s4: Add a new script for setting password properties for a domain in a easier way
[ira/wip.git] / source4 / setup / pwsettings
1 #!/usr/bin/python
2 #
3 #       Sets password settings (Password complexity, history length,
4 #       minimum password length, the minimum and maximum password age) on a
5 #       Samba4 server
6 #
7 #       Copyright Jelmer Vernooij 2008
8 #       Copyright Matthias Dieter Wallnoefer 2009
9 #       Released under the GNU GPL version 3 or later
10 #
11 import os, sys
12
13 sys.path.insert(0, os.path.join(os.path.dirname(sys.argv[0]), "../bin/python"))
14
15 import samba.getopt as options
16 import optparse
17 import pwd
18 import ldb
19
20 from samba.auth import system_session
21 from samba.samdb import SamDB
22 from samba.dcerpc.samr import DOMAIN_PASSWORD_COMPLEX
23
24 parser = optparse.OptionParser("pwsettings (show | set <options>)")
25 sambaopts = options.SambaOptions(parser)
26 parser.add_option_group(sambaopts)
27 parser.add_option_group(options.VersionOptions(parser))
28 credopts = options.CredentialsOptions(parser)
29 parser.add_option_group(credopts)
30 parser.add_option("-H", help="LDB URL for database or target server", type=str)
31 parser.add_option("--complexity",
32   help="The password complexity (on | off). Default is 'on'", type=str)
33 parser.add_option("--history-length",
34   help="The password history length (<integer> | default)", type=str)
35 parser.add_option("--min-pwd-length",
36   help="The minimum password length (<integer> | default)", type=str)
37 parser.add_option("--min-pwd-age",
38   help="The minimum password age (<integer in days> | default)", type=str)
39 parser.add_option("--max-pwd-age",
40   help="The maximum password age (<integer in days> | default)", type=str)
41
42 opts, args = parser.parse_args()
43
44 #
45 #  print a message if quiet is not set
46 #
47 def message(text):
48         if not opts.quiet:
49                 print text
50
51 if len(args) == 0:
52         parser.print_usage()
53         sys.exit(1)
54
55 lp = sambaopts.get_loadparm()
56
57 creds = credopts.get_credentials(lp)
58
59 if opts.H is not None:
60         url = opts.H
61 else:
62         url = lp.get("sam database")
63
64 samdb = SamDB(url=url, session_info=system_session(),
65               credentials=creds, lp=lp)
66
67 res = samdb.search("", scope=ldb.SCOPE_BASE,
68           expression="(defaultNamingContext=*)",
69           attrs=["defaultNamingContext"])
70 assert(len(res) == 1 and res[0]["defaultNamingContext"] is not None)
71 domain_dn = res[0]["defaultNamingContext"][0]
72
73 res = samdb.search(domain_dn, scope=ldb.SCOPE_BASE, attrs=["pwdProperties",
74   "pwdHistoryLength", "minPwdLength", "minPwdAge", "maxPwdAge"])
75 assert(len(res) == 1)
76 try:
77         pwd_props = int(res[0]["pwdProperties"][0])
78         pwd_hist_len = int(res[0]["pwdHistoryLength"][0])
79         min_pwd_len = int(res[0]["minPwdLength"][0])
80         min_pwd_age = int(res[0]["minPwdAge"][0])
81         max_pwd_age = int(res[0]["maxPwdAge"][0])
82 except:
83         if args[0] == "show":
84                 print "ERROR: Password informations missing in your AD domain object!"
85                 print "So no settings can be displayed!"
86                 sys.exit(1)
87         else:
88                 if pwd_props is None:
89                         pwd_props = 0
90                         print "WARNING: Assuming previous password properties 0 (used for password complexity setting)"
91
92 if args[0] == "show":
93         print "Password informations for domain '" + domain_dn + "'"
94         print ""
95         if pwd_props & DOMAIN_PASSWORD_COMPLEX != 0:
96                 print "Password complexity: on"
97         else:
98                 print "Password complexity: off"
99         print "Password history length: " + str(pwd_hist_len)
100         print "Minimum password length: " + str(min_pwd_len)
101         print "Minimum password age: " + str(min_pwd_age)
102         print "Maximum password age: " + str(max_pwd_age)
103
104 elif args[0] == "set":
105         if opts.complexity is not None:
106                 if opts.complexity == "on":
107                         pwd_props = pwd_props | DOMAIN_PASSWORD_COMPLEX
108
109                         m = ldb.Message()
110                         m.dn = ldb.Dn(samdb, domain_dn)
111                         m["pwdProperties"] = ldb.MessageElement([],
112                           ldb.CHANGETYPE_DELETE, "pwdProperties")
113                         samdb.modify(m)
114                         m["pwdProperties"] = ldb.MessageElement(str(pwd_props),
115                           ldb.CHANGETYPE_ADD, "pwdProperties")
116                         samdb.modify(m)
117                         print "Password complexity activated!"
