2 Samba Unix/Linux SMB client library
3 Distributed SMB/CIFS Server Management Utility
4 Copyright (C) 2001 Andrew Bartlett (abartlet@samba.org)
5 Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
22 #include "../utils/net.h"
27 * @brief RPC based subcommands for the 'net' utility.
29 * This file should contain much of the functionality that used to
30 * be found in rpcclient, execpt that the commands should change
31 * less often, and the fucntionality should be sane (the user is not
32 * expected to know a rid/sid before they conduct an operation etc.)
34 * @todo Perhaps eventually these should be split out into a number
35 * of files, as this could get quite big.
39 /* A function of this type is passed to the 'run_rpc_command' wrapper */
40 typedef NTSTATUS (*rpc_command_fn)(const DOM_SID *, const char *,
41 struct cli_state *, TALLOC_CTX *, int, const char **);
44 * Many of the RPC functions need the domain sid. This function gets
45 * it at the start of every run
47 * @param cli A cli_state already connected to the remote machine
49 * @return The Domain SID of the remote machine.
52 static DOM_SID *net_get_remote_domain_sid(struct cli_state *cli, TALLOC_CTX *mem_ctx, char **domain_name)
56 NTSTATUS result = NT_STATUS_OK;
57 uint32 info_class = 5;
59 if (!cli_nt_session_open (cli, PI_LSARPC)) {
60 fprintf(stderr, "could not initialise lsa pipe\n");
64 result = cli_lsa_open_policy(cli, mem_ctx, False,
65 SEC_RIGHTS_MAXIMUM_ALLOWED,
67 if (!NT_STATUS_IS_OK(result)) {
71 result = cli_lsa_query_info_policy(cli, mem_ctx, &pol, info_class,
72 domain_name, &domain_sid);
73 if (!NT_STATUS_IS_OK(result)) {
75 fprintf(stderr, "could not obtain sid for domain %s\n", cli->domain);
77 if (!NT_STATUS_IS_OK(result)) {
78 fprintf(stderr, "error: %s\n", nt_errstr(result));
84 cli_lsa_close(cli, mem_ctx, &pol);
85 cli_nt_session_close(cli);
91 * Run a single RPC command, from start to finish.
93 * @param pipe_name the pipe to connect to (usually a PIPE_ constant)
94 * @param conn_flag a NET_FLAG_ combination. Passed to
95 * net_make_ipc_connection.
96 * @param argc Standard main() style argc
97 * @param argc Standard main() style argv. Initial components are already
99 * @return A shell status integer (0 for success)
102 static int run_rpc_command(struct cli_state *cli_arg, const int pipe_idx, int conn_flags,
104 int argc, const char **argv)
106 struct cli_state *cli = NULL;
112 /* make use of cli_state handed over as an argument, if possible */
114 cli = net_make_ipc_connection(conn_flags);
124 if (!(mem_ctx = talloc_init("run_rpc_command"))) {
125 DEBUG(0, ("talloc_init() failed\n"));
130 domain_sid = net_get_remote_domain_sid(cli, mem_ctx, &domain_name);
132 if (!(conn_flags & NET_FLAGS_NO_PIPE)) {
133 if (!cli_nt_session_open(cli, pipe_idx)) {
134 DEBUG(0, ("Could not initialise pipe\n"));
138 nt_status = fn(domain_sid, domain_name, cli, mem_ctx, argc, argv);
140 if (!NT_STATUS_IS_OK(nt_status)) {
141 DEBUG(1, ("rpc command function failed! (%s)\n", nt_errstr(nt_status)));
143 DEBUG(5, ("rpc command function succedded\n"));
146 if (!(conn_flags & NET_FLAGS_NO_PIPE)) {
147 if (cli->nt_pipe_fnum)
148 cli_nt_session_close(cli);
151 /* close the connection only if it was opened here */
155 talloc_destroy(mem_ctx);
157 return (!NT_STATUS_IS_OK(nt_status));
161 /****************************************************************************/
165 * Force a change of the trust acccount password.
167 * All parameters are provided by the run_rpc_command function, except for
168 * argc, argv which are passes through.
170 * @param domain_sid The domain sid aquired from the remote server
171 * @param cli A cli_state connected to the server.
172 * @param mem_ctx Talloc context, destoyed on compleation of the function.
173 * @param argc Standard main() style argc
174 * @param argc Standard main() style argv. Initial components are already
177 * @return Normal NTSTATUS return.
180 static NTSTATUS rpc_changetrustpw_internals(const DOM_SID *domain_sid, const char *domain_name,
181 struct cli_state *cli, TALLOC_CTX *mem_ctx,
182 int argc, const char **argv) {
184 return trust_pw_find_change_and_store_it(cli, mem_ctx, opt_target_workgroup);
188 * Force a change of the trust acccount password.
190 * @param argc Standard main() style argc
191 * @param argc Standard main() style argv. Initial components are already
194 * @return A shell status integer (0 for success)
197 int net_rpc_changetrustpw(int argc, const char **argv)
199 return run_rpc_command(NULL, PI_NETLOGON, NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
200 rpc_changetrustpw_internals,
205 /****************************************************************************/
209 * Join a domain, the old way.
211 * This uses 'machinename' as the inital password, and changes it.
213 * The password should be created with 'server manager' or equiv first.
215 * All parameters are provided by the run_rpc_command function, except for
216 * argc, argv which are passes through.
218 * @param domain_sid The domain sid aquired from the remote server
219 * @param cli A cli_state connected to the server.
220 * @param mem_ctx Talloc context, destoyed on compleation of the function.
221 * @param argc Standard main() style argc
222 * @param argc Standard main() style argv. Initial components are already
225 * @return Normal NTSTATUS return.
228 static NTSTATUS rpc_oldjoin_internals(const DOM_SID *domain_sid, const char *domain_name,
229 struct cli_state *cli,
231 int argc, const char **argv) {
233 fstring trust_passwd;
234 unsigned char orig_trust_passwd_hash[16];
236 uint32 sec_channel_type;
239 check what type of join - if the user want's to join as
240 a BDC, the server must agree that we are a BDC.
243 sec_channel_type = get_sec_channel_type(argv[0]);
245 sec_channel_type = get_sec_channel_type(NULL);
248 fstrcpy(trust_passwd, global_myname());
249 strlower_m(trust_passwd);
252 * Machine names can be 15 characters, but the max length on
253 * a password is 14. --jerry
256 trust_passwd[14] = '\0';
258 E_md4hash(trust_passwd, orig_trust_passwd_hash);
260 result = trust_pw_change_and_store_it(cli, mem_ctx, opt_target_workgroup,
261 orig_trust_passwd_hash,
264 if (NT_STATUS_IS_OK(result))
265 printf("Joined domain %s.\n",opt_target_workgroup);
268 if (!secrets_store_domain_sid(opt_target_workgroup, domain_sid)) {
269 DEBUG(0, ("error storing domain sid for %s\n", opt_target_workgroup));
270 result = NT_STATUS_UNSUCCESSFUL;
277 * Join a domain, the old way.
279 * @param argc Standard main() style argc
280 * @param argc Standard main() style argv. Initial components are already
283 * @return A shell status integer (0 for success)
286 static int net_rpc_perform_oldjoin(int argc, const char **argv)
288 return run_rpc_command(NULL, PI_NETLOGON,
289 NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
290 rpc_oldjoin_internals,
295 * Join a domain, the old way. This function exists to allow
296 * the message to be displayed when oldjoin was explicitly
297 * requested, but not when it was implied by "net rpc join"
299 * @param argc Standard main() style argc
300 * @param argc Standard main() style argv. Initial components are already
303 * @return A shell status integer (0 for success)
306 static int net_rpc_oldjoin(int argc, const char **argv)
308 int rc = net_rpc_perform_oldjoin(argc, argv);
311 d_printf("Failed to join domain\n");
318 * Basic usage function for 'net rpc join'
319 * @param argc Standard main() style argc
320 * @param argc Standard main() style argv. Initial components are already
324 static int rpc_join_usage(int argc, const char **argv)
326 d_printf("net rpc join -U <username>[%%password] <type>[options]\n"\
327 "\t to join a domain with admin username & password\n"\
328 "\t\t password will be prompted if needed and none is specified\n"\
329 "\t <type> can be (default MEMBER)\n"\
330 "\t\t BDC - Join as a BDC\n"\
331 "\t\t PDC - Join as a PDC\n"\
332 "\t\t MEMBER - Join as a MEMBER server\n");
334 net_common_flags_usage(argc, argv);
339 * 'net rpc join' entrypoint.
340 * @param argc Standard main() style argc
341 * @param argc Standard main() style argv. Initial components are already
344 * Main 'net_rpc_join()' (where the admain username/password is used) is
346 * Try to just change the password, but if that doesn't work, use/prompt
347 * for a username/password.
350 int net_rpc_join(int argc, const char **argv)
352 if ((net_rpc_perform_oldjoin(argc, argv) == 0))
355 return net_rpc_join_newstyle(argc, argv);
361 * display info about a rpc domain
363 * All parameters are provided by the run_rpc_command function, except for
364 * argc, argv which are passed through.
366 * @param domain_sid The domain sid acquired from the remote server
367 * @param cli A cli_state connected to the server.
368 * @param mem_ctx Talloc context, destoyed on completion of the function.
369 * @param argc Standard main() style argc
370 * @param argv Standard main() style argv. Initial components are already
373 * @return Normal NTSTATUS return.
377 rpc_info_internals(const DOM_SID *domain_sid, const char *domain_name,
378 struct cli_state *cli,
379 TALLOC_CTX *mem_ctx, int argc, const char **argv)
381 POLICY_HND connect_pol, domain_pol;
382 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
386 sid_to_string(sid_str, domain_sid);
388 /* Get sam policy handle */
389 result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
391 if (!NT_STATUS_IS_OK(result)) {
395 /* Get domain policy handle */
396 result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
397 MAXIMUM_ALLOWED_ACCESS,
398 domain_sid, &domain_pol);
399 if (!NT_STATUS_IS_OK(result)) {
404 result = cli_samr_query_dom_info(cli, mem_ctx, &domain_pol,
406 if (NT_STATUS_IS_OK(result)) {
407 TALLOC_CTX *ctx = talloc_init("rpc_info_internals");
408 d_printf("Domain Name: %s\n", unistr2_tdup(ctx, &ctr.info.inf2.uni_domain));
409 d_printf("Domain SID: %s\n", sid_str);
410 d_printf("Sequence number: %u\n", ctr.info.inf2.seq_num);
411 d_printf("Num users: %u\n", ctr.info.inf2.num_domain_usrs);
412 d_printf("Num domain groups: %u\n", ctr.info.inf2.num_domain_grps);
413 d_printf("Num local groups: %u\n", ctr.info.inf2.num_local_grps);
423 * 'net rpc info' entrypoint.
424 * @param argc Standard main() style argc
425 * @param argc Standard main() style argv. Initial components are already
428 int net_rpc_info(int argc, const char **argv)
430 return run_rpc_command(NULL, PI_SAMR, NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
437 * Fetch domain SID into the local secrets.tdb
439 * All parameters are provided by the run_rpc_command function, except for
440 * argc, argv which are passes through.
442 * @param domain_sid The domain sid acquired from the remote server
443 * @param cli A cli_state connected to the server.
444 * @param mem_ctx Talloc context, destoyed on completion of the function.
