS_STATUS rc;
863 const char *shortattrs[] = {"sAMAccountName", NULL};
864 const char *longattrs[] = {"sAMAccountName", "description", NULL};
865 char *disp_fields[2] = {NULL, NULL};
866
867 if (argc == 0) {
868 if (c->display_usage) {
869 d_printf( "%s\n"
870 "net ads group\n"
871 " %s\n",
872 _("Usage:"),
873 _("List AD groups"));
874 net_display_usage_from_functable(func);
875 return 0;
876 }
877
878 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
879 return -1;
880 }
881
882 if (c->opt_long_list_entries)
883 d_printf(_("\nGroup name Comment"
884 "\n-----------------------------\n"));
885 rc = ads_do_search_all_fn(ads, ads->config.bind_path,
886 LDAP_SCOPE_SUBTREE,
887 "(objectCategory=group)",
888 c->opt_long_list_entries ? longattrs :
889 shortattrs, usergrp_display,
890 disp_fields);
891
892 ads_destroy(&ads);
893 return ADS_ERR_OK(rc) ? 0 : -1;
894 }
895 return net_run_function(c, argc, argv, "net ads group", func);
896 }
897
898 static int net_ads_status(struct net_context *c, int argc, const char **argv)
899 {
900 ADS_STRUCT *ads;
901 ADS_STATUS rc;
902 LDAPMessage *res;
903
904 if (c->display_usage) {
905 d_printf( "%s\n"
906 "net ads status\n"
907 " %s\n",
908 _("Usage:"),
909 _("Display machine account details"));
910 return 0;
911 }
912
913 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
914 return -1;
915 }
916
917 rc = ads_find_machine_acct(ads, &res, global_myname());
918 if (!ADS_ERR_OK(rc)) {
919 d_fprintf(stderr, _("ads_find_machine_acct: %s\n"), ads_errstr(rc));
920 ads_destroy(&ads);
921 return -1;
922 }
923
924 if (ads_count_replies(ads, res) == 0) {
925 d_fprintf(stderr, _("No machine account for '%s' found\n"), global_myname());
926 ads_destroy(&ads);
927 return -1;
928 }
929
930 ads_dump(ads, res);
931 ads_destroy(&ads);
932 return 0;
933 }
934
935 /*******************************************************************
936 Leave an AD domain. Windows XP disables the machine account.
937 We'll try the same. The old code would do an LDAP delete.
938 That only worked using the machine creds because added the machine
939 with full control to the computer object's ACL.
940 *******************************************************************/
941
942 static int net_ads_leave(struct net_context *c, int argc, const char **argv)
943 {
944 TALLOC_CTX *ctx;
945 struct libnet_UnjoinCtx *r = NULL;
946 WERROR werr;
947
948 if (c->display_usage) {
949 d_printf( "%s\n"
950 "net ads leave\n"
951 " %s\n",
952 _("Usage:"),
953 _("Leave an AD domain"));
954 return 0;
955 }
956
957 if (!*lp_realm()) {
958 d_fprintf(stderr, _("No realm set, are we joined ?\n"));
959 return -1;
960 }
961
962 if (!(ctx = talloc_init("net_ads_leave"))) {
963 d_fprintf(stderr, _("Could not initialise talloc context.\n"));
964 return -1;
965 }
966
967 if (!c->opt_kerberos) {
968 use_in_memory_ccache();
969 }
970
971 if (!c->msg_ctx) {
972 d_fprintf(stderr, _("Could not initialise message context. "
973 "Try running as root\n"));
974 return -1;
975 }
976
977 werr = libnet_init_UnjoinCtx(ctx, &r);
978 if (!W_ERROR_IS_OK(werr)) {
979 d_fprintf(stderr, _("Could not initialise unjoin context.\n"));
980 return -1;
981 }
982
983 r->in.debug = true;
984 r->in.use_kerberos = c->opt_kerberos;
985 r->in.dc_name = c->opt_host;
986 r->in.domain_name = lp_realm();
987 r->in.admin_account = c->opt_user_name;
988 r->in.admin_password = net_prompt_pass(c, c->opt_user_name);
989 r->in.modify_config = lp_config_backend_is_registry();
990
991 /* Try to delete it, but if that fails, disable it. The
992 WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE really means "disable */
993 r->in.unjoin_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
994 WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
995 r->in.delete_machine_account = true;
996 r->in.msg_ctx = c->msg_ctx;
997
998 werr = libnet_Unjoin(ctx, r);
999 if (!W_ERROR_IS_OK(werr)) {
1000 d_printf(_("Failed to leave domain: %s\n"),
1001 r->out.error_string ? r->out.error_string :
1002 get_friendly_werror_msg(werr));
1003 goto done;
1004 }
1005
1006 if (r->out.deleted_machine_account) {
1007 d_printf(_("Deleted account for '%s' in realm '%s'\n"),
1008 r->in.machine_name, r->out.dns_domain_name);
1009 goto done;
1010 }
1011
1012 /* We couldn't delete it - see if the disable succeeded. */
1013 if (r->out.disabled_machine_account) {
1014 d_printf(_("Disabled account for '%s' in realm '%s'\n"),
1015 r->in.machine_name, r->out.dns_domain_name);
1016 werr = WERR_OK;
1017 goto done;
1018 }
1019
1020 /* Based on what we requseted, we shouldn't get here, but if
1021 we did, it means the secrets were removed, and therefore
1022 we have left the domain */
1023 d_fprintf(stderr, _("Machine '%s' Left domain '%s'\n"),
1024 r->in.machine_name, r->out.dns_domain_name);
1025
1026 done:
1027 TALLOC_FREE(r);
1028 TALLOC_FREE(ctx);
1029
1030 if (W_ERROR_IS_OK(werr)) {
1031 return 0;
1032 }
1033
1034 return -1;
1035 }
1036
1037 static NTSTATUS net_ads_join_ok(struct net_context *c)
1038 {
1039 ADS_STRUCT *ads = NULL;
1040 ADS_STATUS status;
1041 fstring dc_name;
1042 struct sockaddr_storage dcip;
1043
1044 if (!secrets_init()) {
1045 DEBUG(1,("Failed to initialise secrets database\n"));
1046 return NT_STATUS_ACCESS_DENIED;
1047 }
1048
1049 net_use_krb_machine_account(c);
1050
1051 get_dc_name(lp_workgroup(), lp_realm(), dc_name, &dcip);
1052
1053 status = ads_startup(c, true, &ads);
1054 if (!ADS_ERR_OK(status)) {
1055 return ads_ntstatus(status);
1056 }
1057
1058 ads_destroy(&ads);
1059 return NT_STATUS_OK;
1060 }
1061
1062 /*
1063 check that an existing join is OK
1064 */
1065 int net_ads_testjoin(struct net_context *c, int argc, const char **argv)
1066 {
1067 NTSTATUS status;
1068 use_in_memory_ccache();
1069
1070 if (c->display_usage) {
1071 d_printf( "%s\n"
1072 "net ads testjoin\n"
1073 " %s\n",
1074 _("Usage:"),
1075 _("Test if the existing join is ok"));
1076 return 0;
1077 }
1078
1079 /* Display success or failure */
1080 status = net_ads_join_ok(c);
1081 if (!NT_STATUS_IS_OK(status)) {
1082 fprintf(stderr, _("Join to domain is not valid: %s\n"),
1083 get_friendly_nt_error_msg(status));
1084 return -1;
1085 }
1086
1087 printf(_("Join is OK\n"));
1088 return 0;
1089 }
1090
1091 /*******************************************************************
1092 Simple configu checks before beginning the join
1093 ********************************************************************/
1094
1095 static WERROR check_ads_config( void )
1096 {
1097 if (lp_server_role() != ROLE_DOMAIN_MEMBER ) {
1098 d_printf(_("Host is not configured as a member server.\n"));
1099 return WERR_INVALID_DOMAIN_ROLE;
1100 }
1101
1102 if (strlen(global_myname()) > 15) {
