#
-# backend code for provisioning a Samba4 server
-# Copyright Andrew Tridgell 2005
-# Copyright Jelmer Vernooij 2007
-# Released under the GNU GPL v2 or later
+# Unix SMB/CIFS implementation.
+# backend code for provisioning a Samba4 server
+
+# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
+# Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
+#
+# Based on the original in EJS:
+# Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
from base64 import b64encode
import grp
import time
import uuid, misc
-from socket import gethostname, gethostbyname
+import socket
import param
import registry
import samba
-from samba import Ldb, substitute_var, valid_netbios_name
+from auth import system_session
+from samba import Ldb, substitute_var, valid_netbios_name, check_all_substituted
from samba.samdb import SamDB
+from samba.idmap import IDmapDB
import security
-from ldb import Dn, SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, \
- LDB_ERR_NO_SUCH_OBJECT, timestring
+import urllib
+from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, \
+ LDB_ERR_NO_SUCH_OBJECT, timestring, CHANGETYPE_MODIFY, CHANGETYPE_NONE
+"""Functions for setting up a Samba configuration."""
+
+DEFAULTSITE = "Default-First-Site-Name"
class InvalidNetbiosName(Exception):
def __init__(self, name):
super(InvalidNetbiosName, self).__init__("The name '%r' is not a valid NetBIOS name" % name)
-class ProvisionSettings(object):
- def __init__(self, realm=None, domain=None, hostname=None, hostip=None):
- self.realm = realm
- self.domain = domain
- self.hostname = hostname
- self.hostip = hostip
- self.domainsid = None
- self.invocationid = None
- self.krbtgtpass = None
- self.machinepass = None
- self.adminpass = None
- self.defaultsite = "Default-First-Site-Name"
- self.datestring = None
- self.root = None
- self.nobody = None
- self.nogroup = None
- self.wheel = None
- self.backup = None
- self.users = None
- self.dnsdomain = None
- self.dnsname = None
- self.domaindn = None
- self.domaindn_ldb = None
- self.rootdn = None
- self.configdn = None
- self.configdn_ldb = None
- self.schemedn = None
- self.schemedn_ldb = None
- self.s4_ldapi_path = None
- self.policyguid = None
- self.extensibleobject = None
-
- def subst_vars(self):
- return {"SCHEMADN": self.schemadn,
- "SCHEMADN_LDB": self.schemadn_ldb,
- "SCHEMADN_MOD": "schema_fsmo",
- "SCHEMADN_MOD2": ",objectguid",
- "CONFIGDN": self.configdn,
- "TDB_MODULES_LIST": ","+",".join(self.tdb_modules_list),
- "MODULES_LIST2": ",".join(self.modules_list2),
- "CONFIGDN_LDB": self.configdn_ldb,
- "DOMAINDN": self.domaindn,
- "DOMAINDN_LDB": self.domaindn_ldb,
- "DOMAINDN_MOD": "pdc_fsmo,password_hash",
- "DOMAINDN_MOD2": ",objectguid",
- "DOMAINSID": str(self.domainsid),
- "MODULES_LIST": ",".join(self.modules_list),
- "CONFIGDN_MOD": "naming_fsmo",
- "CONFIGDN_MOD2": ",objectguid",
- "NETBIOSNAME": self.netbiosname,
- "DNSNAME": self.dnsname,
- "ROOTDN": self.rootdn,
- "DOMAIN": self.domain,
- "DNSDOMAIN": self.dnsdomain,
- "REALM": self.realm,
- "DEFAULTSITE": self.defaultsite,
- "MACHINEPASS_B64": b64encode(self.machinepass),
- "ADMINPASS_B64": b64encode(self.adminpass),
- "DNSPASS_B64": b64encode(self.dnspass),
- "KRBTGTPASS_B64": b64encode(self.krbtgtpass),
- "S4_LDAPI_URI": "ldapi://%s" % self.s4_ldapi_path.replace("/", "%2F"),
- "LDAPTIME": timestring(int(time.time())),
- "POLICYGUID": self.policyguid,
- "RDN_DC": self.rdn_dc,
- "DOMAINGUID_MOD": self.domainguid_mod,
- "VERSION": samba.version(),
- "ACI": "# no aci for local ldb",
- "EXTENSIBLEOBJECT": self.extensibleobject,
- }
-
- def fix(self, paths):
- self.realm = self.realm.upper()
- self.hostname = self.hostname.lower()
- self.domain = self.domain.upper()
- if not valid_netbios_name(self.domain):
- raise InvalidNetbiosName(self.domain)
- self.netbiosname = self.hostname.upper()
- if not valid_netbios_name(self.netbiosname):
- raise InvalidNetbiosName(self.netbiosname)
- rdns = self.domaindn.split(",")
- self.rdn_dc = rdns[0][len("DC="):]
-
- self.sam_ldb = paths.samdb
- self.secrets_ldb = paths.secrets
- self.secrets_keytab = paths.keytab
-
- self.s4_ldapi_path = paths.s4_ldapi_path
-
- def validate(self, lp):
- if not valid_netbios_name(self.domain):
- raise InvalidNetbiosName(self.domain)
-
- if not valid_netbios_name(self.netbiosname):
- raise InvalidNetbiosName(self.netbiosname)
-
- if lp.get("workgroup").upper() != self.domain.upper():
- raise Error("workgroup '%s' in smb.conf must match chosen domain '%s'\n",
- lp.get("workgroup"), self.domain)
-
- if lp.get("realm").upper() != self.realm.upper():
- raise Error("realm '%s' in smb.conf must match chosen realm '%s'\n" %
- (lp.get("realm"), self.realm))
-
-
class ProvisionPaths:
def __init__(self):
- self.smbconf = None
self.shareconf = None
self.hklm = None
self.hkcu = None
self.hkpd = None
self.hkpt = None
self.samdb = None
+ self.idmapdb = None
self.secrets = None
self.keytab = None
+ self.dns_keytab = None
self.dns = None
self.winsdb = None
- self.ldap_basedn_ldif = None
- self.ldap_config_basedn_ldif = None
- self.ldap_schema_basedn_ldif = None
- self.s4_ldapi_path = None
-
+ self.private_dir = None
+ self.ldapdir = None
+ self.slapdconf = None
+ self.modulesconf = None
+ self.memberofconf = None
+ self.fedoradsinf = None
+ self.fedoradspartitions = None
+
+class ProvisionNames:
+ def __init__(self):
+ self.rootdn = None
+ self.domaindn = None
+ self.configdn = None
+ self.schemadn = None
+ self.ldapmanagerdn = None
+ self.dnsdomain = None
+ self.realm = None
+ self.netbiosname = None
+ self.domain = None
+ self.hostname = None
+ self.sitename = None
+
+class ProvisionResult:
+ def __init__(self):
+ self.paths = None
+ self.domaindn = None
+ self.lp = None
+ self.samdb = None
-def install_ok(lp, session_info, credentials):
- """Check whether the current install seems ok."""
+def check_install(lp, session_info, credentials):
+ """Check whether the current install seems ok.
+
+ :param lp: Loadparm context
+ :param session_info: Session information
+ :param credentials: Credentials
+ """
if lp.get("realm") == "":
- return False
+ raise Exception("Realm empty")
ldb = Ldb(lp.get("sam database"), session_info=session_info,
credentials=credentials, lp=lp)
if len(ldb.search("(cn=Administrator)")) != 1:
- return False
- return True
+ raise "No administrator account found"
-def findnss(nssfn, *names):
- """Find a user or group from a list of possibilities."""
+def findnss(nssfn, names):
+ """Find a user or group from a list of possibilities.
+
+ :param nssfn: NSS Function to try (should raise KeyError if not found)
+ :param names: Names to check.
+ :return: Value return by first names list.
+ """
for name in names:
try:
return nssfn(name)
except KeyError:
pass
- raise Exception("Unable to find user/group for %s" % arguments[1])
-
+ raise KeyError("Unable to find user/group %r" % names)
-def hostip():
- """return first host IP."""
- return gethostbyname(hostname())
+findnss_uid = lambda names: findnss(pwd.getpwnam, names)[2]
+findnss_gid = lambda names: findnss(grp.getgrnam, names)[2]
-def hostname():
- """return first part of hostname."""
- return gethostname().split(".")[0]
+def open_ldb(session_info, credentials, lp, dbname):
+ """Open a LDB, thrashing it if it is corrupt.
-def ldb_delete(ldb):
- """Delete a LDB file.
-
- This may be necessary if the ldb is in bad shape, possibly due to being
- built from an incompatible previous version of the code, so delete it
- completely.
+ :param session_info: auth session information
+ :param credentials: credentials
+ :param lp: Loadparm context
+ :param dbname: Path of the database to open.
+ :return: a Ldb object
"""
- print "Deleting %s\n" % ldb.filename
- os.unlink(ldb.filename)
- ldb.connect(ldb.filename)
-
-
-def open_ldb(session_info, credentials, lp, dbname):
assert session_info is not None
try:
return Ldb(dbname, session_info=session_info, credentials=credentials,
lp=lp)
-def setup_add_ldif(setup_dir, ldif, subobj, ldb):
- """Setup a ldb in the private dir."""
- assert isinstance(ldif, str)
- assert isinstance(setup_dir, str)
- src = os.path.join(setup_dir, ldif)
+def setup_add_ldif(ldb, ldif_path, subst_vars=None):
+ """Setup a ldb in the private dir.
