source4/scripting/python/samba/provision.py

   1 #
   2 # Unix SMB/CIFS implementation.
   3 # backend code for provisioning a Samba4 server
   4
   5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
   6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
   7 #
   8 # Based on the original in EJS:
   9 # Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
  10 #
  11 # This program is free software; you can redistribute it and/or modify
  12 # it under the terms of the GNU General Public License as published by
  13 # the Free Software Foundation; either version 3 of the License, or
  14 # (at your option) any later version.
  15 #
  16 # This program is distributed in the hope that it will be useful,
  17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19 # GNU General Public License for more details.
  20 #
  21 # You should have received a copy of the GNU General Public License
  22 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 #
  24
  25 """Functions for setting up a Samba configuration."""
  26
  27 from base64 import b64encode
  28 import os
  29 import pwd
  30 import grp
  31 import time
  32 import uuid, misc
  33 import socket
  34 import param
  35 import registry
  36 import samba
  37 from auth import system_session
  38 from samba import Ldb, substitute_var, valid_netbios_name, check_all_substituted
  39 from samba.samdb import SamDB
  40 from samba.idmap import IDmapDB
  41 import security
  42 import urllib
  43 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, \
  44         LDB_ERR_NO_SUCH_OBJECT, timestring, CHANGETYPE_MODIFY, CHANGETYPE_NONE
  45
  46 __docformat__ = "restructuredText"
  47
  48 DEFAULTSITE = "Default-First-Site-Name"
  49
  50 class InvalidNetbiosName(Exception):
  51     """A specified name was not a valid NetBIOS name."""
  52     def __init__(self, name):
  53         super(InvalidNetbiosName, self).__init__("The name '%r' is not a valid NetBIOS name" % name)
  54
  55
  56 class ProvisionPaths(object):
  57     def __init__(self):
  58         self.shareconf = None
  59         self.hklm = None
  60         self.hkcu = None
  61         self.hkcr = None
  62         self.hku = None
  63         self.hkpd = None
  64         self.hkpt = None
  65         self.samdb = None
  66         self.idmapdb = None
  67         self.secrets = None
  68         self.keytab = None
  69         self.dns_keytab = None
  70         self.dns = None
  71         self.winsdb = None
  72         self.private_dir = None
  73         self.ldapdir = None
  74         self.slapdconf = None
  75         self.modulesconf = None
  76         self.memberofconf = None
  77         self.fedoradsinf = None
  78         self.fedoradspartitions = None
  79         self.olmmron = None
  80         self.olmmrserveridsconf = None
  81         self.olmmrsyncreplconf = None
  82
  83 class ProvisionNames(object):
  84     def __init__(self):
  85         self.rootdn = None
  86         self.domaindn = None
  87         self.configdn = None
  88         self.schemadn = None
  89         self.ldapmanagerdn = None
  90         self.dnsdomain = None
  91         self.realm = None
  92         self.netbiosname = None
  93         self.domain = None
  94         self.hostname = None
  95         self.sitename = None
  96         self.smbconf = None
  97
  98
  99 class ProvisionResult(object):
 100     def __init__(self):
 101         self.paths = None
 102         self.domaindn = None
 103         self.lp = None
 104         self.samdb = None
 105
 106 def check_install(lp, session_info, credentials):
 107     """Check whether the current install seems ok.
 108
 109     :param lp: Loadparm context
 110     :param session_info: Session information
 111     :param credentials: Credentials
 112     """
 113     if lp.get("realm") == "":
 114         raise Exception("Realm empty")
 115     ldb = Ldb(lp.get("sam database"), session_info=session_info,
 116             credentials=credentials, lp=lp)
 117     if len(ldb.search("(cn=Administrator)")) != 1:
 118         raise "No administrator account found"
 119
 120
 121 def findnss(nssfn, names):
 122     """Find a user or group from a list of possibilities.
 123
 124     :param nssfn: NSS Function to try (should raise KeyError if not found)
 125     :param names: Names to check.
 126     :return: Value return by first names list.
 127     """
 128     for name in names:
 129         try:
 130             return nssfn(name)
 131         except KeyError:
 132             pass
 133     raise KeyError("Unable to find user/group %r" % names)
 134
 135
 136 findnss_uid = lambda names: findnss(pwd.getpwnam, names)[2]
 137 findnss_gid = lambda names: findnss(grp.getgrnam, names)[2]
 138
 139
 140 def read_and_sub_file(file, subst_vars):
 141     """Read a file and sub in variables found in it
 142
 143     :param file: File to be read (typically from setup directory)
 144      param subst_vars: Optional variables to subsitute in the file.
 145     """
 146     data = open(file, 'r').read()
 147     if subst_vars is not None:
 148         data = substitute_var(data, subst_vars)
 149     check_all_substituted(data)
 150     return data
 151
 152
 153 def setup_add_ldif(ldb, ldif_path, subst_vars=None):
 154     """Setup a ldb in the private dir.
 155
 156     :param ldb: LDB file to import data into
 157     :param ldif_path: Path of the LDIF file to load
 158     :param subst_vars: Optional variables to subsitute in LDIF.
 159     """
 160     assert isinstance(ldif_path, str)
 161
 162     data = read_and_sub_file(ldif_path, subst_vars)
 163     ldb.add_ldif(data)
 164
 165
 166 def setup_modify_ldif(ldb, ldif_path, subst_vars=None):
 167     """Modify a ldb in the private dir.
 168
 169     :param ldb: LDB object.
 170     :param ldif_path: LDIF file path.
 171     :param subst_vars: Optional dictionary with substitution variables.
 172     """
 173     data = read_and_sub_file(ldif_path, subst_vars)
 174
 175     ldb.modify_ldif(data)
 176
 177
 178 def setup_ldb(ldb, ldif_path, subst_vars):
 179     """Import a LDIF a file into a LDB handle, optionally substituting variables.
 180
 181     :note: Either all LDIF data will be added or none (using transactions).
 182
 183     :param ldb: LDB file to import into.
 184     :param ldif_path: Path to the LDIF file.
 185     :param subst_vars: Dictionary with substitution variables.
 186     """
 187     assert ldb is not None
 188     ldb.transaction_start()
 189     try:
 190         setup_add_ldif(ldb, ldif_path, subst_vars)
 191     except:
 192         ldb.transaction_cancel()
 193         raise
 194     ldb.transaction_commit()
 195
 196
 197 def setup_file(template, fname, subst_vars):
 198     """Setup a file in the private dir.
 199
 200     :param template: Path of the template file.
 201     :param fname: Path of the file to create.
 202     :param subst_vars: Substitution variables.
 203     """
 204     f = fname
 205
 206     if os.path.exists(f):
 207         os.unlink(f)
 208
 209     data = read_and_sub_file(template, subst_vars)
 210     open(f, 'w').write(data)
 211
 212
 213 def provision_paths_from_lp(lp, dnsdomain):
 214     """Set the default paths for provisioning.
 215
 216     :param lp: Loadparm context.