1103 d_printf(_("Our netbios name can be at most 15 chars long, "
1104 "\"%s\" is %u chars long\n"), global_myname(),
1105 (unsigned int)strlen(global_myname()));
1106 return WERR_INVALID_COMPUTERNAME;
1107 }
1108
1109 if ( lp_security() == SEC_ADS && !*lp_realm()) {
1110 d_fprintf(stderr, _("realm must be set in in %s for ADS "
1111 "join to succeed.\n"), get_dyn_CONFIGFILE());
1112 return WERR_INVALID_PARAM;
1113 }
1114
1115 return WERR_OK;
1116 }
1117
1118 /*******************************************************************
1119 Send a DNS update request
1120 *******************************************************************/
1121
1122 #if defined(WITH_DNS_UPDATES)
1123 #include "dns.h"
1124 DNS_ERROR DoDNSUpdate(char *pszServerName,
1125 const char *pszDomainName, const char *pszHostName,
1126 const struct sockaddr_storage *sslist,
1127 size_t num_addrs );
1128
1129 static NTSTATUS net_update_dns_internal(TALLOC_CTX *ctx, ADS_STRUCT *ads,
1130 const char *machine_name,
1131 const struct sockaddr_storage *addrs,
1132 int num_addrs)
1133 {
1134 struct dns_rr_ns *nameservers = NULL;
1135 int ns_count = 0;
1136 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
1137 DNS_ERROR dns_err;
1138 fstring dns_server;
1139 const char *dnsdomain = NULL;
1140 char *root_domain = NULL;
1141
1142 if ( (dnsdomain = strchr_m( machine_name, '.')) == NULL ) {
1143 d_printf(_("No DNS domain configured for %s. "
1144 "Unable to perform DNS Update.\n"), machine_name);
1145 status = NT_STATUS_INVALID_PARAMETER;
1146 goto done;
1147 }
1148 dnsdomain++;
1149
1150 status = ads_dns_lookup_ns( ctx, dnsdomain, &nameservers, &ns_count );
1151 if ( !NT_STATUS_IS_OK(status) || (ns_count == 0)) {
1152 /* Child domains often do not have NS records. Look
1153 for the NS record for the forest root domain
1154 (rootDomainNamingContext in therootDSE) */
1155
1156 const char *rootname_attrs[] = { "rootDomainNamingContext", NULL };
1157 LDAPMessage *msg = NULL;
1158 char *root_dn;
1159 ADS_STATUS ads_status;
1160
1161 if ( !ads->ldap.ld ) {
1162 ads_status = ads_connect( ads );
1163 if ( !ADS_ERR_OK(ads_status) ) {
1164 DEBUG(0,("net_update_dns_internal: Failed to connect to our DC!\n"));
1165 goto done;
1166 }
1167 }
1168
1169 ads_status = ads_do_search(ads, "", LDAP_SCOPE_BASE,
1170 "(objectclass=*)", rootname_attrs, &msg);
1171 if (!ADS_ERR_OK(ads_status)) {
1172 goto done;
1173 }
1174
1175 root_dn = ads_pull_string(ads, ctx, msg, "rootDomainNamingContext");
1176 if ( !root_dn ) {
1177 ads_msgfree( ads, msg );
1178 goto done;
1179 }
1180
1181 root_domain = ads_build_domain( root_dn );
1182
1183 /* cleanup */
1184 ads_msgfree( ads, msg );
1185
1186 /* try again for NS servers */
1187
1188 status = ads_dns_lookup_ns( ctx, root_domain, &nameservers, &ns_count );
1189
1190 if ( !NT_STATUS_IS_OK(status) || (ns_count == 0)) {
1191 DEBUG(3,("net_ads_join: Failed to find name server for the %s "
1192 "realm\n", ads->config.realm));
1193 goto done;
1194 }
1195
1196 dnsdomain = root_domain;
1197
1198 }
1199
1200 /* Now perform the dns update - we'll try non-secure and if we fail,
1201 we'll follow it up with a secure update */
1202
1203 fstrcpy( dns_server, nameservers[0].hostname );
1204
1205 dns_err = DoDNSUpdate(dns_server, dnsdomain, machine_name, addrs, num_addrs);
1206 if (!ERR_DNS_IS_OK(dns_err)) {
1207 d_printf(_("DNS Update for %s failed: %s\n"),
1208 machine_name, dns_errstr(dns_err));
1209 status = NT_STATUS_UNSUCCESSFUL;
1210 }
1211
1212 done:
1213
1214 SAFE_FREE( root_domain );
1215
1216 return status;
1217 }
1218
1219 static NTSTATUS net_update_dns_ext(TALLOC_CTX *mem_ctx, ADS_STRUCT *ads,
1220 const char *hostname,
1221 struct sockaddr_storage *iplist,
1222 int num_addrs)
1223 {
1224 struct sockaddr_storage *iplist_alloc = NULL;
1225 fstring machine_name;
1226 NTSTATUS status;
1227
1228 if (hostname) {
1229 fstrcpy(machine_name, hostname);
1230 } else {
1231 name_to_fqdn( machine_name, global_myname() );
1232 }
1233 strlower_m( machine_name );
1234
1235 if (num_addrs == 0 || iplist == NULL) {
1236 /*
1237 * Get our ip address
1238 * (not the 127.0.0.x address but a real ip address)
1239 */
1240 num_addrs = get_my_ip_address(&iplist_alloc);
1241 if ( num_addrs <= 0 ) {
1242 DEBUG(4, ("net_update_dns_ext: Failed to find my "
1243 "non-loopback IP addresses!\n"));
1244 return NT_STATUS_INVALID_PARAMETER;
1245 }
1246 iplist = iplist_alloc;
1247 }
1248
1249 status = net_update_dns_internal(mem_ctx, ads, machine_name,
1250 iplist, num_addrs);
1251
1252 SAFE_FREE(iplist_alloc);
1253 return status;
1254 }
1255
1256 static NTSTATUS net_update_dns(TALLOC_CTX *mem_ctx, ADS_STRUCT *ads, const char *hostname)
1257 {
1258 NTSTATUS status;
1259
1260 status = net_update_dns_ext(mem_ctx, ads, hostname, NULL, 0);
1261 return status;
1262 }
1263 #endif
1264
1265
1266 /*******************************************************************
1267 ********************************************************************/
1268
1269 static int net_ads_join_usage(struct net_context *c, int argc, const char **argv)
1270 {
1271 d_printf(_("net ads join [options]\n"
1272 "Valid options:\n"));
1273 d_printf(_(" createupn[=UPN] Set the userPrincipalName attribute during the join.\n"
1274 " The deault UPN is in the form host/netbiosname@REALM.\n"));
1275 d_printf(_(" createcomputer=OU Precreate the computer account in a specific OU.\n"
1276 " The OU string read from top to bottom without RDNs and delimited by a '/'.\n"
1277 " E.g. \"createcomputer=Computers/Servers/Unix\"\n"
1278 " NB: A backslash '\\' is used as escape at multiple levels and may\n"
1279 " need to be doubled or even quadrupled. It is not used as a separator.\n"));
1280 d_printf(_(" osName=string Set the operatingSystem attribute during the join.\n"));
1281 d_printf(_(" osVer=string Set the operatingSystemVersion attribute during the join.\n"
1282 " NB: osName and osVer must be specified together for either to take effect.\n"
1283 " Also, the operatingSystemService attribute is also set when along with\n"
1284 " the two other attributes.\n"));
1285
1286 return -1;
1287 }
1288
1289 /*******************************************************************
1290 ********************************************************************/
1291
1292 int net_ads_join(struct net_context *c, int argc, const char **argv)
1293 {
1294 TALLOC_CTX *ctx = NULL;
1295 struct libnet_JoinCtx *r = NULL;
1296 const char *domain = lp_realm();
1297 WERROR werr = WERR_SETUP_NOT_JOINED;
1298 bool createupn = false;
1299 const char *machineupn = NULL;
1300 const char *create_in_ou = NULL;
1301 int i;
1302 const char *os_name = NULL;
1303 const char *os_version = NULL;
1304 bool modify_config = lp_config_backend_is_registry();
1305
