3 # backend code for upgrading from Samba3
4 # Copyright Jelmer Vernooij 2005-2007
5 # Released under the GNU GPL v3 or later
8 """Support code for upgrading from Samba 3 to Samba 4."""
10 from provision import findnss, provision, FILL_DRS
17 from samba.samdb import SamDB
19 def import_sam_policy(samldb, samba3_policy, domaindn):
20 samldb.modify_ldif("""
29 samba3ResetCountMinutes: %d
30 samba3UserMustLogonToChangePassword: %d
31 samba3BadLockoutMinutes: %d
32 samba3DisconnectTime: %d
34 """ % (dn, policy.min_password_length,
35 policy.password_history, policy.minimum_password_age,
36 policy.maximum_password_age, policy.lockout_duration,
37 policy.reset_count_minutes, policy.user_must_logon_to_change_password,
38 policy.bad_lockout_minutes, policy.disconnect_time))
41 def import_sam_account(samldb,acc,domaindn,domainsid):
42 """Import a Samba 3 SAM account.
44 :param samldb: Samba 4 SAM Database handle
45 :param acc: Samba 3 account
46 :param domaindn: Domain DN
47 :param domainsid: Domain SID."""
48 if acc.nt_username is None or acc.nt_username == "":
49 acc.nt_username = acc.username
51 if acc.fullname is None:
53 acc.fullname = pwd.getpwnam(acc.username)[4].split(",")[0]
57 if acc.fullname is None:
58 acc.fullname = acc.username
60 assert acc.fullname is not None
61 assert acc.nt_username is not None
64 "dn": "cn=%s,%s" % (acc.fullname, domaindn),
65 "objectClass": ["top", "user"],
66 "lastLogon": str(acc.logon_time),
67 "lastLogoff": str(acc.logoff_time),
68 "unixName": acc.username,
69 "sAMAccountName": acc.nt_username,
70 "cn": acc.nt_username,
71 "description": acc.acct_desc,
72 "primaryGroupID": str(acc.group_rid),
73 "badPwdcount": str(acc.bad_password_count),
74 "logonCount": str(acc.logon_count),
75 "samba3Domain": acc.domain,
76 "samba3DirDrive": acc.dir_drive,
77 "samba3MungedDial": acc.munged_dial,
78 "samba3Homedir": acc.homedir,
79 "samba3LogonScript": acc.logon_script,
80 "samba3ProfilePath": acc.profile_path,
81 "samba3Workstations": acc.workstations,
82 "samba3KickOffTime": str(acc.kickoff_time),
83 "samba3BadPwdTime": str(acc.bad_password_time),
84 "samba3PassLastSetTime": str(acc.pass_last_set_time),
85 "samba3PassCanChangeTime": str(acc.pass_can_change_time),
86 "samba3PassMustChangeTime": str(acc.pass_must_change_time),
87 "objectSid": "%s-%d" % (domainsid, acc.user_rid),
88 "lmPwdHash:": acc.lm_password,
89 "ntPwdHash:": acc.nt_password,
93 def import_sam_group(samldb, sid, gid, sid_name_use, nt_name, comment, domaindn):
94 """Upgrade a SAM group.
96 :param samldb: SAM database.
98 :param sid_name_use: SID name use
99 :param nt_name: NT Group Name
100 :param comment: NT Group Comment
101 :param domaindn: Domain DN
104 if sid_name_use == 5: # Well-known group
107 if nt_name in ("Domain Guests", "Domain Users", "Domain Admins"):
111 gr = grp.getgrnam(nt_name)
113 gr = grp.getgrgid(gid)
118 unixname = gr.gr_name
120 assert unixname is not None
123 "dn": "cn=%s,%s" % (nt_name, domaindn),
124 "objectClass": ["top", "group"],
125 "description": comment,
128 "unixName": unixname,
129 "samba3SidNameUse": str(sid_name_use)
133 def import_idmap(samdb,samba3_idmap,domaindn):
134 """Import idmap data.
136 :param samdb: SamDB handle.
137 :param samba3_idmap: Samba 3 IDMAP database to import from
138 :param domaindn: Domain DN.
142 "userHwm": str(samba3_idmap.get_user_hwm()),
143 "groupHwm": str(samba3_idmap.get_group_hwm())})
145 for uid in samba3_idmap.uids():
146 samdb.add({"dn": "SID=%s,%s" % (samba3_idmap.get_user_sid(uid), domaindn),
147 "SID": samba3_idmap.get_user_sid(uid),
151 for gid in samba3_idmap.uids():
152 samdb.add({"dn": "SID=%s,%s" % (samba3_idmap.get_group_sid(gid), domaindn),
153 "SID": samba3_idmap.get_group_sid(gid),
158 def import_wins(samba4_winsdb, samba3_winsdb):
159 """Import settings from a Samba3 WINS database.
