2 backend code for provisioning a Samba4 server
3 Copyright Andrew Tridgell 2005
4 Released under the GNU GPL v2 or later
7 /* used to generate sequence numbers for records */
8 provision_next_usn = 1;
13 return true if the current install seems to be OK
15 function install_ok(session_info, credentials)
17 var lp = loadparm_init();
19 ldb.session_info = session_info;
20 ldb.credentials = credentials;
21 if (lp.get("realm") == "") {
24 var ok = ldb.connect(lp.get("sam database"));
28 var res = ldb.search("(cn=Administrator)");
29 if (res.length != 1) {
36 find a user or group from a list of possibilities
41 assert(arguments.length >= 2);
42 var nssfn = arguments[0];
43 for (i=1;i<arguments.length;i++) {
44 if (nssfn(arguments[i]) != undefined) {
48 printf("Unable to find user/group for %s\n", arguments[1]);
49 assert(i<arguments.length);
53 add a foreign security principle
55 function add_foreign(str, sid, desc, unixname)
58 dn: CN=${SID},CN=ForeignSecurityPrincipals,${BASEDN}
60 objectClass: foreignSecurityPrincipal
66 var sub = new Object();
69 sub.UNIXNAME = unixname;
70 return str + substitute_var(add, sub);
74 return current time as a nt time string
78 return "" + sys.nttime();
82 return current time as a ldap time string
86 return sys.ldaptime(sys.nttime());
90 return a date string suitable for a dns zone serial number
94 var t = sys.gmtime(sys.nttime());
95 return sprintf("%04u%02u%02u%02u",
96 t.tm_year+1900, t.tm_mon+1, t.tm_mday, t.tm_hour);
104 var list = sys.interfaces();
109 return next USN in the sequence
113 provision_next_usn = provision_next_usn+1;
114 return provision_next_usn;
118 return first part of hostname
122 var s = split(".", sys.hostname());
127 /* the ldb is in bad shape, possibly due to being built from an
128 incompatible previous version of the code, so delete it
130 function ldb_delete(ldb)
132 println("Deleting " + ldb.filename);
133 var lp = loadparm_init();
134 sys.unlink(sprintf("%s/%s", lp.get("private dir"), ldb.filename));
135 ldb.transaction_cancel();
137 var ok = ldb.connect(ldb.filename);
138 ldb.transaction_start();
143 erase an ldb, removing all records
145 function ldb_erase(ldb)
147 var attrs = new Array("dn");
149 /* delete the specials */
150 ldb.del("@INDEXLIST");
151 ldb.del("@ATTRIBUTES");
152 ldb.del("@SUBCLASSES");
156 var res = ldb.search("(&(|(objectclass=*)(dn=*))(!(dn=@BASEINFO)))", attrs);
158 if (typeof(res) == "undefined") {
162 for (i=0;i<res.length;i++) {
165 /* extra hack to ensure it's gone on remote ldap */
166 ldb.del("cn=ROOTDSE");
168 var res = ldb.search("(&(|(objectclass=*)(dn=*))(!(dn=@BASEINFO)))", attrs);
169 if (res.length != 0) {
173 assert(res.length == 0);
177 setup a ldb in the private dir
179 function setup_ldb(ldif, info, dbname)
183 var ldb = ldb_init();
184 var lp = loadparm_init();
185 ldb.session_info = info.session_info;
186 ldb.credentials = info.credentials;
188 if (arguments.length >= 4) {
189 extra = arguments[3];
192 if (arguments.length == 5) {
193 erase = arguments[4];
196 var src = lp.get("setup directory") + "/" + ldif;
198 var data = sys.file_load(src);
200 data = substitute_var(data, info.subobj);
202 ldb.filename = dbname;
204 var connect_ok = ldb.connect(dbname);
207 ldb.transaction_start();
213 var add_ok = ldb.add(data);
215 info.message("ldb load failed: " + ldb.errstring() + "\n");
218 var commit_ok = ldb.transaction_commit();
220 info.message("ldb commit failed: " + ldb.errstring() + "\n");
226 setup a file in the private dir
228 function setup_file(template, fname, subobj)
230 var lp = loadparm_init();
232 var src = lp.get("setup directory") + "/" + template;
236 var data = sys.file_load(src);
237 data = substitute_var(data, subobj);
239 ok = sys.file_save(f, data);
243 function provision_default_paths(subobj)
245 var lp = loadparm_init();
246 var paths = new Object();
247 paths.smbconf = lp.get("config file");
248 paths.hklm = "hklm.ldb";
249 paths.hkcu = "hkcu.ldb";
250 paths.hkcr = "hkcr.ldb";
251 paths.hku = "hku.ldb";
252 paths.hkpd = "hkpd.ldb";
253 paths.hkpt = "hkpt.ldb";
254 paths.samdb = lp.get("sam database");
255 paths.secrets = "secrets.ldb";
256 paths.dns = lp.get("private dir") + "/" + subobj.DNSDOMAIN + ".zone";
257 paths.winsdb = "wins.ldb";
262 provision samba4 - caution, this wipes all existing data!