1306 if (c->display_usage)
1307 return net_ads_join_usage(c, argc, argv);
1308
1309 if (!modify_config) {
1310
1311 werr = check_ads_config();
1312 if (!W_ERROR_IS_OK(werr)) {
1313 d_fprintf(stderr, _("Invalid configuration. Exiting....\n"));
1314 goto fail;
1315 }
1316 }
1317
1318 if (!(ctx = talloc_init("net_ads_join"))) {
1319 d_fprintf(stderr, _("Could not initialise talloc context.\n"));
1320 werr = WERR_NOMEM;
1321 goto fail;
1322 }
1323
1324 if (!c->opt_kerberos) {
1325 use_in_memory_ccache();
1326 }
1327
1328 werr = libnet_init_JoinCtx(ctx, &r);
1329 if (!W_ERROR_IS_OK(werr)) {
1330 goto fail;
1331 }
1332
1333 /* process additional command line args */
1334
1335 for ( i=0; i<argc; i++ ) {
1336 if ( !StrnCaseCmp(argv[i], "createupn", strlen("createupn")) ) {
1337 createupn = true;
1338 machineupn = get_string_param(argv[i]);
1339 }
1340 else if ( !StrnCaseCmp(argv[i], "createcomputer", strlen("createcomputer")) ) {
1341 if ( (create_in_ou = get_string_param(argv[i])) == NULL ) {
1342 d_fprintf(stderr, _("Please supply a valid OU path.\n"));
1343 werr = WERR_INVALID_PARAM;
1344 goto fail;
1345 }
1346 }
1347 else if ( !StrnCaseCmp(argv[i], "osName", strlen("osName")) ) {
1348 if ( (os_name = get_string_param(argv[i])) == NULL ) {
1349 d_fprintf(stderr, _("Please supply a operating system name.\n"));
1350 werr = WERR_INVALID_PARAM;
1351 goto fail;
1352 }
1353 }
1354 else if ( !StrnCaseCmp(argv[i], "osVer", strlen("osVer")) ) {
1355 if ( (os_version = get_string_param(argv[i])) == NULL ) {
1356 d_fprintf(stderr, _("Please supply a valid operating system version.\n"));
1357 werr = WERR_INVALID_PARAM;
1358 goto fail;
1359 }
1360 }
1361 else {
1362 domain = argv[i];
1363 }
1364 }
1365
1366 if (!*domain) {
1367 d_fprintf(stderr, _("Please supply a valid domain name\n"));
1368 werr = WERR_INVALID_PARAM;
1369 goto fail;
1370 }
1371
1372 if (!c->msg_ctx) {
1373 d_fprintf(stderr, _("Could not initialise message context. "
1374 "Try running as root\n"));
1375 werr = WERR_ACCESS_DENIED;
1376 goto fail;
1377 }
1378
1379 /* Do the domain join here */
1380
1381 r->in.domain_name = domain;
1382 r->in.create_upn = createupn;
1383 r->in.upn = machineupn;
1384 r->in.account_ou = create_in_ou;
1385 r->in.os_name = os_name;
1386 r->in.os_version = os_version;
1387 r->in.dc_name = c->opt_host;
1388 r->in.admin_account = c->opt_user_name;
1389 r->in.admin_password = net_prompt_pass(c, c->opt_user_name);
1390 r->in.debug = true;
1391 r->in.use_kerberos = c->opt_kerberos;
1392 r->in.modify_config = modify_config;
1393 r->in.join_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
1394 WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE |
1395 WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED;
1396 r->in.msg_ctx = c->msg_ctx;
1397
1398 werr = libnet_Join(ctx, r);
1399 if (!W_ERROR_IS_OK(werr)) {
1400 goto fail;
1401 }
1402
1403 /* Check the short name of the domain */
1404
1405 if (!modify_config && !strequal(lp_workgroup(), r->out.netbios_domain_name)) {
1406 d_printf(_("The workgroup in %s does not match the short\n"
1407 "domain name obtained from the server.\n"
1408 "Using the name [%s] from the server.\n"
1409 "You should set \"workgroup = %s\" in %s.\n"),
1410 get_dyn_CONFIGFILE(), r->out.netbios_domain_name,
1411 r->out.netbios_domain_name, get_dyn_CONFIGFILE());
1412 }
1413
1414 d_printf(_("Using short domain name -- %s\n"), r->out.netbios_domain_name);
1415
1416 if (r->out.dns_domain_name) {
1417 d_printf(_("Joined '%s' to realm '%s'\n"), r->in.machine_name,
1418 r->out.dns_domain_name);
1419 } else {
1420 d_printf(_("Joined '%s' to domain '%s'\n"), r->in.machine_name,
1421 r->out.netbios_domain_name);
1422 }
1423
1424 #if defined(WITH_DNS_UPDATES)
1425 /*
1426 * In a clustered environment, don't do dynamic dns updates:
1427 * Registering the set of ip addresses that are assigned to
1428 * the interfaces of the node that performs the join does usually
1429 * not have the desired effect, since the local interfaces do not
1430 * carry the complete set of the cluster's public IP addresses.
1431 * And it can also contain internal addresses that should not
1432 * be visible to the outside at all.
1433 * In order to do dns updates in a clustererd setup, use
1434 * net ads dns register.
1435 */
1436 if (lp_clustering()) {
1437 d_fprintf(stderr, _("Not doing automatic DNS update in a"
1438 "clustered setup.\n"));
1439 goto done;
1440 }
1441
1442 if (r->out.domain_is_ad) {
1443 /* We enter this block with user creds */
1444 ADS_STRUCT *ads_dns = NULL;
1445
1446 if ( (ads_dns = ads_init( lp_realm(), NULL, NULL )) != NULL ) {
1447 /* kinit with the machine password */
1448
1449 use_in_memory_ccache();
1450 if (asprintf( &ads_dns->auth.user_name, "%s$", global_myname()) == -1) {
1451 goto fail;
1452 }
1453 ads_dns->auth.password = secrets_fetch_machine_password(
1454 r->out.netbios_domain_name, NULL, NULL );
1455 ads_dns->auth.realm = SMB_STRDUP( r->out.dns_domain_name );
1456 strupper_m(ads_dns->auth.realm );
1457 ads_kinit_password( ads_dns );
1458 }
1459
1460 if ( !ads_dns || !NT_STATUS_IS_OK(net_update_dns( ctx, ads_dns, NULL)) ) {
1461 d_fprintf( stderr, _("DNS update failed!\n") );
1462 }
1463
1464 /* exit from this block using machine creds */
1465 ads_destroy(&ads_dns);
1466 }
1467 #endif
1468
1469 done:
1470 TALLOC_FREE(r);
1471 TALLOC_FREE( ctx );
1472
1473 return 0;
1474
1475 fail:
1476 /* issue an overall failure message at the end. */
1477 d_printf(_("Failed to join domain: %s\n"),
1478 r && r->out.error_string ? r->out.error_string :
1479 get_friendly_werror_msg(werr));
1480 TALLOC_FREE( ctx );
1481
1482 return -1;
1483 }
1484
1485 /*******************************************************************
1486 ********************************************************************/
1487
1488 static int net_ads_dns_register(struct net_context *c, int argc, const char **argv)
1489 {
1490 #if defined(WITH_DNS_UPDATES)
1491 ADS_STRUCT *ads;
1492 ADS_STATUS status;
1493 NTSTATUS ntstatus;
1494 TALLOC_CTX *ctx;
1495 const char *hostname = NULL;
1496 const char **addrs_list = NULL;
1497 struct sockaddr_storage *addrs = NULL;
1498 int num_addrs = 0;
1499 int count;
1500
1501 #ifdef DEVELOPER
1502 talloc_enable_leak_report();
1503 #endif
1504
1505 if (argc <= 1 && lp_clustering() && lp_cluster_addresses() == NULL) {
1506 d_fprintf(stderr, _("Refusing DNS updates with automatic "
1507 "detection of addresses in a clustered "
1508 "setup.\n"));
1509 c->display_usage = true;
1510 }
1511
1512 if (c->display_usage) {
1513 d_printf( "%s\n"
1514 "net ads dns register [hostname [IP [IP...]]]\n"
1515 " %s\n",
1516 _("Usage:"),
1517 _("Register hostname with DNS\n"));
1518 return -1;
1519 }
1520