+
+ :param ldb: LDB file to import data into
+ :param ldif_path: Path of the LDIF file to load
+ :param subst_vars: Optional variables to subsitute in LDIF.
+ """
+ assert isinstance(ldif_path, str)
- data = open(src, 'r').read()
- data = substitute_var(data, subobj.subst_vars())
+ data = open(ldif_path, 'r').read()
+ if subst_vars is not None:
+ data = substitute_var(data, subst_vars)
- for msg in ldb.parse_ldif(data):
- ldb.add(msg[1])
+ check_all_substituted(data)
+ ldb.add_ldif(data)
+
+
+def setup_modify_ldif(ldb, ldif_path, substvars=None):
+ """Modify a ldb in the private dir.
+
+ :param ldb: LDB object.
+ :param ldif_path: LDIF file path.
+ :param substvars: Optional dictionary with substitution variables.
+ """
+ data = open(ldif_path, 'r').read()
+ if substvars is not None:
+ data = substitute_var(data, substvars)
-def setup_modify_ldif(setup_dir, ldif, subobj, ldb):
- src = os.path.join(setup_dir, ldif)
+ check_all_substituted(data)
- data = open(src, 'r').read()
- data = substitute_var(data, subobj.subst_vars())
+ ldb.modify_ldif(data)
- for (changetype, msg) in ldb.parse_ldif(data):
- ldb.modify(msg)
+def setup_ldb(ldb, ldif_path, subst_vars):
+ """Import a LDIF a file into a LDB handle, optionally substituting variables.
-def setup_ldb(ldb, setup_dir, ldif, subobj):
+ :note: Either all LDIF data will be added or none (using transactions).
+
+ :param ldb: LDB file to import into.
+ :param ldif_path: Path to the LDIF file.
+ :param subst_vars: Dictionary with substitution variables.
+ """
assert ldb is not None
ldb.transaction_start()
try:
- setup_add_ldif(setup_dir, ldif, subobj, ldb)
+ setup_add_ldif(ldb, ldif_path, subst_vars)
except:
ldb.transaction_cancel()
raise
ldb.transaction_commit()
-def setup_ldb_modify(setup_dir, ldif, subobj, ldb):
- """Modify a ldb in the private dir."""
- src = os.path.join(setup_dir, ldif)
-
- data = open(src, 'r').read()
- data = substitute_var(data, subobj.subst_vars())
- assert not "${" in data
-
- for (changetype, msg) in ldb.parse_ldif(data):
- ldb.modify(msg)
+def setup_file(template, fname, substvars):
+ """Setup a file in the private dir.
-
-def setup_file(setup_dir, template, message, fname, subobj):
- """Setup a file in the private dir."""
+ :param template: Path of the template file.
+ :param fname: Path of the file to create.
+ :param substvars: Substitution variables.
+ """
f = fname
- src = os.path.join(setup_dir, template)
- os.unlink(f)
+ if os.path.exists(f):
+ os.unlink(f)
- data = open(src, 'r').read()
- data = substitute_var(data, subobj.subst_vars())
- assert not "${" in data
+ data = open(template, 'r').read()
+ if substvars:
+ data = substitute_var(data, substvars)
+ check_all_substituted(data)
open(f, 'w').write(data)
-def provision_default_paths(lp, subobj):
+def provision_paths_from_lp(lp, dnsdomain):
"""Set the default paths for provisioning.
:param lp: Loadparm context.
- :param subobj: Object
+ :param dnsdomain: DNS Domain name
"""
paths = ProvisionPaths()
- private_dir = lp.get("private dir")
- paths.shareconf = os.path.join(private_dir, "share.ldb")
- paths.samdb = os.path.join(private_dir, lp.get("sam database") or "samdb.ldb")
- paths.secrets = os.path.join(private_dir, lp.get("secrets database") or "secrets.ldb")
- paths.templates = os.path.join(private_dir, "templates.ldb")
- paths.keytab = os.path.join(private_dir, "secrets.keytab")
- paths.dns = os.path.join(private_dir, subobj.dnsdomain + ".zone")
- paths.winsdb = os.path.join(private_dir, "wins.ldb")
- paths.ldap_basedn_ldif = os.path.join(private_dir,
- subobj.dnsdomain + ".ldif")
- paths.ldap_config_basedn_ldif = os.path.join(private_dir,
- subobj.dnsdomain + "-config.ldif")
- paths.ldap_schema_basedn_ldif = os.path.join(private_dir,
- subobj.dnsdomain + "-schema.ldif")
- paths.s4_ldapi_path = os.path.join(private_dir, "ldapi")
- paths.phpldapadminconfig = os.path.join(private_dir,
+ paths.private_dir = lp.get("private dir")
+ paths.keytab = "secrets.keytab"
+ paths.dns_keytab = "dns.keytab"
+
+ paths.shareconf = os.path.join(paths.private_dir, "share.ldb")
+ paths.samdb = os.path.join(paths.private_dir, lp.get("sam database") or "samdb.ldb")
+ paths.idmapdb = os.path.join(paths.private_dir, lp.get("idmap database") or "idmap.ldb")
+ paths.secrets = os.path.join(paths.private_dir, lp.get("secrets database") or "secrets.ldb")
+ paths.templates = os.path.join(paths.private_dir, "templates.ldb")
+ paths.dns = os.path.join(paths.private_dir, dnsdomain + ".zone")
+ paths.winsdb = os.path.join(paths.private_dir, "wins.ldb")
+ paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
+ paths.phpldapadminconfig = os.path.join(paths.private_dir,
"phpldapadmin-config.php")
- paths.hklm = os.path.join(private_dir, "hklm.ldb")
+ paths.ldapdir = os.path.join(paths.private_dir,
+ "ldap")
+ paths.slapdconf = os.path.join(paths.ldapdir,
+ "slapd.conf")
+ paths.modulesconf = os.path.join(paths.ldapdir,
+ "modules.conf")
+ paths.memberofconf = os.path.join(paths.ldapdir,
+ "memberof.conf")
+ paths.fedoradsinf = os.path.join(paths.ldapdir,
+ "fedorads.inf")
+ paths.fedoradspartitions = os.path.join(paths.ldapdir,
+ "fedorads-partitions.ldif")
+ paths.hklm = "hklm.ldb"
+ paths.hkcr = "hkcr.ldb"
+ paths.hkcu = "hkcu.ldb"
+ paths.hku = "hku.ldb"
+ paths.hkpd = "hkpd.ldb"
+ paths.hkpt = "hkpt.ldb"
+
+ paths.sysvol = lp.get("path", "sysvol")
+
+ paths.netlogon = lp.get("path", "netlogon")
+
return paths
-def setup_name_mappings(subobj, ldb):
- """setup reasonable name mappings for sam names to unix names."""
