3 # Unix SMB/CIFS implementation.
4 # Copyright (C) Amitay Isaacs <amitay@gmail.com> 2012
6 # Upgrade DNS provision from BIND9_FLATFILE to BIND9_DLZ or SAMBA_INTERNAL
8 # This program is free software; you can redistribute it and/or modify
9 # it under the terms of the GNU General Public License as published by
10 # the Free Software Foundation; either version 3 of the License, or
11 # (at your option) any later version.
13 # This program is distributed in the hope that it will be useful,
14 # but WITHOUT ANY WARRANTY; without even the implied warranty of
15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 # GNU General Public License for more details.
18 # You should have received a copy of the GNU General Public License
19 # along with this program. If not, see <http://www.gnu.org/licenses/>.
27 from base64 import b64encode
30 sys.path.insert(0, "bin/python")
34 from samba import param
35 from samba.auth import system_session
36 from samba.ndr import (
39 import samba.getopt as options
40 from samba.upgradehelpers import (
43 from samba.dsdb import DS_DOMAIN_FUNCTION_2003
44 from samba.provision import (
45 find_provision_key_parameters,
48 from samba.provision.common import (
52 from samba.provision.sambadns import (
62 create_dns_partitions,
63 fill_dns_data_partitions,
69 from samba.dcerpc import security
71 import dns.zone, dns.rdatatype
73 __docformat__ = 'restructuredText'
77 """Find system group id for bind9
79 for name in ["bind", "named"]:
81 return grp.getgrnam(name)[2]
87 def convert_dns_rdata(rdata, serial=1):
88 """Convert resource records in dnsRecord format
90 if rdata.rdtype == dns.rdatatype.A:
91 rec = ARecord(rdata.address, serial=serial)
92 elif rdata.rdtype == dns.rdatatype.AAAA:
93 rec = AAAARecord(rdata.address, serial=serial)
94 elif rdata.rdtype == dns.rdatatype.CNAME:
95 rec = CNameRecord(rdata.target.to_text(), serial=serial)
96 elif rdata.rdtype == dns.rdatatype.NS:
97 rec = NSRecord(rdata.target.to_text(), serial=serial)
98 elif rdata.rdtype == dns.rdatatype.SRV:
99 rec = SRVRecord(rdata.target.to_text(), int(rdata.port),
100 priority=int(rdata.priority), weight=int(rdata.weight),
102 elif rdata.rdtype == dns.rdatatype.TXT:
103 slist = shlex.split(rdata.to_text())
104 rec = TXTRecord(slist, serial=serial)
105 elif rdata.rdtype == dns.rdatatype.SOA:
106 rec = SOARecord(rdata.mname.to_text(), rdata.rname.to_text(),
107 serial=int(rdata.serial),
108 refresh=int(rdata.refresh), retry=int(rdata.retry),
109 expire=int(rdata.expire), minimum=int(rdata.minimum))
115 def import_zone_data(samdb, logger, zone, serial, domaindn, forestdn,
116 dnsdomain, dnsforest):
117 """Insert zone data in DNS partitions
119 labels = dnsdomain.split('.')
121 domain_root = dns.name.Name(labels)
122 domain_prefix = "DC=%s,CN=MicrosoftDNS,DC=DomainDnsZones,%s" % (dnsdomain,
125 tmp = "_msdcs.%s" % dnsforest
126 labels = tmp.split('.')
