1 # Unix SMB/CIFS implementation.
2 # backend code for provisioning a Samba4 server
4 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2012
5 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008-2009
6 # Copyright (C) Oliver Liebel <oliver@itc.li> 2008-2009
8 # Based on the original in EJS:
9 # Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
11 # This program is free software; you can redistribute it and/or modify
12 # it under the terms of the GNU General Public License as published by
13 # the Free Software Foundation; either version 3 of the License, or
14 # (at your option) any later version.
16 # This program is distributed in the hope that it will be useful,
17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 # GNU General Public License for more details.
21 # You should have received a copy of the GNU General Public License
22 # along with this program. If not, see <http://www.gnu.org/licenses/>.
25 """Functions for setting up a Samba configuration."""
27 __docformat__ = "restructuredText"
29 from base64 import b64encode
44 from samba.auth import system_session, admin_session
46 from samba.samba3 import smbd, passdb
47 from samba.samba3 import param as s3param
48 from samba.dsdb import DS_DOMAIN_FUNCTION_2000
52 check_all_substituted,
53 is_valid_netbios_char,
59 from samba.dcerpc import security, misc
60 from samba.dcerpc.misc import (
64 from samba.dsdb import (
65 DS_DOMAIN_FUNCTION_2003,
66 DS_DOMAIN_FUNCTION_2008_R2,
69 from samba.idmap import IDmapDB
70 from samba.ms_display_specifiers import read_ms_ldif
71 from samba.ntacls import setntacl, getntacl, dsacl2fsacl
72 from samba.ndr import ndr_pack, ndr_unpack
73 from samba.provision.backend import (
79 from samba.descriptor import (
81 get_config_descriptor,
82 get_config_partitions_descriptor,
83 get_config_sites_descriptor,
84 get_config_ntds_quotas_descriptor,
85 get_config_delete_protected1_descriptor,
86 get_config_delete_protected1wd_descriptor,
87 get_config_delete_protected2_descriptor,
88 get_domain_descriptor,
89 get_domain_infrastructure_descriptor,
90 get_domain_builtin_descriptor,
91 get_domain_computers_descriptor,
92 get_domain_users_descriptor,
93 get_domain_controllers_descriptor,
94 get_domain_delete_protected1_descriptor,
95 get_domain_delete_protected2_descriptor,
96 get_dns_partition_descriptor,
97 get_dns_forest_microsoft_dns_descriptor,
98 get_dns_domain_microsoft_dns_descriptor,
100 from samba.provision.common import (
109 from samba.provision.sambadns import (
112 create_dns_update_list
116 import samba.registry
117 from samba.schema import Schema
118 from samba.samdb import SamDB
119 from samba.dbchecker import dbcheck
122 DEFAULT_POLICY_GUID = "31B2F340-016D-11D2-945F-00C04FB984F9"
123 DEFAULT_DC_POLICY_GUID = "6AC1786C-016F-11D2-945F-00C04fB984F9"
124 DEFAULTSITE = "Default-First-Site-Name"
125 LAST_PROVISION_USN_ATTRIBUTE = "lastProvisionUSN"
128 class ProvisionPaths(object):
131 self.shareconf = None
142 self.dns_keytab = None
145 self.private_dir = None
146 self.state_dir = None
149 class ProvisionNames(object):
157 self.dnsforestdn = None
158 self.dnsdomaindn = None
159 self.ldapmanagerdn = None
160 self.dnsdomain = None
162 self.netbiosname = None
167 self.domainsid = None
168 self.forestsid = None
169 self.domainguid = None
173 def find_provision_key_parameters(samdb, secretsdb, idmapdb, paths, smbconf,
175 """Get key provision parameters (realm, domain, ...) from a given provision
177 :param samdb: An LDB object connected to the sam.ldb file
178 :param secretsdb: An LDB object connected to the secrets.ldb file
179 :param idmapdb: An LDB object connected to the idmap.ldb file
180 :param paths: A list of path to provision object
181 :param smbconf: Path to the smb.conf file
182 :param lp: A LoadParm object
183 :return: A list of key provision parameters
185 names = ProvisionNames()
186 names.adminpass = None
188 # NT domain, kerberos realm, root dn, domain dn, domain dns name
189 names.domain = string.upper(lp.get("workgroup"))
190 names.realm = lp.get("realm")
191 names.dnsdomain = names.realm.lower()
192 basedn = samba.dn_from_dns_name(names.dnsdomain)
193 names.realm = string.upper(names.realm)
195 # Get the netbiosname first (could be obtained from smb.conf in theory)
196 res = secretsdb.search(expression="(flatname=%s)" %
197 names.domain,base="CN=Primary Domains",
198 scope=ldb.SCOPE_SUBTREE, attrs=["sAMAccountName"])
199 names.netbiosname = str(res[0]["sAMAccountName"]).replace("$","")
201 names.smbconf = smbconf
203 # That's a bit simplistic but it's ok as long as we have only 3
205 current = samdb.search(expression="(objectClass=*)",
206 base="", scope=ldb.SCOPE_BASE,
207 attrs=["defaultNamingContext", "schemaNamingContext",
208 "configurationNamingContext","rootDomainNamingContext",
211 names.configdn = current[0]["configurationNamingContext"][0]
212 names.schemadn = current[0]["schemaNamingContext"][0]
213 if not (ldb.Dn(samdb, basedn) == (ldb.Dn(samdb,
214 current[0]["defaultNamingContext"][0]))):
215 raise ProvisioningError(("basedn in %s (%s) and from %s (%s)"
216 "is not the same ..." % (paths.samdb,
217 str(current[0]["defaultNamingContext"][0]),
218 paths.smbconf, basedn)))
220 names.domaindn=current[0]["defaultNamingContext"][0]
221 names.rootdn=current[0]["rootDomainNamingContext"][0]
222 names.ncs=current[0]["namingContexts"]
223 names.dnsforestdn = None
224 names.dnsdomaindn = None
226 for i in range(0, len(names.ncs)):
229 dnsforestdn = "DC=ForestDnsZones,%s" % (str(names.rootdn))
230 if nc == dnsforestdn:
231 names.dnsforestdn = dnsforestdn
234 dnsdomaindn = "DC=DomainDnsZones,%s" % (str(names.domaindn))
235 if nc == dnsdomaindn:
236 names.dnsdomaindn = dnsdomaindn
240 res3 = samdb.search(expression="(objectClass=site)",
241 base="CN=Sites," + names.configdn, scope=ldb.SCOPE_ONELEVEL, attrs=["cn"])
242 names.sitename = str(res3[0]["cn"])
244 # dns hostname and server dn
245 res4 = samdb.search(expression="(CN=%s)" % names.netbiosname,
246 base="OU=Domain Controllers,%s" % basedn,
247 scope=ldb.SCOPE_ONELEVEL, attrs=["dNSHostName"])
249 raise ProvisioningError("Unable to find DC called CN=%s under OU=Domain Controllers,%s" % (names.netbiosname, basedn))
251 names.hostname = str(res4[0]["dNSHostName"]).replace("." + names.dnsdomain, "")
253 server_res = samdb.search(expression="serverReference=%s" % res4[0].dn,
254 attrs=[], base=names.configdn)
255 names.serverdn = str(server_res[0].dn)
257 # invocation id/objectguid
258 res5 = samdb.search(expression="(objectClass=*)",
259 base="CN=NTDS Settings,%s" % str(names.serverdn),
260 scope=ldb.SCOPE_BASE,
261 attrs=["invocationID", "objectGUID"])
262 names.invocation = str(ndr_unpack(misc.GUID, res5[0]["invocationId"][0]))
263 names.ntdsguid = str(ndr_unpack(misc.GUID, res5[0]["objectGUID"][0]))
266 res6 = samdb.search(expression="(objectClass=*)", base=basedn,
267 scope=ldb.SCOPE_BASE, attrs=["objectGUID",
268 "objectSid","msDS-Behavior-Version" ])
269 names.domainguid = str(ndr_unpack(misc.GUID, res6[0]["objectGUID"][0]))
270 names.domainsid = ndr_unpack( security.dom_sid, res6[0]["objectSid"][0])
271 names.forestsid = ndr_unpack( security.dom_sid, res6[0]["objectSid"][0])
272 if res6[0].get("msDS-Behavior-Version") is None or \
273 int(res6[0]["msDS-Behavior-Version"][0]) < DS_DOMAIN_FUNCTION_2000:
274 names.domainlevel = DS_DOMAIN_FUNCTION_2000
276 names.domainlevel = int(res6[0]["msDS-Behavior-Version"][0])
279 res7 = samdb.search(expression="(name={%s})" % DEFAULT_POLICY_GUID,
280 base="CN=Policies,CN=System," + basedn,
281 scope=ldb.SCOPE_ONELEVEL, attrs=["cn","displayName"])
282 names.policyid = str(res7[0]["cn"]).replace("{","").replace("}","")
284 res8 = samdb.search(expression="(name={%s})" % DEFAULT_DC_POLICY_GUID,
285 base="CN=Policies,CN=System," + basedn,
286 scope=ldb.SCOPE_ONELEVEL,
287 attrs=["cn","displayName"])
289 names.policyid_dc = str(res8[0]["cn"]).replace("{","").replace("}","")
291 names.policyid_dc = None
293 res9 = idmapdb.search(expression="(cn=%s-%s)" %
294 (str(names.domainsid), security.DOMAIN_RID_ADMINISTRATOR),
295 attrs=["xidNumber", "type"])
297 raise ProvisioningError("Unable to find uid/gid for Domain Admins rid (%s-%s" % (str(names.domainsid), security.DOMAIN_RID_ADMINISTRATOR))
298 if res9[0]["type"][0] == "ID_TYPE_BOTH":
299 names.root_gid = res9[0]["xidNumber"][0]
301 names.root_gid = pwd.getpwuid(int(res9[0]["xidNumber"][0])).pw_gid
303 res10 = samdb.search(expression="(samaccountname=dns)",
304 scope=ldb.SCOPE_SUBTREE, attrs=["dn"],
305 controls=["search_options:1:2"])
307 has_legacy_dns_account = True
309 has_legacy_dns_account = False
311 res11 = samdb.search(expression="(samaccountname=dns-%s)" % names.netbiosname,
312 scope=ldb.SCOPE_SUBTREE, attrs=["dn"],
313 controls=["search_options:1:2"])
315 has_dns_account = True
317 has_dns_account = False
319 if names.dnsdomaindn is not None:
321 names.dns_backend = 'BIND9_DLZ'
323 names.dns_backend = 'SAMBA_INTERNAL'
324 elif has_dns_account or has_legacy_dns_account:
325 names.dns_backend = 'BIND9_FLATFILE'
327 names.dns_backend = 'NONE'
329 dns_admins_sid = get_dnsadmins_sid(samdb, names.domaindn)
330 names.name_map['DnsAdmins'] = str(dns_admins_sid)
335 def update_provision_usn(samdb, low, high, id, replace=False):
336 """Update the field provisionUSN in sam.ldb
338 This field is used to track range of USN modified by provision and
340 This value is used afterward by next provision to figure out if
341 the field have been modified since last provision.
