2 Samba Unix/Linux SMB client library
3 Distributed SMB/CIFS Server Management Utility
4 Copyright (C) 2001 Andrew Bartlett (abartlet@samba.org)
5 Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
6 Copyright (C) 2004,2008 Guenther Deschner (gd@samba.org)
7 Copyright (C) 2005 Jeremy Allison (jra@samba.org)
8 Copyright (C) 2006 Jelmer Vernooij (jelmer@samba.org)
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>. */
24 #include "utils/net.h"
25 #include "../libcli/auth/libcli_auth.h"
27 static int net_mode_share;
28 static bool sync_files(struct copy_clistate *cp_clistate, const char *mask);
33 * @brief RPC based subcommands for the 'net' utility.
35 * This file should contain much of the functionality that used to
36 * be found in rpcclient, execpt that the commands should change
37 * less often, and the fucntionality should be sane (the user is not
38 * expected to know a rid/sid before they conduct an operation etc.)
40 * @todo Perhaps eventually these should be split out into a number
41 * of files, as this could get quite big.
46 * Many of the RPC functions need the domain sid. This function gets
47 * it at the start of every run
49 * @param cli A cli_state already connected to the remote machine
51 * @return The Domain SID of the remote machine.
54 NTSTATUS net_get_remote_domain_sid(struct cli_state *cli, TALLOC_CTX *mem_ctx,
56 const char **domain_name)
58 struct rpc_pipe_client *lsa_pipe = NULL;
59 struct policy_handle pol;
60 NTSTATUS result = NT_STATUS_OK;
61 union lsa_PolicyInformation *info = NULL;
63 result = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
65 if (!NT_STATUS_IS_OK(result)) {
66 d_fprintf(stderr, _("Could not initialise lsa pipe\n"));
70 result = rpccli_lsa_open_policy(lsa_pipe, mem_ctx, false,
71 SEC_FLAG_MAXIMUM_ALLOWED,
73 if (!NT_STATUS_IS_OK(result)) {
74 d_fprintf(stderr, _("open_policy failed: %s\n"),
79 result = rpccli_lsa_QueryInfoPolicy(lsa_pipe, mem_ctx,
81 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
83 if (!NT_STATUS_IS_OK(result)) {
84 d_fprintf(stderr, _("lsaquery failed: %s\n"),
89 *domain_name = info->account_domain.name.string;
90 *domain_sid = info->account_domain.sid;
92 rpccli_lsa_Close(lsa_pipe, mem_ctx, &pol);
93 TALLOC_FREE(lsa_pipe);
99 * Run a single RPC command, from start to finish.
101 * @param pipe_name the pipe to connect to (usually a PIPE_ constant)
102 * @param conn_flag a NET_FLAG_ combination. Passed to
103 * net_make_ipc_connection.
104 * @param argc Standard main() style argc.
105 * @param argv Standard main() style argv. Initial components are already
107 * @return A shell status integer (0 for success).
110 int run_rpc_command(struct net_context *c,
111 struct cli_state *cli_arg,
112 const struct ndr_syntax_id *interface,
118 struct cli_state *cli = NULL;
119 struct rpc_pipe_client *pipe_hnd = NULL;
123 const char *domain_name;
126 /* make use of cli_state handed over as an argument, if possible */
128 nt_status = net_make_ipc_connection(c, conn_flags, &cli);
129 if (!NT_STATUS_IS_OK(nt_status)) {
130 DEBUG(1, ("failed to make ipc connection: %s\n",
131 nt_errstr(nt_status)));
144 if (!(mem_ctx = talloc_init("run_rpc_command"))) {
145 DEBUG(0, ("talloc_init() failed\n"));
149 nt_status = net_get_remote_domain_sid(cli, mem_ctx, &domain_sid,
151 if (!NT_STATUS_IS_OK(nt_status)) {
155 if (!(conn_flags & NET_FLAGS_NO_PIPE)) {
156 if (lp_client_schannel()
157 && (ndr_syntax_id_equal(interface,
158 &ndr_table_netlogon.syntax_id))) {
159 /* Always try and create an schannel netlogon pipe. */
160 nt_status = cli_rpc_pipe_open_schannel(
161 cli, interface, NCACN_NP,
162 DCERPC_AUTH_LEVEL_PRIVACY, domain_name,
164 if (!NT_STATUS_IS_OK(nt_status)) {
165 DEBUG(0, ("Could not initialise schannel netlogon pipe. Error was %s\n",
166 nt_errstr(nt_status) ));
170 if (conn_flags & NET_FLAGS_SEAL) {
171 nt_status = cli_rpc_pipe_open_ntlmssp(
173 (conn_flags & NET_FLAGS_TCP) ?
174 NCACN_IP_TCP : NCACN_NP,
175 DCERPC_AUTH_LEVEL_PRIVACY,
176 lp_workgroup(), c->opt_user_name,
177 c->opt_password, &pipe_hnd);
179 nt_status = cli_rpc_pipe_open_noauth(
183 if (!NT_STATUS_IS_OK(nt_status)) {
184 DEBUG(0, ("Could not initialise pipe %s. Error was %s\n",
185 get_pipe_name_from_iface(interface),
186 nt_errstr(nt_status) ));
192 nt_status = fn(c, domain_sid, domain_name, cli, pipe_hnd, mem_ctx, argc, argv);
194 if (!NT_STATUS_IS_OK(nt_status)) {
195 DEBUG(1, ("rpc command function failed! (%s)\n", nt_errstr(nt_status)));
198 DEBUG(5, ("rpc command function succedded\n"));
201 if (!(conn_flags & NET_FLAGS_NO_PIPE)) {
203 TALLOC_FREE(pipe_hnd);
208 /* close the connection only if it was opened here */
213 talloc_destroy(mem_ctx);
218 * Force a change of the trust acccount password.
220 * All parameters are provided by the run_rpc_command function, except for
221 * argc, argv which are passed through.
223 * @param domain_sid The domain sid acquired from the remote server.
224 * @param cli A cli_state connected to the server.
225 * @param mem_ctx Talloc context, destroyed on completion of the function.
226 * @param argc Standard main() style argc.
227 * @param argv Standard main() style argv. Initial components are already
230 * @return Normal NTSTATUS return.
233 static NTSTATUS rpc_changetrustpw_internals(struct net_context *c,
234 const DOM_SID *domain_sid,
235 const char *domain_name,
236 struct cli_state *cli,
237 struct rpc_pipe_client *pipe_hnd,
244 status = trust_pw_find_change_and_store_it(pipe_hnd, mem_ctx, c->opt_target_workgroup);
245 if (!NT_STATUS_IS_OK(status)) {
246 d_fprintf(stderr, _("Failed to change machine account password: %s\n"),
255 * Force a change of the trust acccount password.
257 * @param argc Standard main() style argc.
258 * @param argv Standard main() style argv. Initial components are already
261 * @return A shell status integer (0 for success).
264 int net_rpc_changetrustpw(struct net_context *c, int argc, const char **argv)
266 if (c->display_usage) {
267 d_printf(_("Usage:\n"
268 "net rpc changetrustpw\n"
269 " Change the machine trust password\n"));
273 return run_rpc_command(c, NULL, &ndr_table_netlogon.syntax_id,
274 NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
275 rpc_changetrustpw_internals,
280 * Join a domain, the old way.
282 * This uses 'machinename' as the inital password, and changes it.
284 * The password should be created with 'server manager' or equiv first.
286 * All parameters are provided by the run_rpc_command function, except for
287 * argc, argv which are passed through.
289 * @param domain_sid The domain sid acquired from the remote server.
290 * @param cli A cli_state connected to the server.
291 * @param mem_ctx Talloc context, destroyed on completion of the function.
292 * @param argc Standard main() style argc.
293 * @param argv Standard main() style argv. Initial components are already
296 * @return Normal NTSTATUS return.
299 static NTSTATUS rpc_oldjoin_internals(struct net_context *c,
300 const DOM_SID *domain_sid,
301 const char *domain_name,
302 struct cli_state *cli,
303 struct rpc_pipe_client *pipe_hnd,
309 fstring trust_passwd;
310 unsigned char orig_trust_passwd_hash[16];
312 uint32 sec_channel_type;
314 result = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
316 if (!NT_STATUS_IS_OK(result)) {
317 DEBUG(0,("rpc_oldjoin_internals: netlogon pipe open to machine %s failed. "
320 nt_errstr(result) ));
325 check what type of join - if the user want's to join as
326 a BDC, the server must agree that we are a BDC.
329 sec_channel_type = get_sec_channel_type(argv[0]);
331 sec_channel_type = get_sec_channel_type(NULL);
334 fstrcpy(trust_passwd, global_myname());
335 strlower_m(trust_passwd);
338 * Machine names can be 15 characters, but the max length on
339 * a password is 14. --jerry
342 trust_passwd[14] = '\0';
344 E_md4hash(trust_passwd, orig_trust_passwd_hash);
346 result = trust_pw_change_and_store_it(pipe_hnd, mem_ctx, c->opt_target_workgroup,
348 orig_trust_passwd_hash,
351 if (NT_STATUS_IS_OK(result))
352 printf(_("Joined domain %s.\n"), c->opt_target_workgroup);
355 if (!secrets_store_domain_sid(c->opt_target_workgroup, domain_sid)) {
356 DEBUG(0, ("error storing domain sid for %s\n", c->opt_target_workgroup));
357 result = NT_STATUS_UNSUCCESSFUL;
364 * Join a domain, the old way.
366 * @param argc Standard main() style argc.
367 * @param argv Standard main() style argv. Initial components are already
370 * @return A shell status integer (0 for success).
373 static int net_rpc_perform_oldjoin(struct net_context *c, int argc, const char **argv)
375 return run_rpc_command(c, NULL, &ndr_table_netlogon.syntax_id,
376 NET_FLAGS_NO_PIPE | NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
377 rpc_oldjoin_internals,
382 * Join a domain, the old way. This function exists to allow
383 * the message to be displayed when oldjoin was explicitly
384 * requested, but not when it was implied by "net rpc join".
386 * @param argc Standard main() style argc.
387 * @param argv Standard main() style argv. Initial components are already
390 * @return A shell status integer (0 for success).
393 static int net_rpc_oldjoin(struct net_context *c, int argc, const char **argv)
397 if (c->display_usage) {
398 d_printf(_("Usage:\n"
400 " Join a domain the old way\n"));
404 rc = net_rpc_perform_oldjoin(c, argc, argv);
407 d_fprintf(stderr, _("Failed to join domain\n"));
414 * 'net rpc join' entrypoint.
415 * @param argc Standard main() style argc.
416 * @param argv Standard main() style argv. Initial components are already
419 * Main 'net_rpc_join()' (where the admin username/password is used) is
421 * Try to just change the password, but if that doesn't work, use/prompt
422 * for a username/password.
425 int net_rpc_join(struct net_context *c, int argc, const char **argv)
427 if (c->display_usage) {
428 d_printf(_("Usage:\n"
429 "net rpc join -U <username>[%%password] <type>\n"
431 " username\tName of the admin user"
432 " password\tPassword of the admin user, will "
433 "prompt if not specified\n"
434 " type\tCan be one of the following:\n"
435 "\t\tMEMBER\tJoin as member server (default)\n"
436 "\t\tBDC\tJoin as BDC\n"
437 "\t\tPDC\tJoin as PDC\n"));
441 if (lp_server_role() == ROLE_STANDALONE) {
442 d_printf(_("cannot join as standalone machine\n"));
446 if (strlen(global_myname()) > 15) {
447 d_printf(_("Our netbios name can be at most 15 chars long, "
448 "\"%s\" is %u chars long\n"),
449 global_myname(), (unsigned int)strlen(global_myname()));
453 if ((net_rpc_perform_oldjoin(c, argc, argv) == 0))
456 return net_rpc_join_newstyle(c, argc, argv);
460 * display info about a rpc domain
462 * All parameters are provided by the run_rpc_command function, except for
463 * argc, argv which are passed through.
465 * @param domain_sid The domain sid acquired from the remote server
466 * @param cli A cli_state connected to the server.
467 * @param mem_ctx Talloc context, destroyed on completion of the function.
468 * @param argc Standard main() style argc.
469 * @param argv Standard main() style argv. Initial components are already
472 * @return Normal NTSTATUS return.
475 NTSTATUS rpc_info_internals(struct net_context *c,
476 const DOM_SID *domain_sid,
477 const char *domain_name,
478 struct cli_state *cli,
479 struct rpc_pipe_client *pipe_hnd,
484 struct policy_handle connect_pol, domain_pol;
485 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
486 union samr_DomainInfo *info = NULL;
489 sid_to_fstring(sid_str, domain_sid);
491 /* Get sam policy handle */
492 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
494 MAXIMUM_ALLOWED_ACCESS,
496 if (!NT_STATUS_IS_OK(result)) {
497 d_fprintf(stderr, _("Could not connect to SAM: %s\n"),
502 /* Get domain policy handle */
503 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
505 MAXIMUM_ALLOWED_ACCESS,
506 CONST_DISCARD(struct dom_sid2 *, domain_sid),
508 if (!NT_STATUS_IS_OK(result)) {
509 d_fprintf(stderr, _("Could not open domain: %s\n"),
514 result = rpccli_samr_QueryDomainInfo(pipe_hnd, mem_ctx,
518 if (NT_STATUS_IS_OK(result)) {
519 d_printf(_("Domain Name: %s\n"),
520 info->general.domain_name.string);
521 d_printf(_("Domain SID: %s\n"), sid_str);
522 d_printf(_("Sequence number: %llu\n"),
523 (unsigned long long)info->general.sequence_num);
524 d_printf(_("Num users: %u\n"), info->general.num_users);
525 d_printf(_("Num domain groups: %u\n"),info->general.num_groups);
526 d_printf(_("Num local groups: %u\n"),info->general.num_aliases);
534 * 'net rpc info' entrypoint.
535 * @param argc Standard main() style argc.
536 * @param argv Standard main() style argv. Initial components are already
540 int net_rpc_info(struct net_context *c, int argc, const char **argv)
542 if (c->display_usage) {
543 d_printf(_("Usage:\n"
545 " Display information about the domain\n"));
549 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id,
550 NET_FLAGS_PDC, rpc_info_internals,
555 * Fetch domain SID into the local secrets.tdb.
557 * All parameters are provided by the run_rpc_command function, except for
558 * argc, argv which are passed through.
560 * @param domain_sid The domain sid acquired from the remote server.
561 * @param cli A cli_state connected to the server.
562 * @param mem_ctx Talloc context, destroyed on completion of the function.
563 * @param argc Standard main() style argc.
564 * @param argv Standard main() style argv. Initial components are already
567 * @return Normal NTSTATUS return.
570 static NTSTATUS rpc_getsid_internals(struct net_context *c,
571 const DOM_SID *domain_sid,
572 const char *domain_name,
573 struct cli_state *cli,
574 struct rpc_pipe_client *pipe_hnd,
581 sid_to_fstring(sid_str, domain_sid);
582 d_printf(_("Storing SID %s for Domain %s in secrets.tdb\n"),
583 sid_str, domain_name);
585 if (!secrets_store_domain_sid(domain_name, domain_sid)) {
586 DEBUG(0,("Can't store domain SID\n"));
587 return NT_STATUS_UNSUCCESSFUL;
594 * 'net rpc getsid' entrypoint.
595 * @param argc Standard main() style argc.
596 * @param argv Standard main() style argv. Initial components are already
600 int net_rpc_getsid(struct net_context *c, int argc, const char **argv)
602 if (c->display_usage) {
603 d_printf(_("Usage:\n"
605 " Fetch domain SID into local secrets.tdb\n"));
609 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id,
610 NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
611 rpc_getsid_internals,
615 /****************************************************************************/
618 * Basic usage function for 'net rpc user'.
619 * @param argc Standard main() style argc.
620 * @param argv Standard main() style argv. Initial components are already
624 static int rpc_user_usage(struct net_context *c, int argc, const char **argv)
626 return net_user_usage(c, argc, argv);
630 * Add a new user to a remote RPC server.
632 * @param argc Standard main() style argc.
633 * @param argv Standard main() style argv. Initial components are already
636 * @return A shell status integer (0 for success).
639 static int rpc_user_add(struct net_context *c, int argc, const char **argv)
641 NET_API_STATUS status;
642 struct USER_INFO_1 info1;
643 uint32_t parm_error = 0;
645 if (argc < 1 || c->display_usage) {
646 rpc_user_usage(c, argc, argv);
652 info1.usri1_name = argv[0];
654 info1.usri1_password = argv[1];
657 status = NetUserAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
660 d_fprintf(stderr,_("Failed to add user '%s' with error: %s.\n"),
661 argv[0], libnetapi_get_error_string(c->netapi_ctx,
665 d_printf(_("Added user '%s'.\n"), argv[0]);
672 * Rename a user on a remote RPC server.
674 * @param argc Standard main() style argc.
675 * @param argv Standard main() style argv. Initial components are already
678 * @return A shell status integer (0 for success).
681 static int rpc_user_rename(struct net_context *c, int argc, const char **argv)
683 NET_API_STATUS status;
684 struct USER_INFO_0 u0;
685 uint32_t parm_err = 0;
687 if (argc != 2 || c->display_usage) {
688 rpc_user_usage(c, argc, argv);
692 u0.usri0_name = argv[1];
694 status = NetUserSetInfo(c->opt_host, argv[0],
695 0, (uint8_t *)&u0, &parm_err);
698 _("Failed to rename user from %s to %s - %s\n"),
700 libnetapi_get_error_string(c->netapi_ctx, status));
702 d_printf(_("Renamed user from %s to %s\n"), argv[0], argv[1]);
709 * Delete a user from a remote RPC server.
711 * @param argc Standard main() style argc.
712 * @param argv Standard main() style argv. Initial components are already
715 * @return A shell status integer (0 for success).
718 static int rpc_user_delete(struct net_context *c, int argc, const char **argv)
720 NET_API_STATUS status;
722 if (argc < 1 || c->display_usage) {
723 rpc_user_usage(c, argc, argv);
727 status = NetUserDel(c->opt_host, argv[0]);
730 d_fprintf(stderr, _("Failed to delete user '%s' with: %s.\n"),
732 libnetapi_get_error_string(c->netapi_ctx, status));
735 d_printf(_("Deleted user '%s'.\n"), argv[0]);
742 * Set a user's password on a remote RPC server.
744 * @param argc Standard main() style argc.
745 * @param argv Standard main() style argv. Initial components are already
748 * @return A shell status integer (0 for success).
751 static int rpc_user_password(struct net_context *c, int argc, const char **argv)
753 NET_API_STATUS status;
755 struct USER_INFO_1003 u1003;
756 uint32_t parm_err = 0;
759 if (argc < 1 || c->display_usage) {
760 rpc_user_usage(c, argc, argv);
765 u1003.usri1003_password = argv[1];
767 ret = asprintf(&prompt, _("Enter new password for %s:"),
772 u1003.usri1003_password = getpass(prompt);
776 status = NetUserSetInfo(c->opt_host, argv[0], 1003, (uint8_t *)&u1003, &parm_err);
778 /* Display results */
781 _("Failed to set password for '%s' with error: %s.\n"),
782 argv[0], libnetapi_get_error_string(c->netapi_ctx,
791 * List a user's groups from a remote RPC server.
793 * @param argc Standard main() style argc.
794 * @param argv Standard main() style argv. Initial components are already
797 * @return A shell status integer (0 for success)
800 static int rpc_user_info(struct net_context *c, int argc, const char **argv)
803 NET_API_STATUS status;
804 struct GROUP_USERS_INFO_0 *u0 = NULL;
805 uint32_t entries_read = 0;
806 uint32_t total_entries = 0;
810 if (argc < 1 || c->display_usage) {
811 rpc_user_usage(c, argc, argv);
815 status = NetUserGetGroups(c->opt_host,
818 (uint8_t **)(void *)&u0,
824 _("Failed to get groups for '%s' with error: %s.\n"),
825 argv[0], libnetapi_get_error_string(c->netapi_ctx,
830 for (i=0; i < entries_read; i++) {
831 printf("%s\n", u0->grui0_name);
839 * List users on a remote RPC server.
841 * All parameters are provided by the run_rpc_command function, except for
842 * argc, argv which are passed through.
844 * @param domain_sid The domain sid acquired from the remote server.
845 * @param cli A cli_state connected to the server.
846 * @param mem_ctx Talloc context, destroyed on completion of the function.
847 * @param argc Standard main() style argc.
848 * @param argv Standard main() style argv. Initial components are already
851 * @return Normal NTSTATUS return.
854 static int rpc_user_list(struct net_context *c, int argc, const char **argv)
856 NET_API_STATUS status;
857 uint32_t start_idx=0, num_entries, i, loop_count = 0;
858 struct NET_DISPLAY_USER *info = NULL;
861 /* Query domain users */
862 if (c->opt_long_list_entries)
863 d_printf(_("\nUser name Comment"
864 "\n-----------------------------\n"));
866 uint32_t max_entries, max_size;
868 get_query_dispinfo_params(
869 loop_count, &max_entries, &max_size);
871 status = NetQueryDisplayInformation(c->opt_host,
878 if (status != 0 && status != ERROR_MORE_DATA) {
882 info = (struct NET_DISPLAY_USER *)buffer;
884 for (i = 0; i < num_entries; i++) {
886 if (c->opt_long_list_entries)
887 printf("%-21.21s %s\n", info->usri1_name,
888 info->usri1_comment);
890 printf("%s\n", info->usri1_name);
894 NetApiBufferFree(buffer);
897 start_idx += num_entries;
899 } while (status == ERROR_MORE_DATA);
905 * 'net rpc user' entrypoint.
906 * @param argc Standard main() style argc.