- res = ldb.search(Dn(ldb, subobj.domaindn), SCOPE_BASE, "objectSid=*",
- ["objectSid"])
- assert len(res) == 1
- assert "objectSid" in res[0]
- sid = str(list(res[0]["objectSid"])[0])
+def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None,
+ serverrole=None, rootdn=None, domaindn=None, configdn=None,
+ schemadn=None, sitename=None):
- # add some foreign sids if they are not present already
- ldb.add_foreign(subobj.domaindn, "S-1-5-7", "Anonymous")
- ldb.add_foreign(subobj.domaindn, "S-1-1-0", "World")
- ldb.add_foreign(subobj.domaindn, "S-1-5-2", "Network")
- ldb.add_foreign(subobj.domaindn, "S-1-5-18", "System")
- ldb.add_foreign(subobj.domaindn, "S-1-5-11", "Authenticated Users")
-
- # some well known sids
- ldb.setup_name_mapping(subobj.domaindn, "S-1-5-7", subobj.nobody)
- ldb.setup_name_mapping(subobj.domaindn, "S-1-1-0", subobj.nogroup)
- ldb.setup_name_mapping(subobj.domaindn, "S-1-5-2", subobj.nogroup)
- ldb.setup_name_mapping(subobj.domaindn, "S-1-5-18", subobj.root)
- ldb.setup_name_mapping(subobj.domaindn, "S-1-5-11", subobj.users)
- ldb.setup_name_mapping(subobj.domaindn, "S-1-5-32-544", subobj.wheel)
- ldb.setup_name_mapping(subobj.domaindn, "S-1-5-32-545", subobj.users)
- ldb.setup_name_mapping(subobj.domaindn, "S-1-5-32-546", subobj.nogroup)
- ldb.setup_name_mapping(subobj.domaindn, "S-1-5-32-551", subobj.backup)
-
- # and some well known domain rids
- ldb.setup_name_mapping(subobj.domaindn, sid + "-500", subobj.root)
- ldb.setup_name_mapping(subobj.domaindn, sid + "-518", subobj.wheel)
- ldb.setup_name_mapping(subobj.domaindn, sid + "-519", subobj.wheel)
- ldb.setup_name_mapping(subobj.domaindn, sid + "-512", subobj.wheel)
- ldb.setup_name_mapping(subobj.domaindn, sid + "-513", subobj.users)
- ldb.setup_name_mapping(subobj.domaindn, sid + "-520", subobj.wheel)
-
-
-def provision_become_dc(setup_dir, subobj, message, paths, lp, session_info,
- credentials):
- assert session_info is not None
- subobj.fix(paths)
+ if hostname is None:
+ hostname = socket.gethostname().split(".")[0].lower()
- message("Setting up templates into %s" % paths.templates)
- templates_ldb = Ldb(paths.templates, session_info=session_info,
- credentials=credentials, lp=lp)
- templates_ldb.erase()
- setup_ldb(templates_ldb, setup_dir, "provision_templates.ldif", subobj)
+ netbiosname = hostname.upper()
+ if not valid_netbios_name(netbiosname):
+ raise InvalidNetbiosName(netbiosname)
- # Also wipes the database
- message("Setting up %s partitions" % paths.samdb)
- samdb = SamDB(paths.samdb, credentials=credentials,
- session_info=session_info, lp=lp)
- samdb.erase()
- setup_ldb(samdb, setup_dir, "provision_partitions.ldif", subobj)
+ hostname = hostname.lower()
- samdb = SamDB(paths.samdb, session_info=session_info,
- credentials=credentials, lp=lp)
- ldb.transaction_start()
- try:
- message("Setting up %s attributes" % paths.samdb)
- setup_add_ldif(setup_dir, "provision_init.ldif", subobj, samdb)
+ if dnsdomain is None:
+ dnsdomain = lp.get("realm")
- message("Setting up %s rootDSE" % paths.samdb)
- setup_add_ldif(setup_dir, "provision_rootdse_add.ldif", subobj, samdb)
+ if serverrole is None:
+ serverrole = lp.get("server role")
- message("Erasing data from partitions")
- ldb_erase_partitions(subobj, message, samdb, None)
+ assert dnsdomain is not None
+ realm = dnsdomain.upper()
- message("Setting up %s indexes" % paths.samdb)
- setup_add_ldif(setup_dir, "provision_index.ldif", subobj, samdb)
- except:
- samdb.transaction_cancel()
- raise
+ if lp.get("realm").upper() != realm:
+ raise Exception("realm '%s' must match chosen realm '%s'" %
+ (lp.get("realm"), realm))
+
+ dnsdomain = dnsdomain.lower()
+
+ if serverrole == "domain controller":
+ if domain is None:
+ domain = lp.get("workgroup")
+ if domaindn is None:
+ domaindn = "DC=" + dnsdomain.replace(".", ",DC=")
+ if lp.get("workgroup").upper() != domain.upper():
+ raise Exception("workgroup '%s' in smb.conf must match chosen domain '%s'",
+ lp.get("workgroup"), domain)
+ else:
+ domain = netbiosname
+ if domaindn is None:
+ domaindn = "CN=" + netbiosname
+
+ assert domain is not None
+ domain = domain.upper()
+ if not valid_netbios_name(domain):
+ raise InvalidNetbiosName(domain)
+
+ if rootdn is None:
+ rootdn = domaindn
+
+ if configdn is None:
+ configdn = "CN=Configuration," + rootdn
+ if schemadn is None:
+ schemadn = "CN=Schema," + configdn
+
+ if sitename is None:
+ sitename=DEFAULTSITE
+
+ names = ProvisionNames()
+ names.rootdn = rootdn
+ names.domaindn = domaindn
+ names.configdn = configdn
+ names.schemadn = schemadn
+ names.ldapmanagerdn = "CN=Manager," + rootdn
+ names.dnsdomain = dnsdomain
+ names.domain = domain
+ names.realm = realm
+ names.netbiosname = netbiosname
+ names.hostname = hostname
+ names.sitename = sitename
+
+ return names
+
- samdb.transaction_commit()
+def make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole,
+ targetdir):
+ if hostname is None:
+ hostname = socket.gethostname().split(".")[0].lower()
- message("Setting up %s" % paths.secrets)
- secrets_ldb = Ldb(paths.secrets, session_info=session_info,
- credentials=credentials, lp=lp)
- secrets_ldb.clear()
- setup_ldb(secrets_ldb, setup_dir, "secrets_init.ldif", subobj)
- setup_ldb(secrets_ldb, setup_dir, "secrets.ldif", subobj)
- setup_ldb(secrets_ldb, setup_dir, "secrets_dc.ldif", subobj)
+ if serverrole is None:
+ serverrole = "standalone"
+ assert serverrole in ("domain controller", "member server", "standalone")
+ if serverrole == "domain controller":
+ smbconfsuffix = "dc"
+ elif serverrole == "member server":
+ smbconfsuffix = "member"
+ elif serverrole == "standalone":
+ smbconfsuffix = "standalone"
-def provision(lp, setup_dir, subobj, message, blank, paths, session_info,
- credentials, ldapbackend):
- """Provision samba4
+ assert domain is not None
+ assert realm is not None
+
+ default_lp = param.LoadParm()
+ #Load non-existant file
+ default_lp.load(smbconf)
- :note: caution, this wipes all existing data!
- """
- subobj.fix(paths)
+ if targetdir is not None:
+ privatedir_line = "private dir = " + os.path.abspath(os.path.join(targetdir, "private"))
+ lockdir_line = "lock dir = " + os.path.abspath(targetdir)
- if subobj.domain_guid is not None:
- subobj.domainguid_mod = "replace: objectGUID\nobjectGUID: %s\n-" % subobj.domain_guid
+ default_lp.set("lock dir", os.path.abspath(targetdir))
else:
- subobj.domainguid_mod = ""
+ privatedir_line = ""
+ lockdir_line = ""
+
+ sysvol = os.path.join(default_lp.get("lock dir"), "sysvol")
+ netlogon = os.path.join(sysvol, realm.lower(), "scripts")
+
+ setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix),
+ smbconf, {
+ "HOSTNAME": hostname,
+ "DOMAIN": domain,
+ "REALM": realm,
+ "SERVERROLE": serverrole,
+ "NETLOGONPATH": netlogon,
+ "SYSVOLPATH": sysvol,
+ "PRIVATEDIR_LINE": privatedir_line,
+ "LOCKDIR_LINE": lockdir_line
+ })
+
+
+def setup_name_mappings(samdb, idmap, sid, domaindn, root_uid, nobody_uid,
+ users_gid, wheel_gid):
+ """setup reasonable name mappings for sam names to unix names.
+
+ :param samdb: SamDB object.
+ :param idmap: IDmap db object.
+ :param sid: The domain sid.
+ :param domaindn: The domain DN.
+ :param root_uid: uid of the UNIX root user.
+ :param nobody_uid: uid of the UNIX nobody user.
+ :param users_gid: gid of the UNIX users group.
+ :param wheel_gid: gid of the UNIX wheel group."""
+ # add some foreign sids if they are not present already
+ samdb.add_foreign(domaindn, "S-1-5-7", "Anonymous")
+ samdb.add_foreign(domaindn, "S-1-1-0", "World")
+ samdb.add_foreign(domaindn, "S-1-5-2", "Network")
+ samdb.add_foreign(domaindn, "S-1-5-18", "System")
+ samdb.add_foreign(domaindn, "S-1-5-11", "Authenticated Users")
- if subobj.host_guid is not None:
- subobj.hostguid_add = "objectGUID: %s" % subobj.host_guid
- else:
- subobj.hostguid_add = ""
+ idmap.setup_name_mapping("S-1-5-7", idmap.TYPE_UID, nobody_uid)
+ idmap.setup_name_mapping("S-1-5-32-544", idmap.TYPE_GID, wheel_gid)
- assert paths.smbconf is not None
+ idmap.setup_name_mapping(sid + "-500", idmap.TYPE_UID, root_uid)
+ idmap.setup_name_mapping(sid + "-513", idmap.TYPE_GID, users_gid)
- # only install a new smb.conf if there isn't one there already
- if not os.path.exists(paths.smbconf):
- message("Setting up smb.conf")
- setup_file(setup_dir, "provision.smb.conf", message, paths.smbconf,
- subobj)
- lp.reload()
- # only install a new shares config db if there is none
- if not os.path.exists(paths.shareconf):
- message("Setting up share.ldb")
- share_ldb = Ldb(paths.shareconf, session_info=session_info,
- credentials=credentials, lp=lp)
- setup_ldb(share_ldb, setup_dir, "share.ldif", subobj)
-
- message("Setting up %s" % paths.secrets)
- secrets_ldb = Ldb(paths.secrets, session_info=session_info,
- credentials=credentials, lp=lp)
- secrets_ldb.erase()
- setup_ldb(secrets_ldb, setup_dir, "secrets_init.ldif", subobj)
- setup_ldb(secrets_ldb, setup_dir, "secrets.ldif", subobj)
+def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info,
+ credentials, names,
+ serverrole, ldap_backend=None,
+ ldap_backend_type=None, erase=False):
+ """Setup the partitions for the SAM database.
+
+ Alternatively, provision() may call this, and then populate the database.
+
+ :note: This will wipe the Sam Database!
+
+ :note: This function always removes the local SAM LDB file. The erase
+ parameter controls whether to erase the existing data, which
+ may not be stored locally but in LDAP.