343 :param samdb: An LDB object connect to sam.ldb
344 :param low: The lowest USN modified by this upgrade
345 :param high: The highest USN modified by this upgrade
346 :param id: The invocation id of the samba's dc
347 :param replace: A boolean indicating if the range should replace any
348 existing one or appended (default)
353 entry = samdb.search(base="@PROVISION",
354 scope=ldb.SCOPE_BASE,
355 attrs=[LAST_PROVISION_USN_ATTRIBUTE, "dn"])
356 for e in entry[0][LAST_PROVISION_USN_ATTRIBUTE]:
357 if not re.search(';', e):
358 e = "%s;%s" % (e, id)
361 tab.append("%s-%s;%s" % (low, high, id))
362 delta = ldb.Message()
363 delta.dn = ldb.Dn(samdb, "@PROVISION")
364 delta[LAST_PROVISION_USN_ATTRIBUTE] = ldb.MessageElement(tab,
365 ldb.FLAG_MOD_REPLACE, LAST_PROVISION_USN_ATTRIBUTE)
366 entry = samdb.search(expression='provisionnerID=*',
367 base="@PROVISION", scope=ldb.SCOPE_BASE,
368 attrs=["provisionnerID"])
369 if len(entry) == 0 or len(entry[0]) == 0:
370 delta["provisionnerID"] = ldb.MessageElement(id, ldb.FLAG_MOD_ADD, "provisionnerID")
374 def set_provision_usn(samdb, low, high, id):
375 """Set the field provisionUSN in sam.ldb
376 This field is used to track range of USN modified by provision and
378 This value is used afterward by next provision to figure out if
379 the field have been modified since last provision.
381 :param samdb: An LDB object connect to sam.ldb
382 :param low: The lowest USN modified by this upgrade
383 :param high: The highest USN modified by this upgrade
384 :param id: The invocationId of the provision"""
387 tab.append("%s-%s;%s" % (low, high, id))
389 delta = ldb.Message()
390 delta.dn = ldb.Dn(samdb, "@PROVISION")
391 delta[LAST_PROVISION_USN_ATTRIBUTE] = ldb.MessageElement(tab,
392 ldb.FLAG_MOD_ADD, LAST_PROVISION_USN_ATTRIBUTE)
396 def get_max_usn(samdb,basedn):
397 """ This function return the biggest USN present in the provision
399 :param samdb: A LDB object pointing to the sam.ldb
400 :param basedn: A string containing the base DN of the provision
402 :return: The biggest USN in the provision"""
404 res = samdb.search(expression="objectClass=*",base=basedn,
405 scope=ldb.SCOPE_SUBTREE,attrs=["uSNChanged"],
406 controls=["search_options:1:2",
407 "server_sort:1:1:uSNChanged",
408 "paged_results:1:1"])
409 return res[0]["uSNChanged"]
412 def get_last_provision_usn(sam):
413 """Get USNs ranges modified by a provision or an upgradeprovision
415 :param sam: An LDB object pointing to the sam.ldb
416 :return: a dictionary which keys are invocation id and values are an array
417 of integer representing the different ranges
420 entry = sam.search(expression="%s=*" % LAST_PROVISION_USN_ATTRIBUTE,
421 base="@PROVISION", scope=ldb.SCOPE_BASE,
422 attrs=[LAST_PROVISION_USN_ATTRIBUTE, "provisionnerID"])
423 except ldb.LdbError, (ecode, emsg):
424 if ecode == ldb.ERR_NO_SUCH_OBJECT:
431 if entry[0].get("provisionnerID"):
432 for e in entry[0]["provisionnerID"]:
434 for r in entry[0][LAST_PROVISION_USN_ATTRIBUTE]:
435 tab1 = str(r).split(';')
440 if (len(myids) > 0 and id not in myids):
442 tab2 = p.split(tab1[0])
443 if range.get(id) is None:
445 range[id].append(tab2[0])
446 range[id].append(tab2[1])
452 class ProvisionResult(object):
453 """Result of a provision.
455 :ivar server_role: The server role
456 :ivar paths: ProvisionPaths instance
457 :ivar domaindn: The domain dn, as string
461 self.server_role = None
468 self.domainsid = None
469 self.adminpass_generated = None
470 self.adminpass = None
471 self.backend_result = None
473 def report_logger(self, logger):
474 """Report this provision result to a logger."""
476 "Once the above files are installed, your Samba4 server will "
478 if self.adminpass_generated:
479 logger.info("Admin password: %s", self.adminpass)
480 logger.info("Server Role: %s", self.server_role)
481 logger.info("Hostname: %s", self.names.hostname)
482 logger.info("NetBIOS Domain: %s", self.names.domain)
483 logger.info("DNS Domain: %s", self.names.dnsdomain)
484 logger.info("DOMAIN SID: %s", self.domainsid)
486 if self.backend_result:
487 self.backend_result.report_logger(logger)
490 def check_install(lp, session_info, credentials):
491 """Check whether the current install seems ok.
493 :param lp: Loadparm context
494 :param session_info: Session information
495 :param credentials: Credentials
497 if lp.get("realm") == "":
498 raise Exception("Realm empty")
499 samdb = Ldb(lp.samdb_url(), session_info=session_info,
500 credentials=credentials, lp=lp)
501 if len(samdb.search("(cn=Administrator)")) != 1:
502 raise ProvisioningError("No administrator account found")
505 def findnss(nssfn, names):
506 """Find a user or group from a list of possibilities.
508 :param nssfn: NSS Function to try (should raise KeyError if not found)
509 :param names: Names to check.
510 :return: Value return by first names list.
517 raise KeyError("Unable to find user/group in %r" % names)
520 findnss_uid = lambda names: findnss(pwd.getpwnam, names)[2]
521 findnss_gid = lambda names: findnss(grp.getgrnam, names)[2]
524 def provision_paths_from_lp(lp, dnsdomain):
525 """Set the default paths for provisioning.
527 :param lp: Loadparm context.
528 :param dnsdomain: DNS Domain name
530 paths = ProvisionPaths()
531 paths.private_dir = lp.get("private dir")
532 paths.state_dir = lp.get("state directory")
534 # This is stored without path prefix for the "privateKeytab" attribute in
535 # "secrets_dns.ldif".
536 paths.dns_keytab = "dns.keytab"
537 paths.keytab = "secrets.keytab"
539 paths.shareconf = os.path.join(paths.private_dir, "share.ldb")
540 paths.samdb = os.path.join(paths.private_dir, "sam.ldb")
541 paths.idmapdb = os.path.join(paths.private_dir, "idmap.ldb")
542 paths.secrets = os.path.join(paths.private_dir, "secrets.ldb")
543 paths.privilege = os.path.join(paths.private_dir, "privilege.ldb")
544 paths.dns = os.path.join(paths.private_dir, "dns", dnsdomain + ".zone")
545 paths.dns_update_list = os.path.join(paths.private_dir, "dns_update_list")
546 paths.spn_update_list = os.path.join(paths.private_dir, "spn_update_list")
547 paths.namedconf = os.path.join(paths.private_dir, "named.conf")
548 paths.namedconf_update = os.path.join(paths.private_dir, "named.conf.update")
549 paths.namedtxt = os.path.join(paths.private_dir, "named.txt")
550 paths.krb5conf = os.path.join(paths.private_dir, "krb5.conf")
551 paths.winsdb = os.path.join(paths.private_dir, "wins.ldb")
552 paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
553 paths.hklm = "hklm.ldb"
554 paths.hkcr = "hkcr.ldb"
555 paths.hkcu = "hkcu.ldb"
556 paths.hku = "hku.ldb"
557 paths.hkpd = "hkpd.ldb"
558 paths.hkpt = "hkpt.ldb"
559 paths.sysvol = lp.get("path", "sysvol")
560 paths.netlogon = lp.get("path", "netlogon")
561 paths.smbconf = lp.configfile
565 def determine_netbios_name(hostname):
566 """Determine a netbios name from a hostname."""
567 # remove forbidden chars and force the length to be <16
568 netbiosname = "".join([x for x in hostname if is_valid_netbios_char(x)])
569 return netbiosname[:MAX_NETBIOS_NAME_LEN].upper()
572 def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None,
573 serverrole=None, rootdn=None, domaindn=None, configdn=None,
574 schemadn=None, serverdn=None, sitename=None,
575 domain_names_forced=False):
576 """Guess configuration settings to use."""
579 hostname = socket.gethostname().split(".")[0]
581 netbiosname = lp.get("netbios name")
582 if netbiosname is None:
583 netbiosname = determine_netbios_name(hostname)
584 netbiosname = netbiosname.upper()
585 if not valid_netbios_name(netbiosname):
586 raise InvalidNetbiosName(netbiosname)
588 if dnsdomain is None:
589 dnsdomain = lp.get("realm")
590 if dnsdomain is None or dnsdomain == "":
591 raise ProvisioningError("guess_names: 'realm' not specified in supplied %s!", lp.configfile)
593 dnsdomain = dnsdomain.lower()
595 if serverrole is None:
596 serverrole = lp.get("server role")
597 if serverrole is None:
598 raise ProvisioningError("guess_names: 'server role' not specified in supplied %s!" % lp.configfile)
600 serverrole = serverrole.lower()
602 realm = dnsdomain.upper()
604 if lp.get("realm") == "":
605 raise ProvisioningError("guess_names: 'realm =' was not specified in supplied %s. Please remove the smb.conf file and let provision generate it" % lp.configfile)
607 if lp.get("realm").upper() != realm:
608 raise ProvisioningError("guess_names: 'realm=%s' in %s must match chosen realm '%s'! Please remove the smb.conf file and let provision generate it" % (lp.get("realm").upper(), lp.configfile, realm))
610 if lp.get("server role").lower() != serverrole:
611 raise ProvisioningError("guess_names: 'server role=%s' in %s must match chosen server role '%s'! Please remove the smb.conf file and let provision generate it" % (lp.get("server role"), lp.configfile, serverrole))
613 if serverrole == "active directory domain controller":
615 # This will, for better or worse, default to 'WORKGROUP'
616 domain = lp.get("workgroup")
617 domain = domain.upper()
619 if lp.get("workgroup").upper() != domain:
620 raise ProvisioningError("guess_names: Workgroup '%s' in smb.conf must match chosen domain '%s'! Please remove the %s file and let provision generate it" % (lp.get("workgroup").upper(), domain, lp.configfile))
623 domaindn = samba.dn_from_dns_name(dnsdomain)
625 if domain == netbiosname:
626 raise ProvisioningError("guess_names: Domain '%s' must not be equal to short host name '%s'!" % (domain, netbiosname))
630 domaindn = "DC=" + netbiosname
632 if not valid_netbios_name(domain):
633 raise InvalidNetbiosName(domain)
635 if hostname.upper() == realm:
636 raise ProvisioningError("guess_names: Realm '%s' must not be equal to hostname '%s'!" % (realm, hostname))
637 if netbiosname.upper() == realm:
638 raise ProvisioningError("guess_names: Realm '%s' must not be equal to NetBIOS hostname '%s'!" % (realm, netbiosname))
639 if domain == realm and not domain_names_forced:
640 raise ProvisioningError("guess_names: Realm '%s' must not be equal to short domain name '%s'!" % (realm, domain))
646 configdn = "CN=Configuration," + rootdn
648 schemadn = "CN=Schema," + configdn
651 sitename = DEFAULTSITE
653 names = ProvisionNames()
654 names.rootdn = rootdn
655 names.domaindn = domaindn
656 names.configdn = configdn
657 names.schemadn = schemadn
658 names.ldapmanagerdn = "CN=Manager," + rootdn
659 names.dnsdomain = dnsdomain
660 names.domain = domain
662 names.netbiosname = netbiosname
663 names.hostname = hostname
664 names.sitename = sitename
665 names.serverdn = "CN=%s,CN=Servers,CN=%s,CN=Sites,%s" % (
666 netbiosname, sitename, configdn)
671 def make_smbconf(smbconf, hostname, domain, realm, targetdir,
672 serverrole=None, eadb=False, use_ntvfs=False, lp=None,
674 """Create a new smb.conf file based on a couple of basic settings.