445 * @param argc Standard main() style argc
446 * @param argv Standard main() style argv. Initial components are already
449 * @return Normal NTSTATUS return.
453 rpc_getsid_internals(const DOM_SID *domain_sid, const char *domain_name,
454 struct cli_state *cli,
455 TALLOC_CTX *mem_ctx, int argc, const char **argv)
459 sid_to_string(sid_str, domain_sid);
460 d_printf("Storing SID %s for Domain %s in secrets.tdb\n",
461 sid_str, domain_name);
463 if (!secrets_store_domain_sid(domain_name, domain_sid)) {
464 DEBUG(0,("Can't store domain SID\n"));
465 return NT_STATUS_UNSUCCESSFUL;
473 * 'net rpc getsid' entrypoint.
474 * @param argc Standard main() style argc
475 * @param argc Standard main() style argv. Initial components are already
478 int net_rpc_getsid(int argc, const char **argv)
480 return run_rpc_command(NULL, PI_SAMR, NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
481 rpc_getsid_internals,
486 /****************************************************************************/
489 * Basic usage function for 'net rpc user'
490 * @param argc Standard main() style argc.
491 * @param argv Standard main() style argv. Initial components are already
495 static int rpc_user_usage(int argc, const char **argv)
497 return net_help_user(argc, argv);
501 * Add a new user to a remote RPC server
503 * All parameters are provided by the run_rpc_command function, except for
504 * argc, argv which are passes through.
506 * @param domain_sid The domain sid acquired from the remote server
507 * @param cli A cli_state connected to the server.
508 * @param mem_ctx Talloc context, destoyed on completion of the function.
509 * @param argc Standard main() style argc
510 * @param argv Standard main() style argv. Initial components are already
513 * @return Normal NTSTATUS return.
516 static NTSTATUS rpc_user_add_internals(const DOM_SID *domain_sid, const char *domain_name,
517 struct cli_state *cli, TALLOC_CTX *mem_ctx,
518 int argc, const char **argv) {
520 POLICY_HND connect_pol, domain_pol, user_pol;
521 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
522 const char *acct_name;
524 uint32 unknown, user_rid;
527 d_printf("User must be specified\n");
528 rpc_user_usage(argc, argv);
534 /* Get sam policy handle */
536 result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
538 if (!NT_STATUS_IS_OK(result)) {
542 /* Get domain policy handle */
544 result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
545 MAXIMUM_ALLOWED_ACCESS,
546 domain_sid, &domain_pol);
547 if (!NT_STATUS_IS_OK(result)) {
551 /* Create domain user */
553 acb_info = ACB_NORMAL;
554 unknown = 0xe005000b; /* No idea what this is - a permission mask? */
556 result = cli_samr_create_dom_user(cli, mem_ctx, &domain_pol,
557 acct_name, acb_info, unknown,
558 &user_pol, &user_rid);
559 if (!NT_STATUS_IS_OK(result)) {
564 if (!NT_STATUS_IS_OK(result)) {
565 d_printf("Failed to add user %s - %s\n", acct_name,
568 d_printf("Added user %s\n", acct_name);
574 * Add a new user to a remote RPC server
576 * @param argc Standard main() style argc
577 * @param argv Standard main() style argv. Initial components are already
580 * @return A shell status integer (0 for success)
583 static int rpc_user_add(int argc, const char **argv)
585 return run_rpc_command(NULL, PI_SAMR, 0, rpc_user_add_internals,
590 * Delete a user from a remote RPC server
592 * All parameters are provided by the run_rpc_command function, except for
593 * argc, argv which are passes through.
595 * @param domain_sid The domain sid acquired from the remote server
596 * @param cli A cli_state connected to the server.
597 * @param mem_ctx Talloc context, destoyed on completion of the function.
598 * @param argc Standard main() style argc
599 * @param argv Standard main() style argv. Initial components are already
602 * @return Normal NTSTATUS return.
605 static NTSTATUS rpc_user_del_internals(const DOM_SID *domain_sid,
606 const char *domain_name,
607 struct cli_state *cli,
609 int argc, const char **argv)
611 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
612 POLICY_HND connect_pol, domain_pol, user_pol;
615 d_printf("User must be specified\n");
616 rpc_user_usage(argc, argv);
619 /* Get sam policy and domain handles */
621 result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
624 if (!NT_STATUS_IS_OK(result)) {
628 result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
629 MAXIMUM_ALLOWED_ACCESS,
630 domain_sid, &domain_pol);
632 if (!NT_STATUS_IS_OK(result)) {
636 /* Get handle on user */
639 uint32 *user_rids, num_rids, *name_types;
640 uint32 flags = 0x000003e8; /* Unknown */
642 result = cli_samr_lookup_names(cli, mem_ctx, &domain_pol,
644 &num_rids, &user_rids,
647 if (!NT_STATUS_IS_OK(result)) {
651 result = cli_samr_open_user(cli, mem_ctx, &domain_pol,
652 MAXIMUM_ALLOWED_ACCESS,
653 user_rids[0], &user_pol);
655 if (!NT_STATUS_IS_OK(result)) {
662 result = cli_samr_delete_dom_user(cli, mem_ctx, &user_pol);
664 if (!NT_STATUS_IS_OK(result)) {
668 /* Display results */
676 * Delete a user from a remote RPC server
678 * @param argc Standard main() style argc
679 * @param argv Standard main() style argv. Initial components are already
682 * @return A shell status integer (0 for success)
685 static int rpc_user_delete(int argc, const char **argv)
687 return run_rpc_command(NULL, PI_SAMR, 0, rpc_user_del_internals,
692 * Set a password for a user on a remote RPC server
694 * All parameters are provided by the run_rpc_command function, except for
695 * argc, argv which are passes through.
697 * @param domain_sid The domain sid acquired from the remote server
698 * @param cli A cli_state connected to the server.
699 * @param mem_ctx Talloc context, destoyed on completion of the function.
700 * @param argc Standard main() style argc
701 * @param argv Standard main() style argv. Initial components are already
704 * @return Normal NTSTATUS return.
707 static NTSTATUS rpc_user_password_internals(const DOM_SID *domain_sid,
708 const char *domain_name,
709 struct cli_state *cli,
711 int argc, const char **argv)
713 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
714 POLICY_HND connect_pol, domain_pol, user_pol;
715 SAM_USERINFO_CTR ctr;
716 SAM_USER_INFO_24 p24;
719 const char *new_password;
723 d_printf("User must be specified\n");
724 rpc_user_usage(argc, argv);
731 new_password = argv[1];
733 asprintf(&prompt, "Enter new password for %s:", user);
734 new_password = getpass(prompt);
738 /* Get sam policy and domain handles */
740 result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
743 if (!NT_STATUS_IS_OK(result)) {
747 result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
748 MAXIMUM_ALLOWED_ACCESS,
749 domain_sid, &domain_pol);
751 if (!NT_STATUS_IS_OK(result)) {
755 /* Get handle on user */
758 uint32 *user_rids, num_rids, *name_types;
759 uint32 flags = 0x000003e8; /* Unknown */
761 result = cli_samr_lookup_names(cli, mem_ctx, &domain_pol,
763 &num_rids, &user_rids,
766 if (!NT_STATUS_IS_OK(result)) {
770 result = cli_samr_open_user(cli, mem_ctx, &domain_pol,
771 MAXIMUM_ALLOWED_ACCESS,
772 user_rids[0], &user_pol);
774 if (!NT_STATUS_IS_OK(result)) {
779 /* Set password on account */
784 encode_pw_buffer(pwbuf, new_password, STR_UNICODE);
786 init_sam_user_info24(&p24, (char *)pwbuf,24);
788 ctr.switch_value = 24;
789 ctr.info.id24 = &p24;
791 result = cli_samr_set_userinfo(cli, mem_ctx, &user_pol, 24,
792 &cli->user_session_key, &ctr);
794 if (!NT_STATUS_IS_OK(result)) {
798 /* Display results */
806 * Set a user's password on a remote RPC server
808 * @param argc Standard main() style argc
809 * @param argv Standard main() style argv. Initial components are already
812 * @return A shell status integer (0 for success)
815 static int rpc_user_password(int argc, const char **argv)
817 return run_rpc_command(NULL, PI_SAMR, 0, rpc_user_password_internals,
822 * List user's groups on a remote RPC server
824 * All parameters are provided by the run_rpc_command function, except for
825 * argc, argv which are passes through.
827 * @param domain_sid The domain sid acquired from the remote server
828 * @param cli A cli_state connected to the server.
829 * @param mem_ctx Talloc context, destoyed on completion of the function.
830 * @param argc Standard main() style argc
831 * @param argv Standard main() style argv. Initial components are already
834 * @return Normal NTSTATUS return.
838 rpc_user_info_internals(const DOM_SID *domain_sid, const char *domain_name,
839 struct cli_state *cli,
840 TALLOC_CTX *mem_ctx, int argc, const char **argv)
842 POLICY_HND connect_pol, domain_pol, user_pol;
843 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
844 uint32 *rids, num_rids, *name_types, num_names;
845 uint32 flags = 0x000003e8; /* Unknown */
851 d_printf("User must be specified\n");
852 rpc_user_usage(argc, argv);
855 /* Get sam policy handle */
857 result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
859 if (!NT_STATUS_IS_OK(result)) goto done;
861 /* Get domain policy handle */
863 result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
864 MAXIMUM_ALLOWED_ACCESS,
865 domain_sid, &domain_pol);
866 if (!NT_STATUS_IS_OK(result)) goto done;
868 /* Get handle on user */
870 result = cli_samr_lookup_names(cli, mem_ctx, &domain_pol,
872 &num_rids, &rids, &name_types);
874 if (!NT_STATUS_IS_OK(result)) goto done;
876 result = cli_samr_open_user(cli, mem_ctx, &domain_pol,
877 MAXIMUM_ALLOWED_ACCESS,
879 if (!NT_STATUS_IS_OK(result)) goto done;
881 result = cli_samr_query_usergroups(cli, mem_ctx, &user_pol,
882 &num_rids, &user_gids);
886 rids = (uint32 *)talloc(mem_ctx, sizeof(uint32) * num_rids);
888 for (i = 0; i < num_rids; i++)
889 rids[i] = user_gids[i].g_rid;
891 result = cli_samr_lookup_rids(cli, mem_ctx, &domain_pol,
892 flags, num_rids, rids,
893 &num_names, &names, &name_types);
895 if (!NT_STATUS_IS_OK(result)) {
899 /* Display results */
901 for (i = 0; i < num_names; i++)
902 printf("%s\n", names[i]);
909 * List a user's groups from a remote RPC server
911 * @param argc Standard main() style argc
912 * @param argv Standard main() style argv. Initial components are already
915 * @return A shell status integer (0 for success)
918 static int rpc_user_info(int argc, const char **argv)
920 return run_rpc_command(NULL, PI_SAMR, 0, rpc_user_info_internals,
925 * List users on a remote RPC server
927 * All parameters are provided by the run_rpc_command function, except for
928 * argc, argv which are passes through.
930 * @param domain_sid The domain sid acquired from the remote server
931 * @param cli A cli_state connected to the server.
932 * @param mem_ctx Talloc context, destoyed on completion of the function.
933 * @param argc Standard main() style argc
934 * @param argv Standard main() style argv. Initial components are already
937 * @return Normal NTSTATUS return.