118                 elif opts.complexity == "off":
119                         pwd_props = pwd_props & (~DOMAIN_PASSWORD_COMPLEX)
120
121                         m = ldb.Message()
122                         m.dn = ldb.Dn(samdb, domain_dn)
123                         m["pwdProperties"] = ldb.MessageElement([],
124                           ldb.CHANGETYPE_DELETE, "pwdProperties")
125                         samdb.modify(m)
126                         m["pwdProperties"] = ldb.MessageElement(str(pwd_props),
127                           ldb.CHANGETYPE_ADD, "pwdProperties")
128                         samdb.modify(m)
129                         print "Password complexity deactivated!"
130                 else:
131                         print "ERROR: Wrong argument '" + opts.complexity + "'!"
132                         sys.exit(1)
133
134         if opts.history_length is not None:
135                 if opts.history_length == "default":
136                         pwd_hist_len = 24
137                 else:
138                         pwd_hist_len = int(opts.history_length)
139
140                 m = ldb.Message()
141                 m.dn = ldb.Dn(samdb, domain_dn)
142                 m["pwdHistoryLength"] = ldb.MessageElement([],
143                   ldb.CHANGETYPE_DELETE, "pwdHistoryLength")
144                 samdb.modify(m)
145                 m["pwdHistoryLength"] = ldb.MessageElement(str(pwd_hist_len),
146                   ldb.CHANGETYPE_ADD, "pwdHistoryLength")
147                 samdb.modify(m)
148                 print "Password history length changed!"
149
150         if opts.min_pwd_length is not None:
151                 if opts.min_pwd_length == "default":
152                         min_pwd_len = 7
153                 else:
154                         min_pwd_len = int(opts.min_pwd_length)
155
156                 m = ldb.Message()
157                 m.dn = ldb.Dn(samdb, domain_dn)
158                 m["minPwdLength"] = ldb.MessageElement([],
159                   ldb.CHANGETYPE_DELETE, "minPwdLength")
160                 samdb.modify(m)
161                 m["minPwdLength"] = ldb.MessageElement(str(min_pwd_len),
162                   ldb.CHANGETYPE_ADD, "minPwdLength")
163                 samdb.modify(m)
164                 print "Minimum password length changed!"
165
166         if opts.min_pwd_age is not None:
167                 if opts.min_pwd_age == "default":
168                         min_pwd_age = 0
169                 else:
170                         min_pwd_age = int(opts.min_pwd_age)
171
172                 m = ldb.Message()
173                 m.dn = ldb.Dn(samdb, domain_dn)
174                 m["minPwdAge"] = ldb.MessageElement([],
175                   ldb.CHANGETYPE_DELETE, "minPwdAge")
176                 samdb.modify(m)
177                 m["minPwdAge"] = ldb.MessageElement(str(min_pwd_age),
178                   ldb.CHANGETYPE_ADD, "minPwdAge")
179                 samdb.modify(m)
180                 print "Minimum password age changed!"
181
182         if opts.max_pwd_age is not None:
183                 if opts.max_pwd_age == "default":
184                         max_pwd_age = -37108517437440
185                 else:
186                         max_pwd_age = int(opts.max_pwd_age)
187
188                 m = ldb.Message()
189                 m.dn = ldb.Dn(samdb, domain_dn)
190                 m["maxPwdAge"] = ldb.MessageElement([],
191                   ldb.CHANGETYPE_DELETE, "maxPwdAge")
192                 samdb.modify(m)
193                 m["maxPwdAge"] = ldb.MessageElement(str(max_pwd_age),
194                   ldb.CHANGETYPE_ADD, "maxPwdAge")
195                 samdb.modify(m)
196                 print "Maximum password age changed!"
197
198         print "All changes applied successfully!"
199
200 else:
201         print "ERROR: Wrong argument '" + args[0] + "'!"
202         sys.exit(1)