128 forest_root = dns.name.Name(labels)
129 dnsmsdcs = "_msdcs.%s" % dnsforest
130 forest_prefix = "DC=%s,CN=MicrosoftDNS,DC=ForestDnsZones,%s" % (dnsmsdcs,
134 at_record = zone.get_node(domain_root)
135 zone.delete_node(domain_root)
138 rdset = at_record.get_rdataset(dns.rdataclass.IN, dns.rdatatype.SOA)
139 soa_rec = ndr_pack(convert_dns_rdata(rdset[0]))
140 at_record.delete_rdataset(dns.rdataclass.IN, dns.rdatatype.SOA)
143 rdset = at_record.get_rdataset(dns.rdataclass.IN, dns.rdatatype.NS)
144 ns_rec = ndr_pack(convert_dns_rdata(rdset[0]))
145 at_record.delete_rdataset(dns.rdataclass.IN, dns.rdatatype.NS)
149 for rdset in at_record:
151 rec = convert_dns_rdata(r)
152 ip_recs.append(ndr_pack(rec))
154 # Add @ record for domain
155 dns_rec = [soa_rec, ns_rec] + ip_recs
156 msg = ldb.Message(ldb.Dn(samdb, 'DC=@,%s' % domain_prefix))
157 msg["objectClass"] = ["top", "dnsNode"]
158 msg["dnsRecord"] = ldb.MessageElement(dns_rec, ldb.FLAG_MOD_ADD,
163 logger.error("Failed to add @ record for domain")
165 logger.debug("Added @ record for domain")
167 # Add @ record for forest
168 dns_rec = [soa_rec, ns_rec]
169 msg = ldb.Message(ldb.Dn(samdb, 'DC=@,%s' % forest_prefix))
170 msg["objectClass"] = ["top", "dnsNode"]
171 msg["dnsRecord"] = ldb.MessageElement(dns_rec, ldb.FLAG_MOD_ADD,
176 logger.error("Failed to add @ record for forest")
178 logger.debug("Added @ record for forest")
180 # Add remaining records in domain and forest
181 for node in zone.nodes:
182 name = node.relativize(forest_root).to_text()
183 if name == node.to_text():
184 name = node.relativize(domain_root).to_text()
185 dn = "DC=%s,%s" % (name, domain_prefix)
186 fqdn = "%s.%s" % (name, dnsdomain)
188 dn = "DC=%s,%s" % (name, forest_prefix)
189 fqdn = "%s.%s" % (name, dnsmsdcs)
192 for rdataset in zone.nodes[node]:
193 for rdata in rdataset:
194 rec = convert_dns_rdata(rdata, serial)
196 logger.warn("Unsupported record type (%s) for %s, ignoring" %
197 dns.rdatatype.to_text(rdata.rdatatype), name)
199 dns_rec.append(ndr_pack(rec))
201 msg = ldb.Message(ldb.Dn(samdb, dn))
202 msg["objectClass"] = ["top", "dnsNode"]
203 msg["dnsRecord"] = ldb.MessageElement(dns_rec, ldb.FLAG_MOD_ADD,
208 logger.error("Failed to add DNS record %s" % (fqdn))
210 logger.debug("Added DNS record %s" % (fqdn))
212 def cleanup_remove_file(file_path):
216 if e.errno not in [errno.EEXIST, errno.ENOENT]:
219 logger.debug("Could not remove %s: %s" % (file_path, e.strerror))
221 def cleanup_remove_dir(dir_path):
223 for root, dirs, files in os.walk(dir_path, topdown=False):
225 os.remove(os.path.join(root, name))
227 os.rmdir(os.path.join(root, name))
230 if e.errno not in [errno.EEXIST, errno.ENOENT]:
233 logger.debug("Could not delete dir %s: %s" % (dir_path, e.strerror))
235 def cleanup_obsolete_dns_files(paths):
236 cleanup_remove_file(os.path.join(paths.private_dir, "named.conf"))
237 cleanup_remove_file(os.path.join(paths.private_dir, "named.conf.update"))
238 cleanup_remove_file(os.path.join(paths.private_dir, "named.txt"))
240 cleanup_remove_dir(os.path.join(paths.private_dir, "dns"))
243 # dnsprovision creates application partitions for AD based DNS mainly if the existing
244 # provision was created using earlier snapshots of samba4 which did not have support
247 if __name__ == '__main__':
249 # Setup command line parser
250 parser = optparse.OptionParser("upgradedns [options]")
251 sambaopts = options.SambaOptions(parser)
252 credopts = options.CredentialsOptions(parser)
254 parser.add_option_group(options.VersionOptions(parser))
