python/samba/remove_dc.py

   1 # Unix SMB/CIFS implementation.
   2 # Copyright Matthieu Patou <mat@matws.net> 2011
   3 # Copyright Andrew Bartlett <abartlet@samba.org> 2008-2015
   4 #
   5 # This program is free software; you can redistribute it and/or modify
   6 # it under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation; either version 3 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 #
  18
  19 import ldb
  20 from ldb import LdbError
  21 from samba.ndr import ndr_unpack
  22 from samba.dcerpc import misc
  23
  24 class DemoteException(Exception):
  25     """Base element for demote errors"""
  26
  27     def __init__(self, value):
  28         self.value = value
  29
  30     def __str__(self):
  31         return "DemoteException: " + self.value
  32
  33
  34 def remove_sysvol_references(samdb, rdn):
  35     realm = samdb.domain_dns_name()
  36     for s in ("CN=Enterprise,CN=Microsoft System Volumes,CN=System,CN=Configuration",
  37               "CN=%s,CN=Microsoft System Volumes,CN=System,CN=Configuration" % realm,
  38               "CN=Domain System Volumes (SYSVOL share),CN=File Replication Service,CN=System"):
  39         try:
  40             samdb.delete(ldb.Dn(samdb,
  41                                 "%s,%s,%s" % (str(rdn), s, str(samdb.get_root_basedn()))))
  42         except ldb.LdbError, l:
  43             pass
  44
  45 def remove_dns_references(samdb, dnsHostName):
  46
  47     # Check we are using in-database DNS
  48     zones = samdb.search(base="", scope=ldb.SCOPE_SUBTREE,
  49                          expression="(&(objectClass=dnsZone)(!(dc=RootDNSServers)))",
  50                          attrs=[],
  51                          controls=["search_options:0:2"])
  52     if len(zones) == 0:
  53         return
  54
  55     try:
  56         rec = samdb.dns_lookup(dnsHostName)
  57     except RuntimeError as (enum, estr):
  58         if enum == 0x000025F2: #WERR_DNS_ERROR_NAME_DOES_NOT_EXIST
  59               return
  60         raise DemoteException("lookup of %s failed: %s" % (dnsHostName, estr))
  61     samdb.dns_replace(dnsHostName, [])
  62
  63 def offline_remove_server(samdb, server_dn,
  64                           remove_computer_obj=False,
  65                           remove_server_obj=False,
  66                           remove_sysvol_obj=False,
  67                           remove_dns_names=False):
  68     res = samdb.search("",
  69                        scope=ldb.SCOPE_BASE, attrs=["dsServiceName"])
  70     assert len(res) == 1
  71     my_serviceName = res[0]["dsServiceName"][0]
  72
  73     # Confirm this is really a server object
  74     msgs = samdb.search(base=server_dn,
  75                         attrs=["serverReference", "cn",
  76                                "dnsHostName"],
  77                         scope=ldb.SCOPE_BASE,
  78                         expression="(objectClass=server)")
  79     msg = msgs[0]
  80     dc_name = msgs[0]["cn"]
  81
  82     try:
  83         computer_dn = ldb.Dn(samdb, msgs[0]["serverReference"][0])
  84     except KeyError:
  85         computer_dn = None
  86
  87     try:
  88         dnsHostName = msgs[0]["dnsHostName"][0]
  89     except KeyError:
  90         dnsHostName = None
  91
  92     if remove_server_obj:
  93         # Remove the server DN
  94         samdb.delete(server_dn)
  95
  96     if computer_dn is not None:
  97         computer_msgs = samdb.search(base=computer_dn,
  98                                      expression="objectclass=computer",
  99                                      attrs=["msDS-KrbTgtLink",
 100                                             "rIDSetReferences"],
 101                                      scope=ldb.SCOPE_BASE)
 102         if "rIDSetReferences" in computer_msgs[0]:
 103             samdb.delete(computer_msgs[0]["rIDSetReferences"][0])
 104         if "msDS-KrbTgtLink" in computer_msgs[0]:
 105             samdb.delete(computer_msgs[0]["msDS-KrbTgtLink"][0])
 106
 107         if remove_computer_obj:
 108             # Delete the computer tree
 109             samdb.delete(computer_dn, ["tree_delete:0"])
 110
 111         if "dnsHostName" in msgs[0]:
 112             dnsHostName = msgs[0]["dnsHostName"][0]
 113
 114     if dnsHostName is not None and remove_dns_names:
 115         remove_dns_references(samdb, dnsHostName)
 116
 117     if remove_sysvol_obj:
 118         remove_sysvol_references(samdb, "CN=%s" % dc_name)
 119
 120 def offline_remove_ntds_dc(samdb, ntds_dn,
 121                            remove_computer_obj=False,
 122                            remove_server_obj=False,
 123                            remove_connection_obj=False,
 124                            seize_stale_fsmo=False,
 125                            remove_sysvol_obj=False,
 126                            remove_dns_names=False):
 127     res = samdb.search("",
 128                        scope=ldb.SCOPE_BASE, attrs=["dsServiceName"])
 129     assert len(res) == 1
 130     my_serviceName = ldb.Dn(samdb, res[0]["dsServiceName"][0])
 131     server_dn = ntds_dn.parent()
 132
 133     if my_serviceName == ntds_dn:
 134         raise DemoteException("Refusing to demote our own DSA: %s " % my_serviceName)
 135
 136     try:
 137         msgs = samdb.search(base=ntds_dn, expression="objectClass=ntdsDSA",
 138                         attrs=["objectGUID"], scope=ldb.SCOPE_BASE)
 139     except LdbError as (enum, estr):
 140         if enum == ldb.ERR_NO_SUCH_OBJECT:
 141               raise DemoteException("Given DN %s doesn't exist" % ntds_dn)
 142         else:
 143             raise
 144     if (len(msgs) == 0):
 145         raise DemoteException("%s is not an ntdsda in %s"
 146                               % (ntds_dn, samdb.domain_dns_name()))
 147
 148     msg = msgs[0]
 149     if (msg.dn.get_rdn_name() != "CN" or
 150         msg.dn.get_rdn_value() != "NTDS Settings"):
 151         raise DemoteException("Given DN (%s) wasn't the NTDS Settings DN" %
 152                               ntds_dn)
 153
 154     ntds_guid = ndr_unpack(misc.GUID, msg["objectGUID"][0])
 155
 156     if remove_connection_obj:
 157         # Find any nTDSConnection objects with that DC as the fromServer.
