import samba.auth
from samba.auth import AUTH_SESSION_INFO_DEFAULT_GROUPS, AUTH_SESSION_INFO_AUTHENTICATED, AUTH_SESSION_INFO_SIMPLE_PRIVILEGES
from samba.netcmd.common import netcmd_finddc
+from samba import policy
from samba import smb
+import uuid
def samdb_connect(ctx):
return default
-def flags_string(flags, value):
- '''return a set of flags as a string'''
- if value == 0:
- return 'NONE'
- ret = ''
- for (str, val) in flags:
- if val & value:
- ret += str + ' '
- value &= ~val
- if value != 0:
- ret += '0x%08x' % value
- return ret.rstrip()
+def gpo_flags_string(value):
+ '''return gpo flags string'''
+ flags = policy.get_gpo_flags(value)
+ if not flags:
+ ret = 'NONE'
+ else:
+ ret = ' '.join(flags)
+ return ret
+
+
+def gplink_options_string(value):
+ '''return gplink options string'''
+ options = policy.get_gplink_options(value)
+ if not options:
+ ret = 'NONE'
+ else:
+ ret = ' '.join(options)
+ return ret
def parse_gplink(gplink):
search_scope = ldb.SCOPE_ONELEVEL
if gpo is not None:
- search_expr = "(&(objectClass=groupPolicyContainer)(name=%s))" % gpo
+ search_expr = "(&(objectClass=groupPolicyContainer)(name=%s))" % ldb.binary_encode(gpo)
if displayname is not None:
- search_expr = "(&(objectClass=groupPolicyContainer)(displayname=%s))" % displayname
+ search_expr = "(&(objectClass=groupPolicyContainer)(displayname=%s))" % ldb.binary_encode(displayname)
if dn is not None:
base_dn = dn
return []
-def copy_directory_recurse(conn, remotedir, localdir):
+def copy_directory_remote_to_local(conn, remotedir, localdir):
if not os.path.isdir(localdir):
os.mkdir(localdir)
r_dirs = [ remotedir ]
dirlist = conn.list(r_dir)
for e in dirlist:
r_name = r_dir + '\\' + e['name']
- l_name = l_dir + os.path.sep + e['name']
+ l_name = os.path.join(l_dir, e['name'])
if e['attrib'] & smb.FILE_ATTRIBUTE_DIRECTORY:
r_dirs.append(r_name)
l_dirs.append(l_name)
os.mkdir(l_name)
- elif e['attrib'] & smb.FILE_ATTRIBUTE_ARCHIVE:
+ else:
data = conn.loadfile(r_name)
file(l_name, 'w').write(data)
+def copy_directory_local_to_remote(conn, localdir, remotedir):
+ if not conn.chkpath(remotedir):
+ conn.mkdir(remotedir)
+ l_dirs = [ localdir ]
+ r_dirs = [ remotedir ]
+ while l_dirs:
+ l_dir = l_dirs.pop()
+ r_dir = r_dirs.pop()
+
+ dirlist = os.listdir(l_dir)
+ for e in dirlist:
+ l_name = os.path.join(l_dir, e)
+ r_name = r_dir + '\\' + e
+
+ if os.path.isdir(l_name):
+ l_dirs.append(l_name)
+ r_dirs.append(r_name)
+ conn.mkdir(r_name)
+ else:
+ data = file(l_name, 'r').read()
+ conn.savefile(r_name, data)
+
+
+def create_directory_hier(conn, remotedir):
+ elems = remotedir.replace('/', '\\').split('\\')
+ path = ""
+ for e in elems:
+ path = path + '\\' + e
+ if not conn.chkpath(path):
+ conn.mkdir(path)
+
+
class cmd_listall(Command):
"""list all GPOs"""
samdb_connect(self)
- gpo_flags = [
- ("GPO_FLAG_USER_DISABLE", dsdb.GPO_FLAG_USER_DISABLE ),
- ( "GPO_FLAG_MACHINE_DISABLE", dsdb.GPO_FLAG_MACHINE_DISABLE ) ]