255 parser.add_option_group(sambaopts)
256 parser.add_option_group(credopts)
258 parser.add_option("--dns-backend", type="choice", metavar="<BIND9_DLZ|SAMBA_INTERNAL>",
259 choices=["SAMBA_INTERNAL", "BIND9_DLZ"], default="SAMBA_INTERNAL",
260 help="The DNS server backend, default SAMBA_INTERNAL")
261 parser.add_option("--migrate", type="choice", metavar="<yes|no>",
262 choices=["yes","no"], default="yes",
263 help="Migrate existing zone data, default yes")
264 parser.add_option("--verbose", help="Be verbose", action="store_true")
266 opts = parser.parse_args()[0]
268 if opts.dns_backend is None:
269 opts.dns_backend = 'SAMBA_INTERNAL'
277 logger = logging.getLogger("upgradedns")
278 logger.addHandler(logging.StreamHandler(sys.stdout))
279 logger.setLevel(logging.INFO)
281 logger.setLevel(logging.DEBUG)
283 lp = sambaopts.get_loadparm()
284 lp.load(lp.configfile)
285 creds = credopts.get_credentials(lp)
287 logger.info("Reading domain information")
288 paths = get_paths(param, smbconf=lp.configfile)
289 paths.bind_gid = find_bind_gid()
290 ldbs = get_ldbs(paths, creds, system_session(), lp)
291 names = find_provision_key_parameters(ldbs.sam, ldbs.secrets, ldbs.idmap,
292 paths, lp.configfile, lp)
294 if names.domainlevel < DS_DOMAIN_FUNCTION_2003:
295 logger.error("Cannot create AD based DNS for OS level < 2003")
298 domaindn = names.domaindn
299 forestdn = names.rootdn
301 dnsdomain = names.dnsdomain.lower()
302 dnsforest = dnsdomain
304 site = names.sitename
305 hostname = names.hostname
306 dnsname = '%s.%s' % (hostname, dnsdomain)
308 domainsid = names.domainsid
309 domainguid = names.domainguid
310 ntdsguid = names.ntdsguid
312 # Check for DNS accounts and create them if required
314 msg = ldbs.sam.search(base=domaindn, scope=ldb.SCOPE_DEFAULT,
315 expression='(sAMAccountName=DnsAdmins)',
317 dnsadmins_sid = ndr_unpack(security.dom_sid, msg[0]['objectSid'][0])
319 logger.info("Adding DNS accounts")
320 add_dns_accounts(ldbs.sam, domaindn)
321 dnsadmins_sid = get_dnsadmins_sid(ldbs.sam, domaindn)
323 logger.info("DNS accounts already exist")
325 # Import dns records from zone file
326 if os.path.exists(paths.dns):
327 logger.info("Reading records from zone file %s" % paths.dns)
329 zone = dns.zone.from_file(paths.dns, relativize=False)
330 rrset = zone.get_rdataset("%s." % dnsdomain, dns.rdatatype.SOA)
331 serial = int(rrset[0].serial)
332 except Exception as e:
333 logger.warn("Error parsing DNS data from '%s' (%s)" % (paths.dns, str(e)))
334 logger.warn("DNS records will be automatically created")
337 logger.info("No zone file %s" % paths.dns)
338 logger.warn("DNS records will be automatically created")
341 # Create DNS partitions if missing and fill DNS information
343 expression = '(|(dnsRoot=DomainDnsZones.%s)(dnsRoot=ForestDnsZones.%s))' % \
344 (dnsdomain, dnsforest)
345 msg = ldbs.sam.search(base=names.configdn, scope=ldb.SCOPE_DEFAULT,
346 expression=expression, attrs=['nCName'])
347 ncname = msg[0]['nCName'][0]
349 logger.info("Creating DNS partitions")
351 logger.info("Looking up IPv4 addresses")
352 hostip = interface_ips_v4(lp)
354 hostip.remove('127.0.0.1')
358 logger.error("No IPv4 addresses found")
362 logger.debug("IPv4 addresses: %s" % hostip)
364 logger.info("Looking up IPv6 addresses")
365 hostip6 = interface_ips_v6(lp)
370 logger.debug("IPv6 addresses: %s" % hostip6)
372 create_dns_partitions(ldbs.sam, domainsid, names, domaindn, forestdn,
373 dnsadmins_sid, FILL_FULL)
375 logger.info("Populating DNS partitions")