+ """
+ assert session_info is not None
- message("Setting up registry")
- reg = registry.Registry()
- #hive = registry.Hive(paths.hklm, session_info=session_info,
- # credentials=credentials, lp_ctx=lp)
- #reg.mount_hive(hive, "HKEY_LOCAL_MACHINE")
- provision_reg = os.path.join(setup_dir, "provision.reg")
- assert os.path.exists(provision_reg)
- #reg.apply_patchfile(provision_reg)
+ samdb = SamDB(samdb_path, session_info=session_info,
+ credentials=credentials, lp=lp)
- message("Setting up templates into %s" % paths.templates)
- templates_ldb = Ldb(paths.templates, session_info=session_info,
- credentials=credentials, lp=lp)
- templates_ldb.erase()
- setup_ldb(templates_ldb, setup_dir, "provision_templates.ldif", subobj)
+ # Wipes the database
+ try:
+ samdb.erase()
+ except:
+ os.unlink(samdb_path)
- message("Setting up sam.ldb partitions")
- samdb = SamDB(paths.samdb, session_info=session_info,
+ samdb = SamDB(samdb_path, session_info=session_info,
credentials=credentials, lp=lp)
- samdb.erase()
- setup_ldb(samdb, setup_dir, "provision_partitions.ldif", subobj)
- samdb = SamDB(paths.samdb, session_info=session_info,
+ #Add modules to the list to activate them by default
+ #beware often order is important
+ #
+ # Some Known ordering constraints:
+ # - rootdse must be first, as it makes redirects from "" -> cn=rootdse
+ # - objectclass must be before password_hash, because password_hash checks
+ # that the objectclass is of type person (filled in by objectclass
+ # module when expanding the objectclass list)
+ # - partition must be last
+ # - each partition has its own module list then
+ modules_list = ["rootdse",
+ "paged_results",
+ "ranged_results",
+ "anr",
+ "server_sort",
+ "extended_dn",
+ "asq",
+ "rdn_name",
+ "objectclass",
+ "samldb",
+ "kludge_acl",
+ "operational"]
+ tdb_modules_list = [
+ "subtree_rename",
+ "subtree_delete",
+ "linked_attributes"]
+ modules_list2 = ["show_deleted",
+ "partition"]
+
+ domaindn_ldb = "users.ldb"
+ if ldap_backend is not None:
+ domaindn_ldb = ldap_backend
+ configdn_ldb = "configuration.ldb"
+ if ldap_backend is not None:
+ configdn_ldb = ldap_backend
+ schemadn_ldb = "schema.ldb"
+ if ldap_backend is not None:
+ schema_ldb = ldap_backend
+ schemadn_ldb = ldap_backend
+
+ if ldap_backend_type == "fedora-ds":
+ backend_modules = ["nsuniqueid", "paged_searches"]
+ # We can handle linked attributes here, as we don't have directory-side subtree operations
+ tdb_modules_list = ["linked_attributes"]
+ elif ldap_backend_type == "openldap":
+ backend_modules = ["normalise", "entryuuid", "paged_searches"]
+ # OpenLDAP handles subtree renames, so we don't want to do any of these things
+ tdb_modules_list = None
+ elif serverrole == "domain controller":
+ backend_modules = ["repl_meta_data"]
+ else:
+ backend_modules = ["objectguid"]
+
+ if tdb_modules_list is None:
+ tdb_modules_list_as_string = ""
+ else:
+ tdb_modules_list_as_string = ","+",".join(tdb_modules_list)
+
+ samdb.transaction_start()
+ try:
+ setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), {
+ "SCHEMADN": names.schemadn,
+ "SCHEMADN_LDB": schemadn_ldb,
+ "SCHEMADN_MOD2": ",objectguid",
+ "CONFIGDN": names.configdn,
+ "CONFIGDN_LDB": configdn_ldb,
+ "DOMAINDN": names.domaindn,
+ "DOMAINDN_LDB": domaindn_ldb,
+ "SCHEMADN_MOD": "schema_fsmo,instancetype",
+ "CONFIGDN_MOD": "naming_fsmo,instancetype",
+ "DOMAINDN_MOD": "pdc_fsmo,password_hash,instancetype",
+ "MODULES_LIST": ",".join(modules_list),
+ "TDB_MODULES_LIST": tdb_modules_list_as_string,
+ "MODULES_LIST2": ",".join(modules_list2),
+ "BACKEND_MOD": ",".join(backend_modules),
+ })
+
+ except:
+ samdb.transaction_cancel()
+ raise
+
+ samdb.transaction_commit()
+
+ samdb = SamDB(samdb_path, session_info=session_info,
credentials=credentials, lp=lp)
+
samdb.transaction_start()
try:
message("Setting up sam.ldb attributes")
- setup_add_ldif(setup_dir, "provision_init.ldif", subobj, samdb)
+ samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
message("Setting up sam.ldb rootDSE")
- setup_add_ldif(setup_dir, "provision_rootdse_add.ldif", subobj, samdb)
+ setup_samdb_rootdse(samdb, setup_path, names.schemadn, names.domaindn,
+ names.hostname, names.dnsdomain, names.realm,
+ names.rootdn, names.configdn, names.netbiosname,
+ names.sitename)
+
+ if erase:
+ message("Erasing data from partitions")
+ samdb.erase_partitions()
- message("Erasing data from partitions")
- ldb_erase_partitions(subobj, message, samdb, ldapbackend)
except:
samdb.transaction_cancel()
raise
samdb.transaction_commit()
+
+ return samdb
+
+
+def secretsdb_become_dc(secretsdb, setup_path, domain, realm, dnsdomain,
+ netbiosname, domainsid, keytab_path, samdb_url,
+ dns_keytab_path, dnspass, machinepass):
+ """Add DC-specific bits to a secrets database.
+
+ :param secretsdb: Ldb Handle to the secrets database
+ :param setup_path: Setup path function
+ :param machinepass: Machine password
+ """
+ setup_ldb(secretsdb, setup_path("secrets_dc.ldif"), {
+ "MACHINEPASS_B64": b64encode(machinepass),
+ "DOMAIN": domain,
+ "REALM": realm,
+ "DNSDOMAIN": dnsdomain,
+ "DOMAINSID": str(domainsid),
+ "SECRETS_KEYTAB": keytab_path,
+ "NETBIOSNAME": netbiosname,
+ "SAM_LDB": samdb_url,
+ "DNS_KEYTAB": dns_keytab_path,
+ "DNSPASS_B64": b64encode(dnspass),
+ })
+
+
+def setup_secretsdb(path, setup_path, session_info, credentials, lp):
+ """Setup the secrets database.
+
+ :param path: Path to the secrets database.
+ :param setup_path: Get the path to a setup file.
+ :param session_info: Session info.
+ :param credentials: Credentials
+ :param lp: Loadparm context
+ :return: LDB handle for the created secrets database
+ """
+ if os.path.exists(path):
+ os.unlink(path)
+ secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
+ lp=lp)
+ secrets_ldb.erase()
+ secrets_ldb.load_ldif_file_add(setup_path("secrets_init.ldif"))
+ secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
+ lp=lp)
+ secrets_ldb.load_ldif_file_add(setup_path("secrets.ldif"))
+ return secrets_ldb
+
+
+def setup_templatesdb(path, setup_path, session_info, credentials, lp):
+ """Setup the templates database.
+
+ :param path: Path to the database.
+ :param setup_path: Function for obtaining the path to setup files.
+ :param session_info: Session info
+ :param credentials: Credentials
+ :param lp: Loadparm context
+ """
+ templates_ldb = SamDB(path, session_info=session_info,
+ credentials=credentials, lp=lp)
+ templates_ldb.erase()
+ templates_ldb.load_ldif_file_add(setup_path("provision_templates.ldif"))
+
+
+def setup_registry(path, setup_path, session_info, credentials, lp):
+ """Setup the registry.
+
+ :param path: Path to the registry database
+ :param setup_path: Function that returns the path to a setup.
+ :param session_info: Session information
+ :param credentials: Credentials
+ :param lp: Loadparm context
+ """
+ reg = registry.Registry()
+ hive = registry.open_ldb(path, session_info=session_info,
+ credentials=credentials, lp_ctx=lp)
+ reg.mount_hive(hive, "HKEY_LOCAL_MACHINE")
+ provision_reg = setup_path("provision.reg")
+ assert os.path.exists(provision_reg)
+ reg.diff_apply(provision_reg)
+
+
+def setup_idmapdb(path, setup_path, session_info, credentials, lp):
+ """Setup the idmap database.
+
+ :param path: path to the idmap database
+ :param setup_path: Function that returns a path to a setup file
+ :param session_info: Session information
+ :param credentials: Credentials
+ :param lp: Loadparm context
+ """
+ if os.path.exists(path):
+ os.unlink(path)
+
+ idmap_ldb = IDmapDB(path, session_info=session_info,
+ credentials=credentials, lp=lp)
+
+ idmap_ldb.erase()
+ idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif"))
+ return idmap_ldb
+
+
+def setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname,
+ dnsdomain, realm, rootdn, configdn, netbiosname,
+ sitename):
+ """Setup the SamDB rootdse.
+
+ :param samdb: Sam Database handle
+ :param setup_path: Obtain setup path
+ """
+ setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
+ "SCHEMADN": schemadn,
+ "NETBIOSNAME": netbiosname,
+ "DNSDOMAIN": dnsdomain,
+ "DEFAULTSITE": sitename,
+ "REALM": realm,
+ "DNSNAME": "%s.%s" % (hostname, dnsdomain),
+ "DOMAINDN": domaindn,
+ "ROOTDN": rootdn,
+ "CONFIGDN": configdn,
+ "VERSION": samba.version(),
+ })
+
+
+def setup_self_join(samdb, names,
+ machinepass, dnspass,
+ domainsid, invocationid, setup_path,
+ policyguid):
+ """Join a host to its own domain."""
+ setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), {
+ "CONFIGDN": names.configdn,
+ "SCHEMADN": names.schemadn,
+ "DOMAINDN": names.domaindn,
+ "INVOCATIONID": invocationid,
+ "NETBIOSNAME": names.netbiosname,
+ "DEFAULTSITE": names.sitename,
+ "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
+ "MACHINEPASS_B64": b64encode(machinepass),
+ "DNSPASS_B64": b64encode(dnspass),
+ "REALM": names.realm,
+ "DOMAIN": names.domain,
+ "DNSDOMAIN": names.dnsdomain})
+ setup_add_ldif(samdb, setup_path("provision_group_policy.ldif"), {
+ "POLICYGUID": policyguid,
+ "DNSDOMAIN": names.dnsdomain,
+ "DOMAINSID": str(domainsid),
+ "DOMAINDN": names.domaindn})
+
+
+def setup_samdb(path, setup_path, session_info, credentials, lp,
+ names, message,
+ domainsid, aci, domainguid, policyguid,
+ fill, adminpass, krbtgtpass,
+ machinepass, invocationid, dnspass,
+ serverrole, ldap_backend=None,
+ ldap_backend_type=None):
+ """Setup a complete SAM Database.
+
+ :note: This will wipe the main SAM database file!
+ """
+
+ erase = (fill != FILL_DRS)
+
+ # Also wipes the database
+ setup_samdb_partitions(path, setup_path, message=message, lp=lp,
+ credentials=credentials, session_info=session_info,
+ names=names,
+ ldap_backend=ldap_backend, serverrole=serverrole,
+ ldap_backend_type=ldap_backend_type, erase=erase)
+
+ samdb = SamDB(path, session_info=session_info,
+ credentials=credentials, lp=lp)
+
+ if fill == FILL_DRS:
+ # We want to finish here, but setup the index before we do so
+ message("Setting up sam.ldb index")
+ samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
+ return samdb
message("Pre-loading the Samba 4 and AD schema")
- samdb = SamDB(paths.samdb, session_info=session_info,
+ samdb = SamDB(path, session_info=session_info,
credentials=credentials, lp=lp)
- samdb.set_domain_sid(subobj.domainsid)
- load_schema(setup_dir, subobj, samdb)
+ samdb.set_domain_sid(domainsid)
+ if serverrole == "domain controller":
+ samdb.set_invocation_id(invocationid)
+
+ load_schema(setup_path, samdb, names.schemadn, names.netbiosname,
+ names.configdn, names.sitename)
samdb.transaction_start()
try:
- message("Adding DomainDN: %s (permitted to fail)" % subobj.domaindn)
- setup_add_ldif(setup_dir, "provision_basedn.ldif", subobj, samdb)
- message("Modifying DomainDN: " + subobj.domaindn + "")
- setup_ldb_modify(setup_dir, "provision_basedn_modify.ldif", subobj, samdb)
+ message("Adding DomainDN: %s (permitted to fail)" % names.domaindn)
+ if serverrole == "domain controller":
+ domain_oc = "domainDNS"
+ else:
+ domain_oc = "samba4LocalDomain"
+
+ setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
+ "DOMAINDN": names.domaindn,
+ "ACI": aci,
+ "DOMAIN_OC": domain_oc
+ })
+
+ message("Modifying DomainDN: " + names.domaindn + "")
+ if domainguid is not None:
+ domainguid_mod = "replace: objectGUID\nobjectGUID: %s\n-" % domainguid
+ else:
+ domainguid_mod = ""
+
+ setup_modify_ldif(samdb, setup_path("provision_basedn_modify.ldif"), {
+ "LDAPTIME": timestring(int(time.time())),
+ "DOMAINSID": str(domainsid),
+ "SCHEMADN": names.schemadn,
+ "NETBIOSNAME": names.netbiosname,
+ "DEFAULTSITE": names.sitename,
+ "CONFIGDN": names.configdn,
+ "POLICYGUID": policyguid,
+ "DOMAINDN": names.domaindn,
+ "DOMAINGUID_MOD": domainguid_mod,
+ })
message("Adding configuration container (permitted to fail)")
- setup_add_ldif(setup_dir, "provision_configuration_basedn.ldif", subobj, samdb)
+ setup_add_ldif(samdb, setup_path("provision_configuration_basedn.ldif"), {
+ "CONFIGDN": names.configdn,
+ "ACI": aci,
+ "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb",
+ })
message("Modifying configuration container")
- setup_ldb_modify(setup_dir, "provision_configuration_basedn_modify.ldif", subobj, samdb)
+ setup_modify_ldif(samdb, setup_path("provision_configuration_basedn_modify.ldif"), {
+ "CONFIGDN": names.configdn,
+ "SCHEMADN": names.schemadn,
+ })
message("Adding schema container (permitted to fail)")
- setup_add_ldif(setup_dir, "provision_schema_basedn.ldif", subobj, samdb)
+ setup_add_ldif(samdb, setup_path("provision_schema_basedn.ldif"), {
+ "SCHEMADN": names.schemadn,
+ "ACI": aci,
+ "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb"
+ })
message("Modifying schema container")
- setup_ldb_modify(setup_dir, "provision_schema_basedn_modify.ldif", subobj, samdb)
+ setup_modify_ldif(samdb,
+ setup_path("provision_schema_basedn_modify.ldif"), {
+ "SCHEMADN": names.schemadn,
+ "NETBIOSNAME": names.netbiosname,
+ "DEFAULTSITE": names.sitename,
+ "CONFIGDN": names.configdn,
+ })
+
message("Setting up sam.ldb Samba4 schema")
- setup_add_ldif(setup_dir, "schema_samba4.ldif", subobj, samdb)
+ setup_add_ldif(samdb, setup_path("schema_samba4.ldif"),
+ {"SCHEMADN": names.schemadn })
message("Setting up sam.ldb AD schema")
- setup_add_ldif(setup_dir, "schema.ldif", subobj, samdb)
+ setup_add_ldif(samdb, setup_path("schema.ldif"),
+ {"SCHEMADN": names.schemadn})
message("Setting up sam.ldb configuration data")
- setup_add_ldif(setup_dir, "provision_configuration.ldif", subobj, samdb)
+ setup_add_ldif(samdb, setup_path("provision_configuration.ldif"), {
+ "CONFIGDN": names.configdn,
+ "NETBIOSNAME": names.netbiosname,
+ "DEFAULTSITE": names.sitename,
+ "DNSDOMAIN": names.dnsdomain,
+ "DOMAIN": names.domain,
+ "SCHEMADN": names.schemadn,
+ "DOMAINDN": names.domaindn,
+ })
message("Setting up display specifiers")
- setup_add_ldif(setup_dir, "display_specifiers.ldif", subobj, samdb)
+ setup_add_ldif(samdb, setup_path("display_specifiers.ldif"),
+ {"CONFIGDN": names.configdn})
message("Adding users container (permitted to fail)")
- setup_add_ldif(setup_dir, "provision_users_add.ldif", subobj, samdb)
+ setup_add_ldif(samdb, setup_path("provision_users_add.ldif"), {
+ "DOMAINDN": names.domaindn})
message("Modifying users container")
- setup_ldb_modify(setup_dir, "provision_users_modify.ldif", subobj, samdb)
+ setup_modify_ldif(samdb, setup_path("provision_users_modify.ldif"), {
+ "DOMAINDN": names.domaindn})
message("Adding computers container (permitted to fail)")
- setup_add_ldif(setup_dir, "provision_computers_add.ldif", subobj, samdb)
+ setup_add_ldif(samdb, setup_path("provision_computers_add.ldif"), {
+ "DOMAINDN": names.domaindn})
message("Modifying computers container")
- setup_ldb_modify(setup_dir, "provision_computers_modify.ldif", subobj, samdb)
+ setup_modify_ldif(samdb, setup_path("provision_computers_modify.ldif"), {
+ "DOMAINDN": names.domaindn})
message("Setting up sam.ldb data")
- setup_add_ldif(setup_dir, "provision.ldif", subobj, samdb)
+ setup_add_ldif(samdb, setup_path("provision.ldif"), {
+ "DOMAINDN": names.domaindn,
+ "NETBIOSNAME": names.netbiosname,
+ "DEFAULTSITE": names.sitename,
+ "CONFIGDN": names.configdn,
+ })
+
+ if fill == FILL_FULL:
+ message("Setting up sam.ldb users and groups")
+ setup_add_ldif(samdb, setup_path("provision_users.ldif"), {
+ "DOMAINDN": names.domaindn,
+ "DOMAINSID": str(domainsid),
+ "CONFIGDN": names.configdn,
+ "ADMINPASS_B64": b64encode(adminpass),
+ "KRBTGTPASS_B64": b64encode(krbtgtpass),
+ })
+
+ if serverrole == "domain controller":
+ message("Setting up self join")
+ setup_self_join(samdb, names=names, invocationid=invocationid,
+ dnspass=dnspass,
+ machinepass=machinepass,
+ domainsid=domainsid, policyguid=policyguid,
+ setup_path=setup_path)
+
+ #We want to setup the index last, as adds are faster unindexed
+ message("Setting up sam.ldb index")
+ samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
+ except:
+ samdb.transaction_cancel()
+ raise
- if blank:
- message("Setting up sam.ldb index")
- setup_add_ldif(setup_dir, "provision_index.ldif", subobj, samdb)
+ samdb.transaction_commit()
+ return samdb
+
+
+FILL_FULL = "FULL"
+FILL_NT4SYNC = "NT4SYNC"
+FILL_DRS = "DRS"
+
+def provision(setup_dir, message, session_info,
+ credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL,
+ realm=None, rootdn=None, domaindn=None, schemadn=None,
+ configdn=None, domain=None, hostname=None, hostip=None,
+ hostip6=None, domainsid=None, adminpass=None, krbtgtpass=None,
+ domainguid=None, policyguid=None, invocationid=None,
+ machinepass=None, dnspass=None, root=None, nobody=None,
+ nogroup=None, users=None, wheel=None, backup=None, aci=None,
+ serverrole=None, ldap_backend=None, ldap_backend_type=None,
+ sitename=None):
+ """Provision samba4
+
+ :note: caution, this wipes all existing data!