907 * @param argv Standard main() style argv. Initial components are already
911 int net_rpc_user(struct net_context *c, int argc, const char **argv)
913 NET_API_STATUS status;
915 struct functable func[] = {
920 N_("Add specified user"),
921 N_("net rpc user add\n"
922 " Add specified user")
928 N_("List domain groups of user"),
929 N_("net rpc user info\n"
930 " Lis domain groups of user")
936 N_("Remove specified user"),
937 N_("net rpc user delete\n"
938 " Remove specified user")
944 N_("Change user password"),
945 N_("net rpc user password\n"
946 " Change user password")
952 N_("Rename specified user"),
953 N_("net rpc user rename\n"
954 " Rename specified user")
956 {NULL, NULL, 0, NULL, NULL}
959 status = libnetapi_init(&c->netapi_ctx);
963 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
964 libnetapi_set_password(c->netapi_ctx, c->opt_password);
965 if (c->opt_kerberos) {
966 libnetapi_set_use_kerberos(c->netapi_ctx);
970 if (c->display_usage) {
971 d_printf(_("Usage:\n"));
972 d_printf(_("net rpc user\n"
973 " List all users\n"));
974 net_display_usage_from_functable(func);
978 return rpc_user_list(c, argc, argv);
981 return net_run_function(c, argc, argv, "net rpc user", func);
984 static NTSTATUS rpc_sh_user_list(struct net_context *c,
986 struct rpc_sh_ctx *ctx,
987 struct rpc_pipe_client *pipe_hnd,
988 int argc, const char **argv)
990 return werror_to_ntstatus(W_ERROR(rpc_user_list(c, argc, argv)));
993 static NTSTATUS rpc_sh_user_info(struct net_context *c,
995 struct rpc_sh_ctx *ctx,
996 struct rpc_pipe_client *pipe_hnd,
997 int argc, const char **argv)
999 return werror_to_ntstatus(W_ERROR(rpc_user_info(c, argc, argv)));
1002 static NTSTATUS rpc_sh_handle_user(struct net_context *c,
1003 TALLOC_CTX *mem_ctx,
1004 struct rpc_sh_ctx *ctx,
1005 struct rpc_pipe_client *pipe_hnd,
1006 int argc, const char **argv,
1008 struct net_context *c,
1009 TALLOC_CTX *mem_ctx,
1010 struct rpc_sh_ctx *ctx,
1011 struct rpc_pipe_client *pipe_hnd,
1012 struct policy_handle *user_hnd,
1013 int argc, const char **argv))
1015 struct policy_handle connect_pol, domain_pol, user_pol;
1016 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1019 enum lsa_SidType type;
1022 d_fprintf(stderr, _("usage: %s <username>\n"), ctx->whoami);
1023 return NT_STATUS_INVALID_PARAMETER;
1026 ZERO_STRUCT(connect_pol);
1027 ZERO_STRUCT(domain_pol);
1028 ZERO_STRUCT(user_pol);
1030 result = net_rpc_lookup_name(c, mem_ctx, rpc_pipe_np_smb_conn(pipe_hnd),
1031 argv[0], NULL, NULL, &sid, &type);
1032 if (!NT_STATUS_IS_OK(result)) {
1033 d_fprintf(stderr, _("Could not lookup %s: %s\n"), argv[0],
1038 if (type != SID_NAME_USER) {
1039 d_fprintf(stderr, _("%s is a %s, not a user\n"), argv[0],
1040 sid_type_lookup(type));
1041 result = NT_STATUS_NO_SUCH_USER;
1045 if (!sid_peek_check_rid(ctx->domain_sid, &sid, &rid)) {
1046 d_fprintf(stderr, _("%s is not in our domain\n"), argv[0]);
1047 result = NT_STATUS_NO_SUCH_USER;
1051 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
1053 MAXIMUM_ALLOWED_ACCESS,
1055 if (!NT_STATUS_IS_OK(result)) {
1059 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
1061 MAXIMUM_ALLOWED_ACCESS,
1064 if (!NT_STATUS_IS_OK(result)) {
1068 result = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
1070 MAXIMUM_ALLOWED_ACCESS,
1073 if (!NT_STATUS_IS_OK(result)) {
1077 result = fn(c, mem_ctx, ctx, pipe_hnd, &user_pol, argc-1, argv+1);
1080 if (is_valid_policy_hnd(&user_pol)) {
1081 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1083 if (is_valid_policy_hnd(&domain_pol)) {
1084 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
1086 if (is_valid_policy_hnd(&connect_pol)) {
1087 rpccli_samr_Close(pipe_hnd, mem_ctx, &connect_pol);
1092 static NTSTATUS rpc_sh_user_show_internals(struct net_context *c,
1093 TALLOC_CTX *mem_ctx,
1094 struct rpc_sh_ctx *ctx,
1095 struct rpc_pipe_client *pipe_hnd,
1096 struct policy_handle *user_hnd,
1097 int argc, const char **argv)
1100 union samr_UserInfo *info = NULL;
1103 d_fprintf(stderr, _("usage: %s show <username>\n"),ctx->whoami);
1104 return NT_STATUS_INVALID_PARAMETER;
1107 result = rpccli_samr_QueryUserInfo(pipe_hnd, mem_ctx,
1111 if (!NT_STATUS_IS_OK(result)) {
1115 d_printf(_("user rid: %d, group rid: %d\n"),
1117 info->info21.primary_gid);
1122 static NTSTATUS rpc_sh_user_show(struct net_context *c,
1123 TALLOC_CTX *mem_ctx,
1124 struct rpc_sh_ctx *ctx,
1125 struct rpc_pipe_client *pipe_hnd,
1126 int argc, const char **argv)
1128 return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1129 rpc_sh_user_show_internals);
1132 #define FETCHSTR(name, rec) \
1133 do { if (strequal(ctx->thiscmd, name)) { \
1134 oldval = talloc_strdup(mem_ctx, info->info21.rec.string); } \
1137 #define SETSTR(name, rec, flag) \
1138 do { if (strequal(ctx->thiscmd, name)) { \
1139 init_lsa_String(&(info->info21.rec), argv[0]); \
1140 info->info21.fields_present |= SAMR_FIELD_##flag; } \
1143 static NTSTATUS rpc_sh_user_str_edit_internals(struct net_context *c,
1144 TALLOC_CTX *mem_ctx,
1145 struct rpc_sh_ctx *ctx,
1146 struct rpc_pipe_client *pipe_hnd,
1147 struct policy_handle *user_hnd,
1148 int argc, const char **argv)
1151 const char *username;
1152 const char *oldval = "";
1153 union samr_UserInfo *info = NULL;
1156 d_fprintf(stderr, _("usage: %s <username> [new value|NULL]\n"),
1158 return NT_STATUS_INVALID_PARAMETER;
1161 result = rpccli_samr_QueryUserInfo(pipe_hnd, mem_ctx,
1165 if (!NT_STATUS_IS_OK(result)) {
1169 username = talloc_strdup(mem_ctx, info->info21.account_name.string);
1171 FETCHSTR("fullname", full_name);
1172 FETCHSTR("homedir", home_directory);
1173 FETCHSTR("homedrive", home_drive);
1174 FETCHSTR("logonscript", logon_script);
1175 FETCHSTR("profilepath", profile_path);
1176 FETCHSTR("description", description);
1179 d_printf(_("%s's %s: [%s]\n"), username, ctx->thiscmd, oldval);
1183 if (strcmp(argv[0], "NULL") == 0) {
1187 ZERO_STRUCT(info->info21);
1189 SETSTR("fullname", full_name, FULL_NAME);
1190 SETSTR("homedir", home_directory, HOME_DIRECTORY);
1191 SETSTR("homedrive", home_drive, HOME_DRIVE);
1192 SETSTR("logonscript", logon_script, LOGON_SCRIPT);
1193 SETSTR("profilepath", profile_path, PROFILE_PATH);
1194 SETSTR("description", description, DESCRIPTION);
1196 result = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
1201 d_printf(_("Set %s's %s from [%s] to [%s]\n"), username,
1202 ctx->thiscmd, oldval, argv[0]);
1209 #define HANDLEFLG(name, rec) \
1210 do { if (strequal(ctx->thiscmd, name)) { \
1211 oldval = (oldflags & ACB_##rec) ? "yes" : "no"; \
1213 newflags = oldflags | ACB_##rec; \
1215 newflags = oldflags & ~ACB_##rec; \
1218 static NTSTATUS rpc_sh_user_str_edit(struct net_context *c,
1219 TALLOC_CTX *mem_ctx,
1220 struct rpc_sh_ctx *ctx,
1221 struct rpc_pipe_client *pipe_hnd,
1222 int argc, const char **argv)
1224 return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1225 rpc_sh_user_str_edit_internals);
1228 static NTSTATUS rpc_sh_user_flag_edit_internals(struct net_context *c,
1229 TALLOC_CTX *mem_ctx,
1230 struct rpc_sh_ctx *ctx,
1231 struct rpc_pipe_client *pipe_hnd,
1232 struct policy_handle *user_hnd,
1233 int argc, const char **argv)
1236 const char *username;
1237 const char *oldval = "unknown";
1238 uint32 oldflags, newflags;
1240 union samr_UserInfo *info = NULL;
1243 ((argc == 1) && !strequal(argv[0], "yes") &&
1244 !strequal(argv[0], "no"))) {
1245 /* TRANSATORS: The yes|no here are program keywords. Please do
1247 d_fprintf(stderr, _("usage: %s <username> [yes|no]\n"),
1249 return NT_STATUS_INVALID_PARAMETER;
1252 newval = strequal(argv[0], "yes");
1254 result = rpccli_samr_QueryUserInfo(pipe_hnd, mem_ctx,
1258 if (!NT_STATUS_IS_OK(result)) {
1262 username = talloc_strdup(mem_ctx, info->info21.account_name.string);
1263 oldflags = info->info21.acct_flags;
1264 newflags = info->info21.acct_flags;
1266 HANDLEFLG("disabled", DISABLED);
1267 HANDLEFLG("pwnotreq", PWNOTREQ);
1268 HANDLEFLG("autolock", AUTOLOCK);
1269 HANDLEFLG("pwnoexp", PWNOEXP);
1272 d_printf(_("%s's %s flag: %s\n"), username, ctx->thiscmd,
1277 ZERO_STRUCT(info->info21);
1279 info->info21.acct_flags = newflags;
1280 info->info21.fields_present = SAMR_FIELD_ACCT_FLAGS;
1282 result = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
1287 if (NT_STATUS_IS_OK(result)) {
1288 d_printf(_("Set %s's %s flag from [%s] to [%s]\n"), username,
1289 ctx->thiscmd, oldval, argv[0]);
1297 static NTSTATUS rpc_sh_user_flag_edit(struct net_context *c,
1298 TALLOC_CTX *mem_ctx,
1299 struct rpc_sh_ctx *ctx,
1300 struct rpc_pipe_client *pipe_hnd,
1301 int argc, const char **argv)
1303 return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1304 rpc_sh_user_flag_edit_internals);
1307 struct rpc_sh_cmd *net_rpc_user_edit_cmds(struct net_context *c,
1308 TALLOC_CTX *mem_ctx,
1309 struct rpc_sh_ctx *ctx)
1311 static struct rpc_sh_cmd cmds[] = {
1313 { "fullname", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_str_edit,
1314 N_("Show/Set a user's full name") },
1316 { "homedir", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_str_edit,
1317 N_("Show/Set a user's home directory") },
1319 { "homedrive", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_str_edit,
1320 N_("Show/Set a user's home drive") },
1322 { "logonscript", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_str_edit,
1323 N_("Show/Set a user's logon script") },
1325 { "profilepath", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_str_edit,
1326 N_("Show/Set a user's profile path") },
1328 { "description", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_str_edit,
1329 N_("Show/Set a user's description") },
1331 { "disabled", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_flag_edit,
1332 N_("Show/Set whether a user is disabled") },
1334 { "autolock", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_flag_edit,
1335 N_("Show/Set whether a user locked out") },
1337 { "pwnotreq", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_flag_edit,
1338 N_("Show/Set whether a user does not need a password") },
1340 { "pwnoexp", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_flag_edit,
1341 N_("Show/Set whether a user's password does not expire") },
1343 { NULL, NULL, 0, NULL, NULL }
1349 struct rpc_sh_cmd *net_rpc_user_cmds(struct net_context *c,
1350 TALLOC_CTX *mem_ctx,
1351 struct rpc_sh_ctx *ctx)
1353 static struct rpc_sh_cmd cmds[] = {
1355 { "list", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_list,
1356 N_("List available users") },
1358 { "info", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_info,
1359 N_("List the domain groups a user is member of") },
1361 { "show", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_show,
1362 N_("Show info about a user") },
1364 { "edit", net_rpc_user_edit_cmds, 0, NULL,
1365 N_("Show/Modify a user's fields") },
1367 { NULL, NULL, 0, NULL, NULL }
1373 /****************************************************************************/
1376 * Basic usage function for 'net rpc group'.
1377 * @param argc Standard main() style argc.
1378 * @param argv Standard main() style argv. Initial components are already
1382 static int rpc_group_usage(struct net_context *c, int argc, const char **argv)
1384 return net_group_usage(c, argc, argv);
1388 * Delete group on a remote RPC server.
1390 * All parameters are provided by the run_rpc_command function, except for
1391 * argc, argv which are passed through.
1393 * @param domain_sid The domain sid acquired from the remote server.
1394 * @param cli A cli_state connected to the server.
1395 * @param mem_ctx Talloc context, destroyed on completion of the function.
1396 * @param argc Standard main() style argc.
1397 * @param argv Standard main() style argv. Initial components are already
1400 * @return Normal NTSTATUS return.
1403 static NTSTATUS rpc_group_delete_internals(struct net_context *c,
1404 const DOM_SID *domain_sid,
1405 const char *domain_name,
1406 struct cli_state *cli,
1407 struct rpc_pipe_client *pipe_hnd,
1408 TALLOC_CTX *mem_ctx,
1412 struct policy_handle connect_pol, domain_pol, group_pol, user_pol;
1413 bool group_is_primary = false;
1414 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1416 struct samr_RidTypeArray *rids = NULL;
1419 /* struct samr_RidWithAttribute *user_gids; */
1421 struct samr_Ids group_rids, name_types;
1422 struct lsa_String lsa_acct_name;
1423 union samr_UserInfo *info = NULL;
1425 if (argc < 1 || c->display_usage) {
1426 rpc_group_usage(c, argc,argv);
1427 return NT_STATUS_OK; /* ok? */
1430 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
1432 MAXIMUM_ALLOWED_ACCESS,
1435 if (!NT_STATUS_IS_OK(result)) {
1436 d_fprintf(stderr, _("Request samr_Connect2 failed\n"));
1440 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
1442 MAXIMUM_ALLOWED_ACCESS,
1443 CONST_DISCARD(struct dom_sid2 *, domain_sid),
1446 if (!NT_STATUS_IS_OK(result)) {
1447 d_fprintf(stderr, _("Request open_domain failed\n"));
1451 init_lsa_String(&lsa_acct_name, argv[0]);
1453 result = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
1459 if (!NT_STATUS_IS_OK(result)) {
1460 d_fprintf(stderr, _("Lookup of '%s' failed\n"),argv[0]);
1464 switch (name_types.ids[0])
1466 case SID_NAME_DOM_GRP:
1467 result = rpccli_samr_OpenGroup(pipe_hnd, mem_ctx,
1469 MAXIMUM_ALLOWED_ACCESS,
1472 if (!NT_STATUS_IS_OK(result)) {
1473 d_fprintf(stderr, _("Request open_group failed"));
1477 group_rid = group_rids.ids[0];
1479 result = rpccli_samr_QueryGroupMember(pipe_hnd, mem_ctx,
1483 if (!NT_STATUS_IS_OK(result)) {
1485 _("Unable to query group members of %s"),
1490 if (c->opt_verbose) {
1492 _("Domain Group %s (rid: %d) has %d members\n"),
1493 argv[0],group_rid, rids->count);
1496 /* Check if group is anyone's primary group */
1497 for (i = 0; i < rids->count; i++)
1499 result = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
1501 MAXIMUM_ALLOWED_ACCESS,
1505 if (!NT_STATUS_IS_OK(result)) {
1507 _("Unable to open group member %d\n"),
1512 result = rpccli_samr_QueryUserInfo(pipe_hnd, mem_ctx,
1517 if (!NT_STATUS_IS_OK(result)) {
1519 _("Unable to lookup userinfo for group "
1525 if (info->info21.primary_gid == group_rid) {
1526 if (c->opt_verbose) {
1527 d_printf(_("Group is primary group "
1529 info->info21.account_name.string);
1531 group_is_primary = true;
1534 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1537 if (group_is_primary) {
1538 d_fprintf(stderr, _("Unable to delete group because "
1539 "some of it's members have it as primary "
1541 result = NT_STATUS_MEMBERS_PRIMARY_GROUP;
1545 /* remove all group members */
1546 for (i = 0; i < rids->count; i++)
1549 d_printf(_("Remove group member %d..."),
1551 result = rpccli_samr_DeleteGroupMember(pipe_hnd, mem_ctx,
1555 if (NT_STATUS_IS_OK(result)) {
1557 d_printf(_("ok\n"));
1560 d_printf(_("failed\n"));
1565 result = rpccli_samr_DeleteDomainGroup(pipe_hnd, mem_ctx,
1569 /* removing a local group is easier... */
1570 case SID_NAME_ALIAS:
1571 result = rpccli_samr_OpenAlias(pipe_hnd, mem_ctx,
1573 MAXIMUM_ALLOWED_ACCESS,
1577 if (!NT_STATUS_IS_OK(result)) {
1578 d_fprintf(stderr, _("Request open_alias failed\n"));
1582 result = rpccli_samr_DeleteDomAlias(pipe_hnd, mem_ctx,
1586 d_fprintf(stderr, _("%s is of type %s. This command is only "
1587 "for deleting local or global groups\n"),
1588 argv[0],sid_type_lookup(name_types.ids[0]));
1589 result = NT_STATUS_UNSUCCESSFUL;
1593 if (NT_STATUS_IS_OK(result)) {
1595 d_printf(_("Deleted %s '%s'\n"),
1596 sid_type_lookup(name_types.ids[0]), argv[0]);
1598 d_fprintf(stderr, _("Deleting of %s failed: %s\n"), argv[0],
1599 get_friendly_nt_error_msg(result));
1607 static int rpc_group_delete(struct net_context *c, int argc, const char **argv)
1609 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
1610 rpc_group_delete_internals, argc,argv);
1613 static int rpc_group_add_internals(struct net_context *c, int argc, const char **argv)
1615 NET_API_STATUS status;
1616 struct GROUP_INFO_1 info1;
1617 uint32_t parm_error = 0;
1619 if (argc != 1 || c->display_usage) {
1620 rpc_group_usage(c, argc, argv);
1626 info1.grpi1_name = argv[0];
1627 if (c->opt_comment && strlen(c->opt_comment) > 0) {
1628 info1.grpi1_comment = c->opt_comment;
1631 status = NetGroupAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
1635 _("Failed to add group '%s' with error: %s.\n"),
1636 argv[0], libnetapi_get_error_string(c->netapi_ctx,
1640 d_printf(_("Added group '%s'.\n"), argv[0]);
1646 static int rpc_alias_add_internals(struct net_context *c, int argc, const char **argv)
1648 NET_API_STATUS status;
1649 struct LOCALGROUP_INFO_1 info1;
1650 uint32_t parm_error = 0;
1652 if (argc != 1 || c->display_usage) {
1653 rpc_group_usage(c, argc, argv);
1659 info1.lgrpi1_name = argv[0];
1660 if (c->opt_comment && strlen(c->opt_comment) > 0) {
1661 info1.lgrpi1_comment = c->opt_comment;
1664 status = NetLocalGroupAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
1668 _("Failed to add alias '%s' with error: %s.\n"),
1669 argv[0], libnetapi_get_error_string(c->netapi_ctx,
1673 d_printf(_("Added alias '%s'.\n"), argv[0]);
1679 static int rpc_group_add(struct net_context *c, int argc, const char **argv)
1681 if (c->opt_localgroup)
1682 return rpc_alias_add_internals(c, argc, argv);
1684 return rpc_group_add_internals(c, argc, argv);
1687 static NTSTATUS get_sid_from_name(struct cli_state *cli,
1688 TALLOC_CTX *mem_ctx,
1691 enum lsa_SidType *type)
1693 DOM_SID *sids = NULL;
1694 enum lsa_SidType *types = NULL;
1695 struct rpc_pipe_client *pipe_hnd = NULL;
1696 struct policy_handle lsa_pol;
1697 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1699 result = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
1701 if (!NT_STATUS_IS_OK(result)) {
1705 result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, false,
1706 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
1708 if (!NT_STATUS_IS_OK(result)) {
1712 result = rpccli_lsa_lookup_names(pipe_hnd, mem_ctx, &lsa_pol, 1,
1713 &name, NULL, 1, &sids, &types);
1715 if (NT_STATUS_IS_OK(result)) {
1716 sid_copy(sid, &sids[0]);
1720 rpccli_lsa_Close(pipe_hnd, mem_ctx, &lsa_pol);
1724 TALLOC_FREE(pipe_hnd);
1727 if (!NT_STATUS_IS_OK(result) && (StrnCaseCmp(name, "S-", 2) == 0)) {
1729 /* Try as S-1-5-whatever */
1733 if (string_to_sid(&tmp_sid, name)) {
1734 sid_copy(sid, &tmp_sid);
1735 *type = SID_NAME_UNKNOWN;
1736 result = NT_STATUS_OK;
1743 static NTSTATUS rpc_add_groupmem(struct rpc_pipe_client *pipe_hnd,
1744 TALLOC_CTX *mem_ctx,
1745 const DOM_SID *group_sid,
1748 struct policy_handle connect_pol, domain_pol;
1751 struct policy_handle group_pol;
1753 struct samr_Ids rids, rid_types;
1754 struct lsa_String lsa_acct_name;
1758 sid_copy(&sid, group_sid);
1760 if (!sid_split_rid(&sid, &group_rid)) {
1761 return NT_STATUS_UNSUCCESSFUL;
1764 /* Get sam policy handle */
1765 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