1521 if (!(ctx = talloc_init("net_ads_dns"))) {
1522 d_fprintf(stderr, _("Could not initialise talloc context\n"));
1523 return -1;
1524 }
1525
1526 if (argc >= 1) {
1527 hostname = argv[0];
1528 }
1529
1530 if (argc > 1) {
1531 num_addrs = argc - 1;
1532 addrs_list = &argv[1];
1533 } else if (lp_clustering()) {
1534 addrs_list = lp_cluster_addresses();
1535 num_addrs = str_list_length(addrs_list);
1536 }
1537
1538 if (num_addrs > 0) {
1539 addrs = talloc_zero_array(ctx, struct sockaddr_storage, num_addrs);
1540 if (addrs == NULL) {
1541 d_fprintf(stderr, _("Error allocating memory!\n"));
1542 talloc_free(ctx);
1543 return -1;
1544 }
1545 }
1546
1547 for (count = 0; count < num_addrs; count++) {
1548 if (!interpret_string_addr(&addrs[count], addrs_list[count], 0)) {
1549 d_fprintf(stderr, "%s '%s'.\n",
1550 _("Cannot interpret address"),
1551 addrs_list[count]);
1552 talloc_free(ctx);
1553 return -1;
1554 }
1555 }
1556
1557 status = ads_startup(c, true, &ads);
1558 if ( !ADS_ERR_OK(status) ) {
1559 DEBUG(1, ("error on ads_startup: %s\n", ads_errstr(status)));
1560 TALLOC_FREE(ctx);
1561 return -1;
1562 }
1563
1564 ntstatus = net_update_dns_ext(ctx, ads, hostname, addrs, num_addrs);
1565 if (!NT_STATUS_IS_OK(ntstatus)) {
1566 d_fprintf( stderr, _("DNS update failed!\n") );
1567 ads_destroy( &ads );
1568 TALLOC_FREE( ctx );
1569 return -1;
1570 }
1571
1572 d_fprintf( stderr, _("Successfully registered hostname with DNS\n") );
1573
1574 ads_destroy(&ads);
1575 TALLOC_FREE( ctx );
1576
1577 return 0;
1578 #else
1579 d_fprintf(stderr,
1580 _("DNS update support not enabled at compile time!\n"));
1581 return -1;
1582 #endif
1583 }
1584
1585 #if defined(WITH_DNS_UPDATES)
1586 DNS_ERROR do_gethostbyname(const char *server, const char *host);
1587 #endif
1588
1589 static int net_ads_dns_gethostbyname(struct net_context *c, int argc, const char **argv)
1590 {
1591 #if defined(WITH_DNS_UPDATES)
1592 DNS_ERROR err;
1593
1594 #ifdef DEVELOPER
1595 talloc_enable_leak_report();
1596 #endif
1597
1598 if (argc != 2 || c->display_usage) {
1599 d_printf( "%s\n"
1600 " %s\n"
1601 " %s\n",
1602 _("Usage:"),
1603 _("net ads dns gethostbyname <server> <name>\n"),
1604 _(" Look up hostname from the AD\n"
1605 " server\tName server to use\n"
1606 " name\tName to look up\n"));
1607 return -1;
1608 }
1609
1610 err = do_gethostbyname(argv[0], argv[1]);
1611
1612 d_printf(_("do_gethostbyname returned %s (%d)\n"),
1613 dns_errstr(err), ERROR_DNS_V(err));
1614 #endif
1615 return 0;
1616 }
1617
1618 static int net_ads_dns(struct net_context *c, int argc, const char *argv[])
1619 {
1620 struct functable func[] = {
1621 {
1622 "register",
1623 net_ads_dns_register,
1624 NET_TRANSPORT_ADS,
1625 N_("Add host dns entry to AD"),
1626 N_("net ads dns register\n"
1627 " Add host dns entry to AD")
1628 },
1629 {
1630 "gethostbyname",
1631 net_ads_dns_gethostbyname,
1632 NET_TRANSPORT_ADS,
1633 N_("Look up host"),
1634 N_("net ads dns gethostbyname\n"
1635 " Look up host")
1636 },
1637 {NULL, NULL, 0, NULL, NULL}
1638 };
1639
1640 return net_run_function(c, argc, argv, "net ads dns", func);
1641 }
1642
1643 /*******************************************************************
1644 ********************************************************************/
1645
1646 int net_ads_printer_usage(struct net_context *c, int argc, const char **argv)
1647 {
1648 d_printf(_(
1649 "\nnet ads printer search <printer>"
1650 "\n\tsearch for a printer in the directory\n"
1651 "\nnet ads printer info <printer> <server>"
1652 "\n\tlookup info in directory for printer on server"
1653 "\n\t(note: printer defaults to \"*\", server defaults to local)\n"
1654 "\nnet ads printer publish <printername>"
1655 "\n\tpublish printer in directory"
1656 "\n\t(note: printer name is required)\n"
1657 "\nnet ads printer remove <printername>"
1658 "\n\tremove printer from directory"
1659 "\n\t(note: printer name is required)\n"));
1660 return -1;
1661 }
1662
1663 /*******************************************************************
1664 ********************************************************************/
1665
1666 static int net_ads_printer_search(struct net_context *c, int argc, const char **argv)
1667 {
1668 ADS_STRUCT *ads;
1669 ADS_STATUS rc;
1670 LDAPMessage *res = NULL;
1671
1672 if (c->display_usage) {
1673 d_printf( "%s\n"
1674 "net ads printer search\n"
1675 " %s\n",
1676 _("Usage:"),
1677 _("List printers in the AD"));
1678 return 0;
1679 }
1680
1681 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
1682 return -1;
1683 }
1684
1685 rc = ads_find_printers(ads, &res);
1686
1687 if (!ADS_ERR_OK(rc)) {
1688 d_fprintf(stderr, _("ads_find_printer: %s\n"), ads_errstr(rc));
1689 ads_msgfree(ads, res);
1690 ads_destroy(&ads);
1691 return -1;
1692 }
1693
1694 if (ads_count_replies(ads, res) == 0) {
1695 d_fprintf(stderr, _("No results found\n"));
1696 ads_msgfree(ads, res);
1697 ads_destroy(&ads);
1698 return -1;
1699 }
1700
1701 ads_dump(ads, res);
1702 ads_msgfree(ads, res);
1703 ads_destroy(&ads);
1704 return 0;
1705 }
1706
1707 static int net_ads_printer_info(struct net_context *c, int argc, const char **argv)
1708 {
1709 ADS_STRUCT *ads;
1710 ADS_STATUS rc;
1711 const char *servername, *printername;
1712 LDAPMessage *res = NULL;
1713
1714 if (c->display_usage) {
1715 d_printf("%s\n%s",
1716 _("Usage:"),
1717 _("net ads printer info [printername [servername]]\n"
1718 " Display printer info from AD\n"
1719 " printername\tPrinter name or wildcard\n"
1720 " servername\tName of the print server\n"));
1721 return 0;
1722 }
1723
1724 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
1725 return -1;
1726 }
1727
1728 if (argc > 0) {
1729 printername = argv[0];
1730 } else {
1731 printername = "*";
1732 }
1733
1734 if (argc > 1) {
1735 servername = argv[1];
1736 } else {
1737 servername = global_myname();
1738 }
1739
1740 rc = ads_find_printer_on_server(ads, &res, printername, servername);
1741
1742 if (!ADS_ERR_OK(rc)) {
1743 d_fprintf(stderr, _("Server '%s' not found: %s\n"),
1744 servername, ads_errstr(rc));
1745 ads_msgfree(ads, res);
1746 ads_destroy(&ads);
1747 return -1;
1748 }
1749
1750 if (ads_count_replies(ads, res) == 0) {
1751 d_fprintf(stderr, _("Printer '%s' not found\n"), printername);
1752 ads_msgfree(ads, res);
1753 ads_destroy(&ads);
1754 return -1;
1755 }
1756
1757 ads_dump(ads, res);
1758 ads_msgfree(ads, res);
1759 ads_destroy(&ads);
1760
1761 return 0;
1762 }
1763
1764 static int net_ads_printer_publish(struct net_context *c, int argc, const char **argv)
1765 {
1766 ADS_STRUCT *ads;
1767 ADS_STATUS rc;
1768 const char *servername, *printername;
1769 struct cli_state *cli = NULL;
1770 struct rpc_pipe_client *pipe_hnd = NULL;
1771 struct sockaddr_storage server_ss;
