X-Git-Url: http://git.samba.org/?a=blobdiff_plain;f=python%2Fsamba%2Fprovision%2Fsambadns.py;h=a04d8b83ddbe0d8e2da6aace962f1a06fbb3959b;hb=1a86733d034019083cadb137cb81dba661f96b66;hp=4522683fe8b2f334cbfc1317ada10b0dbf729963;hpb=87afc3aee1ea593069322a49355dd8780d99e123;p=samba.git diff --git a/python/samba/provision/sambadns.py b/python/samba/provision/sambadns.py index 4522683fe8b..a04d8b83ddb 100644 --- a/python/samba/provision/sambadns.py +++ b/python/samba/provision/sambadns.py @@ -26,17 +26,21 @@ import shutil import time import ldb from base64 import b64encode +import subprocess import samba from samba.tdb_util import tdb_copy +from samba.mdb_util import mdb_copy from samba.ndr import ndr_pack, ndr_unpack from samba import setup_file from samba.dcerpc import dnsp, misc, security from samba.dsdb import ( DS_DOMAIN_FUNCTION_2000, DS_DOMAIN_FUNCTION_2003, - DS_DOMAIN_FUNCTION_2008_R2 + DS_DOMAIN_FUNCTION_2008_R2, + DS_DOMAIN_FUNCTION_2012_R2, + DS_DOMAIN_FUNCTION_2016 ) -from samba.provision.descriptor import ( +from samba.descriptor import ( get_domain_descriptor, get_domain_delete_protected1_descriptor, get_domain_delete_protected2_descriptor, @@ -48,9 +52,14 @@ from samba.provision.common import ( setup_path, setup_add_ldif, setup_modify_ldif, - setup_ldb + setup_ldb, + FILL_FULL, + FILL_SUBDOMAIN, + FILL_NT4SYNC, + FILL_DRS, ) +from samba.samdb import get_default_backend_store def get_domainguid(samdb, domaindn): res = samdb.search(base=domaindn, scope=ldb.SCOPE_BASE, attrs=["objectGUID"]) @@ -125,6 +134,7 @@ class SOARecord(dnsp.DnssrvRpcRecord): soa.expire = expire soa.mname = mname soa.rname = rname + soa.minimum = minimum self.data = soa @@ -230,47 +240,62 @@ class AgingEnabledTimeProperty(dnsp.DnsProperty): def setup_dns_partitions(samdb, domainsid, domaindn, forestdn, configdn, - serverdn): + serverdn, fill_level): domainzone_dn = "DC=DomainDnsZones,%s" % domaindn forestzone_dn = "DC=ForestDnsZones,%s" % forestdn descriptor = get_dns_partition_descriptor(domainsid) + setup_add_ldif(samdb, setup_path("provision_dnszones_partitions.ldif"), { - "DOMAINZONE_DN": domainzone_dn, - "FORESTZONE_DN": forestzone_dn, - "SECDESC" : b64encode(descriptor) + "ZONE_DN": domainzone_dn, + "SECDESC" : b64encode(descriptor).decode('utf8') + }) + if fill_level != FILL_SUBDOMAIN: + setup_add_ldif(samdb, setup_path("provision_dnszones_partitions.ldif"), { + "ZONE_DN": forestzone_dn, + "SECDESC" : b64encode(descriptor).decode('utf8') }) domainzone_guid = get_domainguid(samdb, domainzone_dn) - forestzone_guid = get_domainguid(samdb, forestzone_dn) - domainzone_guid = str(uuid.uuid4()) - forestzone_guid = str(uuid.uuid4()) - domainzone_dns = ldb.Dn(samdb, domainzone_dn).canonical_ex_str().strip() - forestzone_dns = ldb.Dn(samdb, forestzone_dn).canonical_ex_str().strip() protected1_desc = get_domain_delete_protected1_descriptor(domainsid) protected2_desc = get_domain_delete_protected2_descriptor(domainsid) setup_add_ldif(samdb, setup_path("provision_dnszones_add.ldif"), { - "DOMAINZONE_DN": domainzone_dn, - "FORESTZONE_DN": forestzone_dn, - "DOMAINZONE_GUID": domainzone_guid, - "FORESTZONE_GUID": forestzone_guid, - "DOMAINZONE_DNS": domainzone_dns, - "FORESTZONE_DNS": forestzone_dns, + "ZONE_DN": domainzone_dn, + "ZONE_GUID": domainzone_guid, + "ZONE_DNS": domainzone_dns, "CONFIGDN": configdn, "SERVERDN": serverdn, - "LOSTANDFOUND_DESCRIPTOR": b64encode(protected2_desc), - "INFRASTRUCTURE_DESCRIPTOR": b64encode(protected1_desc), + "LOSTANDFOUND_DESCRIPTOR": b64encode(protected2_desc).decode('utf8'), + "INFRASTRUCTURE_DESCRIPTOR": b64encode(protected1_desc).decode('utf8'), }) - setup_modify_ldif(samdb, setup_path("provision_dnszones_modify.ldif"), { "CONFIGDN": configdn, "SERVERDN": serverdn, - "DOMAINZONE_DN": domainzone_dn, - "FORESTZONE_DN": forestzone_dn, + "ZONE_DN": domainzone_dn, }) + if fill_level != FILL_SUBDOMAIN: + forestzone_guid = get_domainguid(samdb, forestzone_dn) + forestzone_guid = str(uuid.uuid4()) + forestzone_dns = ldb.Dn(samdb, forestzone_dn).canonical_ex_str().strip() + + setup_add_ldif(samdb, setup_path("provision_dnszones_add.ldif"), { + "ZONE_DN": forestzone_dn, + "ZONE_GUID": forestzone_guid, + "ZONE_DNS": forestzone_dns, + "CONFIGDN": configdn, + "SERVERDN": serverdn, + "LOSTANDFOUND_DESCRIPTOR": b64encode(protected2_desc).decode('utf8'), + "INFRASTRUCTURE_DESCRIPTOR": b64encode(protected1_desc).decode('utf8'), + }) + setup_modify_ldif(samdb, setup_path("provision_dnszones_modify.ldif"), { + "CONFIGDN": configdn, + "SERVERDN": serverdn, + "ZONE_DN": forestzone_dn, + }) + def add_dns_accounts(samdb, domaindn): setup_add_ldif(samdb, setup_path("provision_dns_accounts_add.ldif"), { @@ -295,15 +320,16 @@ def add_dns_container(samdb, domaindn, prefix, domain_sid, dnsadmins_sid, forest def add_rootservers(samdb, domaindn, prefix): + # https://www.internic.net/zones/named.root rootservers = {} rootservers["a.root-servers.net"] = "198.41.0.4" rootservers["b.root-servers.net"] = "192.228.79.201" rootservers["c.root-servers.net"] = "192.33.4.12" - rootservers["d.root-servers.net"] = "128.8.10.90" + rootservers["d.root-servers.net"] = "199.7.91.13" rootservers["e.root-servers.net"] = "192.203.230.10" rootservers["f.root-servers.net"] = "192.5.5.241" rootservers["g.root-servers.net"] = "192.112.36.4" - rootservers["h.root-servers.net"] = "128.63.2.53" + rootservers["h.root-servers.net"] = "198.97.190.53" rootservers["i.root-servers.net"] = "192.36.148.17" rootservers["j.root-servers.net"] = "192.58.128.30" rootservers["k.root-servers.net"] = "193.0.14.129" @@ -312,10 +338,17 @@ def add_rootservers(samdb, domaindn, prefix): rootservers_v6 = {} rootservers_v6["a.root-servers.net"] = "2001:503:ba3e::2:30" + rootservers_v6["b.root-servers.net"] = "2001:500:84::b" + rootservers_v6["c.root-servers.net"] = "2001:500:2::c" + rootservers_v6["d.root-servers.net"] = "2001:500:2d::d" + rootservers_v6["e.root-servers.net"] = "2001:500:a8::e" rootservers_v6["f.root-servers.net"] = "2001:500:2f::f" - rootservers_v6["h.root-servers.net"] = "2001:500:1::803f:235" + rootservers_v6["g.root-servers.net"] = "2001:500:12::d0d" + rootservers_v6["h.root-servers.net"] = "2001:500:1::53" + rootservers_v6["i.root-servers.net"] = "2001:7fe::53" rootservers_v6["j.root-servers.net"] = "2001:503:c27::2:30" rootservers_v6["k.root-servers.net"] = "2001:7fd::1" + rootservers_v6["l.root-servers.net"] = "2001:500:9f::42" rootservers_v6["m.root-servers.net"] = "2001:dc3::35" container_dn = "DC=RootDNSServers,CN=MicrosoftDNS,%s,%s" % (prefix, domaindn) @@ -619,8 +652,8 @@ def add_dc_msdcs_records(samdb, forestdn, prefix, site, dnsforest, hostname, fqdn_hostname) -def secretsdb_setup_dns(secretsdb, names, private_dir, realm, - dnsdomain, dns_keytab_path, dnspass): +def secretsdb_setup_dns(secretsdb, names, private_dir, binddns_dir, realm, + dnsdomain, dns_keytab_path, dnspass, key_version_number): """Add DNS specific bits to a secrets database. :param secretsdb: Ldb Handle to the secrets database @@ -629,14 +662,21 @@ def secretsdb_setup_dns(secretsdb, names, private_dir, realm, """ try: os.unlink(os.path.join(private_dir, dns_keytab_path)) + os.unlink(os.path.join(binddns_dir, dns_keytab_path)) except OSError: pass + if key_version_number is None: + key_version_number = 1 + + # This will create the dns.keytab file in the private_dir when it is + # commited! setup_ldb(secretsdb, setup_path("secrets_dns.ldif"), { "REALM": realm, "DNSDOMAIN": dnsdomain, "DNS_KEYTAB": dns_keytab_path, - "DNSPASS_B64": b64encode(dnspass), + "DNSPASS_B64": b64encode(dnspass.encode('utf-8')).decode('utf8'), + "KEY_VERSION_NUMBER": str(key_version_number), "HOSTNAME": names.hostname, "DNSNAME" : '%s.%s' % ( names.netbiosname.lower(), names.dnsdomain.lower()) @@ -656,13 +696,13 @@ def create_dns_dir(logger, paths): except OSError: pass - os.mkdir(dns_dir, 0770) + os.mkdir(dns_dir, 0o770) if paths.bind_gid is not None: try: os.chown(dns_dir, -1, paths.bind_gid) # chmod needed to cope with umask - os.chmod(dns_dir, 0770) + os.chmod(dns_dir, 0o770) except OSError: if not os.environ.has_key('SAMBA_SELFTEST'): logger.error("Failed to chown %s to bind gid %u" % ( @@ -729,7 +769,7 @@ def create_zone_file(lp, logger, paths, targetdir, dnsdomain, try: os.chown(paths.dns, -1, paths.bind_gid) # chmod needed to cope with umask - os.chmod(paths.dns, 0664) + os.chmod(paths.dns, 0o664) except OSError: if not os.environ.has_key('SAMBA_SELFTEST'): logger.error("Failed to chown %s to bind gid %u" % ( @@ -749,22 +789,35 @@ def create_samdb_copy(samdb, logger, paths, names, domainsid, domainguid): # Find the partitions and corresponding filenames partfile = {} - res = samdb.search(base="@PARTITION", scope=ldb.SCOPE_BASE, attrs=["partition"]) + res = samdb.search(base="@PARTITION", + scope=ldb.SCOPE_BASE, + attrs=["partition", "backendStore"]) for tmp in res[0]["partition"]: (nc, fname) = tmp.split(':') partfile[nc.upper()] = fname + backend_store = get_default_backend_store() + if "backendStore" in res[0]: + backend_store = res[0]["backendStore"][0] + # Create empty domain partition + domaindn = names.domaindn.upper() domainpart_file = os.path.join(dns_dir, partfile[domaindn]) try: os.mkdir(dns_samldb_dir) - file(domainpart_file, 'w').close() + open(domainpart_file, 'w').close() # Fill the basedn and @OPTION records in domain partition - dom_ldb = samba.Ldb(domainpart_file) + dom_url = "%s://%s" % (backend_store, domainpart_file) + dom_ldb = samba.Ldb(dom_url) + + # We need the dummy main-domain DB to have the correct @INDEXLIST + index_res = samdb.search(base="@INDEXLIST", scope=ldb.SCOPE_BASE) + dom_ldb.add(index_res[0]) + domainguid_line = "objectGUID: %s\n-" % domainguid - descr = b64encode(get_domain_descriptor(domainsid)) + descr = b64encode(get_domain_descriptor(domainsid)).decode('utf8') setup_add_ldif(dom_ldb, setup_path("provision_basedn.ldif"), { "DOMAINDN" : names.domaindn, "DOMAINGUID" : domainguid_line, @@ -772,31 +825,44 @@ def create_samdb_copy(samdb, logger, paths, names, domainsid, domainguid): "DESCRIPTOR" : descr}) setup_add_ldif(dom_ldb, setup_path("provision_basedn_options.ldif"), None) + except: logger.error( "Failed to setup database for BIND, AD based DNS cannot be used") raise + + # This line is critical to the security of the whole scheme. + # We assume there is no secret data in the (to be left out of + # date and essentially read-only) config, schema and metadata partitions. + # + # Only the stub of the domain partition is created above. + # + # That way, things like the krbtgt key do not leak. del partfile[domaindn] # Link dns partitions and metadata domainzonedn = "DC=DOMAINDNSZONES,%s" % names.domaindn.upper() forestzonedn = "DC=FORESTDNSZONES,%s" % names.rootdn.upper() + domainzone_file = partfile[domainzonedn] - forestzone_file = partfile[forestzonedn] + forestzone_file = partfile.get(forestzonedn) + metadata_file = "metadata.tdb" try: os.link(os.path.join(samldb_dir, metadata_file), os.path.join(dns_samldb_dir, metadata_file)) os.link(os.path.join(private_dir, domainzone_file), os.path.join(dns_dir, domainzone_file)) - os.link(os.path.join(private_dir, forestzone_file), - os.path.join(dns_dir, forestzone_file)) + if forestzone_file: + os.link(os.path.join(private_dir, forestzone_file), + os.path.join(dns_dir, forestzone_file)) except OSError: logger.error( "Failed to setup database for BIND, AD based DNS cannot be used") raise del partfile[domainzonedn] - del partfile[forestzonedn] + if forestzone_file: + del partfile[forestzonedn] # Copy root, config, schema partitions (and any other if any) # Since samdb is open in the current process, copy them in a child process @@ -805,8 +871,12 @@ def create_samdb_copy(samdb, logger, paths, names, domainsid, domainguid): os.path.join(dns_dir, "sam.ldb")) for nc in partfile: pfile = partfile[nc] - tdb_copy(os.path.join(private_dir, pfile), - os.path.join(dns_dir, pfile)) + if backend_store == "mdb": + mdb_copy(os.path.join(private_dir, pfile), + os.path.join(dns_dir, pfile)) + else: + tdb_copy(os.path.join(private_dir, pfile), + os.path.join(dns_dir, pfile)) except: logger.error( "Failed to setup database for BIND, AD based DNS cannot be used") @@ -815,19 +885,16 @@ def create_samdb_copy(samdb, logger, paths, names, domainsid, domainguid): # Give bind read/write permissions dns partitions if paths.bind_gid is not None: try: - os.chown(samldb_dir, -1, paths.bind_gid) - os.chmod(samldb_dir, 0750) - for dirname, dirs, files in os.walk(dns_dir): for d in dirs: dpath = os.path.join(dirname, d) os.chown(dpath, -1, paths.bind_gid) - os.chmod(dpath, 0770) + os.chmod(dpath, 0o770) for f in files: - if f.endswith('.ldb') or f.endswith('.tdb'): + if f.endswith(('.ldb', '.tdb', 'ldb-lock')): fpath = os.path.join(dirname, f) os.chown(fpath, -1, paths.bind_gid) - os.chmod(fpath, 0660) + os.chmod(fpath, 0o660) except OSError: if not os.environ.has_key('SAMBA_SELFTEST'): logger.error( @@ -846,7 +913,7 @@ def create_dns_update_list(lp, logger, paths): setup_file(setup_path("spn_update_list"), paths.spn_update_list, None) -def create_named_conf(paths, realm, dnsdomain, dns_backend): +def create_named_conf(paths, realm, dnsdomain, dns_backend, logger): """Write out a file containing zone statements suitable for inclusion in a named.conf file (including GSS-TSIG configuration). @@ -855,8 +922,16 @@ def create_named_conf(paths, realm, dnsdomain, dns_backend): :param dnsdomain: DNS Domain name :param dns_backend: DNS backend type :param keytab_name: File name of DNS keytab file + :param logger: Logger object """ + # TODO: This really should have been done as a top level import. + # It is done here to avoid a depencency loop. That is, we move + # ProvisioningError to another file, and have all the provision + # scripts import it from there. + + from samba.provision import ProvisioningError + if dns_backend == "BIND9_FLATFILE": setup_file(setup_path("named.conf"), paths.namedconf, { "DNSDOMAIN": dnsdomain, @@ -870,13 +945,41 @@ def create_named_conf(paths, realm, dnsdomain, dns_backend): setup_file(setup_path("named.conf.update"), paths.namedconf_update) elif dns_backend == "BIND9_DLZ": + bind_info = subprocess.Popen(['named -V'], shell=True, + stdout=subprocess.PIPE, + stderr=subprocess.STDOUT, + cwd='.').communicate()[0] + bind9_8 = '#' + bind9_9 = '#' + bind9_10 = '#' + bind9_11 = '#' + bind9_12 = '#' + if bind_info.upper().find('BIND 9.8') != -1: + bind9_8 = '' + elif bind_info.upper().find('BIND 9.9') != -1: + bind9_9 = '' + elif bind_info.upper().find('BIND 9.10') != -1: + bind9_10 = '' + elif bind_info.upper().find('BIND 9.11') != -1: + bind9_11 = '' + elif bind_info.upper().find('BIND 9.12') != -1: + bind9_12 = '' + elif bind_info.upper().find('BIND 9.7') != -1: + raise ProvisioningError("DLZ option incompatible with BIND 9.7.") + else: + logger.warning("BIND version unknown, please modify %s manually." % paths.namedconf) setup_file(setup_path("named.conf.dlz"), paths.namedconf, { "NAMED_CONF": paths.namedconf, "MODULESDIR" : samba.param.modules_dir(), + "BIND9_8" : bind9_8, + "BIND9_9" : bind9_9, + "BIND9_10" : bind9_10, + "BIND9_11" : bind9_11, + "BIND9_12" : bind9_12 }) -def create_named_txt(path, realm, dnsdomain, dnsname, private_dir, +def create_named_txt(path, realm, dnsdomain, dnsname, binddns_dir, keytab_name): """Write out a file containing zone statements suitable for inclusion in a named.conf file (including GSS-TSIG configuration). @@ -884,7 +987,7 @@ def create_named_txt(path, realm, dnsdomain, dnsname, private_dir, :param path: Path of the new named.conf file. :param realm: Realm name :param dnsdomain: DNS Domain name - :param private_dir: Path to private directory + :param binddns_dir: Path to bind dns directory :param keytab_name: File name of DNS keytab file """ setup_file(setup_path("named.txt"), path, { @@ -892,8 +995,8 @@ def create_named_txt(path, realm, dnsdomain, dnsname, private_dir, "DNSNAME" : dnsname, "REALM": realm, "DNS_KEYTAB": keytab_name, - "DNS_KEYTAB_ABS": os.path.join(private_dir, keytab_name), - "PRIVATE_DIR": private_dir + "DNS_KEYTAB_ABS": os.path.join(binddns_dir, keytab_name), + "PRIVATE_DIR": binddns_dir }) @@ -902,7 +1005,7 @@ def is_valid_dns_backend(dns_backend): def is_valid_os_level(os_level): - return DS_DOMAIN_FUNCTION_2000 <= os_level <= DS_DOMAIN_FUNCTION_2008_R2 + return DS_DOMAIN_FUNCTION_2000 <= os_level <= DS_DOMAIN_FUNCTION_2016 def create_dns_legacy(samdb, domainsid, forestdn, dnsadmins_sid): @@ -924,21 +1027,23 @@ def fill_dns_data_legacy(samdb, domainsid, forestdn, dnsdomain, site, hostname, def create_dns_partitions(samdb, domainsid, names, domaindn, forestdn, - dnsadmins_sid): + dnsadmins_sid, fill_level): # Set up additional partitions (DomainDnsZones, ForstDnsZones) setup_dns_partitions(samdb, domainsid, domaindn, forestdn, - names.configdn, names.serverdn) + names.configdn, names.serverdn, fill_level) # Set up MicrosoftDNS containers add_dns_container(samdb, domaindn, "DC=DomainDnsZones", domainsid, dnsadmins_sid) - add_dns_container(samdb, forestdn, "DC=ForestDnsZones", domainsid, - dnsadmins_sid, forest=True) + if fill_level != FILL_SUBDOMAIN: + add_dns_container(samdb, forestdn, "DC=ForestDnsZones", domainsid, + dnsadmins_sid, forest=True) def fill_dns_data_partitions(samdb, domainsid, site, domaindn, forestdn, - dnsdomain, dnsforest, hostname, hostip, hostip6, - domainguid, ntdsguid, dnsadmins_sid, autofill=True): + dnsdomain, dnsforest, hostname, hostip, hostip6, + domainguid, ntdsguid, dnsadmins_sid, autofill=True, + fill_level=FILL_FULL, add_root=True): """Fill data in various AD partitions :param samdb: LDB object connected to sam.ldb file @@ -959,7 +1064,8 @@ def fill_dns_data_partitions(samdb, domainsid, site, domaindn, forestdn, ##### Set up DC=DomainDnsZones, # Add rootserver records - add_rootservers(samdb, domaindn, "DC=DomainDnsZones") + if add_root: + add_rootservers(samdb, domaindn, "DC=DomainDnsZones") # Add domain record add_domain_record(samdb, domaindn, "DC=DomainDnsZones", dnsdomain, @@ -970,32 +1076,31 @@ def fill_dns_data_partitions(samdb, domainsid, site, domaindn, forestdn, add_dc_domain_records(samdb, domaindn, "DC=DomainDnsZones", site, dnsdomain, hostname, hostip, hostip6) - ##### Set up DC=ForestDnsZones, - # Add _msdcs record - add_msdcs_record(samdb, forestdn, "DC=ForestDnsZones", dnsforest) + if fill_level != FILL_SUBDOMAIN: + ##### Set up DC=ForestDnsZones, + # Add _msdcs record + add_msdcs_record(samdb, forestdn, "DC=ForestDnsZones", dnsforest) - # Add DNS records for a DC in forest - if autofill: - add_dc_msdcs_records(samdb, forestdn, "DC=ForestDnsZones", site, - dnsforest, hostname, hostip, hostip6, - domainguid, ntdsguid) + # Add DNS records for a DC in forest + if autofill: + add_dc_msdcs_records(samdb, forestdn, "DC=ForestDnsZones", site, + dnsforest, hostname, hostip, hostip6, + domainguid, ntdsguid) -def setup_ad_dns(samdb, secretsdb, domainsid, names, paths, lp, logger, - dns_backend, os_level, site, dnspass=None, hostip=None, hostip6=None, - targetdir=None): +def setup_ad_dns(samdb, secretsdb, names, paths, lp, logger, + dns_backend, os_level, dnspass=None, hostip=None, hostip6=None, + targetdir=None, fill_level=FILL_FULL, backend_store=None): """Provision