}
if (!(conn_flags & NET_FLAGS_NO_PIPE)) {
- if (cli->nt_pipe_fnum[cli->pipe_idx])
+ if (cli->pipes[cli->pipe_idx].fnum)
cli_nt_session_close(cli);
}
TALLOC_CTX *ctx = talloc_init("rpc_info_internals");
d_printf("Domain Name: %s\n", unistr2_tdup(ctx, &ctr.info.inf2.uni_domain));
d_printf("Domain SID: %s\n", sid_str);
- d_printf("Sequence number: %u\n", ctr.info.inf2.seq_num);
+ d_printf("Sequence number: %u\n", ctr.info.inf2.seq_num.low);
d_printf("Num users: %u\n", ctr.info.inf2.num_domain_usrs);
d_printf("Num domain groups: %u\n", ctr.info.inf2.num_domain_grps);
d_printf("Num local groups: %u\n", ctr.info.inf2.num_local_grps);
}
/* Display results */
+ if (!NT_STATUS_IS_OK(result)) {
+ d_printf("Failed to delete user account - %s\n", nt_errstr(result));
+ } else {
+ d_printf("Deleted user account\n");
+ }
done:
return result;
}
+/**
+ * Rename a user on a remote RPC server
+ *
+ * All parameters are provided by the run_rpc_command function, except for
+ * argc, argv which are passes through.
+ *
+ * @param domain_sid The domain sid acquired from the remote server
+ * @param cli A cli_state connected to the server.
+ * @param mem_ctx Talloc context, destoyed on completion of the function.
+ * @param argc Standard main() style argc
+ * @param argv Standard main() style argv. Initial components are already
+ * stripped
+ *
+ * @return Normal NTSTATUS return.
+ **/
+
+static NTSTATUS rpc_user_rename_internals(const DOM_SID *domain_sid, const char *domain_name,
+ struct cli_state *cli, TALLOC_CTX *mem_ctx,
+ int argc, const char **argv) {
+
+ POLICY_HND connect_pol, domain_pol, user_pol;
+ NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
+ uint32 info_level = 7;
+ const char *old_name, *new_name;
+ uint32 *user_rid;
+ uint32 flags = 0x000003e8; /* Unknown */
+ uint32 num_rids, *name_types;
+ uint32 num_names = 1;
+ const char **names;
+ SAM_USERINFO_CTR *user_ctr;
+ SAM_USERINFO_CTR ctr;
+ SAM_USER_INFO_7 info7;
+
+ if (argc != 2) {
+ d_printf("New and old username must be specified\n");
+ rpc_user_usage(argc, argv);
+ return NT_STATUS_OK;
+ }
+
+ old_name = argv[0];
+ new_name = argv[1];
+
+ ZERO_STRUCT(ctr);
+ ZERO_STRUCT(user_ctr);
+
+ /* Get sam policy handle */
+
+ result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
+ &connect_pol);
+ if (!NT_STATUS_IS_OK(result)) {
+ goto done;
+ }
+
+ /* Get domain policy handle */
+
+ result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
+ MAXIMUM_ALLOWED_ACCESS,
+ domain_sid, &domain_pol);
+ if (!NT_STATUS_IS_OK(result)) {
+ goto done;
+ }
+
+ names = TALLOC_ARRAY(mem_ctx, const char *, num_names);
+ names[0] = old_name;
+ result = cli_samr_lookup_names(cli, mem_ctx, &domain_pol,
+ flags, num_names, names,
+ &num_rids, &user_rid, &name_types);
+ if (!NT_STATUS_IS_OK(result)) {
+ goto done;
+ }
+
+ /* Open domain user */
+ result = cli_samr_open_user(cli, mem_ctx, &domain_pol,
+ MAXIMUM_ALLOWED_ACCESS, user_rid[0], &user_pol);
+
+ if (!NT_STATUS_IS_OK(result)) {
+ goto done;
+ }
+
+ /* Query user info */
+ result = cli_samr_query_userinfo(cli, mem_ctx, &user_pol,