676 assert smbconf is not None
679 hostname = socket.gethostname().split(".")[0]
681 netbiosname = determine_netbios_name(hostname)
683 if serverrole is None:
684 serverrole = "standalone server"
686 assert domain is not None
687 domain = domain.upper()
689 assert realm is not None
690 realm = realm.upper()
693 "netbios name": netbiosname,
696 "server role": serverrole,
700 lp = samba.param.LoadParm()
701 #Load non-existent file
702 if os.path.exists(smbconf):
705 if global_param is not None:
706 for ent in global_param:
707 if global_param[ent] is not None:
708 global_settings[ent] = " ".join(global_param[ent])
710 if targetdir is not None:
711 global_settings["private dir"] = os.path.abspath(os.path.join(targetdir, "private"))
712 global_settings["lock dir"] = os.path.abspath(targetdir)
713 global_settings["state directory"] = os.path.abspath(os.path.join(targetdir, "state"))
714 global_settings["cache directory"] = os.path.abspath(os.path.join(targetdir, "cache"))
716 lp.set("lock dir", os.path.abspath(targetdir))
717 lp.set("state directory", global_settings["state directory"])
718 lp.set("cache directory", global_settings["cache directory"])
721 if use_ntvfs and not lp.get("posix:eadb"):
722 if targetdir is not None:
723 privdir = os.path.join(targetdir, "private")
725 privdir = lp.get("private dir")
726 lp.set("posix:eadb", os.path.abspath(os.path.join(privdir, "eadb.tdb")))
727 elif not use_ntvfs and not lp.get("xattr_tdb:file"):
728 if targetdir is not None:
729 statedir = os.path.join(targetdir, "state")
731 statedir = lp.get("state directory")
732 lp.set("xattr_tdb:file", os.path.abspath(os.path.join(statedir, "xattr.tdb")))
735 if serverrole == "active directory domain controller":
736 shares["sysvol"] = os.path.join(lp.get("state directory"), "sysvol")
737 shares["netlogon"] = os.path.join(shares["sysvol"], realm.lower(),
740 global_settings["passdb backend"] = "samba_dsdb"
742 f = open(smbconf, 'w')
744 f.write("[globals]\n")
745 for key, val in global_settings.iteritems():
746 f.write("\t%s = %s\n" % (key, val))
749 for name, path in shares.iteritems():
750 f.write("[%s]\n" % name)
751 f.write("\tpath = %s\n" % path)
752 f.write("\tread only = no\n")
756 # reload the smb.conf
759 # and dump it without any values that are the default
760 # this ensures that any smb.conf parameters that were set
761 # on the provision/join command line are set in the resulting smb.conf
762 f = open(smbconf, mode='w')
769 def setup_name_mappings(idmap, sid, root_uid, nobody_uid,
770 users_gid, root_gid):
771 """setup reasonable name mappings for sam names to unix names.
773 :param samdb: SamDB object.
774 :param idmap: IDmap db object.
775 :param sid: The domain sid.
776 :param domaindn: The domain DN.
777 :param root_uid: uid of the UNIX root user.
778 :param nobody_uid: uid of the UNIX nobody user.
779 :param users_gid: gid of the UNIX users group.
780 :param root_gid: gid of the UNIX root group.
782 idmap.setup_name_mapping("S-1-5-7", idmap.TYPE_UID, nobody_uid)
784 idmap.setup_name_mapping(sid + "-500", idmap.TYPE_UID, root_uid)
785 idmap.setup_name_mapping(sid + "-513", idmap.TYPE_GID, users_gid)
788 def setup_samdb_partitions(samdb_path, logger, lp, session_info,
789 provision_backend, names, schema, serverrole,
791 """Setup the partitions for the SAM database.
793 Alternatively, provision() may call this, and then populate the database.
795 :note: This will wipe the Sam Database!
797 :note: This function always removes the local SAM LDB file. The erase
798 parameter controls whether to erase the existing data, which
799 may not be stored locally but in LDAP.
802 assert session_info is not None
804 # We use options=["modules:"] to stop the modules loading - we
805 # just want to wipe and re-initialise the database, not start it up
808 os.unlink(samdb_path)
812 samdb = Ldb(url=samdb_path, session_info=session_info,
813 lp=lp, options=["modules:"])
815 ldap_backend_line = "# No LDAP backend"
816 if provision_backend.type != "ldb":
817 ldap_backend_line = "ldapBackend: %s" % provision_backend.ldap_uri
819 samdb.transaction_start()
821 logger.info("Setting up sam.ldb partitions and settings")
822 setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), {
823 "LDAP_BACKEND_LINE": ldap_backend_line
827 setup_add_ldif(samdb, setup_path("provision_init.ldif"), {
828 "BACKEND_TYPE": provision_backend.type,
829 "SERVER_ROLE": serverrole
832 logger.info("Setting up sam.ldb rootDSE")
833 setup_samdb_rootdse(samdb, names)
835 samdb.transaction_cancel()
838 samdb.transaction_commit()
841 def secretsdb_self_join(secretsdb, domain,
842 netbiosname, machinepass, domainsid=None,
843 realm=None, dnsdomain=None,
845 key_version_number=1,
846 secure_channel_type=SEC_CHAN_WKSTA):
847 """Add domain join-specific bits to a secrets database.
849 :param secretsdb: Ldb Handle to the secrets database
850 :param machinepass: Machine password
852 attrs = ["whenChanged",
859 if realm is not None:
860 if dnsdomain is None:
861 dnsdomain = realm.lower()
862 dnsname = '%s.%s' % (netbiosname.lower(), dnsdomain.lower())
865 shortname = netbiosname.lower()
867 # We don't need to set msg["flatname"] here, because rdn_name will handle
868 # it, and it causes problems for modifies anyway
869 msg = ldb.Message(ldb.Dn(secretsdb, "flatname=%s,cn=Primary Domains" % domain))
870 msg["secureChannelType"] = [str(secure_channel_type)]
871 msg["objectClass"] = ["top", "primaryDomain"]
872 if dnsname is not None:
873 msg["objectClass"] = ["top", "primaryDomain", "kerberosSecret"]
874 msg["realm"] = [realm]
875 msg["saltPrincipal"] = ["host/%s@%s" % (dnsname, realm.upper())]
876 msg["msDS-KeyVersionNumber"] = [str(key_version_number)]
877 msg["privateKeytab"] = ["secrets.keytab"]
879 msg["secret"] = [machinepass]
880 msg["samAccountName"] = ["%s$" % netbiosname]
881 msg["secureChannelType"] = [str(secure_channel_type)]
882 if domainsid is not None:
883 msg["objectSid"] = [ndr_pack(domainsid)]
885 # This complex expression tries to ensure that we don't have more
886 # than one record for this SID, realm or netbios domain at a time,
887 # but we don't delete the old record that we are about to modify,
888 # because that would delete the keytab and previous password.
889 res = secretsdb.search(base="cn=Primary Domains", attrs=attrs,
890 expression=("(&(|(flatname=%s)(realm=%s)(objectSid=%s))(objectclass=primaryDomain)(!(distinguishedName=%s)))" % (domain, realm, str(domainsid), str(msg.dn))),
891 scope=ldb.SCOPE_ONELEVEL)
894 secretsdb.delete(del_msg.dn)
896 res = secretsdb.search(base=msg.dn, attrs=attrs, scope=ldb.SCOPE_BASE)
899 msg["priorSecret"] = [res[0]["secret"][0]]
900 msg["priorWhenChanged"] = [res[0]["whenChanged"][0]]
903 msg["privateKeytab"] = [res[0]["privateKeytab"][0]]
908 msg["krb5Keytab"] = [res[0]["krb5Keytab"][0]]
914 msg[el].set_flags(ldb.FLAG_MOD_REPLACE)
915 secretsdb.modify(msg)
916 secretsdb.rename(res[0].dn, msg.dn)
918 spn = [ 'HOST/%s' % shortname ]
919 if secure_channel_type == SEC_CHAN_BDC and dnsname is not None:
920 # we are a domain controller then we add servicePrincipalName
921 # entries for the keytab code to update.
922 spn.extend([ 'HOST/%s' % dnsname ])
923 msg["servicePrincipalName"] = spn
928 def setup_secretsdb(paths, session_info, backend_credentials, lp):
929 """Setup the secrets database.
931 :note: This function does not handle exceptions and transaction on purpose,
932 it's up to the caller to do this job.
934 :param path: Path to the secrets database.
935 :param session_info: Session info.
936 :param credentials: Credentials
937 :param lp: Loadparm context
938 :return: LDB handle for the created secrets database
940 if os.path.exists(paths.secrets):
941 os.unlink(paths.secrets)
943 keytab_path = os.path.join(paths.private_dir, paths.keytab)
944 if os.path.exists(keytab_path):
945 os.unlink(keytab_path)
947 dns_keytab_path = os.path.join(paths.private_dir, paths.dns_keytab)
948 if os.path.exists(dns_keytab_path):
949 os.unlink(dns_keytab_path)
953 secrets_ldb = Ldb(path, session_info=session_info, lp=lp)
955 secrets_ldb.load_ldif_file_add(setup_path("secrets_init.ldif"))
956 secrets_ldb = Ldb(path, session_info=session_info, lp=lp)
957 secrets_ldb.transaction_start()
959 secrets_ldb.load_ldif_file_add(setup_path("secrets.ldif"))
961 if (backend_credentials is not None and
962 backend_credentials.authentication_requested()):
963 if backend_credentials.get_bind_dn() is not None:
964 setup_add_ldif(secrets_ldb,
965 setup_path("secrets_simple_ldap.ldif"), {
966 "LDAPMANAGERDN": backend_credentials.get_bind_dn(),
967 "LDAPMANAGERPASS_B64": b64encode(backend_credentials.get_password())
970 setup_add_ldif(secrets_ldb,
971 setup_path("secrets_sasl_ldap.ldif"), {
972 "LDAPADMINUSER": backend_credentials.get_username(),
973 "LDAPADMINREALM": backend_credentials.get_realm(),
974 "LDAPADMINPASS_B64": b64encode(backend_credentials.get_password())
977 secrets_ldb.transaction_cancel()
982 def setup_privileges(path, session_info, lp):
983 """Setup the privileges database.
985 :param path: Path to the privileges database.
986 :param session_info: Session info.
987 :param credentials: Credentials
988 :param lp: Loadparm context
989 :return: LDB handle for the created secrets database
991 if os.path.exists(path):
993 privilege_ldb = Ldb(path, session_info=session_info, lp=lp)
994 privilege_ldb.erase()
995 privilege_ldb.load_ldif_file_add(setup_path("provision_privilege.ldif"))
998 def setup_registry(path, session_info, lp):
999 """Setup the registry.
