import registry
import samba
import subprocess
+import ldb
import shutil
from credentials import Credentials, DONT_USE_KERBEROS
-from auth import system_session
+from auth import system_session, admin_session
from samba import version, Ldb, substitute_var, valid_netbios_name, check_all_substituted, \
DS_BEHAVIOR_WIN2008
from samba.samdb import SamDB
self.memberofconf = None
self.fedoradsinf = None
self.fedoradspartitions = None
+ self.fedoradssasl = None
self.olmmron = None
self.olmmrserveridsconf = None
self.olmmrsyncreplconf = None
self.domaindn = None
self.configdn = None
self.schemadn = None
+ self.sambadn = None
self.ldapmanagerdn = None
self.dnsdomain = None
self.realm = None
class Schema(object):
def __init__(self, setup_path, schemadn=None,
- serverdn=None):
+ serverdn=None, sambadn=None, ldap_backend_type=None):
"""Load schema for the SamDB from the AD schema files and samba4_schema.ldif
:param samdb: Load a schema into a SamDB.
"fedorads.inf")
paths.fedoradspartitions = os.path.join(paths.ldapdir,
"fedorads-partitions.ldif")
+ paths.fedoradssasl = os.path.join(paths.ldapdir,
+ "fedorads-sasl.ldif")
+ paths.fedoradssamba = os.path.join(paths.ldapdir,
+ "fedorads-samba.ldif")
paths.olmmrserveridsconf = os.path.join(paths.ldapdir,
"mmr_serverids.conf")
paths.olmmrsyncreplconf = os.path.join(paths.ldapdir,
return paths
-def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None, serverrole=None,
- rootdn=None, domaindn=None, configdn=None, schemadn=None, serverdn=None,
- sitename=None):
+def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None,
+ serverrole=None, rootdn=None, domaindn=None, configdn=None,
+ schemadn=None, serverdn=None, sitename=None, sambadn=None):
"""Guess configuration settings to use."""
if hostname is None:
configdn = "CN=Configuration," + rootdn
if schemadn is None:
schemadn = "CN=Schema," + configdn
+ if sambadn is None:
+ sambadn = "CN=Samba"
if sitename is None:
sitename=DEFAULTSITE
names.domaindn = domaindn
names.configdn = configdn
names.schemadn = schemadn
+ names.sambadn = sambadn
names.ldapmanagerdn = "CN=Manager," + rootdn
names.dnsdomain = dnsdomain
names.domain = domain
"objectclass",
"samldb",
"password_hash",
- "operational"]
+ "operational",
+ "kludge_acl"]
tdb_modules_list = [
"subtree_rename",
"subtree_delete",
"linked_attributes",
"extended_dn_out_ldb"]
modules_list2 = ["show_deleted",
- "kludge_acl",
"partition"]
domaindn_ldb = "users.ldb"
ldap_backend=ldap_backend, serverrole=serverrole)
if (schema == None):
- schema = Schema(setup_path, schemadn=names.schemadn, serverdn=names.serverdn)
+ schema = Schema(setup_path, schemadn=names.schemadn, serverdn=names.serverdn,
+ sambadn=names.sambadn, ldap_backend_type=ldap_backend.ldap_backend_type)
# Load the database, but importantly, use Ldb not SamDB as we don't want to load the global schema
samdb = Ldb(session_info=session_info,
else:
domain_oc = "samba4LocalDomain"
+#impersonate domain admin
+ admin_session_info = admin_session(lp, str(domainsid))
+ samdb.set_session_info(admin_session_info)
+
setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
"DOMAINDN": names.domaindn,
"DOMAIN_OC": domain_oc
dnspass=dnspass,
machinepass=machinepass,
domainsid=domainsid, policyguid=policyguid,
- setup_path=setup_path, domainControllerFunctionality=domainControllerFunctionality)
+ setup_path=setup_path,
+ domainControllerFunctionality=domainControllerFunctionality)
except:
samdb.transaction_cancel()
def provision(setup_dir, message, session_info,
- credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL, realm=None,
+ credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL,
+ realm=None,
rootdn=None, domaindn=None, schemadn=None, configdn=None,
serverdn=None,
domain=None, hostname=None, hostip=None, hostip6=None,
policyguid=None, invocationid=None, machinepass=None,
dnspass=None, root=None, nobody=None, users=None,
wheel=None, backup=None, aci=None, serverrole=None,
- ldap_backend_extra_port=None, ldap_backend_type=None, sitename=None,
+ ldap_backend_extra_port=None, ldap_backend_type=None,
+ sitename=None,
ol_mmr_urls=None, ol_olc=None,
setup_ds_path=None, slapd_path=None, nosync=False,
ldap_dryrun_mode=False):
ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
- schema = Schema(setup_path, schemadn=names.schemadn, serverdn=names.serverdn)
+ schema = Schema(setup_path, schemadn=names.schemadn, serverdn=names.serverdn,
+ sambadn=names.sambadn, ldap_backend_type=ldap_backend_type)
+ secrets_credentials = credentials
provision_backend = None
if ldap_backend_type:
# We only support an LDAP backend over ldapi://
- provision_backend = ProvisionBackend(paths=paths, setup_path=setup_path, lp=lp, credentials=credentials,
+ provision_backend = ProvisionBackend(paths=paths, setup_path=setup_path,
+ lp=lp, credentials=credentials,
names=names,
- message=message, hostname=hostname,
- root=root, schema=schema, ldap_backend_type=ldap_backend_type,
+ message=message, hostname=hostname,
+ root=root, schema=schema,
+ ldap_backend_type=ldap_backend_type,
ldapadminpass=ldapadminpass,
ldap_backend_extra_port=ldap_backend_extra_port,
ol_mmr_urls=ol_mmr_urls,
# Now use the backend credentials to access the databases
credentials = provision_backend.credentials
+ secrets_credentials = provision_backend.adminCredentials
+ ldapi_url = provision_backend.ldapi_uri
# only install a new shares config db if there is none
if not os.path.exists(paths.shareconf):
message("Setting up secrets.ldb")
secrets_ldb = setup_secretsdb(paths.secrets, setup_path,
session_info=session_info,
- credentials=credentials, lp=lp)
+ credentials=secrets_credentials, lp=lp)
message("Setting up the registry")
setup_registry(paths.hklm, setup_path, session_info,
if serverrole == "domain controller":
secrets_ldb = Ldb(paths.secrets, session_info=session_info,
credentials=credentials, lp=lp)
- secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
- netbiosname=names.netbiosname, domainsid=domainsid,
- keytab_path=paths.keytab, samdb_url=paths.samdb,
- dns_keytab_path=paths.dns_keytab, dnspass=dnspass,
- machinepass=machinepass, dnsdomain=names.dnsdomain)
+ secretsdb_become_dc(secrets_ldb, setup_path, domain=domain,
+ realm=names.realm,
+ netbiosname=names.netbiosname,
+ domainsid=domainsid,
+ keytab_path=paths.keytab, samdb_url=paths.samdb,
+ dns_keytab_path=paths.dns_keytab,
+ dnspass=dnspass, machinepass=machinepass,
+ dnsdomain=names.dnsdomain)
domainguid = samdb.searchone(basedn=domaindn, attribute="objectGUID")
assert isinstance(domainguid, str)
message("See %s for an example configuration include file for BIND" % paths.namedconf)
message("and %s for further documentation required for secure DNS updates" % paths.namedtxt)
- create_krb5_conf(paths.krb5conf, setup_path, dnsdomain=names.dnsdomain,
- hostname=names.hostname, realm=names.realm)
+ create_krb5_conf(paths.krb5conf, setup_path,
+ dnsdomain=names.dnsdomain, hostname=names.hostname,
+ realm=names.realm)
message("A Kerberos configuration suitable for Samba 4 has been generated at %s" % paths.krb5conf)