 217     :param dnsdomain: DNS Domain name
 218     """
 219     paths = ProvisionPaths()
 220     paths.private_dir = lp.get("private dir")
 221     paths.keytab = "secrets.keytab"
 222     paths.dns_keytab = "dns.keytab"
 223
 224     paths.shareconf = os.path.join(paths.private_dir, "share.ldb")
 225     paths.samdb = os.path.join(paths.private_dir, lp.get("sam database") or "samdb.ldb")
 226     paths.idmapdb = os.path.join(paths.private_dir, lp.get("idmap database") or "idmap.ldb")
 227     paths.secrets = os.path.join(paths.private_dir, lp.get("secrets database") or "secrets.ldb")
 228     paths.templates = os.path.join(paths.private_dir, "templates.ldb")
 229     paths.dns = os.path.join(paths.private_dir, dnsdomain + ".zone")
 230     paths.namedconf = os.path.join(paths.private_dir, "named.conf")
 231     paths.namedtxt = os.path.join(paths.private_dir, "named.txt")
 232     paths.krb5conf = os.path.join(paths.private_dir, "krb5.conf")
 233     paths.winsdb = os.path.join(paths.private_dir, "wins.ldb")
 234     paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
 235     paths.phpldapadminconfig = os.path.join(paths.private_dir,
 236                                             "phpldapadmin-config.php")
 237     paths.ldapdir = os.path.join(paths.private_dir,
 238                                  "ldap")
 239     paths.slapdconf = os.path.join(paths.ldapdir,
 240                                    "slapd.conf")
 241     paths.modulesconf = os.path.join(paths.ldapdir,
 242                                      "modules.conf")
 243     paths.memberofconf = os.path.join(paths.ldapdir,
 244                                       "memberof.conf")
 245     paths.fedoradsinf = os.path.join(paths.ldapdir,
 246                                      "fedorads.inf")
 247     paths.fedoradspartitions = os.path.join(paths.ldapdir,
 248                                             "fedorads-partitions.ldif")
 249     paths.olmmrserveridsconf = os.path.join(paths.ldapdir,
 250                                             "mmr_serverids.conf")
 251     paths.olmmrsyncreplconf = os.path.join(paths.ldapdir,
 252                                            "mmr_syncrepl.conf")
 253     paths.hklm = "hklm.ldb"
 254     paths.hkcr = "hkcr.ldb"
 255     paths.hkcu = "hkcu.ldb"
 256     paths.hku = "hku.ldb"
 257     paths.hkpd = "hkpd.ldb"
 258     paths.hkpt = "hkpt.ldb"
 259
 260     paths.sysvol = lp.get("path", "sysvol")
 261
 262     paths.netlogon = lp.get("path", "netlogon")
 263
 264     paths.smbconf = lp.configfile()
 265
 266     return paths
 267
 268
 269 def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None, serverrole=None,
 270                 rootdn=None, domaindn=None, configdn=None, schemadn=None, serverdn=None,
 271                 sitename=None):
 272     """Guess configuration settings to use."""
 273
 274     if hostname is None:
 275         hostname = socket.gethostname().split(".")[0].lower()
 276
 277     netbiosname = hostname.upper()
 278     if not valid_netbios_name(netbiosname):
 279         raise InvalidNetbiosName(netbiosname)
 280
 281     hostname = hostname.lower()
 282
 283     if dnsdomain is None:
 284         dnsdomain = lp.get("realm")
 285
 286     if serverrole is None:
 287         serverrole = lp.get("server role")
 288
 289     assert dnsdomain is not None
 290     realm = dnsdomain.upper()
 291
 292     if lp.get("realm").upper() != realm:
 293         raise Exception("realm '%s' in %s must match chosen realm '%s'" %
 294                         (lp.get("realm"), lp.configfile(), realm))
 295
 296     dnsdomain = dnsdomain.lower()
 297
 298     if serverrole == "domain controller":
 299         if domain is None:
 300             domain = lp.get("workgroup")
 301         if domaindn is None:
 302             domaindn = "DC=" + dnsdomain.replace(".", ",DC=")
 303         if lp.get("workgroup").upper() != domain.upper():
 304             raise Exception("workgroup '%s' in smb.conf must match chosen domain '%s'",
 305                         lp.get("workgroup"), domain)
 306     else:
 307         domain = netbiosname
 308         if domaindn is None:
 309             domaindn = "CN=" + netbiosname
 310
 311     assert domain is not None
 312     domain = domain.upper()
 313     if not valid_netbios_name(domain):
 314         raise InvalidNetbiosName(domain)
 315
 316     if rootdn is None:
 317        rootdn = domaindn
 318
 319     if configdn is None:
 320         configdn = "CN=Configuration," + rootdn
 321     if schemadn is None:
 322         schemadn = "CN=Schema," + configdn
 323
 324     if sitename is None:
 325         sitename=DEFAULTSITE
 326
 327     names = ProvisionNames()
 328     names.rootdn = rootdn
 329     names.domaindn = domaindn
 330     names.configdn = configdn
 331     names.schemadn = schemadn
 332     names.ldapmanagerdn = "CN=Manager," + rootdn
 333     names.dnsdomain = dnsdomain
 334     names.domain = domain
 335     names.realm = realm
 336     names.netbiosname = netbiosname
 337     names.hostname = hostname
 338     names.sitename = sitename
 339     names.serverdn = "CN=%s,CN=Servers,CN=%s,CN=Sites,%s" % (netbiosname, sitename, configdn)
 340
 341     return names
 342
 343
 344 def make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole,
 345                  targetdir):
 346     if hostname is None:
 347         hostname = socket.gethostname().split(".")[0].lower()
 348
 349     if serverrole is None:
 350         serverrole = "standalone"
 351
 352     assert serverrole in ("domain controller", "member server", "standalone")
 353     if serverrole == "domain controller":
 354         smbconfsuffix = "dc"
 355     elif serverrole == "member server":
 356         smbconfsuffix = "member"
 357     elif serverrole == "standalone":
 358         smbconfsuffix = "standalone"
 359
 360     assert domain is not None
 361     assert realm is not None
 362
 363     default_lp = param.LoadParm()
 364     #Load non-existant file
 365     default_lp.load(smbconf)
 366
 367     if targetdir is not None:
 368         privatedir_line = "private dir = " + os.path.abspath(os.path.join(targetdir, "private"))
 369         lockdir_line = "lock dir = " + os.path.abspath(targetdir)
 370
 371         default_lp.set("lock dir", os.path.abspath(targetdir))
 372     else:
 373         privatedir_line = ""
 374         lockdir_line = ""
 375
 376     sysvol = os.path.join(default_lp.get("lock dir"), "sysvol")
 377     netlogon = os.path.join(sysvol, realm.lower(), "scripts")
 378
 379     setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix),
 380                smbconf, {
 381             "HOSTNAME": hostname,
 382             "DOMAIN": domain,
 383             "REALM": realm,
 384             "SERVERROLE": serverrole,
 385             "NETLOGONPATH": netlogon,
 386             "SYSVOLPATH": sysvol,
 387             "PRIVATEDIR_LINE": privatedir_line,
 388             "LOCKDIR_LINE": lockdir_line
 389             })
 390
 391
 392
 393 def setup_name_mappings(samdb, idmap, sid, domaindn, root_uid, nobody_uid,
 394                         users_gid, wheel_gid):
 395     """setup reasonable name mappings for sam names to unix names.
 396
 397     :param samdb: SamDB object.
 398     :param idmap: IDmap db object.
 399     :param sid: The domain sid.
 400     :param domaindn: The domain DN.
 401     :param root_uid: uid of the UNIX root user.
 402     :param nobody_uid: uid of the UNIX nobody user.
 403     :param users_gid: gid of the UNIX users group.
 404     :param wheel_gid: gid of the UNIX wheel group."""
 405     # add some foreign sids if they are not present already
 406     samdb.add_foreign(domaindn, "S-1-5-7", "Anonymous")
 407     samdb.add_foreign(domaindn, "S-1-1-0", "World")
 408     samdb.add_foreign(domaindn, "S-1-5-2", "Network")
 409     samdb.add_foreign(domaindn, "S-1-5-18", "System")
 410     samdb.add_foreign(domaindn, "S-1-5-11", "Authenticated Users")
 411
 412     idmap.setup_name_mapping("S-1-5-7", idmap.TYPE_UID, nobody_uid)
 413     idmap.setup_name_mapping("S-1-5-32-544", idmap.TYPE_GID, wheel_gid)
 414
 415     idmap.setup_name_mapping(sid + "-500", idmap.TYPE_UID, root_uid)
 416     idmap.setup_name_mapping(sid + "-513", idmap.TYPE_GID, users_gid)
 417
 418
 419 def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info,
 420                            credentials, names,
 421                            serverrole, ldap_backend=None,
 422                            ldap_backend_type=None, erase=False):
 423     """Setup the partitions for the SAM database.
 424
 425     Alternatively, provision() may call this, and then populate the database.
 426
 427     :note: This will wipe the Sam Database!
 428
 429     :note: This function always removes the local SAM LDB file. The erase
 430         parameter controls whether to erase the existing data, which
 431         may not be stored locally but in LDAP.
