# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
# Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
+# Copyright (C) Oliver Liebel <oliver@itc.li> 2008-2009
#
# Based on the original in EJS:
# Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
from base64 import b64encode
import os
+import sys
import pwd
import grp
import time
-import uuid, misc
+import uuid, glue
import socket
import param
import registry
from samba import Ldb, substitute_var, valid_netbios_name, check_all_substituted
from samba.samdb import SamDB
from samba.idmap import IDmapDB
-import security
+from samba.dcerpc import security
import urllib
from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, \
- LDB_ERR_NO_SUCH_OBJECT, timestring, CHANGETYPE_MODIFY, CHANGETYPE_NONE
+ timestring, CHANGETYPE_MODIFY, CHANGETYPE_NONE
__docformat__ = "restructuredText"
+
+def find_setup_dir():
+ """Find the setup directory used by provision."""
+ dirname = os.path.dirname(__file__)
+ if "/site-packages/" in dirname:
+ prefix = "/".join(dirname[:dirname.index("/site-packages/")].split("/")[:-2])
+ for suffix in ["share/setup", "share/samba/setup", "setup"]:
+ ret = os.path.join(prefix, suffix)
+ if os.path.isdir(ret):
+ return ret
+ # In source tree
+ ret = os.path.join(dirname, "../../../setup")
+ if os.path.isdir(ret):
+ return ret
+ raise Exception("Unable to find setup directory.")
+
+
DEFAULTSITE = "Default-First-Site-Name"
class InvalidNetbiosName(Exception):
super(InvalidNetbiosName, self).__init__("The name '%r' is not a valid NetBIOS name" % name)
-class ProvisionPaths:
+class ProvisionPaths(object):
def __init__(self):
self.shareconf = None
self.hklm = None
self.memberofconf = None
self.fedoradsinf = None
self.fedoradspartitions = None
-
-class ProvisionNames:
+ self.olmmron = None
+ self.olmmrserveridsconf = None
+ self.olmmrsyncreplconf = None
+ self.olcdir = None
+ self.olslaptest = None
+ self.olcseedldif = None
+
+
+class ProvisionNames(object):
def __init__(self):
self.rootdn = None
self.domaindn = None
self.sitename = None
self.smbconf = None
-class ProvisionResult:
+
+class ProvisionResult(object):
def __init__(self):
self.paths = None
self.domaindn = None
findnss_gid = lambda names: findnss(grp.getgrnam, names)[2]
-def open_ldb(session_info, credentials, lp, dbname):
- """Open a LDB, thrashing it if it is corrupt.
-
- :param session_info: auth session information
- :param credentials: credentials
- :param lp: Loadparm context
- :param dbname: Path of the database to open.
- :return: a Ldb object
+def read_and_sub_file(file, subst_vars):
+ """Read a file and sub in variables found in it
+
+ :param file: File to be read (typically from setup directory)
+ param subst_vars: Optional variables to subsitute in the file.
"""
- assert session_info is not None
- try:
- return Ldb(dbname, session_info=session_info, credentials=credentials,
- lp=lp)
- except LdbError, e:
- print e
- os.unlink(dbname)
- return Ldb(dbname, session_info=session_info, credentials=credentials,
- lp=lp)
+ data = open(file, 'r').read()
+ if subst_vars is not None:
+ data = substitute_var(data, subst_vars)
+ check_all_substituted(data)
+ return data
def setup_add_ldif(ldb, ldif_path, subst_vars=None):
"""
assert isinstance(ldif_path, str)
- data = open(ldif_path, 'r').read()
- if subst_vars is not None:
- data = substitute_var(data, subst_vars)
-
- check_all_substituted(data)
-
+ data = read_and_sub_file(ldif_path, subst_vars)
ldb.add_ldif(data)
-def setup_modify_ldif(ldb, ldif_path, substvars=None):
+def setup_modify_ldif(ldb, ldif_path, subst_vars=None):
"""Modify a ldb in the private dir.
:param ldb: LDB object.
:param ldif_path: LDIF file path.
- :param substvars: Optional dictionary with substitution variables.
+ :param subst_vars: Optional dictionary with substitution variables.
"""
- data = open(ldif_path, 'r').read()
- if substvars is not None:
- data = substitute_var(data, substvars)
-
- check_all_substituted(data)
+ data = read_and_sub_file(ldif_path, subst_vars)
ldb.modify_ldif(data)
ldb.transaction_commit()
-def setup_file(template, fname, substvars):
+def setup_file(template, fname, subst_vars):
"""Setup a file in the private dir.
:param template: Path of the template file.
:param fname: Path of the file to create.
- :param substvars: Substitution variables.
+ :param subst_vars: Substitution variables.
