"""Functions for setting up a Samba configuration."""
+__docformat__ = "restructuredText"
+
DEFAULTSITE = "Default-First-Site-Name"
class InvalidNetbiosName(Exception):
self.domain = None
self.hostname = None
self.sitename = None
+ self.smbconf = None
class ProvisionResult:
def __init__(self):
paths.secrets = os.path.join(paths.private_dir, lp.get("secrets database") or "secrets.ldb")
paths.templates = os.path.join(paths.private_dir, "templates.ldb")
paths.dns = os.path.join(paths.private_dir, dnsdomain + ".zone")
+ paths.namedconf = os.path.join(paths.private_dir, "named.conf")
+ paths.krb5conf = os.path.join(paths.private_dir, "krb5.conf")
paths.winsdb = os.path.join(paths.private_dir, "wins.ldb")
paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
paths.phpldapadminconfig = os.path.join(paths.private_dir,
paths.netlogon = lp.get("path", "netlogon")
+ paths.smbconf = lp.configfile()
+
return paths
-def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None,
- serverrole=None, rootdn=None, domaindn=None, configdn=None,
- schemadn=None, sitename=None):
+def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None, serverrole=None,
+ rootdn=None, domaindn=None, configdn=None, schemadn=None, serverdn=None,
+ sitename=None):
+ """Guess configuration settings to use."""
if hostname is None:
hostname = socket.gethostname().split(".")[0].lower()
realm = dnsdomain.upper()
if lp.get("realm").upper() != realm:
- raise Exception("realm '%s' must match chosen realm '%s'" %
- (lp.get("realm"), realm))
+ raise Exception("realm '%s' in %s must match chosen realm '%s'" %
+ (lp.get("realm"), lp.configfile(), realm))
dnsdomain = dnsdomain.lower()
names.netbiosname = netbiosname
names.hostname = hostname
names.sitename = sitename
+ names.serverdn = "CN=%s,CN=Servers,CN=%s,CN=Sites,%s" % (netbiosname, sitename, configdn)
return names
})
+
def setup_name_mappings(samdb, idmap, sid, domaindn, root_uid, nobody_uid,
users_gid, wheel_gid):
"""setup reasonable name mappings for sam names to unix names.
samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
message("Setting up sam.ldb rootDSE")
- setup_samdb_rootdse(samdb, setup_path, names.schemadn, names.domaindn,
- names.hostname, names.dnsdomain, names.realm,
- names.rootdn, names.configdn, names.netbiosname,
- names.sitename)
+ setup_samdb_rootdse(samdb, setup_path, names)
if erase:
message("Erasing data from partitions")
return idmap_ldb
-def setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname,
- dnsdomain, realm, rootdn, configdn, netbiosname,
- sitename):
+def setup_samdb_rootdse(samdb, setup_path, names):
"""Setup the SamDB rootdse.
:param samdb: Sam Database handle
:param setup_path: Obtain setup path
"""
setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
- "SCHEMADN": schemadn,
- "NETBIOSNAME": netbiosname,
- "DNSDOMAIN": dnsdomain,
- "DEFAULTSITE": sitename,
- "REALM": realm,
- "DNSNAME": "%s.%s" % (hostname, dnsdomain),
- "DOMAINDN": domaindn,
- "ROOTDN": rootdn,
- "CONFIGDN": configdn,
- "VERSION": samba.version(),
+ "SCHEMADN": names.schemadn,
+ "NETBIOSNAME": names.netbiosname,
+ "DNSDOMAIN": names.dnsdomain,
+ "REALM": names.realm,
+ "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
+ "DOMAINDN": names.domaindn,
+ "ROOTDN": names.rootdn,
+ "CONFIGDN": names.configdn,
+ "SERVERDN": names.serverdn,
})
domainsid, invocationid, setup_path,
policyguid):
"""Join a host to its own domain."""
