s4/scripting/bin: py2/py3 compatability always decode result of b64encode

[nivanova/samba-autobuild/.git] / source4 / scripting / bin / samba_upgradedns

diff --git a/source4/scripting/bin/samba_upgradedns b/source4/scripting/bin/samba_upgradedns
index db3ef5c6d6545889adf47c5fd5b732950437088e..e29ba7092b57bc5a49684dba9bb4716e65bf9d34 100755 (executable)
--- a/source4/scripting/bin/samba_upgradedns
+++ b/source4/scripting/bin/samba_upgradedns
@@ -330,7 +330,7 @@ if __name__ == '__main__':
             zone = dns.zone.from_file(paths.dns, relativize=False)
             rrset = zone.get_rdataset("%s." % dnsdomain, dns.rdatatype.SOA)
             serial = int(rrset[0].serial)
-        except Exception, e:
+        except Exception as e:
             logger.warn("Error parsing DNS data from '%s' (%s)" % (paths.dns, str(e)))
             logger.warn("DNS records will be automatically created")
             autofill = True
@@ -442,6 +442,12 @@ if __name__ == '__main__':
 
     # Special stuff for DLZ backend
     if opts.dns_backend == "BIND9_DLZ":
+        config_migration = False
+
+        if (paths.private_dir != paths.binddns_dir and
+            os.path.isfile(os.path.join(paths.private_dir, "named.conf"))):
+            config_migration = True
+
         # Check if dns-HOSTNAME account exists and create it if required
         secrets_msgs = ldbs.secrets.search(expression='(samAccountName=dns-%s)' % hostname, attrs=['secret'])
         msg = ldbs.sam.search(base=domaindn, scope=ldb.SCOPE_DEFAULT,
@@ -463,7 +469,7 @@ if __name__ == '__main__':
             setup_add_ldif(ldbs.sam, setup_path("provision_dns_add_samba.ldif"), {
                     "DNSDOMAIN": dnsdomain,
                     "DOMAINDN": domaindn,
-                    "DNSPASS_B64": b64encode(dnspass.encode('utf-16-le')),
+                    "DNSPASS_B64": b64encode(dnspass.encode('utf-16-le')).decode('utf8'),
                     "HOSTNAME" : hostname,
                     "DNSNAME" : dnsname }
                            )
@@ -537,10 +543,33 @@ if __name__ == '__main__':
 
         cleanup_obsolete_dns_files(paths)
 
-        logger.info("See %s for an example configuration include file for BIND", paths.namedconf)
-        logger.info("and %s for further documentation required for secure DNS "
-                    "updates", paths.namedtxt)
+        if config_migration:
+            logger.info("ATTENTION: The BIND configuration and keytab has been moved to: %s",
+                        paths.binddns_dir)
+            logger.info("           Please update your BIND configuration accordingly.")
+        else:
+            logger.info("See %s for an example configuration include file for BIND", paths.namedconf)
+            logger.info("and %s for further documentation required for secure DNS "
+                        "updates", paths.namedtxt)
+
     elif opts.dns_backend == "SAMBA_INTERNAL":
+        # Make sure to remove everything from the bind-dns directory to avoid
+        # possible security issues with the named group having write access
+        # to all AD partions
+        cleanup_remove_file(os.path.join(paths.binddns_dir, "dns.keytab"))
+        cleanup_remove_file(os.path.join(paths.binddns_dir, "named.conf"))
+        cleanup_remove_file(os.path.join(paths.binddns_dir, "named.conf.update"))
+        cleanup_remove_file(os.path.join(paths.binddns_dir, "named.txt"))
+
+        cleanup_remove_dir(os.path.dirname(paths.dns))
+
+        try:
+            os.chmod(paths.private_dir, 0o700)
+            os.chown(paths.private_dir, -1, 0)
+        except:
+            logger.warn("Failed to restore owner and permissions for %s",
+                        (paths.private_dir))
+
         # Check if dns-HOSTNAME account exists and delete it if required
         try:
             dn_str = 'samAccountName=dns-%s,CN=Principals' % hostname