-
msg = get_gpo_info(self.samdb, None)
for m in msg:
print("path : %s" % m['gPCFileSysPath'][0])
print("dn : %s" % m.dn)
print("version : %s" % attr_default(m, 'versionNumber', '0'))
- print("flags : %s" % flags_string(gpo_flags, int(attr_default(m, 'flags', 0))))
+ print("flags : %s" % gpo_flags_string(int(attr_default(m, 'flags', 0))))
print("")
try:
msg = self.samdb.search(expression='(&(|(samAccountName=%s)(samAccountName=%s$))(objectClass=User))' %
- (username,username))
+ (ldb.binary_encode(username),ldb.binary_encode(username)))
user_dn = msg[0].dn
except Exception, e:
raise CommandError("Failed to find account %s" % username, e)
samdb_connect(self)
- gpo_flags = [
- ("GPO_FLAG_USER_DISABLE", dsdb.GPO_FLAG_USER_DISABLE ),
- ( "GPO_FLAG_MACHINE_DISABLE", dsdb.GPO_FLAG_MACHINE_DISABLE ) ]
-
try:
msg = get_gpo_info(self.samdb, gpo)[0]
except Exception, e:
print("path : %s" % msg['gPCFileSysPath'][0])
print("dn : %s" % msg.dn)
print("version : %s" % attr_default(msg, 'versionNumber', '0'))
- print("flags : %s" % flags_string(gpo_flags, int(attr_default(msg, 'flags', 0))))
+ print("flags : %s" % gpo_flags_string(int(attr_default(msg, 'flags', 0))))
print("ACL : %s" % secdesc.as_sddl())
print("")
samdb_connect(self)
- gplink_options = [
- ("GPLINK_OPT_DISABLE", dsdb.GPLINK_OPT_DISABLE),
- ("GPLINK_OPT_ENFORCE", dsdb.GPLINK_OPT_ENFORCE),
- ]
-
try:
msg = self.samdb.search(base=container_dn, scope=ldb.SCOPE_BASE,
expression="(objectClass=*)",
msg = get_gpo_info(self.samdb, dn=g['dn'])
print(" GPO : %s" % msg[0]['name'][0])
print(" Name : %s" % msg[0]['displayName'][0])
- print(" Options : %s" % flags_string(gplink_options, g['options']))
+ print(" Options : %s" % gplink_options_string(g['options']))
print("")
else:
print("No GPO(s) linked to DN=%s" % container_dn)
except Exception, e:
raise CommandError("GPO %s does not exist" % gpo)
+ # verify UNC path
unc = msg['gPCFileSysPath'][0]
try:
[dom_name, service, sharepath] = parse_unc(unc)
except:
raise CommandError("Invalid GPO path (%s)" % unc)
+ # SMB connect to DC
try:
conn = smb.SMB(dc_hostname, service, lp=self.lp, creds=self.creds)
except Exception, e:
raise CommandError("Error connecting to '%s' using SMB" % dc_hostname, e)
+ # Copy GPT
if tmpdir is None:
tmpdir = "/tmp"
+ if not os.path.isdir(tmpdir):
+ raise CommandError("Temoprary directory '%s' does not exist" % tmpdir)
+
+ localdir = os.path.join(tmpdir, "policy")
+ if not os.path.isdir(localdir):
+ os.mkdir(localdir)
+
+ gpodir = os.path.join(localdir, gpo)
+ if os.path.isdir(gpodir):
+ raise CommandError("GPO directory '%s' already exists, refusing to overwrite" % gpodir)
try:
- localdir = tmpdir + os.path.sep + "policy"
- if not os.path.isdir(localdir):
- os.mkdir(localdir)
- gpodir = localdir + os.path.sep + gpo
- if not os.path.isdir(gpodir):
- os.mkdir(gpodir)
- copy_directory_recurse(conn, sharepath, gpodir)
+ os.mkdir(gpodir)
+ copy_directory_remote_to_local(conn, sharepath, gpodir)
