3 # backend code for upgrading from Samba3
4 # Copyright Jelmer Vernooij 2005-2007
5 # Copyright Matthias Dieter Wallnöfer 2009
6 # Released under the GNU GPL v3 or later
9 """Support code for upgrading from Samba 3 to Samba 4."""
11 __docformat__ = "restructuredText"
13 from provision import provision
20 from samba.param import LoadParm
22 def import_sam_policy(samldb, policy, dn):
23 """Import a Samba 3 policy database."""
24 samldb.modify_ldif("""
33 samba3ResetCountMinutes: %d
34 samba3UserMustLogonToChangePassword: %d
35 samba3BadLockoutMinutes: %d
36 samba3DisconnectTime: %d
38 """ % (dn, policy.min_password_length,
39 policy.password_history, policy.minimum_password_age,
40 policy.maximum_password_age, policy.lockout_duration,
41 policy.reset_count_minutes, policy.user_must_logon_to_change_password,
42 policy.bad_lockout_minutes, policy.disconnect_time))
45 def import_sam_account(samldb,acc,domaindn,domainsid):
46 """Import a Samba 3 SAM account.
48 :param samldb: Samba 4 SAM Database handle
49 :param acc: Samba 3 account
50 :param domaindn: Domain DN
51 :param domainsid: Domain SID."""
52 if acc.nt_username is None or acc.nt_username == "":
53 acc.nt_username = acc.username
55 if acc.fullname is None:
57 acc.fullname = pwd.getpwnam(acc.username)[4].split(",")[0]
61 if acc.fullname is None:
62 acc.fullname = acc.username
64 assert acc.fullname is not None
65 assert acc.nt_username is not None
68 "dn": "cn=%s,%s" % (acc.fullname, domaindn),
69 "objectClass": ["top", "user"],
70 "lastLogon": str(acc.logon_time),
71 "lastLogoff": str(acc.logoff_time),
72 "unixName": acc.username,
73 "sAMAccountName": acc.nt_username,
74 "cn": acc.nt_username,
75 "description": acc.acct_desc,
76 "primaryGroupID": str(acc.group_rid),
77 "badPwdcount": str(acc.bad_password_count),
78 "logonCount": str(acc.logon_count),
79 "samba3Domain": acc.domain,
80 "samba3DirDrive": acc.dir_drive,
81 "samba3MungedDial": acc.munged_dial,
82 "samba3Homedir": acc.homedir,
83 "samba3LogonScript": acc.logon_script,
84 "samba3ProfilePath": acc.profile_path,
85 "samba3Workstations": acc.workstations,
86 "samba3KickOffTime": str(acc.kickoff_time),
87 "samba3BadPwdTime": str(acc.bad_password_time),
88 "samba3PassLastSetTime": str(acc.pass_last_set_time),
89 "samba3PassCanChangeTime": str(acc.pass_can_change_time),
90 "samba3PassMustChangeTime": str(acc.pass_must_change_time),
91 "objectSid": "%s-%d" % (domainsid, acc.user_rid),
92 "lmPwdHash:": acc.lm_password,
93 "ntPwdHash:": acc.nt_password,
96 def import_sam_group(samldb, sid, gid, sid_name_use, nt_name, comment, domaindn):
97 """Upgrade a SAM group.
99 :param samldb: SAM database.
100 :param gid: Group GID
101 :param sid_name_use: SID name use
102 :param nt_name: NT Group Name
103 :param comment: NT Group Comment
104 :param domaindn: Domain DN
107 if sid_name_use == 5: # Well-known group
110 if nt_name in ("Domain Guests", "Domain Users", "Domain Admins"):
114 gr = grp.getgrnam(nt_name)
116 gr = grp.getgrgid(gid)
121 unixname = gr.gr_name
123 assert unixname is not None
126 "dn": "cn=%s,%s" % (nt_name, domaindn),
127 "objectClass": ["top", "group"],
128 "description": comment,
131 "unixName": unixname,
132 "samba3SidNameUse": str(sid_name_use)
135 def import_idmap(samdb,samba3_idmap,domaindn):
136 """Import idmap data.
138 :param samdb: SamDB handle.
139 :param samba3_idmap: Samba 3 IDMAP database to import from
140 :param domaindn: Domain DN.
144 "userHwm": str(samba3_idmap.get_user_hwm()),
145 "groupHwm": str(samba3_idmap.get_group_hwm())})
147 for uid in samba3_idmap.uids():
148 samdb.add({"dn": "SID=%s,%s" % (samba3_idmap.get_user_sid(uid), domaindn),
149 "SID": samba3_idmap.get_user_sid(uid),
153 for gid in samba3_idmap.uids():
154 samdb.add({"dn": "SID=%s,%s" % (samba3_idmap.get_group_sid(gid), domaindn),
155 "SID": samba3_idmap.get_group_sid(gid),
159 def import_wins(samba4_winsdb, samba3_winsdb):
160 """Import settings from a Samba3 WINS database.