264 function provision(subobj, message, blank, paths, session_info, credentials)
267 var lp = loadparm_init();
268 var sys = sys_init();
269 var info = new Object();
272 some options need to be upper/lower case
274 subobj.REALM = strupper(subobj.REALM);
275 subobj.HOSTNAME = strlower(subobj.HOSTNAME);
276 subobj.DOMAIN = strupper(subobj.DOMAIN);
277 assert(valid_netbios_name(subobj.DOMAIN));
278 subobj.NETBIOSNAME = strupper(subobj.HOSTNAME);
279 assert(valid_netbios_name(subobj.NETBIOSNAME));
280 var rdns = split(",", subobj.BASEDN);
281 subobj.RDN_DC = substr(rdns[0], strlen("DC="));
283 data = add_foreign(data, "S-1-5-7", "Anonymous", "${NOBODY}");
284 data = add_foreign(data, "S-1-1-0", "World", "${NOGROUP}");
285 data = add_foreign(data, "S-1-5-2", "Network", "${NOGROUP}");
286 data = add_foreign(data, "S-1-5-18", "System", "${ROOT}");
287 data = add_foreign(data, "S-1-5-11", "Authenticated Users", "${USERS}");
289 provision_next_usn = 1;
291 info.subobj = subobj;
292 info.message = message;
293 info.credentials = credentials;
294 info.session_info = session_info;
296 /* only install a new smb.conf if there isn't one there already */
297 var st = sys.stat(paths.smbconf);
298 if (st == undefined) {
299 message("Setting up smb.conf\n");
300 setup_file("provision.smb.conf", paths.smbconf, subobj);
303 message("Setting up secrets.ldb\n");
304 setup_ldb("secrets.ldif", info, paths.secrets);
305 message("Setting up keytabs\n");
306 var keytab_ok = credentials_update_all_keytabs();
308 message("Setting up hklm.ldb\n");
309 setup_ldb("hklm.ldif", info, paths.hklm);
312 message("Setting up sam.ldb attributes\n");
313 setup_ldb("provision_init.ldif", info, paths.samdb);
314 message("Setting up sam.ldb schema\n");
315 setup_ldb("schema.ldif", info, paths.samdb, NULL, false);
316 message("Setting up display specifiers\n");
317 setup_ldb("display_specifiers.ldif", info, paths.samdb, NULL, false);
318 message("Setting up sam.ldb templates\n");
319 setup_ldb("provision_templates.ldif", info, paths.samdb, NULL, false);
320 message("Setting up sam.ldb data\n");
321 setup_ldb("provision.ldif", info, paths.samdb, NULL, false);
322 if (blank == false) {
323 message("Setting up sam.ldb users and groups\n");
324 setup_ldb("provision_users.ldif", info, paths.samdb, data, false);
329 /* Write out a DNS zone file, from the info in the current database */
330 function provision_dns(subobj, message, paths, session_info, credentials)
332 message("Setting up DNS zone: " + subobj.DNSDOMAIN + " \n");
333 var ldb = ldb_init();
334 ldb.session_info = session_info;
335 ldb.credentials = credentials;
337 /* connect to the sam */
338 var ok = ldb.connect(paths.samdb);
341 /* These values may have changed, due to an incoming SamSync, so fetch them from the database */
342 subobj.DOMAINGUID = searchone(ldb, "(&(objectClass=domainDNS)(dnsDomain=" + subobj.DNSDOMAIN + "))", "objectGUID");
343 assert(subobj.DOMAINGUID != undefined);
345 subobj.HOSTGUID = searchone(ldb, "(&(objectClass=computer)(cn=" + subobj.NETBIOSNAME + "))", "objectGUID");
346 assert(subobj.HOSTGUID != undefined);
348 setup_file("provision.zone",
352 message("Please install the zone located in " + paths.dns + " into your DNS server\n");
356 guess reasonably default options for provisioning
358 function provision_guess()
360 var subobj = new Object();
361 var nss = nss_init();
362 var lp = loadparm_init();
366 subobj.REALM = strupper(lp.get("realm"));
367 subobj.DOMAIN = lp.get("workgroup");
368 subobj.HOSTNAME = hostname();
370 assert(subobj.REALM);
371 assert(subobj.DOMAIN);
372 assert(subobj.HOSTNAME);
374 subobj.HOSTIP = hostip();
375 subobj.DOMAINGUID = randguid();
376 subobj.DOMAINSID = randsid();
377 subobj.HOSTGUID = randguid();
378 subobj.INVOCATIONID = randguid();
379 subobj.KRBTGTPASS = randpass(12);
380 subobj.MACHINEPASS = randpass(12);
381 subobj.ADMINPASS = randpass(12);
382 subobj.DEFAULTSITE = "Default-First-Site-Name";
383 subobj.NEWGUID = randguid;
384 subobj.NTTIME = nttime;
385 subobj.LDAPTIME = ldaptime;
386 subobj.DATESTRING = datestring;