+ info_level, &user_ctr);
+
+ if (!NT_STATUS_IS_OK(result)) {
+ goto done;
+ }
+
+ ctr.switch_value = info_level;
+ ctr.info.id7 = &info7;
+
+ init_sam_user_info7(&info7, new_name);
+
+ /* Set new name */
+ result = cli_samr_set_userinfo(cli, mem_ctx, &user_pol,
+ info_level, &cli->user_session_key, &ctr);
+
+ if (!NT_STATUS_IS_OK(result)) {
+ goto done;
+ }
+
+ done:
+ if (!NT_STATUS_IS_OK(result)) {
+ d_printf("Failed to rename user from %s to %s - %s\n", old_name, new_name,
+ nt_errstr(result));
+ } else {
+ d_printf("Renamed user from %s to %s\n", old_name, new_name);
+ }
+ return result;
+}
+
+
+/**
+ * Rename a user on a remote RPC server
+ *
+ * @param argc Standard main() style argc
+ * @param argv Standard main() style argv. Initial components are already
+ * stripped
+ *
+ * @return A shell status integer (0 for success)
+ **/
+
+static int rpc_user_rename(int argc, const char **argv)
+{
+ return run_rpc_command(NULL, PI_SAMR, 0, rpc_user_rename_internals,
+ argc, argv);
+}
+
/**
* Delete a user from a remote RPC server
*
result = cli_samr_query_usergroups(cli, mem_ctx, &user_pol,
&num_rids, &user_gids);
- /* Look up rids */
+ if (!NT_STATUS_IS_OK(result)) goto done;
- rids = TALLOC_ARRAY(mem_ctx, uint32, num_rids);
+ /* Look up rids */
- for (i = 0; i < num_rids; i++)
- rids[i] = user_gids[i].g_rid;
+ if (num_rids) {
+ rids = TALLOC_ARRAY(mem_ctx, uint32, num_rids);
- result = cli_samr_lookup_rids(cli, mem_ctx, &domain_pol,
- flags, num_rids, rids,
- &num_names, &names, &name_types);
+ for (i = 0; i < num_rids; i++)
+ rids[i] = user_gids[i].g_rid;
- if (!NT_STATUS_IS_OK(result)) {
- goto done;
- }
+ result = cli_samr_lookup_rids(cli, mem_ctx, &domain_pol,
+ num_rids, rids,
+ &num_names, &names, &name_types);
- /* Display results */
+ if (!NT_STATUS_IS_OK(result)) {
+ goto done;
+ }
- for (i = 0; i < num_names; i++)
- printf("%s\n", names[i]);
+ /* Display results */
+ for (i = 0; i < num_names; i++)
+ printf("%s\n", names[i]);
+ }
done:
return result;
}
{"info", rpc_user_info},
{"delete", rpc_user_delete},
{"password", rpc_user_password},
+ {"rename", rpc_user_rename},
{NULL, NULL}
};
ALIAS_INFO_CTR alias_info;
if (argc != 1) {
- d_printf("Group name must be specified\n");
+ d_printf("Alias name must be specified\n");
rpc_group_usage(argc, argv);
return NT_STATUS_OK;
}
/* We've got a comment to set */
- alias_info.switch_value1 = 3;
- alias_info.switch_value2 = 3;
+ alias_info.level = 3;
init_samr_alias_info3(&alias_info.alias.info3, opt_comment);
result = cli_samr_set_aliasinfo(cli, mem_ctx, &alias_pol, &alias_info);
done:
if (NT_STATUS_IS_OK(result))
- DEBUG(5, ("add group succeeded\n"));
+ DEBUG(5, ("add alias succeeded\n"));
else
- d_printf("add group failed: %s\n", nt_errstr(result));
+ d_printf("add alias failed: %s\n", nt_errstr(result));
return result;
}
NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
uint32 start_idx=0, max_entries=250, num_entries, i, loop_count = 0;
struct acct_info *groups;
- DOM_SID global_sid_Builtin;
BOOL global = False;
BOOL local = False;
BOOL builtin = False;