1772 NTSTATUS nt_status;
1773 TALLOC_CTX *mem_ctx = talloc_init("net_ads_printer_publish");
1774 ADS_MODLIST mods = ads_init_mods(mem_ctx);
1775 char *prt_dn, *srv_dn, **srv_cn;
1776 char *srv_cn_escaped = NULL, *printername_escaped = NULL;
1777 LDAPMessage *res = NULL;
1778
1779 if (argc < 1 || c->display_usage) {
1780 d_printf("%s\n%s",
1781 _("Usage:"),
1782 _("net ads printer publish <printername> [servername]\n"
1783 " Publish printer in AD\n"
1784 " printername\tName of the printer\n"
1785 " servername\tName of the print server\n"));
1786 talloc_destroy(mem_ctx);
1787 return -1;
1788 }
1789
1790 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
1791 talloc_destroy(mem_ctx);
1792 return -1;
1793 }
1794
1795 printername = argv[0];
1796
1797 if (argc == 2) {
1798 servername = argv[1];
1799 } else {
1800 servername = global_myname();
1801 }
1802
1803 /* Get printer data from SPOOLSS */
1804
1805 resolve_name(servername, &server_ss, 0x20, false);
1806
1807 nt_status = cli_full_connection(&cli, global_myname(), servername,
1808 &server_ss, 0,
1809 "IPC$", "IPC",
1810 c->opt_user_name, c->opt_workgroup,
1811 c->opt_password ? c->opt_password : "",
1812 CLI_FULL_CONNECTION_USE_KERBEROS,
1813 Undefined, NULL);
1814
1815 if (NT_STATUS_IS_ERR(nt_status)) {
1816 d_fprintf(stderr, _("Unable to open a connnection to %s to "
1817 "obtain data for %s\n"),
1818 servername, printername);
1819 ads_destroy(&ads);
1820 talloc_destroy(mem_ctx);
1821 return -1;
1822 }
1823
1824 /* Publish on AD server */
1825
1826 ads_find_machine_acct(ads, &res, servername);
1827
1828 if (ads_count_replies(ads, res) == 0) {
1829 d_fprintf(stderr, _("Could not find machine account for server "
1830 "%s\n"),
1831 servername);
1832 ads_destroy(&ads);
1833 talloc_destroy(mem_ctx);
1834 return -1;
1835 }
1836
1837 srv_dn = ldap_get_dn((LDAP *)ads->ldap.ld, (LDAPMessage *)res);
1838 srv_cn = ldap_explode_dn(srv_dn, 1);
1839
1840 srv_cn_escaped = escape_rdn_val_string_alloc(srv_cn[0]);
1841 printername_escaped = escape_rdn_val_string_alloc(printername);
1842 if (!srv_cn_escaped || !printername_escaped) {
1843 SAFE_FREE(srv_cn_escaped);
1844 SAFE_FREE(printername_escaped);
1845 d_fprintf(stderr, _("Internal error, out of memory!"));
1846 ads_destroy(&ads);
1847 talloc_destroy(mem_ctx);
1848 return -1;
1849 }
1850
1851 if (asprintf(&prt_dn, "cn=%s-%s,%s", srv_cn_escaped, printername_escaped, srv_dn) == -1) {
1852 SAFE_FREE(srv_cn_escaped);
1853 SAFE_FREE(printername_escaped);
1854 d_fprintf(stderr, _("Internal error, out of memory!"));
1855 ads_destroy(&ads);
1856 talloc_destroy(mem_ctx);
1857 return -1;
1858 }
1859
1860 SAFE_FREE(srv_cn_escaped);
1861 SAFE_FREE(printername_escaped);
1862
1863 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_spoolss.syntax_id, &pipe_hnd);
1864 if (!NT_STATUS_IS_OK(nt_status)) {
1865 d_fprintf(stderr, _("Unable to open a connnection to the spoolss pipe on %s\n"),
1866 servername);
1867 SAFE_FREE(prt_dn);
1868 ads_destroy(&ads);
1869 talloc_destroy(mem_ctx);
1870 return -1;
1871 }
1872
1873 if (!W_ERROR_IS_OK(get_remote_printer_publishing_data(pipe_hnd, mem_ctx, &mods,
1874 printername))) {
1875 SAFE_FREE(prt_dn);
1876 ads_destroy(&ads);
1877 talloc_destroy(mem_ctx);
1878 return -1;
1879 }
1880
1881 rc = ads_add_printer_entry(ads, prt_dn, mem_ctx, &mods);
1882 if (!ADS_ERR_OK(rc)) {
1883 d_fprintf(stderr, "ads_publish_printer: %s\n", ads_errstr(rc));
1884 SAFE_FREE(prt_dn);
1885 ads_destroy(&ads);
1886 talloc_destroy(mem_ctx);
1887 return -1;
1888 }
1889
1890 d_printf("published printer\n");
1891 SAFE_FREE(prt_dn);
1892 ads_destroy(&ads);
1893 talloc_destroy(mem_ctx);
1894
1895 return 0;
1896 }
1897
1898 static int net_ads_printer_remove(struct net_context *c, int argc, const char **argv)
1899 {
1900 ADS_STRUCT *ads;
1901 ADS_STATUS rc;
1902 const char *servername;
1903 char *prt_dn;
1904 LDAPMessage *res = NULL;
1905
1906 if (argc < 1 || c->display_usage) {
1907 d_printf("%s\n%s",
1908 _("Usage:"),
1909 _("net ads printer remove <printername> [servername]\n"
1910 " Remove a printer from the AD\n"
1911 " printername\tName of the printer\n"
1912 " servername\tName of the print server\n"));
1913 return -1;
1914 }
1915
1916 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
1917 return -1;
1918 }
1919
1920 if (argc > 1) {
1921 servername = argv[1];
1922 } else {
1923 servername = global_myname();
1924 }
1925
1926 rc = ads_find_printer_on_server(ads, &res, argv[0], servername);
1927
1928 if (!ADS_ERR_OK(rc)) {
1929 d_fprintf(stderr, _("ads_find_printer_on_server: %s\n"), ads_errstr(rc));
1930 ads_msgfree(ads, res);
1931 ads_destroy(&ads);
1932 return -1;
1933 }
1934
1935 if (ads_count_replies(ads, res) == 0) {
1936 d_fprintf(stderr, _("Printer '%s' not found\n"), argv[1]);
1937 ads_msgfree(ads, res);
1938 ads_destroy(&ads);
1939 return -1;
1940 }
1941
1942 prt_dn = ads_get_dn(ads, talloc_tos(), res);
1943 ads_msgfree(ads, res);
1944 rc = ads_del_dn(ads, prt_dn);
1945 TALLOC_FREE(prt_dn);
1946
1947 if (!ADS_ERR_OK(rc)) {
1948 d_fprintf(stderr, _("ads_del_dn: %s\n"), ads_errstr(rc));
1949 ads_destroy(&ads);
1950 return -1;
1951 }
1952
1953 ads_destroy(&ads);
1954 return 0;
1955 }
1956
1957 static int net_ads_printer(struct net_context *c, int argc, const char **argv)
1958 {
1959 struct functable func[] = {
1960 {
1961 "search",
1962 net_ads_printer_search,
1963 NET_TRANSPORT_ADS,
1964 N_("Search for a printer"),
1965 N_("net ads printer search\n"
1966 " Search for a printer")
1967 },
1968 {
1969 "info",
1970 net_ads_printer_info,
1971 NET_TRANSPORT_ADS,
1972 N_("Display printer information"),
1973 N_("net ads printer info\n"
1974 " Display printer information")
1975 },
1976 {
1977 "publish",
1978 net_ads_printer_publish,
1979 NET_TRANSPORT_ADS,
1980 N_("Publish a printer"),
1981 N_("net ads printer publish\n"
1982 " Publish a printer")
1983 },
1984 {
1985 "remove",
1986 net_ads_printer_remove,
1987 NET_TRANSPORT_ADS,
1988 N_("Delete a printer"),
1989 N_("net ads printer remove\n"
1990 " Delete a printer")
1991 },
1992 {NULL, NULL, 0, NULL, NULL}
1993 };
1994
1995 return net_run_function(c, argc, argv, "net ads printer", func);
1996 }
1997
1998
1999 static int net_ads_password(struct net_context *c, int argc, const char **argv)
2000 {
2001 ADS_STRUCT *ads;
2002 const char *auth_principal = c->opt_user_name;
2003 const char *auth_password = c->opt_password;
2004 char *realm = NULL;
2005 char *new_password = NULL;
2006 char *chr, *prompt;
2007 const char *user;
2008 ADS_STATUS ret;
2009
2010 if (c->display_usage) {
2011 d_printf("%s\n%s",
2012 _("Usage:"),
2013 _("net ads password <username>\n"
2014 " Change password for user\n"
2015 " username\tName of user to change password for\n"));