161 :param samba4_winsdb: WINS database to import to
162 :param samba3_winsdb: WINS database to import from
167 for (name, (ttl, ips, nb_flags)) in samba3_winsdb.items():
170 type = int(name.split("#", 1)[1], 16)
185 if ttl > time.time():
186 rState = 0x0 # active
188 rState = 0x1 # released
190 nType = ((nb_flags & 0x60)>>5)
192 samba4_winsdb.add({"dn": "name=%s,type=0x%s" % tuple(name.split("#")),
193 "type": name.split("#")[1],
194 "name": name.split("#")[0],
195 "objectClass": "winsRecord",
196 "recordType": str(rType),
197 "recordState": str(rState),
198 "nodeType": str(nType),
199 "expireTime": ldb.timestring(ttl),
201 "versionID": str(version_id),
204 samba4_winsdb.add({"dn": "CN=VERSION",
205 "objectClass": "winsMaxVersion",
206 "maxVersion": str(version_id)})
208 def upgrade_provision(samba3, setup_dir, message, credentials, session_info, lp, paths):
209 oldconf = samba3.get_conf()
211 if oldconf.get("domain logons") == "True":
212 serverrole = "domain controller"
214 if oldconf.get("security") == "user":
215 serverrole = "standalone"
217 serverrole = "member server"
219 lp.set("server role", serverrole)
220 domainname = oldconf.get("workgroup")
222 domainname = str(domainname)
223 lp.set("workgroup", domainname)
224 realm = oldconf.get("realm")
225 netbiosname = oldconf.get("netbios name")
227 secrets_db = samba3.get_secrets_db()
229 if domainname is None:
230 domainname = secrets_db.domains()[0]
231 message("No domain specified in smb.conf file, assuming '%s'" % domainname)
234 realm = domainname.lower()
235 message("No realm specified in smb.conf file, assuming '%s'\n" % realm)
236 lp.set("realm", realm)
238 domainguid = secrets_db.get_domain_guid(domainname)
239 domainsid = secrets_db.get_sid(domainname)
240 if domainsid is None:
241 message("Can't find domain secrets for '%s'; using random SID\n" % domainname)
243 if netbiosname is not None:
244 machinepass = secrets_db.get_machine_password(netbiosname)
248 domaindn = provision(lp=lp, setup_dir=setup_dir, message=message,
249 samdb_fill=FILL_DRS, paths=paths, session_info=session_info,
250 credentials=credentials, realm=realm,
251 domain=domainname, domainsid=domainsid, domainguid=domainguid,
252 machinepass=machinepass, serverrole=serverrole)
254 samdb = SamDB(paths.samdb, credentials=credentials, lp=lp, session_info=session_info)
256 import_wins(Ldb(paths.winsdb), samba3.get_wins_db())
258 # FIXME: import_registry(registry.Registry(), samba3.get_registry())
260 # FIXME: import_idmap(samdb,samba3.get_idmap_db(),domaindn)
262 groupdb = samba3.get_groupmapping_db()
263 for sid in groupdb.groupsids():
264 (gid, sid_name_use, nt_name, comment) = groupdb.get_group(sid)
265 # FIXME: import_sam_group(samdb, sid, gid, sid_name_use, nt_name, comment, domaindn)
269 passdb = samba3.get_sam_db()
272 #FIXME: import_sam_account(samdb, user, domaindn, domainsid)
274 if hasattr(passdb, 'ldap_url'):
275 message("Enabling Samba3 LDAP mappings for SAM database")
277 enable_samba3sam(samdb, passdb.ldap_url)
280 def enable_samba3sam(samdb, ldapurl):
281 """Enable Samba 3 LDAP URL database.
283 :param samdb: SAM Database.
284 :param ldapurl: Samba 3 LDAP URL
286 samdb.modify_ldif("""
290 @LIST: samldb,operational,objectguid,rdn_name,samba3sam
293 samdb.add({"dn": "@MAP=samba3sam", "@MAP_URL": ldapurl})
310 "bind interfaces only",
315 "obey pam restrictions",
323 "client NTLMv2 auth",
324 "client lanman auth",
325 "client plaintext auth",
345 "name resolve order",
354 "paranoid server security",
390 def upgrade_smbconf(oldconf,mark):
391 """Remove configuration variables not present in Samba4
393 :param oldconf: Old configuration structure
394 :param mark: Whether removed configuration variables should be
395 kept in the new configuration as "samba3:<name>"
397 data = oldconf.data()
398 newconf = param_init()
403 for k in smbconf_keep:
404 if smbconf_keep[k] == p:
409 newconf.set(s, p, oldconf.get(s, p))
411 newconf.set(s, "samba3:"+p, oldconf.get(s,p))
415 SAMBA3_PREDEF_NAMES = {
416 'HKLM': registry.HKEY_LOCAL_MACHINE,
419 def import_registry(samba4_registry, samba3_regdb):
420 """Import a Samba 3 registry database into the Samba 4 registry.
422 :param samba4_registry: Samba 4 registry handle.
423 :param samba3_regdb: Samba 3 registry database handle.
425 def ensure_key_exists(keypath):
426 (predef_name, keypath) = keypath.split("/", 1)
427 predef_id = SAMBA3_PREDEF_NAMES[predef_name]
428 keypath = keypath.replace("/", "\\")
429 return samba4_registry.create_key(predef_id, keypath)
431 for key in samba3_regdb.keys():
432 key_handle = ensure_key_exists(key)
433 for subkey in samba3_regdb.subkeys(key):
434 ensure_key_exists(subkey)
435 for (value_name, (value_type, value_data)) in samba3_regdb.values(key).items():
436 key_handle.set_value(value_name, value_type, value_data)