"""
f = fname
if os.path.exists(f):
os.unlink(f)
- data = open(template, 'r').read()
- if substvars:
- data = substitute_var(data, substvars)
- check_all_substituted(data)
-
+ data = read_and_sub_file(template, subst_vars)
open(f, 'w').write(data)
paths.templates = os.path.join(paths.private_dir, "templates.ldb")
paths.dns = os.path.join(paths.private_dir, dnsdomain + ".zone")
paths.namedconf = os.path.join(paths.private_dir, "named.conf")
+ paths.namedtxt = os.path.join(paths.private_dir, "named.txt")
paths.krb5conf = os.path.join(paths.private_dir, "krb5.conf")
paths.winsdb = os.path.join(paths.private_dir, "wins.ldb")
paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
paths.memberofconf = os.path.join(paths.ldapdir,
"memberof.conf")
paths.fedoradsinf = os.path.join(paths.ldapdir,
- "fedorads.inf")
+ "fedorads.inf")
paths.fedoradspartitions = os.path.join(paths.ldapdir,
"fedorads-partitions.ldif")
+ paths.olmmrserveridsconf = os.path.join(paths.ldapdir,
+ "mmr_serverids.conf")
+ paths.olmmrsyncreplconf = os.path.join(paths.ldapdir,
+ "mmr_syncrepl.conf")
+ paths.olcdir = os.path.join(paths.ldapdir,
+ "slapd.d")
+ paths.olcseedldif = os.path.join(paths.ldapdir,
+ "olc_seed.ldif")
paths.hklm = "hklm.ldb"
paths.hkcr = "hkcr.ldb"
paths.hkcu = "hkcu.ldb"
paths.netlogon = lp.get("path", "netlogon")
- paths.smbconf = lp.configfile()
+ paths.smbconf = lp.configfile
return paths
if lp.get("realm").upper() != realm:
raise Exception("realm '%s' in %s must match chosen realm '%s'" %
- (lp.get("realm"), lp.configfile(), realm))
+ (lp.get("realm"), lp.configfile, realm))
dnsdomain = dnsdomain.lower()
names.hostname = hostname
names.sitename = sitename
names.serverdn = "CN=%s,CN=Servers,CN=%s,CN=Sites,%s" % (netbiosname, sitename, configdn)
-
+
return names
def make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole,
targetdir):
+ """Create a new smb.conf file based on a couple of basic settings.
+ """
+ assert smbconf is not None
if hostname is None:
hostname = socket.gethostname().split(".")[0].lower()
default_lp = param.LoadParm()
#Load non-existant file
- default_lp.load(smbconf)
+ if os.path.exists(smbconf):
+ default_lp.load(smbconf)
if targetdir is not None:
privatedir_line = "private dir = " + os.path.abspath(os.path.join(targetdir, "private"))
})
-
def setup_name_mappings(samdb, idmap, sid, domaindn, root_uid, nobody_uid,
users_gid, wheel_gid):
"""setup reasonable name mappings for sam names to unix names.
:param users_gid: gid of the UNIX users group.
:param wheel_gid: gid of the UNIX wheel group."""
# add some foreign sids if they are not present already
- samdb.add_foreign(domaindn, "S-1-5-7", "Anonymous")
- samdb.add_foreign(domaindn, "S-1-1-0", "World")
- samdb.add_foreign(domaindn, "S-1-5-2", "Network")
- samdb.add_foreign(domaindn, "S-1-5-18", "System")
- samdb.add_foreign(domaindn, "S-1-5-11", "Authenticated Users")
+ samdb.add_stock_foreign_sids()
idmap.setup_name_mapping("S-1-5-7", idmap.TYPE_UID, nobody_uid)
idmap.setup_name_mapping("S-1-5-32-544", idmap.TYPE_GID, wheel_gid)
"""
assert session_info is not None
- samdb = SamDB(samdb_path, session_info=session_info,
- credentials=credentials, lp=lp)
-
- # Wipes the database
try:
+ samdb = SamDB(samdb_path, session_info=session_info,
+ credentials=credentials, lp=lp)
+ # Wipes the database
samdb.erase()
- except:
+ except LdbError:
os.unlink(samdb_path)
-
- samdb = SamDB(samdb_path, session_info=session_info,
- credentials=credentials, lp=lp)
+ samdb = SamDB(samdb_path, session_info=session_info,
+ credentials=credentials, lp=lp)
+ # Wipes the database
+ samdb.erase()
+
#Add modules to the list to activate them by default
#beware often order is important
"ranged_results",
"anr",
"server_sort",
- "extended_dn",
"asq",
+ "extended_dn_store",
+ "extended_dn_in",
"rdn_name",
"objectclass",
"samldb",
"kludge_acl",
+ "password_hash",
"operational"]
tdb_modules_list = [
"subtree_rename",
"subtree_delete",
- "linked_attributes"]
+ "linked_attributes",
+ "extended_dn_out_ldb"]
modules_list2 = ["show_deleted",
"partition"]
if ldap_backend_type == "fedora-ds":
backend_modules = ["nsuniqueid", "paged_searches"]
# We can handle linked attributes here, as we don't have directory-side subtree operations
- tdb_modules_list = ["linked_attributes"]
+ tdb_modules_list = ["linked_attributes", "extended_dn_out_dereference"]
elif ldap_backend_type == "openldap":