387 subobj.USN = nextusn;
388 subobj.ROOT = findnss(nss.getpwnam, "root");
389 subobj.NOBODY = findnss(nss.getpwnam, "nobody");
390 subobj.NOGROUP = findnss(nss.getgrnam, "nogroup", "nobody");
391 subobj.WHEEL = findnss(nss.getgrnam, "wheel", "root", "staff");
392 subobj.USERS = findnss(nss.getgrnam, "users", "guest", "other");
393 subobj.DNSDOMAIN = strlower(subobj.REALM);
394 subobj.DNSNAME = sprintf("%s.%s",
395 strlower(subobj.HOSTNAME),
397 rdn_list = split(".", subobj.DNSDOMAIN);
398 subobj.BASEDN = "DC=" + join(",DC=", rdn_list);
403 search for one attribute as a string
405 function searchone(ldb, expression, attribute)
407 var attrs = new Array(attribute);
408 res = ldb.search(expression, attrs);
409 if (res.length != 1 ||
410 res[0][attribute] == undefined) {
413 return res[0][attribute];
417 modify an account to remove the
419 function enable_account(ldb, user_dn)
421 var attrs = new Array("userAccountControl");
422 var res = ldb.search(NULL, user_dn, ldb.SCOPE_ONELEVEL, attrs);
423 assert(res.length == 1);
424 var userAccountControl = res[0].userAccountControl;
425 userAccountControl = userAccountControl - 2; /* remove disabled bit */
429 replace: userAccountControl
430 userAccountControl: %u
432 user_dn, userAccountControl);
433 var ok = ldb.modify(mod);
439 add a new user record
441 function newuser(username, unixname, password, message, session_info, credentials)
443 var lp = loadparm_init();
444 var samdb = lp.get("sam database");
445 var ldb = ldb_init();
447 ldb.session_info = session_info;
448 ldb.credentials = credentials;
450 /* connect to the sam */
451 var ok = ldb.connect(samdb);
454 ldb.transaction_start();
456 /* find the DNs for the domain and the domain users group */
457 var domain_dn = searchone(ldb, "objectClass=domainDNS", "dn");
458 assert(domain_dn != undefined);
459 var dom_users = searchone(ldb, "name=Domain Users", "dn");
460 assert(dom_users != undefined);
462 var user_dn = sprintf("CN=%s,CN=Users,%s", username, domain_dn);
466 the new user record. note the reliance on the samdb module to fill
477 user_dn, username, dom_users,
480 add the user to the users group as well
482 var modgroup = sprintf("
494 message("Adding user %s\n", user_dn);
497 message("Failed to add %s - %s\n", user_dn, ldb.errstring());
501 message("Modifying group %s\n", dom_users);
502 ok = ldb.modify(modgroup);
504 message("Failed to modify %s - %s\n", dom_users, ldb.errstring());
509 modify the userAccountControl to remove the disabled bit
511 ok = enable_account(ldb, user_dn);
513 ldb.transaction_commit();
518 // Check whether a name is valid as a NetBIOS name.
519 // FIXME: There are probably more constraints here.
520 // crh has a paragraph on this in his book (1.4.1.1)
521 function valid_netbios_name(name)
523 if (strlen(name) > 13) return false;
527 function provision_validate(subobj, message)
529 if (!valid_netbios_name(subobj.DOMAIN)) {
530 message("Invalid NetBIOS name for domain\n");
534 if (!valid_netbios_name(subobj.NETBIOSNAME)) {
535 message("Invalid NetBIOS name for host\n");
542 function join_domain(domain, netbios_name, join_type, creds, message)
544 var ctx = NetContext(creds);
545 var joindom = new Object();
546 joindom.domain = domain;
547 joindom.join_type = join_type;
548 joindom.netbios_name = netbios_name;
549 if (!ctx.JoinDomain(joindom)) {
550 message("Domain Join failed: " + join.error_string);
556 /* Vampire a remote domain. Session info and credentials are required for for
557 * access to our local database (might be remote ldap)
560 function vampire(domain, session_info, credentials, message) {
561 var ctx = NetContext(credentials);
562 vampire = new Object();
563 var machine_creds = credentials_init();
564 machine_creds.set_domain(form.DOMAIN);
565 if (!machine_creds.set_machine_account()) {
566 message("Failed to access domain join information!");
569 vampire.machine_creds = machine_creds;
570 vampire.session_info = session_info;
571 if (!ctx.SamSyncLdb(vampire)) {
572 message("Migration of remote domain to Samba failed: " + vampire.error_string);