- # if backend is openldap, terminate slapd after final provision and check its proper termination
- if provision_backend is not None and provision_backend.slapd is not None:
- if provision_backend.slapd.poll() is None:
- #Kill the slapd
- if hasattr(provision_backend.slapd, "terminate"):
- provision_backend.slapd.terminate()
- else:
- import signal
- os.kill(provision_backend.slapd.pid, signal.SIGTERM)
+ if provision_backend is not None:
+ if ldap_backend_type == "fedora-ds":
+ ldapi_db = Ldb(provision_backend.ldapi_uri, lp=lp, credentials=credentials)
+
+ # delete default SASL mappings
+ res = ldapi_db.search(expression="(!(cn=samba-admin mapping))", base="cn=mapping,cn=sasl,cn=config", scope=SCOPE_ONELEVEL, attrs=["dn"])
+
+ # configure in-directory access control on Fedora DS via the aci attribute (over a direct ldapi:// socket)
+ for i in range (0, len(res)):
+ dn = str(res[i]["dn"])
+ ldapi_db.delete(dn)
+
+ aci = """(targetattr = "*") (version 3.0;acl "full access to all by samba-admin";allow (all)(userdn = "ldap:///CN=samba-admin,%s");)""" % names.sambadn
+
+ m = ldb.Message()
+ m["aci"] = ldb.MessageElement([aci], ldb.FLAG_MOD_REPLACE, "aci")
+
+ m.dn = ldb.Dn(1, names.domaindn)
+ ldapi_db.modify(m)
+
+ m.dn = ldb.Dn(1, names.configdn)
+ ldapi_db.modify(m)
+
+ m.dn = ldb.Dn(1, names.schemadn)
+ ldapi_db.modify(m)
+
+ # if an LDAP backend is in use, terminate slapd after final provision and check its proper termination
+ if provision_backend.slapd.poll() is None:
+ #Kill the slapd
+ if hasattr(provision_backend.slapd, "terminate"):
+ provision_backend.slapd.terminate()
+ else:
+ # Older python versions don't have .terminate()
+ import signal
+ os.kill(provision_backend.slapd.pid, signal.SIGTERM)
- #and now wait for it to die
- provision_backend.slapd.communicate()
+ #and now wait for it to die
+ provision_backend.slapd.communicate()
# now display slapd_command_file.txt to show how slapd must be started next time
message("Use later the following commandline to start slapd, then Samba:")
def provision_become_dc(setup_dir=None,
smbconf=None, targetdir=None, realm=None,
- rootdn=None, domaindn=None, schemadn=None, configdn=None,
- serverdn=None,
+ rootdn=None, domaindn=None, schemadn=None,
+ configdn=None, serverdn=None,
domain=None, hostname=None, domainsid=None,
adminpass=None, krbtgtpass=None, domainguid=None,
policyguid=None, invocationid=None, machinepass=None,
dnspass=None, root=None, nobody=None, users=None,
wheel=None, backup=None, serverrole=None,
- ldap_backend=None, ldap_backend_type=None, sitename=None, debuglevel=1):
+ ldap_backend=None, ldap_backend_type=None,
+ sitename=None, debuglevel=1):
def message(text):
"""print a message if quiet is not set."""
glue.set_debug_level(debuglevel)
return provision(setup_dir, message, system_session(), None,
- smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS, realm=realm,
- rootdn=rootdn, domaindn=domaindn, schemadn=schemadn, configdn=configdn, serverdn=serverdn,
- domain=domain, hostname=hostname, hostip="127.0.0.1", domainsid=domainsid, machinepass=machinepass, serverrole="domain controller", sitename=sitename)
-
+ smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS,
+ realm=realm, rootdn=rootdn, domaindn=domaindn, schemadn=schemadn,
+ configdn=configdn, serverdn=serverdn, domain=domain,
+ hostname=hostname, hostip="127.0.0.1", domainsid=domainsid,
+ machinepass=machinepass, serverrole="domain controller",
+ sitename=sitename)
+
def setup_db_config(setup_path, dbdir):
"""Setup a Berkeley database.