 432     """
 433     assert session_info is not None
 434
 435     samdb = SamDB(samdb_path, session_info=session_info,
 436                   credentials=credentials, lp=lp)
 437
 438     # Wipes the database
 439     try:
 440         samdb.erase()
 441     except:
 442         os.unlink(samdb_path)
 443
 444     samdb = SamDB(samdb_path, session_info=session_info,
 445                   credentials=credentials, lp=lp)
 446
 447     #Add modules to the list to activate them by default
 448     #beware often order is important
 449     #
 450     # Some Known ordering constraints:
 451     # - rootdse must be first, as it makes redirects from "" -> cn=rootdse
 452     # - objectclass must be before password_hash, because password_hash checks
 453     #   that the objectclass is of type person (filled in by objectclass
 454     #   module when expanding the objectclass list)
 455     # - partition must be last
 456     # - each partition has its own module list then
 457     modules_list = ["rootdse",
 458                     "paged_results",
 459                     "ranged_results",
 460                     "anr",
 461                     "server_sort",
 462                     "extended_dn",
 463                     "asq",
 464                     "rdn_name",
 465                     "objectclass",
 466                     "samldb",
 467                     "kludge_acl",
 468                     "operational"]
 469     tdb_modules_list = [
 470                     "subtree_rename",
 471                     "subtree_delete",
 472                     "linked_attributes"]
 473     modules_list2 = ["show_deleted",
 474                     "partition"]
 475
 476     domaindn_ldb = "users.ldb"
 477     if ldap_backend is not None:
 478         domaindn_ldb = ldap_backend
 479     configdn_ldb = "configuration.ldb"
 480     if ldap_backend is not None:
 481         configdn_ldb = ldap_backend
 482     schemadn_ldb = "schema.ldb"
 483     if ldap_backend is not None:
 484         schema_ldb = ldap_backend
 485         schemadn_ldb = ldap_backend
 486
 487     if ldap_backend_type == "fedora-ds":
 488         backend_modules = ["nsuniqueid", "paged_searches"]
 489         # We can handle linked attributes here, as we don't have directory-side subtree operations
 490         tdb_modules_list = ["linked_attributes"]
 491     elif ldap_backend_type == "openldap":
 492         backend_modules = ["normalise", "entryuuid", "paged_searches"]
 493         # OpenLDAP handles subtree renames, so we don't want to do any of these things
 494         tdb_modules_list = None
 495     elif ldap_backend is not None:
 496         raise "LDAP Backend specified, but LDAP Backend Type not specified"
 497     elif serverrole == "domain controller":
 498         backend_modules = ["repl_meta_data"]
 499     else:
 500         backend_modules = ["objectguid"]
 501
 502     if tdb_modules_list is None:
 503         tdb_modules_list_as_string = ""
 504     else:
 505         tdb_modules_list_as_string = ","+",".join(tdb_modules_list)
 506
 507     samdb.transaction_start()
 508     try:
 509         setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), {
 510                 "SCHEMADN": names.schemadn,
 511                 "SCHEMADN_LDB": schemadn_ldb,
 512                 "SCHEMADN_MOD2": ",objectguid",
 513                 "CONFIGDN": names.configdn,
 514                 "CONFIGDN_LDB": configdn_ldb,
 515                 "DOMAINDN": names.domaindn,
 516                 "DOMAINDN_LDB": domaindn_ldb,
 517                 "SCHEMADN_MOD": "schema_fsmo,instancetype",
 518                 "CONFIGDN_MOD": "naming_fsmo,instancetype",
 519                 "DOMAINDN_MOD": "pdc_fsmo,password_hash,instancetype",
 520                 "MODULES_LIST": ",".join(modules_list),
 521                 "TDB_MODULES_LIST": tdb_modules_list_as_string,
 522                 "MODULES_LIST2": ",".join(modules_list2),
 523                 "BACKEND_MOD": ",".join(backend_modules),
 524         })
 525
 526     except:
 527         samdb.transaction_cancel()
 528         raise
 529
 530     samdb.transaction_commit()
 531
 532     samdb = SamDB(samdb_path, session_info=session_info,
 533                   credentials=credentials, lp=lp)
 534
 535     samdb.transaction_start()
 536     try:
 537         message("Setting up sam.ldb attributes")
 538         samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
 539
 540         message("Setting up sam.ldb rootDSE")
 541         setup_samdb_rootdse(samdb, setup_path, names)
 542
 543         if erase:
 544             message("Erasing data from partitions")
 545             samdb.erase_partitions()
 546
 547     except:
 548         samdb.transaction_cancel()
 549         raise
 550
 551     samdb.transaction_commit()
 552
 553     return samdb
 554
 555
 556 def secretsdb_become_dc(secretsdb, setup_path, domain, realm, dnsdomain,
 557                         netbiosname, domainsid, keytab_path, samdb_url,
 558                         dns_keytab_path, dnspass, machinepass):
 559     """Add DC-specific bits to a secrets database.
 560
 561     :param secretsdb: Ldb Handle to the secrets database
 562     :param setup_path: Setup path function
 563     :param machinepass: Machine password
 564     """
 565     setup_ldb(secretsdb, setup_path("secrets_dc.ldif"), {
 566             "MACHINEPASS_B64": b64encode(machinepass),
 567             "DOMAIN": domain,
 568             "REALM": realm,
 569             "DNSDOMAIN": dnsdomain,
 570             "DOMAINSID": str(domainsid),
 571             "SECRETS_KEYTAB": keytab_path,
 572             "NETBIOSNAME": netbiosname,
 573             "SAM_LDB": samdb_url,
 574             "DNS_KEYTAB": dns_keytab_path,
 575             "DNSPASS_B64": b64encode(dnspass),
 576             })
 577
 578
 579 def setup_secretsdb(path, setup_path, session_info, credentials, lp):
 580     """Setup the secrets database.
 581
 582     :param path: Path to the secrets database.
 583     :param setup_path: Get the path to a setup file.
 584     :param session_info: Session info.
 585     :param credentials: Credentials
 586     :param lp: Loadparm context
 587     :return: LDB handle for the created secrets database
 588     """
 589     if os.path.exists(path):
 590         os.unlink(path)
 591     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
 592                       lp=lp)
 593     secrets_ldb.erase()
 594     secrets_ldb.load_ldif_file_add(setup_path("secrets_init.ldif"))
 595     secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
 596                       lp=lp)
 597     secrets_ldb.load_ldif_file_add(setup_path("secrets.ldif"))
 598
 599     if credentials is not None and credentials.authentication_requested():
 600         if credentials.get_bind_dn() is not None:
 601             setup_add_ldif(secrets_ldb, setup_path("secrets_simple_ldap.ldif"), {
 602                     "LDAPMANAGERDN": credentials.get_bind_dn(),
 603                     "LDAPMANAGERPASS_B64": b64encode(credentials.get_password())
 604                     })
 605         else:
 606             setup_add_ldif(secrets_ldb, setup_path("secrets_sasl_ldap.ldif"), {
 607                     "LDAPADMINUSER": credentials.get_username(),
 608                     "LDAPADMINREALM": credentials.get_realm(),
 609                     "LDAPADMINPASS_B64": b64encode(credentials.get_password())
 610                     })
 611
 612     return secrets_ldb
 613
 614
 615 def setup_templatesdb(path, setup_path, session_info, credentials, lp):
 616     """Setup the templates database.
 617
 618     :param path: Path to the database.
 619     :param setup_path: Function for obtaining the path to setup files.
 620     :param session_info: Session info
 621     :param credentials: Credentials
 622     :param lp: Loadparm context
 623     """
 624     templates_ldb = SamDB(path, session_info=session_info,
 625                           credentials=credentials, lp=lp)
 626     # Wipes the database
 627     try:
 628         templates_ldb.erase()
 629     except:
 630         os.unlink(path)
 631
 632     templates_ldb.load_ldif_file_add(setup_path("provision_templates_init.ldif"))
 633
 634     templates_ldb = SamDB(path, session_info=session_info,
 635                           credentials=credentials, lp=lp)
 636
 637     templates_ldb.load_ldif_file_add(setup_path("provision_templates.ldif"))
 638
 639
 640 def setup_registry(path, setup_path, session_info, credentials, lp):
 641     """Setup the registry.