- backend_modules = ["normalise", "entryuuid", "paged_searches"]
+ backend_modules = ["entryuuid", "paged_searches"]
# OpenLDAP handles subtree renames, so we don't want to do any of these things
- tdb_modules_list = None
+ tdb_modules_list = ["extended_dn_out_dereference"]
+ elif ldap_backend is not None:
+ raise "LDAP Backend specified, but LDAP Backend Type not specified"
elif serverrole == "domain controller":
backend_modules = ["repl_meta_data"]
else:
"DOMAINDN_LDB": domaindn_ldb,
"SCHEMADN_MOD": "schema_fsmo,instancetype",
"CONFIGDN_MOD": "naming_fsmo,instancetype",
- "DOMAINDN_MOD": "pdc_fsmo,password_hash,instancetype",
+ "DOMAINDN_MOD": "pdc_fsmo,instancetype",
"MODULES_LIST": ",".join(modules_list),
"TDB_MODULES_LIST": tdb_modules_list_as_string,
"MODULES_LIST2": ",".join(modules_list2),
secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
lp=lp)
secrets_ldb.load_ldif_file_add(setup_path("secrets.ldif"))
+
+ if credentials is not None and credentials.authentication_requested():
+ if credentials.get_bind_dn() is not None:
+ setup_add_ldif(secrets_ldb, setup_path("secrets_simple_ldap.ldif"), {
+ "LDAPMANAGERDN": credentials.get_bind_dn(),
+ "LDAPMANAGERPASS_B64": b64encode(credentials.get_password())
+ })
+ else:
+ setup_add_ldif(secrets_ldb, setup_path("secrets_sasl_ldap.ldif"), {
+ "LDAPADMINUSER": credentials.get_username(),
+ "LDAPADMINREALM": credentials.get_realm(),
+ "LDAPADMINPASS_B64": b64encode(credentials.get_password())
+ })
+
return secrets_ldb
"""
templates_ldb = SamDB(path, session_info=session_info,
credentials=credentials, lp=lp)
- templates_ldb.erase()
+ # Wipes the database
+ try:
+ templates_ldb.erase()
+ # This should be 'except LdbError', but on a re-provision the assert in ldb.erase fires, and we need to catch that too
+ except:
+ os.unlink(path)
+
+ templates_ldb.load_ldif_file_add(setup_path("provision_templates_init.ldif"))
+
+ templates_ldb = SamDB(path, session_info=session_info,
+ credentials=credentials, lp=lp)
+
templates_ldb.load_ldif_file_add(setup_path("provision_templates.ldif"))
reg = registry.Registry()
hive = registry.open_ldb(path, session_info=session_info,
credentials=credentials, lp_ctx=lp)
- reg.mount_hive(hive, "HKEY_LOCAL_MACHINE")
+ reg.mount_hive(hive, registry.HKEY_LOCAL_MACHINE)
provision_reg = setup_path("provision.reg")
assert os.path.exists(provision_reg)
reg.diff_apply(provision_reg)
samdb = SamDB(path, session_info=session_info,
credentials=credentials, lp=lp)
-
if fill == FILL_DRS:
- # We want to finish here, but setup the index before we do so
- message("Setting up sam.ldb index")
- samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
return samdb
message("Pre-loading the Samba 4 and AD schema")
- samdb.set_domain_sid(domainsid)
+ samdb.set_domain_sid(str(domainsid))
if serverrole == "domain controller":
samdb.set_invocation_id(invocationid)
load_schema(setup_path, samdb, names.schemadn, names.netbiosname,
- names.configdn, names.sitename)
+ names.configdn, names.sitename, names.serverdn,
+ names.hostname)
samdb.transaction_start()
domain_oc = "samba4LocalDomain"
setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
- "DOMAINDN": names.domaindn,
- "ACI": aci,
- "DOMAIN_OC": domain_oc
- })
+ "DOMAINDN": names.domaindn,
+ "ACI": aci,
+ "DOMAIN_OC": domain_oc
+ })
message("Modifying DomainDN: " + names.domaindn + "")
if domainguid is not None:
setup_add_ldif(samdb, setup_path("provision_configuration_basedn.ldif"), {
"CONFIGDN": names.configdn,
"ACI": aci,
- "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb",
})
message("Modifying configuration container")
setup_modify_ldif(samdb, setup_path("provision_configuration_basedn_modify.ldif"), {
setup_add_ldif(samdb, setup_path("provision_schema_basedn.ldif"), {
"SCHEMADN": names.schemadn,
"ACI": aci,
- "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb"
})
message("Modifying schema container")
message("Setting up sam.ldb AD schema")
setup_add_ldif(samdb, setup_path("schema.ldif"),
{"SCHEMADN": names.schemadn})
+ setup_add_ldif(samdb, setup_path("aggregate_schema.ldif"),
+ {"SCHEMADN": names.schemadn})
message("Setting up sam.ldb configuration data")
setup_add_ldif(samdb, setup_path("provision_configuration.ldif"), {
domainsid=domainsid, policyguid=policyguid,
setup_path=setup_path)
- #We want to setup the index last, as adds are faster unindexed
- message("Setting up sam.ldb index")
- samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
except:
samdb.transaction_cancel()
raise
if domainsid is None:
domainsid = security.random_sid()
- else:
- domainsid = security.Sid(domainsid)
if policyguid is None:
policyguid = str(uuid.uuid4())
if adminpass is None:
- adminpass = misc.random_password(12)
+ adminpass = glue.generate_random_str(12)
if krbtgtpass is None:
- krbtgtpass = misc.random_password(12)
+ krbtgtpass = glue.generate_random_str(12)
if machinepass is None:
- machinepass = misc.random_password(12)
+ machinepass = glue.generate_random_str(12)
if dnspass is None:
- dnspass = misc.random_password(12)
+ dnspass = glue.generate_random_str(12)
root_uid = findnss_uid([root or "root"])
nobody_uid = findnss_uid([nobody or "nobody"])
users_gid = findnss_gid([users or "users"])
if (not os.path.exists(os.path.join(targetdir, "etc"))):
os.makedirs(os.path.join(targetdir, "etc"))
smbconf = os.path.join(targetdir, "etc", "smb.conf")
+ elif smbconf is None:
+ smbconf = param.default_path()
# only install a new smb.conf if there isn't one there already
if not os.path.exists(smbconf):
paths = provision_paths_from_lp(lp, names.dnsdomain)
if hostip is None:
- hostip = socket.getaddrinfo(names.hostname, None, socket.AF_INET, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
+ try:
+ hostip = socket.getaddrinfo(names.hostname, None, socket.AF_INET, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
+ except socket.gaierror, (socket.EAI_NODATA, msg):
+ hostip = None
if hostip6 is None:
try:
hostip6 = socket.getaddrinfo(names.hostname, None, socket.AF_INET6, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
- except socket.gaierror:
- pass
+ except socket.gaierror, (socket.EAI_NODATA, msg):
+ hostip6 = None
if serverrole is None:
serverrole = lp.get("server role")
policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies",
"{" + policyguid + "}")
os.makedirs(policy_path, 0755)
+ open(os.path.join(policy_path, "GPT.INI"), 'w').write("")
os.makedirs(os.path.join(policy_path, "Machine"), 0755)
os.makedirs(os.path.join(policy_path, "User"), 0755)
if not os.path.isdir(paths.netlogon):
hostip6=hostip6, hostname=names.hostname,
dnspass=dnspass, realm=names.realm,
domainguid=domainguid, hostguid=hostguid)
- message("Please install the zone located in %s into your DNS server" % paths.dns)
create_named_conf(paths.namedconf, setup_path, realm=names.realm,
+ dnsdomain=names.dnsdomain, private_dir=paths.private_dir)
+
+ create_named_txt(paths.namedtxt, setup_path, realm=names.realm,
dnsdomain=names.dnsdomain, private_dir=paths.private_dir,
keytab_name=paths.dns_keytab)
- message("See %s for example configuration statements for secure GSS-TSIG updates" % paths.namedconf)
+ message("See %s for an example configuration include file for BIND" % paths.namedconf)
+ message("and %s for further documentation required for secure DNS updates" % paths.namedtxt)
create_krb5_conf(paths.krb5conf, setup_path, dnsdomain=names.dnsdomain,
hostname=names.hostname, realm=names.realm)
smbconf=None, targetdir=None, realm=None,
rootdn=None, domaindn=None, schemadn=None, configdn=None,
domain=None, hostname=None, adminpass=None, root=None, serverrole=None,
- ldap_backend_type=None, ldap_backend_port=None):
+ ldap_backend_type=None, ldap_backend_port=None,
+ ol_mmr_urls=None,ol_olc=None,ol_slaptest=None):
def setup_path(file):
return os.path.join(setup_dir, file)
if root is None:
root = findnss(pwd.getpwnam, ["root"])[0]
- if smbconf is None:
- etcdir = os.path.join(targetdir, "etc")
- os.makedirs(etcdir)
- smbconf = os.path.join(etcdir, "smb.conf")
+ if adminpass is None:
+ adminpass = glue.generate_random_str(12)
+
+ if targetdir is not None:
+ if (not os.path.exists(os.path.join(targetdir, "etc"))):
+ os.makedirs(os.path.join(targetdir, "etc"))
+ smbconf = os.path.join(targetdir, "etc", "smb.conf")
+ elif smbconf is None:
+ smbconf = param.default_path()
+ assert smbconf is not None
# only install a new smb.conf if there isn't one there already
if not os.path.exists(smbconf):
- make_smbconf(smbconf, setup_path, hostname, domain, realm,
- serverrole, targetdir)
+ make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole,
+ targetdir)
+
+ # openldap-online-configuration: validation of olc and slaptest
+ if ol_olc == "yes" and ol_slaptest is None:
+ sys.exit("Warning: OpenLDAP-Online-Configuration cant be setup without path to slaptest-Binary!")