1001 :param path: Path to the registry database
1002 :param session_info: Session information
1003 :param credentials: Credentials
1004 :param lp: Loadparm context
1006 reg = samba.registry.Registry()
1007 hive = samba.registry.open_ldb(path, session_info=session_info, lp_ctx=lp)
1008 reg.mount_hive(hive, samba.registry.HKEY_LOCAL_MACHINE)
1009 provision_reg = setup_path("provision.reg")
1010 assert os.path.exists(provision_reg)
1011 reg.diff_apply(provision_reg)
1014 def setup_idmapdb(path, session_info, lp):
1015 """Setup the idmap database.
1017 :param path: path to the idmap database
1018 :param session_info: Session information
1019 :param credentials: Credentials
1020 :param lp: Loadparm context
1022 if os.path.exists(path):
1025 idmap_ldb = IDmapDB(path, session_info=session_info, lp=lp)
1027 idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif"))
1031 def setup_samdb_rootdse(samdb, names):
1032 """Setup the SamDB rootdse.
1034 :param samdb: Sam Database handle
1036 setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
1037 "SCHEMADN": names.schemadn,
1038 "DOMAINDN": names.domaindn,
1039 "ROOTDN" : names.rootdn,
1040 "CONFIGDN": names.configdn,
1041 "SERVERDN": names.serverdn,
1045 def setup_self_join(samdb, admin_session_info, names, fill, machinepass,
1046 dns_backend, dnspass, domainsid, next_rid, invocationid,
1047 policyguid, policyguid_dc,
1048 domainControllerFunctionality, ntdsguid=None, dc_rid=None):
1049 """Join a host to its own domain."""
1050 assert isinstance(invocationid, str)
1051 if ntdsguid is not None:
1052 ntdsguid_line = "objectGUID: %s\n"%ntdsguid
1059 setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), {
1060 "CONFIGDN": names.configdn,
1061 "SCHEMADN": names.schemadn,
1062 "DOMAINDN": names.domaindn,
1063 "SERVERDN": names.serverdn,
1064 "INVOCATIONID": invocationid,
1065 "NETBIOSNAME": names.netbiosname,
1066 "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
1067 "MACHINEPASS_B64": b64encode(machinepass.encode('utf-16-le')),
1068 "DOMAINSID": str(domainsid),
1069 "DCRID": str(dc_rid),
1070 "SAMBA_VERSION_STRING": version,
1071 "NTDSGUID": ntdsguid_line,
1072 "DOMAIN_CONTROLLER_FUNCTIONALITY": str(
1073 domainControllerFunctionality),
1074 "RIDALLOCATIONSTART": str(next_rid + 100),
1075 "RIDALLOCATIONEND": str(next_rid + 100 + 499)})
1077 setup_add_ldif(samdb, setup_path("provision_group_policy.ldif"), {
1078 "POLICYGUID": policyguid,
1079 "POLICYGUID_DC": policyguid_dc,
1080 "DNSDOMAIN": names.dnsdomain,
1081 "DOMAINDN": names.domaindn})
1083 # If we are setting up a subdomain, then this has been replicated in, so we
1084 # don't need to add it
1085 if fill == FILL_FULL:
1086 setup_add_ldif(samdb, setup_path("provision_self_join_config.ldif"), {
1087 "CONFIGDN": names.configdn,
1088 "SCHEMADN": names.schemadn,
1089 "DOMAINDN": names.domaindn,
1090 "SERVERDN": names.serverdn,
1091 "INVOCATIONID": invocationid,
1092 "NETBIOSNAME": names.netbiosname,
1093 "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
1094 "MACHINEPASS_B64": b64encode(machinepass.encode('utf-16-le')),
1095 "DOMAINSID": str(domainsid),
1096 "DCRID": str(dc_rid),
1097 "SAMBA_VERSION_STRING": version,
1098 "NTDSGUID": ntdsguid_line,
1099 "DOMAIN_CONTROLLER_FUNCTIONALITY": str(
1100 domainControllerFunctionality)})
1102 # Setup fSMORoleOwner entries to point at the newly created DC entry
1103 setup_modify_ldif(samdb,
1104 setup_path("provision_self_join_modify_config.ldif"), {
1105 "CONFIGDN": names.configdn,
1106 "SCHEMADN": names.schemadn,
1107 "DEFAULTSITE": names.sitename,
1108 "NETBIOSNAME": names.netbiosname,
1109 "SERVERDN": names.serverdn,
1112 system_session_info = system_session()
1113 samdb.set_session_info(system_session_info)
1114 # Setup fSMORoleOwner entries to point at the newly created DC entry to
1115 # modify a serverReference under cn=config when we are a subdomain, we must
1116 # be system due to ACLs
1117 setup_modify_ldif(samdb, setup_path("provision_self_join_modify.ldif"), {
1118 "DOMAINDN": names.domaindn,
1119 "SERVERDN": names.serverdn,
1120 "NETBIOSNAME": names.netbiosname,
1123 samdb.set_session_info(admin_session_info)
1125 if dns_backend != "SAMBA_INTERNAL":
1126 # This is Samba4 specific and should be replaced by the correct
1127 # DNS AD-style setup
1128 setup_add_ldif(samdb, setup_path("provision_dns_add_samba.ldif"), {
1129 "DNSDOMAIN": names.dnsdomain,
1130 "DOMAINDN": names.domaindn,
1131 "DNSPASS_B64": b64encode(dnspass.encode('utf-16-le')),
1132 "HOSTNAME" : names.hostname,
1133 "DNSNAME" : '%s.%s' % (
1134 names.netbiosname.lower(), names.dnsdomain.lower())
1138 def getpolicypath(sysvolpath, dnsdomain, guid):
1139 """Return the physical path of policy given its guid.
1141 :param sysvolpath: Path to the sysvol folder
1142 :param dnsdomain: DNS name of the AD domain
1143 :param guid: The GUID of the policy
1144 :return: A string with the complete path to the policy folder
1147 guid = "{%s}" % guid
1148 policy_path = os.path.join(sysvolpath, dnsdomain, "Policies", guid)
1152 def create_gpo_struct(policy_path):
1153 if not os.path.exists(policy_path):
1154 os.makedirs(policy_path, 0775)
1155 f = open(os.path.join(policy_path, "GPT.INI"), 'w')
1157 f.write("[General]\r\nVersion=0")
1160 p = os.path.join(policy_path, "MACHINE")
1161 if not os.path.exists(p):
1162 os.makedirs(p, 0775)
1163 p = os.path.join(policy_path, "USER")
1164 if not os.path.exists(p):
1165 os.makedirs(p, 0775)
1168 def create_default_gpo(sysvolpath, dnsdomain, policyguid, policyguid_dc):
1169 """Create the default GPO for a domain
1171 :param sysvolpath: Physical path for the sysvol folder
1172 :param dnsdomain: DNS domain name of the AD domain
1173 :param policyguid: GUID of the default domain policy
1174 :param policyguid_dc: GUID of the default domain controler policy
1176 policy_path = getpolicypath(sysvolpath,dnsdomain,policyguid)
1177 create_gpo_struct(policy_path)
1179 policy_path = getpolicypath(sysvolpath,dnsdomain,policyguid_dc)
1180 create_gpo_struct(policy_path)
1183 def setup_samdb(path, session_info, provision_backend, lp, names,
1184 logger, fill, serverrole, schema, am_rodc=False):
1185 """Setup a complete SAM Database.
1187 :note: This will wipe the main SAM database file!
1190 # Also wipes the database
1191 setup_samdb_partitions(path, logger=logger, lp=lp,
1192 provision_backend=provision_backend, session_info=session_info,
1193 names=names, serverrole=serverrole, schema=schema)
1195 # Load the database, but don's load the global schema and don't connect
1197 samdb = SamDB(session_info=session_info, url=None, auto_connect=False,
1198 credentials=provision_backend.credentials, lp=lp,
1199 global_schema=False, am_rodc=am_rodc)
1201 logger.info("Pre-loading the Samba 4 and AD schema")
1203 # Load the schema from the one we computed earlier
1204 samdb.set_schema(schema, write_indices_and_attributes=False)
1206 # Set the NTDS settings DN manually - in order to have it already around
1207 # before the provisioned tree exists and we connect
1208 samdb.set_ntds_settings_dn("CN=NTDS Settings,%s" % names.serverdn)
1210 # And now we can connect to the DB - the schema won't be loaded from the
1214 except ldb.LdbError, (num, string_error):
1215 if (num == ldb.ERR_INSUFFICIENT_ACCESS_RIGHTS):
1216 raise ProvisioningError("Permission denied connecting to %s, are you running as root?" % path)
1220 # But we have to give it one more kick to have it use the schema
1221 # during provision - it needs, now that it is connected, to write
1222 # the schema @ATTRIBUTES and @INDEXLIST records to the database.
1223 samdb.set_schema(schema, write_indices_and_attributes=True)
1228 def fill_samdb(samdb, lp, names, logger, policyguid,
1229 policyguid_dc, fill, adminpass, krbtgtpass, machinepass, dns_backend,
1230 dnspass, invocationid, ntdsguid, serverrole, am_rodc=False,
1231 dom_for_fun_level=None, schema=None, next_rid=None, dc_rid=None):
1233 if next_rid is None:
1236 # Provision does not make much sense values larger than 1000000000
1237 # as the upper range of the rIDAvailablePool is 1073741823 and
1238 # we don't want to create a domain that cannot allocate rids.
1239 if next_rid < 1000 or next_rid > 1000000000:
1240 error = "You want to run SAMBA 4 with a next_rid of %u, " % (next_rid)
1241 error += "the valid range is %u-%u. The default is %u." % (
1242 1000, 1000000000, 1000)
1243 raise ProvisioningError(error)
1245 # ATTENTION: Do NOT change these default values without discussion with the
1246 # team and/or release manager. They have a big impact on the whole program!
1247 domainControllerFunctionality = DS_DOMAIN_FUNCTION_2008_R2
1249 if dom_for_fun_level is None:
1250 dom_for_fun_level = DS_DOMAIN_FUNCTION_2008_R2
1252 if dom_for_fun_level > domainControllerFunctionality:
1253 raise ProvisioningError("You want to run SAMBA 4 on a domain and forest function level which itself is higher than its actual DC function level (2008_R2). This won't work!")
1255 domainFunctionality = dom_for_fun_level
1256 forestFunctionality = dom_for_fun_level
1258 # Set the NTDS settings DN manually - in order to have it already around
1259 # before the provisioned tree exists and we connect
1260 samdb.set_ntds_settings_dn("CN=NTDS Settings,%s" % names.serverdn)
1262 # Set the domain functionality levels onto the database.
1263 # Various module (the password_hash module in particular) need
1264 # to know what level of AD we are emulating.
1266 # These will be fixed into the database via the database
1267 # modifictions below, but we need them set from the start.