builtin = True;
}
- string_to_sid(&global_sid_Builtin, "S-1-5-32");
-
/* Get sam policy handle */
result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
(NT_STATUS_IS_OK(cli_samr_close(cli, mem_ctx,
&alias_pol)))) {
description = unistr2_tdup(mem_ctx,
- &ctr.alias.info3.uni_acct_desc);
+ ctr.alias.info3.description.string);
}
}
(NT_STATUS_IS_OK(cli_samr_close(cli, mem_ctx,
&alias_pol)))) {
description = unistr2_tdup(mem_ctx,
- &ctr.alias.info3.uni_acct_desc);
+ ctr.alias.info3.description.string);
}
}
if (num_members < this_time)
this_time = num_members;
- result = cli_samr_lookup_rids(cli, mem_ctx, domain_pol, 1000,
+ result = cli_samr_lookup_rids(cli, mem_ctx, domain_pol,
this_time, group_rids,
&num_names, &names, &name_types);
strequal(netname,"global"))
continue;
+ if (opt_exclude && in_list(netname, opt_exclude, False)) {
+ printf("excluding [%s]\n", netname);
+ continue;
+ }
+
/* only work with file-shares */
if (!cli_send_tconX(cli, netname, "A:", "", 0)) {
d_printf("skipping [%s]: not a file share.\n", netname);
* @param state arg-pointer
*
**/
-static void copy_fn(file_info *f, const char *mask, void *state)
+static void copy_fn(const char *mnt, file_info *f, const char *mask, void *state)
{
NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
struct copy_clistate *local_state = (struct copy_clistate *)state;
continue;
}
- if (opt_exclude && in_list(netname, (char *)opt_exclude, False)) {
+ if (opt_exclude && in_list(netname, opt_exclude, False)) {
printf("excluding [%s]\n", netname);
continue;
}
{
NTSTATUS result;
POLICY_HND connect_pol;
- DOM_SID global_sid_Builtin;
result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
&connect_pol);
if (!NT_STATUS_IS_OK(result))
goto done;
- string_to_sid(&global_sid_Builtin, "S-1-5-32");
-
result = rpc_fetch_domain_aliases(cli, mem_ctx, &connect_pol,
&global_sid_Builtin);
static void init_user_token(NT_USER_TOKEN *token, DOM_SID *user_sid)
{
- DOM_SID global_sid_World;
- DOM_SID global_sid_Network;
- DOM_SID global_sid_Authenticated_Users;
-
- string_to_sid(&global_sid_World, "S-1-1-0");
- string_to_sid(&global_sid_Network, "S-1-5-2");
- string_to_sid(&global_sid_Authenticated_Users, "S-1-5-11");
-
token->num_sids = 4;
token->user_sids = SMB_MALLOC_ARRAY(DOM_SID, 4);
int i;
struct user_token *result;
+ if (lp_winbind_use_default_domain() &&
+ (opt_target_workgroup == NULL)) {
+ d_printf("winbind use default domain = yes set, please "
+ "specify a workgroup\n");
+ return False;
+ }
+
/* Send request to winbind daemon */
ZERO_STRUCT(request);
DEBUG(3, ("%s\n", name));
- if (p == NULL)
- continue;
-
- *p++ = '\0';
-
- fstrcpy(domain, name);
- strupper_m(domain);
- fstrcpy(user, p);
+ if (p == NULL) {
+ fstrcpy(domain, opt_target_workgroup);
+ fstrcpy(user, name);
+ } else {
+ *p++ = '\0';
+ fstrcpy(domain, name);
+ strupper_m(domain);
+ fstrcpy(user, p);
+ }
get_user_sids(domain, user, &(result[i].token));
i+=1;
}
/* Create trusting domain's account */
- acb_info = ACB_DOMTRUST;
+ acb_info = ACB_NORMAL;
unknown = 0xe00500b0; /* No idea what this is - a permission mask?