162 :param samba4_winsdb: WINS database to import to
163 :param samba3_winsdb: WINS database to import from
167 for (name, (ttl, ips, nb_flags)) in samba3_winsdb.items():
170 type = int(name.split("#", 1)[1], 16)
185 if ttl > time.time():
186 rState = 0x0 # active
188 rState = 0x1 # released
190 nType = ((nb_flags & 0x60)>>5)
192 samba4_winsdb.add({"dn": "name=%s,type=0x%s" % tuple(name.split("#")),
193 "type": name.split("#")[1],
194 "name": name.split("#")[0],
195 "objectClass": "winsRecord",
196 "recordType": str(rType),
197 "recordState": str(rState),
198 "nodeType": str(nType),
199 "expireTime": ldb.timestring(ttl),
201 "versionID": str(version_id),
204 samba4_winsdb.add({"dn": "cn=VERSION",
206 "objectClass": "winsMaxVersion",
207 "maxVersion": str(version_id)})
209 def enable_samba3sam(samdb, ldapurl):
210 """Enable Samba 3 LDAP URL database.
212 :param samdb: SAM Database.
213 :param ldapurl: Samba 3 LDAP URL
215 samdb.modify_ldif("""
219 @LIST: samldb,operational,objectguid,rdn_name,samba3sam
222 samdb.add({"dn": "@MAP=samba3sam", "@MAP_URL": ldapurl})
238 "bind interfaces only",
243 "obey pam restrictions",
251 "client NTLMv2 auth",
252 "client lanman auth",
253 "client plaintext auth",
273 "name resolve order",
282 "paranoid server security",
318 def upgrade_smbconf(oldconf,mark):
319 """Remove configuration variables not present in Samba4
321 :param oldconf: Old configuration structure
322 :param mark: Whether removed configuration variables should be
323 kept in the new configuration as "samba3:<name>"
325 data = oldconf.data()
331 for k in smbconf_keep:
332 if smbconf_keep[k] == p:
337 newconf.set(s, p, oldconf.get(s, p))
339 newconf.set(s, "samba3:"+p, oldconf.get(s,p))
343 SAMBA3_PREDEF_NAMES = {
344 'HKLM': registry.HKEY_LOCAL_MACHINE,
347 def import_registry(samba4_registry, samba3_regdb):
348 """Import a Samba 3 registry database into the Samba 4 registry.
350 :param samba4_registry: Samba 4 registry handle.
351 :param samba3_regdb: Samba 3 registry database handle.
353 def ensure_key_exists(keypath):
354 (predef_name, keypath) = keypath.split("/", 1)
355 predef_id = SAMBA3_PREDEF_NAMES[predef_name]
356 keypath = keypath.replace("/", "\\")
357 return samba4_registry.create_key(predef_id, keypath)
359 for key in samba3_regdb.keys():
360 key_handle = ensure_key_exists(key)
361 for subkey in samba3_regdb.subkeys(key):
362 ensure_key_exists(subkey)
363 for (value_name, (value_type, value_data)) in samba3_regdb.values(key).items():
364 key_handle.set_value(value_name, value_type, value_data)
367 def upgrade_provision(samba3, setup_dir, message, credentials, session_info,
369 oldconf = samba3.get_conf()
371 if oldconf.get("domain logons") == "True":
372 serverrole = "domain controller"
374 if oldconf.get("security") == "user":
375 serverrole = "standalone"
377 serverrole = "member server"
379 domainname = oldconf.get("workgroup")
380 realm = oldconf.get("realm")
381 netbiosname = oldconf.get("netbios name")
383 secrets_db = samba3.get_secrets_db()
385 if domainname is None:
386 domainname = secrets_db.domains()[0]
387 message("No domain specified in smb.conf file, assuming '%s'" % domainname)
390 if oldconf.get("domain logons") == "True":
391 message("No realm specified in smb.conf file and being a DC. That upgrade path doesn't work! Please add a 'realm' directive to your old smb.conf to let us know which one you want to use (generally it's the upcased DNS domainname).")
394 realm = domainname.upper()
395 message("No realm specified in smb.conf file, assuming '%s'" % realm)
397 domainguid = secrets_db.get_domain_guid(domainname)
398 domainsid = secrets_db.get_sid(domainname)
399 if domainsid is None:
400 message("Can't find domain secrets for '%s'; using random SID" % domainname)
402 if netbiosname is not None:
403 machinepass = secrets_db.get_machine_password(netbiosname)
407 result = provision(setup_dir=setup_dir, message=message,
408 session_info=session_info, credentials=credentials,
409 targetdir=targetdir, realm=realm, domain=domainname,
410 domainguid=domainguid, domainsid=domainsid,
411 hostname=netbiosname, machinepass=machinepass,
412 serverrole=serverrole)
414 # FIXME: import_wins(Ldb(result.paths.winsdb), samba3.get_wins_db())
416 # FIXME: import_registry(registry.Registry(), samba3.get_registry())
418 # FIXME: import_idmap(samdb,samba3.get_idmap_db(),domaindn)
420 groupdb = samba3.get_groupmapping_db()
421 for sid in groupdb.groupsids():
422 (gid, sid_name_use, nt_name, comment) = groupdb.get_group(sid)
423 # FIXME: import_sam_group(samdb, sid, gid, sid_name_use, nt_name, comment, domaindn)
427 passdb = samba3.get_sam_db()
430 #FIXME: import_sam_account(result.samdb, user, domaindn, domainsid)
432 if hasattr(passdb, 'ldap_url'):
433 message("Enabling Samba3 LDAP mappings for SAM database")
435 enable_samba3sam(result.samdb, passdb.ldap_url)