+
+ if ol_olc == "yes" and ol_slaptest is not None:
+ ol_slaptest = ol_slaptest + "/slaptest"
+ if not os.path.exists(ol_slaptest):
+ message (ol_slaptest)
+ sys.exit("Warning: Given Path to slaptest-Binary does not exist!")
+ ###
+
+
lp = param.LoadParm()
lp.load(smbconf)
+ if serverrole is None:
+ serverrole = lp.get("server role")
+
names = guess_names(lp=lp, hostname=hostname, domain=domain,
dnsdomain=realm, serverrole=serverrole,
rootdn=rootdn, domaindn=domaindn, configdn=configdn,
paths = provision_paths_from_lp(lp, names.dnsdomain)
if not os.path.isdir(paths.ldapdir):
- os.makedirs(paths.ldapdir)
+ os.makedirs(paths.ldapdir, 0700)
schemadb_path = os.path.join(paths.ldapdir, "schema-tmp.ldb")
try:
os.unlink(schemadb_path)
- except:
+ except OSError:
pass
schemadb = Ldb(schemadb_path, lp=lp)
+ prefixmap = open(setup_path("prefixMap.txt"), 'r').read()
+
setup_add_ldif(schemadb, setup_path("provision_schema_basedn.ldif"),
{"SCHEMADN": names.schemadn,
"ACI": "#",
- "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb"
})
setup_modify_ldif(schemadb,
setup_path("provision_schema_basedn_modify.ldif"), \
"NETBIOSNAME": names.netbiosname,
"DEFAULTSITE": DEFAULTSITE,
"CONFIGDN": names.configdn,
- "SERVERDN": names.serverdn
+ "SERVERDN": names.serverdn,
+ "PREFIXMAP_B64": b64encode(prefixmap)
})
setup_add_ldif(schemadb, setup_path("schema_samba4.ldif"),
mapping = "schema-map-fedora-ds-1.0"
backend_schema = "99_ad.ldif"
- slapdcommand="Initailise Fedora DS with: setup-ds.pl --file=%s" % paths.fedoradsinf
+ slapdcommand="Initialise Fedora DS with: setup-ds.pl --file=%s" % paths.fedoradsinf
+ ldapuser = "--simple-bind-dn=" + names.ldapmanagerdn
+
elif ldap_backend_type == "openldap":
attrs = ["linkID", "lDAPDisplayName"]
- res = schemadb.search(expression="(&(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1)))(objectclass=attributeSchema))", base=names.schemadn, scope=SCOPE_SUBTREE, attrs=attrs)
+ res = schemadb.search(expression="(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1))(objectclass=attributeSchema)(attributeSyntax=2.5.5.1))", base=names.schemadn, scope=SCOPE_SUBTREE, attrs=attrs)
- memberof_config = "# Generated from schema in %s\n" % schemadb_path
- refint_attributes = ""
- for i in range (0, len(res)):
- expression = "(&(objectclass=attributeSchema)(linkID=%d))" % (int(res[i]["linkID"][0])+1)
+ memberof_config = "# Generated from schema in %s\n" % schemadb_path
+ refint_attributes = ""
+ for i in range (0, len(res)):
+ expression = "(&(objectclass=attributeSchema)(linkID=%d)(attributeSyntax=2.5.5.1))" % (int(res[i]["linkID"][0])+1)
target = schemadb.searchone(basedn=names.schemadn,
expression=expression,
attribute="lDAPDisplayName",
scope=SCOPE_SUBTREE)
if target is not None:
refint_attributes = refint_attributes + " " + target + " " + res[i]["lDAPDisplayName"][0]
- memberof_config += """overlay memberof
-memberof-dangling error
-memberof-refint TRUE
-memberof-group-oc top
-memberof-member-ad """ + res[i]["lDAPDisplayName"][0] + """
-memberof-memberof-ad """ + target + """
-memberof-dangling-error 32
-
-"""
-
- memberof_config += """
-overlay refint
-refint_attributes""" + refint_attributes + "\n"
-
- setup_file(setup_path("slapd.conf"), paths.slapdconf,
+
+ memberof_config += read_and_sub_file(setup_path("memberof.conf"),
+ { "MEMBER_ATTR" : str(res[i]["lDAPDisplayName"][0]),
+ "MEMBEROF_ATTR" : str(target) })
+
+ refint_config = read_and_sub_file(setup_path("refint.conf"),
+ { "LINK_ATTRS" : refint_attributes})
+
+# generate serverids, ldap-urls and syncrepl-blocks for mmr hosts
+ mmr_on_config = ""
+ mmr_replicator_acl = ""
+ mmr_serverids_config = ""
+ mmr_syncrepl_schema_config = ""