mimir: yes, most probably it is */
{
SAM_USERINFO_CTR ctr;
- SAM_USER_INFO_24 p24;
+ SAM_USER_INFO_23 p23;
+ NTTIME notime;
+ char nostr[] = "";
+ LOGON_HRS hrs;
uchar pwbuf[516];
encode_pw_buffer((char *)pwbuf, argv[1], STR_UNICODE);
ZERO_STRUCT(ctr);
- ZERO_STRUCT(p24);
-
- init_sam_user_info24(&p24, (char *)pwbuf, 24);
-
- ctr.switch_value = 24;
- ctr.info.id24 = &p24;
-
- result = cli_samr_set_userinfo(cli, mem_ctx, &user_pol, 24,
+ ZERO_STRUCT(p23);
+ ZERO_STRUCT(notime);
+ hrs.max_len = 1260;
+ hrs.offset = 0;
+ hrs.len = 21;
+ memset(hrs.hours, 0xFF, sizeof(hrs.hours));
+ acb_info = ACB_DOMTRUST;
+
+ init_sam_user_info23A(&p23, ¬ime, ¬ime, ¬ime,
+ ¬ime, ¬ime, ¬ime,
+ nostr, nostr, nostr, nostr, nostr,
+ nostr, nostr, nostr, nostr, nostr,
+ 0, 0, acb_info, ACCT_FLAGS, 168, &hrs,
+ 0, 0, (char *)pwbuf);
+ ctr.switch_value = 23;
+ ctr.info.id23 = &p23;
+ p23.passmustchange = 0;
+
+ result = cli_samr_set_userinfo(cli, mem_ctx, &user_pol, 23,
&cli->user_session_key, &ctr);
if (!NT_STATUS_IS_OK(result)) {
}
+/**
+ * Remove interdomain trust account from the RPC server.
+ * All parameters (except for argc and argv) are passed by run_rpc_command
+ * function.
+ *
+ * @param domain_sid The domain sid acquired from the server
+ * @param cli A cli_state connected to the server.
+ * @param mem_ctx Talloc context, destoyed on completion of the function.
+ * @param argc Standard main() style argc
+ * @param argc Standard main() style argv. Initial components are already
+ * stripped
+ *
+ * @return normal NTSTATUS return code
+ */
+
+static NTSTATUS rpc_trustdom_del_internals(const DOM_SID *domain_sid,
+ const char *domain_name,
+ struct cli_state *cli, TALLOC_CTX *mem_ctx,
+ int argc, const char **argv) {
+
+ POLICY_HND connect_pol, domain_pol, user_pol;
+ NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
+ char *acct_name;
+ const char **names;
+ DOM_SID trust_acct_sid;
+ uint32 *user_rids, num_rids, *name_types;
+ uint32 flags = 0x000003e8; /* Unknown */
+
+ if (argc != 1) {
+ d_printf("Usage: net rpc trustdom del <domain_name>\n");
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ /*
+ * Make valid trusting domain account (ie. uppercased and with '$' appended)
+ */
+ acct_name = talloc_asprintf(mem_ctx, "%s$", argv[0]);
+
+ if (acct_name == NULL)
+ return NT_STATUS_NO_MEMORY;
+
+ strupper_m(acct_name);
+
+ names = TALLOC_ARRAY(mem_ctx, const char *, 1);
+ names[0] = acct_name;
+
+
+ /* Get samr policy handle */
+ result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS,
+ &connect_pol);
+ if (!NT_STATUS_IS_OK(result)) {
+ goto done;
+ }
+
+ /* Get domain policy handle */
+ result = cli_samr_open_domain(cli, mem_ctx, &connect_pol,
+ MAXIMUM_ALLOWED_ACCESS,
+ domain_sid, &domain_pol);
+ if (!NT_STATUS_IS_OK(result)) {
+ goto done;
+ }
+
+ result = cli_samr_lookup_names(cli, mem_ctx, &domain_pol, flags, 1,
+ names, &num_rids,