941 rpc_user_list_internals(const DOM_SID *domain_sid, const char *domain_name,
942 struct cli_state *cli,
943 TALLOC_CTX *mem_ctx, int argc, const char **argv)
945 POLICY_HND connect_pol, domain_pol;
946 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
947 uint32 start_idx=0, num_entries, i, loop_count = 0;
948 SAM_DISPINFO_CTR ctr;
949 SAM_DISPINFO_1 info1;
951 /* Get sam policy handle */
953 result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
955 if (!NT_STATUS_IS_OK(result)) {
959 /* Get domain policy handle */
961 result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
962 MAXIMUM_ALLOWED_ACCESS,
963 domain_sid, &domain_pol);
964 if (!NT_STATUS_IS_OK(result)) {
968 /* Query domain users */
971 ctr.sam.info1 = &info1;
972 if (opt_long_list_entries)
973 d_printf("\nUser name Comment"\
974 "\n-----------------------------\n");
977 uint32 max_entries, max_size;
979 get_query_dispinfo_params(
980 loop_count, &max_entries, &max_size);
982 result = cli_samr_query_dispinfo(cli, mem_ctx, &domain_pol,
983 &start_idx, 1, &num_entries,
984 max_entries, max_size, &ctr);
987 for (i = 0; i < num_entries; i++) {
988 unistr2_to_ascii(user, &(&ctr.sam.info1->str[i])->uni_acct_name, sizeof(user)-1);
989 if (opt_long_list_entries)
990 unistr2_to_ascii(desc, &(&ctr.sam.info1->str[i])->uni_acct_desc, sizeof(desc)-1);
992 if (opt_long_list_entries)
993 printf("%-21.21s %s\n", user, desc);
995 printf("%s\n", user);
997 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
1004 * 'net rpc user' entrypoint.
1005 * @param argc Standard main() style argc
1006 * @param argc Standard main() style argv. Initial components are already
1010 int net_rpc_user(int argc, const char **argv)
1012 struct functable func[] = {
1013 {"add", rpc_user_add},
1014 {"info", rpc_user_info},
1015 {"delete", rpc_user_delete},
1016 {"password", rpc_user_password},
1021 if (opt_long_list_entries) {
1024 return run_rpc_command(NULL,PI_SAMR, 0,
1025 rpc_user_list_internals,
1029 return net_run_function(argc, argv, func, rpc_user_usage);
1033 /****************************************************************************/
1036 * Basic usage function for 'net rpc group'
1037 * @param argc Standard main() style argc.
1038 * @param argv Standard main() style argv. Initial components are already
1042 static int rpc_group_usage(int argc, const char **argv)
1044 return net_help_group(argc, argv);
1048 rpc_group_add_internals(const DOM_SID *domain_sid, const char *domain_name,
1049 struct cli_state *cli,
1050 TALLOC_CTX *mem_ctx, int argc, const char **argv)
1052 POLICY_HND connect_pol, domain_pol, group_pol;
1053 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1054 GROUP_INFO_CTR group_info;
1057 d_printf("Group name must be specified\n");
1058 rpc_group_usage(argc, argv);
1059 return NT_STATUS_OK;
1062 /* Get sam policy handle */
1064 result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
1066 if (!NT_STATUS_IS_OK(result)) goto done;
1068 /* Get domain policy handle */
1070 result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
1071 MAXIMUM_ALLOWED_ACCESS,
1072 domain_sid, &domain_pol);
1073 if (!NT_STATUS_IS_OK(result)) goto done;
1075 /* Create the group */
1077 result = cli_samr_create_dom_group(cli, mem_ctx, &domain_pol,
1078 argv[0], MAXIMUM_ALLOWED_ACCESS,
1080 if (!NT_STATUS_IS_OK(result)) goto done;
1082 if (strlen(opt_comment) == 0) goto done;
1084 /* We've got a comment to set */
1086 group_info.switch_value1 = 4;
1087 init_samr_group_info4(&group_info.group.info4, opt_comment);
1089 result = cli_samr_set_groupinfo(cli, mem_ctx, &group_pol, &group_info);
1090 if (!NT_STATUS_IS_OK(result)) goto done;
1093 if (NT_STATUS_IS_OK(result))
1094 DEBUG(5, ("add group succeeded\n"));
1096 d_printf("add group failed: %s\n", nt_errstr(result));
1102 rpc_alias_add_internals(const DOM_SID *domain_sid, const char *domain_name,
1103 struct cli_state *cli,
1104 TALLOC_CTX *mem_ctx, int argc, const char **argv)
1106 POLICY_HND connect_pol, domain_pol, alias_pol;
1107 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1108 ALIAS_INFO_CTR alias_info;
1111 d_printf("Group name must be specified\n");
1112 rpc_group_usage(argc, argv);
1113 return NT_STATUS_OK;
1116 /* Get sam policy handle */
1118 result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
1120 if (!NT_STATUS_IS_OK(result)) goto done;
1122 /* Get domain policy handle */
1124 result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
1125 MAXIMUM_ALLOWED_ACCESS,
1126 domain_sid, &domain_pol);
1127 if (!NT_STATUS_IS_OK(result)) goto done;
1129 /* Create the group */
1131 result = cli_samr_create_dom_alias(cli, mem_ctx, &domain_pol,
1132 argv[0], &alias_pol);
1133 if (!NT_STATUS_IS_OK(result)) goto done;
1135 if (strlen(opt_comment) == 0) goto done;
1137 /* We've got a comment to set */
1139 alias_info.switch_value1 = 3;
1140 alias_info.switch_value2 = 3;
1141 init_samr_alias_info3(&alias_info.alias.info3, opt_comment);
1143 result = cli_samr_set_aliasinfo(cli, mem_ctx, &alias_pol, &alias_info);
1144 if (!NT_STATUS_IS_OK(result)) goto done;
1147 if (NT_STATUS_IS_OK(result))
1148 DEBUG(5, ("add group succeeded\n"));
1150 d_printf("add group failed: %s\n", nt_errstr(result));
1155 static int rpc_group_add(int argc, const char **argv)
1158 return run_rpc_command(NULL, PI_SAMR, 0,
1159 rpc_alias_add_internals,
1162 return run_rpc_command(NULL, PI_SAMR, 0,
1163 rpc_group_add_internals,
1168 get_sid_from_name(struct cli_state *cli, TALLOC_CTX *mem_ctx, const char *name,
1169 DOM_SID *sid, enum SID_NAME_USE *type)
1171 int current_pipe = cli->pipe_idx;
1173 DOM_SID *sids = NULL;
1174 uint32 *types = NULL;
1176 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1178 if (current_pipe != PI_LSARPC) {
1180 if (current_pipe != -1)
1181 cli_nt_session_close(cli);
1183 if (!cli_nt_session_open(cli, PI_LSARPC))
1187 result = cli_lsa_open_policy(cli, mem_ctx, False,
1188 SEC_RIGHTS_MAXIMUM_ALLOWED, &lsa_pol);
1190 if (!NT_STATUS_IS_OK(result))
1193 result = cli_lsa_lookup_names(cli, mem_ctx, &lsa_pol, 1,
1194 &name, &sids, &types);
1196 if (NT_STATUS_IS_OK(result)) {
1197 sid_copy(sid, &sids[0]);
1201 cli_lsa_close(cli, mem_ctx, &lsa_pol);
1204 if (current_pipe != PI_LSARPC) {
1205 cli_nt_session_close(cli);
1206 if (current_pipe != -1)
1207 cli_nt_session_open(cli, current_pipe);
1210 if (!NT_STATUS_IS_OK(result) && (StrnCaseCmp(name, "S-", 2) == 0)) {
1212 /* Try as S-1-5-whatever */
1216 if (string_to_sid(&tmp_sid, name)) {
1217 sid_copy(sid, &tmp_sid);
1218 *type = SID_NAME_UNKNOWN;
1219 result = NT_STATUS_OK;
1227 rpc_add_groupmem(struct cli_state *cli, TALLOC_CTX *mem_ctx,
1228 const DOM_SID *group_sid, const char *member)
1230 POLICY_HND connect_pol, domain_pol;
1233 POLICY_HND group_pol;
1236 uint32 *rids = NULL;
1237 uint32 *rid_types = NULL;
1241 sid_copy(&sid, group_sid);
1243 if (!sid_split_rid(&sid, &group_rid))
1244 return NT_STATUS_UNSUCCESSFUL;
1246 /* Get sam policy handle */
1247 result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
1249 if (!NT_STATUS_IS_OK(result))
1252 /* Get domain policy handle */
1253 result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
1254 MAXIMUM_ALLOWED_ACCESS,
1256 if (!NT_STATUS_IS_OK(result))
1259 result = cli_samr_lookup_names(cli, mem_ctx, &domain_pol, 1000,
1261 &num_rids, &rids, &rid_types);
1263 if (!NT_STATUS_IS_OK(result)) {
1264 d_printf("Could not lookup up group member %s\n", member);
1268 result = cli_samr_open_group(cli, mem_ctx, &domain_pol,
1269 MAXIMUM_ALLOWED_ACCESS,
1270 group_rid, &group_pol);
1272 if (!NT_STATUS_IS_OK(result))
1275 result = cli_samr_add_groupmem(cli, mem_ctx, &group_pol, rids[0]);
1278 cli_samr_close(cli, mem_ctx, &connect_pol);
1283 rpc_add_aliasmem(struct cli_state *cli, TALLOC_CTX *mem_ctx,
1284 const DOM_SID *alias_sid, const char *member)
1286 POLICY_HND connect_pol, domain_pol;
1289 POLICY_HND alias_pol;
1292 enum SID_NAME_USE member_type;
1296 sid_copy(&sid, alias_sid);
1298 if (!sid_split_rid(&sid, &alias_rid))
1299 return NT_STATUS_UNSUCCESSFUL;
1301 result = get_sid_from_name(cli, mem_ctx, member,
1302 &member_sid, &member_type);
1304 if (!NT_STATUS_IS_OK(result)) {
1305 d_printf("Could not lookup up group member %s\n", member);
1309 /* Get sam policy handle */
1310 result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
1312 if (!NT_STATUS_IS_OK(result)) {
1316 /* Get domain policy handle */
1317 result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
1318 MAXIMUM_ALLOWED_ACCESS,
1320 if (!NT_STATUS_IS_OK(result)) {
1324 result = cli_samr_open_alias(cli, mem_ctx, &domain_pol,
1325 MAXIMUM_ALLOWED_ACCESS,
1326 alias_rid, &alias_pol);
1328 if (!NT_STATUS_IS_OK(result))
1331 result = cli_samr_add_aliasmem(cli, mem_ctx, &alias_pol, &member_sid);
1333 if (!NT_STATUS_IS_OK(result))
1337 cli_samr_close(cli, mem_ctx, &connect_pol);
1342 rpc_group_addmem_internals(const DOM_SID *domain_sid, const char *domain_name,
1343 struct cli_state *cli,
1344 TALLOC_CTX *mem_ctx, int argc, const char **argv)
1347 enum SID_NAME_USE group_type;
1350 d_printf("Usage: 'net rpc group addmem <group> <member>\n");
1351 return NT_STATUS_UNSUCCESSFUL;
1354 if (!NT_STATUS_IS_OK(get_sid_from_name(cli, mem_ctx, argv[0],
1355 &group_sid, &group_type))) {
1356 d_printf("Could not lookup group name %s\n", argv[0]);
1357 return NT_STATUS_UNSUCCESSFUL;