376 fill_dns_data_partitions(ldbs.sam, domainsid, site, domaindn, forestdn,
377 dnsdomain, dnsforest, hostname, hostip, hostip6,
378 domainguid, ntdsguid, dnsadmins_sid,
382 logger.info("Importing records from zone file")
383 import_zone_data(ldbs.sam, logger, zone, serial, domaindn, forestdn,
384 dnsdomain, dnsforest)
386 logger.info("DNS partitions already exist")
388 # Mark that we are hosting DNS partitions
390 dns_nclist = [ 'DC=DomainDnsZones,%s' % domaindn,
391 'DC=ForestDnsZones,%s' % forestdn ]
393 msgs = ldbs.sam.search(base=names.serverdn, scope=ldb.SCOPE_DEFAULT,
394 expression='(objectclass=nTDSDSa)',
395 attrs=['hasPartialReplicaNCs',
396 'msDS-hasMasterNCs'])
400 ncs = msg.get("msDS-hasMasterNCs")
403 master_nclist.append(str(nc))
406 ncs = msg.get("hasPartialReplicaNCs")
409 partial_nclist.append(str(nc))
411 modified_master = False
412 modified_partial = False
414 for nc in dns_nclist:
415 if nc not in master_nclist:
416 master_nclist.append(nc)
417 modified_master = True
418 if nc in partial_nclist:
419 partial_nclist.remove(nc)
420 modified_partial = True
422 if modified_master or modified_partial:
423 logger.debug("Updating msDS-hasMasterNCs and hasPartialReplicaNCs attributes")
427 m["msDS-hasMasterNCs"] = ldb.MessageElement(master_nclist,
428 ldb.FLAG_MOD_REPLACE,
432 m["hasPartialReplicaNCs"] = ldb.MessageElement(partial_nclist,
433 ldb.FLAG_MOD_REPLACE,
434 "hasPartialReplicaNCs")
436 m["hasPartialReplicaNCs"] = ldb.MessageElement(ncs,
438 "hasPartialReplicaNCs")
443 # Special stuff for DLZ backend
444 if opts.dns_backend == "BIND9_DLZ":
445 config_migration = False
447 if (paths.private_dir != paths.binddns_dir and
448 os.path.isfile(os.path.join(paths.private_dir, "named.conf"))):
449 config_migration = True
451 # Check if dns-HOSTNAME account exists and create it if required
452 secrets_msgs = ldbs.secrets.search(expression='(samAccountName=dns-%s)' % hostname, attrs=['secret'])
453 msg = ldbs.sam.search(base=domaindn, scope=ldb.SCOPE_DEFAULT,
454 expression='(sAMAccountName=dns-%s)' % (hostname),
457 if len(secrets_msgs) == 0 or len(msg) == 0:
458 logger.info("Adding dns-%s account" % hostname)
460 if len(secrets_msgs) == 1:
461 dn = secrets_msgs[0].dn
462 ldbs.secrets.delete(dn)
468 dnspass = samba.generate_random_password(128, 255)
469 setup_add_ldif(ldbs.sam, setup_path("provision_dns_add_samba.ldif"), {
470 "DNSDOMAIN": dnsdomain,
471 "DOMAINDN": domaindn,
472 "DNSPASS_B64": b64encode(dnspass.encode('utf-16-le')).decode('utf8'),
473 "HOSTNAME" : hostname,
474 "DNSNAME" : dnsname }
477 res = ldbs.sam.search(base=domaindn, scope=ldb.SCOPE_DEFAULT,
478 expression='(sAMAccountName=dns-%s)' % (hostname),
479 attrs=["msDS-KeyVersionNumber"])
480 if "msDS-KeyVersionNumber" in res[0]:
481 dns_key_version_number = int(res[0]["msDS-KeyVersionNumber"][0])
483 dns_key_version_number = None
485 secretsdb_setup_dns(ldbs.secrets, names,
486 paths.private_dir, paths.binddns_dir, realm=names.realm,
487 dnsdomain=names.dnsdomain,
488 dns_keytab_path=paths.dns_keytab, dnspass=dnspass,
489 key_version_number=dns_key_version_number)
492 logger.info("dns-%s account already exists" % hostname)
494 private_dns_keytab_path = os.path.join(paths.private_dir, paths.dns_keytab)
495 bind_dns_keytab_path = os.path.join(paths.binddns_dir, paths.dns_keytab)
497 if os.path.isfile(private_dns_keytab_path):
498 if os.path.isfile(bind_dns_keytab_path):
500 os.unlink(bind_dns_keytab_path)
502 logger.error("Failed to remove %s: %s" %
