2 backend code for provisioning a Samba4 server
3 Copyright Andrew Tridgell 2005
4 Released under the GNU GPL v2 or later
7 /* used to generate sequence numbers for records */
8 provision_next_usn = 1;
13 return true if the current install seems to be OK
17 var lp = loadparm_init();
19 if (lp.get("realm") == "") {
22 var ok = ldb.connect(lp.get("sam database"));
26 var res = ldb.search("(name=Administrator)");
27 if (res.length != 1) {
34 find a user or group from a list of possibilities
39 assert(arguments.length >= 2);
40 var nssfn = arguments[0];
41 for (i=1;i<arguments.length;i++) {
42 if (nssfn(arguments[i]) != undefined) {
46 printf("Unable to find user/group for %s\n", arguments[1]);
47 assert(i<arguments.length);
51 add a foreign security principle
53 function add_foreign(str, sid, desc, unixname)
56 dn: CN=${SID},CN=ForeignSecurityPrincipals,${BASEDN}
58 objectClass: foreignSecurityPrincipal
62 whenCreated: ${LDAPTIME}
63 whenChanged: ${LDAPTIME}
66 showInAdvancedViewOnly: TRUE
68 objectGUID: ${NEWGUID}
70 objectCategory: CN=Foreign-Security-Principal,CN=Schema,CN=Configuration,${BASEDN}
73 var sub = new Object();
76 sub.UNIXNAME = unixname;
77 return str + substitute_var(add, sub);
81 return current time as a nt time string
85 return "" + sys.nttime();
89 return current time as a ldap time string
93 return sys.ldaptime(sys.nttime());
97 return a date string suitable for a dns zone serial number
101 var t = sys.gmtime(sys.nttime());
102 return sprintf("%04u%02u%02u%02u",
103 t.tm_year+1900, t.tm_mon+1, t.tm_mday, t.tm_hour);
111 var list = sys.interfaces();
116 return current time as a ldap time string
120 provision_next_usn = provision_next_usn+1;
121 return provision_next_usn;
125 return first part of hostname
129 var s = split(".", sys.hostname());
135 erase an ldb, removing all records
137 function ldb_erase(ldb)
139 var attrs = new Array("dn");
141 /* delete the specials */
142 ldb.del("@INDEXLIST");
143 ldb.del("@ATTRIBUTES");
144 ldb.del("@SUBCLASSES");
148 var res = ldb.search("(|(objectclass=*)(dn=*))", attrs);
150 for (i=0;i<res.length;i++) {
153 res = ldb.search("(objectclass=*)", attrs);
154 assert(res.length == 0);
159 setup a ldb in the private dir
161 function setup_ldb(ldif, dbname, subobj)
164 var ldb = ldb_init();
165 var lp = loadparm_init();
167 if (arguments.length == 4) {
168 extra = arguments[3];
172 var src = lp.get("setup directory") + "/" + ldif;
174 var data = sys.file_load(src);
176 data = substitute_var(data, subobj);
178 var ok = ldb.connect(dbfile);
188 setup a file in the private dir
190 function setup_file(template, fname, subobj)
192 var lp = loadparm_init();
194 var src = lp.get("setup directory") + "/" + template;
198 var data = sys.file_load(src);
199 data = substitute_var(data, subobj);
201 ok = sys.file_save(f, data);
206 provision samba4 - caution, this wipes all existing data!