 158         # We use the GUID to avoid issues with any () chars in a server
 159         # name.
 160         stale_connections = samdb.search(base=samdb.get_config_basedn(),
 161                                          expression="(&(objectclass=nTDSConnection)"
 162                                          "(fromServer=<GUID=%s>))" % ntds_guid)
 163         for conn in stale_connections:
 164             samdb.delete(conn.dn)
 165
 166     if seize_stale_fsmo:
 167         stale_fsmo_roles = samdb.search(base="", scope=ldb.SCOPE_SUBTREE,
 168                                         expression="(fsmoRoleOwner=<GUID=%s>))"
 169                                         % ntds_guid,
 170                                         controls=["search_options:0:2"])
 171         # Find any FSMO roles they have, give them to this server
 172
 173         for role in stale_fsmo_roles:
 174             val = str(my_serviceName)
 175             m = ldb.Message()
 176             m.dn = role.dn
 177             m['value'] = ldb.MessageElement(val, ldb.FLAG_MOD_REPLACE,
 178                                             'fsmoRoleOwner')
 179             samdb.modify(m)
 180
 181     # Remove the NTDS setting tree
 182     try:
 183         samdb.delete(ntds_dn, ["tree_delete:0"])
 184     except LdbError as (enum, estr):
 185         raise DemoteException("Failed to remove the DCs NTDS DSA object: %s"
 186                               % estr)
 187
 188     offline_remove_server(samdb, server_dn,
 189                           remove_computer_obj=remove_computer_obj,
 190                           remove_server_obj=remove_server_obj,
 191                           remove_sysvol_obj=remove_sysvol_obj,
 192                           remove_dns_names=remove_dns_names)
 193
 194
 195 def remove_dc(samdb, dc_name):
 196
 197     # TODO: Check if this is the last server (covered mostly by
 198     # refusing to remove our own name)
 199
 200     samdb.transaction_start()
 201
 202     msgs = samdb.search(base=samdb.get_config_basedn(),
 203                         attrs=["serverReference"],
 204                         expression="(&(objectClass=server)(cn=%s))"
 205                     % ldb.binary_encode(dc_name))
 206     if (len(msgs) == 0):
 207         raise DemoteException("%s is not an AD DC in %s"
 208                               % (dc_name, samdb.domain_dns_name()))
 209     server_dn = msgs[0].dn
 210
 211     ntds_dn = ldb.Dn(samdb, "CN=NTDS Settings")
 212     ntds_dn.add_base(msgs[0].dn)
 213
 214     # Confirm this is really an ntdsDSA object
 215     try:
 216         msgs = samdb.search(base=ntds_dn, attrs=[], scope=ldb.SCOPE_BASE,
 217                             expression="(objectClass=ntdsdsa)")
 218     except LdbError as (enum, estr):
 219         if enum == ldb.ERR_NO_SUCH_OBJECT:
 220             offline_remove_server(samdb, msgs[0].dn,
 221                                   remove_computer_obj=True,
 222                                   remove_server_obj=True,
 223                                   remove_sysvol_obj=True,
 224                                   remove_dns_names=True)
 225
 226             samdb.transaction_commit()
 227             return
 228         else:
 229             pass
 230
 231     offline_remove_ntds_dc(samdb, msgs[0].dn,
 232                            remove_computer_obj=True,
 233                            remove_server_obj=True,
 234                            remove_connection_obj=True,
 235                            seize_stale_fsmo=True,
 236                            remove_sysvol_obj=True,
 237                            remove_dns_names=True)
 238
 239     samdb.transaction_commit()
 240
 241
 242
 243 def offline_remove_dc_RemoveDsServer(samdb, ntds_dn):
 244
 245     samdb.start_transaction()
 246
 247     offline_remove_ntds_dc(samdb, ntds_dn)
 248
 249     samdb.commit_transaction()