503 (bind_dns_keytab_path, e.strerror))
505 # link the dns.keytab to the bind-dns directory
507 os.link(private_dns_keytab_path, bind_dns_keytab_path)
509 logger.error("Failed to create link %s -> %s: %s" %
510 (private_dns_keytab_path, bind_dns_keytab_path, e.strerror))
512 # chown the dns.keytab in the bind-dns directory
513 if paths.bind_gid is not None:
515 os.chmod(paths.binddns_dir, 0o770)
516 os.chown(paths.binddns_dir, -1, paths.bind_gid)
518 if 'SAMBA_SELFTEST' not in os.environ:
519 logger.info("Failed to chown %s to bind gid %u",
520 paths.binddns_dir, paths.bind_gid)
522 os.chmod(bind_dns_keytab_path, 0o640)
523 os.chown(bind_dns_keytab_path, -1, paths.bind_gid)
525 if 'SAMBA_SELFTEST' not in os.environ:
526 logger.info("Failed to chown %s to bind gid %u",
527 bind_dns_keytab_path, paths.bind_gid)
530 # This forces a re-creation of dns directory and all the files within
531 # It's an overkill, but it's easier to re-create a samdb copy, rather
532 # than trying to fix a broken copy.
533 create_dns_dir(logger, paths)
535 # Setup a copy of SAM for BIND9
536 create_samdb_copy(ldbs.sam, logger, paths, names, domainsid,
539 create_named_conf(paths, names.realm, dnsdomain, opts.dns_backend, logger)
541 create_named_txt(paths.namedtxt, names.realm, dnsdomain, dnsname,
542 paths.binddns_dir, paths.dns_keytab)
544 cleanup_obsolete_dns_files(paths)
547 logger.info("ATTENTION: The BIND configuration and keytab has been moved to: %s",
549 logger.info(" Please update your BIND configuration accordingly.")
551 logger.info("See %s for an example configuration include file for BIND", paths.namedconf)
552 logger.info("and %s for further documentation required for secure DNS "
553 "updates", paths.namedtxt)
555 elif opts.dns_backend == "SAMBA_INTERNAL":
556 # Make sure to remove everything from the bind-dns directory to avoid
557 # possible security issues with the named group having write access
559 cleanup_remove_file(os.path.join(paths.binddns_dir, "dns.keytab"))
560 cleanup_remove_file(os.path.join(paths.binddns_dir, "named.conf"))
561 cleanup_remove_file(os.path.join(paths.binddns_dir, "named.conf.update"))
562 cleanup_remove_file(os.path.join(paths.binddns_dir, "named.txt"))
564 cleanup_remove_dir(os.path.dirname(paths.dns))
567 os.chmod(paths.private_dir, 0o700)
568 os.chown(paths.private_dir, -1, 0)
570 logger.warn("Failed to restore owner and permissions for %s",
573 # Check if dns-HOSTNAME account exists and delete it if required
575 dn_str = 'samAccountName=dns-%s,CN=Principals' % hostname
576 msg = ldbs.secrets.search(expression='(dn=%s)' % dn_str, attrs=[])
583 ldbs.secrets.delete(dn)
585 logger.info("Failed to delete %s from secrets.ldb" % dn)
588 msg = ldbs.sam.search(base=domaindn, scope=ldb.SCOPE_DEFAULT,
589 expression='(sAMAccountName=dns-%s)' % (hostname),
599 logger.info("Failed to delete %s from sam.ldb" % dn)
601 logger.info("Finished upgrading DNS")
603 services = lp.get("server services")
604 for service in services:
606 if opts.dns_backend.startswith("BIND"):
607 logger.info("You have switched to using %s as your dns backend,"
608 " but still have the internal dns starting. Please"
609 " make sure you add '-dns' to your server services"
610 " line in your smb.conf." % opts.dns_backend)
613 if opts.dns_backend == "SAMBA_INTERNAL":
614 logger.info("You have switched to using %s as your dns backend,"
615 " but you still have samba starting looking for a"
616 " BIND backend. Please remove the -dns from your"
617 " server services line." % opts.dns_backend)