 642
 643     :param path: Path to the registry database
 644     :param setup_path: Function that returns the path to a setup.
 645     :param session_info: Session information
 646     :param credentials: Credentials
 647     :param lp: Loadparm context
 648     """
 649     reg = registry.Registry()
 650     hive = registry.open_ldb(path, session_info=session_info,
 651                          credentials=credentials, lp_ctx=lp)
 652     reg.mount_hive(hive, "HKEY_LOCAL_MACHINE")
 653     provision_reg = setup_path("provision.reg")
 654     assert os.path.exists(provision_reg)
 655     reg.diff_apply(provision_reg)
 656
 657
 658 def setup_idmapdb(path, setup_path, session_info, credentials, lp):
 659     """Setup the idmap database.
 660
 661     :param path: path to the idmap database
 662     :param setup_path: Function that returns a path to a setup file
 663     :param session_info: Session information
 664     :param credentials: Credentials
 665     :param lp: Loadparm context
 666     """
 667     if os.path.exists(path):
 668         os.unlink(path)
 669
 670     idmap_ldb = IDmapDB(path, session_info=session_info,
 671                         credentials=credentials, lp=lp)
 672
 673     idmap_ldb.erase()
 674     idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif"))
 675     return idmap_ldb
 676
 677
 678 def setup_samdb_rootdse(samdb, setup_path, names):
 679     """Setup the SamDB rootdse.
 680
 681     :param samdb: Sam Database handle
 682     :param setup_path: Obtain setup path
 683     """
 684     setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
 685         "SCHEMADN": names.schemadn,
 686         "NETBIOSNAME": names.netbiosname,
 687         "DNSDOMAIN": names.dnsdomain,
 688         "REALM": names.realm,
 689         "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
 690         "DOMAINDN": names.domaindn,
 691         "ROOTDN": names.rootdn,
 692         "CONFIGDN": names.configdn,
 693         "SERVERDN": names.serverdn,
 694         })
 695
 696
 697 def setup_self_join(samdb, names,
 698                     machinepass, dnspass,
 699                     domainsid, invocationid, setup_path,
 700                     policyguid):
 701     """Join a host to its own domain."""
 702     assert isinstance(invocationid, str)
 703     setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), {
 704               "CONFIGDN": names.configdn,
 705               "SCHEMADN": names.schemadn,
 706               "DOMAINDN": names.domaindn,
 707               "SERVERDN": names.serverdn,
 708               "INVOCATIONID": invocationid,
 709               "NETBIOSNAME": names.netbiosname,
 710               "DEFAULTSITE": names.sitename,
 711               "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
 712               "MACHINEPASS_B64": b64encode(machinepass),
 713               "DNSPASS_B64": b64encode(dnspass),
 714               "REALM": names.realm,
 715               "DOMAIN": names.domain,
 716               "DNSDOMAIN": names.dnsdomain})
 717     setup_add_ldif(samdb, setup_path("provision_group_policy.ldif"), {
 718               "POLICYGUID": policyguid,
 719               "DNSDOMAIN": names.dnsdomain,
 720               "DOMAINSID": str(domainsid),
 721               "DOMAINDN": names.domaindn})
 722
 723
 724 def setup_samdb(path, setup_path, session_info, credentials, lp,
 725                 names, message,
 726                 domainsid, aci, domainguid, policyguid,
 727                 fill, adminpass, krbtgtpass,
 728                 machinepass, invocationid, dnspass,
 729                 serverrole, ldap_backend=None,
 730                 ldap_backend_type=None):
 731     """Setup a complete SAM Database.
 732
 733     :note: This will wipe the main SAM database file!
 734     """
 735
 736     erase = (fill != FILL_DRS)
 737
 738     # Also wipes the database
 739     setup_samdb_partitions(path, setup_path, message=message, lp=lp,
 740                            credentials=credentials, session_info=session_info,
 741                            names=names,
 742                            ldap_backend=ldap_backend, serverrole=serverrole,
 743                            ldap_backend_type=ldap_backend_type, erase=erase)
 744
 745     samdb = SamDB(path, session_info=session_info,
 746                   credentials=credentials, lp=lp)
 747     if fill == FILL_DRS:
 748         return samdb
 749
 750     message("Pre-loading the Samba 4 and AD schema")
 751     samdb.set_domain_sid(domainsid)
 752     if serverrole == "domain controller":
 753         samdb.set_invocation_id(invocationid)
 754
 755     load_schema(setup_path, samdb, names.schemadn, names.netbiosname,
 756                 names.configdn, names.sitename, names.serverdn,
 757                 names.hostname)
 758
 759     samdb.transaction_start()
 760
 761     try:
 762         message("Adding DomainDN: %s (permitted to fail)" % names.domaindn)
 763         if serverrole == "domain controller":
 764             domain_oc = "domainDNS"
 765         else:
 766             domain_oc = "samba4LocalDomain"
 767
 768         setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
 769                 "DOMAINDN": names.domaindn,
 770                 "ACI": aci,
 771                 "DOMAIN_OC": domain_oc
 772                 })
 773
 774         message("Modifying DomainDN: " + names.domaindn + "")
 775         if domainguid is not None:
 776             domainguid_mod = "replace: objectGUID\nobjectGUID: %s\n-" % domainguid
 777         else:
 778             domainguid_mod = ""
 779
 780         setup_modify_ldif(samdb, setup_path("provision_basedn_modify.ldif"), {
 781             "LDAPTIME": timestring(int(time.time())),
 782             "DOMAINSID": str(domainsid),
 783             "SCHEMADN": names.schemadn,
 784             "NETBIOSNAME": names.netbiosname,
 785             "DEFAULTSITE": names.sitename,
 786             "CONFIGDN": names.configdn,
 787             "SERVERDN": names.serverdn,
 788             "POLICYGUID": policyguid,
 789             "DOMAINDN": names.domaindn,
 790             "DOMAINGUID_MOD": domainguid_mod,
 791             })
 792
 793         message("Adding configuration container (permitted to fail)")
 794         setup_add_ldif(samdb, setup_path("provision_configuration_basedn.ldif"), {
 795             "CONFIGDN": names.configdn,
 796             "ACI": aci,
 797             })
 798         message("Modifying configuration container")
 799         setup_modify_ldif(samdb, setup_path("provision_configuration_basedn_modify.ldif"), {
 800             "CONFIGDN": names.configdn,
 801             "SCHEMADN": names.schemadn,
 802             })
 803
 804         message("Adding schema container (permitted to fail)")
 805         setup_add_ldif(samdb, setup_path("provision_schema_basedn.ldif"), {
 806             "SCHEMADN": names.schemadn,
 807             "ACI": aci,
 808             })
 809         message("Modifying schema container")
 810
 811         prefixmap = open(setup_path("prefixMap.txt"), 'r').read()
 812
 813         setup_modify_ldif(samdb,
 814             setup_path("provision_schema_basedn_modify.ldif"), {
 815             "SCHEMADN": names.schemadn,
 816             "NETBIOSNAME": names.netbiosname,
 817             "DEFAULTSITE": names.sitename,
 818             "CONFIGDN": names.configdn,
 819             "SERVERDN": names.serverdn,
 820             "PREFIXMAP_B64": b64encode(prefixmap)
 821             })
 822
 823         message("Setting up sam.ldb Samba4 schema")
 824         setup_add_ldif(samdb, setup_path("schema_samba4.ldif"),
 825                        {"SCHEMADN": names.schemadn })
 826         message("Setting up sam.ldb AD schema")
 827         setup_add_ldif(samdb, setup_path("schema.ldif"),
 828                        {"SCHEMADN": names.schemadn})
 829
 830         message("Setting up sam.ldb configuration data")
 831         setup_add_ldif(samdb, setup_path("provision_configuration.ldif"), {
 832             "CONFIGDN": names.configdn,
 833             "NETBIOSNAME": names.netbiosname,
 834             "DEFAULTSITE": names.sitename,
 835             "DNSDOMAIN": names.dnsdomain,
 836             "DOMAIN": names.domain,
 837             "SCHEMADN": names.schemadn,
 838             "DOMAINDN": names.domaindn,
 839             "SERVERDN": names.serverdn
 840             })
 841
 842         message("Setting up display specifiers")
 843         setup_add_ldif(samdb, setup_path("display_specifiers.ldif"),
 844                        {"CONFIGDN": names.configdn})
 845