1268 samdb.set_opaque_integer("domainFunctionality", domainFunctionality)
1269 samdb.set_opaque_integer("forestFunctionality", forestFunctionality)
1270 samdb.set_opaque_integer("domainControllerFunctionality",
1271 domainControllerFunctionality)
1273 samdb.set_domain_sid(str(names.domainsid))
1274 samdb.set_invocation_id(invocationid)
1276 logger.info("Adding DomainDN: %s" % names.domaindn)
1278 # impersonate domain admin
1279 admin_session_info = admin_session(lp, str(names.domainsid))
1280 samdb.set_session_info(admin_session_info)
1281 if names.domainguid is not None:
1282 domainguid_line = "objectGUID: %s\n-" % names.domainguid
1284 domainguid_line = ""
1286 descr = b64encode(get_domain_descriptor(names.domainsid))
1287 setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
1288 "DOMAINDN": names.domaindn,
1289 "DOMAINSID": str(names.domainsid),
1290 "DESCRIPTOR": descr,
1291 "DOMAINGUID": domainguid_line
1294 setup_modify_ldif(samdb, setup_path("provision_basedn_modify.ldif"), {
1295 "DOMAINDN": names.domaindn,
1296 "CREATTIME": str(samba.unix2nttime(int(time.time()))),
1297 "NEXTRID": str(next_rid),
1298 "DEFAULTSITE": names.sitename,
1299 "CONFIGDN": names.configdn,
1300 "POLICYGUID": policyguid,
1301 "DOMAIN_FUNCTIONALITY": str(domainFunctionality),
1302 "SAMBA_VERSION_STRING": version
1305 # If we are setting up a subdomain, then this has been replicated in, so we don't need to add it
1306 if fill == FILL_FULL:
1307 logger.info("Adding configuration container")
1308 descr = b64encode(get_config_descriptor(names.domainsid))
1309 setup_add_ldif(samdb, setup_path("provision_configuration_basedn.ldif"), {
1310 "CONFIGDN": names.configdn,
1311 "DESCRIPTOR": descr,
1314 # The LDIF here was created when the Schema object was constructed
1315 logger.info("Setting up sam.ldb schema")
1316 samdb.add_ldif(schema.schema_dn_add, controls=["relax:0"])
1317 samdb.modify_ldif(schema.schema_dn_modify)
1318 samdb.write_prefixes_from_schema()
1319 samdb.add_ldif(schema.schema_data, controls=["relax:0"])
1320 setup_add_ldif(samdb, setup_path("aggregate_schema.ldif"),
1321 {"SCHEMADN": names.schemadn})
1323 # Now register this container in the root of the forest
1324 msg = ldb.Message(ldb.Dn(samdb, names.domaindn))
1325 msg["subRefs"] = ldb.MessageElement(names.configdn , ldb.FLAG_MOD_ADD,
1328 samdb.invocation_id = invocationid
1330 # If we are setting up a subdomain, then this has been replicated in, so we don't need to add it
1331 if fill == FILL_FULL:
1332 logger.info("Setting up sam.ldb configuration data")
1334 partitions_descr = b64encode(get_config_partitions_descriptor(names.domainsid))
1335 sites_descr = b64encode(get_config_sites_descriptor(names.domainsid))
1336 ntdsquotas_descr = b64encode(get_config_ntds_quotas_descriptor(names.domainsid))
1337 protected1_descr = b64encode(get_config_delete_protected1_descriptor(names.domainsid))
1338 protected1wd_descr = b64encode(get_config_delete_protected1wd_descriptor(names.domainsid))
1339 protected2_descr = b64encode(get_config_delete_protected2_descriptor(names.domainsid))
1341 setup_add_ldif(samdb, setup_path("provision_configuration.ldif"), {
1342 "CONFIGDN": names.configdn,
1343 "NETBIOSNAME": names.netbiosname,
1344 "DEFAULTSITE": names.sitename,
1345 "DNSDOMAIN": names.dnsdomain,
1346 "DOMAIN": names.domain,
1347 "SCHEMADN": names.schemadn,
1348 "DOMAINDN": names.domaindn,
1349 "SERVERDN": names.serverdn,
1350 "FOREST_FUNCTIONALITY": str(forestFunctionality),
1351 "DOMAIN_FUNCTIONALITY": str(domainFunctionality),
1352 "NTDSQUOTAS_DESCRIPTOR": ntdsquotas_descr,
1353 "LOSTANDFOUND_DESCRIPTOR": protected1wd_descr,
1354 "SERVICES_DESCRIPTOR": protected1_descr,
1355 "PHYSICALLOCATIONS_DESCRIPTOR": protected1wd_descr,
1356 "FORESTUPDATES_DESCRIPTOR": protected1wd_descr,
1357 "EXTENDEDRIGHTS_DESCRIPTOR": protected2_descr,
1358 "PARTITIONS_DESCRIPTOR": partitions_descr,
1359 "SITES_DESCRIPTOR": sites_descr,
1362 logger.info("Setting up display specifiers")
1363 display_specifiers_ldif = read_ms_ldif(
1364 setup_path('display-specifiers/DisplaySpecifiers-Win2k8R2.txt'))
1365 display_specifiers_ldif = substitute_var(display_specifiers_ldif,
1366 {"CONFIGDN": names.configdn})
1367 check_all_substituted(display_specifiers_ldif)
1368 samdb.add_ldif(display_specifiers_ldif)
1370 logger.info("Modifying display specifiers")
1371 setup_modify_ldif(samdb,
1372 setup_path("provision_configuration_modify.ldif"), {
1373 "CONFIGDN": names.configdn,
1374 "DISPLAYSPECIFIERS_DESCRIPTOR": protected2_descr
1377 logger.info("Adding users container")
1378 users_desc = b64encode(get_domain_users_descriptor(names.domainsid))
1379 setup_add_ldif(samdb, setup_path("provision_users_add.ldif"), {
1380 "DOMAINDN": names.domaindn,
1381 "USERS_DESCRIPTOR": users_desc
1383 logger.info("Modifying users container")
1384 setup_modify_ldif(samdb, setup_path("provision_users_modify.ldif"), {
1385 "DOMAINDN": names.domaindn})
1386 logger.info("Adding computers container")
1387 computers_desc = b64encode(get_domain_computers_descriptor(names.domainsid))
1388 setup_add_ldif(samdb, setup_path("provision_computers_add.ldif"), {
1389 "DOMAINDN": names.domaindn,
1390 "COMPUTERS_DESCRIPTOR": computers_desc
1392 logger.info("Modifying computers container")
1393 setup_modify_ldif(samdb,
1394 setup_path("provision_computers_modify.ldif"), {
1395 "DOMAINDN": names.domaindn})
1396 logger.info("Setting up sam.ldb data")
1397 infrastructure_desc = b64encode(get_domain_infrastructure_descriptor(names.domainsid))
1398 lostandfound_desc = b64encode(get_domain_delete_protected2_descriptor(names.domainsid))
1399 system_desc = b64encode(get_domain_delete_protected1_descriptor(names.domainsid))
1400 builtin_desc = b64encode(get_domain_builtin_descriptor(names.domainsid))
1401 controllers_desc = b64encode(get_domain_controllers_descriptor(names.domainsid))
1402 setup_add_ldif(samdb, setup_path("provision.ldif"), {
1403 "CREATTIME": str(samba.unix2nttime(int(time.time()))),
1404 "DOMAINDN": names.domaindn,
1405 "NETBIOSNAME": names.netbiosname,
1406 "DEFAULTSITE": names.sitename,
1407 "CONFIGDN": names.configdn,
1408 "SERVERDN": names.serverdn,
1409 "RIDAVAILABLESTART": str(next_rid + 600),
1410 "POLICYGUID_DC": policyguid_dc,
1411 "INFRASTRUCTURE_DESCRIPTOR": infrastructure_desc,
1412 "LOSTANDFOUND_DESCRIPTOR": lostandfound_desc,
1413 "SYSTEM_DESCRIPTOR": system_desc,
1414 "BUILTIN_DESCRIPTOR": builtin_desc,
1415 "DOMAIN_CONTROLLERS_DESCRIPTOR": controllers_desc,
1418 # If we are setting up a subdomain, then this has been replicated in, so we don't need to add it
1419 if fill == FILL_FULL:
1420 setup_modify_ldif(samdb,
1421 setup_path("provision_configuration_references.ldif"), {
1422 "CONFIGDN": names.configdn,
1423 "SCHEMADN": names.schemadn})
1425 logger.info("Setting up well known security principals")
1426 protected1wd_descr = b64encode(get_config_delete_protected1wd_descriptor(names.domainsid))
1427 setup_add_ldif(samdb, setup_path("provision_well_known_sec_princ.ldif"), {
1428 "CONFIGDN": names.configdn,
1429 "WELLKNOWNPRINCIPALS_DESCRIPTOR": protected1wd_descr,
1432 if fill == FILL_FULL or fill == FILL_SUBDOMAIN:
1433 setup_modify_ldif(samdb,
1434 setup_path("provision_basedn_references.ldif"),
1435 {"DOMAINDN": names.domaindn})
1437 logger.info("Setting up sam.ldb users and groups")
1438 setup_add_ldif(samdb, setup_path("provision_users.ldif"), {
1439 "DOMAINDN": names.domaindn,
1440 "DOMAINSID": str(names.domainsid),
1441 "ADMINPASS_B64": b64encode(adminpass.encode('utf-16-le')),
1442 "KRBTGTPASS_B64": b64encode(krbtgtpass.encode('utf-16-le'))
1445 logger.info("Setting up self join")
1446 setup_self_join(samdb, admin_session_info, names=names, fill=fill,
1447 invocationid=invocationid,
1448 dns_backend=dns_backend,
1450 machinepass=machinepass,
1451 domainsid=names.domainsid,
1454 policyguid=policyguid,
1455 policyguid_dc=policyguid_dc,
1456 domainControllerFunctionality=domainControllerFunctionality,
1459 ntds_dn = "CN=NTDS Settings,%s" % names.serverdn
1460 names.ntdsguid = samdb.searchone(basedn=ntds_dn,
1461 attribute="objectGUID", expression="", scope=ldb.SCOPE_BASE)
1462 assert isinstance(names.ntdsguid, str)
1467 SYSVOL_ACL = "O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)"
1468 POLICIES_ACL = "O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001301bf;;;PA)"
1469 SYSVOL_SERVICE="sysvol"
1471 def set_dir_acl(path, acl, lp, domsid, use_ntvfs, passdb, service=SYSVOL_SERVICE):
1472 setntacl(lp, path, acl, domsid, use_ntvfs=use_ntvfs, skip_invalid_chown=True, passdb=passdb, service=service)
1473 for root, dirs, files in os.walk(path, topdown=False):
1475 setntacl(lp, os.path.join(root, name), acl, domsid,
1476 use_ntvfs=use_ntvfs, skip_invalid_chown=True, passdb=passdb, service=service)
1478 setntacl(lp, os.path.join(root, name), acl, domsid,
1479 use_ntvfs=use_ntvfs, skip_invalid_chown=True, passdb=passdb, service=service)
1482 def set_gpos_acl(sysvol, dnsdomain, domainsid, domaindn, samdb, lp, use_ntvfs, passdb):
1483 """Set ACL on the sysvol/<dnsname>/Policies folder and the policy
1486 :param sysvol: Physical path for the sysvol folder
1487 :param dnsdomain: The DNS name of the domain
1488 :param domainsid: The SID of the domain
1489 :param domaindn: The DN of the domain (ie. DC=...)