+ &user_rids, &name_types);
+
+ if (!NT_STATUS_IS_OK(result)) {
+ goto done;
+ }
+
+ result = cli_samr_open_user(cli, mem_ctx, &domain_pol,
+ MAXIMUM_ALLOWED_ACCESS,
+ user_rids[0], &user_pol);
+
+ if (!NT_STATUS_IS_OK(result)) {
+ goto done;
+ }
+
+ /* append the rid to the domain sid */
+ sid_copy(&trust_acct_sid, domain_sid);
+ if (!sid_append_rid(&trust_acct_sid, user_rids[0])) {
+ goto done;
+ }
+
+ /* remove the sid */
+
+ result = cli_samr_remove_sid_foreign_domain(cli, mem_ctx, &user_pol,
+ &trust_acct_sid);
+
+ if (!NT_STATUS_IS_OK(result)) {
+ goto done;
+ }
+
+ /* Delete user */
+
+ result = cli_samr_delete_dom_user(cli, mem_ctx, &user_pol);
+
+ if (!NT_STATUS_IS_OK(result)) {
+ goto done;
+ }
+
+ if (!NT_STATUS_IS_OK(result)) {
+ DEBUG(0,("Could not set trust account password: %s\n",
+ nt_errstr(result)));
+ goto done;
+ }
+
+ done:
+ return result;
+}
+
/**
* Delete interdomain trust account for a remote domain.
*
*
* @return Integer status (0 means success)
**/
-
+
static int rpc_trustdom_del(int argc, const char **argv)
{
- d_printf("Sorry, not yet implemented.\n");
- d_printf("Use 'smbpasswd -x -i' instead.\n");
- return -1;
+ if (argc > 0) {
+ return run_rpc_command(NULL, PI_SAMR, 0, rpc_trustdom_del_internals,
+ argc, argv);
+ } else {
+ d_printf("Usage: net rpc trustdom del <domain>\n");
+ return -1;
+ }
}
-
+
/**
* Establish trust relationship to a trusting domain.
* Interdomain account must already be created on remote PDC.
TALLOC_CTX *mem_ctx;
NTSTATUS nt_status;
DOM_SID *domain_sid;
- WKS_INFO_100 wks_info;
+ smb_ucs2_t *uni_domain_name;
char* domain_name;
char* domain_name_pol;
for domain %s\n", domain_name));
}
- /*
- * Call WksQueryInfo to check remote server's capabilities
- * note: It is now used only to get unicode domain name
- */
-
- if (!cli_nt_session_open(cli, PI_WKSSVC)) {
- DEBUG(0, ("Couldn't not initialise wkssvc pipe\n"));
- return -1;
- }
-
- if (!(mem_ctx = talloc_init("establishing trust relationship to domain %s",
- domain_name))) {
+ if (!(mem_ctx = talloc_init("establishing trust relationship to "
+ "domain %s", domain_name))) {
DEBUG(0, ("talloc_init() failed\n"));
cli_shutdown(cli);
return -1;
}
-
- nt_status = cli_wks_query_info(cli, mem_ctx, &wks_info);
-
- if (NT_STATUS_IS_ERR(nt_status)) {
- DEBUG(0, ("WksQueryInfo call failed.\n"));
- return -1;
- }
-
- if (cli->nt_pipe_fnum[cli->pipe_idx])
- cli_nt_session_close(cli);
-
/*
* Call LsaOpenPolicy and LsaQueryInfo
*/
- if (!(mem_ctx = talloc_init("rpc_trustdom_establish"))) {
- DEBUG(0, ("talloc_init() failed\n"));
- cli_shutdown(cli);
- return -1;
- }
-
if (!cli_nt_session_open(cli, PI_LSARPC)) {
DEBUG(0, ("Could not initialise lsa pipe\n"));
cli_shutdown(cli);
/* Querying info level 5 */
nt_status = cli_lsa_query_info_policy(cli, mem_ctx, &connect_hnd,
- 5 /* info level */, &domain_name_pol,
- &domain_sid);
+ 5 /* info level */,
+ &domain_name_pol, &domain_sid);