 846         message("Adding users container (permitted to fail)")
 847         setup_add_ldif(samdb, setup_path("provision_users_add.ldif"), {
 848                 "DOMAINDN": names.domaindn})
 849         message("Modifying users container")
 850         setup_modify_ldif(samdb, setup_path("provision_users_modify.ldif"), {
 851                 "DOMAINDN": names.domaindn})
 852         message("Adding computers container (permitted to fail)")
 853         setup_add_ldif(samdb, setup_path("provision_computers_add.ldif"), {
 854                 "DOMAINDN": names.domaindn})
 855         message("Modifying computers container")
 856         setup_modify_ldif(samdb, setup_path("provision_computers_modify.ldif"), {
 857                 "DOMAINDN": names.domaindn})
 858         message("Setting up sam.ldb data")
 859         setup_add_ldif(samdb, setup_path("provision.ldif"), {
 860             "DOMAINDN": names.domaindn,
 861             "NETBIOSNAME": names.netbiosname,
 862             "DEFAULTSITE": names.sitename,
 863             "CONFIGDN": names.configdn,
 864             "SERVERDN": names.serverdn
 865             })
 866
 867         if fill == FILL_FULL:
 868             message("Setting up sam.ldb users and groups")
 869             setup_add_ldif(samdb, setup_path("provision_users.ldif"), {
 870                 "DOMAINDN": names.domaindn,
 871                 "DOMAINSID": str(domainsid),
 872                 "CONFIGDN": names.configdn,
 873                 "ADMINPASS_B64": b64encode(adminpass),
 874                 "KRBTGTPASS_B64": b64encode(krbtgtpass),
 875                 })
 876
 877             if serverrole == "domain controller":
 878                 message("Setting up self join")
 879                 setup_self_join(samdb, names=names, invocationid=invocationid,
 880                                 dnspass=dnspass,
 881                                 machinepass=machinepass,
 882                                 domainsid=domainsid, policyguid=policyguid,
 883                                 setup_path=setup_path)
 884
 885     except:
 886         samdb.transaction_cancel()
 887         raise
 888
 889     samdb.transaction_commit()
 890     return samdb
 891
 892
 893 FILL_FULL = "FULL"
 894 FILL_NT4SYNC = "NT4SYNC"
 895 FILL_DRS = "DRS"
 896
 897 def provision(setup_dir, message, session_info,
 898               credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL, realm=None,
 899               rootdn=None, domaindn=None, schemadn=None, configdn=None,
 900               serverdn=None,
 901               domain=None, hostname=None, hostip=None, hostip6=None,
 902               domainsid=None, adminpass=None, krbtgtpass=None, domainguid=None,
 903               policyguid=None, invocationid=None, machinepass=None,
 904               dnspass=None, root=None, nobody=None, nogroup=None, users=None,
 905               wheel=None, backup=None, aci=None, serverrole=None,
 906               ldap_backend=None, ldap_backend_type=None, sitename=None):
 907     """Provision samba4
 908
 909     :note: caution, this wipes all existing data!
 910     """
 911
 912     def setup_path(file):
 913         return os.path.join(setup_dir, file)
 914
 915     if domainsid is None:
 916         domainsid = security.random_sid()
 917     else:
 918         domainsid = security.Sid(domainsid)
 919
 920     if policyguid is None:
 921         policyguid = str(uuid.uuid4())
 922     if adminpass is None:
 923         adminpass = misc.random_password(12)
 924     if krbtgtpass is None:
 925         krbtgtpass = misc.random_password(12)
 926     if machinepass is None:
 927         machinepass  = misc.random_password(12)
 928     if dnspass is None:
 929         dnspass = misc.random_password(12)
 930     root_uid = findnss_uid([root or "root"])
 931     nobody_uid = findnss_uid([nobody or "nobody"])
 932     users_gid = findnss_gid([users or "users"])
 933     if wheel is None:
 934         wheel_gid = findnss_gid(["wheel", "adm"])
 935     else:
 936         wheel_gid = findnss_gid([wheel])
 937     if aci is None:
 938         aci = "# no aci for local ldb"
 939
 940     if targetdir is not None:
 941         if (not os.path.exists(os.path.join(targetdir, "etc"))):
 942             os.makedirs(os.path.join(targetdir, "etc"))
 943         smbconf = os.path.join(targetdir, "etc", "smb.conf")
 944
 945     # only install a new smb.conf if there isn't one there already
 946     if not os.path.exists(smbconf):
 947         make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole,
 948                      targetdir)
 949
 950     lp = param.LoadParm()
 951     lp.load(smbconf)
 952
 953     names = guess_names(lp=lp, hostname=hostname, domain=domain,
 954                         dnsdomain=realm, serverrole=serverrole, sitename=sitename,
 955                         rootdn=rootdn, domaindn=domaindn, configdn=configdn, schemadn=schemadn,
 956                         serverdn=serverdn)
 957
 958     paths = provision_paths_from_lp(lp, names.dnsdomain)
 959
 960     if hostip is None:
 961         hostip = socket.getaddrinfo(names.hostname, None, socket.AF_INET, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
 962
 963     if hostip6 is None:
 964         try:
 965             hostip6 = socket.getaddrinfo(names.hostname, None, socket.AF_INET6, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
 966         except socket.gaierror:
 967             pass
 968
 969     if serverrole is None:
 970         serverrole = lp.get("server role")
 971
 972     assert serverrole in ("domain controller", "member server", "standalone")
 973     if invocationid is None and serverrole == "domain controller":
 974         invocationid = str(uuid.uuid4())
 975
 976     if not os.path.exists(paths.private_dir):
 977         os.mkdir(paths.private_dir)
 978
 979     ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
 980
 981     if ldap_backend is not None:
 982         if ldap_backend == "ldapi":
 983             # provision-backend will set this path suggested slapd command line / fedorads.inf
 984             ldap_backend = "ldapi://%s" % urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
 985
 986     # only install a new shares config db if there is none
 987     if not os.path.exists(paths.shareconf):
 988         message("Setting up share.ldb")
 989         share_ldb = Ldb(paths.shareconf, session_info=session_info,
 990                         credentials=credentials, lp=lp)
 991         share_ldb.load_ldif_file_add(setup_path("share.ldif"))
 992
 993
 994     message("Setting up secrets.ldb")
 995     secrets_ldb = setup_secretsdb(paths.secrets, setup_path,
 996                                   session_info=session_info,
 997                                   credentials=credentials, lp=lp)
 998
 999     message("Setting up the registry")
1000     setup_registry(paths.hklm, setup_path, session_info,
1001                    credentials=credentials, lp=lp)
1002
1003     message("Setting up templates db")
1004     setup_templatesdb(paths.templates, setup_path, session_info=session_info,
1005                       credentials=credentials, lp=lp)
1006
1007     message("Setting up idmap db")
1008     idmap = setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info,
1009                           credentials=credentials, lp=lp)
1010
1011     samdb = setup_samdb(paths.samdb, setup_path, session_info=session_info,
1012                         credentials=credentials, lp=lp, names=names,
1013                         message=message,
1014                         domainsid=domainsid,
1015                         aci=aci, domainguid=domainguid, policyguid=policyguid,
1016                         fill=samdb_fill,
1017                         adminpass=adminpass, krbtgtpass=krbtgtpass,
1018                         invocationid=invocationid,
1019                         machinepass=machinepass, dnspass=dnspass,
1020                         serverrole=serverrole, ldap_backend=ldap_backend,
1021                         ldap_backend_type=ldap_backend_type)
1022
1023     if lp.get("server role") == "domain controller":
1024         if paths.netlogon is None:
1025             message("Existing smb.conf does not have a [netlogon] share, but you are configuring a DC.")
1026             message("Please either remove %s or see the template at %s" %
1027                     ( paths.smbconf, setup_path("provision.smb.conf.dc")))
1028             assert(paths.netlogon is not None)
1029
1030         if paths.sysvol is None:
1031             message("Existing smb.conf does not have a [sysvol] share, but you are configuring a DC.")