1490 :param samdb: An LDB object on the SAM db
1491 :param lp: an LP object
1494 # Set ACL for GPO root folder
1495 root_policy_path = os.path.join(sysvol, dnsdomain, "Policies")
1496 setntacl(lp, root_policy_path, POLICIES_ACL, str(domainsid),
1497 use_ntvfs=use_ntvfs, skip_invalid_chown=True, passdb=passdb, service=SYSVOL_SERVICE)
1499 res = samdb.search(base="CN=Policies,CN=System,%s"%(domaindn),
1500 attrs=["cn", "nTSecurityDescriptor"],
1501 expression="", scope=ldb.SCOPE_ONELEVEL)
1504 acl = ndr_unpack(security.descriptor,
1505 str(policy["nTSecurityDescriptor"])).as_sddl()
1506 policy_path = getpolicypath(sysvol, dnsdomain, str(policy["cn"]))
1507 set_dir_acl(policy_path, dsacl2fsacl(acl, domainsid), lp,
1508 str(domainsid), use_ntvfs,
1512 def setsysvolacl(samdb, netlogon, sysvol, uid, gid, domainsid, dnsdomain,
1513 domaindn, lp, use_ntvfs):
1514 """Set the ACL for the sysvol share and the subfolders
1516 :param samdb: An LDB object on the SAM db
1517 :param netlogon: Physical path for the netlogon folder
1518 :param sysvol: Physical path for the sysvol folder
1519 :param uid: The UID of the "Administrator" user
1520 :param gid: The GID of the "Domain adminstrators" group
1521 :param domainsid: The SID of the domain
1522 :param dnsdomain: The DNS name of the domain
1523 :param domaindn: The DN of the domain (ie. DC=...)
1528 s3conf = s3param.get_context()
1529 s3conf.load(lp.configfile)
1531 file = tempfile.NamedTemporaryFile(dir=os.path.abspath(sysvol))
1534 smbd.set_simple_acl(file.name, 0755, gid)
1536 if not smbd.have_posix_acls():
1537 # This clue is only strictly correct for RPM and
1538 # Debian-like Linux systems, but hopefully other users
1539 # will get enough clue from it.
1540 raise ProvisioningError("Samba was compiled without the posix ACL support that s3fs requires. "
1541 "Try installing libacl1-dev or libacl-devel, then re-run configure and make.")
1543 raise ProvisioningError("Your filesystem or build does not support posix ACLs, which s3fs requires. "
1544 "Try the mounting the filesystem with the 'acl' option.")
1546 smbd.chown(file.name, uid, gid)
1548 raise ProvisioningError("Unable to chown a file on your filesystem. "
1549 "You may not be running provision as root.")
1553 # This will ensure that the smbd code we are running when setting ACLs
1554 # is initialised with the smb.conf
1555 s3conf = s3param.get_context()
1556 s3conf.load(lp.configfile)
1557 # ensure we are using the right samba_dsdb passdb backend, no matter what
1558 s3conf.set("passdb backend", "samba_dsdb:%s" % samdb.url)
1559 passdb.reload_static_pdb()
1561 # ensure that we init the samba_dsdb backend, so the domain sid is
1562 # marked in secrets.tdb
1563 s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
1565 # now ensure everything matches correctly, to avoid wierd issues
1566 if passdb.get_global_sam_sid() != domainsid:
1567 raise ProvisioningError('SID as seen by smbd [%s] does not match SID as seen by the provision script [%s]!' % (passdb.get_global_sam_sid(), domainsid))
1569 domain_info = s4_passdb.domain_info()
1570 if domain_info["dom_sid"] != domainsid:
1571 raise ProvisioningError('SID as seen by pdb_samba_dsdb [%s] does not match SID as seen by the provision script [%s]!' % (domain_info["dom_sid"], domainsid))
1573 if domain_info["dns_domain"].upper() != dnsdomain.upper():
1574 raise ProvisioningError('Realm as seen by pdb_samba_dsdb [%s] does not match Realm as seen by the provision script [%s]!' % (domain_info["dns_domain"].upper(), dnsdomain.upper()))
1579 os.chown(sysvol, -1, gid)
1585 # Set the SYSVOL_ACL on the sysvol folder and subfolder (first level)
1586 setntacl(lp,sysvol, SYSVOL_ACL, str(domainsid), use_ntvfs=use_ntvfs,
1587 skip_invalid_chown=True, passdb=s4_passdb,
1588 service=SYSVOL_SERVICE)
1589 for root, dirs, files in os.walk(sysvol, topdown=False):
1591 if use_ntvfs and canchown:
1592 os.chown(os.path.join(root, name), -1, gid)
1593 setntacl(lp, os.path.join(root, name), SYSVOL_ACL, str(domainsid),
1594 use_ntvfs=use_ntvfs, skip_invalid_chown=True,
1595 passdb=s4_passdb, service=SYSVOL_SERVICE)
1597 if use_ntvfs and canchown:
1598 os.chown(os.path.join(root, name), -1, gid)
1599 setntacl(lp, os.path.join(root, name), SYSVOL_ACL, str(domainsid),
1600 use_ntvfs=use_ntvfs, skip_invalid_chown=True,
1601 passdb=s4_passdb, service=SYSVOL_SERVICE)
1603 # Set acls on Policy folder and policies folders
1604 set_gpos_acl(sysvol, dnsdomain, domainsid, domaindn, samdb, lp, use_ntvfs, passdb=s4_passdb)
1606 def acl_type(direct_db_access):
1607 if direct_db_access:
1612 def check_dir_acl(path, acl, lp, domainsid, direct_db_access):
1613 fsacl = getntacl(lp, path, direct_db_access=direct_db_access, service=SYSVOL_SERVICE)
1614 fsacl_sddl = fsacl.as_sddl(domainsid)
1615 if fsacl_sddl != acl:
1616 raise ProvisioningError('%s ACL on GPO directory %s %s does not match expected value %s from GPO object' % (acl_type(direct_db_access), path, fsacl_sddl, acl))
1618 for root, dirs, files in os.walk(path, topdown=False):
1620 fsacl = getntacl(lp, os.path.join(root, name),
1621 direct_db_access=direct_db_access, service=SYSVOL_SERVICE)
1623 raise ProvisioningError('%s ACL on GPO file %s %s not found!' % (acl_type(direct_db_access), os.path.join(root, name)))
1624 fsacl_sddl = fsacl.as_sddl(domainsid)
1625 if fsacl_sddl != acl:
1626 raise ProvisioningError('%s ACL on GPO file %s %s does not match expected value %s from GPO object' % (acl_type(direct_db_access), os.path.join(root, name), fsacl_sddl, acl))
1629 fsacl = getntacl(lp, os.path.join(root, name),
1630 direct_db_access=direct_db_access, service=SYSVOL_SERVICE)
1632 raise ProvisioningError('%s ACL on GPO directory %s %s not found!' % (acl_type(direct_db_access), os.path.join(root, name)))
1633 fsacl_sddl = fsacl.as_sddl(domainsid)
1634 if fsacl_sddl != acl:
1635 raise ProvisioningError('%s ACL on GPO directory %s %s does not match expected value %s from GPO object' % (acl_type(direct_db_access), os.path.join(root, name), fsacl_sddl, acl))
1638 def check_gpos_acl(sysvol, dnsdomain, domainsid, domaindn, samdb, lp,
1640 """Set ACL on the sysvol/<dnsname>/Policies folder and the policy
1643 :param sysvol: Physical path for the sysvol folder
1644 :param dnsdomain: The DNS name of the domain
1645 :param domainsid: The SID of the domain
1646 :param domaindn: The DN of the domain (ie. DC=...)
1647 :param samdb: An LDB object on the SAM db
1648 :param lp: an LP object
1651 # Set ACL for GPO root folder
1652 root_policy_path = os.path.join(sysvol, dnsdomain, "Policies")
1653 fsacl = getntacl(lp, root_policy_path,
1654 direct_db_access=direct_db_access, service=SYSVOL_SERVICE)
1656 raise ProvisioningError('DB ACL on policy root %s %s not found!' % (acl_type(direct_db_access), root_policy_path))
1657 fsacl_sddl = fsacl.as_sddl(domainsid)
1658 if fsacl_sddl != POLICIES_ACL:
1659 raise ProvisioningError('%s ACL on policy root %s %s does not match expected value %s from provision' % (acl_type(direct_db_access), root_policy_path, fsacl_sddl, fsacl))
1660 res = samdb.search(base="CN=Policies,CN=System,%s"%(domaindn),
1661 attrs=["cn", "nTSecurityDescriptor"],
1662 expression="", scope=ldb.SCOPE_ONELEVEL)
1665 acl = ndr_unpack(security.descriptor,
1666 str(policy["nTSecurityDescriptor"])).as_sddl()
1667 policy_path = getpolicypath(sysvol, dnsdomain, str(policy["cn"]))
1668 check_dir_acl(policy_path, dsacl2fsacl(acl, domainsid), lp,
1669 domainsid, direct_db_access)
1672 def checksysvolacl(samdb, netlogon, sysvol, domainsid, dnsdomain, domaindn,
1674 """Set the ACL for the sysvol share and the subfolders
1676 :param samdb: An LDB object on the SAM db
1677 :param netlogon: Physical path for the netlogon folder
1678 :param sysvol: Physical path for the sysvol folder
1679 :param uid: The UID of the "Administrator" user
1680 :param gid: The GID of the "Domain adminstrators" group
1681 :param domainsid: The SID of the domain
1682 :param dnsdomain: The DNS name of the domain
1683 :param domaindn: The DN of the domain (ie. DC=...)