+ assert isinstance(invocationid, str)
setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), {
"CONFIGDN": names.configdn,
"SCHEMADN": names.schemadn,
"DOMAINDN": names.domaindn,
+ "SERVERDN": names.serverdn,
"INVOCATIONID": invocationid,
"NETBIOSNAME": names.netbiosname,
"DEFAULTSITE": names.sitename,
return samdb
message("Pre-loading the Samba 4 and AD schema")
- samdb = SamDB(path, session_info=session_info,
- credentials=credentials, lp=lp)
samdb.set_domain_sid(domainsid)
if serverrole == "domain controller":
samdb.set_invocation_id(invocationid)
"NETBIOSNAME": names.netbiosname,
"DEFAULTSITE": names.sitename,
"CONFIGDN": names.configdn,
+ "SERVERDN": names.serverdn,
"POLICYGUID": policyguid,
"DOMAINDN": names.domaindn,
"DOMAINGUID_MOD": domainguid_mod,
"NETBIOSNAME": names.netbiosname,
"DEFAULTSITE": names.sitename,
"CONFIGDN": names.configdn,
+ "SERVERDN": names.serverdn
})
message("Setting up sam.ldb Samba4 schema")
"DOMAIN": names.domain,
"SCHEMADN": names.schemadn,
"DOMAINDN": names.domaindn,
+ "SERVERDN": names.serverdn
})
message("Setting up display specifiers")
"NETBIOSNAME": names.netbiosname,
"DEFAULTSITE": names.sitename,
"CONFIGDN": names.configdn,
+ "SERVERDN": names.serverdn
})
if fill == FILL_FULL:
FILL_DRS = "DRS"
def provision(setup_dir, message, session_info,
- credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL,
- realm=None, rootdn=None, domaindn=None, schemadn=None,
- configdn=None, domain=None, hostname=None, hostip=None,
- hostip6=None, domainsid=None, adminpass=None, krbtgtpass=None,
- domainguid=None, policyguid=None, invocationid=None,
- machinepass=None, dnspass=None, root=None, nobody=None,
- nogroup=None, users=None, wheel=None, backup=None, aci=None,
- serverrole=None, ldap_backend=None, ldap_backend_type=None,
- sitename=None):
+ credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL, realm=None,
+ rootdn=None, domaindn=None, schemadn=None, configdn=None,
+ serverdn=None,
+ domain=None, hostname=None, hostip=None, hostip6=None,
+ domainsid=None, adminpass=None, krbtgtpass=None, domainguid=None,
+ policyguid=None, invocationid=None, machinepass=None,
+ dnspass=None, root=None, nobody=None, nogroup=None, users=None,
+ wheel=None, backup=None, aci=None, serverrole=None,
+ ldap_backend=None, ldap_backend_type=None, sitename=None):
"""Provision samba4
:note: caution, this wipes all existing data!
domainsid = security.Sid(domainsid)
if policyguid is None:
- policyguid = uuid.random()
+ policyguid = str(uuid.uuid4())
if adminpass is None:
adminpass = misc.random_password(12)
if krbtgtpass is None:
lp.load(smbconf)
names = guess_names(lp=lp, hostname=hostname, domain=domain,
- dnsdomain=realm, serverrole=serverrole,
- sitename=sitename, rootdn=rootdn, domaindn=domaindn,
- configdn=configdn, schemadn=schemadn)
+ dnsdomain=realm, serverrole=serverrole, sitename=sitename,
+ rootdn=rootdn, domaindn=domaindn, configdn=configdn, schemadn=schemadn,
+ serverdn=serverdn)
paths = provision_paths_from_lp(lp, names.dnsdomain)
assert serverrole in ("domain controller", "member server", "standalone")
if invocationid is None and serverrole == "domain controller":
- invocationid = uuid.random()
+ invocationid = str(uuid.uuid4())
if not os.path.exists(paths.private_dir):
os.mkdir(paths.private_dir)
ldap_backend_type=ldap_backend_type)
if lp.get("server role") == "domain controller":
- policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies",
- "{" + policyguid + "}")
- os.makedirs(policy_path, 0755)
- os.makedirs(os.path.join(policy_path, "Machine"), 0755)
- os.makedirs(os.path.join(policy_path, "User"), 0755)
- if not os.path.isdir(paths.netlogon):
+ if paths.netlogon is None:
+ message("Existing smb.conf does not have a [netlogon] share, but you are configuring a DC.")