1767 MAXIMUM_ALLOWED_ACCESS,
1769 if (!NT_STATUS_IS_OK(result)) {
1773 /* Get domain policy handle */
1774 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
1776 MAXIMUM_ALLOWED_ACCESS,
1779 if (!NT_STATUS_IS_OK(result)) {
1783 init_lsa_String(&lsa_acct_name, member);
1785 result = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
1792 if (!NT_STATUS_IS_OK(result)) {
1793 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
1798 result = rpccli_samr_OpenGroup(pipe_hnd, mem_ctx,
1800 MAXIMUM_ALLOWED_ACCESS,
1804 if (!NT_STATUS_IS_OK(result)) {
1808 result = rpccli_samr_AddGroupMember(pipe_hnd, mem_ctx,
1811 0x0005); /* unknown flags */
1814 rpccli_samr_Close(pipe_hnd, mem_ctx, &connect_pol);
1818 static NTSTATUS rpc_add_aliasmem(struct rpc_pipe_client *pipe_hnd,
1819 TALLOC_CTX *mem_ctx,
1820 const DOM_SID *alias_sid,
1823 struct policy_handle connect_pol, domain_pol;
1826 struct policy_handle alias_pol;
1829 enum lsa_SidType member_type;
1833 sid_copy(&sid, alias_sid);
1835 if (!sid_split_rid(&sid, &alias_rid)) {
1836 return NT_STATUS_UNSUCCESSFUL;
1839 result = get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd), mem_ctx,
1840 member, &member_sid, &member_type);
1842 if (!NT_STATUS_IS_OK(result)) {
1843 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
1848 /* Get sam policy handle */
1849 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
1851 MAXIMUM_ALLOWED_ACCESS,
1853 if (!NT_STATUS_IS_OK(result)) {
1857 /* Get domain policy handle */
1858 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
1860 MAXIMUM_ALLOWED_ACCESS,
1863 if (!NT_STATUS_IS_OK(result)) {
1867 result = rpccli_samr_OpenAlias(pipe_hnd, mem_ctx,
1869 MAXIMUM_ALLOWED_ACCESS,
1873 if (!NT_STATUS_IS_OK(result)) {
1877 result = rpccli_samr_AddAliasMember(pipe_hnd, mem_ctx,
1881 if (!NT_STATUS_IS_OK(result)) {
1886 rpccli_samr_Close(pipe_hnd, mem_ctx, &connect_pol);
1890 static NTSTATUS rpc_group_addmem_internals(struct net_context *c,
1891 const DOM_SID *domain_sid,
1892 const char *domain_name,
1893 struct cli_state *cli,
1894 struct rpc_pipe_client *pipe_hnd,
1895 TALLOC_CTX *mem_ctx,
1900 enum lsa_SidType group_type;
1902 if (argc != 2 || c->display_usage) {
1903 d_printf(_("Usage:\n"
1904 "net rpc group addmem <group> <member>\n"
1905 " Add a member to a group\n"
1906 " group\tGroup to add member to\n"
1907 " member\tMember to add to group\n"));
1908 return NT_STATUS_UNSUCCESSFUL;
1911 if (!NT_STATUS_IS_OK(get_sid_from_name(cli, mem_ctx, argv[0],
1912 &group_sid, &group_type))) {
1913 d_fprintf(stderr, _("Could not lookup group name %s\n"),
1915 return NT_STATUS_UNSUCCESSFUL;
1918 if (group_type == SID_NAME_DOM_GRP) {
1919 NTSTATUS result = rpc_add_groupmem(pipe_hnd, mem_ctx,
1920 &group_sid, argv[1]);
1922 if (!NT_STATUS_IS_OK(result)) {
1923 d_fprintf(stderr, _("Could not add %s to %s: %s\n"),
1924 argv[1], argv[0], nt_errstr(result));
1929 if (group_type == SID_NAME_ALIAS) {
1930 NTSTATUS result = rpc_add_aliasmem(pipe_hnd, mem_ctx,
1931 &group_sid, argv[1]);
1933 if (!NT_STATUS_IS_OK(result)) {
1934 d_fprintf(stderr, _("Could not add %s to %s: %s\n"),
1935 argv[1], argv[0], nt_errstr(result));
1940 d_fprintf(stderr, _("Can only add members to global or local groups "
1941 "which %s is not\n"), argv[0]);
1943 return NT_STATUS_UNSUCCESSFUL;
1946 static int rpc_group_addmem(struct net_context *c, int argc, const char **argv)
1948 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
1949 rpc_group_addmem_internals,
1953 static NTSTATUS rpc_del_groupmem(struct net_context *c,
1954 struct rpc_pipe_client *pipe_hnd,
1955 TALLOC_CTX *mem_ctx,
1956 const DOM_SID *group_sid,
1959 struct policy_handle connect_pol, domain_pol;
1962 struct policy_handle group_pol;
1964 struct samr_Ids rids, rid_types;
1965 struct lsa_String lsa_acct_name;
1969 sid_copy(&sid, group_sid);
1971 if (!sid_split_rid(&sid, &group_rid))
1972 return NT_STATUS_UNSUCCESSFUL;
1974 /* Get sam policy handle */
1975 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
1977 MAXIMUM_ALLOWED_ACCESS,
1979 if (!NT_STATUS_IS_OK(result))
1982 /* Get domain policy handle */
1983 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
1985 MAXIMUM_ALLOWED_ACCESS,
1988 if (!NT_STATUS_IS_OK(result))
1991 init_lsa_String(&lsa_acct_name, member);
1993 result = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
1999 if (!NT_STATUS_IS_OK(result)) {
2000 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2005 result = rpccli_samr_OpenGroup(pipe_hnd, mem_ctx,
2007 MAXIMUM_ALLOWED_ACCESS,
2011 if (!NT_STATUS_IS_OK(result))
2014 result = rpccli_samr_DeleteGroupMember(pipe_hnd, mem_ctx,
2019 rpccli_samr_Close(pipe_hnd, mem_ctx, &connect_pol);
2023 static NTSTATUS rpc_del_aliasmem(struct rpc_pipe_client *pipe_hnd,
2024 TALLOC_CTX *mem_ctx,
2025 const DOM_SID *alias_sid,
2028 struct policy_handle connect_pol, domain_pol;
2031 struct policy_handle alias_pol;
2034 enum lsa_SidType member_type;
2038 sid_copy(&sid, alias_sid);
2040 if (!sid_split_rid(&sid, &alias_rid))
2041 return NT_STATUS_UNSUCCESSFUL;
2043 result = get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd), mem_ctx,
2044 member, &member_sid, &member_type);
2046 if (!NT_STATUS_IS_OK(result)) {
2047 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2052 /* Get sam policy handle */
2053 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
2055 MAXIMUM_ALLOWED_ACCESS,
2057 if (!NT_STATUS_IS_OK(result)) {
2061 /* Get domain policy handle */
2062 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
2064 MAXIMUM_ALLOWED_ACCESS,
2067 if (!NT_STATUS_IS_OK(result)) {
2071 result = rpccli_samr_OpenAlias(pipe_hnd, mem_ctx,
2073 MAXIMUM_ALLOWED_ACCESS,
2077 if (!NT_STATUS_IS_OK(result))
2080 result = rpccli_samr_DeleteAliasMember(pipe_hnd, mem_ctx,
2084 if (!NT_STATUS_IS_OK(result))
2088 rpccli_samr_Close(pipe_hnd, mem_ctx, &connect_pol);
2092 static NTSTATUS rpc_group_delmem_internals(struct net_context *c,
2093 const DOM_SID *domain_sid,
2094 const char *domain_name,
2095 struct cli_state *cli,
2096 struct rpc_pipe_client *pipe_hnd,
2097 TALLOC_CTX *mem_ctx,
2102 enum lsa_SidType group_type;
2104 if (argc != 2 || c->display_usage) {
2105 d_printf(_("Usage:\n"
2106 "net rpc group delmem <group> <member>\n"
2107 " Delete a member from a group\n"
2108 " group\tGroup to delete member from\n"
2109 " member\tMember to delete from group\n"));
2110 return NT_STATUS_UNSUCCESSFUL;
2113 if (!NT_STATUS_IS_OK(get_sid_from_name(cli, mem_ctx, argv[0],
2114 &group_sid, &group_type))) {
2115 d_fprintf(stderr, _("Could not lookup group name %s\n"),
2117 return NT_STATUS_UNSUCCESSFUL;
2120 if (group_type == SID_NAME_DOM_GRP) {
2121 NTSTATUS result = rpc_del_groupmem(c, pipe_hnd, mem_ctx,
2122 &group_sid, argv[1]);
2124 if (!NT_STATUS_IS_OK(result)) {
2125 d_fprintf(stderr, _("Could not del %s from %s: %s\n"),
2126 argv[1], argv[0], nt_errstr(result));
2131 if (group_type == SID_NAME_ALIAS) {
2132 NTSTATUS result = rpc_del_aliasmem(pipe_hnd, mem_ctx,
2133 &group_sid, argv[1]);
2135 if (!NT_STATUS_IS_OK(result)) {
2136 d_fprintf(stderr, _("Could not del %s from %s: %s\n"),
2137 argv[1], argv[0], nt_errstr(result));
2142 d_fprintf(stderr, _("Can only delete members from global or local "
2143 "groups which %s is not\n"), argv[0]);
2145 return NT_STATUS_UNSUCCESSFUL;
2148 static int rpc_group_delmem(struct net_context *c, int argc, const char **argv)
2150 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
2151 rpc_group_delmem_internals,
2156 * List groups on a remote RPC server.
2158 * All parameters are provided by the run_rpc_command function, except for
2159 * argc, argv which are passes through.
2161 * @param domain_sid The domain sid acquired from the remote server.
2162 * @param cli A cli_state connected to the server.
2163 * @param mem_ctx Talloc context, destroyed on completion of the function.
2164 * @param argc Standard main() style argc.
2165 * @param argv Standard main() style argv. Initial components are already
2168 * @return Normal NTSTATUS return.
2171 static NTSTATUS rpc_group_list_internals(struct net_context *c,
2172 const DOM_SID *domain_sid,
2173 const char *domain_name,
2174 struct cli_state *cli,
2175 struct rpc_pipe_client *pipe_hnd,
2176 TALLOC_CTX *mem_ctx,
2180 struct policy_handle connect_pol, domain_pol;
2181 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2182 uint32 start_idx=0, max_entries=250, num_entries, i, loop_count = 0;
2183 struct samr_SamArray *groups = NULL;
2184 bool global = false;
2186 bool builtin = false;
2188 if (c->display_usage) {
2189 d_printf(_("Usage:\n"
2190 "net rpc group list [global] [local] [builtin]\n"
2191 " List groups on RPC server\n"
2192 " global\tList global groups\n"
2193 " local\tList local groups\n"
2194 " builtin\tList builtin groups\n"
2195 " If none of global, local or builtin is "
2196 "specified, all three options are considered "
2198 return NT_STATUS_OK;
2207 for (i=0; i<argc; i++) {
2208 if (strequal(argv[i], "global"))
2211 if (strequal(argv[i], "local"))
2214 if (strequal(argv[i], "builtin"))
2218 /* Get sam policy handle */
2220 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
2222 MAXIMUM_ALLOWED_ACCESS,
2224 if (!NT_STATUS_IS_OK(result)) {
2228 /* Get domain policy handle */
2230 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
2232 MAXIMUM_ALLOWED_ACCESS,
2233 CONST_DISCARD(struct dom_sid2 *, domain_sid),
2235 if (!NT_STATUS_IS_OK(result)) {
2239 /* Query domain groups */
2240 if (c->opt_long_list_entries)
2241 d_printf(_("\nGroup name Comment"
2242 "\n-----------------------------\n"));
2244 uint32_t max_size, total_size, returned_size;
2245 union samr_DispInfo info;
2249 get_query_dispinfo_params(
2250 loop_count, &max_entries, &max_size);
2252 result = rpccli_samr_QueryDisplayInfo(pipe_hnd, mem_ctx,
2261 num_entries = info.info3.count;
2262 start_idx += info.info3.count;
2264 if (!NT_STATUS_IS_OK(result) &&
2265 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
2268 for (i = 0; i < num_entries; i++) {
2270 const char *group = NULL;
2271 const char *desc = NULL;
2273 group = info.info3.entries[i].account_name.string;
2274 desc = info.info3.entries[i].description.string;
2276 if (c->opt_long_list_entries)
2277 printf("%-21.21s %-50.50s\n",
2280 printf("%s\n", group);
2282 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2283 /* query domain aliases */
2288 result = rpccli_samr_EnumDomainAliases(pipe_hnd, mem_ctx,
2294 if (!NT_STATUS_IS_OK(result) &&
2295 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
2298 for (i = 0; i < num_entries; i++) {
2300 const char *description = NULL;
2302 if (c->opt_long_list_entries) {
2304 struct policy_handle alias_pol;
2305 union samr_AliasInfo *info = NULL;
2307 if ((NT_STATUS_IS_OK(rpccli_samr_OpenAlias(pipe_hnd, mem_ctx,
2310 groups->entries[i].idx,
2312 (NT_STATUS_IS_OK(rpccli_samr_QueryAliasInfo(pipe_hnd, mem_ctx,
2316 (NT_STATUS_IS_OK(rpccli_samr_Close(pipe_hnd, mem_ctx,
2318 description = info->description.string;
2322 if (description != NULL) {
2323 printf("%-21.21s %-50.50s\n",
2324 groups->entries[i].name.string,
2327 printf("%s\n", groups->entries[i].name.string);
2330 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2331 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
2332 /* Get builtin policy handle */
2334 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
2336 MAXIMUM_ALLOWED_ACCESS,
2337 CONST_DISCARD(struct dom_sid2 *, &global_sid_Builtin),
2339 if (!NT_STATUS_IS_OK(result)) {
2342 /* query builtin aliases */
2345 if (!builtin) break;
2347 result = rpccli_samr_EnumDomainAliases(pipe_hnd, mem_ctx,
2353 if (!NT_STATUS_IS_OK(result) &&
2354 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
2357 for (i = 0; i < num_entries; i++) {
2359 const char *description = NULL;
2361 if (c->opt_long_list_entries) {
2363 struct policy_handle alias_pol;
2364 union samr_AliasInfo *info = NULL;
2366 if ((NT_STATUS_IS_OK(rpccli_samr_OpenAlias(pipe_hnd, mem_ctx,
2369 groups->entries[i].idx,
2371 (NT_STATUS_IS_OK(rpccli_samr_QueryAliasInfo(pipe_hnd, mem_ctx,
2375 (NT_STATUS_IS_OK(rpccli_samr_Close(pipe_hnd, mem_ctx,
2377 description = info->description.string;
2381 if (description != NULL) {
2382 printf("%-21.21s %-50.50s\n",
2383 groups->entries[i].name.string,
2386 printf("%s\n", groups->entries[i].name.string);
2389 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2395 static int rpc_group_list(struct net_context *c, int argc, const char **argv)
2397 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
2398 rpc_group_list_internals,
2402 static NTSTATUS rpc_list_group_members(struct net_context *c,
2403 struct rpc_pipe_client *pipe_hnd,
2404 TALLOC_CTX *mem_ctx,
2405 const char *domain_name,
2406 const DOM_SID *domain_sid,
2407 struct policy_handle *domain_pol,
2411 struct policy_handle group_pol;
2412 uint32 num_members, *group_rids;
2414 struct samr_RidTypeArray *rids = NULL;
2415 struct lsa_Strings names;
2416 struct samr_Ids types;
2419 sid_to_fstring(sid_str, domain_sid);
2421 result = rpccli_samr_OpenGroup(pipe_hnd, mem_ctx,
2423 MAXIMUM_ALLOWED_ACCESS,
2427 if (!NT_STATUS_IS_OK(result))
2430 result = rpccli_samr_QueryGroupMember(pipe_hnd, mem_ctx,
2434 if (!NT_STATUS_IS_OK(result))
2437 num_members = rids->count;
2438 group_rids = rids->rids;
2440 while (num_members > 0) {
2441 int this_time = 512;
2443 if (num_members < this_time)
2444 this_time = num_members;
2446 result = rpccli_samr_LookupRids(pipe_hnd, mem_ctx,
2453 if (!NT_STATUS_IS_OK(result))
2456 /* We only have users as members, but make the output
2457 the same as the output of alias members */
2459 for (i = 0; i < this_time; i++) {
2461 if (c->opt_long_list_entries) {
2462 printf("%s-%d %s\\%s %d\n", sid_str,
2463 group_rids[i], domain_name,
2464 names.names[i].string,
2467 printf("%s\\%s\n", domain_name,
2468 names.names[i].string);
2472 num_members -= this_time;
2476 return NT_STATUS_OK;
2479 static NTSTATUS rpc_list_alias_members(struct net_context *c,
2480 struct rpc_pipe_client *pipe_hnd,
2481 TALLOC_CTX *mem_ctx,
2482 struct policy_handle *domain_pol,
2486 struct rpc_pipe_client *lsa_pipe;
2487 struct policy_handle alias_pol, lsa_pol;
2489 DOM_SID *alias_sids;
2492 enum lsa_SidType *types;
2494 struct lsa_SidArray sid_array;
2496 result = rpccli_samr_OpenAlias(pipe_hnd, mem_ctx,
2498 MAXIMUM_ALLOWED_ACCESS,
2502 if (!NT_STATUS_IS_OK(result))
2505 result = rpccli_samr_GetMembersInAlias(pipe_hnd, mem_ctx,
2509 if (!NT_STATUS_IS_OK(result)) {
2510 d_fprintf(stderr, _("Couldn't list alias members\n"));
2514 num_members = sid_array.num_sids;
2516 if (num_members == 0) {
2517 return NT_STATUS_OK;
2520 result = cli_rpc_pipe_open_noauth(rpc_pipe_np_smb_conn(pipe_hnd),
2521 &ndr_table_lsarpc.syntax_id,
2523 if (!NT_STATUS_IS_OK(result)) {
2524 d_fprintf(stderr, _("Couldn't open LSA pipe. Error was %s\n"),
2525 nt_errstr(result) );
2529 result = rpccli_lsa_open_policy(lsa_pipe, mem_ctx, true,
2530 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
2532 if (!NT_STATUS_IS_OK(result)) {
2533 d_fprintf(stderr, _("Couldn't open LSA policy handle\n"));
2534 TALLOC_FREE(lsa_pipe);
2538 alias_sids = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, num_members);
2540 d_fprintf(stderr, _("Out of memory\n"));
2541 TALLOC_FREE(lsa_pipe);
2542 return NT_STATUS_NO_MEMORY;
2545 for (i=0; i<num_members; i++) {
2546 sid_copy(&alias_sids[i], sid_array.sids[i].sid);
2549 result = rpccli_lsa_lookup_sids(lsa_pipe, mem_ctx, &lsa_pol,
2550 num_members, alias_sids,
2551 &domains, &names, &types);
2553 if (!NT_STATUS_IS_OK(result) &&
2554 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
2555 d_fprintf(stderr, _("Couldn't lookup SIDs\n"));
2556 TALLOC_FREE(lsa_pipe);
2560 for (i = 0; i < num_members; i++) {
2562 sid_to_fstring(sid_str, &alias_sids[i]);
2564 if (c->opt_long_list_entries) {
2565 printf("%s %s\\%s %d\n", sid_str,
2566 domains[i] ? domains[i] : _("*unknown*"),
2567 names[i] ? names[i] : _("*unknown*"), types[i]);
2570 printf("%s\\%s\n", domains[i], names[i]);
2572 printf("%s\n", sid_str);
2576 TALLOC_FREE(lsa_pipe);
2577 return NT_STATUS_OK;
2580 static NTSTATUS rpc_group_members_internals(struct net_context *c,
2581 const DOM_SID *domain_sid,
2582 const char *domain_name,
2583 struct cli_state *cli,
2584 struct rpc_pipe_client *pipe_hnd,
2585 TALLOC_CTX *mem_ctx,
2590 struct policy_handle connect_pol, domain_pol;
2591 struct samr_Ids rids, rid_types;
2592 struct lsa_String lsa_acct_name;
2594 /* Get sam policy handle */
2596 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
2598 MAXIMUM_ALLOWED_ACCESS,
2601 if (!NT_STATUS_IS_OK(result))
2604 /* Get domain policy handle */
2606 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
2608 MAXIMUM_ALLOWED_ACCESS,
2609 CONST_DISCARD(struct dom_sid2 *, domain_sid),
2612 if (!NT_STATUS_IS_OK(result))
2615 init_lsa_String(&lsa_acct_name, argv[0]); /* sure? */
2617 result = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
2624 if (!NT_STATUS_IS_OK(result)) {
2626 /* Ok, did not find it in the global sam, try with builtin */
2628 DOM_SID sid_Builtin;
2630 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
2632 sid_copy(&sid_Builtin, &global_sid_Builtin);
2634 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
2636 MAXIMUM_ALLOWED_ACCESS,
2640 if (!NT_STATUS_IS_OK(result)) {
2641 d_fprintf(stderr, _("Couldn't find group %s\n"),
2646 result = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
2653 if (!NT_STATUS_IS_OK(result)) {
2654 d_fprintf(stderr, _("Couldn't find group %s\n"),
2660 if (rids.count != 1) {
2661 d_fprintf(stderr, _("Couldn't find group %s\n"),
2666 if (rid_types.ids[0] == SID_NAME_DOM_GRP) {
2667 return rpc_list_group_members(c, pipe_hnd, mem_ctx, domain_name,
2668 domain_sid, &domain_pol,
2672 if (rid_types.ids[0] == SID_NAME_ALIAS) {
2673 return rpc_list_alias_members(c, pipe_hnd, mem_ctx, &domain_pol,
2677 return NT_STATUS_NO_SUCH_GROUP;
2680 static int rpc_group_members(struct net_context *c, int argc, const char **argv)
2682 if (argc != 1 || c->display_usage) {
2683 return rpc_group_usage(c, argc, argv);
2686 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
2687 rpc_group_members_internals,
2691 static int rpc_group_rename_internals(struct net_context *c, int argc, const char **argv)
2693 NET_API_STATUS status;
2694 struct GROUP_INFO_0 g0;
2698 d_printf(_("Usage: 'net rpc group rename group newname'\n"));
2702 g0.grpi0_name = argv[1];
2704 status = NetGroupSetInfo(c->opt_host,
2711 d_fprintf(stderr, _("Renaming group %s failed with: %s\n"),
2712 argv[0], libnetapi_get_error_string(c->netapi_ctx,
2720 static int rpc_group_rename(struct net_context *c, int argc, const char **argv)
2722 if (argc != 2 || c->display_usage) {
2723 return rpc_group_usage(c, argc, argv);
2726 return rpc_group_rename_internals(c, argc, argv);
2730 * 'net rpc group' entrypoint.