+ mmr_syncrepl_config_config = ""
+ mmr_syncrepl_user_config = ""
+
+
+ if ol_mmr_urls is not None:
+ # For now, make these equal
+ mmr_pass = adminpass
+
+ url_list=filter(None,ol_mmr_urls.split(' '))
+ if (len(url_list) == 1):
+ url_list=filter(None,ol_mmr_urls.split(','))
+
+
+ mmr_on_config = "MirrorMode On"
+ mmr_replicator_acl = " by dn=cn=replicator,cn=samba read"
+ serverid=0
+ for url in url_list:
+ serverid=serverid+1
+ mmr_serverids_config += read_and_sub_file(setup_path("mmr_serverids.conf"),
+ { "SERVERID" : str(serverid),
+ "LDAPSERVER" : url })
+ rid=serverid*10
+ rid=rid+1
+ mmr_syncrepl_schema_config += read_and_sub_file(setup_path("mmr_syncrepl.conf"),
+ { "RID" : str(rid),
+ "MMRDN": names.schemadn,
+ "LDAPSERVER" : url,
+ "MMR_PASSWORD": mmr_pass})
+
+ rid=rid+1
+ mmr_syncrepl_config_config += read_and_sub_file(setup_path("mmr_syncrepl.conf"),
+ { "RID" : str(rid),
+ "MMRDN": names.configdn,
+ "LDAPSERVER" : url,
+ "MMR_PASSWORD": mmr_pass})
+
+ rid=rid+1
+ mmr_syncrepl_user_config += read_and_sub_file(setup_path("mmr_syncrepl.conf"),
+ { "RID" : str(rid),
+ "MMRDN": names.domaindn,
+ "LDAPSERVER" : url,
+ "MMR_PASSWORD": mmr_pass })
+ # olc = yes?
+ olc_config_pass = ""
+ olc_config_acl = ""
+ olc_syncrepl_config = ""
+ olc_mmr_config = ""
+ if ol_olc == "yes":
+ olc_config_pass += read_and_sub_file(setup_path("olc_pass.conf"),
+ { "OLC_PW": adminpass })
+ olc_config_acl += read_and_sub_file(setup_path("olc_acl.conf"),{})
+
+ # if olc = yes + mmr = yes, generate cn=config-replication directives
+ # and olc_seed.lif for the other mmr-servers
+ if ol_olc == "yes" and ol_mmr_urls is not None:
+ serverid=0
+ olc_serverids_config = ""
+ olc_syncrepl_config = ""
+ olc_syncrepl_seed_config = ""
+ olc_mmr_config = ""
+ olc_mmr_config += read_and_sub_file(setup_path("olc_mmr.conf"),{})
+ rid=1000
+ for url in url_list:
+ serverid=serverid+1
+ olc_serverids_config += read_and_sub_file(setup_path("olc_serverid.conf"),
+ { "SERVERID" : str(serverid),
+ "LDAPSERVER" : url })
+
+ rid=rid+1
+ olc_syncrepl_config += read_and_sub_file(setup_path("olc_syncrepl.conf"),
+ { "RID" : str(rid),
+ "LDAPSERVER" : url,
+ "MMR_PASSWORD": adminpass})
+
+ olc_syncrepl_seed_config += read_and_sub_file(setup_path("olc_syncrepl_seed.conf"),
+ { "RID" : str(rid),
+ "LDAPSERVER" : url})
+
+ setup_file(setup_path("olc_seed.ldif"), paths.olcseedldif,
+ {"OLC_SERVER_ID_CONF": olc_serverids_config,
+ "OLC_PW": adminpass,
+ "OLC_SYNCREPL_CONF": olc_syncrepl_seed_config})
+
+
+ # end olc
+
+ setup_file(setup_path("slapd.conf"), paths.slapdconf,
{"DNSDOMAIN": names.dnsdomain,
"LDAPDIR": paths.ldapdir,
"DOMAINDN": names.domaindn,
"CONFIGDN": names.configdn,
"SCHEMADN": names.schemadn,
- "LDAPMANAGERDN": names.ldapmanagerdn,
- "LDAPMANAGERPASS": adminpass,
- "MEMBEROF_CONFIG": memberof_config})
- setup_file(setup_path("modules.conf"), paths.modulesconf,
+ "MEMBEROF_CONFIG": memberof_config,
+ "MIRRORMODE": mmr_on_config,
+ "REPLICATOR_ACL": mmr_replicator_acl,
+ "MMR_SERVERIDS_CONFIG": mmr_serverids_config,
+ "MMR_SYNCREPL_SCHEMA_CONFIG": mmr_syncrepl_schema_config,
+ "MMR_SYNCREPL_CONFIG_CONFIG": mmr_syncrepl_config_config,
+ "MMR_SYNCREPL_USER_CONFIG": mmr_syncrepl_user_config,
+ "OLC_CONFIG_PASS": olc_config_pass,
+ "OLC_SYNCREPL_CONFIG": olc_syncrepl_config,
+ "OLC_CONFIG_ACL": olc_config_acl,
+ "OLC_MMR_CONFIG": olc_mmr_config,
+ "REFINT_CONFIG": refint_config})
+ setup_file(setup_path("modules.conf"), paths.modulesconf,
{"REALM": names.realm})
- setup_db_config(setup_path, os.path.join(paths.ldapdir, os.path.join("db", "user")))
- setup_db_config(setup_path, os.path.join(paths.ldapdir, os.path.join("db", "config")))