+ """
- message("Setting up sam.ldb rootDSE marking as syncronized")
- setup_modify_ldif(setup_dir, "provision_rootdse_modify.ldif", subobj, samdb)
+ def setup_path(file):
+ return os.path.join(setup_dir, file)
- samdb.transaction_commit()
- return
+ if domainsid is None:
+ domainsid = security.random_sid()
+ else:
+ domainsid = security.Sid(domainsid)
+
+ if policyguid is None:
+ policyguid = uuid.random()
+ if adminpass is None:
+ adminpass = misc.random_password(12)
+ if krbtgtpass is None:
+ krbtgtpass = misc.random_password(12)
+ if machinepass is None:
+ machinepass = misc.random_password(12)
+ if dnspass is None:
+ dnspass = misc.random_password(12)
+ root_uid = findnss_uid([root or "root"])
+ nobody_uid = findnss_uid([nobody or "nobody"])
+ users_gid = findnss_gid([users or "users"])
+ if wheel is None:
+ wheel_gid = findnss_gid(["wheel", "adm"])
+ else:
+ wheel_gid = findnss_gid([wheel])
+ if aci is None:
+ aci = "# no aci for local ldb"
- # message("Activate schema module")
- # setup_modify_ldif("schema_activation.ldif", info, samdb, False)
- #
- # // (hack) Reload, now we have the schema loaded.
- # commit_ok = samdb.transaction_commit()
- # if (!commit_ok) {
- # message("samdb commit failed: " + samdb.errstring() + "\n")
- # assert(commit_ok)
- # }
- # samdb.close()
- #
- # samdb = open_ldb(info, paths.samdb, False)
- #
- message("Setting up sam.ldb users and groups")
- setup_add_ldif(setup_dir, "provision_users.ldif", subobj, samdb)
+ if smbconf is None:
+ os.makedirs(os.path.join(targetdir, "etc"))
+ smbconf = os.path.join(targetdir, "etc", "smb.conf")
- setup_name_mappings(subobj, samdb)
+ # only install a new smb.conf if there isn't one there already
+ if not os.path.exists(smbconf):
+ make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole,
+ targetdir)
- message("Setting up sam.ldb index")
- setup_add_ldif(setup_dir, "provision_index.ldif", subobj, samdb)
+ lp = param.LoadParm()
+ lp.load(smbconf)
- message("Setting up sam.ldb rootDSE marking as syncronized")
- setup_modify_ldif(setup_dir, "provision_rootdse_modify.ldif", subobj, samdb)
- except:
- samdb.transaction_cancel()
- raise
+ names = guess_names(lp=lp, hostname=hostname, domain=domain,
+ dnsdomain=realm, serverrole=serverrole,
+ sitename=sitename, rootdn=rootdn, domaindn=domaindn,
+ configdn=configdn, schemadn=schemadn)
- samdb.transaction_commit()
+ paths = provision_paths_from_lp(lp, names.dnsdomain)
- message("Setting up phpLDAPadmin configuration")
- setup_file(setup_dir, "phpldapadmin-config.php", message,
- paths.phpldapadminconfig, subobj)
- message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
+ if hostip is None:
+ hostip = socket.getaddrinfo(names.hostname, None, socket.AF_INET, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
+ if hostip6 is None:
+ try:
+ hostip6 = socket.getaddrinfo(names.hostname, None, socket.AF_INET6, socket.AI_CANONNAME, socket.IPPROTO_IP)[0][-1][0]
+ except socket.gaierror:
+ pass
-def provision_dns(setup_dir, subobj, message, paths, session_info, credentials):
- """Write out a DNS zone file, from the info in the current database."""
- message("Setting up DNS zone: %s" % subobj.dnsdomain)
- # connect to the sam
- ldb = SamDB(paths.samdb, session_info=session_info, credentials=credentials,
- lp=lp)
+ if serverrole is None:
+ serverrole = lp.get("server role")
- # These values may have changed, due to an incoming SamSync,
- # or may not have been specified, so fetch them from the database
+ assert serverrole in ("domain controller", "member server", "standalone")
+ if invocationid is None and serverrole == "domain controller":
+ invocationid = uuid.random()
- res = ldb.search(Dn(ldb, subobj.domaindn), SCOPE_BASE, "objectGUID=*",
- ["objectGUID"])
- assert(len(res) == 1)
- assert(res[0]["objectGUID"] is not None)
- subobj.domainguid = res[0]["objectGUID"]
+ if not os.path.exists(paths.private_dir):
+ os.mkdir(paths.private_dir)
- subobj.host_guid = ldb.searchone(subobj.domaindn,
- "(&(objectClass=computer)(cn=%s))" % subobj.netbiosname, "objectGUID")
- assert subobj.host_guid is not None
+ ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
+
+ if ldap_backend is not None:
+ if ldap_backend == "ldapi":
+ # provision-backend will set this path suggested slapd command line / fedorads.inf
+ ldap_backend = "ldapi://" % urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
+
+ # only install a new shares config db if there is none
+ if not os.path.exists(paths.shareconf):
+ message("Setting up share.ldb")
+ share_ldb = Ldb(paths.shareconf, session_info=session_info,
+ credentials=credentials, lp=lp)
+ share_ldb.load_ldif_file_add(setup_path("share.ldif"))
- setup_file(setup_dir, "provision.zone", message, paths.dns, subobj)
+
+ message("Setting up secrets.ldb")
+ secrets_ldb = setup_secretsdb(paths.secrets, setup_path,
+ session_info=session_info,
+ credentials=credentials, lp=lp)
- message("Please install the zone located in %s into your DNS server" % paths.dns)
+ message("Setting up the registry")
+ setup_registry(paths.hklm, setup_path, session_info,
+ credentials=credentials, lp=lp)
+ message("Setting up templates db")
+ setup_templatesdb(paths.templates, setup_path, session_info=session_info,
+ credentials=credentials, lp=lp)
-def provision_ldapbase(setup_dir, subobj, message, paths):
- """Write out a DNS zone file, from the info in the current database."""