2731 * @param argc Standard main() style argc.
2732 * @param argv Standard main() style argv. Initial components are already
2736 int net_rpc_group(struct net_context *c, int argc, const char **argv)
2738 NET_API_STATUS status;
2740 struct functable func[] = {
2745 N_("Create specified group"),
2746 N_("net rpc group add\n"
2747 " Create specified group")
2753 N_("Delete specified group"),
2754 N_("net rpc group delete\n"
2755 " Delete specified group")
2761 N_("Add member to group"),
2762 N_("net rpc group addmem\n"
2763 " Add member to group")
2769 N_("Remove member from group"),
2770 N_("net rpc group delmem\n"
2771 " Remove member from group")
2778 N_("net rpc group list\n"
2785 N_("List group members"),
2786 N_("net rpc group members\n"
2787 " List group members")
2794 N_("net rpc group rename\n"
2797 {NULL, NULL, 0, NULL, NULL}
2800 status = libnetapi_init(&c->netapi_ctx);
2804 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
2805 libnetapi_set_password(c->netapi_ctx, c->opt_password);
2806 if (c->opt_kerberos) {
2807 libnetapi_set_use_kerberos(c->netapi_ctx);
2811 if (c->display_usage) {
2812 d_printf(_("Usage:\n"));
2813 d_printf(_("net rpc group\n"
2814 " Alias for net rpc group list global "
2815 "local builtin\n"));
2816 net_display_usage_from_functable(func);
2820 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
2821 rpc_group_list_internals,
2825 return net_run_function(c, argc, argv, "net rpc group", func);
2828 /****************************************************************************/
2830 static int rpc_share_usage(struct net_context *c, int argc, const char **argv)
2832 return net_share_usage(c, argc, argv);
2836 * Add a share on a remote RPC server.
2838 * @param argc Standard main() style argc.
2839 * @param argv Standard main() style argv. Initial components are already
2842 * @return A shell status integer (0 for success).
2845 static int rpc_share_add(struct net_context *c, int argc, const char **argv)
2847 NET_API_STATUS status;
2850 uint32 type = STYPE_DISKTREE; /* only allow disk shares to be added */
2851 uint32 num_users=0, perms=0;
2852 char *password=NULL; /* don't allow a share password */
2853 struct SHARE_INFO_2 i2;
2854 uint32_t parm_error = 0;
2856 if ((argc < 1) || !strchr(argv[0], '=') || c->display_usage) {
2857 return rpc_share_usage(c, argc, argv);
2860 if ((sharename = talloc_strdup(c, argv[0])) == NULL) {
2864 path = strchr(sharename, '=');
2871 i2.shi2_netname = sharename;
2872 i2.shi2_type = type;
2873 i2.shi2_remark = c->opt_comment;
2874 i2.shi2_permissions = perms;
2875 i2.shi2_max_uses = c->opt_maxusers;
2876 i2.shi2_current_uses = num_users;
2877 i2.shi2_path = path;
2878 i2.shi2_passwd = password;
2880 status = NetShareAdd(c->opt_host,
2885 printf(_("NetShareAdd failed with: %s\n"),
2886 libnetapi_get_error_string(c->netapi_ctx, status));
2893 * Delete a share on a remote RPC server.
2895 * @param domain_sid The domain sid acquired from the remote server.
2896 * @param argc Standard main() style argc.
2897 * @param argv Standard main() style argv. Initial components are already
2900 * @return A shell status integer (0 for success).
2902 static int rpc_share_delete(struct net_context *c, int argc, const char **argv)
2904 if (argc < 1 || c->display_usage) {
2905 return rpc_share_usage(c, argc, argv);
2908 return NetShareDel(c->opt_host, argv[0], 0);
2912 * Formatted print of share info
2914 * @param r pointer to SHARE_INFO_1 to format
2917 static void display_share_info_1(struct net_context *c,
2918 struct SHARE_INFO_1 *r)
2920 if (c->opt_long_list_entries) {
2921 d_printf("%-12s %-8.8s %-50s\n",
2923 net_share_type_str(r->shi1_type & ~(STYPE_TEMPORARY|STYPE_HIDDEN)),
2926 d_printf("%s\n", r->shi1_netname);
2930 static WERROR get_share_info(struct net_context *c,
2931 struct rpc_pipe_client *pipe_hnd,
2932 TALLOC_CTX *mem_ctx,
2936 struct srvsvc_NetShareInfoCtr *info_ctr)
2940 union srvsvc_NetShareInfo info;
2942 /* no specific share requested, enumerate all */
2945 uint32_t preferred_len = 0xffffffff;
2946 uint32_t total_entries = 0;
2947 uint32_t resume_handle = 0;
2949 info_ctr->level = level;
2951 status = rpccli_srvsvc_NetShareEnumAll(pipe_hnd, mem_ctx,
2961 /* request just one share */
2962 status = rpccli_srvsvc_NetShareGetInfo(pipe_hnd, mem_ctx,
2969 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(result)) {
2974 ZERO_STRUCTP(info_ctr);
2976 info_ctr->level = level;
2981 struct srvsvc_NetShareCtr1 *ctr1;
2983 ctr1 = TALLOC_ZERO_P(mem_ctx, struct srvsvc_NetShareCtr1);
2984 W_ERROR_HAVE_NO_MEMORY(ctr1);
2987 ctr1->array = info.info1;
2989 info_ctr->ctr.ctr1 = ctr1;
2993 struct srvsvc_NetShareCtr2 *ctr2;
2995 ctr2 = TALLOC_ZERO_P(mem_ctx, struct srvsvc_NetShareCtr2);
2996 W_ERROR_HAVE_NO_MEMORY(ctr2);
2999 ctr2->array = info.info2;
3001 info_ctr->ctr.ctr2 = ctr2;
3005 struct srvsvc_NetShareCtr502 *ctr502;
3007 ctr502 = TALLOC_ZERO_P(mem_ctx, struct srvsvc_NetShareCtr502);
3008 W_ERROR_HAVE_NO_MEMORY(ctr502);
3011 ctr502->array = info.info502;
3013 info_ctr->ctr.ctr502 = ctr502;
3021 * 'net rpc share list' entrypoint.
3022 * @param argc Standard main() style argc.
3023 * @param argv Standard main() style argv. Initial components are already
3026 static int rpc_share_list(struct net_context *c, int argc, const char **argv)
3028 NET_API_STATUS status;
3029 struct SHARE_INFO_1 *i1 = NULL;
3030 uint32_t entries_read = 0;
3031 uint32_t total_entries = 0;
3032 uint32_t resume_handle = 0;
3033 uint32_t i, level = 1;
3035 if (c->display_usage) {
3036 d_printf(_("Usage\n"
3037 "net rpc share list\n"
3038 " List shares on remote server\n"));
3042 status = NetShareEnum(c->opt_host,
3044 (uint8_t **)(void *)&i1,
3053 /* Display results */
3055 if (c->opt_long_list_entries) {
3057 "\nEnumerating shared resources (exports) on remote server:\n\n"
3058 "\nShare name Type Description\n"
3059 "---------- ---- -----------\n"));
3061 for (i = 0; i < entries_read; i++)
3062 display_share_info_1(c, &i1[i]);
3067 static bool check_share_availability(struct cli_state *cli, const char *netname)
3069 if (!NT_STATUS_IS_OK(cli_tcon_andx(cli, netname, "A:", "", 0))) {
3070 d_printf(_("skipping [%s]: not a file share.\n"), netname);
3080 static bool check_share_sanity(struct net_context *c, struct cli_state *cli,
3081 const char *netname, uint32 type)
3083 /* only support disk shares */
3084 if (! ( type == STYPE_DISKTREE || type == (STYPE_DISKTREE | STYPE_HIDDEN)) ) {
3085 printf(_("share [%s] is not a diskshare (type: %x)\n"), netname,
3090 /* skip builtin shares */
3091 /* FIXME: should print$ be added too ? */
3092 if (strequal(netname,"IPC$") || strequal(netname,"ADMIN$") ||
3093 strequal(netname,"global"))
3096 if (c->opt_exclude && in_list(netname, c->opt_exclude, false)) {
3097 printf(_("excluding [%s]\n"), netname);
3101 return check_share_availability(cli, netname);
3105 * Migrate shares from a remote RPC server to the local RPC server.
3107 * All parameters are provided by the run_rpc_command function, except for
3108 * argc, argv which are passed through.
3110 * @param domain_sid The domain sid acquired from the remote server.
3111 * @param cli A cli_state connected to the server.
3112 * @param mem_ctx Talloc context, destroyed on completion of the function.
3113 * @param argc Standard main() style argc.
3114 * @param argv Standard main() style argv. Initial components are already
3117 * @return Normal NTSTATUS return.
3120 static NTSTATUS rpc_share_migrate_shares_internals(struct net_context *c,
3121 const DOM_SID *domain_sid,
3122 const char *domain_name,
3123 struct cli_state *cli,
3124 struct rpc_pipe_client *pipe_hnd,
3125 TALLOC_CTX *mem_ctx,
3130 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3131 struct srvsvc_NetShareInfoCtr ctr_src;
3133 struct rpc_pipe_client *srvsvc_pipe = NULL;
3134 struct cli_state *cli_dst = NULL;
3135 uint32 level = 502; /* includes secdesc */
3136 uint32_t parm_error = 0;
3138 result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
3140 if (!W_ERROR_IS_OK(result))
3143 /* connect destination PI_SRVSVC */
3144 nt_status = connect_dst_pipe(c, &cli_dst, &srvsvc_pipe,
3145 &ndr_table_srvsvc.syntax_id);
3146 if (!NT_STATUS_IS_OK(nt_status))
3150 for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
3152 union srvsvc_NetShareInfo info;
3153 struct srvsvc_NetShareInfo502 info502 =
3154 ctr_src.ctr.ctr502->array[i];
3156 /* reset error-code */
3157 nt_status = NT_STATUS_UNSUCCESSFUL;
3159 if (!check_share_sanity(c, cli, info502.name, info502.type))
3162 /* finally add the share on the dst server */
3164 printf(_("migrating: [%s], path: %s, comment: %s, without "
3166 info502.name, info502.path, info502.comment);
3168 info.info502 = &info502;
3170 nt_status = rpccli_srvsvc_NetShareAdd(srvsvc_pipe, mem_ctx,
3171 srvsvc_pipe->desthost,
3177 if (W_ERROR_V(result) == W_ERROR_V(WERR_FILE_EXISTS)) {
3178 printf(_(" [%s] does already exist\n"),
3183 if (!NT_STATUS_IS_OK(nt_status) || !W_ERROR_IS_OK(result)) {
3184 printf(_("cannot add share: %s\n"), win_errstr(result));
3190 nt_status = NT_STATUS_OK;
3194 cli_shutdown(cli_dst);
3202 * Migrate shares from a RPC server to another.
3204 * @param argc Standard main() style argc.
3205 * @param argv Standard main() style argv. Initial components are already
3208 * @return A shell status integer (0 for success).
3210 static int rpc_share_migrate_shares(struct net_context *c, int argc,
3213 if (c->display_usage) {
3214 d_printf(_("Usage:\n"
3215 "net rpc share migrate shares\n"
3216 " Migrate shares to local server\n"));
3221 printf(_("no server to migrate\n"));
3225 return run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
3226 rpc_share_migrate_shares_internals,
3233 * @param f file_info
3234 * @param mask current search mask
3235 * @param state arg-pointer
3238 static void copy_fn(const char *mnt, file_info *f,
3239 const char *mask, void *state)
3241 static NTSTATUS nt_status;
3242 static struct copy_clistate *local_state;
3243 static fstring filename, new_mask;
3246 struct net_context *c;
3248 local_state = (struct copy_clistate *)state;
3249 nt_status = NT_STATUS_UNSUCCESSFUL;
3253 if (strequal(f->name, ".") || strequal(f->name, ".."))
3256 DEBUG(3,("got mask: %s, name: %s\n", mask, f->name));
3259 if (f->mode & aDIR) {
3261 DEBUG(3,("got dir: %s\n", f->name));
3263 fstrcpy(dir, local_state->cwd);
3265 fstrcat(dir, f->name);
3267 switch (net_mode_share)
3269 case NET_MODE_SHARE_MIGRATE:
3270 /* create that directory */
3271 nt_status = net_copy_file(c, local_state->mem_ctx,
3272 local_state->cli_share_src,
3273 local_state->cli_share_dst,
3275 c->opt_acls? true : false,
3276 c->opt_attrs? true : false,
3277 c->opt_timestamps? true:false,
3281 d_fprintf(stderr, _("Unsupported mode %d\n"), net_mode_share);
3285 if (!NT_STATUS_IS_OK(nt_status))
3286 printf(_("could not handle dir %s: %s\n"),
3287 dir, nt_errstr(nt_status));
3289 /* search below that directory */
3290 fstrcpy(new_mask, dir);
3291 fstrcat(new_mask, "\\*");
3293 old_dir = local_state->cwd;
3294 local_state->cwd = dir;
3295 if (!sync_files(local_state, new_mask))
3296 printf(_("could not handle files\n"));
3297 local_state->cwd = old_dir;
3304 fstrcpy(filename, local_state->cwd);
3305 fstrcat(filename, "\\");
3306 fstrcat(filename, f->name);
3308 DEBUG(3,("got file: %s\n", filename));
3310 switch (net_mode_share)
3312 case NET_MODE_SHARE_MIGRATE:
3313 nt_status = net_copy_file(c, local_state->mem_ctx,
3314 local_state->cli_share_src,
3315 local_state->cli_share_dst,
3317 c->opt_acls? true : false,
3318 c->opt_attrs? true : false,
3319 c->opt_timestamps? true: false,
3323 d_fprintf(stderr, _("Unsupported file mode %d\n"),
3328 if (!NT_STATUS_IS_OK(nt_status))
3329 printf(_("could not handle file %s: %s\n"),
3330 filename, nt_errstr(nt_status));
3335 * sync files, can be called recursivly to list files
3336 * and then call copy_fn for each file
3338 * @param cp_clistate pointer to the copy_clistate we work with
3339 * @param mask the current search mask
3341 * @return Boolean result
3343 static bool sync_files(struct copy_clistate *cp_clistate, const char *mask)
3345 struct cli_state *targetcli;
3346 char *targetpath = NULL;
3348 DEBUG(3,("calling cli_list with mask: %s\n", mask));
3350 if ( !cli_resolve_path(talloc_tos(), "", NULL, cp_clistate->cli_share_src,
3351 mask, &targetcli, &targetpath ) ) {
3352 d_fprintf(stderr, _("cli_resolve_path %s failed with error: "
3354 mask, cli_errstr(cp_clistate->cli_share_src));
3358 if (cli_list(targetcli, targetpath, cp_clistate->attribute, copy_fn, cp_clistate) == -1) {
3359 d_fprintf(stderr, _("listing %s failed with error: %s\n"),
3360 mask, cli_errstr(targetcli));
3369 * Set the top level directory permissions before we do any further copies.
3370 * Should set up ACL inheritance.
3373 bool copy_top_level_perms(struct net_context *c,
3374 struct copy_clistate *cp_clistate,
3375 const char *sharename)
3377 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3379 switch (net_mode_share) {
3380 case NET_MODE_SHARE_MIGRATE:
3381 DEBUG(3,("calling net_copy_fileattr for '.' directory in share %s\n", sharename));
3382 nt_status = net_copy_fileattr(c,
3383 cp_clistate->mem_ctx,
3384 cp_clistate->cli_share_src,
3385 cp_clistate->cli_share_dst,
3387 c->opt_acls? true : false,
3388 c->opt_attrs? true : false,
3389 c->opt_timestamps? true: false,
3393 d_fprintf(stderr, _("Unsupported mode %d\n"), net_mode_share);
3397 if (!NT_STATUS_IS_OK(nt_status)) {
3398 printf(_("Could handle directory attributes for top level "
3399 "directory of share %s. Error %s\n"),
3400 sharename, nt_errstr(nt_status));
3408 * Sync all files inside a remote share to another share (over smb).
3410 * All parameters are provided by the run_rpc_command function, except for
3411 * argc, argv which are passed through.
3413 * @param domain_sid The domain sid acquired from the remote server.
3414 * @param cli A cli_state connected to the server.
3415 * @param mem_ctx Talloc context, destroyed on completion of the function.
3416 * @param argc Standard main() style argc.
3417 * @param argv Standard main() style argv. Initial components are already
3420 * @return Normal NTSTATUS return.
3423 static NTSTATUS rpc_share_migrate_files_internals(struct net_context *c,
3424 const DOM_SID *domain_sid,
3425 const char *domain_name,
3426 struct cli_state *cli,
3427 struct rpc_pipe_client *pipe_hnd,
3428 TALLOC_CTX *mem_ctx,
3433 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3434 struct srvsvc_NetShareInfoCtr ctr_src;
3437 struct copy_clistate cp_clistate;
3438 bool got_src_share = false;
3439 bool got_dst_share = false;
3440 const char *mask = "\\*";
3443 dst = SMB_STRDUP(c->opt_destination?c->opt_destination:"127.0.0.1");
3445 nt_status = NT_STATUS_NO_MEMORY;
3449 result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
3452 if (!W_ERROR_IS_OK(result))
3455 for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
3457 struct srvsvc_NetShareInfo502 info502 =
3458 ctr_src.ctr.ctr502->array[i];
3460 if (!check_share_sanity(c, cli, info502.name, info502.type))
3463 /* one might not want to mirror whole discs :) */
3464 if (strequal(info502.name, "print$") || info502.name[1] == '$') {
3465 d_printf(_("skipping [%s]: builtin/hidden share\n"),
3470 switch (net_mode_share)
3472 case NET_MODE_SHARE_MIGRATE:
3476 d_fprintf(stderr, _("Unsupported mode %d\n"),
3480 printf(_(" [%s] files and directories %s ACLs, %s DOS "
3483 c->opt_acls ? _("including") : _("without"),
3484 c->opt_attrs ? _("including") : _("without"),
3485 c->opt_timestamps ? _("(preserving timestamps)") : "");
3487 cp_clistate.mem_ctx = mem_ctx;
3488 cp_clistate.cli_share_src = NULL;
3489 cp_clistate.cli_share_dst = NULL;
3490 cp_clistate.cwd = NULL;
3491 cp_clistate.attribute = aSYSTEM | aHIDDEN | aDIR;
3494 /* open share source */
3495 nt_status = connect_to_service(c, &cp_clistate.cli_share_src,
3496 &cli->dest_ss, cli->desthost,
3497 info502.name, "A:");
3498 if (!NT_STATUS_IS_OK(nt_status))
3501 got_src_share = true;
3503 if (net_mode_share == NET_MODE_SHARE_MIGRATE) {
3504 /* open share destination */
3505 nt_status = connect_to_service(c, &cp_clistate.cli_share_dst,
3506 NULL, dst, info502.name, "A:");
3507 if (!NT_STATUS_IS_OK(nt_status))
3510 got_dst_share = true;
3513 if (!copy_top_level_perms(c, &cp_clistate, info502.name)) {
3514 d_fprintf(stderr, _("Could not handle the top level "
3515 "directory permissions for the "
3516 "share: %s\n"), info502.name);
3517 nt_status = NT_STATUS_UNSUCCESSFUL;
3521 if (!sync_files(&cp_clistate, mask)) {
3522 d_fprintf(stderr, _("could not handle files for share: "
3523 "%s\n"), info502.name);
3524 nt_status = NT_STATUS_UNSUCCESSFUL;
3529 nt_status = NT_STATUS_OK;
3534 cli_shutdown(cp_clistate.cli_share_src);
3537 cli_shutdown(cp_clistate.cli_share_dst);
3544 static int rpc_share_migrate_files(struct net_context *c, int argc, const char **argv)
3546 if (c->display_usage) {
3547 d_printf(_("Usage:\n"
3548 "net share migrate files\n"
3549 " Migrate files to local server\n"));
3554 d_printf(_("no server to migrate\n"));
3558 return run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
3559 rpc_share_migrate_files_internals,
3564 * Migrate share-ACLs from a remote RPC server to the local RPC server.
3566 * All parameters are provided by the run_rpc_command function, except for
3567 * argc, argv which are passed through.
3569 * @param domain_sid The domain sid acquired from the remote server.
3570 * @param cli A cli_state connected to the server.
3571 * @param mem_ctx Talloc context, destroyed on completion of the function.
3572 * @param argc Standard main() style argc.
3573 * @param argv Standard main() style argv. Initial components are already
3576 * @return Normal NTSTATUS return.
3579 static NTSTATUS rpc_share_migrate_security_internals(struct net_context *c,
3580 const DOM_SID *domain_sid,
3581 const char *domain_name,
3582 struct cli_state *cli,
3583 struct rpc_pipe_client *pipe_hnd,
3584 TALLOC_CTX *mem_ctx,
3589 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3590 struct srvsvc_NetShareInfoCtr ctr_src;
3591 union srvsvc_NetShareInfo info;
3593 struct rpc_pipe_client *srvsvc_pipe = NULL;
3594 struct cli_state *cli_dst = NULL;
3595 uint32 level = 502; /* includes secdesc */
3596 uint32_t parm_error = 0;
3598 result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
3601 if (!W_ERROR_IS_OK(result))
3604 /* connect destination PI_SRVSVC */
3605 nt_status = connect_dst_pipe(c, &cli_dst, &srvsvc_pipe,
3606 &ndr_table_srvsvc.syntax_id);
3607 if (!NT_STATUS_IS_OK(nt_status))
3611 for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
3613 struct srvsvc_NetShareInfo502 info502 =
3614 ctr_src.ctr.ctr502->array[i];
3616 /* reset error-code */
3617 nt_status = NT_STATUS_UNSUCCESSFUL;
3619 if (!check_share_sanity(c, cli, info502.name, info502.type))
3622 printf(_("migrating: [%s], path: %s, comment: %s, including "
3624 info502.name, info502.path, info502.comment);
3627 display_sec_desc(info502.sd_buf.sd);
3629 /* FIXME: shouldn't we be able to just set the security descriptor ? */
3630 info.info502 = &info502;
3632 /* finally modify the share on the dst server */
3633 nt_status = rpccli_srvsvc_NetShareSetInfo(srvsvc_pipe, mem_ctx,
3634 srvsvc_pipe->desthost,
3640 if (!NT_STATUS_IS_OK(nt_status) || !W_ERROR_IS_OK(result)) {
3641 printf(_("cannot set share-acl: %s\n"),
3642 win_errstr(result));
3648 nt_status = NT_STATUS_OK;
3652 cli_shutdown(cli_dst);
3660 * Migrate share-acls from a RPC server to another.