- setup_db_config(setup_path, os.path.join(paths.ldapdir, os.path.join("db", "schema")))
- mapping = "schema-map-openldap-2.3"
- backend_schema = "backend-schema.schema"
-
- ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
- if ldap_backend_port is not None:
- server_port_string = " -h ldap://0.0.0.0:%d" % ldap_backend_port
- else:
- server_port_string = ""
- slapdcommand="Start slapd with: slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri + server_port_string
+ setup_db_config(setup_path, os.path.join(paths.ldapdir, "db", "user"))
+ setup_db_config(setup_path, os.path.join(paths.ldapdir, "db", "config"))
+ setup_db_config(setup_path, os.path.join(paths.ldapdir, "db", "schema"))
+
+ if not os.path.exists(os.path.join(paths.ldapdir, "db", "samba", "cn=samba")):
+ os.makedirs(os.path.join(paths.ldapdir, "db", "samba", "cn=samba"), 0700)
+
+ setup_file(setup_path("cn=samba.ldif"),
+ os.path.join(paths.ldapdir, "db", "samba", "cn=samba.ldif"),
+ { "UUID": str(uuid.uuid4()),
+ "LDAPTIME": timestring(int(time.time()))} )
+ setup_file(setup_path("cn=samba-admin.ldif"),
+ os.path.join(paths.ldapdir, "db", "samba", "cn=samba", "cn=samba-admin.ldif"),
+ {"LDAPADMINPASS_B64": b64encode(adminpass),
+ "UUID": str(uuid.uuid4()),
+ "LDAPTIME": timestring(int(time.time()))} )
+
+ if ol_mmr_urls is not None:
+ setup_file(setup_path("cn=replicator.ldif"),
+ os.path.join(paths.ldapdir, "db", "samba", "cn=samba", "cn=replicator.ldif"),
+ {"MMR_PASSWORD_B64": b64encode(mmr_pass),
+ "UUID": str(uuid.uuid4()),
+ "LDAPTIME": timestring(int(time.time()))} )
- schema_command = "bin/ad2oLschema --option=convert:target=" + ldap_backend_type + " -I " + setup_path(mapping) + " -H tdb://" + schemadb_path + " -O " + os.path.join(paths.ldapdir, backend_schema)
- os.system(schema_command)
+ mapping = "schema-map-openldap-2.3"
+ backend_schema = "backend-schema.schema"
+
+ ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
+ if ldap_backend_port is not None:
+ server_port_string = " -h ldap://0.0.0.0:%d" % ldap_backend_port
+ else:
+ server_port_string = ""
+ if ol_olc != "yes" and ol_mmr_urls is None:
+ slapdcommand="Start slapd with: slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri + server_port_string
+
+ if ol_olc == "yes" and ol_mmr_urls is None:
+ slapdcommand="Start slapd with: slapd -F " + paths.olcdir + " -h \"" + ldapi_uri + " ldap://<FQHN>:<PORT>\""
+
+ if ol_olc != "yes" and ol_mmr_urls is not None:
+ slapdcommand="Start slapd with: slapd -f " + paths.ldapdir + "/slapd.conf -h \"" + ldapi_uri + " ldap://<FQHN>:<PORT>\""
+
+ if ol_olc == "yes" and ol_mmr_urls is not None:
+ slapdcommand="Start slapd with: slapd -F " + paths.olcdir + " -h \"" + ldapi_uri + " ldap://<FQHN>:<PORT>\""
+
+
+ ldapuser = "--username=samba-admin"
+
+
+ schema_command = "bin/ad2oLschema --option=convert:target=" + ldap_backend_type + " -I " + setup_path(mapping) + " -H tdb://" + schemadb_path + " -O " + os.path.join(paths.ldapdir, backend_schema)
+
+ os.system(schema_command)
message("Your %s Backend for Samba4 is now configured, and is ready to be started" % ldap_backend_type)
message("Server Role: %s" % serverrole)
message("Hostname: %s" % names.hostname)
message("DNS Domain: %s" % names.dnsdomain)
message("Base DN: %s" % names.domaindn)
- message("LDAP admin DN: %s" % names.ldapmanagerdn)
+
+ if ldap_backend_type == "openldap":
+ message("LDAP admin user: samba-admin")
+ else:
+ message("LDAP admin DN: %s" % names.ldapmanagerdn)
+
message("LDAP admin password: %s" % adminpass)
message(slapdcommand)
+ if ol_olc == "yes" or ol_mmr_urls is not None:
+ message("Attention to slapd-Port: <PORT> must be different than 389!")