1360 if (group_type == SID_NAME_DOM_GRP) {
1361 NTSTATUS result = rpc_add_groupmem(cli, mem_ctx,
1362 &group_sid, argv[1]);
1364 if (!NT_STATUS_IS_OK(result)) {
1365 d_printf("Could not add %s to %s: %s\n",
1366 argv[1], argv[0], nt_errstr(result));
1371 if (group_type == SID_NAME_ALIAS) {
1372 NTSTATUS result = rpc_add_aliasmem(cli, mem_ctx,
1373 &group_sid, argv[1]);
1375 if (!NT_STATUS_IS_OK(result)) {
1376 d_printf("Could not add %s to %s: %s\n",
1377 argv[1], argv[0], nt_errstr(result));
1382 return NT_STATUS_UNSUCCESSFUL;
1385 static int rpc_group_addmem(int argc, const char **argv)
1387 return run_rpc_command(NULL, PI_SAMR, 0,
1388 rpc_group_addmem_internals,
1393 rpc_del_groupmem(struct cli_state *cli, TALLOC_CTX *mem_ctx,
1394 const DOM_SID *group_sid, const char *member)
1396 POLICY_HND connect_pol, domain_pol;
1399 POLICY_HND group_pol;
1402 uint32 *rids = NULL;
1403 uint32 *rid_types = NULL;
1407 sid_copy(&sid, group_sid);
1409 if (!sid_split_rid(&sid, &group_rid))
1410 return NT_STATUS_UNSUCCESSFUL;
1412 /* Get sam policy handle */
1413 result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
1415 if (!NT_STATUS_IS_OK(result))
1418 /* Get domain policy handle */
1419 result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
1420 MAXIMUM_ALLOWED_ACCESS,
1422 if (!NT_STATUS_IS_OK(result))
1425 result = cli_samr_lookup_names(cli, mem_ctx, &domain_pol, 1000,
1427 &num_rids, &rids, &rid_types);
1429 if (!NT_STATUS_IS_OK(result)) {
1430 d_printf("Could not lookup up group member %s\n", member);
1434 result = cli_samr_open_group(cli, mem_ctx, &domain_pol,
1435 MAXIMUM_ALLOWED_ACCESS,
1436 group_rid, &group_pol);
1438 if (!NT_STATUS_IS_OK(result))
1441 result = cli_samr_del_groupmem(cli, mem_ctx, &group_pol, rids[0]);
1444 cli_samr_close(cli, mem_ctx, &connect_pol);
1449 rpc_del_aliasmem(struct cli_state *cli, TALLOC_CTX *mem_ctx,
1450 const DOM_SID *alias_sid, const char *member)
1452 POLICY_HND connect_pol, domain_pol;
1455 POLICY_HND alias_pol;
1458 enum SID_NAME_USE member_type;
1462 sid_copy(&sid, alias_sid);
1464 if (!sid_split_rid(&sid, &alias_rid))
1465 return NT_STATUS_UNSUCCESSFUL;
1467 result = get_sid_from_name(cli, mem_ctx, member,
1468 &member_sid, &member_type);
1470 if (!NT_STATUS_IS_OK(result)) {
1471 d_printf("Could not lookup up group member %s\n", member);
1475 /* Get sam policy handle */
1476 result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
1478 if (!NT_STATUS_IS_OK(result)) {
1482 /* Get domain policy handle */
1483 result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
1484 MAXIMUM_ALLOWED_ACCESS,
1486 if (!NT_STATUS_IS_OK(result)) {
1490 result = cli_samr_open_alias(cli, mem_ctx, &domain_pol,
1491 MAXIMUM_ALLOWED_ACCESS,
1492 alias_rid, &alias_pol);
1494 if (!NT_STATUS_IS_OK(result))
1497 result = cli_samr_del_aliasmem(cli, mem_ctx, &alias_pol, &member_sid);
1499 if (!NT_STATUS_IS_OK(result))
1503 cli_samr_close(cli, mem_ctx, &connect_pol);
1508 rpc_group_delmem_internals(const DOM_SID *domain_sid, const char *domain_name,
1509 struct cli_state *cli,
1510 TALLOC_CTX *mem_ctx, int argc, const char **argv)
1513 enum SID_NAME_USE group_type;
1516 d_printf("Usage: 'net rpc group delmem <group> <member>\n");
1517 return NT_STATUS_UNSUCCESSFUL;
1520 if (!NT_STATUS_IS_OK(get_sid_from_name(cli, mem_ctx, argv[0],
1521 &group_sid, &group_type))) {
1522 d_printf("Could not lookup group name %s\n", argv[0]);
1523 return NT_STATUS_UNSUCCESSFUL;
1526 if (group_type == SID_NAME_DOM_GRP) {
1527 NTSTATUS result = rpc_del_groupmem(cli, mem_ctx,
1528 &group_sid, argv[1]);
1530 if (!NT_STATUS_IS_OK(result)) {
1531 d_printf("Could not del %s to %s: %s\n",
1532 argv[1], argv[0], nt_errstr(result));
1537 if (group_type == SID_NAME_ALIAS) {
1538 NTSTATUS result = rpc_del_aliasmem(cli, mem_ctx,
1539 &group_sid, argv[1]);
1541 if (!NT_STATUS_IS_OK(result)) {
1542 d_printf("Could not add %s to %s: %s\n",
1543 argv[1], argv[0], nt_errstr(result));
1548 return NT_STATUS_UNSUCCESSFUL;
1551 static int rpc_group_delmem(int argc, const char **argv)
1553 return run_rpc_command(NULL, PI_SAMR, 0,
1554 rpc_group_delmem_internals,
1559 * List groups on a remote RPC server
1561 * All parameters are provided by the run_rpc_command function, except for
1562 * argc, argv which are passes through.
1564 * @param domain_sid The domain sid acquired from the remote server
1565 * @param cli A cli_state connected to the server.
1566 * @param mem_ctx Talloc context, destoyed on completion of the function.
1567 * @param argc Standard main() style argc
1568 * @param argv Standard main() style argv. Initial components are already
1571 * @return Normal NTSTATUS return.
1575 rpc_group_list_internals(const DOM_SID *domain_sid, const char *domain_name,
1576 struct cli_state *cli,
1577 TALLOC_CTX *mem_ctx, int argc, const char **argv)
1579 POLICY_HND connect_pol, domain_pol;
1580 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1581 uint32 start_idx=0, max_entries=250, num_entries, i, loop_count = 0;
1582 struct acct_info *groups;
1583 DOM_SID global_sid_Builtin;
1584 BOOL global = False;
1586 BOOL builtin = False;
1594 for (i=0; i<argc; i++) {
1595 if (strequal(argv[i], "global"))
1598 if (strequal(argv[i], "local"))
1601 if (strequal(argv[i], "builtin"))
1605 string_to_sid(&global_sid_Builtin, "S-1-5-32");
1607 /* Get sam policy handle */
1609 result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
1611 if (!NT_STATUS_IS_OK(result)) {
1615 /* Get domain policy handle */
1617 result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
1618 MAXIMUM_ALLOWED_ACCESS,
1619 domain_sid, &domain_pol);
1620 if (!NT_STATUS_IS_OK(result)) {
1624 /* Query domain groups */
1625 if (opt_long_list_entries)
1626 d_printf("\nGroup name Comment"\
1627 "\n-----------------------------\n");
1629 SAM_DISPINFO_CTR ctr;
1630 SAM_DISPINFO_3 info3;
1635 ctr.sam.info3 = &info3;
1639 get_query_dispinfo_params(
1640 loop_count, &max_entries, &max_size);
1642 result = cli_samr_query_dispinfo(cli, mem_ctx, &domain_pol,
1643 &start_idx, 3, &num_entries,
1644 max_entries, max_size, &ctr);
1646 if (!NT_STATUS_IS_OK(result) &&
1647 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
1650 for (i = 0; i < num_entries; i++) {
1652 fstring group, desc;
1654 unistr2_to_ascii(group, &(&ctr.sam.info3->str[i])->uni_grp_name, sizeof(group)-1);
1655 unistr2_to_ascii(desc, &(&ctr.sam.info3->str[i])->uni_grp_desc, sizeof(desc)-1);
1657 if (opt_long_list_entries)
1658 printf("%-21.21s %-50.50s\n",
1661 printf("%s\n", group);
1663 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
1664 /* query domain aliases */
1669 result = cli_samr_enum_als_groups(cli, mem_ctx, &domain_pol,
1670 &start_idx, max_entries,
1671 &groups, &num_entries);
1673 if (!NT_STATUS_IS_OK(result) &&
1674 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
1677 for (i = 0; i < num_entries; i++) {
1679 char *description = NULL;
1681 if (opt_long_list_entries) {
1683 POLICY_HND alias_pol;
1686 if ((NT_STATUS_IS_OK(cli_samr_open_alias(cli, mem_ctx,
1691 (NT_STATUS_IS_OK(cli_samr_query_alias_info(cli, mem_ctx,
1694 (NT_STATUS_IS_OK(cli_samr_close(cli, mem_ctx,
1696 description = unistr2_tdup(mem_ctx,
1697 &ctr.alias.info3.uni_acct_desc);
1701 if (description != NULL) {
1702 printf("%-21.21s %-50.50s\n",
1703 groups[i].acct_name,
1706 printf("%s\n", groups[i].acct_name);
1709 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
1710 cli_samr_close(cli, mem_ctx, &domain_pol);
1711 /* Get builtin policy handle */
1713 result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
1714 MAXIMUM_ALLOWED_ACCESS,
1715 &global_sid_Builtin, &domain_pol);
1716 if (!NT_STATUS_IS_OK(result)) {
1719 /* query builtin aliases */
1722 if (!builtin) break;
1724 result = cli_samr_enum_als_groups(cli, mem_ctx, &domain_pol,
1725 &start_idx, max_entries,
1726 &groups, &num_entries);
1728 if (!NT_STATUS_IS_OK(result) &&
1729 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
1732 for (i = 0; i < num_entries; i++) {
1734 char *description = NULL;
1736 if (opt_long_list_entries) {
1738 POLICY_HND alias_pol;
1741 if ((NT_STATUS_IS_OK(cli_samr_open_alias(cli, mem_ctx,
1746 (NT_STATUS_IS_OK(cli_samr_query_alias_info(cli, mem_ctx,
1749 (NT_STATUS_IS_OK(cli_samr_close(cli, mem_ctx,
1751 description = unistr2_tdup(mem_ctx,
1752 &ctr.alias.info3.uni_acct_desc);
1756 if (description != NULL) {
1757 printf("%-21.21s %-50.50s\n",
1758 groups[i].acct_name,
1761 printf("%s\n", groups[i].acct_name);
1764 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
1770 static int rpc_group_list(int argc, const char **argv)
1772 return run_rpc_command(NULL, PI_SAMR, 0,
1773 rpc_group_list_internals,
1778 rpc_list_group_members(struct cli_state *cli, TALLOC_CTX *mem_ctx,
1779 const char *domain_name, const DOM_SID *domain_sid,
1780 POLICY_HND *domain_pol, uint32 rid)
1783 POLICY_HND group_pol;
1784 uint32 num_members, *group_rids, *group_attrs;
1791 sid_to_string(sid_str, domain_sid);
1793 result = cli_samr_open_group(cli, mem_ctx, domain_pol,
1794 MAXIMUM_ALLOWED_ACCESS,
1797 if (!NT_STATUS_IS_OK(result))
1800 result = cli_samr_query_groupmem(cli, mem_ctx, &group_pol,
1801 &num_members, &group_rids,
1804 if (!NT_STATUS_IS_OK(result))
1807 while (num_members > 0) {
1808 int this_time = 512;
1810 if (num_members < this_time)
1811 this_time = num_members;
1813 result = cli_samr_lookup_rids(cli, mem_ctx, domain_pol, 1000,