2016 return 0;
2017 }
2018
2019 if (c->opt_user_name == NULL || c->opt_password == NULL) {
2020 d_fprintf(stderr, _("You must supply an administrator "
2021 "username/password\n"));
2022 return -1;
2023 }
2024
2025 if (argc < 1) {
2026 d_fprintf(stderr, _("ERROR: You must say which username to "
2027 "change password for\n"));
2028 return -1;
2029 }
2030
2031 user = argv[0];
2032 if (!strchr_m(user, '@')) {
2033 if (asprintf(&chr, "%s@%s", argv[0], lp_realm()) == -1) {
2034 return -1;
2035 }
2036 user = chr;
2037 }
2038
2039 use_in_memory_ccache();
2040 chr = strchr_m(auth_principal, '@');
2041 if (chr) {
2042 realm = ++chr;
2043 } else {
2044 realm = lp_realm();
2045 }
2046
2047 /* use the realm so we can eventually change passwords for users
2048 in realms other than default */
2049 if (!(ads = ads_init(realm, c->opt_workgroup, c->opt_host))) {
2050 return -1;
2051 }
2052
2053 /* we don't actually need a full connect, but it's the easy way to
2054 fill in the KDC's addresss */
2055 ads_connect(ads);
2056
2057 if (!ads->config.realm) {
2058 d_fprintf(stderr, _("Didn't find the kerberos server!\n"));
2059 ads_destroy(&ads);
2060 return -1;
2061 }
2062
2063 if (argv[1]) {
2064 new_password = (char *)argv[1];
2065 } else {
2066 if (asprintf(&prompt, _("Enter new password for %s:"), user) == -1) {
2067 return -1;
2068 }
2069 new_password = getpass(prompt);
2070 free(prompt);
2071 }
2072
2073 ret = kerberos_set_password(ads->auth.kdc_server, auth_principal,
2074 auth_password, user, new_password, ads->auth.time_offset);
2075 if (!ADS_ERR_OK(ret)) {
2076 d_fprintf(stderr, _("Password change failed: %s\n"), ads_errstr(ret));
2077 ads_destroy(&ads);
2078 return -1;
2079 }
2080
2081 d_printf(_("Password change for %s completed.\n"), user);
2082 ads_destroy(&ads);
2083
2084 return 0;
2085 }
2086
2087 int net_ads_changetrustpw(struct net_context *c, int argc, const char **argv)
2088 {
2089 ADS_STRUCT *ads;
2090 char *host_principal;
2091 fstring my_name;
2092 ADS_STATUS ret;
2093
2094 if (c->display_usage) {
2095 d_printf( "%s\n"
2096 "net ads changetrustpw\n"
2097 " %s\n",
2098 _("Usage:"),
2099 _("Change the machine account's trust password"));
2100 return 0;
2101 }
2102
2103 if (!secrets_init()) {
2104 DEBUG(1,("Failed to initialise secrets database\n"));
2105 return -1;
2106 }
2107
2108 net_use_krb_machine_account(c);
2109
2110 use_in_memory_ccache();
2111
2112 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2113 return -1;
2114 }
2115
2116 fstrcpy(my_name, global_myname());
2117 strlower_m(my_name);
2118 if (asprintf(&host_principal, "%s$@%s", my_name, ads->config.realm) == -1) {
2119 ads_destroy(&ads);
2120 return -1;
2121 }
2122 d_printf(_("Changing password for principal: %s\n"), host_principal);
2123
2124 ret = ads_change_trust_account_password(ads, host_principal);
2125
2126 if (!ADS_ERR_OK(ret)) {
2127 d_fprintf(stderr, _("Password change failed: %s\n"), ads_errstr(ret));
2128 ads_destroy(&ads);
2129 SAFE_FREE(host_principal);
2130 return -1;
2131 }
2132
2133 d_printf(_("Password change for principal %s succeeded.\n"), host_principal);
2134
2135 if (USE_SYSTEM_KEYTAB) {
2136 d_printf(_("Attempting to update system keytab with new password.\n"));
2137 if (ads_keytab_create_default(ads)) {
2138 d_printf(_("Failed to update system keytab.\n"));
2139 }
2140 }
2141
2142 ads_destroy(&ads);
2143 SAFE_FREE(host_principal);
2144
2145 return 0;
2146 }
2147
2148 /*
2149 help for net ads search
2150 */
2151 static int net_ads_search_usage(struct net_context *c, int argc, const char **argv)
2152 {
2153 d_printf(_(
2154 "\nnet ads search <expression> <attributes...>\n"
2155 "\nPerform a raw LDAP search on a ADS server and dump the results.\n"
2156 "The expression is a standard LDAP search expression, and the\n"
2157 "attributes are a list of LDAP fields to show in the results.\n\n"
2158 "Example: net ads search '(objectCategory=group)' sAMAccountName\n\n"
2159 ));
2160 net_common_flags_usage(c, argc, argv);
2161 return -1;
2162 }
2163
2164
2165 /*
2166 general ADS search function. Useful in diagnosing problems in ADS
2167 */
2168 static int net_ads_search(struct net_context *c, int argc, const char **argv)
2169 {
2170 ADS_STRUCT *ads;
2171 ADS_STATUS rc;
2172 const char *ldap_exp;
2173 const char **attrs;
2174 LDAPMessage *res = NULL;
2175
2176 if (argc < 1 || c->display_usage) {
2177 return net_ads_search_usage(c, argc, argv);
2178 }
2179
2180 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2181 return -1;
2182 }
2183
2184 ldap_exp = argv[0];
2185 attrs = (argv + 1);
2186
2187 rc = ads_do_search_all(ads, ads->config.bind_path,
2188 LDAP_SCOPE_SUBTREE,
2189 ldap_exp, attrs, &res);
2190 if (!ADS_ERR_OK(rc)) {
2191 d_fprintf(stderr, _("search failed: %s\n"), ads_errstr(rc));
2192 ads_destroy(&ads);
2193 return -1;
2194 }
2195
2196 d_printf(_("Got %d replies\n\n"), ads_count_replies(ads, res));
2197
2198 /* dump the results */
2199 ads_dump(ads, res);
2200
2201 ads_msgfree(ads, res);
2202 ads_destroy(&ads);
2203
2204 return 0;
2205 }
2206
2207
2208 /*
2209 help for net ads search
2210 */
2211 static int net_ads_dn_usage(struct net_context *c, int argc, const char **argv)
2212 {
2213 d_printf(_(
2214 "\nnet ads dn <dn> <attributes...>\n"
2215 "\nperform a raw LDAP search on a ADS server and dump the results\n"
2216 "The DN standard LDAP DN, and the attributes are a list of LDAP fields \n"
2217 "to show in the results\n\n"
2218 "Example: net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' sAMAccountName\n\n"
2219 "Note: the DN must be provided properly escaped. See RFC 4514 for details\n\n"
2220 ));
2221 net_common_flags_usage(c, argc, argv);
2222 return -1;
2223 }
2224
2225
2226 /*
2227 general ADS search function. Useful in diagnosing problems in ADS
2228 */
2229 static int net_ads_dn(struct net_context *c, int argc, const char **argv)
2230 {
2231 ADS_STRUCT *ads;
2232 ADS_STATUS rc;
2233 const char *dn;
2234 const char **attrs;
2235 LDAPMessage *res = NULL;
2236
2237 if (argc < 1 || c->display_usage) {
2238 return net_ads_dn_usage(c, argc, argv);
2239 }
2240
2241 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2242 return -1;
2243 }
2244
2245 dn = argv[0];
2246 attrs = (argv + 1);
2247
2248 rc = ads_do_search_all(ads, dn,
2249 LDAP_SCOPE_BASE,
2250 "(objectclass=*)", attrs, &res);
2251 if (!ADS_ERR_OK(rc)) {
2252 d_fprintf(stderr, _("search failed: %s\n"), ads_errstr(rc));
2253 ads_destroy(&ads);
2254 return -1;
2255 }
2256
2257 d_printf("Got %d replies\n\n", ads_count_replies(ads, res));
2258
2259 /* dump the results */
2260 ads_dump(ads, res);
2261
2262 ads_msgfree(ads, res);
2263 ads_destroy(&ads);
2264
2265 return 0;
2266 }
2267
2268 /*
2269 help for net ads sid search
