2 Unix SMB/CIFS implementation.
3 dump the remote SAM using rpc samsync operations
5 Copyright (C) Andrew Tridgell 2002
6 Copyright (C) Tim Potter 2001,2002
7 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2005
8 Modified by Volker Lendecke 2002
9 Copyright (C) Jeremy Allison 2005.
10 Copyright (C) Guenther Deschner 2008.
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #include "utils/net.h"
28 #include "../librpc/gen_ndr/ndr_netlogon.h"
29 #include "../librpc/gen_ndr/ndr_drsuapi.h"
31 static void parse_samsync_partial_replication_objects(TALLOC_CTX *mem_ctx,
34 bool *do_single_object_replication,
35 struct samsync_object **objects,
36 uint32_t *num_objects)
41 *do_single_object_replication = true;
44 for (i=0; i<argc; i++) {
46 struct samsync_object o;
50 if (!StrnCaseCmp(argv[i], "user_rid=", strlen("user_rid="))) {
51 o.object_identifier.rid = get_int_param(argv[i]);
52 o.object_type = NETR_DELTA_USER;
53 o.database_id = SAM_DATABASE_DOMAIN;
55 if (!StrnCaseCmp(argv[i], "group_rid=", strlen("group_rid="))) {
56 o.object_identifier.rid = get_int_param(argv[i]);
57 o.object_type = NETR_DELTA_GROUP;
58 o.database_id = SAM_DATABASE_DOMAIN;
60 if (!StrnCaseCmp(argv[i], "group_member_rid=", strlen("group_member_rid="))) {
61 o.object_identifier.rid = get_int_param(argv[i]);
62 o.object_type = NETR_DELTA_GROUP_MEMBER;
63 o.database_id = SAM_DATABASE_DOMAIN;
65 if (!StrnCaseCmp(argv[i], "alias_rid=", strlen("alias_rid="))) {
66 o.object_identifier.rid = get_int_param(argv[i]);
67 o.object_type = NETR_DELTA_ALIAS;
68 o.database_id = SAM_DATABASE_BUILTIN;
70 if (!StrnCaseCmp(argv[i], "alias_member_rid=", strlen("alias_member_rid="))) {
71 o.object_identifier.rid = get_int_param(argv[i]);
72 o.object_type = NETR_DELTA_ALIAS_MEMBER;
73 o.database_id = SAM_DATABASE_BUILTIN;
75 if (!StrnCaseCmp(argv[i], "account_sid=", strlen("account_sid="))) {
76 const char *sid_str = get_string_param(argv[i]);
77 string_to_sid(&o.object_identifier.sid, sid_str);
78 o.object_type = NETR_DELTA_ACCOUNT;
79 o.database_id = SAM_DATABASE_PRIVS;
81 if (!StrnCaseCmp(argv[i], "policy_sid=", strlen("policy_sid="))) {
82 const char *sid_str = get_string_param(argv[i]);
83 string_to_sid(&o.object_identifier.sid, sid_str);
84 o.object_type = NETR_DELTA_POLICY;
85 o.database_id = SAM_DATABASE_PRIVS;
87 if (!StrnCaseCmp(argv[i], "trustdom_sid=", strlen("trustdom_sid="))) {
88 const char *sid_str = get_string_param(argv[i]);
89 string_to_sid(&o.object_identifier.sid, sid_str);
90 o.object_type = NETR_DELTA_TRUSTED_DOMAIN;
91 o.database_id = SAM_DATABASE_PRIVS;
93 if (!StrnCaseCmp(argv[i], "secret_name=", strlen("secret_name="))) {
94 o.object_identifier.name = get_string_param(argv[i]);
95 o.object_type = NETR_DELTA_SECRET;
96 o.database_id = SAM_DATABASE_PRIVS;
99 if (o.object_type > 0) {
100 ADD_TO_ARRAY(mem_ctx, struct samsync_object, o,
101 objects, num_objects);
106 /* dump sam database via samsync rpc calls */
107 NTSTATUS rpc_samdump_internals(struct net_context *c,
108 const DOM_SID *domain_sid,
109 const char *domain_name,
110 struct cli_state *cli,
111 struct rpc_pipe_client *pipe_hnd,
116 struct samsync_context *ctx = NULL;
119 status = libnet_samsync_init_context(mem_ctx,
122 if (!NT_STATUS_IS_OK(status)) {
126 ctx->mode = NET_SAMSYNC_MODE_DUMP;
128 ctx->ops = &libnet_samsync_display_ops;
129 ctx->domain_name = domain_name;
131 ctx->force_full_replication = c->opt_force_full_repl ? true : false;
132 ctx->clean_old_entries = c->opt_clean_old_entries ? true : false;
134 parse_samsync_partial_replication_objects(ctx, argc, argv,
135 &ctx->single_object_replication,
139 libnet_samsync(SAM_DATABASE_DOMAIN, ctx);
141 libnet_samsync(SAM_DATABASE_BUILTIN, ctx);
143 libnet_samsync(SAM_DATABASE_PRIVS, ctx);
151 * Basic usage function for 'net rpc vampire'
153 * @param c A net_context structure
154 * @param argc Standard main() style argc