DNS information (assuming GC role) :param samdb: LDB object connected to sam.ldb file :param secretsdb: LDB object connected to secrets.ldb file - :param domainsid: Domain SID (as dom_sid object) :param names: Names shortcut :param paths: Paths shortcut :param lp: Loadparm object :param logger: Logger object :param dns_backend: Type of DNS backend :param os_level: Functional level (treated as os level) - :param site: Site to create hostnames in :param dnspass: Password for bind's DNS account :param hostip: IPv4 address :param hostip6: IPv6 address @@ -1017,18 +1122,18 @@ def setup_ad_dns(samdb, secretsdb, domainsid, names, paths, lp, logger, add_dns_accounts(samdb, names.domaindn) # If dns_backend is BIND9_FLATFILE - # Populate only CN=MicrosoftDNS,CN=System, + # Populate only CN=MicrosoftDNS,CN=System, # # If dns_backend is SAMBA_INTERNAL or BIND9_DLZ # Populate DNS partitions # If os_level < 2003 (DS_DOMAIN_FUNCTION_2000) - # All dns records are in CN=MicrosoftDNS,CN=System, + # All dns records are in CN=MicrosoftDNS,CN=System, # # If os_level >= 2003 (DS_DOMAIN_FUNCTION_2003, DS_DOMAIN_FUNCTION_2008, # DS_DOMAIN_FUNCTION_2008_R2) - # Root server records are in CN=MicrosoftDNS,CN=System, - # Domain records are in CN=MicrosoftDNS,CN=System, + # Root server records are in CN=MicrosoftDNS,CN=System, + # Domain records are in CN=MicrosoftDNS,CN=System, # Domain records are in CN=MicrosoftDNS,DC=DomainDnsZones, # Forest records are in CN=MicrosoftDNS,DC=ForestDnsZones, domaindn = names.domaindn @@ -1037,49 +1142,61 @@ def setup_ad_dns(samdb, secretsdb, domainsid, names, paths, lp, logger, dnsdomain = names.dnsdomain.lower() dnsforest = dnsdomain + site = names.sitename + hostname = names.netbiosname.lower() dnsadmins_sid = get_dnsadmins_sid(samdb, domaindn) domainguid = get_domainguid(samdb, domaindn) - # Create CN=System - logger.info("Creating CN=MicrosoftDNS,CN=System,%s" % forestdn) - create_dns_legacy(samdb, domainsid, forestdn, dnsadmins_sid) - - if os_level == DS_DOMAIN_FUNCTION_2000: - # Populating legacy dns - logger.info("Populating CN=MicrosoftDNS,CN=System,%s" % forestdn) - fill_dns_data_legacy(samdb, domainsid, forestdn, dnsdomain, site, - hostname, hostip, hostip6, dnsadmins_sid) - - elif dns_backend in ("SAMBA_INTERNAL", "BIND9_DLZ") and \ - os_level >= DS_DOMAIN_FUNCTION_2003: - - # Create DNS partitions - logger.info("Creating DomainDnsZones and ForestDnsZones partitions") - create_dns_partitions(samdb, domainsid, names, domaindn, forestdn, - dnsadmins_sid) + samdb.transaction_start() + try: + # Create CN=System + logger.info("Creating CN=MicrosoftDNS,CN=System,%s" % domaindn) + create_dns_legacy(samdb, names.domainsid, domaindn, dnsadmins_sid) + + if os_level == DS_DOMAIN_FUNCTION_2000: + # Populating legacy dns + logger.info("Populating CN=MicrosoftDNS,CN=System,%s" % domaindn) + fill_dns_data_legacy(samdb, names.domainsid, domaindn, dnsdomain, site, + hostname, hostip, hostip6, dnsadmins_sid) + + elif dns_backend in ("SAMBA_INTERNAL", "BIND9_DLZ") and \ + os_level >= DS_DOMAIN_FUNCTION_2003: + + # Create DNS partitions + logger.info("Creating