3662 * @param argc Standard main() style argc.
3663 * @param argv Standard main() style argv. Initial components are already
3666 * @return A shell status integer (0 for success).
3668 static int rpc_share_migrate_security(struct net_context *c, int argc,
3671 if (c->display_usage) {
3672 d_printf(_("Usage:\n"
3673 "net rpc share migrate security\n"
3674 " Migrate share-acls to local server\n"));
3679 d_printf(_("no server to migrate\n"));
3683 return run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
3684 rpc_share_migrate_security_internals,
3689 * Migrate shares (including share-definitions, share-acls and files with acls/attrs)
3690 * from one server to another.
3692 * @param argc Standard main() style argc.
3693 * @param argv Standard main() style argv. Initial components are already
3696 * @return A shell status integer (0 for success).
3699 static int rpc_share_migrate_all(struct net_context *c, int argc,
3704 if (c->display_usage) {
3705 d_printf(_("Usage:\n"
3706 "net rpc share migrate all\n"
3707 " Migrates shares including all share settings\n"));
3712 d_printf(_("no server to migrate\n"));
3716 /* order is important. we don't want to be locked out by the share-acl
3717 * before copying files - gd */
3719 ret = run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
3720 rpc_share_migrate_shares_internals, argc, argv);
3724 ret = run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
3725 rpc_share_migrate_files_internals, argc, argv);
3729 return run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
3730 rpc_share_migrate_security_internals, argc,
3736 * 'net rpc share migrate' entrypoint.
3737 * @param argc Standard main() style argc.
3738 * @param argv Standard main() style argv. Initial components are already
3741 static int rpc_share_migrate(struct net_context *c, int argc, const char **argv)
3744 struct functable func[] = {
3747 rpc_share_migrate_all,
3749 N_("Migrate shares from remote to local server"),
3750 N_("net rpc share migrate all\n"
3751 " Migrate shares from remote to local server")
3755 rpc_share_migrate_files,
3757 N_("Migrate files from remote to local server"),
3758 N_("net rpc share migrate files\n"
3759 " Migrate files from remote to local server")
3763 rpc_share_migrate_security,
3765 N_("Migrate share-ACLs from remote to local server"),
3766 N_("net rpc share migrate security\n"
3767 " Migrate share-ACLs from remote to local server")
3771 rpc_share_migrate_shares,
3773 N_("Migrate shares from remote to local server"),
3774 N_("net rpc share migrate shares\n"
3775 " Migrate shares from remote to local server")
3777 {NULL, NULL, 0, NULL, NULL}
3780 net_mode_share = NET_MODE_SHARE_MIGRATE;
3782 return net_run_function(c, argc, argv, "net rpc share migrate", func);
3791 static int num_server_aliases;
3792 static struct full_alias *server_aliases;
3795 * Add an alias to the static list.
3797 static void push_alias(TALLOC_CTX *mem_ctx, struct full_alias *alias)
3799 if (server_aliases == NULL)
3800 server_aliases = SMB_MALLOC_ARRAY(struct full_alias, 100);
3802 server_aliases[num_server_aliases] = *alias;
3803 num_server_aliases += 1;
3807 * For a specific domain on the server, fetch all the aliases
3808 * and their members. Add all of them to the server_aliases.
3811 static NTSTATUS rpc_fetch_domain_aliases(struct rpc_pipe_client *pipe_hnd,
3812 TALLOC_CTX *mem_ctx,
3813 struct policy_handle *connect_pol,
3814 const DOM_SID *domain_sid)
3816 uint32 start_idx, max_entries, num_entries, i;
3817 struct samr_SamArray *groups = NULL;
3819 struct policy_handle domain_pol;
3821 /* Get domain policy handle */
3823 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
3825 MAXIMUM_ALLOWED_ACCESS,
3826 CONST_DISCARD(struct dom_sid2 *, domain_sid),
3828 if (!NT_STATUS_IS_OK(result))
3835 result = rpccli_samr_EnumDomainAliases(pipe_hnd, mem_ctx,
3841 for (i = 0; i < num_entries; i++) {
3843 struct policy_handle alias_pol;
3844 struct full_alias alias;
3845 struct lsa_SidArray sid_array;
3848 result = rpccli_samr_OpenAlias(pipe_hnd, mem_ctx,
3850 MAXIMUM_ALLOWED_ACCESS,
3851 groups->entries[i].idx,
3853 if (!NT_STATUS_IS_OK(result))
3856 result = rpccli_samr_GetMembersInAlias(pipe_hnd, mem_ctx,
3859 if (!NT_STATUS_IS_OK(result))
3862 alias.num_members = sid_array.num_sids;
3864 result = rpccli_samr_Close(pipe_hnd, mem_ctx, &alias_pol);
3865 if (!NT_STATUS_IS_OK(result))
3868 alias.members = NULL;
3870 if (alias.num_members > 0) {
3871 alias.members = SMB_MALLOC_ARRAY(DOM_SID, alias.num_members);
3873 for (j = 0; j < alias.num_members; j++)
3874 sid_copy(&alias.members[j],
3875 sid_array.sids[j].sid);
3878 sid_copy(&alias.sid, domain_sid);
3879 sid_append_rid(&alias.sid, groups->entries[i].idx);
3881 push_alias(mem_ctx, &alias);
3883 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
3885 result = NT_STATUS_OK;
3888 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
3894 * Dump server_aliases as names for debugging purposes.
3897 static NTSTATUS rpc_aliaslist_dump(struct net_context *c,
3898 const DOM_SID *domain_sid,
3899 const char *domain_name,
3900 struct cli_state *cli,
3901 struct rpc_pipe_client *pipe_hnd,
3902 TALLOC_CTX *mem_ctx,
3908 struct policy_handle lsa_pol;
3910 result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
3911 SEC_FLAG_MAXIMUM_ALLOWED,
3913 if (!NT_STATUS_IS_OK(result))
3916 for (i=0; i<num_server_aliases; i++) {
3919 enum lsa_SidType *types;
3922 struct full_alias *alias = &server_aliases[i];
3924 result = rpccli_lsa_lookup_sids(pipe_hnd, mem_ctx, &lsa_pol, 1,
3926 &domains, &names, &types);
3927 if (!NT_STATUS_IS_OK(result))
3930 DEBUG(1, ("%s\\%s %d: ", domains[0], names[0], types[0]));
3932 if (alias->num_members == 0) {
3937 result = rpccli_lsa_lookup_sids(pipe_hnd, mem_ctx, &lsa_pol,
3940 &domains, &names, &types);
3942 if (!NT_STATUS_IS_OK(result) &&
3943 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
3946 for (j=0; j<alias->num_members; j++)
3947 DEBUG(1, ("%s\\%s (%d); ",
3948 domains[j] ? domains[j] : "*unknown*",
3949 names[j] ? names[j] : "*unknown*",types[j]));
3953 rpccli_lsa_Close(pipe_hnd, mem_ctx, &lsa_pol);
3955 return NT_STATUS_OK;
3959 * Fetch a list of all server aliases and their members into
3963 static NTSTATUS rpc_aliaslist_internals(struct net_context *c,
3964 const DOM_SID *domain_sid,
3965 const char *domain_name,
3966 struct cli_state *cli,
3967 struct rpc_pipe_client *pipe_hnd,
3968 TALLOC_CTX *mem_ctx,
3973 struct policy_handle connect_pol;
3975 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
3977 MAXIMUM_ALLOWED_ACCESS,
3980 if (!NT_STATUS_IS_OK(result))
3983 result = rpc_fetch_domain_aliases(pipe_hnd, mem_ctx, &connect_pol,
3984 &global_sid_Builtin);
3986 if (!NT_STATUS_IS_OK(result))
3989 result = rpc_fetch_domain_aliases(pipe_hnd, mem_ctx, &connect_pol,
3992 rpccli_samr_Close(pipe_hnd, mem_ctx, &connect_pol);
3997 static void init_user_token(NT_USER_TOKEN *token, DOM_SID *user_sid)
3999 token->num_sids = 4;
4001 if (!(token->user_sids = SMB_MALLOC_ARRAY(DOM_SID, 4))) {
4002 d_fprintf(stderr, _("malloc failed\n"));
4003 token->num_sids = 0;
4007 token->user_sids[0] = *user_sid;
4008 sid_copy(&token->user_sids[1], &global_sid_World);
4009 sid_copy(&token->user_sids[2], &global_sid_Network);
4010 sid_copy(&token->user_sids[3], &global_sid_Authenticated_Users);
4013 static void free_user_token(NT_USER_TOKEN *token)
4015 SAFE_FREE(token->user_sids);
4018 static void add_sid_to_token(NT_USER_TOKEN *token, DOM_SID *sid)
4020 if (is_sid_in_token(token, sid))
4023 token->user_sids = SMB_REALLOC_ARRAY(token->user_sids, DOM_SID, token->num_sids+1);
4024 if (!token->user_sids) {
4028 sid_copy(&token->user_sids[token->num_sids], sid);
4030 token->num_sids += 1;
4035 NT_USER_TOKEN token;
4038 static void dump_user_token(struct user_token *token)
4042 d_printf("%s\n", token->name);
4044 for (i=0; i<token->token.num_sids; i++) {
4045 d_printf(" %s\n", sid_string_tos(&token->token.user_sids[i]));
4049 static bool is_alias_member(DOM_SID *sid, struct full_alias *alias)
4053 for (i=0; i<alias->num_members; i++) {
4054 if (sid_compare(sid, &alias->members[i]) == 0)
4061 static void collect_sid_memberships(NT_USER_TOKEN *token, DOM_SID sid)
4065 for (i=0; i<num_server_aliases; i++) {
4066 if (is_alias_member(&sid, &server_aliases[i]))
4067 add_sid_to_token(token, &server_aliases[i].sid);
4072 * We got a user token with all the SIDs we can know about without asking the
4073 * server directly. These are the user and domain group sids. All of these can
4074 * be members of aliases. So scan the list of aliases for each of the SIDs and
4075 * add them to the token.
4078 static void collect_alias_memberships(NT_USER_TOKEN *token)
4080 int num_global_sids = token->num_sids;
4083 for (i=0; i<num_global_sids; i++) {
4084 collect_sid_memberships(token, token->user_sids[i]);
4088 static bool get_user_sids(const char *domain, const char *user, NT_USER_TOKEN *token)
4090 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
4091 enum wbcSidType type;
4093 struct wbcDomainSid wsid;
4094 char *sid_str = NULL;
4096 uint32_t num_groups;
4097 gid_t *groups = NULL;
4100 fstr_sprintf(full_name, "%s%c%s",
4101 domain, *lp_winbind_separator(), user);
4103 /* First let's find out the user sid */
4105 wbc_status = wbcLookupName(domain, user, &wsid, &type);
4107 if (!WBC_ERROR_IS_OK(wbc_status)) {
4108 DEBUG(1, ("winbind could not find %s: %s\n",
4109 full_name, wbcErrorString(wbc_status)));
4113 wbc_status = wbcSidToString(&wsid, &sid_str);
4114 if (!WBC_ERROR_IS_OK(wbc_status)) {
4118 if (type != SID_NAME_USER) {
4119 wbcFreeMemory(sid_str);
4120 DEBUG(1, ("%s is not a user\n", full_name));
4124 if (!string_to_sid(&user_sid, sid_str)) {
4125 DEBUG(1,("Could not convert sid %s from string\n", sid_str));
4129 wbcFreeMemory(sid_str);
4132 init_user_token(token, &user_sid);
4134 /* And now the groups winbind knows about */
4136 wbc_status = wbcGetGroups(full_name, &num_groups, &groups);
4137 if (!WBC_ERROR_IS_OK(wbc_status)) {
4138 DEBUG(1, ("winbind could not get groups of %s: %s\n",
4139 full_name, wbcErrorString(wbc_status)));
4143 for (i = 0; i < num_groups; i++) {
4144 gid_t gid = groups[i];
4147 wbc_status = wbcGidToSid(gid, &wsid);
4148 if (!WBC_ERROR_IS_OK(wbc_status)) {
4149 DEBUG(1, ("winbind could not find SID of gid %u: %s\n",
4150 (unsigned int)gid, wbcErrorString(wbc_status)));
4151 wbcFreeMemory(groups);
4155 wbc_status = wbcSidToString(&wsid, &sid_str);
4156 if (!WBC_ERROR_IS_OK(wbc_status)) {
4157 wbcFreeMemory(groups);
4161 DEBUG(3, (" %s\n", sid_str));
4163 string_to_sid(&sid, sid_str);
4164 wbcFreeMemory(sid_str);
4167 add_sid_to_token(token, &sid);
4169 wbcFreeMemory(groups);
4175 * Get a list of all user tokens we want to look at
4178 static bool get_user_tokens(struct net_context *c, int *num_tokens,
4179 struct user_token **user_tokens)
4181 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
4182 uint32_t i, num_users;
4184 struct user_token *result;
4185 TALLOC_CTX *frame = NULL;
4187 if (lp_winbind_use_default_domain() &&
4188 (c->opt_target_workgroup == NULL)) {
4189 d_fprintf(stderr, _("winbind use default domain = yes set, "
4190 "please specify a workgroup\n"));
4194 /* Send request to winbind daemon */
4196 wbc_status = wbcListUsers(NULL, &num_users, &users);
4197 if (!WBC_ERROR_IS_OK(wbc_status)) {
4198 DEBUG(1, (_("winbind could not list users: %s\n"),
4199 wbcErrorString(wbc_status)));
4203 result = SMB_MALLOC_ARRAY(struct user_token, num_users);
4205 if (result == NULL) {
4206 DEBUG(1, ("Could not malloc sid array\n"));
4207 wbcFreeMemory(users);
4211 frame = talloc_stackframe();
4212 for (i=0; i < num_users; i++) {
4213 fstring domain, user;
4216 fstrcpy(result[i].name, users[i]);
4218 p = strchr(users[i], *lp_winbind_separator());
4220 DEBUG(3, ("%s\n", users[i]));
4223 fstrcpy(domain, c->opt_target_workgroup);
4224 fstrcpy(user, users[i]);
4227 fstrcpy(domain, users[i]);
4232 get_user_sids(domain, user, &(result[i].token));
4236 wbcFreeMemory(users);
4238 *num_tokens = num_users;
4239 *user_tokens = result;
4244 static bool get_user_tokens_from_file(FILE *f,
4246 struct user_token **tokens)
4248 struct user_token *token = NULL;
4253 if (fgets(line, sizeof(line)-1, f) == NULL) {
4257 if (line[strlen(line)-1] == '\n')
4258 line[strlen(line)-1] = '\0';
4260 if (line[0] == ' ') {
4264 if(!string_to_sid(&sid, &line[1])) {
4265 DEBUG(1,("get_user_tokens_from_file: Could "
4266 "not convert sid %s \n",&line[1]));
4270 if (token == NULL) {
4271 DEBUG(0, ("File does not begin with username"));
4275 add_sid_to_token(&token->token, &sid);
4279 /* And a new user... */
4282 *tokens = SMB_REALLOC_ARRAY(*tokens, struct user_token, *num_tokens);
4283 if (*tokens == NULL) {
4284 DEBUG(0, ("Could not realloc tokens\n"));
4288 token = &((*tokens)[*num_tokens-1]);
4290 fstrcpy(token->name, line);
4291 token->token.num_sids = 0;
4292 token->token.user_sids = NULL;
4301 * Show the list of all users that have access to a share
4304 static void show_userlist(struct rpc_pipe_client *pipe_hnd,
4305 TALLOC_CTX *mem_ctx,
4306 const char *netname,
4308 struct user_token *tokens)
4311 SEC_DESC *share_sd = NULL;
4312 SEC_DESC *root_sd = NULL;
4313 struct cli_state *cli = rpc_pipe_np_smb_conn(pipe_hnd);
4315 union srvsvc_NetShareInfo info;
4320 status = rpccli_srvsvc_NetShareGetInfo(pipe_hnd, mem_ctx,
4327 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(result)) {
4328 DEBUG(1, ("Coult not query secdesc for share %s\n",
4333 share_sd = info.info502->sd_buf.sd;
4334 if (share_sd == NULL) {
4335 DEBUG(1, ("Got no secdesc for share %s\n",
4341 if (!NT_STATUS_IS_OK(cli_tcon_andx(cli, netname, "A:", "", 0))) {
4345 if (!NT_STATUS_IS_OK(cli_ntcreate(cli, "\\", 0, READ_CONTROL_ACCESS, 0,
4346 FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN, 0x0, 0x0, &fnum))) {
4347 root_sd = cli_query_secdesc(cli, fnum, mem_ctx);
4350 for (i=0; i<num_tokens; i++) {
4353 if (share_sd != NULL) {
4354 status = se_access_check(share_sd, &tokens[i].token,
4357 if (!NT_STATUS_IS_OK(status)) {
4358 DEBUG(1, ("Could not check share_sd for "
4365 if (root_sd == NULL) {
4366 d_printf(" %s\n", tokens[i].name);
4370 status = se_access_check(root_sd, &tokens[i].token,
4372 if (!NT_STATUS_IS_OK(status)) {
4373 DEBUG(1, ("Could not check root_sd for user %s\n",
4377 d_printf(" %s\n", tokens[i].name);
4380 if (fnum != (uint16_t)-1)
4381 cli_close(cli, fnum);
4393 static void collect_share(const char *name, uint32 m,
4394 const char *comment, void *state)
4396 struct share_list *share_list = (struct share_list *)state;
4398 if (m != STYPE_DISKTREE)
4401 share_list->num_shares += 1;
4402 share_list->shares = SMB_REALLOC_ARRAY(share_list->shares, char *, share_list->num_shares);
4403 if (!share_list->shares) {
4404 share_list->num_shares = 0;
4407 share_list->shares[share_list->num_shares-1] = SMB_STRDUP(name);
4411 * List shares on a remote RPC server, including the security descriptors.
4413 * All parameters are provided by the run_rpc_command function, except for
4414 * argc, argv which are passed through.
4416 * @param domain_sid The domain sid acquired from the remote server.
4417 * @param cli A cli_state connected to the server.
4418 * @param mem_ctx Talloc context, destroyed on completion of the function.
4419 * @param argc Standard main() style argc.
4420 * @param argv Standard main() style argv. Initial components are already
4423 * @return Normal NTSTATUS return.
4426 static NTSTATUS rpc_share_allowedusers_internals(struct net_context *c,
4427 const DOM_SID *domain_sid,
4428 const char *domain_name,
4429 struct cli_state *cli,
4430 struct rpc_pipe_client *pipe_hnd,
4431 TALLOC_CTX *mem_ctx,
4440 struct user_token *tokens = NULL;
4443 struct share_list share_list;
4448 f = fopen(argv[0], "r");
4452 DEBUG(0, ("Could not open userlist: %s\n", strerror(errno)));
4453 return NT_STATUS_UNSUCCESSFUL;
4456 r = get_user_tokens_from_file(f, &num_tokens, &tokens);
4462 DEBUG(0, ("Could not read users from file\n"));
4463 return NT_STATUS_UNSUCCESSFUL;
4466 for (i=0; i<num_tokens; i++)
4467 collect_alias_memberships(&tokens[i].token);
4469 share_list.num_shares = 0;
4470 share_list.shares = NULL;
4472 ret = cli_RNetShareEnum(cli, collect_share, &share_list);
4475 DEBUG(0, ("Error returning browse list: %s\n",
4480 for (i = 0; i < share_list.num_shares; i++) {
4481 char *netname = share_list.shares[i];
4483 if (netname[strlen(netname)-1] == '$')
4486 d_printf("%s\n", netname);
4488 show_userlist(pipe_hnd, mem_ctx, netname,
4489 num_tokens, tokens);
4492 for (i=0; i<num_tokens; i++) {
4493 free_user_token(&tokens[i].token);
4496 SAFE_FREE(share_list.shares);
4498 return NT_STATUS_OK;
4501 static int rpc_share_allowedusers(struct net_context *c, int argc,
4506 if (c->display_usage) {
4507 d_printf(_("Usage:\n"
4508 "net rpc share allowedusers\n"
4509 " List allowed users\n"));
4513 result = run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
4514 rpc_aliaslist_internals,
4519 result = run_rpc_command(c, NULL, &ndr_table_lsarpc.syntax_id, 0,
4525 return run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
4526 rpc_share_allowedusers_internals,
4530 int net_usersidlist(struct net_context *c, int argc, const char **argv)
4533 struct user_token *tokens = NULL;
4537 net_usersidlist_usage(c, argc, argv);
4541 if (!get_user_tokens(c, &num_tokens, &tokens)) {
4542 DEBUG(0, ("Could not get the user/sid list\n"));
4546 for (i=0; i<num_tokens; i++) {
4547 dump_user_token(&tokens[i]);
4548 free_user_token(&tokens[i].token);
4555 int net_usersidlist_usage(struct net_context *c, int argc, const char **argv)
4557 d_printf(_("net usersidlist\n"
4558 "\tprints out a list of all users the running winbind knows\n"
4559 "\tabout, together with all their SIDs. This is used as\n"
4560 "\tinput to the 'net rpc share allowedusers' command.\n\n"));
4562 net_common_flags_usage(c, argc, argv);
4567 * 'net rpc share' entrypoint.
4568 * @param argc Standard main() style argc.