155 * @param argc Standard main() style argv. Initial components are already
159 int rpc_vampire_usage(struct net_context *c, int argc, const char **argv)
161 d_printf(_("net rpc vampire ([ldif [<ldif-filename>] | [keytab] "
162 "[<keytab-filename]) [options]\n"
163 "\t to pull accounts from a remote PDC where we are a BDC\n"
164 "\t\t no args puts accounts in local passdb from smb.conf\n"
165 "\t\t ldif - put accounts in ldif format (file defaults to "
167 "\t\t keytab - put account passwords in krb5 keytab "
168 "(defaults to system keytab)\n"));
170 net_common_flags_usage(c, argc, argv);
175 /* dump sam database via samsync rpc calls */
176 NTSTATUS rpc_vampire_internals(struct net_context *c,
177 const DOM_SID *domain_sid,
178 const char *domain_name,
179 struct cli_state *cli,
180 struct rpc_pipe_client *pipe_hnd,
186 struct samsync_context *ctx = NULL;
188 if (!sid_equal(domain_sid, get_global_sam_sid())) {
189 d_printf(_("Cannot import users from %s at this time, "
190 "as the current domain:\n\t%s: %s\nconflicts "
191 "with the remote domain\n\t%s: %s\n"
192 "Perhaps you need to set: \n\n\tsecurity=user\n\t"
193 "workgroup=%s\n\n in your smb.conf?\n"),
195 get_global_sam_name(),
196 sid_string_dbg(get_global_sam_sid()),
198 sid_string_dbg(domain_sid),
200 return NT_STATUS_UNSUCCESSFUL;
203 result = libnet_samsync_init_context(mem_ctx,
206 if (!NT_STATUS_IS_OK(result)) {
210 ctx->mode = NET_SAMSYNC_MODE_FETCH_PASSDB;
212 ctx->ops = &libnet_samsync_passdb_ops;
213 ctx->domain_name = domain_name;
215 ctx->force_full_replication = c->opt_force_full_repl ? true : false;
216 ctx->clean_old_entries = c->opt_clean_old_entries ? true : false;
218 parse_samsync_partial_replication_objects(ctx, argc, argv,
219 &ctx->single_object_replication,
224 result = libnet_samsync(SAM_DATABASE_DOMAIN, ctx);
226 if (!NT_STATUS_IS_OK(result) && ctx->error_message) {
227 d_fprintf(stderr, "%s\n", ctx->error_message);
231 if (ctx->result_message) {
232 d_fprintf(stdout, "%s\n", ctx->result_message);
236 ctx->domain_sid = sid_dup_talloc(mem_ctx, &global_sid_Builtin);
237 ctx->domain_sid_str = sid_string_talloc(mem_ctx, ctx->domain_sid);
238 result = libnet_samsync(SAM_DATABASE_BUILTIN, ctx);
240 if (!NT_STATUS_IS_OK(result) && ctx->error_message) {
241 d_fprintf(stderr, "%s\n", ctx->error_message);
245 if (ctx->result_message) {
246 d_fprintf(stdout, "%s\n", ctx->result_message);
254 int rpc_vampire_passdb(struct net_context *c, int argc, const char **argv)
256 if (c->display_usage) {
258 "net rpc vampire passdb\n"
261 _("Dump remote SAM database to passdb"));
265 return run_rpc_command(c, NULL, &ndr_table_netlogon.syntax_id, 0,
266 rpc_vampire_internals, argc, argv);
269 NTSTATUS rpc_vampire_ldif_internals(struct net_context *c,
270 const DOM_SID *domain_sid,
271 const char *domain_name,
272 struct cli_state *cli,
273 struct rpc_pipe_client *pipe_hnd,
279 struct samsync_context *ctx = NULL;
281 status = libnet_samsync_init_context(mem_ctx,
284 if (!NT_STATUS_IS_OK(status)) {
289 ctx->output_filename = argv[0];
292 parse_samsync_partial_replication_objects(ctx, argc-1, argv+1,
293 &ctx->single_object_replication,
298 ctx->mode = NET_SAMSYNC_MODE_FETCH_LDIF;
300 ctx->ops = &libnet_samsync_ldif_ops;
301 ctx->domain_name = domain_name;
303 ctx->force_full_replication = c->opt_force_full_repl ? true : false;
304 ctx->clean_old_entries = c->opt_clean_old_entries ? true : false;
307 status = libnet_samsync(SAM_DATABASE_DOMAIN, ctx);
309 if (!NT_STATUS_IS_OK(status) && ctx->error_message) {
310 d_fprintf(stderr, "%s\n", ctx->error_message);
314 if (ctx->result_message) {
315 d_fprintf(stdout, "%s\n", ctx->result_message);
319 ctx->domain_sid = sid_dup_talloc(mem_ctx, &global_sid_Builtin);
320 ctx->domain_sid_str = sid_string_talloc(mem_ctx, ctx->domain_sid);
321 status = libnet_samsync(SAM_DATABASE_BUILTIN, ctx);