1814 this_time, group_rids,
1815 &num_names, &names, &name_types);
1817 if (!NT_STATUS_IS_OK(result))
1820 /* We only have users as members, but make the output
1821 the same as the output of alias members */
1823 for (i = 0; i < this_time; i++) {
1825 if (opt_long_list_entries) {
1826 printf("%s-%d %s\\%s %d\n", sid_str,
1827 group_rids[i], domain_name, names[i],
1830 printf("%s\\%s\n", domain_name, names[i]);
1834 num_members -= this_time;
1838 return NT_STATUS_OK;
1842 rpc_list_alias_members(struct cli_state *cli, TALLOC_CTX *mem_ctx,
1843 POLICY_HND *domain_pol, uint32 rid)
1846 POLICY_HND alias_pol, lsa_pol;
1848 DOM_SID *alias_sids;
1854 result = cli_samr_open_alias(cli, mem_ctx, domain_pol,
1855 MAXIMUM_ALLOWED_ACCESS, rid, &alias_pol);
1857 if (!NT_STATUS_IS_OK(result))
1860 result = cli_samr_query_aliasmem(cli, mem_ctx, &alias_pol,
1861 &num_members, &alias_sids);
1863 if (!NT_STATUS_IS_OK(result)) {
1864 d_printf("Couldn't list alias members\n");
1868 if (num_members == 0) {
1869 return NT_STATUS_OK;
1872 cli_nt_session_close(cli);
1874 if (!cli_nt_session_open(cli, PI_LSARPC)) {
1875 d_printf("Couldn't open LSA pipe\n");
1879 result = cli_lsa_open_policy(cli, mem_ctx, True,
1880 SEC_RIGHTS_MAXIMUM_ALLOWED, &lsa_pol);
1882 if (!NT_STATUS_IS_OK(result)) {
1883 d_printf("Couldn't open LSA policy handle\n");
1887 result = cli_lsa_lookup_sids(cli, mem_ctx, &lsa_pol, num_members,
1889 &domains, &names, &types);
1891 if (!NT_STATUS_IS_OK(result) &&
1892 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
1893 d_printf("Couldn't lookup SIDs\n");
1897 for (i = 0; i < num_members; i++) {
1899 sid_to_string(sid_str, &alias_sids[i]);
1901 if (opt_long_list_entries) {
1902 printf("%s %s\\%s %d\n", sid_str,
1903 domains[i] ? domains[i] : "*unknown*",
1904 names[i] ? names[i] : "*unknown*", types[i]);
1907 printf("%s\\%s\n", domains[i], names[i]);
1909 printf("%s\n", sid_str);
1913 return NT_STATUS_OK;
1917 rpc_group_members_internals(const DOM_SID *domain_sid,
1918 const char *domain_name,
1919 struct cli_state *cli,
1920 TALLOC_CTX *mem_ctx, int argc, const char **argv)
1923 POLICY_HND connect_pol, domain_pol;
1924 uint32 num_rids, *rids, *rid_types;
1926 /* Get sam policy handle */
1928 result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
1931 if (!NT_STATUS_IS_OK(result))
1934 /* Get domain policy handle */
1936 result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
1937 MAXIMUM_ALLOWED_ACCESS,
1938 domain_sid, &domain_pol);
1940 if (!NT_STATUS_IS_OK(result))
1943 result = cli_samr_lookup_names(cli, mem_ctx, &domain_pol, 1000,
1944 1, argv, &num_rids, &rids, &rid_types);
1946 if (!NT_STATUS_IS_OK(result)) {
1948 /* Ok, did not find it in the global sam, try with builtin */
1950 DOM_SID sid_Builtin;
1952 cli_samr_close(cli, mem_ctx, &domain_pol);
1954 string_to_sid(&sid_Builtin, "S-1-5-32");
1956 result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
1957 MAXIMUM_ALLOWED_ACCESS,
1958 &sid_Builtin, &domain_pol);
1960 if (!NT_STATUS_IS_OK(result)) {
1961 d_printf("Couldn't find group %s\n", argv[0]);
1965 result = cli_samr_lookup_names(cli, mem_ctx, &domain_pol, 1000,
1969 if (!NT_STATUS_IS_OK(result)) {
1970 d_printf("Couldn't find group %s\n", argv[0]);
1975 if (num_rids != 1) {
1976 d_printf("Couldn't find group %s\n", argv[0]);
1980 if (rid_types[0] == SID_NAME_DOM_GRP) {
1981 return rpc_list_group_members(cli, mem_ctx, domain_name,
1982 domain_sid, &domain_pol,
1986 if (rid_types[0] == SID_NAME_ALIAS) {
1987 return rpc_list_alias_members(cli, mem_ctx, &domain_pol,
1991 return NT_STATUS_NO_SUCH_GROUP;
1994 static int rpc_group_members(int argc, const char **argv)
1997 return rpc_group_usage(argc, argv);
2000 return run_rpc_command(NULL, PI_SAMR, 0,
2001 rpc_group_members_internals,
2006 * 'net rpc group' entrypoint.
2007 * @param argc Standard main() style argc
2008 * @param argc Standard main() style argv. Initial components are already
2012 int net_rpc_group(int argc, const char **argv)
2014 struct functable func[] = {
2015 {"add", rpc_group_add},
2016 {"addmem", rpc_group_addmem},
2017 {"delmem", rpc_group_delmem},
2019 {"delete", rpc_group_delete},
2021 {"list", rpc_group_list},
2022 {"members", rpc_group_members},
2027 if (opt_long_list_entries) {
2030 return run_rpc_command(NULL, PI_SAMR, 0,
2031 rpc_group_list_internals,
2035 return net_run_function(argc, argv, func, rpc_group_usage);
2038 /****************************************************************************/
2040 static int rpc_share_usage(int argc, const char **argv)
2042 return net_help_share(argc, argv);
2046 * Add a share on a remote RPC server
2048 * All parameters are provided by the run_rpc_command function, except for
2049 * argc, argv which are passes through.
2051 * @param domain_sid The domain sid acquired from the remote server
2052 * @param cli A cli_state connected to the server.
2053 * @param mem_ctx Talloc context, destoyed on completion of the function.
2054 * @param argc Standard main() style argc
2055 * @param argv Standard main() style argv. Initial components are already
2058 * @return Normal NTSTATUS return.
2061 rpc_share_add_internals(const DOM_SID *domain_sid, const char *domain_name,
2062 struct cli_state *cli,
2063 TALLOC_CTX *mem_ctx,int argc, const char **argv)
2066 char *sharename=talloc_strdup(mem_ctx, argv[0]);
2068 uint32 type=0; /* only allow disk shares to be added */
2069 uint32 num_users=0, perms=0;
2070 char *password=NULL; /* don't allow a share password */
2072 path = strchr(sharename, '=');
2074 return NT_STATUS_UNSUCCESSFUL;
2077 result = cli_srvsvc_net_share_add(cli, mem_ctx, sharename, type,
2078 opt_comment, perms, opt_maxusers,
2079 num_users, path, password);
2080 return W_ERROR_IS_OK(result) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
2083 static int rpc_share_add(int argc, const char **argv)
2085 if ((argc < 1) || !strchr(argv[0], '=')) {
2086 DEBUG(1,("Sharename or path not specified on add\n"));
2087 return rpc_share_usage(argc, argv);
2089 return run_rpc_command(NULL, PI_SRVSVC, 0,
2090 rpc_share_add_internals,
2095 * Delete a share on a remote RPC server
2097 * All parameters are provided by the run_rpc_command function, except for
2098 * argc, argv which are passes through.
2100 * @param domain_sid The domain sid acquired from the remote server
2101 * @param cli A cli_state connected to the server.
2102 * @param mem_ctx Talloc context, destoyed on completion of the function.
2103 * @param argc Standard main() style argc
2104 * @param argv Standard main() style argv. Initial components are already
2107 * @return Normal NTSTATUS return.
2110 rpc_share_del_internals(const DOM_SID *domain_sid, const char *domain_name,
2111 struct cli_state *cli,
2112 TALLOC_CTX *mem_ctx,int argc, const char **argv)
2116 result = cli_srvsvc_net_share_del(cli, mem_ctx, argv[0]);
2117 return W_ERROR_IS_OK(result) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
2121 * Delete a share on a remote RPC server
2123 * @param domain_sid The domain sid acquired from the remote server
2124 * @param argc Standard main() style argc
2125 * @param argv Standard main() style argv. Initial components are already
2128 * @return A shell status integer (0 for success)
2130 static int rpc_share_delete(int argc, const char **argv)
2133 DEBUG(1,("Sharename not specified on delete\n"));
2134 return rpc_share_usage(argc, argv);
2136 return run_rpc_command(NULL, PI_SRVSVC, 0,
2137 rpc_share_del_internals,
2142 * Formatted print of share info
2144 * @param info1 pointer to SRV_SHARE_INFO_1 to format
2147 static void display_share_info_1(SRV_SHARE_INFO_1 *info1)
2149 fstring netname = "", remark = "";
2151 rpcstr_pull_unistr2_fstring(netname, &info1->info_1_str.uni_netname);
2152 rpcstr_pull_unistr2_fstring(remark, &info1->info_1_str.uni_remark);
2154 if (opt_long_list_entries) {
2155 d_printf("%-12s %-8.8s %-50s\n",
2156 netname, share_type[info1->info_1.type], remark);
2158 d_printf("%s\n", netname);
2164 * List shares on a remote RPC server
2166 * All parameters are provided by the run_rpc_command function, except for
2167 * argc, argv which are passes through.
2169 * @param domain_sid The domain sid acquired from the remote server
2170 * @param cli A cli_state connected to the server.
2171 * @param mem_ctx Talloc context, destoyed on completion of the function.
2172 * @param argc Standard main() style argc
2173 * @param argv Standard main() style argv. Initial components are already
2176 * @return Normal NTSTATUS return.
2180 rpc_share_list_internals(const DOM_SID *domain_sid, const char *domain_name,
2181 struct cli_state *cli,
2182 TALLOC_CTX *mem_ctx, int argc, const char **argv)
2184 SRV_SHARE_INFO_CTR ctr;
2187 uint32 preferred_len = 0xffffffff, i;
2189 init_enum_hnd(&hnd, 0);
2191 result = cli_srvsvc_net_share_enum(
2192 cli, mem_ctx, 1, &ctr, preferred_len, &hnd);
2194 if (!W_ERROR_IS_OK(result))
2197 /* Display results */
2199 if (opt_long_list_entries) {
2201 "\nEnumerating shared resources (exports) on remote server:\n\n"\
2202 "\nShare name Type Description\n"\
2203 "---------- ---- -----------\n");
2205 for (i = 0; i < ctr.num_entries; i++)
2206 display_share_info_1(&ctr.share.info1[i]);
2208 return W_ERROR_IS_OK(result) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
2212 * 'net rpc share' entrypoint.