except Exception, e:
- raise CommandError("Error copying GPO", e)
+ raise CommandError("Error copying GPO from DC", e)
print('GPO copied to %s' % gpodir)
class cmd_create(Command):
- """Create a GPO"""
+ """Create an empty GPO"""
+
+ synopsis = "%prog gpo create <displayname> [options]"
+
+ takes_optiongroups = {
+ "sambaopts": options.SambaOptions,
+ "versionopts": options.VersionOptions,
+ "credopts": options.CredentialsOptions,
+ }
+
+ takes_args = [ 'displayname' ]
+
+ takes_options = [
+ Option("-H", help="LDB URL for database or target server", type=str),
+ Option("--tmpdir", help="Temporary directory for copying policy files", type=str)
+ ]
+
+ def run(self, displayname, H=None, tmpdir=None, sambaopts=None, credopts=None,
+ versionopts=None):
+
+ self.lp = sambaopts.get_loadparm()
+ self.creds = credopts.get_credentials(self.lp, fallback_machine=True)
+
+ self.url = dc_url(self.lp, self.creds, H)
+
+ dc_hostname = netcmd_finddc(self.lp, self.creds)
+ samdb_connect(self)
+
+ msg = get_gpo_info(self.samdb, displayname=displayname)
+ if msg.count > 0:
+ raise CommandError("A GPO already existing with name '%s'" % displayname)
+
+ # Create new GUID
+ guid = str(uuid.uuid4())
+ gpo = "{%s}" % guid.upper()
+ realm = self.lp.get('realm')
+ unc_path = "\\\\%s\\sysvol\\%s\\Policies\\%s" % (realm, realm, gpo)
+
+ # Create GPT
+ if tmpdir is None:
+ tmpdir = "/tmp"
+ if not os.path.isdir(tmpdir):
+ raise CommandError("Temporary directory '%s' does not exist" % tmpdir)
+
+ localdir = os.path.join(tmpdir, "policy")
+ if not os.path.isdir(localdir):
+ os.mkdir(localdir)
+
+ gpodir = os.path.join(localdir, gpo)
+ if os.path.isdir(gpodir):
+ raise CommandError("GPO directory '%s' already exists, refusing to overwrite" % gpodir)
+
+ try:
+ os.mkdir(gpodir)
+ os.mkdir(os.path.join(gpodir, "Machine"))
+ os.mkdir(os.path.join(gpodir, "User"))
+ gpt_contents = "[General]\r\nVersion=0\r\n"
+ file(os.path.join(gpodir, "GPT.INI"), "w").write(gpt_contents)
+ except Exception, e:
+ raise CommandError("Error Creating GPO files", e)
+
+ # Add cn=<guid>
+ gpo_dn = self.samdb.get_default_basedn()
+ gpo_dn.add_child(ldb.Dn(self.samdb, "CN=Policies,CN=System"))
+ gpo_dn.add_child(ldb.Dn(self.samdb, "CN=%s" % gpo))
+
+ m = ldb.Message()
+ m.dn = ldb.Dn(self.samdb, gpo_dn.get_linearized())
+ m['a01'] = ldb.MessageElement("groupPolicyContainer", ldb.FLAG_MOD_ADD, "objectClass")
+ m['a02'] = ldb.MessageElement(displayname, ldb.FLAG_MOD_ADD, "displayName")
+ m['a03'] = ldb.MessageElement(unc_path, ldb.FLAG_MOD_ADD, "gPCFileSysPath")
+ m['a04'] = ldb.MessageElement("0", ldb.FLAG_MOD_ADD, "flags")
+ m['a05'] = ldb.MessageElement("0", ldb.FLAG_MOD_ADD, "versionNumber")
+ m['a06'] = ldb.MessageElement("TRUE", ldb.FLAG_MOD_ADD, "showInAdvancedViewOnly")
+ m['a07'] = ldb.MessageElement("2", ldb.FLAG_MOD_ADD, "gpcFunctionalityVersion")
+ try:
+ self.samdb.add(m)
+ except Exception, e:
+ raise CommandError("Error adding GPO in AD", e)
+
+ # Add cn=User,cn=<guid>
+ child_dn = gpo_dn
+ child_dn.add_child(ldb.Dn(self.samdb, "CN=User"))
+
+ m = ldb.Message()
+ m.dn = ldb.Dn(self.samdb, child_dn.get_linearized())
+ m['a01'] = ldb.MessageElement("container", ldb.FLAG_MOD_ADD, "objectClass")
+ m['a02'] = ldb.MessageElement("TRUE", ldb.FLAG_MOD_ADD, "showInAdvancedViewOnly")
+ try:
+ self.samdb.add(m)
+ except Exception, e:
+ raise CommandError("Error adding GPO in AD", e)
+
+ # Add cn=User,cn=<guid>
+ child_dn = gpo_dn
+ child_dn.add_child(ldb.Dn(self.samdb, "CN=Machine"))
+
+ m = ldb.Message()
+ m.dn = ldb.Dn(self.samdb, child_dn.get_linearized())
+ m['a01'] = ldb.MessageElement("container", ldb.FLAG_MOD_ADD, "objectClass")
+ m['a02'] = ldb.MessageElement("TRUE", ldb.FLAG_MOD_ADD, "showInAdvancedViewOnly")
+ try:
+ self.samdb.add(m)
+ except Exception, e:
+ raise CommandError("Error adding GPO in AD", e)
+
+ # Copy GPO files over SMB
+ [dom_name, service, sharepath] = parse_unc(unc_path)
+ try:
+ conn = smb.SMB(dc_hostname, service, lp=self.lp, creds=self.creds)
+ except Exception, e:
+ raise CommandError("Error connecting to '%s' using SMB" % dc_hostname, e)
+
+ try:
+ create_directory_hier(conn, sharepath)
+ copy_directory_local_to_remote(conn, gpodir, sharepath)
+ except Exception, e:
+ raise CommandError("Error Copying GPO to DC", e)
+
+ # Get new security descriptor
+ msg = get_gpo_info(self.samdb, gpo=gpo)[0]
+ ds_sd_ndr = msg['ntSecurityDescriptor'][0]
+ ds_sd = ndr_unpack(dcerpc.security.descriptor, ds_sd_ndr)
+
+ # Create a file system security descriptor
+ fs_sd = dcerpc.security.descriptor()
+ fs_sd.owner_sid = ds_sd.owner_sid
+ fs_sd.group_sid = ds_sd.group_sid
+ fs_sd.type = ds_sd.type
+ fs_sd.revision = ds_sd.revision
+
+ # Copy sacl
+ fs_sd.sacl = ds_sd.sacl
+
+ # Copy dacl
+ dacl = ds_sd.dacl
+ for ace in dacl.aces:
+ # Don't add the allow for SID_BUILTIN_PREW2K
+ if (not (ace.type & dcerpc.security.SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) and
+ ace.trustee == dcerpc.security.SID_BUILTIN_PREW2K):
+ continue
+
+ # Copy the ace from the directory server security descriptor
+ new_ace = ace
+
+ # Set specific inheritance flags for within the GPO
+ new_ace.flags |= (dcerpc.security.SEC_ACE_FLAG_OBJECT_INHERIT |
+ dcerpc.security.SEC_ACE_FLAG_CONTAINER_INHERIT)
+ if ace.trustee == dcerpc.security.SID_CREATOR_OWNER:
+ new_ace.flags |= dcerpc.security.SEC_ACE_FLAG_INHERIT_ONLY
+
+ # Get a directory access mask from the assigned access mask on the ldap object
+ new_ace.access_mask = policy.ads_to_dir_access_mask(ace.access_mask)
+
+ # Add the ace to DACL
+ fs_sd.dacl_add(new_ace)
+
+ # Set ACL
+ try:
+ conn.set_acl(sharepath, fs_sd)
+ except Exception, e:
+ raise CommandError("Error setting ACL on GPT", e)
+
+ print "GPO '%s' created as %s" % (displayname, gpo)
+
class cmd_setacl(Command):
"""Set ACL on a GPO"""
git.samba.org / metze / samba / wip.git / blobdiff