4569 * @param argv Standard main() style argv. Initial components are already
4573 int net_rpc_share(struct net_context *c, int argc, const char **argv)
4575 NET_API_STATUS status;
4577 struct functable func[] = {
4583 N_("net rpc share add\n"
4591 N_("net rpc share delete\n"
4596 rpc_share_allowedusers,
4598 N_("Modify allowed users"),
4599 N_("net rpc share allowedusers\n"
4600 " Modify allowed users")
4606 N_("Migrate share to local server"),
4607 N_("net rpc share migrate\n"
4608 " Migrate share to local server")
4615 N_("net rpc share list\n"
4618 {NULL, NULL, 0, NULL, NULL}
4621 status = libnetapi_init(&c->netapi_ctx);
4625 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
4626 libnetapi_set_password(c->netapi_ctx, c->opt_password);
4627 if (c->opt_kerberos) {
4628 libnetapi_set_use_kerberos(c->netapi_ctx);
4632 if (c->display_usage) {
4633 d_printf(_("Usage:\n"
4636 " Alias for net rpc share list\n"));
4637 net_display_usage_from_functable(func);
4641 return rpc_share_list(c, argc, argv);
4644 return net_run_function(c, argc, argv, "net rpc share", func);
4647 static NTSTATUS rpc_sh_share_list(struct net_context *c,
4648 TALLOC_CTX *mem_ctx,
4649 struct rpc_sh_ctx *ctx,
4650 struct rpc_pipe_client *pipe_hnd,
4651 int argc, const char **argv)
4654 return werror_to_ntstatus(W_ERROR(rpc_share_list(c, argc, argv)));
4657 static NTSTATUS rpc_sh_share_add(struct net_context *c,
4658 TALLOC_CTX *mem_ctx,
4659 struct rpc_sh_ctx *ctx,
4660 struct rpc_pipe_client *pipe_hnd,
4661 int argc, const char **argv)
4663 NET_API_STATUS status;
4664 uint32_t parm_err = 0;
4665 struct SHARE_INFO_2 i2;
4667 if ((argc < 2) || (argc > 3)) {
4668 d_fprintf(stderr, _("usage: %s <share> <path> [comment]\n"),
4670 return NT_STATUS_INVALID_PARAMETER;
4673 i2.shi2_netname = argv[0];
4674 i2.shi2_type = STYPE_DISKTREE;
4675 i2.shi2_remark = (argc == 3) ? argv[2] : "";
4676 i2.shi2_permissions = 0;
4677 i2.shi2_max_uses = 0;
4678 i2.shi2_current_uses = 0;
4679 i2.shi2_path = argv[1];
4680 i2.shi2_passwd = NULL;
4682 status = NetShareAdd(pipe_hnd->desthost,
4687 return werror_to_ntstatus(W_ERROR(status));
4690 static NTSTATUS rpc_sh_share_delete(struct net_context *c,
4691 TALLOC_CTX *mem_ctx,
4692 struct rpc_sh_ctx *ctx,
4693 struct rpc_pipe_client *pipe_hnd,
4694 int argc, const char **argv)
4697 d_fprintf(stderr, _("usage: %s <share>\n"), ctx->whoami);
4698 return NT_STATUS_INVALID_PARAMETER;
4701 return werror_to_ntstatus(W_ERROR(NetShareDel(pipe_hnd->desthost, argv[0], 0)));
4704 static NTSTATUS rpc_sh_share_info(struct net_context *c,
4705 TALLOC_CTX *mem_ctx,
4706 struct rpc_sh_ctx *ctx,
4707 struct rpc_pipe_client *pipe_hnd,
4708 int argc, const char **argv)
4710 union srvsvc_NetShareInfo info;
4715 d_fprintf(stderr, _("usage: %s <share>\n"), ctx->whoami);
4716 return NT_STATUS_INVALID_PARAMETER;
4719 status = rpccli_srvsvc_NetShareGetInfo(pipe_hnd, mem_ctx,
4725 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(result)) {
4729 d_printf(_("Name: %s\n"), info.info2->name);
4730 d_printf(_("Comment: %s\n"), info.info2->comment);
4731 d_printf(_("Path: %s\n"), info.info2->path);
4732 d_printf(_("Password: %s\n"), info.info2->password);
4735 return werror_to_ntstatus(result);
4738 struct rpc_sh_cmd *net_rpc_share_cmds(struct net_context *c, TALLOC_CTX *mem_ctx,
4739 struct rpc_sh_ctx *ctx)
4741 static struct rpc_sh_cmd cmds[] = {
4743 { "list", NULL, &ndr_table_srvsvc.syntax_id, rpc_sh_share_list,
4744 N_("List available shares") },
4746 { "add", NULL, &ndr_table_srvsvc.syntax_id, rpc_sh_share_add,
4747 N_("Add a share") },
4749 { "delete", NULL, &ndr_table_srvsvc.syntax_id, rpc_sh_share_delete,
4750 N_("Delete a share") },
4752 { "info", NULL, &ndr_table_srvsvc.syntax_id, rpc_sh_share_info,
4753 N_("Get information about a share") },
4755 { NULL, NULL, 0, NULL, NULL }
4761 /****************************************************************************/
4763 static int rpc_file_usage(struct net_context *c, int argc, const char **argv)
4765 return net_file_usage(c, argc, argv);
4769 * Close a file on a remote RPC server.
4771 * @param argc Standard main() style argc.
4772 * @param argv Standard main() style argv. Initial components are already
4775 * @return A shell status integer (0 for success).
4777 static int rpc_file_close(struct net_context *c, int argc, const char **argv)
4779 if (argc < 1 || c->display_usage) {
4780 return rpc_file_usage(c, argc, argv);
4783 return NetFileClose(c->opt_host, atoi(argv[0]));
4787 * Formatted print of open file info
4789 * @param r struct FILE_INFO_3 contents
4792 static void display_file_info_3(struct FILE_INFO_3 *r)
4794 d_printf("%-7.1d %-20.20s 0x%-4.2x %-6.1d %s\n",
4795 r->fi3_id, r->fi3_username, r->fi3_permissions,
4796 r->fi3_num_locks, r->fi3_pathname);
4800 * List files for a user on a remote RPC server.
4802 * @param argc Standard main() style argc.
4803 * @param argv Standard main() style argv. Initial components are already
4806 * @return A shell status integer (0 for success)..
4809 static int rpc_file_user(struct net_context *c, int argc, const char **argv)
4811 NET_API_STATUS status;
4812 uint32 preferred_len = 0xffffffff, i;
4813 const char *username=NULL;
4814 uint32_t total_entries = 0;
4815 uint32_t entries_read = 0;
4816 uint32_t resume_handle = 0;
4817 struct FILE_INFO_3 *i3 = NULL;
4819 if (c->display_usage) {
4820 return rpc_file_usage(c, argc, argv);
4823 /* if argc > 0, must be user command */
4825 username = smb_xstrdup(argv[0]);
4828 status = NetFileEnum(c->opt_host,
4832 (uint8_t **)(void *)&i3,
4842 /* Display results */
4845 "\nEnumerating open files on remote server:\n\n"
4846 "\nFileId Opened by Perms Locks Path"
4847 "\n------ --------- ----- ----- ---- \n"));
4848 for (i = 0; i < entries_read; i++) {
4849 display_file_info_3(&i3[i]);
4856 * 'net rpc file' entrypoint.
4857 * @param argc Standard main() style argc.
4858 * @param argv Standard main() style argv. Initial components are already
4862 int net_rpc_file(struct net_context *c, int argc, const char **argv)
4864 NET_API_STATUS status;
4866 struct functable func[] = {
4871 N_("Close opened file"),
4872 N_("net rpc file close\n"
4873 " Close opened file")
4879 N_("List files opened by user"),
4880 N_("net rpc file user\n"
4881 " List files opened by user")
4888 N_("Display information about opened file"),
4889 N_("net rpc file info\n"
4890 " Display information about opened file")
4893 {NULL, NULL, 0, NULL, NULL}
4896 status = libnetapi_init(&c->netapi_ctx);
4900 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
4901 libnetapi_set_password(c->netapi_ctx, c->opt_password);
4902 if (c->opt_kerberos) {
4903 libnetapi_set_use_kerberos(c->netapi_ctx);
4907 if (c->display_usage) {
4908 d_printf(_("Usage:\n"));
4909 d_printf(_("net rpc file\n"
4910 " List opened files\n"));
4911 net_display_usage_from_functable(func);
4915 return rpc_file_user(c, argc, argv);
4918 return net_run_function(c, argc, argv, "net rpc file", func);
4922 * ABORT the shutdown of a remote RPC Server, over initshutdown pipe.
4924 * All parameters are provided by the run_rpc_command function, except for
4925 * argc, argv which are passed through.
4927 * @param c A net_context structure.
4928 * @param domain_sid The domain sid acquired from the remote server.
4929 * @param cli A cli_state connected to the server.
4930 * @param mem_ctx Talloc context, destroyed on completion of the function.
4931 * @param argc Standard main() style argc.
4932 * @param argv Standard main() style argv. Initial components are already
4935 * @return Normal NTSTATUS return.
4938 static NTSTATUS rpc_shutdown_abort_internals(struct net_context *c,
4939 const DOM_SID *domain_sid,
4940 const char *domain_name,
4941 struct cli_state *cli,
4942 struct rpc_pipe_client *pipe_hnd,
4943 TALLOC_CTX *mem_ctx,
4947 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
4949 result = rpccli_initshutdown_Abort(pipe_hnd, mem_ctx, NULL, NULL);
4951 if (NT_STATUS_IS_OK(result)) {
4952 d_printf(_("\nShutdown successfully aborted\n"));
4953 DEBUG(5,("cmd_shutdown_abort: query succeeded\n"));
4955 DEBUG(5,("cmd_shutdown_abort: query failed\n"));
4961 * ABORT the shutdown of a remote RPC Server, over winreg pipe.
4963 * All parameters are provided by the run_rpc_command function, except for
4964 * argc, argv which are passed through.
4966 * @param c A net_context structure.
4967 * @param domain_sid The domain sid acquired from the remote server.
4968 * @param cli A cli_state connected to the server.
4969 * @param mem_ctx Talloc context, destroyed on completion of the function.
4970 * @param argc Standard main() style argc.
4971 * @param argv Standard main() style argv. Initial components are already
4974 * @return Normal NTSTATUS return.
4977 static NTSTATUS rpc_reg_shutdown_abort_internals(struct net_context *c,
4978 const DOM_SID *domain_sid,
4979 const char *domain_name,
4980 struct cli_state *cli,
4981 struct rpc_pipe_client *pipe_hnd,
4982 TALLOC_CTX *mem_ctx,
4986 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
4988 result = rpccli_winreg_AbortSystemShutdown(pipe_hnd, mem_ctx, NULL, NULL);
4990 if (NT_STATUS_IS_OK(result)) {
4991 d_printf(_("\nShutdown successfully aborted\n"));
4992 DEBUG(5,("cmd_reg_abort_shutdown: query succeeded\n"));
4994 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
5000 * ABORT the shutdown of a remote RPC server.
5002 * @param argc Standard main() style argc.
5003 * @param argv Standard main() style argv. Initial components are already
5006 * @return A shell status integer (0 for success).
5009 static int rpc_shutdown_abort(struct net_context *c, int argc,
5014 if (c->display_usage) {
5015 d_printf(_("Usage:\n"
5016 "net rpc abortshutdown\n"
5017 " Abort a scheduled shutdown\n"));
5021 rc = run_rpc_command(c, NULL, &ndr_table_initshutdown.syntax_id, 0,
5022 rpc_shutdown_abort_internals, argc, argv);
5027 DEBUG(1, ("initshutdown pipe didn't work, trying winreg pipe\n"));
5029 return run_rpc_command(c, NULL, &ndr_table_winreg.syntax_id, 0,
5030 rpc_reg_shutdown_abort_internals,
5035 * Shut down a remote RPC Server via initshutdown pipe.
5037 * All parameters are provided by the run_rpc_command function, except for
5038 * argc, argv which are passed through.
5040 * @param c A net_context structure.
5041 * @param domain_sid The domain sid acquired from the remote server.
5042 * @param cli A cli_state connected to the server.
5043 * @param mem_ctx Talloc context, destroyed on completion of the function.
5044 * @param argc Standard main() style argc.
5045 * @param argv Standard main() style argv. Initial components are already
5048 * @return Normal NTSTATUS return.
5051 NTSTATUS rpc_init_shutdown_internals(struct net_context *c,
5052 const DOM_SID *domain_sid,
5053 const char *domain_name,
5054 struct cli_state *cli,
5055 struct rpc_pipe_client *pipe_hnd,
5056 TALLOC_CTX *mem_ctx,
5060 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
5061 const char *msg = N_("This machine will be shutdown shortly");
5062 uint32 timeout = 20;
5063 struct lsa_StringLarge msg_string;
5065 if (c->opt_comment) {
5066 msg = c->opt_comment;
5068 if (c->opt_timeout) {
5069 timeout = c->opt_timeout;
5072 msg_string.string = msg;
5074 /* create an entry */
5075 result = rpccli_initshutdown_Init(pipe_hnd, mem_ctx, NULL,
5076 &msg_string, timeout, c->opt_force, c->opt_reboot,
5079 if (NT_STATUS_IS_OK(result)) {
5080 d_printf(_("\nShutdown of remote machine succeeded\n"));
5081 DEBUG(5,("Shutdown of remote machine succeeded\n"));
5083 DEBUG(1,("Shutdown of remote machine failed!\n"));
5089 * Shut down a remote RPC Server via winreg pipe.
5091 * All parameters are provided by the run_rpc_command function, except for
5092 * argc, argv which are passed through.
5094 * @param c A net_context structure.
5095 * @param domain_sid The domain sid acquired from the remote server.
5096 * @param cli A cli_state connected to the server.
5097 * @param mem_ctx Talloc context, destroyed on completion of the function.
5098 * @param argc Standard main() style argc.
5099 * @param argv Standard main() style argv. Initial components are already
5102 * @return Normal NTSTATUS return.
5105 NTSTATUS rpc_reg_shutdown_internals(struct net_context *c,
5106 const DOM_SID *domain_sid,
5107 const char *domain_name,
5108 struct cli_state *cli,
5109 struct rpc_pipe_client *pipe_hnd,
5110 TALLOC_CTX *mem_ctx,
5114 const char *msg = N_("This machine will be shutdown shortly");
5115 uint32 timeout = 20;
5116 struct lsa_StringLarge msg_string;
5120 if (c->opt_comment) {
5121 msg = c->opt_comment;
5123 msg_string.string = msg;
5125 if (c->opt_timeout) {
5126 timeout = c->opt_timeout;
5129 /* create an entry */
5130 result = rpccli_winreg_InitiateSystemShutdown(pipe_hnd, mem_ctx, NULL,
5131 &msg_string, timeout, c->opt_force, c->opt_reboot,
5134 if (NT_STATUS_IS_OK(result)) {
5135 d_printf(_("\nShutdown of remote machine succeeded\n"));
5137 d_fprintf(stderr, "\nShutdown of remote machine failed\n");
5138 if ( W_ERROR_EQUAL(werr, WERR_MACHINE_LOCKED) )
5139 d_fprintf(stderr, "\nMachine locked, use -f switch to force\n");
5141 d_fprintf(stderr, "\nresult was: %s\n", win_errstr(werr));
5148 * Shut down a remote RPC server.
5150 * @param argc Standard main() style argc.
5151 * @param argv Standard main() style argv. Initial components are already
5154 * @return A shell status integer (0 for success).
5157 static int rpc_shutdown(struct net_context *c, int argc, const char **argv)
5161 if (c->display_usage) {
5162 d_printf(_("Usage:\n"
5163 "net rpc shutdown\n"
5164 " Shut down a remote RPC server\n"));
5168 rc = run_rpc_command(c, NULL, &ndr_table_initshutdown.syntax_id, 0,
5169 rpc_init_shutdown_internals, argc, argv);
5172 DEBUG(1, ("initshutdown pipe failed, trying winreg pipe\n"));
5173 rc = run_rpc_command(c, NULL, &ndr_table_winreg.syntax_id, 0,
5174 rpc_reg_shutdown_internals, argc, argv);
5180 /***************************************************************************
5181 NT Domain trusts code (i.e. 'net rpc trustdom' functionality)
5182 ***************************************************************************/
5185 * Add interdomain trust account to the RPC server.
5186 * All parameters (except for argc and argv) are passed by run_rpc_command
5189 * @param c A net_context structure.
5190 * @param domain_sid The domain sid acquired from the server.
5191 * @param cli A cli_state connected to the server.
5192 * @param mem_ctx Talloc context, destroyed on completion of the function.
5193 * @param argc Standard main() style argc.
5194 * @param argv Standard main() style argv. Initial components are already
5197 * @return normal NTSTATUS return code.
5200 static NTSTATUS rpc_trustdom_add_internals(struct net_context *c,
5201 const DOM_SID *domain_sid,
5202 const char *domain_name,
5203 struct cli_state *cli,
5204 struct rpc_pipe_client *pipe_hnd,
5205 TALLOC_CTX *mem_ctx,
5209 struct policy_handle connect_pol, domain_pol, user_pol;
5210 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
5212 struct lsa_String lsa_acct_name;
5214 uint32 acct_flags=0;
5216 uint32_t access_granted = 0;
5217 union samr_UserInfo info;
5218 unsigned int orig_timeout;
5221 d_printf(_("Usage: net rpc trustdom add <domain_name> "
5222 "<trust password>\n"));
5223 return NT_STATUS_INVALID_PARAMETER;
5227 * Make valid trusting domain account (ie. uppercased and with '$' appended)
5230 if (asprintf(&acct_name, "%s$", argv[0]) < 0) {
5231 return NT_STATUS_NO_MEMORY;
5234 strupper_m(acct_name);
5236 init_lsa_String(&lsa_acct_name, acct_name);
5238 /* Get samr policy handle */
5239 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
5241 MAXIMUM_ALLOWED_ACCESS,
5243 if (!NT_STATUS_IS_OK(result)) {
5247 /* Get domain policy handle */
5248 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
5250 MAXIMUM_ALLOWED_ACCESS,
5251 CONST_DISCARD(struct dom_sid2 *, domain_sid),
5253 if (!NT_STATUS_IS_OK(result)) {
5257 /* This call can take a long time - allow the server to time out.
5258 * 35 seconds should do it. */
5260 orig_timeout = rpccli_set_timeout(pipe_hnd, 35000);
5262 /* Create trusting domain's account */
5263 acb_info = ACB_NORMAL;
5264 acct_flags = SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
5265 SEC_STD_WRITE_DAC | SEC_STD_DELETE |
5266 SAMR_USER_ACCESS_SET_PASSWORD |
5267 SAMR_USER_ACCESS_GET_ATTRIBUTES |
5268 SAMR_USER_ACCESS_SET_ATTRIBUTES;
5270 result = rpccli_samr_CreateUser2(pipe_hnd, mem_ctx,
5279 /* And restore our original timeout. */
5280 rpccli_set_timeout(pipe_hnd, orig_timeout);
5282 if (!NT_STATUS_IS_OK(result)) {
5283 d_printf(_("net rpc trustdom add: create user %s failed %s\n"),
5284 acct_name, nt_errstr(result));
5289 struct samr_CryptPassword crypt_pwd;
5291 ZERO_STRUCT(info.info23);
5293 init_samr_CryptPassword(argv[1],
5294 &cli->user_session_key,
5297 info.info23.info.fields_present = SAMR_FIELD_ACCT_FLAGS |
5298 SAMR_FIELD_NT_PASSWORD_PRESENT;
5299 info.info23.info.acct_flags = ACB_DOMTRUST;
5300 info.info23.password = crypt_pwd;
5302 result = rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,
5307 if (!NT_STATUS_IS_OK(result)) {
5308 DEBUG(0,("Could not set trust account password: %s\n",
5309 nt_errstr(result)));
5315 SAFE_FREE(acct_name);
5320 * Create interdomain trust account for a remote domain.
5322 * @param argc Standard argc.
5323 * @param argv Standard argv without initial components.
5325 * @return Integer status (0 means success).
5328 static int rpc_trustdom_add(struct net_context *c, int argc, const char **argv)
5330 if (argc > 0 && !c->display_usage) {
5331 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
5332 rpc_trustdom_add_internals, argc, argv);
5334 d_printf(_("Usage:\n"
5335 "net rpc trustdom add <domain_name> <trust "
5343 * Remove interdomain trust account from the RPC server.
5344 * All parameters (except for argc and argv) are passed by run_rpc_command
5347 * @param c A net_context structure.
5348 * @param domain_sid The domain sid acquired from the server.
5349 * @param cli A cli_state connected to the server.
5350 * @param mem_ctx Talloc context, destroyed on completion of the function.
5351 * @param argc Standard main() style argc.
5352 * @param argv Standard main() style argv. Initial components are already
5355 * @return normal NTSTATUS return code.