1686 # This will ensure that the smbd code we are running when setting ACLs is initialised with the smb.conf
1687 s3conf = s3param.get_context()
1688 s3conf.load(lp.configfile)
1689 # ensure we are using the right samba_dsdb passdb backend, no matter what
1690 s3conf.set("passdb backend", "samba_dsdb:%s" % samdb.url)
1691 # ensure that we init the samba_dsdb backend, so the domain sid is marked in secrets.tdb
1692 s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
1694 # now ensure everything matches correctly, to avoid wierd issues
1695 if passdb.get_global_sam_sid() != domainsid:
1696 raise ProvisioningError('SID as seen by smbd [%s] does not match SID as seen by the provision script [%s]!' % (passdb.get_global_sam_sid(), domainsid))
1698 domain_info = s4_passdb.domain_info()
1699 if domain_info["dom_sid"] != domainsid:
1700 raise ProvisioningError('SID as seen by pdb_samba_dsdb [%s] does not match SID as seen by the provision script [%s]!' % (domain_info["dom_sid"], domainsid))
1702 if domain_info["dns_domain"].upper() != dnsdomain.upper():
1703 raise ProvisioningError('Realm as seen by pdb_samba_dsdb [%s] does not match Realm as seen by the provision script [%s]!' % (domain_info["dns_domain"].upper(), dnsdomain.upper()))
1705 # Ensure we can read this directly, and via the smbd VFS
1706 for direct_db_access in [True, False]:
1707 # Check the SYSVOL_ACL on the sysvol folder and subfolder (first level)
1708 for dir_path in [os.path.join(sysvol, dnsdomain), netlogon]:
1709 fsacl = getntacl(lp, dir_path, direct_db_access=direct_db_access, service=SYSVOL_SERVICE)
1711 raise ProvisioningError('%s ACL on sysvol directory %s not found!' % (acl_type(direct_db_access), dir_path))
1712 fsacl_sddl = fsacl.as_sddl(domainsid)
1713 if fsacl_sddl != SYSVOL_ACL:
1714 raise ProvisioningError('%s ACL on sysvol directory %s %s does not match expected value %s from provision' % (acl_type(direct_db_access), dir_path, fsacl_sddl, SYSVOL_ACL))
1716 # Check acls on Policy folder and policies folders
1717 check_gpos_acl(sysvol, dnsdomain, domainsid, domaindn, samdb, lp,
1721 def interface_ips_v4(lp):
1722 """return only IPv4 IPs"""
1723 ips = samba.interface_ips(lp, False)
1726 if i.find(':') == -1:
1731 def interface_ips_v6(lp):
1732 """return only IPv6 IPs"""
1733 ips = samba.interface_ips(lp, False)
1736 if i.find(':') != -1:
1741 def provision_fill(samdb, secrets_ldb, logger, names, paths,
1743 targetdir=None, samdb_fill=FILL_FULL,
1744 hostip=None, hostip6=None,
1745 next_rid=1000, dc_rid=None, adminpass=None, krbtgtpass=None,
1746 domainguid=None, policyguid=None, policyguid_dc=None,
1747 invocationid=None, machinepass=None, ntdsguid=None,
1748 dns_backend=None, dnspass=None,
1749 serverrole=None, dom_for_fun_level=None,
1750 am_rodc=False, lp=None, use_ntvfs=False, skip_sysvolacl=False):
1751 # create/adapt the group policy GUIDs
1752 # Default GUID for default policy are described at
1753 # "How Core Group Policy Works"
1754 # http://technet.microsoft.com/en-us/library/cc784268%28WS.10%29.aspx
1755 if policyguid is None:
1756 policyguid = DEFAULT_POLICY_GUID
1757 policyguid = policyguid.upper()
1758 if policyguid_dc is None:
1759 policyguid_dc = DEFAULT_DC_POLICY_GUID
1760 policyguid_dc = policyguid_dc.upper()
1762 if invocationid is None:
1763 invocationid = str(uuid.uuid4())
1765 if krbtgtpass is None:
1766 krbtgtpass = samba.generate_random_password(128, 255)
1767 if machinepass is None:
1768 machinepass = samba.generate_random_password(128, 255)
1770 dnspass = samba.generate_random_password(128, 255)
1772 samdb.transaction_start()
1774 samdb = fill_samdb(samdb, lp, names, logger=logger,
1776 policyguid=policyguid, policyguid_dc=policyguid_dc,
1777 fill=samdb_fill, adminpass=adminpass, krbtgtpass=krbtgtpass,
1778 invocationid=invocationid, machinepass=machinepass,
1779 dns_backend=dns_backend, dnspass=dnspass,
1780 ntdsguid=ntdsguid, serverrole=serverrole,
1781 dom_for_fun_level=dom_for_fun_level, am_rodc=am_rodc,
1782 next_rid=next_rid, dc_rid=dc_rid)
1784 # Set up group policies (domain policy and domain controller
1786 if serverrole == "active directory domain controller":
1787 create_default_gpo(paths.sysvol, names.dnsdomain, policyguid,
1790 samdb.transaction_cancel()
1793 samdb.transaction_commit()
1795 if serverrole == "active directory domain controller":
1796 # Continue setting up sysvol for GPO. This appears to require being
1797 # outside a transaction.
1798 if not skip_sysvolacl:
1799 setsysvolacl(samdb, paths.netlogon, paths.sysvol, paths.root_uid,
1800 paths.root_gid, names.domainsid, names.dnsdomain,
1801 names.domaindn, lp, use_ntvfs)
1803 logger.info("Setting acl on sysvol skipped")
1805 secretsdb_self_join(secrets_ldb, domain=names.domain,
1806 realm=names.realm, dnsdomain=names.dnsdomain,
1807 netbiosname=names.netbiosname, domainsid=names.domainsid,
1808 machinepass=machinepass, secure_channel_type=SEC_CHAN_BDC)
1810 # Now set up the right msDS-SupportedEncryptionTypes into the DB
1811 # In future, this might be determined from some configuration
1812 kerberos_enctypes = str(ENC_ALL_TYPES)
1815 msg = ldb.Message(ldb.Dn(samdb,
1816 samdb.searchone("distinguishedName",
1817 expression="samAccountName=%s$" % names.netbiosname,
1818 scope=ldb.SCOPE_SUBTREE)))
1819 msg["msDS-SupportedEncryptionTypes"] = ldb.MessageElement(
1820 elements=kerberos_enctypes, flags=ldb.FLAG_MOD_REPLACE,
1821 name="msDS-SupportedEncryptionTypes")
1823 except ldb.LdbError, (enum, estr):
1824 if enum != ldb.ERR_NO_SUCH_ATTRIBUTE:
1825 # It might be that this attribute does not exist in this schema
1828 setup_ad_dns(samdb, secrets_ldb, names, paths, lp, logger,
1829 hostip=hostip, hostip6=hostip6, dns_backend=dns_backend,
1830 dnspass=dnspass, os_level=dom_for_fun_level,
1831 targetdir=targetdir, fill_level=samdb_fill)
1833 domainguid = samdb.searchone(basedn=samdb.get_default_basedn(),
1834 attribute="objectGUID")
1835 assert isinstance(domainguid, str)
1837 lastProvisionUSNs = get_last_provision_usn(samdb)
1838 maxUSN = get_max_usn(samdb, str(names.rootdn))
1839 if lastProvisionUSNs is not None:
1840 update_provision_usn(samdb, 0, maxUSN, invocationid, 1)
1842 set_provision_usn(samdb, 0, maxUSN, invocationid)
1844 logger.info("Setting up sam.ldb rootDSE marking as synchronized")
1845 setup_modify_ldif(samdb, setup_path("provision_rootdse_modify.ldif"),
1846 { 'NTDSGUID' : names.ntdsguid })
1848 # fix any dangling GUIDs from the provision
1849 logger.info("Fixing provision GUIDs")
1850 chk = dbcheck(samdb, samdb_schema=samdb, verbose=False, fix=True, yes=True,
1852 samdb.transaction_start()
1854 # a small number of GUIDs are missing because of ordering issues in the
1856 for schema_obj in ['CN=Domain', 'CN=Organizational-Person', 'CN=Contact', 'CN=inetOrgPerson']:
1857 chk.check_database(DN="%s,%s" % (schema_obj, names.schemadn),
1858 scope=ldb.SCOPE_BASE,
1859 attrs=['defaultObjectCategory'])
1860 chk.check_database(DN="CN=IP Security,CN=System,%s" % names.domaindn,
1861 scope=ldb.SCOPE_ONELEVEL,
1862 attrs=['ipsecOwnersReference',
1863 'ipsecFilterReference',
1864 'ipsecISAKMPReference',
1865 'ipsecNegotiationPolicyReference',
1866 'ipsecNFAReference'])
1868 samdb.transaction_cancel()
1871 samdb.transaction_commit()
1875 "ROLE_STANDALONE": "standalone server",
1876 "ROLE_DOMAIN_MEMBER": "member server",
1877 "ROLE_DOMAIN_BDC": "active directory domain controller",
1878 "ROLE_DOMAIN_PDC": "active directory domain controller",
1879 "dc": "active directory domain controller",
1880 "member": "member server",
1881 "domain controller": "active directory domain controller",
1882 "active directory domain controller": "active directory domain controller",
1883 "member server": "member server",
1884 "standalone": "standalone server",
1885 "standalone server": "standalone server",
1889 def sanitize_server_role(role):
1890 """Sanitize a server role name.
1892 :param role: Server role
1893 :raise ValueError: If the role can not be interpreted
1894 :return: Sanitized server role (one of "member server",
1895 "active directory domain controller", "standalone server")
1898 return _ROLES_MAP[role]
1900 raise ValueError(role)
1903 def provision_fake_ypserver(logger, samdb, domaindn, netbiosname, nisdomain,
1905 """Create AD entries for the fake ypserver.
1907 This is needed for being able to manipulate posix attrs via ADUC.
1909 samdb.transaction_start()
1911 logger.info("Setting up fake yp server settings")
1912 setup_add_ldif(samdb, setup_path("ypServ30.ldif"), {
1913 "DOMAINDN": domaindn,
1914 "NETBIOSNAME": netbiosname,
1915 "NISDOMAIN": nisdomain,
1918 samdb.transaction_cancel()
1921 samdb.transaction_commit()
1924 def provision(logger, session_info, smbconf=None,
1925 targetdir=None, samdb_fill=FILL_FULL, realm=None, rootdn=None,
1926 domaindn=None, schemadn=None, configdn=None, serverdn=None,
1927 domain=None, hostname=None, hostip=None, hostip6=None, domainsid=None,
1928 next_rid=1000, dc_rid=None, adminpass=None, ldapadminpass=None,
1929 krbtgtpass=None, domainguid=None, policyguid=None, policyguid_dc=None,
1930 dns_backend=None, dns_forwarder=None, dnspass=None,
1931 invocationid=None, machinepass=None, ntdsguid=None,
1932 root=None, nobody=None, users=None, backup=None, aci=None,
1933 serverrole=None, dom_for_fun_level=None, backend_type=None,
1934 sitename=None, ol_mmr_urls=None, ol_olc=None, slapd_path=None,
1935 useeadb=False, am_rodc=False, lp=None, use_ntvfs=False,
1936 use_rfc2307=False, maxuid=None, maxgid=None, skip_sysvolacl=True,
1937 ldap_backend_forced_uri=None, nosync=False, ldap_dryrun_mode=False, ldap_backend_extra_port=None):
1940 :note: caution, this wipes all existing data!
1944 serverrole = sanitize_server_role(serverrole)
1946 raise ProvisioningError('server role (%s) should be one of "active directory domain controller", "member server", "standalone server"' % serverrole)
1948 if ldapadminpass is None:
1949 # Make a new, random password between Samba and it's LDAP server
1950 ldapadminpass = samba.generate_random_password(128, 255)
1952 if backend_type is None:
1953 backend_type = "ldb"
1955 if domainsid is None:
1956 domainsid = security.random_sid()
1958 root_uid = findnss_uid([root or "root"])
1959 nobody_uid = findnss_uid([nobody or "nobody"])
1960 users_gid = findnss_gid([users or "users", 'users', 'other', 'staff'])
1961 root_gid = pwd.getpwuid(root_uid).pw_gid
1964 bind_gid = findnss_gid(["bind", "named"])
1968 if targetdir is not None:
1969 smbconf = os.path.join(targetdir, "etc", "smb.conf")
1970 elif smbconf is None:
1971 smbconf = samba.param.default_path()
1972 if not os.path.exists(os.path.dirname(smbconf)):
1973 os.makedirs(os.path.dirname(smbconf))
1975 server_services = []
1978 global_param["idmap_ldb:use rfc2307"] = ["yes"]
1980 if dns_backend != "SAMBA_INTERNAL":
1981 server_services.append("-dns")
1983 if dns_forwarder is not None:
1984 global_param["dns forwarder"] = [dns_forwarder]
1987 server_services.append("+smb")
1988 server_services.append("-s3fs")
1989 global_param["dcerpc endpoint servers"] = ["+winreg", "+srvsvc"]
1991 if len(server_services) > 0:
1992 global_param["server services"] = server_services
1994 # only install a new smb.conf if there isn't one there already
1995 if os.path.exists(smbconf):
1996 # if Samba Team members can't figure out the weird errors
1997 # loading an empty smb.conf gives, then we need to be smarter.