323 if (!NT_STATUS_IS_OK(status) && ctx->error_message) {
324 d_fprintf(stderr, "%s\n", ctx->error_message);
328 if (ctx->result_message) {
329 d_fprintf(stdout, "%s\n", ctx->result_message);
337 int rpc_vampire_ldif(struct net_context *c, int argc, const char **argv)
339 if (c->display_usage) {
341 "net rpc vampire ldif\n"
344 _("Dump remote SAM database to LDIF file or "
349 return run_rpc_command(c, NULL, &ndr_table_netlogon.syntax_id, 0,
350 rpc_vampire_ldif_internals, argc, argv);
354 NTSTATUS rpc_vampire_keytab_internals(struct net_context *c,
355 const DOM_SID *domain_sid,
356 const char *domain_name,
357 struct cli_state *cli,
358 struct rpc_pipe_client *pipe_hnd,
364 struct samsync_context *ctx = NULL;
366 status = libnet_samsync_init_context(mem_ctx,
369 if (!NT_STATUS_IS_OK(status)) {
374 /* the caller should ensure that a filename is provided */
375 return NT_STATUS_INVALID_PARAMETER;
377 ctx->output_filename = argv[0];
380 parse_samsync_partial_replication_objects(ctx, argc-1, argv+1,
381 &ctx->single_object_replication,
386 ctx->mode = NET_SAMSYNC_MODE_FETCH_KEYTAB;
388 ctx->ops = &libnet_samsync_keytab_ops;
389 ctx->domain_name = domain_name;
390 ctx->username = c->opt_user_name;
391 ctx->password = c->opt_password;
393 ctx->force_full_replication = c->opt_force_full_repl ? true : false;
394 ctx->clean_old_entries = c->opt_clean_old_entries ? true : false;
397 status = libnet_samsync(SAM_DATABASE_DOMAIN, ctx);
399 if (!NT_STATUS_IS_OK(status) && ctx->error_message) {
400 d_fprintf(stderr, "%s\n", ctx->error_message);
404 if (ctx->result_message) {
405 d_fprintf(stdout, "%s\n", ctx->result_message);
414 static NTSTATUS rpc_vampire_keytab_ds_internals(struct net_context *c,
415 const DOM_SID *domain_sid,
416 const char *domain_name,
417 struct cli_state *cli,
418 struct rpc_pipe_client *pipe_hnd,
424 struct dssync_context *ctx = NULL;
426 status = libnet_dssync_init_context(mem_ctx,
428 if (!NT_STATUS_IS_OK(status)) {
432 ctx->force_full_replication = c->opt_force_full_repl ? true : false;
433 ctx->clean_old_entries = c->opt_clean_old_entries ? true : false;
436 /* the caller should ensure that a filename is provided */
437 return NT_STATUS_INVALID_PARAMETER;
439 ctx->output_filename = argv[0];
443 ctx->object_dns = &argv[1];
444 ctx->object_count = argc - 1;
445 ctx->single_object_replication = c->opt_single_obj_repl ? true
450 ctx->domain_name = domain_name;
451 ctx->ops = &libnet_dssync_keytab_ops;
453 status = libnet_dssync(mem_ctx, ctx);
454 if (!NT_STATUS_IS_OK(status) && ctx->error_message) {
455 d_fprintf(stderr, "%s\n", ctx->error_message);
459 if (ctx->result_message) {
460 d_fprintf(stdout, "%s\n", ctx->result_message);
470 * Basic function for 'net rpc vampire keytab'
472 * @param c A net_context structure
473 * @param argc Standard main() style argc
474 * @param argc Standard main() style argv. Initial components are already
478 int rpc_vampire_keytab(struct net_context *c, int argc, const char **argv)
482 struct cli_state *cli = NULL;
483 struct net_dc_info dc_info;
485 if (c->display_usage || (argc < 1)) {
488 _("net rpc vampire keytab <keytabfile>\n"
489 " Dump remote SAM database to Kerberos keytab "
494 status = net_make_ipc_connection(c, 0, &cli);
495 if (!NT_STATUS_IS_OK(status)) {
499 status = net_scan_dc(c, cli, &dc_info);
500 if (!NT_STATUS_IS_OK(status)) {
504 if (!dc_info.is_ad) {
505 printf(_("DC is not running Active Directory\n"));
506 ret = run_rpc_command(c, cli, &ndr_table_netlogon.syntax_id,
508 rpc_vampire_keytab_internals, argc, argv);
511 ret = run_rpc_command(c, cli, &ndr_table_drsuapi.syntax_id,
512 NET_FLAGS_SEAL | NET_FLAGS_TCP,
513 rpc_vampire_keytab_ds_internals, argc, argv);
514 if (ret != 0 && dc_info.is_mixed_mode) {
515 printf(_("Fallback to NT4 vampire on Mixed-Mode AD "
517 ret = run_rpc_command(c, cli, &ndr_table_netlogon.syntax_id,
519 rpc_vampire_keytab_internals, argc, argv);