5358 static NTSTATUS rpc_trustdom_del_internals(struct net_context *c,
5359 const DOM_SID *domain_sid,
5360 const char *domain_name,
5361 struct cli_state *cli,
5362 struct rpc_pipe_client *pipe_hnd,
5363 TALLOC_CTX *mem_ctx,
5367 struct policy_handle connect_pol, domain_pol, user_pol;
5368 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
5370 DOM_SID trust_acct_sid;
5371 struct samr_Ids user_rids, name_types;
5372 struct lsa_String lsa_acct_name;
5375 d_printf(_("Usage: net rpc trustdom del <domain_name>\n"));
5376 return NT_STATUS_INVALID_PARAMETER;
5380 * Make valid trusting domain account (ie. uppercased and with '$' appended)
5382 acct_name = talloc_asprintf(mem_ctx, "%s$", argv[0]);
5384 if (acct_name == NULL)
5385 return NT_STATUS_NO_MEMORY;
5387 strupper_m(acct_name);
5389 /* Get samr policy handle */
5390 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
5392 MAXIMUM_ALLOWED_ACCESS,
5394 if (!NT_STATUS_IS_OK(result)) {
5398 /* Get domain policy handle */
5399 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
5401 MAXIMUM_ALLOWED_ACCESS,
5402 CONST_DISCARD(struct dom_sid2 *, domain_sid),
5404 if (!NT_STATUS_IS_OK(result)) {
5408 init_lsa_String(&lsa_acct_name, acct_name);
5410 result = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
5417 if (!NT_STATUS_IS_OK(result)) {
5418 d_printf(_("net rpc trustdom del: LookupNames on user %s "
5420 acct_name, nt_errstr(result) );
5424 result = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
5426 MAXIMUM_ALLOWED_ACCESS,
5430 if (!NT_STATUS_IS_OK(result)) {
5431 d_printf(_("net rpc trustdom del: OpenUser on user %s failed "
5433 acct_name, nt_errstr(result) );
5437 /* append the rid to the domain sid */
5438 sid_copy(&trust_acct_sid, domain_sid);
5439 if (!sid_append_rid(&trust_acct_sid, user_rids.ids[0])) {
5443 /* remove the sid */
5445 result = rpccli_samr_RemoveMemberFromForeignDomain(pipe_hnd, mem_ctx,
5448 if (!NT_STATUS_IS_OK(result)) {
5449 d_printf(_("net rpc trustdom del: RemoveMemberFromForeignDomain"
5450 " on user %s failed %s\n"),
5451 acct_name, nt_errstr(result) );
5457 result = rpccli_samr_DeleteUser(pipe_hnd, mem_ctx,
5460 if (!NT_STATUS_IS_OK(result)) {
5461 d_printf(_("net rpc trustdom del: DeleteUser on user %s failed "
5463 acct_name, nt_errstr(result) );
5467 if (!NT_STATUS_IS_OK(result)) {
5468 d_printf(_("Could not set trust account password: %s\n"),
5478 * Delete interdomain trust account for a remote domain.
5480 * @param argc Standard argc.
5481 * @param argv Standard argv without initial components.
5483 * @return Integer status (0 means success).
5486 static int rpc_trustdom_del(struct net_context *c, int argc, const char **argv)
5488 if (argc > 0 && !c->display_usage) {
5489 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
5490 rpc_trustdom_del_internals, argc, argv);
5492 d_printf(_("Usage:\n"
5493 "net rpc trustdom del <domain>\n"));
5498 static NTSTATUS rpc_trustdom_get_pdc(struct net_context *c,
5499 struct cli_state *cli,
5500 TALLOC_CTX *mem_ctx,
5501 const char *domain_name)
5503 char *dc_name = NULL;
5504 const char *buffer = NULL;
5505 struct rpc_pipe_client *netr;
5508 /* Use NetServerEnum2 */
5510 if (cli_get_pdc_name(cli, domain_name, &dc_name)) {
5512 return NT_STATUS_OK;
5515 DEBUG(1,("NetServerEnum2 error: Couldn't find primary domain controller\
5516 for domain %s\n", domain_name));
5518 /* Try netr_GetDcName */
5520 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
5522 if (!NT_STATUS_IS_OK(status)) {
5526 status = rpccli_netr_GetDcName(netr, mem_ctx,
5533 if (NT_STATUS_IS_OK(status)) {
5537 DEBUG(1,("netr_GetDcName error: Couldn't find primary domain controller\
5538 for domain %s\n", domain_name));
5544 * Establish trust relationship to a trusting domain.
5545 * Interdomain account must already be created on remote PDC.
5547 * @param c A net_context structure.
5548 * @param argc Standard argc.
5549 * @param argv Standard argv without initial components.
5551 * @return Integer status (0 means success).
5554 static int rpc_trustdom_establish(struct net_context *c, int argc,
5557 struct cli_state *cli = NULL;
5558 struct sockaddr_storage server_ss;
5559 struct rpc_pipe_client *pipe_hnd = NULL;
5560 struct policy_handle connect_hnd;
5561 TALLOC_CTX *mem_ctx;
5563 DOM_SID *domain_sid;
5568 union lsa_PolicyInformation *info = NULL;
5571 * Connect to \\server\ipc$ as 'our domain' account with password
5574 if (argc != 1 || c->display_usage) {
5575 d_printf(_("Usage:\n"
5576 "net rpc trustdom establish <domain_name>\n"));
5580 domain_name = smb_xstrdup(argv[0]);
5581 strupper_m(domain_name);
5583 /* account name used at first is our domain's name with '$' */
5584 if (asprintf(&acct_name, "%s$", lp_workgroup()) == -1) {
5587 strupper_m(acct_name);
5590 * opt_workgroup will be used by connection functions further,
5591 * hence it should be set to remote domain name instead of ours
5593 if (c->opt_workgroup) {
5594 c->opt_workgroup = smb_xstrdup(domain_name);
5597 c->opt_user_name = acct_name;
5599 /* find the domain controller */
5600 if (!net_find_pdc(&server_ss, pdc_name, domain_name)) {
5601 DEBUG(0, ("Couldn't find domain controller for domain %s\n", domain_name));
5605 /* connect to ipc$ as username/password */
5606 nt_status = connect_to_ipc(c, &cli, &server_ss, pdc_name);
5607 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT)) {
5609 /* Is it trusting domain account for sure ? */
5610 DEBUG(0, ("Couldn't verify trusting domain account. Error was %s\n",
5611 nt_errstr(nt_status)));
5615 /* store who we connected to */
5617 saf_store( domain_name, pdc_name );
5620 * Connect to \\server\ipc$ again (this time anonymously)
5623 nt_status = connect_to_ipc_anonymous(c, &cli, &server_ss,
5626 if (NT_STATUS_IS_ERR(nt_status)) {
5627 DEBUG(0, ("Couldn't connect to domain %s controller. Error was %s.\n",
5628 domain_name, nt_errstr(nt_status)));
5632 if (!(mem_ctx = talloc_init("establishing trust relationship to "
5633 "domain %s", domain_name))) {
5634 DEBUG(0, ("talloc_init() failed\n"));
5639 /* Make sure we're talking to a proper server */
5641 nt_status = rpc_trustdom_get_pdc(c, cli, mem_ctx, domain_name);
5642 if (!NT_STATUS_IS_OK(nt_status)) {
5644 talloc_destroy(mem_ctx);
5649 * Call LsaOpenPolicy and LsaQueryInfo
5652 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
5654 if (!NT_STATUS_IS_OK(nt_status)) {
5655 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n", nt_errstr(nt_status) ));
5657 talloc_destroy(mem_ctx);
5661 nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, true, KEY_QUERY_VALUE,
5663 if (NT_STATUS_IS_ERR(nt_status)) {
5664 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
5665 nt_errstr(nt_status)));
5667 talloc_destroy(mem_ctx);
5671 /* Querying info level 5 */
5673 nt_status = rpccli_lsa_QueryInfoPolicy(pipe_hnd, mem_ctx,
5675 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
5677 if (NT_STATUS_IS_ERR(nt_status)) {
5678 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
5679 nt_errstr(nt_status)));
5681 talloc_destroy(mem_ctx);
5685 domain_sid = info->account_domain.sid;
5687 /* There should be actually query info level 3 (following nt serv behaviour),
5688 but I still don't know if it's _really_ necessary */
5691 * Store the password in secrets db
5694 if (!pdb_set_trusteddom_pw(domain_name, c->opt_password, domain_sid)) {
5695 DEBUG(0, ("Storing password for trusted domain failed.\n"));
5697 talloc_destroy(mem_ctx);
5702 * Close the pipes and clean up
5705 nt_status = rpccli_lsa_Close(pipe_hnd, mem_ctx, &connect_hnd);
5706 if (NT_STATUS_IS_ERR(nt_status)) {
5707 DEBUG(0, ("Couldn't close LSA pipe. Error was %s\n",
5708 nt_errstr(nt_status)));
5710 talloc_destroy(mem_ctx);
5716 talloc_destroy(mem_ctx);
5718 d_printf(_("Trust to domain %s established\n"), domain_name);
5723 * Revoke trust relationship to the remote domain.
5725 * @param c A net_context structure.
5726 * @param argc Standard argc.
5727 * @param argv Standard argv without initial components.
5729 * @return Integer status (0 means success).
5732 static int rpc_trustdom_revoke(struct net_context *c, int argc,
5738 if (argc < 1 || c->display_usage) {
5739 d_printf(_("Usage:\n"
5740 "net rpc trustdom revoke <domain_name>\n"
5741 " Revoke trust relationship\n"
5742 " domain_name\tName of domain to revoke trust\n"));
5746 /* generate upper cased domain name */
5747 domain_name = smb_xstrdup(argv[0]);
5748 strupper_m(domain_name);
5750 /* delete password of the trust */
5751 if (!pdb_del_trusteddom_pw(domain_name)) {
5752 DEBUG(0, ("Failed to revoke relationship to the trusted domain %s\n",
5759 SAFE_FREE(domain_name);
5763 static NTSTATUS rpc_query_domain_sid(struct net_context *c,
5764 const DOM_SID *domain_sid,
5765 const char *domain_name,
5766 struct cli_state *cli,
5767 struct rpc_pipe_client *pipe_hnd,
5768 TALLOC_CTX *mem_ctx,
5773 sid_to_fstring(str_sid, domain_sid);
5774 d_printf("%s\n", str_sid);
5775 return NT_STATUS_OK;
5778 static void print_trusted_domain(DOM_SID *dom_sid, const char *trusted_dom_name)
5780 fstring ascii_sid, padding;
5781 int pad_len, col_len = 20;
5783 /* convert sid into ascii string */
5784 sid_to_fstring(ascii_sid, dom_sid);
5786 /* calculate padding space for d_printf to look nicer */
5787 pad_len = col_len - strlen(trusted_dom_name);
5788 padding[pad_len] = 0;
5789 do padding[--pad_len] = ' '; while (pad_len);
5791 d_printf("%s%s%s\n", trusted_dom_name, padding, ascii_sid);
5794 static NTSTATUS vampire_trusted_domain(struct rpc_pipe_client *pipe_hnd,
5795 TALLOC_CTX *mem_ctx,
5796 struct policy_handle *pol,
5798 const char *trusted_dom_name)
5801 union lsa_TrustedDomainInfo *info = NULL;
5802 char *cleartextpwd = NULL;
5803 uint8_t session_key[16];
5804 DATA_BLOB session_key_blob;
5805 DATA_BLOB data = data_blob_null;
5807 nt_status = rpccli_lsa_QueryTrustedDomainInfoBySid(pipe_hnd, mem_ctx,
5810 LSA_TRUSTED_DOMAIN_INFO_PASSWORD,
5812 if (NT_STATUS_IS_ERR(nt_status)) {
5813 DEBUG(0,("Could not query trusted domain info. Error was %s\n",
5814 nt_errstr(nt_status)));
5818 data = data_blob(info->password.password->data,
5819 info->password.password->length);
5821 if (!rpccli_get_pwd_hash(pipe_hnd, session_key)) {
5822 DEBUG(0, ("Could not retrieve password hash\n"));
5826 session_key_blob = data_blob_const(session_key, sizeof(session_key));
5827 cleartextpwd = sess_decrypt_string(mem_ctx, &data, &session_key_blob);
5829 if (cleartextpwd == NULL) {
5830 DEBUG(0,("retrieved NULL password\n"));
5831 nt_status = NT_STATUS_UNSUCCESSFUL;
5835 if (!pdb_set_trusteddom_pw(trusted_dom_name, cleartextpwd, &dom_sid)) {
5836 DEBUG(0, ("Storing password for trusted domain failed.\n"));
5837 nt_status = NT_STATUS_UNSUCCESSFUL;
5841 #ifdef DEBUG_PASSWORD
5842 DEBUG(100,("successfully vampired trusted domain [%s], sid: [%s], "
5843 "password: [%s]\n", trusted_dom_name,
5844 sid_string_dbg(&dom_sid), cleartextpwd));
5848 SAFE_FREE(cleartextpwd);
5849 data_blob_free(&data);
5854 static int rpc_trustdom_vampire(struct net_context *c, int argc,
5857 /* common variables */
5858 TALLOC_CTX* mem_ctx;
5859 struct cli_state *cli = NULL;
5860 struct rpc_pipe_client *pipe_hnd = NULL;
5862 const char *domain_name = NULL;
5863 DOM_SID *queried_dom_sid;
5864 struct policy_handle connect_hnd;
5865 union lsa_PolicyInformation *info = NULL;
5867 /* trusted domains listing variables */
5868 unsigned int enum_ctx = 0;
5870 struct lsa_DomainList dom_list;
5873 if (c->display_usage) {
5874 d_printf(_("Usage:\n"
5875 "net rpc trustdom vampire\n"
5876 " Vampire trust relationship from remote server\n"));
5881 * Listing trusted domains (stored in secrets.tdb, if local)
5884 mem_ctx = talloc_init("trust relationships vampire");
5887 * set domain and pdc name to local samba server (default)
5888 * or to remote one given in command line
5891 if (StrCaseCmp(c->opt_workgroup, lp_workgroup())) {
5892 domain_name = c->opt_workgroup;
5893 c->opt_target_workgroup = c->opt_workgroup;
5895 fstrcpy(pdc_name, global_myname());
5896 domain_name = talloc_strdup(mem_ctx, lp_workgroup());
5897 c->opt_target_workgroup = domain_name;
5900 /* open \PIPE\lsarpc and open policy handle */
5901 nt_status = net_make_ipc_connection(c, NET_FLAGS_PDC, &cli);
5902 if (!NT_STATUS_IS_OK(nt_status)) {
5903 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
5904 nt_errstr(nt_status)));
5905 talloc_destroy(mem_ctx);
5909 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
5911 if (!NT_STATUS_IS_OK(nt_status)) {
5912 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
5913 nt_errstr(nt_status) ));
5915 talloc_destroy(mem_ctx);
5919 nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, false, KEY_QUERY_VALUE,
5921 if (NT_STATUS_IS_ERR(nt_status)) {
5922 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
5923 nt_errstr(nt_status)));
5925 talloc_destroy(mem_ctx);
5929 /* query info level 5 to obtain sid of a domain being queried */
5930 nt_status = rpccli_lsa_QueryInfoPolicy(pipe_hnd, mem_ctx,
5932 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
5935 if (NT_STATUS_IS_ERR(nt_status)) {
5936 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
5937 nt_errstr(nt_status)));
5939 talloc_destroy(mem_ctx);
5943 queried_dom_sid = info->account_domain.sid;
5946 * Keep calling LsaEnumTrustdom over opened pipe until
5947 * the end of enumeration is reached
5950 d_printf(_("Vampire trusted domains:\n\n"));
5953 nt_status = rpccli_lsa_EnumTrustDom(pipe_hnd, mem_ctx,
5958 if (NT_STATUS_IS_ERR(nt_status)) {
5959 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
5960 nt_errstr(nt_status)));
5962 talloc_destroy(mem_ctx);
5966 for (i = 0; i < dom_list.count; i++) {
5968 print_trusted_domain(dom_list.domains[i].sid,
5969 dom_list.domains[i].name.string);
5971 nt_status = vampire_trusted_domain(pipe_hnd, mem_ctx, &connect_hnd,
5972 *dom_list.domains[i].sid,
5973 dom_list.domains[i].name.string);
5974 if (!NT_STATUS_IS_OK(nt_status)) {
5976 talloc_destroy(mem_ctx);
5982 * in case of no trusted domains say something rather
5983 * than just display blank line
5985 if (!dom_list.count) d_printf(_("none\n"));
5987 } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
5989 /* close this connection before doing next one */
5990 nt_status = rpccli_lsa_Close(pipe_hnd, mem_ctx, &connect_hnd);
5991 if (NT_STATUS_IS_ERR(nt_status)) {
5992 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
5993 nt_errstr(nt_status)));
5995 talloc_destroy(mem_ctx);
5999 /* close lsarpc pipe and connection to IPC$ */
6002 talloc_destroy(mem_ctx);
6006 static int rpc_trustdom_list(struct net_context *c, int argc, const char **argv)
6008 /* common variables */
6009 TALLOC_CTX* mem_ctx;
6010 struct cli_state *cli = NULL, *remote_cli = NULL;
6011 struct rpc_pipe_client *pipe_hnd = NULL;
6013 const char *domain_name = NULL;
6014 DOM_SID *queried_dom_sid;
6016 int ascii_dom_name_len;
6017 struct policy_handle connect_hnd;
6018 union lsa_PolicyInformation *info = NULL;
6020 /* trusted domains listing variables */
6021 unsigned int num_domains, enum_ctx = 0;
6022 int i, pad_len, col_len = 20;
6023 struct lsa_DomainList dom_list;
6026 /* trusting domains listing variables */
6027 struct policy_handle domain_hnd;
6028 struct samr_SamArray *trusts = NULL;
6030 if (c->display_usage) {
6031 d_printf(_("Usage:\n"
6032 "net rpc trustdom list\n"
6033 " List in- and outgoing trust relationships\n"));
6038 * Listing trusted domains (stored in secrets.tdb, if local)
6041 mem_ctx = talloc_init("trust relationships listing");
6044 * set domain and pdc name to local samba server (default)
6045 * or to remote one given in command line
6048 if (StrCaseCmp(c->opt_workgroup, lp_workgroup())) {
6049 domain_name = c->opt_workgroup;
6050 c->opt_target_workgroup = c->opt_workgroup;
6052 fstrcpy(pdc_name, global_myname());
6053 domain_name = talloc_strdup(mem_ctx, lp_workgroup());
6054 c->opt_target_workgroup = domain_name;
6057 /* open \PIPE\lsarpc and open policy handle */
6058 nt_status = net_make_ipc_connection(c, NET_FLAGS_PDC, &cli);
6059 if (!NT_STATUS_IS_OK(nt_status)) {
6060 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
6061 nt_errstr(nt_status)));
6062 talloc_destroy(mem_ctx);
6066 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
6068 if (!NT_STATUS_IS_OK(nt_status)) {
6069 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
6070 nt_errstr(nt_status) ));
6072 talloc_destroy(mem_ctx);
6076 nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, false, KEY_QUERY_VALUE,
6078 if (NT_STATUS_IS_ERR(nt_status)) {
6079 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6080 nt_errstr(nt_status)));
6082 talloc_destroy(mem_ctx);
6086 /* query info level 5 to obtain sid of a domain being queried */
6087 nt_status = rpccli_lsa_QueryInfoPolicy(pipe_hnd, mem_ctx,
6089 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
6092 if (NT_STATUS_IS_ERR(nt_status)) {
6093 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6094 nt_errstr(nt_status)));
6096 talloc_destroy(mem_ctx);
6100 queried_dom_sid = info->account_domain.sid;
6103 * Keep calling LsaEnumTrustdom over opened pipe until
6104 * the end of enumeration is reached
6107 d_printf(_("Trusted domains list:\n\n"));
6110 nt_status = rpccli_lsa_EnumTrustDom(pipe_hnd, mem_ctx,
6115 if (NT_STATUS_IS_ERR(nt_status)) {
6116 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6117 nt_errstr(nt_status)));
6119 talloc_destroy(mem_ctx);
6123 for (i = 0; i < dom_list.count; i++) {
6124 print_trusted_domain(dom_list.domains[i].sid,
6125 dom_list.domains[i].name.string);
6129 * in case of no trusted domains say something rather
6130 * than just display blank line
6132 if (!dom_list.count) d_printf(_("none\n"));
6134 } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
6136 /* close this connection before doing next one */
6137 nt_status = rpccli_lsa_Close(pipe_hnd, mem_ctx, &connect_hnd);
6138 if (NT_STATUS_IS_ERR(nt_status)) {
6139 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
6140 nt_errstr(nt_status)));
6142 talloc_destroy(mem_ctx);
6146 TALLOC_FREE(pipe_hnd);
6149 * Listing trusting domains (stored in passdb backend, if local)
6152 d_printf(_("\nTrusting domains list:\n\n"));
6155 * Open \PIPE\samr and get needed policy handles
6157 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
6159 if (!NT_STATUS_IS_OK(nt_status)) {
6160 DEBUG(0, ("Could not initialise samr pipe. Error was %s\n", nt_errstr(nt_status)));
6162 talloc_destroy(mem_ctx);
6167 nt_status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
6169 SAMR_ACCESS_LOOKUP_DOMAIN,
6171 if (!NT_STATUS_IS_OK(nt_status)) {
6172 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
6173 nt_errstr(nt_status)));
6175 talloc_destroy(mem_ctx);
6179 /* SamrOpenDomain - we have to open domain policy handle in order to be
6180 able to enumerate accounts*/
6181 nt_status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
6183 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
6186 if (!NT_STATUS_IS_OK(nt_status)) {
6187 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
6188 nt_errstr(nt_status)));
6190 talloc_destroy(mem_ctx);
6195 * perform actual enumeration
6198 enum_ctx = 0; /* reset enumeration context from last enumeration */
6201 nt_status = rpccli_samr_EnumDomainUsers(pipe_hnd, mem_ctx,
6208 if (NT_STATUS_IS_ERR(nt_status)) {
6209 DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
6210 nt_errstr(nt_status)));
6212 talloc_destroy(mem_ctx);
6216 for (i = 0; i < num_domains; i++) {
6218 char *str = CONST_DISCARD(char *, trusts->entries[i].name.string);
6221 * get each single domain's sid (do we _really_ need this ?):
6222 * 1) connect to domain's pdc
6223 * 2) query the pdc for domain's sid
6226 /* get rid of '$' tail */
6227 ascii_dom_name_len = strlen(str);
6228 if (ascii_dom_name_len && ascii_dom_name_len < FSTRING_LEN)
6229 str[ascii_dom_name_len - 1] = '\0';
6231 /* calculate padding space for d_printf to look nicer */
6232 pad_len = col_len - strlen(str);
6233 padding[pad_len] = 0;
6234 do padding[--pad_len] = ' '; while (pad_len);
6236 /* set opt_* variables to remote domain */
6238 c->opt_workgroup = talloc_strdup(mem_ctx, str);
6239 c->opt_target_workgroup = c->opt_workgroup;
6241 d_printf("%s%s", str, padding);
6243 /* connect to remote domain controller */
6244 nt_status = net_make_ipc_connection(c,
6245 NET_FLAGS_PDC | NET_FLAGS_ANONYMOUS,
6247 if (NT_STATUS_IS_OK(nt_status)) {
6248 /* query for domain's sid */
6249 if (run_rpc_command(
6251 &ndr_table_lsarpc.syntax_id, 0,
6252 rpc_query_domain_sid, argc,
6255 _("couldn't get domain's sid\n"));
6257 cli_shutdown(remote_cli);
6260 d_fprintf(stderr, _("domain controller is not "
6261 "responding: %s\n"),
6262 nt_errstr(nt_status));
6266 if (!num_domains) d_printf("none\n");
6268 } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
6270 /* close opened samr and domain policy handles */
6271 nt_status = rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_hnd);
6272 if (!NT_STATUS_IS_OK(nt_status)) {
6273 DEBUG(0, ("Couldn't properly close domain policy handle for domain %s\n", domain_name));
6276 nt_status = rpccli_samr_Close(pipe_hnd, mem_ctx, &connect_hnd);
6277 if (!NT_STATUS_IS_OK(nt_status)) {
6278 DEBUG(0, ("Couldn't properly close samr policy handle for domain %s\n", domain_name));
6281 /* close samr pipe and connection to IPC$ */
6284 talloc_destroy(mem_ctx);
6289 * Entrypoint for 'net rpc trustdom' code.