1032             message("Please either remove %s or see the template at %s" %
1033                     (paths.smbconf, setup_path("provision.smb.conf.dc")))
1034             assert(paths.sysvol is not None)
1035
1036         policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies",
1037                                    "{" + policyguid + "}")
1038         os.makedirs(policy_path, 0755)
1039         open(os.path.join(policy_path, "GPT.INI"), 'w').write("")
1040         os.makedirs(os.path.join(policy_path, "Machine"), 0755)
1041         os.makedirs(os.path.join(policy_path, "User"), 0755)
1042         if not os.path.isdir(paths.netlogon):
1043             os.makedirs(paths.netlogon, 0755)
1044
1045     if samdb_fill == FILL_FULL:
1046         setup_name_mappings(samdb, idmap, str(domainsid), names.domaindn,
1047                             root_uid=root_uid, nobody_uid=nobody_uid,
1048                             users_gid=users_gid, wheel_gid=wheel_gid)
1049
1050         message("Setting up sam.ldb rootDSE marking as synchronized")
1051         setup_modify_ldif(samdb, setup_path("provision_rootdse_modify.ldif"))
1052
1053         # Only make a zone file on the first DC, it should be replicated with DNS replication
1054         if serverrole == "domain controller":
1055             secrets_ldb = Ldb(paths.secrets, session_info=session_info,
1056                               credentials=credentials, lp=lp)
1057             secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
1058                                 netbiosname=names.netbiosname, domainsid=domainsid,
1059                                 keytab_path=paths.keytab, samdb_url=paths.samdb,
1060                                 dns_keytab_path=paths.dns_keytab, dnspass=dnspass,
1061                                 machinepass=machinepass, dnsdomain=names.dnsdomain)
1062
1063             samdb = SamDB(paths.samdb, session_info=session_info,
1064                       credentials=credentials, lp=lp)
1065
1066             domainguid = samdb.searchone(basedn=domaindn, attribute="objectGUID")
1067             assert isinstance(domainguid, str)
1068             hostguid = samdb.searchone(basedn=domaindn, attribute="objectGUID",
1069                                        expression="(&(objectClass=computer)(cn=%s))" % names.hostname,
1070                                        scope=SCOPE_SUBTREE)
1071             assert isinstance(hostguid, str)
1072
1073             create_zone_file(paths.dns, setup_path, dnsdomain=names.dnsdomain,
1074                              domaindn=names.domaindn, hostip=hostip,
1075                              hostip6=hostip6, hostname=names.hostname,
1076                              dnspass=dnspass, realm=names.realm,
1077                              domainguid=domainguid, hostguid=hostguid)
1078
1079             create_named_conf(paths.namedconf, setup_path, realm=names.realm,
1080                               dnsdomain=names.dnsdomain, private_dir=paths.private_dir)
1081
1082             create_named_txt(paths.namedtxt, setup_path, realm=names.realm,
1083                               dnsdomain=names.dnsdomain, private_dir=paths.private_dir,
1084                               keytab_name=paths.dns_keytab)
1085             message("See %s for an example configuration include file for BIND" % paths.namedconf)
1086             message("and %s for further documentation required for secure DNS updates" % paths.namedtxt)
1087
1088             create_krb5_conf(paths.krb5conf, setup_path, dnsdomain=names.dnsdomain,
1089                              hostname=names.hostname, realm=names.realm)
1090             message("A Kerberos configuration suitable for Samba 4 has been generated at %s" % paths.krb5conf)
1091
1092     create_phpldapadmin_config(paths.phpldapadminconfig, setup_path,
1093                                ldapi_url)
1094
1095     message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
1096
1097     message("Once the above files are installed, your Samba4 server will be ready to use")
1098     message("Server Role:    %s" % serverrole)
1099     message("Hostname:       %s" % names.hostname)
1100     message("NetBIOS Domain: %s" % names.domain)
1101     message("DNS Domain:     %s" % names.dnsdomain)
1102     message("DOMAIN SID:     %s" % str(domainsid))
1103     message("Admin password: %s" % adminpass)
1104
1105     result = ProvisionResult()
1106     result.domaindn = domaindn
1107     result.paths = paths
1108     result.lp = lp
1109     result.samdb = samdb
1110     return result
1111
1112
1113 def provision_become_dc(setup_dir=None,
1114                         smbconf=None, targetdir=None, realm=None,
1115                         rootdn=None, domaindn=None, schemadn=None, configdn=None,
1116                         serverdn=None,
1117                         domain=None, hostname=None, domainsid=None,
1118                         adminpass=None, krbtgtpass=None, domainguid=None,
1119                         policyguid=None, invocationid=None, machinepass=None,
1120                         dnspass=None, root=None, nobody=None, nogroup=None, users=None,
1121                         wheel=None, backup=None, aci=None, serverrole=None,
1122                         ldap_backend=None, ldap_backend_type=None, sitename=None):
1123
1124     def message(text):
1125         """print a message if quiet is not set."""
1126         print text
1127
1128     return provision(setup_dir, message, system_session(), None,
1129               smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS, realm=realm,
1130               rootdn=rootdn, domaindn=domaindn, schemadn=schemadn, configdn=configdn, serverdn=serverdn,
1131               domain=domain, hostname=hostname, hostip="127.0.0.1", domainsid=domainsid, machinepass=machinepass, serverrole="domain controller", sitename=sitename)
1132
1133
1134 def setup_db_config(setup_path, dbdir):
1135     """Setup a Berkeley database.
1136
1137     :param setup_path: Setup path function.
1138     :param dbdir: Database directory."""
1139     if not os.path.isdir(os.path.join(dbdir, "bdb-logs")):
1140         os.makedirs(os.path.join(dbdir, "bdb-logs"), 0700)
1141     if not os.path.isdir(os.path.join(dbdir, "tmp")):
1142         os.makedirs(os.path.join(dbdir, "tmp"), 0700)
1143
1144     setup_file(setup_path("DB_CONFIG"), os.path.join(dbdir, "DB_CONFIG"),
1145                {"LDAPDBDIR": dbdir})
1146
1147
1148
1149 def provision_backend(setup_dir=None, message=None,
1150                       smbconf=None, targetdir=None, realm=None,
1151                       rootdn=None, domaindn=None, schemadn=None, configdn=None,
1152                       domain=None, hostname=None, adminpass=None, root=None, serverrole=None,
1153                       ldap_backend_type=None, ldap_backend_port=None,
1154                       ol_mmr_urls=None):
1155
1156     def setup_path(file):
1157         return os.path.join(setup_dir, file)
1158
1159     if hostname is None:
1160         hostname = socket.gethostname().split(".")[0].lower()
1161
1162     if root is None:
1163         root = findnss(pwd.getpwnam, ["root"])[0]
1164
1165     if adminpass is None:
1166         adminpass = misc.random_password(12)
1167
1168     if targetdir is not None:
1169         if (not os.path.exists(os.path.join(targetdir, "etc"))):
1170             os.makedirs(os.path.join(targetdir, "etc"))
1171         smbconf = os.path.join(targetdir, "etc", "smb.conf")
1172
1173     # only install a new smb.conf if there isn't one there already
1174     if not os.path.exists(smbconf):
1175         make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole,
1176                      targetdir)
1177
1178     lp = param.LoadParm()
1179     lp.load(smbconf)
1180
1181     names = guess_names(lp=lp, hostname=hostname, domain=domain,
1182                         dnsdomain=realm, serverrole=serverrole,
1183                         rootdn=rootdn, domaindn=domaindn, configdn=configdn,
1184                         schemadn=schemadn)
1185
1186     paths = provision_paths_from_lp(lp, names.dnsdomain)
1187
1188     if not os.path.isdir(paths.ldapdir):
1189         os.makedirs(paths.ldapdir, 0700)
1190     schemadb_path = os.path.join(paths.ldapdir, "schema-tmp.ldb")
1191     try:
1192         os.unlink(schemadb_path)
1193     except:
1194         pass
1195
1196     schemadb = Ldb(schemadb_path, lp=lp)
1197
1198     prefixmap = open(setup_path("prefixMap.txt"), 'r').read()
1199
1200     setup_add_ldif(schemadb, setup_path("provision_schema_basedn.ldif"),
1201                    {"SCHEMADN": names.schemadn,
1202                     "ACI": "#",
1203                     })
1204     setup_modify_ldif(schemadb,
1205                       setup_path("provision_schema_basedn_modify.ldif"), \
1206                           {"SCHEMADN": names.schemadn,
1207                            "NETBIOSNAME": names.netbiosname,
1208                            "DEFAULTSITE": DEFAULTSITE,
1209                            "CONFIGDN": names.configdn,
1210                            "SERVERDN": names.serverdn,
1211                            "PREFIXMAP_B64": b64encode(prefixmap)
1212                            })
1213
1214     setup_add_ldif(schemadb, setup_path("schema_samba4.ldif"),
1215                    {"SCHEMADN": names.schemadn })
1216     setup_add_ldif(schemadb, setup_path("schema.ldif"),
1217                    {"SCHEMADN": names.schemadn})
1218
1219     if ldap_backend_type == "fedora-ds":
1220         if ldap_backend_port is not None:
1221             serverport = "ServerPort=%d" % ldap_backend_port
1222         else:
1223             serverport = ""