2213 * @param argc Standard main() style argc
2214 * @param argv Standard main() style argv. Initial components are already
2218 int net_rpc_share(int argc, const char **argv)
2220 struct functable func[] = {
2221 {"add", rpc_share_add},
2222 {"delete", rpc_share_delete},
2227 return run_rpc_command(NULL, PI_SRVSVC, 0,
2228 rpc_share_list_internals,
2231 return net_run_function(argc, argv, func, rpc_share_usage);
2234 /****************************************************************************/
2236 static int rpc_file_usage(int argc, const char **argv)
2238 return net_help_file(argc, argv);
2242 * Close a file on a remote RPC server
2244 * All parameters are provided by the run_rpc_command function, except for
2245 * argc, argv which are passes through.
2247 * @param domain_sid The domain sid acquired from the remote server
2248 * @param cli A cli_state connected to the server.
2249 * @param mem_ctx Talloc context, destoyed on completion of the function.
2250 * @param argc Standard main() style argc
2251 * @param argv Standard main() style argv. Initial components are already
2254 * @return Normal NTSTATUS return.
2257 rpc_file_close_internals(const DOM_SID *domain_sid, const char *domain_name,
2258 struct cli_state *cli,
2259 TALLOC_CTX *mem_ctx, int argc, const char **argv)
2262 result = cli_srvsvc_net_file_close(cli, mem_ctx, atoi(argv[0]));
2263 return W_ERROR_IS_OK(result) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
2267 * Close a file on a remote RPC server
2269 * @param argc Standard main() style argc
2270 * @param argv Standard main() style argv. Initial components are already
2273 * @return A shell status integer (0 for success)
2275 static int rpc_file_close(int argc, const char **argv)
2278 DEBUG(1, ("No fileid given on close\n"));
2279 return(rpc_file_usage(argc, argv));
2282 return run_rpc_command(NULL, PI_SRVSVC, 0,
2283 rpc_file_close_internals,
2288 * Formatted print of open file info
2290 * @param info3 FILE_INFO_3 contents
2291 * @param str3 strings for FILE_INFO_3
2294 static void display_file_info_3(FILE_INFO_3 *info3, FILE_INFO_3_STR *str3)
2296 fstring user = "", path = "";
2298 rpcstr_pull_unistr2_fstring(user, &str3->uni_user_name);
2299 rpcstr_pull_unistr2_fstring(path, &str3->uni_path_name);
2301 d_printf("%-7.1d %-20.20s 0x%-4.2x %-6.1d %s\n",
2302 info3->id, user, info3->perms, info3->num_locks, path);
2306 * List open files on a remote RPC server
2308 * All parameters are provided by the run_rpc_command function, except for
2309 * argc, argv which are passes through.
2311 * @param domain_sid The domain sid acquired from the remote server
2312 * @param cli A cli_state connected to the server.
2313 * @param mem_ctx Talloc context, destoyed on completion of the function.
2314 * @param argc Standard main() style argc
2315 * @param argv Standard main() style argv. Initial components are already
2318 * @return Normal NTSTATUS return.
2322 rpc_file_list_internals(const DOM_SID *domain_sid, const char *domain_name,
2323 struct cli_state *cli,
2324 TALLOC_CTX *mem_ctx, int argc, const char **argv)
2326 SRV_FILE_INFO_CTR ctr;
2329 uint32 preferred_len = 0xffffffff, i;
2330 const char *username=NULL;
2332 init_enum_hnd(&hnd, 0);
2334 /* if argc > 0, must be user command */
2336 username = smb_xstrdup(argv[0]);
2338 result = cli_srvsvc_net_file_enum(
2339 cli, mem_ctx, 3, username, &ctr, preferred_len, &hnd);
2341 if (!W_ERROR_IS_OK(result))
2344 /* Display results */
2347 "\nEnumerating open files on remote server:\n\n"\
2348 "\nFileId Opened by Perms Locks Path"\
2349 "\n------ --------- ----- ----- ---- \n");
2350 for (i = 0; i < ctr.num_entries; i++)
2351 display_file_info_3(&ctr.file.info3[i].info_3,
2352 &ctr.file.info3[i].info_3_str);
2354 return W_ERROR_IS_OK(result) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
2359 * List files for a user on a remote RPC server
2361 * @param argc Standard main() style argc
2362 * @param argv Standard main() style argv. Initial components are already
2365 * @return A shell status integer (0 for success)
2367 static int rpc_file_user(int argc, const char **argv)
2370 DEBUG(1, ("No username given\n"));
2371 return(rpc_file_usage(argc, argv));
2374 return run_rpc_command(NULL, PI_SRVSVC, 0,
2375 rpc_file_list_internals,
2381 * 'net rpc file' entrypoint.
2382 * @param argc Standard main() style argc
2383 * @param argv Standard main() style argv. Initial components are already
2387 int net_rpc_file(int argc, const char **argv)
2389 struct functable func[] = {
2390 {"close", rpc_file_close},
2391 {"user", rpc_file_user},
2393 {"info", rpc_file_info},
2399 return run_rpc_command(NULL, PI_SRVSVC, 0,
2400 rpc_file_list_internals,
2403 return net_run_function(argc, argv, func, rpc_file_usage);
2406 /****************************************************************************/
2411 * ABORT the shutdown of a remote RPC Server over, initshutdown pipe
2413 * All parameters are provided by the run_rpc_command function, except for
2414 * argc, argv which are passed through.
2416 * @param domain_sid The domain sid aquired from the remote server
2417 * @param cli A cli_state connected to the server.
2418 * @param mem_ctx Talloc context, destoyed on compleation of the function.
2419 * @param argc Standard main() style argc
2420 * @param argv Standard main() style argv. Initial components are already
2423 * @return Normal NTSTATUS return.
2426 static NTSTATUS rpc_shutdown_abort_internals(const DOM_SID *domain_sid,
2427 const char *domain_name,
2428 struct cli_state *cli,
2429 TALLOC_CTX *mem_ctx,
2430 int argc, const char **argv)
2432 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2434 result = cli_shutdown_abort(cli, mem_ctx);
2436 if (NT_STATUS_IS_OK(result))
2437 DEBUG(5,("cmd_shutdown_abort: query succeeded\n"));
2439 DEBUG(5,("cmd_shutdown_abort: query failed\n"));
2446 * ABORT the shutdown of a remote RPC Server, over winreg pipe
2448 * All parameters are provided by the run_rpc_command function, except for
2449 * argc, argv which are passed through.
2451 * @param domain_sid The domain sid aquired from the remote server
2452 * @param cli A cli_state connected to the server.
2453 * @param mem_ctx Talloc context, destoyed on compleation of the function.
2454 * @param argc Standard main() style argc
2455 * @param argv Standard main() style argv. Initial components are already
2458 * @return Normal NTSTATUS return.
2461 static NTSTATUS rpc_reg_shutdown_abort_internals(const DOM_SID *domain_sid,
2462 const char *domain_name,
2463 struct cli_state *cli,
2464 TALLOC_CTX *mem_ctx,
2465 int argc, const char **argv)
2467 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2469 result = cli_reg_abort_shutdown(cli, mem_ctx);
2471 if (NT_STATUS_IS_OK(result))
2472 DEBUG(5,("cmd_reg_abort_shutdown: query succeeded\n"));
2474 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
2480 * ABORT the Shut down of a remote RPC server
2482 * @param argc Standard main() style argc
2483 * @param argv Standard main() style argv. Initial components are already
2486 * @return A shell status integer (0 for success)
2489 static int rpc_shutdown_abort(int argc, const char **argv)
2491 int rc = run_rpc_command(NULL, PI_SHUTDOWN, 0,
2492 rpc_shutdown_abort_internals,
2498 DEBUG(1, ("initshutdown pipe didn't work, trying winreg pipe\n"));
2500 return run_rpc_command(NULL, PI_WINREG, 0,
2501 rpc_reg_shutdown_abort_internals,
2506 * Shut down a remote RPC Server
2508 * All parameters are provided by the run_rpc_command function, except for
2509 * argc, argv which are passes through.
2511 * @param domain_sid The domain sid aquired from the remote server
2512 * @param cli A cli_state connected to the server.
2513 * @param mem_ctx Talloc context, destoyed on compleation of the function.
2514 * @param argc Standard main() style argc
2515 * @param argc Standard main() style argv. Initial components are already
2518 * @return Normal NTSTATUS return.
2521 static NTSTATUS rpc_shutdown_internals(const DOM_SID *domain_sid,
2522 const char *domain_name,
2523 struct cli_state *cli, TALLOC_CTX *mem_ctx,
2524 int argc, const char **argv)
2526 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2527 const char *msg = "This machine will be shutdown shortly";
2528 uint32 timeout = 20;
2533 struct poptOption long_options[] = {
2534 {"message", 'm', POPT_ARG_STRING, &msg},
2535 {"timeout", 't', POPT_ARG_INT, &timeout},
2536 {"reboot", 'r', POPT_ARG_NONE, &reboot},
2537 {"force", 'f', POPT_ARG_NONE, &force},
2541 pc = poptGetContext(NULL, argc, (const char **) argv, long_options,
2542 POPT_CONTEXT_KEEP_FIRST);
2544 rc = poptGetNextOpt(pc);
2547 /* an error occurred during option processing */
2548 DEBUG(0, ("%s: %s\n",
2549 poptBadOption(pc, POPT_BADOPTION_NOALIAS),
2551 return NT_STATUS_INVALID_PARAMETER;
2558 timeout = opt_timeout;
2561 /* create an entry */
2562 result = cli_reg_shutdown(cli, mem_ctx, msg, timeout, opt_reboot, opt_force);
2564 if (NT_STATUS_IS_OK(result))
2565 DEBUG(5,("Shutdown of remote machine succeeded\n"));
2567 DEBUG(0,("Shutdown of remote machine failed!\n"));
2573 * Shut down a remote RPC server
2575 * @param argc Standard main() style argc
2576 * @param argc Standard main() style argv. Initial components are already
2579 * @return A shell status integer (0 for success)
2582 static int rpc_shutdown(int argc, const char **argv)
2584 return run_rpc_command(NULL, PI_WINREG, 0, rpc_shutdown_internals,
2588 /***************************************************************************
2589 NT Domain trusts code (i.e. 'net rpc trustdom' functionality)
2591 ***************************************************************************/
2594 * Add interdomain trust account to the RPC server.
2595 * All parameters (except for argc and argv) are passed by run_rpc_command
2598 * @param domain_sid The domain sid acquired from the server
2599 * @param cli A cli_state connected to the server.
2600 * @param mem_ctx Talloc context, destoyed on completion of the function.
2601 * @param argc Standard main() style argc
2602 * @param argc Standard main() style argv. Initial components are already
2605 * @return normal NTSTATUS return code
2608 static NTSTATUS rpc_trustdom_add_internals(const DOM_SID *domain_sid,
2609 const char *domain_name,
2610 struct cli_state *cli, TALLOC_CTX *mem_ctx,
2611 int argc, const char **argv) {
2613 POLICY_HND connect_pol, domain_pol, user_pol;
2614 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2617 uint32 unknown, user_rid;
2620 d_printf("Usage: net rpc trustdom add <domain_name> <pw>\n");
2621 return NT_STATUS_INVALID_PARAMETER;
2625 * Make valid trusting domain account (ie. uppercased and with '$' appended)
2628 if (asprintf(&acct_name, "%s$", argv[0]) < 0) {
2629 return NT_STATUS_NO_MEMORY;
2632 strupper_m(acct_name);
2634 /* Get samr policy handle */
2635 result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
2637 if (!NT_STATUS_IS_OK(result)) {
2641 /* Get domain policy handle */
2642 result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
2643 MAXIMUM_ALLOWED_ACCESS,
2644 domain_sid, &domain_pol);
2645 if (!NT_STATUS_IS_OK(result)) {
2649 /* Create trusting domain's account */
2650 acb_info = ACB_DOMTRUST;
2651 unknown = 0xe00500b0; /* No idea what this is - a permission mask?
