1 # gp_sec_ext kdc gpo policy
2 # Copyright (C) Luke Morrison <luc785@.hotmail.com> 2013
3 # Copyright (C) David Mulder <dmulder@suse.com> 2018
5 # This program is free software; you can redistribute it and/or modify
6 # it under the terms of the GNU General Public License as published by
7 # the Free Software Foundation; either version 3 of the License, or
8 # (at your option) any later version.
10 # This program is distributed in the hope that it will be useful,
11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 # GNU General Public License for more details.
15 # You should have received a copy of the GNU General Public License
16 # along with this program. If not, see <http://www.gnu.org/licenses/>.
19 from samba.gpclass import gp_ext_setter, gp_inf_ext
21 class inf_to_kdc_tdb(gp_ext_setter):
22 def mins_to_hours(self):
23 return '%d' % (int(self.val)/60)
25 def days_to_hours(self):
26 return '%d' % (int(self.val)*24)
28 def set_kdc_tdb(self, val):
29 old_val = self.gp_db.gpostore.get(self.attribute)
30 self.logger.info('%s was changed from %s to %s' % (self.attribute,
33 self.gp_db.gpostore.store(self.attribute, val)
34 self.gp_db.store(str(self), self.attribute, old_val)
36 self.gp_db.gpostore.delete(self.attribute)
37 self.gp_db.delete(str(self), self.attribute)
40 return {'kdc:user_ticket_lifetime': (self.set_kdc_tdb, self.explicit),
41 'kdc:service_ticket_lifetime': (self.set_kdc_tdb,
43 'kdc:renewal_lifetime': (self.set_kdc_tdb,
48 return 'Kerberos Policy'
50 class inf_to_ldb(gp_ext_setter):
51 '''This class takes the .inf file parameter (essentially a GPO file mapped
52 to a GUID), hashmaps it to the Samba parameter, which then uses an ldb
53 object to update the parameter to Samba4. Not registry oriented whatsoever.
56 def ch_minPwdAge(self, val):
57 old_val = self.ldb.get_minPwdAge()
58 self.logger.info('KDC Minimum Password age was changed from %s to %s' \
60 self.gp_db.store(str(self), self.attribute, str(old_val))
61 self.ldb.set_minPwdAge(val)
63 def ch_maxPwdAge(self, val):
64 old_val = self.ldb.get_maxPwdAge()
65 self.logger.info('KDC Maximum Password age was changed from %s to %s' \
67 self.gp_db.store(str(self), self.attribute, str(old_val))
68 self.ldb.set_maxPwdAge(val)
70 def ch_minPwdLength(self, val):
71 old_val = self.ldb.get_minPwdLength()
73 'KDC Minimum Password length was changed from %s to %s' \
75 self.gp_db.store(str(self), self.attribute, str(old_val))
76 self.ldb.set_minPwdLength(val)
78 def ch_pwdProperties(self, val):
79 old_val = self.ldb.get_pwdProperties()
80 self.logger.info('KDC Password Properties were changed from %s to %s' \
82 self.gp_db.store(str(self), self.attribute, str(old_val))
83 self.ldb.set_pwdProperties(val)
85 def days2rel_nttime(self):
92 return str(-(val * seconds * minutes * hours * sam_add))
95 '''ldap value : samba setter'''
96 return {"minPwdAge": (self.ch_minPwdAge, self.days2rel_nttime),
97 "maxPwdAge": (self.ch_maxPwdAge, self.days2rel_nttime),
98 # Could be none, but I like the method assignment in
100 "minPwdLength": (self.ch_minPwdLength, self.explicit),
101 "pwdProperties": (self.ch_pwdProperties, self.explicit),
106 return 'System Access'
108 class gp_sec_ext(gp_inf_ext):
109 '''This class does the following two things:
110 1) Identifies the GPO if it has a certain kind of filepath,
111 2) Finally parses it.
117 return "Security GPO extension"
119 def list(self, rootpath):
120 return os.path.join(rootpath,
121 "MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf")
123 def listmachpol(self, rootpath):
124 return os.path.join(rootpath, "Machine/Registry.pol")
126 def listuserpol(self, rootpath):
127 return os.path.join(rootpath, "User/Registry.pol")
130 return {"System Access": {"MinimumPasswordAge": ("minPwdAge",
132 "MaximumPasswordAge": ("maxPwdAge",
134 "MinimumPasswordLength": ("minPwdLength",
136 "PasswordComplexity": ("pwdProperties",
139 "Kerberos Policy": {"MaxTicketAge": (
140 "kdc:user_ticket_lifetime",
144 "kdc:service_ticket_lifetime",
148 "kdc:renewal_lifetime",