if (NT_STATUS_IS_ERR(nt_status)) {
DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
nt_errstr(nt_status)));
return -1;
}
-
-
+ if (push_ucs2_talloc(mem_ctx, &uni_domain_name, domain_name_pol) < 0) {
+ DEBUG(0, ("Could not convert domain name %s to unicode\n",
+ domain_name_pol));
+ return -1;
+ }
/* There should be actually query info level 3 (following nt serv behaviour),
but I still don't know if it's _really_ necessary */
* Store the password in secrets db
*/
- if (!secrets_store_trusted_domain_password(domain_name, wks_info.uni_lan_grp.buffer,
- wks_info.uni_lan_grp.uni_str_len, opt_password,
+ if (!secrets_store_trusted_domain_password(domain_name,
+ uni_domain_name,
+ strlen_w(uni_domain_name)+1,
+ opt_password,
*domain_sid)) {
DEBUG(0, ("Storing password for trusted domain failed.\n"));
return -1;
return -1;
}
- if (cli->nt_pipe_fnum[cli->pipe_idx])
+ if (cli->pipes[cli->pipe_idx].fnum)
cli_nt_session_close(cli);
+
+ cli_shutdown(cli);
talloc_destroy(mem_ctx);
d_printf(" net rpc trustdom establish \t establish relationship to trusted domain\n");
d_printf(" net rpc trustdom revoke \t abandon relationship to trusted domain\n");
d_printf(" net rpc trustdom list \t show current interdomain trust relationships\n");
+ d_printf(" net rpc trustdom vampire \t vampire interdomain trust relationships from remote server\n");
return -1;
}
return NT_STATUS_OK;
}
+static void print_trusted_domain(DOM_SID *dom_sid, const char *trusted_dom_name)
+{
+ fstring ascii_sid, padding;
+ int pad_len, col_len = 20;
+
+ /* convert sid into ascii string */
+ sid_to_string(ascii_sid, dom_sid);
+
+ /* calculate padding space for d_printf to look nicer */
+ pad_len = col_len - strlen(trusted_dom_name);
+ padding[pad_len] = 0;
+ do padding[--pad_len] = ' '; while (pad_len);
+
+ d_printf("%s%s%s\n", trusted_dom_name, padding, ascii_sid);
+}
+
+static NTSTATUS vampire_trusted_domain(struct cli_state *cli,
+ TALLOC_CTX *mem_ctx,
+ POLICY_HND *pol,
+ DOM_SID dom_sid,
+ const char *trusted_dom_name)
+{
+ NTSTATUS nt_status;
+ LSA_TRUSTED_DOMAIN_INFO *info;
+ char *cleartextpwd;
+ DATA_BLOB data;
+ smb_ucs2_t *uni_dom_name;
+
+ nt_status = cli_lsa_query_trusted_domain_info_by_sid(cli, mem_ctx, pol, 4, &dom_sid, &info);
+
+ if (NT_STATUS_IS_ERR(nt_status)) {
+ DEBUG(0,("Could not query trusted domain info. Error was %s\n",
+ nt_errstr(nt_status)));
+ goto done;
+ }
+
+ data = data_blob(NULL, info->password.password.length);
+
+ memcpy(data.data, info->password.password.data, info->password.password.length);
+ data.length = info->password.password.length;
+
+ cleartextpwd = decrypt_trustdom_secret(cli->pwd.password, &data);
+
+ if (cleartextpwd == NULL) {
+ DEBUG(0,("retrieved NULL password\n"));
+ nt_status = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ if (push_ucs2_talloc(mem_ctx, &uni_dom_name, trusted_dom_name) < 0) {