2652 mimir: yes, most probably it is */
2654 result = cli_samr_create_dom_user(cli, mem_ctx, &domain_pol,
2655 acct_name, acb_info, unknown,
2656 &user_pol, &user_rid);
2657 if (!NT_STATUS_IS_OK(result)) {
2662 SAM_USERINFO_CTR ctr;
2663 SAM_USER_INFO_24 p24;
2666 encode_pw_buffer((char *)pwbuf, argv[1], STR_UNICODE);
2671 init_sam_user_info24(&p24, (char *)pwbuf, 24);
2673 ctr.switch_value = 24;
2674 ctr.info.id24 = &p24;
2676 result = cli_samr_set_userinfo(cli, mem_ctx, &user_pol, 24,
2677 &cli->user_session_key, &ctr);
2679 if (!NT_STATUS_IS_OK(result)) {
2680 DEBUG(0,("Could not set trust account password: %s\n",
2681 nt_errstr(result)));
2687 SAFE_FREE(acct_name);
2692 * Create interdomain trust account for a remote domain.
2694 * @param argc standard argc
2695 * @param argv standard argv without initial components
2697 * @return Integer status (0 means success)
2700 static int rpc_trustdom_add(int argc, const char **argv)
2703 return run_rpc_command(NULL, PI_SAMR, 0, rpc_trustdom_add_internals,
2706 d_printf("Usage: net rpc trustdom add <domain>\n");
2713 * Delete interdomain trust account for a remote domain.
2715 * @param argc standard argc
2716 * @param argv standard argv without initial components
2718 * @return Integer status (0 means success)
2721 static int rpc_trustdom_del(int argc, const char **argv)
2723 d_printf("Sorry, not yet implemented.\n");
2724 d_printf("Use 'smbpasswd -x -i' instead.\n");
2730 * Establish trust relationship to a trusting domain.
2731 * Interdomain account must already be created on remote PDC.
2733 * @param argc standard argc
2734 * @param argv standard argv without initial components
2736 * @return Integer status (0 means success)
2739 static int rpc_trustdom_establish(int argc, const char **argv)
2741 struct cli_state *cli;
2742 struct in_addr server_ip;
2743 POLICY_HND connect_hnd;
2744 TALLOC_CTX *mem_ctx;
2746 DOM_SID *domain_sid;
2747 WKS_INFO_100 wks_info;
2750 char* domain_name_pol;
2755 * Connect to \\server\ipc$ as 'our domain' account with password
2759 d_printf("Usage: net rpc trustdom establish <domain_name>\n");
2763 domain_name = smb_xstrdup(argv[0]);
2764 strupper_m(domain_name);
2766 /* account name used at first is our domain's name with '$' */
2767 asprintf(&acct_name, "%s$", lp_workgroup());
2768 strupper_m(acct_name);
2771 * opt_workgroup will be used by connection functions further,
2772 * hence it should be set to remote domain name instead of ours
2774 if (opt_workgroup) {
2775 opt_workgroup = smb_xstrdup(domain_name);
2778 opt_user_name = acct_name;
2780 /* find the domain controller */
2781 if (!net_find_pdc(&server_ip, pdc_name, domain_name)) {
2782 DEBUG(0, ("Couldn't find domain controller for domain %s\n", domain_name));
2786 /* connect to ipc$ as username/password */
2787 nt_status = connect_to_ipc(&cli, &server_ip, pdc_name);
2788 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT)) {
2790 /* Is it trusting domain account for sure ? */
2791 DEBUG(0, ("Couldn't verify trusting domain account. Error was %s\n",
2792 nt_errstr(nt_status)));
2797 * Connect to \\server\ipc$ again (this time anonymously)
2800 nt_status = connect_to_ipc_anonymous(&cli, &server_ip, (char*)pdc_name);
2802 if (NT_STATUS_IS_ERR(nt_status)) {
2803 DEBUG(0, ("Couldn't connect to domain %s controller. Error was %s.\n",
2804 domain_name, nt_errstr(nt_status)));
2808 * Use NetServerEnum2 to make sure we're talking to a proper server
2811 if (!cli_get_pdc_name(cli, domain_name, (char*)pdc_name)) {
2812 DEBUG(0, ("NetServerEnum2 error: Couldn't find primary domain controller\
2813 for domain %s\n", domain_name));
2817 * Call WksQueryInfo to check remote server's capabilities
2818 * note: It is now used only to get unicode domain name
2821 if (!cli_nt_session_open(cli, PI_WKSSVC)) {
2822 DEBUG(0, ("Couldn't not initialise wkssvc pipe\n"));
2826 if (!(mem_ctx = talloc_init("establishing trust relationship to domain %s",
2828 DEBUG(0, ("talloc_init() failed\n"));
2833 nt_status = cli_wks_query_info(cli, mem_ctx, &wks_info);
2835 if (NT_STATUS_IS_ERR(nt_status)) {
2836 DEBUG(0, ("WksQueryInfo call failed.\n"));
2840 if (cli->nt_pipe_fnum)
2841 cli_nt_session_close(cli);
2845 * Call LsaOpenPolicy and LsaQueryInfo
2848 if (!(mem_ctx = talloc_init("rpc_trustdom_establish"))) {
2849 DEBUG(0, ("talloc_init() failed\n"));
2854 if (!cli_nt_session_open(cli, PI_LSARPC)) {
2855 DEBUG(0, ("Could not initialise lsa pipe\n"));
2860 nt_status = cli_lsa_open_policy2(cli, mem_ctx, True, SEC_RIGHTS_QUERY_VALUE,
2862 if (NT_STATUS_IS_ERR(nt_status)) {
2863 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
2864 nt_errstr(nt_status)));
2868 /* Querying info level 5 */
2870 nt_status = cli_lsa_query_info_policy(cli, mem_ctx, &connect_hnd,
2871 5 /* info level */, &domain_name_pol,
2873 if (NT_STATUS_IS_ERR(nt_status)) {
2874 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
2875 nt_errstr(nt_status)));
2882 /* There should be actually query info level 3 (following nt serv behaviour),
2883 but I still don't know if it's _really_ necessary */
2886 * Store the password in secrets db
2889 if (!secrets_store_trusted_domain_password(domain_name, wks_info.uni_lan_grp.buffer,
2890 wks_info.uni_lan_grp.uni_str_len, opt_password,
2892 DEBUG(0, ("Storing password for trusted domain failed.\n"));
2897 * Close the pipes and clean up
2900 nt_status = cli_lsa_close(cli, mem_ctx, &connect_hnd);
2901 if (NT_STATUS_IS_ERR(nt_status)) {
2902 DEBUG(0, ("Couldn't close LSA pipe. Error was %s\n",
2903 nt_errstr(nt_status)));
2907 if (cli->nt_pipe_fnum)
2908 cli_nt_session_close(cli);
2910 talloc_destroy(mem_ctx);
2912 DEBUG(0, ("Success!\n"));
2917 * Revoke trust relationship to the remote domain
2919 * @param argc standard argc
2920 * @param argv standard argv without initial components
2922 * @return Integer status (0 means success)
2925 static int rpc_trustdom_revoke(int argc, const char **argv)
2929 if (argc < 1) return -1;
2931 /* generate upper cased domain name */
2932 domain_name = smb_xstrdup(argv[0]);
2933 strupper_m(domain_name);
2935 /* delete password of the trust */
2936 if (!trusted_domain_password_delete(domain_name)) {
2937 DEBUG(0, ("Failed to revoke relationship to the trusted domain %s\n",
2946 * Usage for 'net rpc trustdom' command
2948 * @param argc standard argc
2949 * @param argv standard argv without inital components
2951 * @return Integer status returned to shell
2954 static int rpc_trustdom_usage(int argc, const char **argv)
2956 d_printf(" net rpc trustdom add \t\t add trusting domain's account\n");
2957 d_printf(" net rpc trustdom del \t\t delete trusting domain's account\n");
2958 d_printf(" net rpc trustdom establish \t establish relationship to trusted domain\n");
2959 d_printf(" net rpc trustdom revoke \t abandon relationship to trusted domain\n");
2960 d_printf(" net rpc trustdom list \t show current interdomain trust relationships\n");
2965 static NTSTATUS rpc_query_domain_sid(const DOM_SID *domain_sid,
2966 const char *domain_name,
2967 struct cli_state *cli, TALLOC_CTX *mem_ctx,
2968 int argc, const char **argv)
2971 sid_to_string(str_sid, domain_sid);
2972 d_printf("%s\n", str_sid);
2973 return NT_STATUS_OK;
2977 static int rpc_trustdom_list(int argc, const char **argv)
2979 /* common variables */
2980 TALLOC_CTX* mem_ctx;
2981 struct cli_state *cli, *remote_cli;
2983 const char *domain_name = NULL;
2984 DOM_SID *queried_dom_sid;
2985 fstring ascii_sid, padding;
2986 int ascii_dom_name_len;
2987 POLICY_HND connect_hnd;
2989 /* trusted domains listing variables */
2990 unsigned int num_domains, enum_ctx = 0;
2991 int i, pad_len, col_len = 20;
2992 DOM_SID *domain_sids;
2993 char **trusted_dom_names;
2997 /* trusting domains listing variables */
2998 POLICY_HND domain_hnd;
2999 char **trusting_dom_names;
3000 uint32 *trusting_dom_rids;
3003 * Listing trusted domains (stored in secrets.tdb, if local)
3006 mem_ctx = talloc_init("trust relationships listing");
3009 * set domain and pdc name to local samba server (default)
3010 * or to remote one given in command line
3013 if (StrCaseCmp(opt_workgroup, lp_workgroup())) {
3014 domain_name = opt_workgroup;
3015 opt_target_workgroup = opt_workgroup;
3017 fstrcpy(pdc_name, global_myname());
3018 domain_name = talloc_strdup(mem_ctx, lp_workgroup());
3019 opt_target_workgroup = domain_name;
3022 /* open \PIPE\lsarpc and open policy handle */
3023 if (!(cli = net_make_ipc_connection(NET_FLAGS_PDC))) {
3024 DEBUG(0, ("Couldn't connect to domain controller\n"));
3028 if (!cli_nt_session_open(cli, PI_LSARPC)) {
3029 DEBUG(0, ("Could not initialise lsa pipe\n"));
3033 nt_status = cli_lsa_open_policy2(cli, mem_ctx, False, SEC_RIGHTS_QUERY_VALUE,
3035 if (NT_STATUS_IS_ERR(nt_status)) {
3036 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
3037 nt_errstr(nt_status)));
3041 /* query info level 5 to obtain sid of a domain being queried */
3042 nt_status = cli_lsa_query_info_policy(
3043 cli, mem_ctx, &connect_hnd, 5 /* info level */,
3044 &dummy, &queried_dom_sid);
3046 if (NT_STATUS_IS_ERR(nt_status)) {
3047 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
3048 nt_errstr(nt_status)));
3053 * Keep calling LsaEnumTrustdom over opened pipe until
3054 * the end of enumeration is reached
3057 d_printf("Trusted domains list:\n\n");
3060 nt_status = cli_lsa_enum_trust_dom(cli, mem_ctx, &connect_hnd, &enum_ctx,
3062 &trusted_dom_names, &domain_sids);
3064 if (NT_STATUS_IS_ERR(nt_status)) {