DomainDnsZones and ForestDnsZones partitions") + create_dns_partitions(samdb, names.domainsid, names, domaindn, forestdn, + dnsadmins_sid, fill_level) + + # Populating dns partitions + logger.info("Populating DomainDnsZones and ForestDnsZones partitions") + fill_dns_data_partitions(samdb, names.domainsid, site, domaindn, forestdn, + dnsdomain, dnsforest, hostname, hostip, hostip6, + domainguid, names.ntdsguid, dnsadmins_sid, + fill_level=fill_level) - # Populating dns partitions - logger.info("Populating DomainDnsZones and ForestDnsZones partitions") - fill_dns_data_partitions(samdb, domainsid, site, domaindn, forestdn, - dnsdomain, dnsforest, hostname, hostip, hostip6, - domainguid, names.ntdsguid, dnsadmins_sid) + except: + samdb.transaction_cancel() + raise + else: + samdb.transaction_commit() if dns_backend.startswith("BIND9_"): - setup_bind9_dns(samdb, secretsdb, domainsid, names, paths, lp, logger, - dns_backend, os_level, site=site, dnspass=dnspass, hostip=hostip, - hostip6=hostip6, targetdir=targetdir) + setup_bind9_dns(samdb, secretsdb, names, paths, lp, logger, + dns_backend, os_level, site=site, dnspass=dnspass, hostip=hostip, + hostip6=hostip6, targetdir=targetdir, + backend_store=backend_store) -def setup_bind9_dns(samdb, secretsdb, domainsid, names, paths, lp, logger, +def setup_bind9_dns(samdb, secretsdb, names, paths, lp, logger, dns_backend, os_level, site=None, dnspass=None, hostip=None, - hostip6=None, targetdir=None): + hostip6=None, targetdir=None, key_version_number=None, + backend_store=None): """Provision DNS information (assuming BIND9 backend in DC role) :param samdb: LDB object connected to sam.ldb file :param secretsdb: LDB object connected to secrets.ldb file - :param domainsid: Domain SID (as dom_sid object) :param names: Names shortcut :param paths: Paths shortcut :param lp: Loadparm object @@ -1105,9 +1222,12 @@ def setup_bind9_dns(samdb, secretsdb, domainsid, names, paths, lp, logger, domainguid = get_domainguid(samdb, domaindn) secretsdb_setup_dns(secretsdb, names, - paths.private_dir, realm=names.realm, + paths.private_dir, + paths.binddns_dir, + realm=names.realm, dnsdomain=names.dnsdomain, - dns_keytab_path=paths.dns_keytab, dnspass=dnspass) + dns_keytab_path=paths.dns_keytab, dnspass=dnspass, + key_version_number=key_version_number) create_dns_dir(logger, paths) @@ -1119,15 +1239,17 @@ def setup_bind9_dns(samdb, secretsdb, domainsid, names, paths, lp, logger, ntdsguid=names.ntdsguid) if dns_backend == "BIND9_DLZ" and os_level >= DS_DOMAIN_FUNCTION_2003: - create_samdb_copy(samdb, logger, paths, names, domainsid, domainguid) + create_samdb_copy(samdb, logger, paths, + names, names.domainsid, domainguid) create_named_conf(paths, realm=names.realm, - dnsdomain=names.dnsdomain, dns_backend=dns_backend) + dnsdomain=names.dnsdomain, dns_backend=dns_backend, + logger=logger) create_named_txt(paths.namedtxt, realm=names.realm, dnsdomain=names.dnsdomain, dnsname = "%s.%s" % (names.hostname, names.dnsdomain), - private_dir=paths.private_dir, + binddns_dir=paths.binddns_dir, keytab_name=paths.dns_keytab) logger.info("See %s for an example configuration include file for BIND", paths.namedconf)