- message("Setting up LDAP base entry: %s" % subobj.domaindn)
- rdns = subobj.domaindn.split(",")
- subobj.extensibleobject = "objectClass: extensibleObject"
+ message("Setting up idmap db")
+ idmap = setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info,
+ credentials=credentials, lp=lp)
+
+ samdb = setup_samdb(paths.samdb, setup_path, session_info=session_info,
+ credentials=credentials, lp=lp, names=names,
+ message=message,
+ domainsid=domainsid,
+ aci=aci, domainguid=domainguid, policyguid=policyguid,
+ fill=samdb_fill,
+ adminpass=adminpass, krbtgtpass=krbtgtpass,
+ invocationid=invocationid,
+ machinepass=machinepass, dnspass=dnspass,
+ serverrole=serverrole, ldap_backend=ldap_backend,
+ ldap_backend_type=ldap_backend_type)
+
+ if lp.get("server role") == "domain controller":
+ policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies",
+ "{" + policyguid + "}")
+ os.makedirs(policy_path, 0755)
+ os.makedirs(os.path.join(policy_path, "Machine"), 0755)
+ os.makedirs(os.path.join(policy_path, "User"), 0755)
+ if not os.path.isdir(paths.netlogon):
+ os.makedirs(paths.netlogon, 0755)
+ secrets_ldb = Ldb(paths.secrets, session_info=session_info,
+ credentials=credentials, lp=lp)
+ secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
+ netbiosname=names.netbiosname, domainsid=domainsid,
+ keytab_path=paths.keytab, samdb_url=paths.samdb,
+ dns_keytab_path=paths.dns_keytab, dnspass=dnspass,
+ machinepass=machinepass, dnsdomain=names.dnsdomain)
+
+ if samdb_fill == FILL_FULL:
+ setup_name_mappings(samdb, idmap, str(domainsid), names.domaindn,
+ root_uid=root_uid, nobody_uid=nobody_uid,
+ users_gid=users_gid, wheel_gid=wheel_gid)
+
+ message("Setting up sam.ldb rootDSE marking as synchronized")
+ setup_modify_ldif(samdb, setup_path("provision_rootdse_modify.ldif"))
+
+ # Only make a zone file on the first DC, it should be replicated with DNS replication
+ if serverrole == "domain controller":
+ samdb = SamDB(paths.samdb, session_info=session_info,
+ credentials=credentials, lp=lp)
- subobj.rdn_dc = rdns[0][len("DC="):]
+ domainguid = samdb.searchone(basedn=domaindn, attribute="objectGUID")
+ assert isinstance(domainguid, str)
+ hostguid = samdb.searchone(basedn=domaindn, attribute="objectGUID",
+ expression="(&(objectClass=computer)(cn=%s))" % names.hostname,
+ scope=SCOPE_SUBTREE)
+ assert isinstance(hostguid, str)
+
+ create_zone_file(paths.dns, setup_path, samdb,
+ hostname=names.hostname, hostip=hostip,
+ hostip6=hostip6, dnsdomain=names.dnsdomain,
+ domaindn=names.domaindn, dnspass=dnspass, realm=names.realm,
+ domainguid=domainguid, hostguid=hostguid)
+ message("Please install the zone located in %s into your DNS server" % paths.dns)
+
+ create_phpldapadmin_config(paths.phpldapadminconfig, setup_path,
+ ldapi_url)
- setup_file(setup_dir, "provision_basedn.ldif",
- message, paths.ldap_basedn_ldif,
- subobj)
+ message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
- setup_file(setup_dir, "provision_configuration_basedn.ldif",
- message, paths.ldap_config_basedn_ldif,
- subobj)
+ message("Once the above files are installed, your server will be ready to use")
+ message("Server Type: %s" % serverrole)
+ message("Hostname: %s" % names.hostname)
+ message("NetBIOS Domain: %s" % names.domain)
+ message("DNS Domain: %s" % names.dnsdomain)
+ message("DOMAIN SID: %s" % str(domainsid))
+ message("Admin password: %s" % adminpass)
+
+ result = ProvisionResult()
+ result.domaindn = domaindn
+ result.paths = paths
+ result.lp = lp
+ result.samdb = samdb
+ return result
+
+def provision_become_dc(setup_dir=None,
+ smbconf=None, targetdir=None, realm=None,
+ rootdn=None, domaindn=None, schemadn=None, configdn=None,
+ domain=None, hostname=None, domainsid=None,
+ adminpass=None, krbtgtpass=None, domainguid=None,
+ policyguid=None, invocationid=None, machinepass=None,
+ dnspass=None, root=None, nobody=None, nogroup=None, users=None,
+ wheel=None, backup=None, aci=None, serverrole=None,
+ ldap_backend=None, ldap_backend_type=None, sitename=DEFAULTSITE):
+
+ def message(text):
+ """print a message if quiet is not set."""
+ print text
+
+ provision(setup_dir, message, system_session(), None,
+ smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS, realm=realm,
+ rootdn=rootdn, domaindn=domaindn, schemadn=schemadn, configdn=configdn,
+ domain=domain, hostname=hostname, hostip="127.0.0.1", domainsid=domainsid, machinepass=machinepass, serverrole="domain controller", sitename=sitename);
+
- setup_file(setup_dir, "provision_schema_basedn.ldif",
- message, paths.ldap_schema_basedn_ldif,
- subobj)
+def setup_db_config(setup_path, file, dbdir):
+ if not os.path.isdir(os.path.join(dbdir, "bdb-logs")):
+ os.makedirs(os.path.join(dbdir, "bdb-logs"), 0700);
+ if not os.path.isdir(os.path.join(dbdir, "tmp")):
+ os.makedirs(os.path.join(dbdir, "tmp"), 0700);
+
+ setup_file(setup_path("DB_CONFIG"), os.path.join(dbdir, "DB_CONFIG"),
+ {"LDAPDBDIR": dbdir})
+
- message("Please install the LDIF located in " + paths.ldap_basedn_ldif + ", " + paths.ldap_config_basedn_ldif + " and " + paths.ldap_schema_basedn_ldif + " into your LDAP server, and re-run with --ldap-backend=ldap://my.ldap.server")
+def provision_backend(setup_dir=None, message=None,
+ smbconf=None, targetdir=None, realm=None,
+ rootdn=None, domaindn=None, schemadn=None, configdn=None,
+ domain=None, hostname=None, adminpass=None, root=None, serverrole=None,
+ ldap_backend_type=None):
-def provision_guess(lp):
- """guess reasonably default options for provisioning."""
- subobj = ProvisionSettings(realm=lp.get("realm").upper(),
- domain=lp.get("workgroup"),
- hostname=hostname(),
- hostip=hostip())
+ def setup_path(file):
+ return os.path.join(setup_dir, file)
- assert subobj.realm is not None
- assert subobj.domain is not None
- assert subobj.hostname is not None
-
- subobj.domainsid = security.random_sid()
- subobj.invocationid = uuid.random()
- subobj.policyguid = uuid.random()
- subobj.krbtgtpass = misc.random_password(12)
- subobj.machinepass = misc.random_password(12)
- subobj.adminpass = misc.random_password(12)
- subobj.dnspass = misc.random_password(12)
- subobj.datestring = time.strftime("%Y%m%d%H")
- subobj.root = findnss(pwd.getpwnam, "root")[4]
- subobj.nobody = findnss(pwd.getpwnam, "nobody")[4]
- subobj.nogroup = findnss(grp.getgrnam, "nogroup", "nobody")[2]
- subobj.wheel = findnss(grp.getgrnam, "wheel", "root", "staff", "adm")[2]
- subobj.backup = findnss(grp.getgrnam, "backup", "wheel", "root", "staff")[2]
- subobj.users = findnss(grp.getgrnam, "users", "guest", "other", "unknown", "usr")[2]
-
- subobj.dnsdomain = subobj.realm.lower()
- subobj.dnsname = "%s.%s" % (subobj.hostname.lower(), subobj.dnsdomain)
- subobj.domaindn = "DC=" + subobj.dnsdomain.replace(".", ",DC=")
- subobj.domaindn_ldb = "users.ldb"
- subobj.rootdn = subobj.domaindn
- subobj.configdn = "CN=Configuration," + subobj.rootdn
- subobj.configdn_ldb = "configuration.ldb"
- subobj.schemadn = "CN=Schema," + subobj.configdn
- subobj.schemadn_ldb = "schema.ldb"
+ if hostname is None:
+ hostname = socket.gethostname().split(".")[0].lower()
- #Add modules to the list to activate them by default
- #beware often order is important
- #
- # Some Known ordering constraints:
- # - rootdse must be first, as it makes redirects from "" -> cn=rootdse
- # - objectclass must be before password_hash, because password_hash checks
- # that the objectclass is of type person (filled in by objectclass
- # module when expanding the objectclass list)
- # - partition must be last
- # - each partition has its own module list then
- subobj.modules_list = ["rootdse",
- "paged_results",
- "ranged_results",
- "anr",
- "server_sort",
- "extended_dn",
- "asq",
- "samldb",
- "rdn_name",
- "objectclass",
- "kludge_acl",
- "operational"]
- subobj.tdb_modules_list = [
- "subtree_rename",
- "subtree_delete",
- "linked_attributes"]
- subobj.modules_list2 = ["show_deleted",
- "partition"]
+ if root is None:
+ root = findnss(pwd.getpwnam, ["root"])[0]
- subobj.extensibleobject = "# no objectClass: extensibleObject for local ldb"
- subobj.aci = "# no aci for local ldb"
- return subobj
-
-
-def load_schema(setup_dir, subobj, samdb):
- """Load schema."""
- src = os.path.join(setup_dir, "schema.ldif")
- schema_data = open(src, 'r').read()
- src = os.path.join(setup_dir, "schema_samba4.ldif")
- schema_data += open(src, 'r').read()
- schema_data = substitute_var(schema_data, subobj.subst_vars())
- src = os.path.join(setup_dir, "provision_schema_basedn_modify.ldif")
- head_data = open(src, 'r').read()
- head_data = substitute_var(head_data, subobj.subst_vars())
- samdb.attach_schema_from_ldif(head_data, schema_data)
+ if smbconf is None:
+ os.makedirs(os.path.join(targetdir, "etc"))
+ smbconf = os.path.join(targetdir, "etc", "smb.conf")
+
+ # only install a new smb.conf if there isn't one there already
+ if not os.path.exists(smbconf):
+ make_smbconf(smbconf, setup_path, hostname, domain, realm,
+ serverrole, targetdir)
+ lp = param.LoadParm()
+ lp.load(smbconf)
-def join_domain(domain, netbios_name, join_type, creds, message):
- ctx = NetContext(creds)
- joindom = object()
- joindom.domain = domain
- joindom.join_type = join_type
- joindom.netbios_name = netbios_name
- if not ctx.JoinDomain(joindom):
- raise Exception("Domain Join failed: " + joindom.error_string)
+ names = guess_names(lp=lp, hostname=hostname, domain=domain,
+ dnsdomain=realm, serverrole=serverrole,
+ rootdn=rootdn, domaindn=domaindn, configdn=configdn,
+ schemadn=schemadn)
+ paths = provision_paths_from_lp(lp, names.dnsdomain)
-def vampire(domain, session_info, credentials, message):
- """Vampire a remote domain.