+ DEBUG(0, ("Could not convert domain name %s to unicode\n",
+ trusted_dom_name));
+ nt_status = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ if (!secrets_store_trusted_domain_password(trusted_dom_name,
+ uni_dom_name,
+ strlen_w(uni_dom_name)+1,
+ cleartextpwd,
+ dom_sid)) {
+ DEBUG(0, ("Storing password for trusted domain failed.\n"));
+ nt_status = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ DEBUG(100,("sucessfully vampired trusted domain [%s], sid: [%s], password: [%s]\n",
+ trusted_dom_name, sid_string_static(&dom_sid), cleartextpwd));
+
+done:
+ SAFE_FREE(cleartextpwd);
+ data_blob_free(&data);
+
+ return nt_status;
+}
+
+static int rpc_trustdom_vampire(int argc, const char **argv)
+{
+ /* common variables */
+ TALLOC_CTX* mem_ctx;
+ struct cli_state *cli;
+ NTSTATUS nt_status;
+ const char *domain_name = NULL;
+ DOM_SID *queried_dom_sid;
+ POLICY_HND connect_hnd;
+
+ /* trusted domains listing variables */
+ unsigned int num_domains, enum_ctx = 0;
+ int i;
+ DOM_SID *domain_sids;
+ char **trusted_dom_names;
+ fstring pdc_name;
+ char *dummy;
+
+ /*
+ * Listing trusted domains (stored in secrets.tdb, if local)
+ */
+
+ mem_ctx = talloc_init("trust relationships vampire");
+
+ /*
+ * set domain and pdc name to local samba server (default)
+ * or to remote one given in command line
+ */
+
+ if (StrCaseCmp(opt_workgroup, lp_workgroup())) {
+ domain_name = opt_workgroup;
+ opt_target_workgroup = opt_workgroup;
+ } else {
+ fstrcpy(pdc_name, global_myname());
+ domain_name = talloc_strdup(mem_ctx, lp_workgroup());
+ opt_target_workgroup = domain_name;
+ };
+
+ /* open \PIPE\lsarpc and open policy handle */
+ if (!(cli = net_make_ipc_connection(NET_FLAGS_PDC))) {
+ DEBUG(0, ("Couldn't connect to domain controller\n"));
+ return -1;
+ };
+
+ if (!cli_nt_session_open(cli, PI_LSARPC)) {
+ DEBUG(0, ("Could not initialise lsa pipe\n"));
+ return -1;
+ };
+
+ nt_status = cli_lsa_open_policy2(cli, mem_ctx, False, SEC_RIGHTS_QUERY_VALUE,
+ &connect_hnd);
+ if (NT_STATUS_IS_ERR(nt_status)) {
+ DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
+ nt_errstr(nt_status)));
+ return -1;
+ };
+
+ /* query info level 5 to obtain sid of a domain being queried */
+ nt_status = cli_lsa_query_info_policy(
+ cli, mem_ctx, &connect_hnd, 5 /* info level */,
+ &dummy, &queried_dom_sid);
+
+ if (NT_STATUS_IS_ERR(nt_status)) {
+ DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
+ nt_errstr(nt_status)));
+ return -1;
+ }
+
+ /*
+ * Keep calling LsaEnumTrustdom over opened pipe until
+ * the end of enumeration is reached
+ */
+
+ d_printf("Vampire trusted domains:\n\n");
+
+ do {
+ nt_status = cli_lsa_enum_trust_dom(cli, mem_ctx, &connect_hnd, &enum_ctx,
+ &num_domains,
+ &trusted_dom_names, &domain_sids);
+
+ if (NT_STATUS_IS_ERR(nt_status)) {
+ DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
+ nt_errstr(nt_status)));
+ return -1;
+ };
+
+ for (i = 0; i < num_domains; i++) {