208 function provision(subobj, message)
211 var lp = loadparm_init();
212 var sys = sys_init();
213 var smbconf = lp.get("config file");
216 some options need to be upper/lower case
218 subobj.REALM = strlower(subobj.REALM);
219 subobj.HOSTNAME = strlower(subobj.HOSTNAME);
220 subobj.DOMAIN = strupper(subobj.DOMAIN);
221 subobj.NETBIOSNAME = strupper(subobj.HOSTNAME);
223 data = add_foreign(data, "S-1-5-7", "Anonymous", "${NOBODY}");
224 data = add_foreign(data, "S-1-1-0", "World", "${NOGROUP}");
225 data = add_foreign(data, "S-1-5-2", "Network", "${NOGROUP}");
226 data = add_foreign(data, "S-1-5-18", "System", "${ROOT}");
227 data = add_foreign(data, "S-1-5-11", "Authenticated Users", "${USERS}");
229 provision_next_usn = 1;
231 /* only install a new smb.conf if there isn't one there already */
232 var st = sys.stat(smbconf);
233 if (st == undefined) {
234 message("Setting up smb.conf\n");
235 setup_file("provision.smb.conf", smbconf, subobj);
238 message("Setting up hklm.ldb\n");
239 setup_ldb("hklm.ldif", "hklm.ldb", subobj);
240 message("Setting up sam.ldb\n");
241 setup_ldb("provision.ldif", "sam.ldb", subobj, data);
242 message("Setting up rootdse.ldb\n");
243 setup_ldb("rootdse.ldif", "rootdse.ldb", subobj);
244 message("Setting up secrets.ldb\n");
245 setup_ldb("secrets.ldif", "secrets.ldb", subobj);
246 message("Setting up DNS zone file\n");
247 setup_file("provision.zone",
248 lp.get("private dir") + "/" + subobj.DNSDOMAIN + ".zone",
253 guess reasonably default options for provisioning
255 function provision_guess()
257 var subobj = new Object();
258 var nss = nss_init();
259 var lp = loadparm_init();
262 subobj.REALM = lp.get("realm");
263 subobj.DOMAIN = lp.get("workgroup");
264 subobj.HOSTNAME = hostname();
266 assert(subobj.REALM);
267 assert(subobj.DOMAIN);
268 assert(subobj.HOSTNAME);
270 subobj.HOSTIP = hostip();
271 subobj.DOMAINGUID = randguid();
272 subobj.DOMAINSID = randsid();
273 subobj.HOSTGUID = randguid();
274 subobj.INVOCATIONID = randguid();
275 subobj.KRBTGTPASS = randpass(12);
276 subobj.MACHINEPASS = randpass(12);
277 subobj.ADMINPASS = randpass(12);
278 subobj.DEFAULTSITE = "Default-First-Site-Name";
279 subobj.NEWGUID = randguid;
280 subobj.NTTIME = nttime;
281 subobj.LDAPTIME = ldaptime;
282 subobj.DATESTRING = datestring;
283 subobj.USN = nextusn;
284 subobj.ROOT = findnss(nss.getpwnam, "root");
285 subobj.NOBODY = findnss(nss.getpwnam, "nobody");
286 subobj.NOGROUP = findnss(nss.getgrnam, "nogroup", "nobody");
287 subobj.WHEEL = findnss(nss.getgrnam, "wheel", "root");
288 subobj.USERS = findnss(nss.getgrnam, "users", "guest", "other");
289 subobj.DNSDOMAIN = strlower(subobj.REALM);
290 subobj.DNSNAME = sprintf("%s.%s",
291 strlower(subobj.HOSTNAME),
293 subobj.BASEDN = "DC=" + join(",DC=", split(".", subobj.REALM));
298 search for one attribute as a string
300 function searchone(ldb, expression, attribute)
302 var attrs = new Array(attribute);
303 res = ldb.search(expression, attrs);
304 if (res.length != 1 ||
305 res[0][attribute] == undefined) {
308 return res[0][attribute];
312 add a new user record
314 function newuser(username, unixname, password, message)
316 var lp = loadparm_init();
317 var samdb = lp.get("sam database");
318 var ldb = ldb_init();
321 /* connect to the sam */
322 var ok = ldb.connect(samdb);
325 /* find the DNs for the domain and the domain users group */
326 var domain_dn = searchone(ldb, "objectClass=domainDNS", "dn");
327 assert(domain_dn != undefined);
328 var dom_users = searchone(ldb, "name=Domain Users", "dn");
329 assert(dom_users != undefined);
331 var user_dn = sprintf("CN=%s,CN=Users,%s", username, domain_dn);
335 the new user record. note the reliance on the samdb module to fill
348 user_dn, username, username, dom_users,
349 unixname, randguid(), password);
351 add the user to the users group as well
353 var modgroup = sprintf("
365 message("Adding user %s\n", user_dn);
368 message("Failed to add %s - %s\n", user_dn, ldb.errstring());
372 message("Modifying group %s\n", dom_users);
373 ok = ldb.modify(modgroup);
375 message("Failed to modify %s - %s\n", dom_users, ldb.errstring());