3065 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
3066 nt_errstr(nt_status)));
3070 for (i = 0; i < num_domains; i++) {
3071 /* convert sid into ascii string */
3072 sid_to_string(ascii_sid, &(domain_sids[i]));
3074 /* calculate padding space for d_printf to look nicer */
3075 pad_len = col_len - strlen(trusted_dom_names[i]);
3076 padding[pad_len] = 0;
3077 do padding[--pad_len] = ' '; while (pad_len);
3079 d_printf("%s%s%s\n", trusted_dom_names[i], padding, ascii_sid);
3083 * in case of no trusted domains say something rather
3084 * than just display blank line
3086 if (!num_domains) d_printf("none\n");
3088 } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
3090 /* close this connection before doing next one */
3091 nt_status = cli_lsa_close(cli, mem_ctx, &connect_hnd);
3092 if (NT_STATUS_IS_ERR(nt_status)) {
3093 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
3094 nt_errstr(nt_status)));
3098 cli_nt_session_close(cli);
3101 * Listing trusting domains (stored in passdb backend, if local)
3104 d_printf("\nTrusting domains list:\n\n");
3107 * Open \PIPE\samr and get needed policy handles
3109 if (!cli_nt_session_open(cli, PI_SAMR)) {
3110 DEBUG(0, ("Could not initialise samr pipe\n"));
3115 nt_status = cli_samr_connect(cli, mem_ctx, SA_RIGHT_SAM_OPEN_DOMAIN,
3117 if (!NT_STATUS_IS_OK(nt_status)) {
3118 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
3119 nt_errstr(nt_status)));
3123 /* SamrOpenDomain - we have to open domain policy handle in order to be
3124 able to enumerate accounts*/
3125 nt_status = cli_samr_open_domain(cli, mem_ctx, &connect_hnd,
3126 SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
3127 queried_dom_sid, &domain_hnd);
3128 if (!NT_STATUS_IS_OK(nt_status)) {
3129 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
3130 nt_errstr(nt_status)));
3135 * perform actual enumeration
3138 enum_ctx = 0; /* reset enumeration context from last enumeration */
3141 nt_status = cli_samr_enum_dom_users(cli, mem_ctx, &domain_hnd,
3142 &enum_ctx, ACB_DOMTRUST, 0xffff,
3143 &trusting_dom_names, &trusting_dom_rids,
3145 if (NT_STATUS_IS_ERR(nt_status)) {
3146 DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
3147 nt_errstr(nt_status)));
3151 for (i = 0; i < num_domains; i++) {
3154 * get each single domain's sid (do we _really_ need this ?):
3155 * 1) connect to domain's pdc
3156 * 2) query the pdc for domain's sid
3159 /* get rid of '$' tail */
3160 ascii_dom_name_len = strlen(trusting_dom_names[i]);
3161 if (ascii_dom_name_len && ascii_dom_name_len < FSTRING_LEN)
3162 trusting_dom_names[i][ascii_dom_name_len - 1] = '\0';
3164 /* calculate padding space for d_printf to look nicer */
3165 pad_len = col_len - strlen(trusting_dom_names[i]);
3166 padding[pad_len] = 0;
3167 do padding[--pad_len] = ' '; while (pad_len);
3169 /* set opt_* variables to remote domain */
3170 strupper_m(trusting_dom_names[i]);
3171 opt_workgroup = talloc_strdup(mem_ctx, trusting_dom_names[i]);
3172 opt_target_workgroup = opt_workgroup;
3174 d_printf("%s%s", trusting_dom_names[i], padding);
3176 /* connect to remote domain controller */
3177 remote_cli = net_make_ipc_connection(NET_FLAGS_PDC | NET_FLAGS_ANONYMOUS);
3179 /* query for domain's sid */
3180 if (run_rpc_command(remote_cli, PI_LSARPC, 0, rpc_query_domain_sid, argc, argv))
3181 d_printf("couldn't get domain's sid\n");
3183 cli_shutdown(remote_cli);
3186 d_printf("domain controller is not responding\n");
3190 if (!num_domains) d_printf("none\n");
3192 } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
3194 /* close opened samr and domain policy handles */
3195 nt_status = cli_samr_close(cli, mem_ctx, &domain_hnd);
3196 if (!NT_STATUS_IS_OK(nt_status)) {
3197 DEBUG(0, ("Couldn't properly close domain policy handle for domain %s\n", domain_name));
3200 nt_status = cli_samr_close(cli, mem_ctx, &connect_hnd);
3201 if (!NT_STATUS_IS_OK(nt_status)) {
3202 DEBUG(0, ("Couldn't properly close samr policy handle for domain %s\n", domain_name));
3205 /* close samr pipe and connection to IPC$ */
3206 cli_nt_session_close(cli);
3209 talloc_destroy(mem_ctx);
3214 * Entrypoint for 'net rpc trustdom' code
3216 * @param argc standard argc
3217 * @param argv standard argv without initial components
3219 * @return Integer status (0 means success)
3222 static int rpc_trustdom(int argc, const char **argv)
3224 struct functable func[] = {
3225 {"add", rpc_trustdom_add},
3226 {"del", rpc_trustdom_del},
3227 {"establish", rpc_trustdom_establish},
3228 {"revoke", rpc_trustdom_revoke},
3229 {"help", rpc_trustdom_usage},
3230 {"list", rpc_trustdom_list},
3235 rpc_trustdom_usage(argc, argv);
3239 return (net_run_function(argc, argv, func, rpc_user_usage));
3243 * Check if a server will take rpc commands
3244 * @param flags Type of server to connect to (PDC, DMB, localhost)
3245 * if the host is not explicitly specified
3246 * @return BOOL (true means rpc supported)
3248 BOOL net_rpc_check(unsigned flags)
3250 struct cli_state cli;
3252 struct in_addr server_ip;
3253 char *server_name = NULL;
3255 /* flags (i.e. server type) may depend on command */
3256 if (!net_find_server(flags, &server_ip, &server_name))
3260 if (cli_initialise(&cli) == False)
3263 if (!cli_connect(&cli, server_name, &server_ip))
3265 if (!attempt_netbios_session_request(&cli, global_myname(),
3266 server_name, &server_ip))
3268 if (!cli_negprot(&cli))
3270 if (cli.protocol < PROTOCOL_NT1)
3279 /* dump sam database via samsync rpc calls */
3280 static int rpc_samdump(int argc, const char **argv) {
3281 return run_rpc_command(NULL, PI_NETLOGON, NET_FLAGS_ANONYMOUS, rpc_samdump_internals,
3285 /* syncronise sam database via samsync rpc calls */
3286 static int rpc_vampire(int argc, const char **argv) {
3287 return run_rpc_command(NULL, PI_NETLOGON, NET_FLAGS_ANONYMOUS, rpc_vampire_internals,
3290 /****************************************************************************/
3294 * Basic usage function for 'net rpc'
3295 * @param argc Standard main() style argc
3296 * @param argv Standard main() style argv. Initial components are already
3300 int net_rpc_usage(int argc, const char **argv)
3302 d_printf(" net rpc info \t\t\tshow basic info about a domain \n");
3303 d_printf(" net rpc join \t\t\tto join a domain \n");
3304 d_printf(" net rpc oldjoin \t\t\tto join a domain created in server manager\n\n\n");
3305 d_printf(" net rpc testjoin \t\ttests that a join is valid\n");
3306 d_printf(" net rpc user \t\t\tto add, delete and list users\n");
3307 d_printf(" net rpc password <username> [<password>] -Uadmin_username%%admin_pass");
3308 d_printf(" net rpc group \t\tto list groups\n");
3309 d_printf(" net rpc share \t\tto add, delete, and list shares\n");
3310 d_printf(" net rpc file \t\t\tto list open files\n");
3311 d_printf(" net rpc changetrustpw \tto change the trust account password\n");
3312 d_printf(" net rpc getsid \t\tfetch the domain sid into the local secrets.tdb\n");
3313 d_printf(" net rpc vampire \t\tsyncronise an NT PDC's users and groups into the local passdb\n");
3314 d_printf(" net rpc samdump \t\tdiplay an NT PDC's users, groups and other data\n");
3315 d_printf(" net rpc trustdom \t\tto create trusting domain's account\n"
3316 "\t\t\t\t\tor establish trust\n");
3317 d_printf(" net rpc abortshutdown \tto abort the shutdown of a remote server\n");
3318 d_printf(" net rpc shutdown \t\tto shutdown a remote server\n");
3320 d_printf("'net rpc shutdown' also accepts the following miscellaneous options:\n"); /* misc options */
3321 d_printf("\t-r or --reboot\trequest remote server reboot on shutdown\n");
3322 d_printf("\t-f or --force\trequest the remote server force its shutdown\n");
3323 d_printf("\t-t or --timeout=<timeout>\tnumber of seconds before shutdown\n");
3324 d_printf("\t-c or --comment=<message>\ttext message to display on impending shutdown\n");
3330 * Help function for 'net rpc'. Calls command specific help if requested
3331 * or displays usage of net rpc
3332 * @param argc Standard main() style argc
3333 * @param argv Standard main() style argv. Initial components are already
3337 int net_rpc_help(int argc, const char **argv)
3339 struct functable func[] = {
3340 {"join", rpc_join_usage},
3341 {"user", rpc_user_usage},
3342 {"group", rpc_group_usage},
3343 {"share", rpc_share_usage},
3344 /*{"changetrustpw", rpc_changetrustpw_usage}, */
3345 {"trustdom", rpc_trustdom_usage},
3346 /*{"abortshutdown", rpc_shutdown_abort_usage},*/
3347 /*{"shutdown", rpc_shutdown_usage}, */
3352 net_rpc_usage(argc, argv);
3356 return (net_run_function(argc, argv, func, rpc_user_usage));
3361 * 'net rpc' entrypoint.
3362 * @param argc Standard main() style argc
3363 * @param argv Standard main() style argv. Initial components are already
3367 int net_rpc(int argc, const char **argv)
3369 struct functable func[] = {
3370 {"info", net_rpc_info},
3371 {"join", net_rpc_join},
3372 {"oldjoin", net_rpc_oldjoin},
3373 {"testjoin", net_rpc_testjoin},
3374 {"user", net_rpc_user},
3375 {"password", rpc_user_password},
3376 {"group", net_rpc_group},
3377 {"share", net_rpc_share},
3378 {"file", net_rpc_file},
3379 {"changetrustpw", net_rpc_changetrustpw},
3380 {"trustdom", rpc_trustdom},
3381 {"abortshutdown", rpc_shutdown_abort},
3382 {"shutdown", rpc_shutdown},
3383 {"samdump", rpc_samdump},
3384 {"vampire", rpc_vampire},
3385 {"getsid", net_rpc_getsid},
3386 {"help", net_rpc_help},
3389 return net_run_function(argc, argv, func, net_rpc_usage);