#include "includes.h"
#include "utils/net.h"
+#include "../libcli/auth/libcli_auth.h"
+#include "../librpc/gen_ndr/cli_lsa.h"
+#include "rpc_client/cli_lsarpc.h"
+#include "../librpc/gen_ndr/cli_samr.h"
+#include "rpc_client/init_samr.h"
+#include "../librpc/gen_ndr/ndr_netlogon.h"
+#include "rpc_client/cli_netlogon.h"
/* Macro for checking RPC error codes to make things more readable */
}
ntret = cli_rpc_pipe_open_schannel_with_key(
- cli, &ndr_table_netlogon.syntax_id, PIPE_AUTH_LEVEL_PRIVACY,
- domain, netlogon_pipe->dc, &pipe_hnd);
+ cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
+ DCERPC_AUTH_LEVEL_PRIVACY,
+ domain, &netlogon_pipe->dc, &pipe_hnd);
if (!NT_STATUS_IS_OK(ntret)) {
DEBUG(0,("net_rpc_join_ok: failed to open schannel session "
TALLOC_CTX *mem_ctx;
uint32 acb_info = ACB_WSTRUST;
uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
- uint32 sec_channel_type;
+ enum netr_SchannelType sec_channel_type;
struct rpc_pipe_client *pipe_hnd = NULL;
/* rpc variables */
- POLICY_HND lsa_pol, sam_pol, domain_pol, user_pol;
- DOM_SID *domain_sid;
+ struct policy_handle lsa_pol, sam_pol, domain_pol, user_pol;
+ struct dom_sid *domain_sid;
uint32 user_rid;
/* Password stuff */
char *clear_trust_password = NULL;
- uchar pwbuf[516];
+ struct samr_CryptPassword crypt_pwd;
uchar md4_trust_password[16];
union samr_UserInfo set_info;
acb_info = ACB_DOMTRUST;
break;
#endif
+ default:
+ DEBUG(0,("secure channel type %d not yet supported\n",
+ sec_channel_type));
+ break;
}
/* Make authenticated connection to remote machine */
CHECK_RPC_ERR(rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
- SEC_RIGHTS_MAXIMUM_ALLOWED,
+ SEC_FLAG_MAXIMUM_ALLOWED,
&lsa_pol),
"error opening lsa policy handle");
CHECK_RPC_ERR(rpccli_samr_Connect2(pipe_hnd, mem_ctx,
pipe_hnd->desthost,
- SEC_RIGHTS_MAXIMUM_ALLOWED,
+ SAMR_ACCESS_ENUM_DOMAINS
+ | SAMR_ACCESS_LOOKUP_DOMAIN,
&sam_pol),
"could not connect to SAM database");
CHECK_RPC_ERR(rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
&sam_pol,
- SEC_RIGHTS_MAXIMUM_ALLOWED,
+ SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
+ | SAMR_DOMAIN_ACCESS_CREATE_USER
+ | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
domain_sid,
&domain_pol),
"could not open domain");
&access_granted,
&user_rid);
- if (!NT_STATUS_IS_OK(result) &&
+ if (!NT_STATUS_IS_OK(result) &&
!NT_STATUS_EQUAL(result, NT_STATUS_USER_EXISTS)) {
- d_fprintf(stderr, "Creation of workstation account failed\n");
+ d_fprintf(stderr,_("Creation of workstation account failed\n"));
/* If NT_STATUS_ACCESS_DENIED then we have a valid
username/password combo but the user does not have
administrator access. */
if (NT_STATUS_V(result) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED))
- d_fprintf(stderr, "User specified does not have administrator privileges\n");
+ d_fprintf(stderr, _("User specified does not have "
+ "administrator privileges\n"));
goto done;
}
CHECK_RPC_ERR_DEBUG(
rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
&domain_pol,
- SEC_RIGHTS_MAXIMUM_ALLOWED,
+ SEC_FLAG_MAXIMUM_ALLOWED,
user_rid,
&user_pol),
("could not re-open existing user %s: %s\n",
/* Create a random machine account password */
- {
- char *str;