self.credentials.guess(lp)
#Kerberos to an ldapi:// backend makes no sense
self.credentials.set_kerberos_state(DONT_USE_KERBEROS)
+
+ self.adminCredentials = Credentials()
+ self.adminCredentials.guess(lp)
+ #Kerberos to an ldapi:// backend makes no sense
+ self.adminCredentials.set_kerberos_state(DONT_USE_KERBEROS)
+
self.ldap_backend_type = ldap_backend_type
if ldap_backend_type == "fedora-ds":
- provision_fds_backend(self, paths=paths, setup_path=setup_path, names=names, message=message,
- hostname=hostname, ldapadminpass=ldapadminpass, root=root,
- schema=schema, ldap_backend_extra_port=ldap_backend_extra_port,
- setup_ds_path=setup_ds_path, slapd_path=slapd_path,
- nosync=nosync, ldap_dryrun_mode=ldap_dryrun_mode)
+ provision_fds_backend(self, paths=paths, setup_path=setup_path,
+ names=names, message=message,
+ hostname=hostname,
+ ldapadminpass=ldapadminpass, root=root,
+ schema=schema,
+ ldap_backend_extra_port=ldap_backend_extra_port,
+ setup_ds_path=setup_ds_path,
+ slapd_path=slapd_path,
+ nosync=nosync,
+ ldap_dryrun_mode=ldap_dryrun_mode)
elif ldap_backend_type == "openldap":
- provision_openldap_backend(self, paths=paths, setup_path=setup_path, names=names, message=message,
- hostname=hostname, ldapadminpass=ldapadminpass, root=root,
- schema=schema, ldap_backend_extra_port=ldap_backend_extra_port,
+ provision_openldap_backend(self, paths=paths, setup_path=setup_path,
+ names=names, message=message,
+ hostname=hostname,
+ ldapadminpass=ldapadminpass, root=root,
+ schema=schema,
+ ldap_backend_extra_port=ldap_backend_extra_port,
ol_mmr_urls=ol_mmr_urls,
slapd_path=slapd_path,
- nosync=nosync, ldap_dryrun_mode=ldap_dryrun_mode)
+ nosync=nosync,
+ ldap_dryrun_mode=ldap_dryrun_mode)
else:
raise ProvisioningError("Unknown LDAP backend type selected")
self.credentials.set_password(ldapadminpass)
+ self.adminCredentials.set_username("samba-admin")
+ self.adminCredentials.set_password(ldapadminpass)
# Now start the slapd, so we can provision onto it. We keep the
# subprocess context around, to kill this off at the successful
raise ProvisioningError("slapd died before we could make a connection to it")
-def provision_openldap_backend(result, paths=None, setup_path=None, names=None, message=None,
+def provision_openldap_backend(result, paths=None, setup_path=None, names=None,
+ message=None,
hostname=None, ldapadminpass=None, root=None,
schema=None,
ldap_backend_extra_port=None,
os.remove(paths.slapdconf)
-def provision_fds_backend(result, paths=None, setup_path=None, names=None, message=None,
+def provision_fds_backend(result, paths=None, setup_path=None, names=None,
+ message=None,
hostname=None, ldapadminpass=None, root=None,
schema=None,
ldap_backend_extra_port=None,
setup_file(setup_path("fedorads-partitions.ldif"), paths.fedoradspartitions,
{"CONFIGDN": names.configdn,
"SCHEMADN": names.schemadn,
+ "SAMBADN": names.sambadn,
+ })
+
+ setup_file(setup_path("fedorads-sasl.ldif"), paths.fedoradssasl,
+ {"SAMBADN": names.sambadn,
+ })
+
+ setup_file(setup_path("fedorads-samba.ldif"), paths.fedoradssamba,
+ {"SAMBADN": names.sambadn,
+ "LDAPADMINPASS": ldapadminpass
})
mapping = "schema-map-fedora-ds-1.0"
if retcode != 0:
raise ProvisioningError("setup-ds failed")
+ # Load samba-admin
+ retcode = subprocess.call([
+ os.path.join(paths.ldapdir, "slapd-samba4", "ldif2db"), "-s", names.sambadn, "-i", paths.fedoradssamba],
+ close_fds=True, shell=False)
+ if retcode != 0:
+ raise("ldib2db failed")
+
def create_phpldapadmin_config(path, setup_path, ldapi_uri):
"""Create a PHP LDAP admin configuration file.
def create_zone_file(path, setup_path, dnsdomain, domaindn,
- hostip, hostip6, hostname, dnspass, realm, domainguid, hostguid):
+ hostip, hostip6, hostname, dnspass, realm, domainguid,
+ hostguid):
"""Write out a DNS zone file, from the info in the current database.
:param path: Path of the new zone file.
})
-
git.samba.org / ira / wip.git / blobdiff