1224
1225         setup_file(setup_path("fedorads.inf"), paths.fedoradsinf,
1226                    {"ROOT": root,
1227                     "HOSTNAME": hostname,
1228                     "DNSDOMAIN": names.dnsdomain,
1229                     "LDAPDIR": paths.ldapdir,
1230                     "DOMAINDN": names.domaindn,
1231                     "LDAPMANAGERDN": names.ldapmanagerdn,
1232                     "LDAPMANAGERPASS": adminpass,
1233                     "SERVERPORT": serverport})
1234
1235         setup_file(setup_path("fedorads-partitions.ldif"), paths.fedoradspartitions,
1236                    {"CONFIGDN": names.configdn,
1237                     "SCHEMADN": names.schemadn,
1238                     })
1239
1240         mapping = "schema-map-fedora-ds-1.0"
1241         backend_schema = "99_ad.ldif"
1242
1243         slapdcommand="Initailise Fedora DS with: setup-ds.pl --file=%s" % paths.fedoradsinf
1244
1245         ldapuser = "--simple-bind-dn=" + names.ldapmanagerdn
1246
1247     elif ldap_backend_type == "openldap":
1248         attrs = ["linkID", "lDAPDisplayName"]
1249         res = schemadb.search(expression="(&(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1)))(objectclass=attributeSchema))", base=names.schemadn, scope=SCOPE_SUBTREE, attrs=attrs)
1250
1251         memberof_config = "# Generated from schema in %s\n" % schemadb_path
1252         refint_attributes = ""
1253         for i in range (0, len(res)):
1254             expression = "(&(objectclass=attributeSchema)(linkID=%d))" % (int(res[i]["linkID"][0])+1)
1255             target = schemadb.searchone(basedn=names.schemadn,
1256                                         expression=expression,
1257                                         attribute="lDAPDisplayName",
1258                                         scope=SCOPE_SUBTREE)
1259             if target is not None:
1260                 refint_attributes = refint_attributes + " " + target + " " + res[i]["lDAPDisplayName"][0]
1261
1262                 memberof_config += read_and_sub_file(setup_path("memberof.conf"),
1263                                                      { "MEMBER_ATTR" : str(res[i]["lDAPDisplayName"][0]),
1264                                                        "MEMBEROF_ATTR" : str(target) })
1265
1266         refint_config = read_and_sub_file(setup_path("refint.conf"),
1267                                             { "LINK_ATTRS" : refint_attributes})
1268
1269 # generate serverids, ldap-urls and syncrepl-blocks for mmr hosts
1270         mmr_on_config = ""
1271         mmr_replicator_acl = ""
1272         mmr_serverids_config = ""
1273         mmr_syncrepl_schema_config = ""
1274         mmr_syncrepl_config_config = ""
1275         mmr_syncrepl_user_config = ""
1276
1277         if ol_mmr_urls is not None:
1278                 # For now, make these equal
1279                 mmr_pass = adminpass
1280
1281                 url_list=filter(None,ol_mmr_urls.split(' '))
1282                 if (len(url_list) == 1):
1283                     url_list=filter(None,ol_mmr_urls.split(','))
1284
1285
1286                 mmr_on_config = "MirrorMode On"
1287                 mmr_replicator_acl = "  by dn=cn=replicator,cn=samba read"
1288                 serverid=0
1289                 for url in url_list:
1290                         serverid=serverid+1
1291                         mmr_serverids_config += read_and_sub_file(setup_path("mmr_serverids.conf"),
1292                                                                      { "SERVERID" : str(serverid),
1293                                                                        "LDAPSERVER" : url })
1294                         rid=serverid*10
1295                         rid=rid+1
1296                         mmr_syncrepl_schema_config += read_and_sub_file(setup_path("mmr_syncrepl.conf"),
1297                                                                      {  "RID" : str(rid),
1298                                                                         "MMRDN": names.schemadn,
1299                                                                         "LDAPSERVER" : url,
1300                                                                         "MMR_PASSWORD": mmr_pass})
1301
1302                         rid=rid+1
1303                         mmr_syncrepl_config_config += read_and_sub_file(setup_path("mmr_syncrepl.conf"),
1304                                                                      {  "RID" : str(rid),
1305                                                                         "MMRDN": names.configdn,
1306                                                                         "LDAPSERVER" : url,
1307                                                                         "MMR_PASSWORD": mmr_pass})
1308
1309                         rid=rid+1
1310                         mmr_syncrepl_user_config += read_and_sub_file(setup_path("mmr_syncrepl.conf"),
1311                                                                      {  "RID" : str(rid),
1312                                                                         "MMRDN": names.domaindn,
1313                                                                         "LDAPSERVER" : url,
1314                                                                         "MMR_PASSWORD": mmr_pass })
1315
1316
1317         setup_file(setup_path("slapd.conf"), paths.slapdconf,
1318                    {"DNSDOMAIN": names.dnsdomain,
1319                     "LDAPDIR": paths.ldapdir,
1320                     "DOMAINDN": names.domaindn,
1321                     "CONFIGDN": names.configdn,
1322                     "SCHEMADN": names.schemadn,
1323                     "MEMBEROF_CONFIG": memberof_config,
1324                     "MIRRORMODE": mmr_on_config,
1325                     "REPLICATOR_ACL": mmr_replicator_acl,
1326                     "MMR_SERVERIDS_CONFIG": mmr_serverids_config,
1327                     "MMR_SYNCREPL_SCHEMA_CONFIG": mmr_syncrepl_schema_config,
1328                     "MMR_SYNCREPL_CONFIG_CONFIG": mmr_syncrepl_config_config,
1329                     "MMR_SYNCREPL_USER_CONFIG": mmr_syncrepl_user_config,
1330                     "REFINT_CONFIG": refint_config})
1331         setup_file(setup_path("modules.conf"), paths.modulesconf,
1332                    {"REALM": names.realm})
1333
1334         setup_db_config(setup_path, os.path.join(paths.ldapdir, "db", "user"))
1335         setup_db_config(setup_path, os.path.join(paths.ldapdir, "db", "config"))
1336         setup_db_config(setup_path, os.path.join(paths.ldapdir, "db", "schema"))
1337
1338         if not os.path.exists(os.path.join(paths.ldapdir, "db", "samba",  "cn=samba")):
1339             os.makedirs(os.path.join(paths.ldapdir, "db", "samba",  "cn=samba"), 0700)
1340
1341         setup_file(setup_path("cn=samba.ldif"),
1342                    os.path.join(paths.ldapdir, "db", "samba",  "cn=samba.ldif"),
1343                    { "UUID": str(uuid.uuid4()),
1344                      "LDAPTIME": timestring(int(time.time()))} )
1345         setup_file(setup_path("cn=samba-admin.ldif"),
1346                               os.path.join(paths.ldapdir, "db", "samba",  "cn=samba", "cn=samba-admin.ldif"),
1347                               {"LDAPADMINPASS_B64": b64encode(adminpass),
1348                                "UUID": str(uuid.uuid4()),
1349                                "LDAPTIME": timestring(int(time.time()))} )
1350
1351         if ol_mmr_urls is not None:
1352            setup_file(setup_path("cn=replicator.ldif"),
1353                               os.path.join(paths.ldapdir, "db", "samba",  "cn=samba", "cn=replicator.ldif"),
1354                               {"MMR_PASSWORD_B64": b64encode(mmr_pass),
1355                                "UUID": str(uuid.uuid4()),
1356                                "LDAPTIME": timestring(int(time.time()))} )
1357
1358
1359
1360         mapping = "schema-map-openldap-2.3"
1361         backend_schema = "backend-schema.schema"
1362
1363         ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
1364         if ldap_backend_port is not None:
1365             server_port_string = " -h ldap://0.0.0.0:%d" % ldap_backend_port
1366         else:
1367             server_port_string = ""
1368
1369         slapdcommand="Start slapd with:    slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri + server_port_string
1370
1371         ldapuser = "--username=samba-admin"
1372
1373
1374     schema_command = "bin/ad2oLschema --option=convert:target=" + ldap_backend_type + " -I " + setup_path(mapping) + " -H tdb://" + schemadb_path + " -O " + os.path.join(paths.ldapdir, backend_schema)
1375
1376     os.system(schema_command)
1377
1378     message("Your %s Backend for Samba4 is now configured, and is ready to be started" % ldap_backend_type)
1379     message("Server Role:         %s" % serverrole)
1380     message("Hostname:            %s" % names.hostname)
1381     message("DNS Domain:          %s" % names.dnsdomain)
1382     message("Base DN:             %s" % names.domaindn)
1383
1384     if ldap_backend_type == "openldap":
1385         message("LDAP admin user:     samba-admin")
1386     else:
1387         message("LDAP admin DN:       %s" % names.ldapmanagerdn)
1388
1389     message("LDAP admin password: %s" % adminpass)
1390     message(slapdcommand)
1391     message("Run provision with:  --ldap-backend=ldapi --ldap-backend-type=" + ldap_backend_type + " --password=" + adminpass + " " + ldapuser)
1392
1393 def create_phpldapadmin_config(path, setup_path, ldapi_uri):
1394     """Create a PHP LDAP admin configuration file.