1998 # Pretend it just didn't exist --abartlet
1999 f = open(smbconf, 'r')
2001 data = f.read().lstrip()
2004 if data is None or data == "":
2005 make_smbconf(smbconf, hostname, domain, realm,
2006 targetdir, serverrole=serverrole,
2007 eadb=useeadb, use_ntvfs=use_ntvfs,
2008 lp=lp, global_param=global_param)
2010 make_smbconf(smbconf, hostname, domain, realm, targetdir,
2011 serverrole=serverrole,
2012 eadb=useeadb, use_ntvfs=use_ntvfs, lp=lp, global_param=global_param)
2015 lp = samba.param.LoadParm()
2017 names = guess_names(lp=lp, hostname=hostname, domain=domain,
2018 dnsdomain=realm, serverrole=serverrole, domaindn=domaindn,
2019 configdn=configdn, schemadn=schemadn, serverdn=serverdn,
2020 sitename=sitename, rootdn=rootdn, domain_names_forced=(samdb_fill == FILL_DRS))
2021 paths = provision_paths_from_lp(lp, names.dnsdomain)
2023 paths.bind_gid = bind_gid
2024 paths.root_uid = root_uid;
2025 paths.root_gid = root_gid
2028 logger.info("Looking up IPv4 addresses")
2029 hostips = interface_ips_v4(lp)
2030 if len(hostips) > 0:
2032 if len(hostips) > 1:
2033 logger.warning("More than one IPv4 address found. Using %s",
2035 if hostip == "127.0.0.1":
2038 logger.warning("No IPv4 address will be assigned")
2041 logger.info("Looking up IPv6 addresses")
2042 hostips = interface_ips_v6(lp)
2044 hostip6 = hostips[0]
2045 if len(hostips) > 1:
2046 logger.warning("More than one IPv6 address found. Using %s", hostip6)
2048 logger.warning("No IPv6 address will be assigned")
2050 names.hostip = hostip
2051 names.hostip6 = hostip6
2052 names.domainguid = domainguid
2053 names.domainsid = domainsid
2054 names.forestsid = domainsid
2056 if serverrole is None:
2057 serverrole = lp.get("server role")
2059 if not os.path.exists(paths.private_dir):
2060 os.mkdir(paths.private_dir)
2061 if not os.path.exists(os.path.join(paths.private_dir, "tls")):
2062 os.makedirs(os.path.join(paths.private_dir, "tls"), 0700)
2063 if not os.path.exists(paths.state_dir):
2064 os.mkdir(paths.state_dir)
2066 if paths.sysvol and not os.path.exists(paths.sysvol):
2067 os.makedirs(paths.sysvol, 0775)
2069 ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
2071 schema = Schema(domainsid, invocationid=invocationid,
2072 schemadn=names.schemadn)
2074 if backend_type == "ldb":
2075 provision_backend = LDBBackend(backend_type, paths=paths,
2077 names=names, logger=logger)
2078 elif backend_type == "existing":
2079 # If support for this is ever added back, then the URI will need to be
2081 provision_backend = ExistingBackend(backend_type, paths=paths,
2083 names=names, logger=logger,
2084 ldap_backend_forced_uri=ldap_backend_forced_uri)
2085 elif backend_type == "fedora-ds":
2086 provision_backend = FDSBackend(backend_type, paths=paths,
2088 names=names, logger=logger, domainsid=domainsid,
2089 schema=schema, hostname=hostname, ldapadminpass=ldapadminpass,
2090 slapd_path=slapd_path,
2092 elif backend_type == "openldap":
2093 provision_backend = OpenLDAPBackend(backend_type, paths=paths,
2095 names=names, logger=logger, domainsid=domainsid,
2096 schema=schema, hostname=hostname, ldapadminpass=ldapadminpass,
2097 slapd_path=slapd_path, ol_mmr_urls=ol_mmr_urls,
2098 ldap_backend_extra_port=ldap_backend_extra_port,
2099 ldap_dryrun_mode=ldap_dryrun_mode, nosync=nosync,
2100 ldap_backend_forced_uri=ldap_backend_forced_uri)
2102 raise ValueError("Unknown LDAP backend type selected")
2104 provision_backend.init()
2105 provision_backend.start()
2107 # only install a new shares config db if there is none
2108 if not os.path.exists(paths.shareconf):
2109 logger.info("Setting up share.ldb")
2110 share_ldb = Ldb(paths.shareconf, session_info=session_info, lp=lp)
2111 share_ldb.load_ldif_file_add(setup_path("share.ldif"))
2113 logger.info("Setting up secrets.ldb")
2114 secrets_ldb = setup_secretsdb(paths,
2115 session_info=session_info,
2116 backend_credentials=provision_backend.credentials, lp=lp)
2119 logger.info("Setting up the registry")
2120 setup_registry(paths.hklm, session_info, lp=lp)
2122 logger.info("Setting up the privileges database")
2123 setup_privileges(paths.privilege, session_info, lp=lp)
2125 logger.info("Setting up idmap db")
2126 idmap = setup_idmapdb(paths.idmapdb, session_info=session_info, lp=lp)
2128 setup_name_mappings(idmap, sid=str(domainsid),
2129 root_uid=root_uid, nobody_uid=nobody_uid,
2130 users_gid=users_gid, root_gid=root_gid)
2132 logger.info("Setting up SAM db")
2133 samdb = setup_samdb(paths.samdb, session_info,
2134 provision_backend, lp, names, logger=logger,
2135 serverrole=serverrole,
2136 schema=schema, fill=samdb_fill, am_rodc=am_rodc)
2138 if serverrole == "active directory domain controller":
2139 if paths.netlogon is None:
2140 raise MissingShareError("netlogon", paths.smbconf)
2142 if paths.sysvol is None:
2143 raise MissingShareError("sysvol", paths.smbconf)
2145 if not os.path.isdir(paths.netlogon):
2146 os.makedirs(paths.netlogon, 0755)
2148 if adminpass is None:
2149 adminpass = samba.generate_random_password(12, 32)
2150 adminpass_generated = True
2152 adminpass = unicode(adminpass, 'utf-8')
2153 adminpass_generated = False
2155 if samdb_fill == FILL_FULL:
2156 provision_fill(samdb, secrets_ldb, logger, names, paths,
2157 schema=schema, targetdir=targetdir, samdb_fill=samdb_fill,
2158 hostip=hostip, hostip6=hostip6,
2159 next_rid=next_rid, dc_rid=dc_rid, adminpass=adminpass,
2160 krbtgtpass=krbtgtpass,
2161 policyguid=policyguid, policyguid_dc=policyguid_dc,
2162 invocationid=invocationid, machinepass=machinepass,
2163 ntdsguid=ntdsguid, dns_backend=dns_backend,
2164 dnspass=dnspass, serverrole=serverrole,
2165 dom_for_fun_level=dom_for_fun_level, am_rodc=am_rodc,
2166 lp=lp, use_ntvfs=use_ntvfs,
2167 skip_sysvolacl=skip_sysvolacl)
2169 create_krb5_conf(paths.krb5conf,
2170 dnsdomain=names.dnsdomain, hostname=names.hostname,
2172 logger.info("A Kerberos configuration suitable for Samba 4 has been "
2173 "generated at %s", paths.krb5conf)
2175 if serverrole == "active directory domain controller":
2176 create_dns_update_list(lp, logger, paths)
2178 backend_result = provision_backend.post_setup()
2179 provision_backend.shutdown()
2182 secrets_ldb.transaction_cancel()
2185 # Now commit the secrets.ldb to disk
2186 secrets_ldb.transaction_commit()
2188 # the commit creates the dns.keytab, now chown it
2189 dns_keytab_path = os.path.join(paths.private_dir, paths.dns_keytab)
2190 if os.path.isfile(dns_keytab_path) and paths.bind_gid is not None:
2192 os.chmod(dns_keytab_path, 0640)
2193 os.chown(dns_keytab_path, -1, paths.bind_gid)
2195 if not os.environ.has_key('SAMBA_SELFTEST'):
2196 logger.info("Failed to chown %s to bind gid %u",
2197 dns_keytab_path, paths.bind_gid)
2199 result = ProvisionResult()
2200 result.server_role = serverrole
2201 result.domaindn = domaindn
2202 result.paths = paths
2203 result.names = names
2205 result.samdb = samdb
2206 result.idmap = idmap
2207 result.domainsid = str(domainsid)
2209 if samdb_fill == FILL_FULL:
2210 result.adminpass_generated = adminpass_generated
2211 result.adminpass = adminpass
2213 result.adminpass_generated = False
2214 result.adminpass = None
2216 result.backend_result = backend_result
2219 provision_fake_ypserver(logger=logger, samdb=samdb,
2220 domaindn=names.domaindn, netbiosname=names.netbiosname,
2221 nisdomain=names.domain.lower(), maxuid=maxuid, maxgid=maxgid)
2226 def provision_become_dc(smbconf=None, targetdir=None,
2227 realm=None, rootdn=None, domaindn=None, schemadn=None, configdn=None,
2228 serverdn=None, domain=None, hostname=None, domainsid=None,
2229 adminpass=None, krbtgtpass=None, domainguid=None, policyguid=None,
2230 policyguid_dc=None, invocationid=None, machinepass=None, dnspass=None,
2231 dns_backend=None, root=None, nobody=None, users=None,
2232 backup=None, serverrole=None, ldap_backend=None,
2233 ldap_backend_type=None, sitename=None, debuglevel=1, use_ntvfs=False):
2235 logger = logging.getLogger("provision")
2236 samba.set_debug_level(debuglevel)
2238 res = provision(logger, system_session(),
2239 smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS,
2240 realm=realm, rootdn=rootdn, domaindn=domaindn, schemadn=schemadn,
2241 configdn=configdn, serverdn=serverdn, domain=domain,
2242 hostname=hostname, hostip=None, domainsid=domainsid,
2243 machinepass=machinepass,
2244 serverrole="active directory domain controller",
2245 sitename=sitename, dns_backend=dns_backend, dnspass=dnspass,
2246 use_ntvfs=use_ntvfs)
2247 res.lp.set("debuglevel", str(debuglevel))
2251 def create_krb5_conf(path, dnsdomain, hostname, realm):
2252 """Write out a file containing a valid krb5.conf file
2254 :param path: Path of the new krb5.conf file.
2255 :param dnsdomain: DNS Domain name
2256 :param hostname: Local hostname
2257 :param realm: Realm name
2259 setup_file(setup_path("krb5.conf"), path, {
2260 "DNSDOMAIN": dnsdomain,
2261 "HOSTNAME": hostname,
2266 class ProvisioningError(Exception):
2267 """A generic provision error."""
2269 def __init__(self, value):
2273 return "ProvisioningError: " + self.value
2276 class InvalidNetbiosName(Exception):
2277 """A specified name was not a valid NetBIOS name."""
2279 def __init__(self, name):
2280 super(InvalidNetbiosName, self).__init__(
2281 "The name '%r' is not a valid NetBIOS name" % name)
2284 class MissingShareError(ProvisioningError):
2286 def __init__(self, name, smbconf):
2287 super(MissingShareError, self).__init__(
2288 "Existing smb.conf does not have a [%s] share, but you are "
2289 "configuring a DC. Please remove %s or add the share manually." %