2270 */
2271 static int net_ads_sid_usage(struct net_context *c, int argc, const char **argv)
2272 {
2273 d_printf(_(
2274 "\nnet ads sid <sid> <attributes...>\n"
2275 "\nperform a raw LDAP search on a ADS server and dump the results\n"
2276 "The SID is in string format, and the attributes are a list of LDAP fields \n"
2277 "to show in the results\n\n"
2278 "Example: net ads sid 'S-1-5-32' distinguishedName\n\n"
2279 ));
2280 net_common_flags_usage(c, argc, argv);
2281 return -1;
2282 }
2283
2284
2285 /*
2286 general ADS search function. Useful in diagnosing problems in ADS
2287 */
2288 static int net_ads_sid(struct net_context *c, int argc, const char **argv)
2289 {
2290 ADS_STRUCT *ads;
2291 ADS_STATUS rc;
2292 const char *sid_string;
2293 const char **attrs;
2294 LDAPMessage *res = NULL;
2295 struct dom_sid sid;
2296
2297 if (argc < 1 || c->display_usage) {
2298 return net_ads_sid_usage(c, argc, argv);
2299 }
2300
2301 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2302 return -1;
2303 }
2304
2305 sid_string = argv[0];
2306 attrs = (argv + 1);
2307
2308 if (!string_to_sid(&sid, sid_string)) {
2309 d_fprintf(stderr, _("could not convert sid\n"));
2310 ads_destroy(&ads);
2311 return -1;
2312 }
2313
2314 rc = ads_search_retry_sid(ads, &res, &sid, attrs);
2315 if (!ADS_ERR_OK(rc)) {
2316 d_fprintf(stderr, _("search failed: %s\n"), ads_errstr(rc));
2317 ads_destroy(&ads);
2318 return -1;
2319 }
2320
2321 d_printf(_("Got %d replies\n\n"), ads_count_replies(ads, res));
2322
2323 /* dump the results */
2324 ads_dump(ads, res);
2325
2326 ads_msgfree(ads, res);
2327 ads_destroy(&ads);
2328
2329 return 0;
2330 }
2331
2332 static int net_ads_keytab_flush(struct net_context *c, int argc, const char **argv)
2333 {
2334 int ret;
2335 ADS_STRUCT *ads;
2336
2337 if (c->display_usage) {
2338 d_printf( "%s\n"
2339 "net ads keytab flush\n"
2340 " %s\n",
2341 _("Usage:"),
2342 _("Delete the whole keytab"));
2343 return 0;
2344 }
2345
2346 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2347 return -1;
2348 }
2349 ret = ads_keytab_flush(ads);
2350 ads_destroy(&ads);
2351 return ret;
2352 }
2353
2354 static int net_ads_keytab_add(struct net_context *c, int argc, const char **argv)
2355 {
2356 int i;
2357 int ret = 0;
2358 ADS_STRUCT *ads;
2359
2360 if (c->display_usage) {
2361 d_printf("%s\n%s",
2362 _("Usage:"),
2363 _("net ads keytab add <principal> [principal ...]\n"
2364 " Add principals to local keytab\n"
2365 " principal\tKerberos principal to add to "
2366 "keytab\n"));
2367 return 0;
2368 }
2369
2370 d_printf(_("Processing principals to add...\n"));
2371 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2372 return -1;
2373 }
2374 for (i = 0; i < argc; i++) {
2375 ret |= ads_keytab_add_entry(ads, argv[i]);
2376 }
2377 ads_destroy(&ads);
2378 return ret;
2379 }
2380
2381 static int net_ads_keytab_create(struct net_context *c, int argc, const char **argv)
2382 {
2383 ADS_STRUCT *ads;
2384 int ret;
2385
2386 if (c->display_usage) {
2387 d_printf( "%s\n"
2388 "net ads keytab create\n"
2389 " %s\n",
2390 _("Usage:"),
2391 _("Create new default keytab"));
2392 return 0;
2393 }
2394
2395 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2396 return -1;
2397 }
2398 ret = ads_keytab_create_default(ads);
2399 ads_destroy(&ads);
2400 return ret;
2401 }
2402
2403 static int net_ads_keytab_list(struct net_context *c, int argc, const char **argv)
2404 {
2405 const char *keytab = NULL;
2406
2407 if (c->display_usage) {
2408 d_printf("%s\n%s",
2409 _("Usage:"),
2410 _("net ads keytab list [keytab]\n"
2411 " List a local keytab\n"
2412 " keytab\tKeytab to list\n"));
2413 return 0;
2414 }
2415
2416 if (argc >= 1) {
2417 keytab = argv[0];
2418 }
2419
2420 return ads_keytab_list(keytab);
2421 }
2422
2423
2424 int net_ads_keytab(struct net_context *c, int argc, const char **argv)
2425 {
2426 struct functable func[] = {
2427 {
2428 "add",
2429 net_ads_keytab_add,
2430 NET_TRANSPORT_ADS,
2431 N_("Add a service principal"),
2432 N_("net ads keytab add\n"
2433 " Add a service principal")
2434 },
2435 {
2436 "create",
2437 net_ads_keytab_create,
2438 NET_TRANSPORT_ADS,
2439 N_("Create a fresh keytab"),
2440 N_("net ads keytab create\n"
2441 " Create a fresh keytab")
2442 },
2443 {
2444 "flush",
2445 net_ads_keytab_flush,
2446 NET_TRANSPORT_ADS,
2447 N_("Remove all keytab entries"),
2448 N_("net ads keytab flush\n"
2449 " Remove all keytab entries")
2450 },
2451 {
2452 "list",
2453 net_ads_keytab_list,
2454 NET_TRANSPORT_ADS,
2455 N_("List a keytab"),
2456 N_("net ads keytab list\n"
2457 " List a keytab")
2458 },
2459 {NULL, NULL, 0, NULL, NULL}
2460 };
2461
2462 if (!USE_KERBEROS_KEYTAB) {
2463 d_printf(_("\nWarning: \"kerberos method\" must be set to a "
2464 "keytab method to use keytab functions.\n"));
2465 }
2466
2467 return net_run_function(c, argc, argv, "net ads keytab", func);
2468 }
2469
2470 static int net_ads_kerberos_renew(struct net_context *c, int argc, const char **argv)
2471 {
2472 int ret = -1;
2473
2474 if (c->display_usage) {
2475 d_printf( "%s\n"
2476 "net ads kerberos renew\n"
2477 " %s\n",
2478 _("Usage:"),
2479 _("Renew TGT from existing credential cache"));
2480 return 0;
2481 }
2482
2483 ret = smb_krb5_renew_ticket(NULL, NULL, NULL, NULL);
2484 if (ret) {
2485 d_printf(_("failed to renew kerberos ticket: %s\n"),
2486 error_message(ret));
2487 }
2488 return ret;
2489 }
2490
2491 static int net_ads_kerberos_pac(struct net_context *c, int argc, const char **argv)
2492 {
2493 struct PAC_LOGON_INFO *info = NULL;
2494 TALLOC_CTX *mem_ctx = NULL;
2495 NTSTATUS status;
2496 int ret = -1;
2497 const char *impersonate_princ_s = NULL;
2498
2499 if (c->display_usage) {
2500 d_printf( "%s\n"
2501 "net ads kerberos pac\n"
2502 " %s\n",
2503 _("Usage:"),
2504 _("Dump the Kerberos PAC"));
2505 return 0;
2506 }
2507
2508 mem_ctx = talloc_init("net_ads_kerberos_pac");
2509 if (!mem_ctx) {
2510 goto out;
2511 }
2512
2513 if (argc > 0) {
2514 impersonate_princ_s = argv[0];
2515 }
2516
2517 c->opt_password = net_prompt_pass(c, c->opt_user_name);
2518
2519 status = kerberos_return_pac(mem_ctx,
2520 c->opt_user_name,
2521 c->opt_password,
2522 0,
2523 NULL,
2524 NULL,
2525 NULL,
2526 true,
2527 true,
2528 2592000, /* one month */
2529 impersonate_princ_s,
2530 &info);
2531 if (!NT_STATUS_IS_OK(status)) {
2532 d_printf(_("failed to query kerberos PAC: %s\n"),
2533 nt_errstr(status));
2534 goto out;
2535 }
2536
2537 if (info) {
2538 const char *s;
2539 s = NDR_PRINT_STRUCT_STRING(mem_ctx, PAC_LOGON_INFO, info);
2540 d_printf(_("The Pac: %s\n"), s);
2541 }
2542
2543 ret = 0;
2544 out:
2545 TALLOC_FREE(mem_ctx);
2546 return ret;
2547 }
2548
2549 static int net_ads_kerberos_kinit(struct net_context *c, int argc, const char **argv)