1395
1396     :param path: Path to write the configuration to.
1397     :param setup_path: Function to generate setup paths.
1398     """
1399     setup_file(setup_path("phpldapadmin-config.php"), path,
1400             {"S4_LDAPI_URI": ldapi_uri})
1401
1402
1403 def create_zone_file(path, setup_path, dnsdomain, domaindn,
1404                      hostip, hostip6, hostname, dnspass, realm, domainguid, hostguid):
1405     """Write out a DNS zone file, from the info in the current database.
1406
1407     :param path: Path of the new zone file.
1408     :param setup_path: Setup path function.
1409     :param dnsdomain: DNS Domain name
1410     :param domaindn: DN of the Domain
1411     :param hostip: Local IPv4 IP
1412     :param hostip6: Local IPv6 IP
1413     :param hostname: Local hostname
1414     :param dnspass: Password for DNS
1415     :param realm: Realm name
1416     :param domainguid: GUID of the domain.
1417     :param hostguid: GUID of the host.
1418     """
1419     assert isinstance(domainguid, str)
1420
1421     if hostip6 is not None:
1422         hostip6_base_line = "            IN AAAA    " + hostip6
1423         hostip6_host_line = hostname + "        IN AAAA    " + hostip6
1424     else:
1425         hostip6_base_line = ""
1426         hostip6_host_line = ""
1427
1428     setup_file(setup_path("provision.zone"), path, {
1429             "DNSPASS_B64": b64encode(dnspass),
1430             "HOSTNAME": hostname,
1431             "DNSDOMAIN": dnsdomain,
1432             "REALM": realm,
1433             "HOSTIP": hostip,
1434             "DOMAINGUID": domainguid,
1435             "DATESTRING": time.strftime("%Y%m%d%H"),
1436             "DEFAULTSITE": DEFAULTSITE,
1437             "HOSTGUID": hostguid,
1438             "HOSTIP6_BASE_LINE": hostip6_base_line,
1439             "HOSTIP6_HOST_LINE": hostip6_host_line,
1440         })
1441
1442
1443 def create_named_conf(path, setup_path, realm, dnsdomain,
1444                       private_dir):
1445     """Write out a file containing zone statements suitable for inclusion in a
1446     named.conf file (including GSS-TSIG configuration).
1447
1448     :param path: Path of the new named.conf file.
1449     :param setup_path: Setup path function.
1450     :param realm: Realm name
1451     :param dnsdomain: DNS Domain name
1452     :param private_dir: Path to private directory
1453     :param keytab_name: File name of DNS keytab file
1454     """
1455
1456     setup_file(setup_path("named.conf"), path, {
1457             "DNSDOMAIN": dnsdomain,
1458             "REALM": realm,
1459             "REALM_WC": "*." + ".".join(realm.split(".")[1:]),
1460             "PRIVATE_DIR": private_dir
1461             })
1462
1463 def create_named_txt(path, setup_path, realm, dnsdomain,
1464                       private_dir, keytab_name):
1465     """Write out a file containing zone statements suitable for inclusion in a
1466     named.conf file (including GSS-TSIG configuration).
1467
1468     :param path: Path of the new named.conf file.
1469     :param setup_path: Setup path function.
1470     :param realm: Realm name
1471     :param dnsdomain: DNS Domain name
1472     :param private_dir: Path to private directory
1473     :param keytab_name: File name of DNS keytab file
1474     """
1475
1476     setup_file(setup_path("named.txt"), path, {
1477             "DNSDOMAIN": dnsdomain,
1478             "REALM": realm,
1479             "DNS_KEYTAB": keytab_name,
1480             "DNS_KEYTAB_ABS": os.path.join(private_dir, keytab_name),
1481             "PRIVATE_DIR": private_dir
1482         })
1483
1484 def create_krb5_conf(path, setup_path, dnsdomain, hostname, realm):
1485     """Write out a file containing zone statements suitable for inclusion in a
1486     named.conf file (including GSS-TSIG configuration).
1487
1488     :param path: Path of the new named.conf file.
1489     :param setup_path: Setup path function.
1490     :param dnsdomain: DNS Domain name
1491     :param hostname: Local hostname
1492     :param realm: Realm name
1493     """
1494
1495     setup_file(setup_path("krb5.conf"), path, {
1496             "DNSDOMAIN": dnsdomain,
1497             "HOSTNAME": hostname,
1498             "REALM": realm,
1499         })
1500
1501
1502 def load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename,
1503                 serverdn, servername):
1504     """Load schema for the SamDB.
1505
1506     :param samdb: Load a schema into a SamDB.
1507     :param setup_path: Setup path function.
1508     :param schemadn: DN of the schema
1509     :param netbiosname: NetBIOS name of the host.
1510     :param configdn: DN of the configuration
1511     :param serverdn: DN of the server
1512     :param servername: Host name of the server
1513     """
1514     schema_data = open(setup_path("schema.ldif"), 'r').read()
1515     schema_data += open(setup_path("schema_samba4.ldif"), 'r').read()
1516     schema_data = substitute_var(schema_data, {"SCHEMADN": schemadn})
1517     check_all_substituted(schema_data)
1518     prefixmap = open(setup_path("prefixMap.txt"), 'r').read()
1519     prefixmap = b64encode(prefixmap)
1520
1521     head_data = open(setup_path("provision_schema_basedn_modify.ldif"), 'r').read()
1522     head_data = substitute_var(head_data, {
1523                     "SCHEMADN": schemadn,
1524                     "NETBIOSNAME": netbiosname,
1525                     "CONFIGDN": configdn,
1526                     "DEFAULTSITE": sitename,
1527                     "PREFIXMAP_B64": prefixmap,
1528                     "SERVERDN": serverdn,
1529                     "SERVERNAME": servername,
1530     })
1531     check_all_substituted(head_data)
1532     samdb.attach_schema_from_ldif(head_data, schema_data)
1533