- str = generate_random_str(DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
- clear_trust_password = SMB_STRDUP(str);
- E_md4hash(clear_trust_password, md4_trust_password);
- }
-
- encode_pw_buffer(pwbuf, clear_trust_password, STR_UNICODE);
+ clear_trust_password = generate_random_str(talloc_tos(), DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
+ E_md4hash(clear_trust_password, md4_trust_password);
/* Set password on machine account */
- init_samr_user_info24(&set_info.info24, pwbuf, 24);
+ init_samr_CryptPassword(clear_trust_password,
+ &cli->user_session_key,
+ &crypt_pwd);
- SamOEMhashBlob(set_info.info24.password.data, 516,
- &cli->user_session_key);
+ set_info.info24.password = crypt_pwd;
+ set_info.info24.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
CHECK_RPC_ERR(rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,
&user_pol,
if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) &&
(sec_channel_type == SEC_CHAN_BDC) ) {
- d_fprintf(stderr, "Please make sure that no computer account\n"
- "named like this machine (%s) exists in the domain\n",
+ d_fprintf(stderr, _("Please make sure that no computer "
+ "account\nnamed like this machine "
+ "(%s) exists in the domain\n"),
global_myname());
}
struct rpc_pipe_client *netlogon_schannel_pipe;
result = cli_rpc_pipe_open_schannel_with_key(
- cli, &ndr_table_netlogon.syntax_id,
- PIPE_AUTH_LEVEL_PRIVACY, domain, pipe_hnd->dc,
+ cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
+ DCERPC_AUTH_LEVEL_PRIVACY, domain, &pipe_hnd->dc,
&netlogon_schannel_pipe);
if (!NT_STATUS_IS_OK(result)) {
if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) &&
(sec_channel_type == SEC_CHAN_BDC) ) {
- d_fprintf(stderr, "Please make sure that no computer account\n"
- "named like this machine (%s) exists in the domain\n",
+ d_fprintf(stderr, _("Please make sure that no "
+ "computer account\nnamed "
+ "like this machine (%s) "
+ "exists in the domain\n"),
global_myname());
}
if (domain) {
if (retval != 0) {
- fprintf(stderr,"Unable to join domain %s.\n",domain);
+ fprintf(stderr,_("Unable to join domain %s.\n"),domain);
} else {
- printf("Joined domain %s.\n",domain);
+ printf(_("Joined domain %s.\n"),domain);
}
}
cli_shutdown(cli);
- SAFE_FREE(clear_trust_password);
+ TALLOC_FREE(clear_trust_password);
return retval;
}
**/
int net_rpc_testjoin(struct net_context *c, int argc, const char **argv)
{
- char *domain = smb_xstrdup(c->opt_target_workgroup);
NTSTATUS nt_status;
if (c->display_usage) {
- d_printf("Usage\n"
- "net rpc testjoin\n"
- " Test if a join is OK\n");
+ d_printf(_("Usage\n"
+ "net rpc testjoin\n"
+ " Test if a join is OK\n"));
return 0;
}
/* Display success or failure */
- nt_status = net_rpc_join_ok(c, domain, NULL, NULL);
+ nt_status = net_rpc_join_ok(c, c->opt_target_workgroup, NULL, NULL);
if (!NT_STATUS_IS_OK(nt_status)) {
- fprintf(stderr,"Join to domain '%s' is not valid: %s\n",
- domain, nt_errstr(nt_status));
- free(domain);
+ fprintf(stderr, _("Join to domain '%s' is not valid: %s\n"),
+ c->opt_target_workgroup, nt_errstr(nt_status));
return -1;
}
- printf("Join to '%s' is OK\n",domain);
- free(domain);
+ printf(_("Join to '%s' is OK\n"), c->opt_target_workgroup);
return 0;
}
git.samba.org / samba.git / blobdiff