+ assert isinstance(ldap_backend_type, str)
+ assert isinstance(ldapuser, str)
+ assert isinstance(adminpass, str)
+ assert isinstance(names.dnsdomain, str)
+ assert isinstance(names.domain, str)
+ assert isinstance(serverrole, str)
+ args = ["--ldap-backend=ldapi",
+ "--ldap-backend-type=" + ldap_backend_type,
+ "--password=" + adminpass,
+ ldapuser,
+ "--realm=" + names.dnsdomain,
+ "--domain=" + names.domain,
+ "--server-role='" + serverrole + "'"]
+ message("Run provision with: " + " ".join(args))
+
+
+ # if --ol-olc=yes, generate online-configuration in ../private/ldap/slapd.d
+ if ol_olc == "yes":
+ if not os.path.isdir(paths.olcdir):
+ os.makedirs(paths.olcdir, 0770)
+ paths.olslaptest = str(ol_slaptest)
+ olc_command = paths.olslaptest + " -f" + paths.slapdconf + " -F" + paths.olcdir + " >/dev/null 2>&1"
+ os.system(olc_command)
+ os.remove(paths.slapdconf)
+ # use line below for debugging during olc-conversion with slaptest, instead of olc_command above
+ #olc_command = paths.olslaptest + " -f" + paths.slapdconf + " -F" + paths.olcdir"
def create_phpldapadmin_config(path, setup_path, ldapi_uri):
hostip6_base_line = ""
hostip6_host_line = ""
+ if hostip is not None:
+ hostip_base_line = " IN A " + hostip
+ hostip_host_line = hostname + " IN A " + hostip
+ else:
+ hostip_base_line = ""
+ hostip_host_line = ""
+
setup_file(setup_path("provision.zone"), path, {
"DNSPASS_B64": b64encode(dnspass),
"HOSTNAME": hostname,
"DNSDOMAIN": dnsdomain,
"REALM": realm,
- "HOSTIP": hostip,
+ "HOSTIP_BASE_LINE": hostip_base_line,
+ "HOSTIP_HOST_LINE": hostip_host_line,
"DOMAINGUID": domainguid,
"DATESTRING": time.strftime("%Y%m%d%H"),
"DEFAULTSITE": DEFAULTSITE,
def create_named_conf(path, setup_path, realm, dnsdomain,
- private_dir, keytab_name):
+ private_dir):
"""Write out a file containing zone statements suitable for inclusion in a
named.conf file (including GSS-TSIG configuration).
"DNSDOMAIN": dnsdomain,
"REALM": realm,
"REALM_WC": "*." + ".".join(realm.split(".")[1:]),
+ "PRIVATE_DIR": private_dir
+ })
+
+def create_named_txt(path, setup_path, realm, dnsdomain,
+ private_dir, keytab_name):
+ """Write out a file containing zone statements suitable for inclusion in a
+ named.conf file (including GSS-TSIG configuration).
+
+ :param path: Path of the new named.conf file.
+ :param setup_path: Setup path function.
+ :param realm: Realm name
+ :param dnsdomain: DNS Domain name
+ :param private_dir: Path to private directory
+ :param keytab_name: File name of DNS keytab file
+ """
+
+ setup_file(setup_path("named.txt"), path, {
+ "DNSDOMAIN": dnsdomain,
+ "REALM": realm,
"DNS_KEYTAB": keytab_name,
"DNS_KEYTAB_ABS": os.path.join(private_dir, keytab_name),
+ "PRIVATE_DIR": private_dir
})
def create_krb5_conf(path, setup_path, dnsdomain, hostname, realm):
})
-def load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename):
+def load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename,
+ serverdn, servername):
"""Load schema for the SamDB.
:param samdb: Load a schema into a SamDB.
:param schemadn: DN of the schema
:param netbiosname: NetBIOS name of the host.
:param configdn: DN of the configuration
+ :param serverdn: DN of the server
+ :param servername: Host name of the server
"""
schema_data = open(setup_path("schema.ldif"), 'r').read()
schema_data += open(setup_path("schema_samba4.ldif"), 'r').read()
schema_data = substitute_var(schema_data, {"SCHEMADN": schemadn})
+ check_all_substituted(schema_data)
prefixmap = open(setup_path("prefixMap.txt"), 'r').read()
prefixmap = b64encode(prefixmap)
"SCHEMADN": schemadn,
"NETBIOSNAME": netbiosname,
"CONFIGDN": configdn,
- "DEFAULTSITE":sitename,
- "PREFIXMAP_B64":prefixmap
+ "DEFAULTSITE": sitename,
+ "PREFIXMAP_B64": prefixmap,
+ "SERVERDN": serverdn,
+ "SERVERNAME": servername,
})
+ check_all_substituted(head_data)
samdb.attach_schema_from_ldif(head_data, schema_data)
git.samba.org / amitay / samba.git / blobdiff