2550 {
2551 TALLOC_CTX *mem_ctx = NULL;
2552 int ret = -1;
2553 NTSTATUS status;
2554
2555 if (c->display_usage) {
2556 d_printf( "%s\n"
2557 "net ads kerberos kinit\n"
2558 " %s\n",
2559 _("Usage:"),
2560 _("Get Ticket Granting Ticket (TGT) for the user"));
2561 return 0;
2562 }
2563
2564 mem_ctx = talloc_init("net_ads_kerberos_kinit");
2565 if (!mem_ctx) {
2566 goto out;
2567 }
2568
2569 c->opt_password = net_prompt_pass(c, c->opt_user_name);
2570
2571 ret = kerberos_kinit_password_ext(c->opt_user_name,
2572 c->opt_password,
2573 0,
2574 NULL,
2575 NULL,
2576 NULL,
2577 true,
2578 true,
2579 2592000, /* one month */
2580 &status);
2581 if (ret) {
2582 d_printf(_("failed to kinit password: %s\n"),
2583 nt_errstr(status));
2584 }
2585 out:
2586 return ret;
2587 }
2588
2589 int net_ads_kerberos(struct net_context *c, int argc, const char **argv)
2590 {
2591 struct functable func[] = {
2592 {
2593 "kinit",
2594 net_ads_kerberos_kinit,
2595 NET_TRANSPORT_ADS,
2596 N_("Retrieve Ticket Granting Ticket (TGT)"),
2597 N_("net ads kerberos kinit\n"
2598 " Receive Ticket Granting Ticket (TGT)")
2599 },
2600 {
2601 "renew",
2602 net_ads_kerberos_renew,
2603 NET_TRANSPORT_ADS,
2604 N_("Renew Ticket Granting Ticket from credential cache"),
2605 N_("net ads kerberos renew\n"
2606 " Renew Ticket Granting Ticket (TGT) from "
2607 "credential cache")
2608 },
2609 {
2610 "pac",
2611 net_ads_kerberos_pac,
2612 NET_TRANSPORT_ADS,
2613 N_("Dump Kerberos PAC"),
2614 N_("net ads kerberos pac\n"
2615 " Dump Kerberos PAC")
2616 },
2617 {NULL, NULL, 0, NULL, NULL}
2618 };
2619
2620 return net_run_function(c, argc, argv, "net ads kerberos", func);
2621 }
2622
2623 int net_ads(struct net_context *c, int argc, const char **argv)
2624 {
2625 struct functable func[] = {
2626 {
2627 "info",
2628 net_ads_info,
2629 NET_TRANSPORT_ADS,
2630 N_("Display details on remote ADS server"),
2631 N_("net ads info\n"
2632 " Display details on remote ADS server")
2633 },
2634 {
2635 "join",
2636 net_ads_join,
2637 NET_TRANSPORT_ADS,
2638 N_("Join the local machine to ADS realm"),
2639 N_("net ads join\n"
2640 " Join the local machine to ADS realm")
2641 },
2642 {
2643 "testjoin",
2644 net_ads_testjoin,
2645 NET_TRANSPORT_ADS,
2646 N_("Validate machine account"),
2647 N_("net ads testjoin\n"
2648 " Validate machine account")
2649 },
2650 {
2651 "leave",
2652 net_ads_leave,
2653 NET_TRANSPORT_ADS,
2654 N_("Remove the local machine from ADS"),
2655 N_("net ads leave\n"
2656 " Remove the local machine from ADS")
2657 },
2658 {
2659 "status",
2660 net_ads_status,
2661 NET_TRANSPORT_ADS,
2662 N_("Display machine account details"),
2663 N_("net ads status\n"
2664 " Display machine account details")
2665 },
2666 {
2667 "user",
2668 net_ads_user,
2669 NET_TRANSPORT_ADS,
2670 N_("List/modify users"),
2671 N_("net ads user\n"
2672 " List/modify users")
2673 },
2674 {
2675 "group",
2676 net_ads_group,
2677 NET_TRANSPORT_ADS,
2678 N_("List/modify groups"),
2679 N_("net ads group\n"
2680 " List/modify groups")
2681 },
2682 {
2683 "dns",
2684 net_ads_dns,
2685 NET_TRANSPORT_ADS,
2686 N_("Issue dynamic DNS update"),
2687 N_("net ads dns\n"
2688 " Issue dynamic DNS update")
2689 },
2690 {
2691 "password",
2692 net_ads_password,
2693 NET_TRANSPORT_ADS,
2694 N_("Change user passwords"),
2695 N_("net ads password\n"
2696 " Change user passwords")
2697 },
2698 {
2699 "changetrustpw",
2700 net_ads_changetrustpw,
2701 NET_TRANSPORT_ADS,
2702 N_("Change trust account password"),
2703 N_("net ads changetrustpw\n"
2704 " Change trust account password")
2705 },
2706 {
2707 "printer",
2708 net_ads_printer,
2709 NET_TRANSPORT_ADS,
2710 N_("List/modify printer entries"),
2711 N_("net ads printer\n"
2712 " List/modify printer entries")
2713 },
2714 {
2715 "search",
2716 net_ads_search,
2717 NET_TRANSPORT_ADS,
2718 N_("Issue LDAP search using filter"),
2719 N_("net ads search\n"
2720 " Issue LDAP search using filter")
2721 },
2722 {
2723 "dn",
2724 net_ads_dn,
2725 NET_TRANSPORT_ADS,
2726 N_("Issue LDAP search by DN"),
2727 N_("net ads dn\n"
2728 " Issue LDAP search by DN")
2729 },
2730 {
2731 "sid",
2732 net_ads_sid,
2733 NET_TRANSPORT_ADS,
2734 N_("Issue LDAP search by SID"),
2735 N_("net ads sid\n"
2736 " Issue LDAP search by SID")
2737 },
2738 {
2739 "workgroup",
2740 net_ads_workgroup,
2741 NET_TRANSPORT_ADS,
2742 N_("Display workgroup name"),
2743 N_("net ads workgroup\n"
2744 " Display the workgroup name")
2745 },
2746 {
2747 "lookup",
2748 net_ads_lookup,
2749 NET_TRANSPORT_ADS,
2750 N_("Perfom CLDAP query on DC"),
2751 N_("net ads lookup\n"
2752 " Find the ADS DC using CLDAP lookups")
2753 },
2754 {
2755 "keytab",
2756 net_ads_keytab,
2757 NET_TRANSPORT_ADS,
2758 N_("Manage local keytab file"),
2759 N_("net ads keytab\n"
2760 " Manage local keytab file")
2761 },
2762 {
2763 "gpo",
2764 net_ads_gpo,
2765 NET_TRANSPORT_ADS,
2766 N_("Manage group policy objects"),
2767 N_("net ads gpo\n"
2768 " Manage group policy objects")
2769 },
2770 {
2771 "kerberos",
2772 net_ads_kerberos,
2773 NET_TRANSPORT_ADS,
2774 N_("Manage kerberos keytab"),
2775 N_("net ads kerberos\n"
2776 " Manage kerberos keytab")
2777 },
2778 {NULL, NULL, 0, NULL, NULL}
2779 };
2780
2781 return net_run_function(c, argc, argv, "net ads", func);
2782 }
2783
2784 #else
2785
2786 static int net_ads_noads(void)
2787 {
2788 d_fprintf(stderr, _("ADS support not compiled in\n"));
2789 return -1;
2790 }
2791
2792 int net_ads_keytab(struct net_context *c, int argc, const char **argv)
2793 {
2794 return net_ads_noads();
2795 }
2796
2797 int net_ads_kerberos(struct net_context *c, int argc, const char **argv)
2798 {
2799 return net_ads_noads();
2800 }
2801
2802 int net_ads_changetrustpw(struct net_context *c, int argc, const char **argv)
2803 {
2804 return net_ads_noads();
2805 }
2806
2807 int net_ads_join(struct net_context *c, int argc, const char **argv)
2808 {
2809 return net_ads_noads();
2810 }
2811
2812 int net_ads_user(struct net_context *c, int argc, const char **argv)
2813 {
2814 return net_ads_noads();
2815 }
2816
2817 int net_ads_group(struct net_context *c, int argc, const char **argv)
2818 {
2819 return net_ads_noads();
2820 }
2821
2822 int net_ads_gpo(struct net_context *c, int argc, const char **argv)
2823 {
2824 return net_ads_noads();
2825 }
2826
2827 /* this one shouldn't display a message */
2828 int net_ads_check(struct net_context *c)
2829 {
2830 return -1;
2831 }
2832
2833 int net_ads_check_our_domain(struct net_context *c)
2834 {
2835 return -1;
2836 }
2837
2838 int net_ads(struct net_context *c, int argc, const char **argv)
2839 {
2840 return net_ads_noads();
2841 }
2842
2843 #endif /* WITH_ADS */
Anubhav's Work In Progress branches