+ if not os.path.isdir(paths.ldapdir):
+ os.makedirs(paths.ldapdir)
+ schemadb_path = os.path.join(paths.ldapdir, "schema-tmp.ldb")
+ try:
+ os.unlink(schemadb_path)
+ except:
+ pass
+
+ schemadb = Ldb(schemadb_path, lp=lp)
+
+ setup_add_ldif(schemadb, setup_path("provision_schema_basedn.ldif"),
+ {"SCHEMADN": names.schemadn,
+ "ACI": "#",
+ "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb"
+ })
+ setup_modify_ldif(schemadb,
+ setup_path("provision_schema_basedn_modify.ldif"), \
+ {"SCHEMADN": names.schemadn,
+ "NETBIOSNAME": names.netbiosname,
+ "DEFAULTSITE": DEFAULTSITE,
+ "CONFIGDN": names.configdn,
+ })
+
+ setup_add_ldif(schemadb, setup_path("schema_samba4.ldif"),
+ {"SCHEMADN": names.schemadn })
+ setup_add_ldif(schemadb, setup_path("schema.ldif"),
+ {"SCHEMADN": names.schemadn})
+
+ if ldap_backend_type == "fedora-ds":
+ setup_file(setup_path("fedora-ds.inf"), paths.fedoradsinf,
+ {"ROOT": root,
+ "HOSTNAME": hostname,
+ "DNSDOMAIN": names.dnsdomain,
+ "LDAPDIR": paths.ldapdir,
+ "DOMAINDN": names.domaindn,
+ "LDAPMANAGERDN": names.ldapmanagerdn,
+ "LDAPMANAGERPASS": adminpass,
+ "SERVERPORT": ""})
+
+ setup_file(setup_path("fedora-partitions.ldif"), paths.fedoradspartitions,
+ {"CONFIGDN": names.configdn,
+ "SCHEMADN": names.schemadn,
+ })
+
+ setup_file(setup_path("fedora-partitions.ldif"), paths.fedoradspartitions,
+ {"CONFIGDN": names.configdn,
+ "SCHEMADN": names.schemadn,
+ })
+ mapping = "schema-map-fedora-ds-1.0"
+ backend_schema = "99_ad.ldif"
+ elif ldap_backend_type == "openldap":
+ attrs = ["linkID", "lDAPDisplayName"]
+ res = schemadb.search(expression="(&(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1)))(objectclass=attributeSchema))", base=names.schemadn, scope=SCOPE_SUBTREE, attrs=attrs);
+
+ memberof_config = "# Generated from schema in " + schemadb_path + "\n";
+ refint_attributes = "";
+ for i in range (0, len(res)):
+ linkid = res[i]["linkID"][0]
+ linkid = str(int(linkid) + 1)
+ expression = "(&(objectclass=attributeSchema)(linkID=" + (linkid) + "))"
+ target = schemadb.searchone(basedn=names.schemadn,
+ expression=expression,
+ attribute="lDAPDisplayName",
+ scope=SCOPE_SUBTREE);
+ if target is not None:
+ refint_attributes = refint_attributes + " " + target + " " + res[i]["lDAPDisplayName"][0];
+ memberof_config = memberof_config + """overlay memberof
+memberof-dangling error
+memberof-refint TRUE
+memberof-group-oc top
+memberof-member-ad """ + res[i]["lDAPDisplayName"][0] + """
+memberof-memberof-ad """ + target + """
+memberof-dangling-error 32
+
+""";
+
+ memberof_config = memberof_config + """
+overlay refint
+refint_attributes""" + refint_attributes + "\n";
- Session info and credentials are required for for
- access to our local database (might be remote ldap)
+ setup_file(setup_path("slapd.conf"), paths.slapdconf,
+ {"DNSDOMAIN": names.dnsdomain,
+ "LDAPDIR": paths.ldapdir,
+ "DOMAINDN": names.domaindn,
+ "CONFIGDN": names.configdn,
+ "SCHEMADN": names.schemadn,
+ "LDAPMANAGERDN": names.ldapmanagerdn,
+ "LDAPMANAGERPASS": adminpass,
+ "MEMBEROF_CONFIG": memberof_config})
+ setup_file(setup_path("modules.conf"), paths.modulesconf,
+ {"REALM": names.realm})
+
+ setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "user"))
+ setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "config"))
+ setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "schema"))
+ mapping = "schema-map-openldap-2.3"
+ backend_schema = "backend-schema.schema"
+
+
+ ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
+ message("Start slapd with: slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri)
+
+
+ schema_command = "bin/ad2oLschema --option=convert:target=" + ldap_backend_type + " -I " + setup_path(mapping) + " -H tdb://" + schemadb_path + " -O " + os.path.join(paths.ldapdir, backend_schema);
+
+ os.system(schema_command)
+
+
+
+def create_phpldapadmin_config(path, setup_path, ldapi_uri):
+ """Create a PHP LDAP admin configuration file.
+
+ :param path: Path to write the configuration to.
+ :param setup_path: Function to generate setup paths.
"""
- ctx = NetContext(credentials)
- vampire_ctx = object()
- machine_creds = credentials_init()
- machine_creds.set_domain(form.domain)
- if not machine_creds.set_machine_account():
- raise Exception("Failed to access domain join information!")
- vampire_ctx.machine_creds = machine_creds
- vampire_ctx.session_info = session_info
- if not ctx.SamSyncLdb(vampire_ctx):
- raise Exception("Migration of remote domain to Samba failed: %s " % vampire_ctx.error_string)
-
-
-def ldb_erase_partitions(subobj, message, ldb, ldapbackend):
- """Erase an ldb, removing all records."""
- assert ldb is not None
- res = ldb.search(Dn(ldb, ""), SCOPE_BASE, "(objectClass=*)",
- ["namingContexts"])
- assert len(res) == 1
- if not "namingContexts" in res[0]:
- return
- for basedn in res[0]["namingContexts"]:
- anything = "(|(objectclass=*)(dn=*))"
- previous_remaining = 1
- current_remaining = 0
-
- if ldapbackend and (basedn == subobj.domaindn):
- # Only delete objects that were created by provision
- anything = "(objectcategory=*)"
-
- k = 0
- while ++k < 10 and (previous_remaining != current_remaining):
- # and the rest
- res2 = ldb.search(Dn(ldb, basedn), SCOPE_SUBTREE, anything, ["dn"])
- previous_remaining = current_remaining
- current_remaining = len(res2)
- for msg in res2:
- try:
- ldb.delete(msg.dn)
- except LdbError, (_, text):
- message("Unable to delete %s: %s" % (msg.dn, text))
+ setup_file(setup_path("phpldapadmin-config.php"), path,
+ {"S4_LDAPI_URI": ldapi_uri})
+def create_zone_file(path, setup_path, samdb, dnsdomain, domaindn,
+ hostip, hostip6, hostname, dnspass, realm, domainguid, hostguid):
+ """Write out a DNS zone file, from the info in the current database.
+
+ :param path: Path of the new file.
+ :param setup_path": Setup path function.
+ :param samdb: SamDB object
+ :param dnsdomain: DNS Domain name
+ :param domaindn: DN of the Domain
+ :param hostip: Local IPv4 IP
+ :param hostip6: Local IPv6 IP
+ :param hostname: Local hostname
+ :param dnspass: Password for DNS
+ :param realm: Realm name
+ :param domainguid: GUID of the domain.
+ :param hostguid: GUID of the host.
+ """
+ assert isinstance(domainguid, str)
+
+ hostip6_base_line = ""
+ hostip6_host_line = ""
+
+ if hostip6 is not None:
+ hostip6_base_line = " IN AAAA " + hostip6
+ hostip6_host_line = hostname + " IN AAAA " + hostip6
+
+ setup_file(setup_path("provision.zone"), path, {
+ "DNSPASS_B64": b64encode(dnspass),
+ "HOSTNAME": hostname,
+ "DNSDOMAIN": dnsdomain,
+ "REALM": realm,
+ "HOSTIP": hostip,
+ "DOMAINGUID": domainguid,
+ "DATESTRING": time.strftime("%Y%m%d%H"),
+ "DEFAULTSITE": DEFAULTSITE,
+ "HOSTGUID": hostguid,
+ "HOSTIP6_BASE_LINE": hostip6_base_line,
+ "HOSTIP6_HOST_LINE": hostip6_host_line,
+ })
+
+def load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename):
+ """Load schema for the SamDB.
+
+ :param samdb: Load a schema into a SamDB.
+ :param setup_path: Setup path function.
+ :param schemadn: DN of the schema
+ :param netbiosname: NetBIOS name of the host.
+ :param configdn: DN of the configuration
+ """
+ schema_data = open(setup_path("schema.ldif"), 'r').read()
+ schema_data += open(setup_path("schema_samba4.ldif"), 'r').read()
+ schema_data = substitute_var(schema_data, {"SCHEMADN": schemadn})
+ head_data = open(setup_path("provision_schema_basedn_modify.ldif"), 'r').read()
+ head_data = substitute_var(head_data, {
+ "SCHEMADN": schemadn,
+ "NETBIOSNAME": netbiosname,
+ "CONFIGDN": configdn,
+ "DEFAULTSITE":sitename
+ })
+ samdb.attach_schema_from_ldif(head_data, schema_data)
+
git.samba.org / kai / samba.git / blobdiff