6291 * @param argc Standard argc.
6292 * @param argv Standard argv without initial components.
6294 * @return Integer status (0 means success).
6297 static int rpc_trustdom(struct net_context *c, int argc, const char **argv)
6299 struct functable func[] = {
6304 N_("Add trusting domain's account"),
6305 N_("net rpc trustdom add\n"
6306 " Add trusting domain's account")
6312 N_("Remove trusting domain's account"),
6313 N_("net rpc trustdom del\n"
6314 " Remove trusting domain's account")
6318 rpc_trustdom_establish,
6320 N_("Establish outgoing trust relationship"),
6321 N_("net rpc trustdom establish\n"
6322 " Establish outgoing trust relationship")
6326 rpc_trustdom_revoke,
6328 N_("Revoke outgoing trust relationship"),
6329 N_("net rpc trustdom revoke\n"
6330 " Revoke outgoing trust relationship")
6336 N_("List in- and outgoing domain trusts"),
6337 N_("net rpc trustdom list\n"
6338 " List in- and outgoing domain trusts")
6342 rpc_trustdom_vampire,
6344 N_("Vampire trusts from remote server"),
6345 N_("net rpc trustdom vampire\n"
6346 " Vampire trusts from remote server")
6348 {NULL, NULL, 0, NULL, NULL}
6351 return net_run_function(c, argc, argv, "net rpc trustdom", func);
6355 * Check if a server will take rpc commands
6356 * @param flags Type of server to connect to (PDC, DMB, localhost)
6357 * if the host is not explicitly specified
6358 * @return bool (true means rpc supported)
6360 bool net_rpc_check(struct net_context *c, unsigned flags)
6362 struct cli_state *cli;
6364 struct sockaddr_storage server_ss;
6365 char *server_name = NULL;
6368 /* flags (i.e. server type) may depend on command */
6369 if (!net_find_server(c, NULL, flags, &server_ss, &server_name))
6372 if ((cli = cli_initialise()) == NULL) {
6376 status = cli_connect(cli, server_name, &server_ss);
6377 if (!NT_STATUS_IS_OK(status))
6379 if (!attempt_netbios_session_request(&cli, global_myname(),
6380 server_name, &server_ss))
6382 status = cli_negprot(cli);
6383 if (!NT_STATUS_IS_OK(status))
6385 if (cli->protocol < PROTOCOL_NT1)
6394 /* dump sam database via samsync rpc calls */
6395 static int rpc_samdump(struct net_context *c, int argc, const char **argv) {
6396 if (c->display_usage) {
6397 d_printf(_("Usage:\n"
6399 " Dump remote SAM database\n"));
6403 return run_rpc_command(c, NULL, &ndr_table_netlogon.syntax_id,
6404 NET_FLAGS_ANONYMOUS,
6405 rpc_samdump_internals, argc, argv);
6408 /* syncronise sam database via samsync rpc calls */
6409 static int rpc_vampire(struct net_context *c, int argc, const char **argv)
6411 struct functable func[] = {
6416 N_("Dump remote SAM database to ldif"),
6417 N_("net rpc vampire ldif\n"
6418 " Dump remote SAM database to LDIF file or "
6425 N_("Dump remote SAM database to Kerberos Keytab"),
6426 N_("net rpc vampire keytab\n"
6427 " Dump remote SAM database to Kerberos keytab "
6434 N_("Dump remote SAM database to passdb"),
6435 N_("net rpc vampire passdb\n"
6436 " Dump remote SAM database to passdb")
6439 {NULL, NULL, 0, NULL, NULL}
6443 if (c->display_usage) {
6444 d_printf(_("Usage:\n"
6446 " Vampire remote SAM database\n"));
6450 return run_rpc_command(c, NULL, &ndr_table_netlogon.syntax_id,
6451 NET_FLAGS_ANONYMOUS,
6452 rpc_vampire_internals,
6456 return net_run_function(c, argc, argv, "net rpc vampire", func);
6460 * Migrate everything from a print server.
6462 * @param c A net_context structure.
6463 * @param argc Standard main() style argc.
6464 * @param argv Standard main() style argv. Initial components are already
6467 * @return A shell status integer (0 for success).
6469 * The order is important !
6470 * To successfully add drivers the print queues have to exist !
6471 * Applying ACLs should be the last step, because you're easily locked out.
6474 static int rpc_printer_migrate_all(struct net_context *c, int argc,
6479 if (c->display_usage) {
6480 d_printf(_("Usage:\n"
6481 "net rpc printer migrate all\n"
6482 " Migrate everything from a print server\n"));
6487 d_printf(_("no server to migrate\n"));
6491 ret = run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6492 rpc_printer_migrate_printers_internals, argc,
6497 ret = run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6498 rpc_printer_migrate_drivers_internals, argc,
6503 ret = run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6504 rpc_printer_migrate_forms_internals, argc, argv);
6508 ret = run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6509 rpc_printer_migrate_settings_internals, argc,
6514 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6515 rpc_printer_migrate_security_internals, argc,
6521 * Migrate print drivers from a print server.
6523 * @param c A net_context structure.
6524 * @param argc Standard main() style argc.
6525 * @param argv Standard main() style argv. Initial components are already
6528 * @return A shell status integer (0 for success).
6530 static int rpc_printer_migrate_drivers(struct net_context *c, int argc,
6533 if (c->display_usage) {
6534 d_printf(_("Usage:\n"
6535 "net rpc printer migrate drivers\n"
6536 " Migrate print-drivers from a print-server\n"));
6541 d_printf(_("no server to migrate\n"));
6545 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6546 rpc_printer_migrate_drivers_internals,
6551 * Migrate print-forms from a print-server.
6553 * @param c A net_context structure.
6554 * @param argc Standard main() style argc.
6555 * @param argv Standard main() style argv. Initial components are already
6558 * @return A shell status integer (0 for success).
6560 static int rpc_printer_migrate_forms(struct net_context *c, int argc,
6563 if (c->display_usage) {
6564 d_printf(_("Usage:\n"
6565 "net rpc printer migrate forms\n"
6566 " Migrate print-forms from a print-server\n"));
6571 d_printf(_("no server to migrate\n"));
6575 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6576 rpc_printer_migrate_forms_internals,
6581 * Migrate printers from a print-server.
6583 * @param c A net_context structure.
6584 * @param argc Standard main() style argc.
6585 * @param argv Standard main() style argv. Initial components are already
6588 * @return A shell status integer (0 for success).
6590 static int rpc_printer_migrate_printers(struct net_context *c, int argc,
6593 if (c->display_usage) {
6594 d_printf(_("Usage:\n"
6595 "net rpc printer migrate printers\n"
6596 " Migrate printers from a print-server\n"));
6601 d_printf(_("no server to migrate\n"));
6605 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6606 rpc_printer_migrate_printers_internals,
6611 * Migrate printer-ACLs from a print-server
6613 * @param c A net_context structure.
6614 * @param argc Standard main() style argc.
6615 * @param argv Standard main() style argv. Initial components are already
6618 * @return A shell status integer (0 for success).
6620 static int rpc_printer_migrate_security(struct net_context *c, int argc,
6623 if (c->display_usage) {
6624 d_printf(_("Usage:\n"
6625 "net rpc printer migrate security\n"
6626 " Migrate printer-ACLs from a print-server\n"));
6631 d_printf(_("no server to migrate\n"));
6635 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6636 rpc_printer_migrate_security_internals,
6641 * Migrate printer-settings from a print-server.
6643 * @param c A net_context structure.
6644 * @param argc Standard main() style argc.
6645 * @param argv Standard main() style argv. Initial components are already
6648 * @return A shell status integer (0 for success).
6650 static int rpc_printer_migrate_settings(struct net_context *c, int argc,
6653 if (c->display_usage) {
6654 d_printf(_("Usage:\n"
6655 "net rpc printer migrate settings\n"
6656 " Migrate printer-settings from a "
6662 d_printf(_("no server to migrate\n"));
6666 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6667 rpc_printer_migrate_settings_internals,
6672 * 'net rpc printer' entrypoint.
6674 * @param c A net_context structure.
6675 * @param argc Standard main() style argc.
6676 * @param argv Standard main() style argv. Initial components are already
6680 int rpc_printer_migrate(struct net_context *c, int argc, const char **argv)
6683 /* ouch: when addriver and setdriver are called from within
6684 rpc_printer_migrate_drivers_internals, the printer-queue already
6687 struct functable func[] = {
6690 rpc_printer_migrate_all,
6692 N_("Migrate all from remote to local print server"),
6693 N_("net rpc printer migrate all\n"
6694 " Migrate all from remote to local print server")
6698 rpc_printer_migrate_drivers,
6700 N_("Migrate drivers to local server"),
6701 N_("net rpc printer migrate drivers\n"
6702 " Migrate drivers to local server")
6706 rpc_printer_migrate_forms,
6708 N_("Migrate froms to local server"),
6709 N_("net rpc printer migrate forms\n"
6710 " Migrate froms to local server")
6714 rpc_printer_migrate_printers,
6716 N_("Migrate printers to local server"),
6717 N_("net rpc printer migrate printers\n"
6718 " Migrate printers to local server")
6722 rpc_printer_migrate_security,
6724 N_("Mirgate printer ACLs to local server"),
6725 N_("net rpc printer migrate security\n"
6726 " Mirgate printer ACLs to local server")
6730 rpc_printer_migrate_settings,
6732 N_("Migrate printer settings to local server"),
6733 N_("net rpc printer migrate settings\n"
6734 " Migrate printer settings to local server")
6736 {NULL, NULL, 0, NULL, NULL}
6739 return net_run_function(c, argc, argv, "net rpc printer migrate",func);
6744 * List printers on a remote RPC server.
6746 * @param c A net_context structure.
6747 * @param argc Standard main() style argc.
6748 * @param argv Standard main() style argv. Initial components are already
6751 * @return A shell status integer (0 for success).
6753 static int rpc_printer_list(struct net_context *c, int argc, const char **argv)
6755 if (c->display_usage) {
6756 d_printf(_("Usage:\n"
6757 "net rpc printer list\n"
6758 " List printers on a remote RPC server\n"));
6762 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6763 rpc_printer_list_internals,
6768 * List printer-drivers on a remote RPC server.
6770 * @param c A net_context structure.
6771 * @param argc Standard main() style argc.
6772 * @param argv Standard main() style argv. Initial components are already
6775 * @return A shell status integer (0 for success).
6777 static int rpc_printer_driver_list(struct net_context *c, int argc,
6780 if (c->display_usage) {
6781 d_printf(_("Usage:\n"
6782 "net rpc printer driver\n"
6783 " List printer-drivers on a remote RPC server\n"));
6787 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6788 rpc_printer_driver_list_internals,
6793 * Publish printer in ADS via MSRPC.
6795 * @param c A net_context structure.
6796 * @param argc Standard main() style argc.
6797 * @param argv Standard main() style argv. Initial components are already
6800 * @return A shell status integer (0 for success).
6802 static int rpc_printer_publish_publish(struct net_context *c, int argc,
6805 if (c->display_usage) {
6806 d_printf(_("Usage:\n"
6807 "net rpc printer publish publish\n"
6808 " Publish printer in ADS via MSRPC\n"));
6812 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6813 rpc_printer_publish_publish_internals,
6818 * Update printer in ADS via MSRPC.
6820 * @param c A net_context structure.
6821 * @param argc Standard main() style argc.
6822 * @param argv Standard main() style argv. Initial components are already
6825 * @return A shell status integer (0 for success).
6827 static int rpc_printer_publish_update(struct net_context *c, int argc, const char **argv)
6829 if (c->display_usage) {
6830 d_printf(_("Usage:\n"
6831 "net rpc printer publish update\n"
6832 " Update printer in ADS via MSRPC\n"));
6836 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6837 rpc_printer_publish_update_internals,
6842 * UnPublish printer in ADS via MSRPC.
6844 * @param c A net_context structure.
6845 * @param argc Standard main() style argc.
6846 * @param argv Standard main() style argv. Initial components are already
6849 * @return A shell status integer (0 for success).
6851 static int rpc_printer_publish_unpublish(struct net_context *c, int argc,
6854 if (c->display_usage) {
6855 d_printf(_("Usage:\n"
6856 "net rpc printer publish unpublish\n"
6857 " UnPublish printer in ADS via MSRPC\n"));
6861 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6862 rpc_printer_publish_unpublish_internals,
6867 * List published printers via MSRPC.
6869 * @param c A net_context structure.
6870 * @param argc Standard main() style argc.
6871 * @param argv Standard main() style argv. Initial components are already
6874 * @return A shell status integer (0 for success).
6876 static int rpc_printer_publish_list(struct net_context *c, int argc,
6879 if (c->display_usage) {
6880 d_printf(_("Usage:\n"
6881 "net rpc printer publish list\n"
6882 " List published printers via MSRPC\n"));
6886 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6887 rpc_printer_publish_list_internals,
6893 * Publish printer in ADS.
6895 * @param c A net_context structure.
6896 * @param argc Standard main() style argc.
6897 * @param argv Standard main() style argv. Initial components are already
6900 * @return A shell status integer (0 for success).
6902 static int rpc_printer_publish(struct net_context *c, int argc,
6906 struct functable func[] = {
6909 rpc_printer_publish_publish,
6911 N_("Publish printer in AD"),
6912 N_("net rpc printer publish publish\n"
6913 " Publish printer in AD")
6917 rpc_printer_publish_update,
6919 N_("Update printer in AD"),
6920 N_("net rpc printer publish update\n"
6921 " Update printer in AD")
6925 rpc_printer_publish_unpublish,
6927 N_("Unpublish printer"),
6928 N_("net rpc printer publish unpublish\n"
6929 " Unpublish printer")
6933 rpc_printer_publish_list,
6935 N_("List published printers"),
6936 N_("net rpc printer publish list\n"
6937 " List published printers")
6939 {NULL, NULL, 0, NULL, NULL}
6943 if (c->display_usage) {
6944 d_printf(_("Usage:\n"));
6945 d_printf(_("net rpc printer publish\n"
6946 " List published printers\n"
6947 " Alias of net rpc printer publish "
6949 net_display_usage_from_functable(func);
6952 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6953 rpc_printer_publish_list_internals,
6957 return net_run_function(c, argc, argv, "net rpc printer publish",func);
6963 * Display rpc printer help page.
6965 * @param c A net_context structure.
6966 * @param argc Standard main() style argc.
6967 * @param argv Standard main() style argv. Initial components are already
6970 int rpc_printer_usage(struct net_context *c, int argc, const char **argv)
6972 d_printf(_("net rpc printer LIST [printer] [misc. options] [targets]\n"
6973 "\tlists all printers on print-server\n\n"));
6974 d_printf(_("net rpc printer DRIVER [printer] [misc. options] [targets]\n"
6975 "\tlists all printer-drivers on print-server\n\n"));
6976 d_printf(_("net rpc printer PUBLISH action [printer] [misc. options] [targets]\n"
6977 "\tpublishes printer settings in Active Directory\n"
6978 "\taction can be one of PUBLISH, UPDATE, UNPUBLISH or LIST\n\n"));
6979 d_printf(_("net rpc printer MIGRATE PRINTERS [printer] [misc. options] [targets]"
6980 "\n\tmigrates printers from remote to local server\n\n"));
6981 d_printf(_("net rpc printer MIGRATE SETTINGS [printer] [misc. options] [targets]"
6982 "\n\tmigrates printer-settings from remote to local server\n\n"));
6983 d_printf(_("net rpc printer MIGRATE DRIVERS [printer] [misc. options] [targets]"
6984 "\n\tmigrates printer-drivers from remote to local server\n\n"));
6985 d_printf(_("net rpc printer MIGRATE FORMS [printer] [misc. options] [targets]"
6986 "\n\tmigrates printer-forms from remote to local server\n\n"));
6987 d_printf(_("net rpc printer MIGRATE SECURITY [printer] [misc. options] [targets]"
6988 "\n\tmigrates printer-ACLs from remote to local server\n\n"));
6989 d_printf(_("net rpc printer MIGRATE ALL [printer] [misc. options] [targets]"
6990 "\n\tmigrates drivers, forms, queues, settings and acls from\n"
6991 "\tremote to local print-server\n\n"));
6992 net_common_methods_usage(c, argc, argv);
6993 net_common_flags_usage(c, argc, argv);
6995 "\t-v or --verbose\t\t\tgive verbose output\n"
6996 "\t --destination\t\tmigration target server (default: localhost)\n"));
7002 * 'net rpc printer' entrypoint.
7004 * @param c A net_context structure.
7005 * @param argc Standard main() style argc.
7006 * @param argv Standard main() style argv. Initial components are already
7009 int net_rpc_printer(struct net_context *c, int argc, const char **argv)
7011 struct functable func[] = {
7016 N_("List all printers on print server"),
7017 N_("net rpc printer list\n"
7018 " List all printers on print server")
7022 rpc_printer_migrate,
7024 N_("Migrate printer to local server"),
7025 N_("net rpc printer migrate\n"
7026 " Migrate printer to local server")
7030 rpc_printer_driver_list,
7032 N_("List printer drivers"),
7033 N_("net rpc printer driver\n"
7034 " List printer drivers")
7038 rpc_printer_publish,
7040 N_("Publish printer in AD"),
7041 N_("net rpc printer publish\n"
7042 " Publish printer in AD")
7044 {NULL, NULL, 0, NULL, NULL}
7048 if (c->display_usage) {
7049 d_printf(_("Usage:\n"));
7050 d_printf(_("net rpc printer\n"
7051 " List printers\n"));
7052 net_display_usage_from_functable(func);
7055 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
7056 rpc_printer_list_internals,
7060 return net_run_function(c, argc, argv, "net rpc printer", func);
7064 * 'net rpc' entrypoint.
7066 * @param c A net_context structure.
7067 * @param argc Standard main() style argc.
7068 * @param argv Standard main() style argv. Initial components are already
7072 int net_rpc(struct net_context *c, int argc, const char **argv)
7074 NET_API_STATUS status;
7076 struct functable func[] = {
7081 N_("Modify global audit settings"),
7082 N_("net rpc audit\n"
7083 " Modify global audit settings")
7089 N_("Show basic info about a domain"),
7091 " Show basic info about a domain")
7097 N_("Join a domain"),
7105 N_("Join a domain created in server manager"),
7106 N_("net rpc oldjoin\n"
7107 " Join a domain created in server manager")
7113 N_("Test that a join is valid"),
7114 N_("net rpc testjoin\n"
7115 " Test that a join is valid")
7121 N_("List/modify users"),
7123 " List/modify users")
7129 N_("Change a user password"),
7130 N_("net rpc password\n"
7131 " Change a user password\n"
7132 " Alias for net rpc user password")
7138 N_("List/modify groups"),
7139 N_("net rpc group\n"
7140 " List/modify groups")
7146 N_("List/modify shares"),
7147 N_("net rpc share\n"
7148 " List/modify shares")
7154 N_("List open files"),
7162 N_("List/modify printers"),
7163 N_("net rpc printer\n"
7164 " List/modify printers")
7168 net_rpc_changetrustpw,
7170 N_("Change trust account password"),
7171 N_("net rpc changetrustpw\n"
7172 " Change trust account password")
7178 N_("Modify domain trusts"),
7179 N_("net rpc trustdom\n"
7180 " Modify domain trusts")
7186 N_("Abort a remote shutdown"),
7187 N_("net rpc abortshutdown\n"
7188 " Abort a remote shutdown")
7194 N_("Shutdown a remote server"),
7195 N_("net rpc shutdown\n"
7196 " Shutdown a remote server")
7202 N_("Dump SAM data of remote NT PDC"),
7203 N_("net rpc samdump\n"
7204 " Dump SAM data of remote NT PDC")
7210 N_("Sync a remote NT PDC's data into local passdb"),
7211 N_("net rpc vampire\n"
7212 " Sync a remote NT PDC's data into local passdb")
7218 N_("Fetch the domain sid into local secrets.tdb"),
7219 N_("net rpc getsid\n"
7220 " Fetch the domain sid into local secrets.tdb")
7226 N_("Manage privileges assigned to SID"),
7227 N_("net rpc rights\n"
7228 " Manage privileges assigned to SID")
7234 N_("Start/stop/query remote services"),
7235 N_("net rpc service\n"
7236 " Start/stop/query remote services")
7242 N_("Manage registry hives"),
7243 N_("net rpc registry\n"
7244 " Manage registry hives")
7250 N_("Open interactive shell on remote server"),
7251 N_("net rpc shell\n"
7252 " Open interactive shell on remote server")
7254 {NULL, NULL, 0, NULL, NULL}
7257 status = libnetapi_init(&c->netapi_ctx);
7261 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
7262 libnetapi_set_password(c->netapi_ctx, c->opt_password);
7263 if (c->opt_kerberos) {
7264 libnetapi_set_use_kerberos(c->netapi_ctx);
7267 return net_run_function(c, argc, argv, "net rpc", func);