+
+ print_trusted_domain(&(domain_sids[i]), trusted_dom_names[i]);
+
+ nt_status = vampire_trusted_domain(cli, mem_ctx, &connect_hnd,
+ domain_sids[i], trusted_dom_names[i]);
+ if (!NT_STATUS_IS_OK(nt_status))
+ return -1;
+ };
+
+ /*
+ * in case of no trusted domains say something rather
+ * than just display blank line
+ */
+ if (!num_domains) d_printf("none\n");
+
+ } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
+
+ /* close this connection before doing next one */
+ nt_status = cli_lsa_close(cli, mem_ctx, &connect_hnd);
+ if (NT_STATUS_IS_ERR(nt_status)) {
+ DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
+ nt_errstr(nt_status)));
+ return -1;
+ };
+
+ /* close lsarpc pipe and connection to IPC$ */
+ cli_nt_session_close(cli);
+ cli_shutdown(cli);
+
+ talloc_destroy(mem_ctx);
+ return 0;
+}
static int rpc_trustdom_list(int argc, const char **argv)
{
NTSTATUS nt_status;
const char *domain_name = NULL;
DOM_SID *queried_dom_sid;
- fstring ascii_sid, padding;
+ fstring padding;
int ascii_dom_name_len;
POLICY_HND connect_hnd;
};
for (i = 0; i < num_domains; i++) {
- /* convert sid into ascii string */
- sid_to_string(ascii_sid, &(domain_sids[i]));
-
- /* calculate padding space for d_printf to look nicer */
- pad_len = col_len - strlen(trusted_dom_names[i]);
- padding[pad_len] = 0;
- do padding[--pad_len] = ' '; while (pad_len);
-
- d_printf("%s%s%s\n", trusted_dom_names[i], padding, ascii_sid);
+ print_trusted_domain(&(domain_sids[i]), trusted_dom_names[i]);
};
/*
{"revoke", rpc_trustdom_revoke},
{"help", rpc_trustdom_usage},
{"list", rpc_trustdom_list},
+ {"vampire", rpc_trustdom_vampire},
{NULL, NULL}
};
{
d_printf(" net rpc info \t\t\tshow basic info about a domain \n");
d_printf(" net rpc join \t\t\tto join a domain \n");
- d_printf(" net rpc oldjoin \t\t\tto join a domain created in server manager\n\n\n");
+ d_printf(" net rpc oldjoin \t\t\tto join a domain created in server manager\n");
d_printf(" net rpc testjoin \t\ttests that a join is valid\n");
d_printf(" net rpc user \t\t\tto add, delete and list users\n");
d_printf(" net rpc password <username> [<password>] -Uadmin_username%%admin_pass\n");
d_printf(" net rpc abortshutdown \tto abort the shutdown of a remote server\n");
d_printf(" net rpc shutdown \t\tto shutdown a remote server\n");
d_printf(" net rpc rights\t\tto manage privileges assigned to SIDs\n");
+ d_printf(" net rpc registry\t\tto manage registry hives\n");
d_printf("\n");
d_printf("'net rpc shutdown' also accepts the following miscellaneous options:\n"); /* misc options */
d_printf("\t-r or --reboot\trequest remote server reboot on shutdown\n");
{"vampire", rpc_vampire},
{"getsid", net_rpc_getsid},
{"rights", net_rpc_rights},
+ {"service", net_rpc_service},
+ {"registry", net_rpc_registry},
{"help", net_rpc_help},
{NULL, NULL}
};
git.samba.org / metze / old / v3-2-winbind-ndr.git / blobdiff