+ message("Please either remove %s or see the template at %s" %
+ ( paths.smbconf, setup_path("provision.smb.conf.dc")))
+ assert(paths.netlogon is not None)
+
+ if paths.sysvol is None:
+ message("Existing smb.conf does not have a [sysvol] share, but you are configuring a DC.")
+ message("Please either remove %s or see the template at %s" %
+ (paths.smbconf, setup_path("provision.smb.conf.dc")))
+ assert(paths.sysvol is not None)
+
+ policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies",
+ "{" + policyguid + "}")
+ os.makedirs(policy_path, 0755)
+ os.makedirs(os.path.join(policy_path, "Machine"), 0755)
+ os.makedirs(os.path.join(policy_path, "User"), 0755)
+ if not os.path.isdir(paths.netlogon):
os.makedirs(paths.netlogon, 0755)
- secrets_ldb = Ldb(paths.secrets, session_info=session_info,
- credentials=credentials, lp=lp)
- secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
- netbiosname=names.netbiosname, domainsid=domainsid,
- keytab_path=paths.keytab, samdb_url=paths.samdb,
- dns_keytab_path=paths.dns_keytab, dnspass=dnspass,
- machinepass=machinepass, dnsdomain=names.dnsdomain)
if samdb_fill == FILL_FULL:
setup_name_mappings(samdb, idmap, str(domainsid), names.domaindn,
# Only make a zone file on the first DC, it should be replicated with DNS replication
if serverrole == "domain controller":
+ secrets_ldb = Ldb(paths.secrets, session_info=session_info,
+ credentials=credentials, lp=lp)
+ secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
+ netbiosname=names.netbiosname, domainsid=domainsid,
+ keytab_path=paths.keytab, samdb_url=paths.samdb,
+ dns_keytab_path=paths.dns_keytab, dnspass=dnspass,
+ machinepass=machinepass, dnsdomain=names.dnsdomain)
+
samdb = SamDB(paths.samdb, session_info=session_info,
credentials=credentials, lp=lp)
expression="(&(objectClass=computer)(cn=%s))" % names.hostname,
scope=SCOPE_SUBTREE)
assert isinstance(hostguid, str)
-
- create_zone_file(paths.dns, setup_path, samdb,
- hostname=names.hostname, hostip=hostip,
- hostip6=hostip6, dnsdomain=names.dnsdomain,
- domaindn=names.domaindn, dnspass=dnspass, realm=names.realm,
+
+ create_zone_file(paths.dns, setup_path, dnsdomain=names.dnsdomain,
+ domaindn=names.domaindn, hostip=hostip,
+ hostip6=hostip6, hostname=names.hostname,
+ dnspass=dnspass, realm=names.realm,
domainguid=domainguid, hostguid=hostguid)
message("Please install the zone located in %s into your DNS server" % paths.dns)
-
+
+ create_named_conf(paths.namedconf, setup_path, realm=names.realm,
+ dnsdomain=names.dnsdomain, private_dir=paths.private_dir,
+ keytab_name=paths.dns_keytab)
+ message("See %s for example configuration statements for secure GSS-TSIG updates" % paths.namedconf)
+
+ create_krb5_conf(paths.krb5conf, setup_path, dnsdomain=names.dnsdomain,
+ hostname=names.hostname, realm=names.realm)
+ message("A Kerberos configuration suitable for Samba 4 has been generated at %s" % paths.krb5conf)
+
create_phpldapadmin_config(paths.phpldapadminconfig, setup_path,
ldapi_url)
message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
- message("Once the above files are installed, your server will be ready to use")
- message("Server Type: %s" % serverrole)
+ message("Once the above files are installed, your Samba4 server will be ready to use")
+ message("Server Role: %s" % serverrole)
message("Hostname: %s" % names.hostname)
message("NetBIOS Domain: %s" % names.domain)
message("DNS Domain: %s" % names.dnsdomain)
result.samdb = samdb
return result
+
def provision_become_dc(setup_dir=None,
smbconf=None, targetdir=None, realm=None,
rootdn=None, domaindn=None, schemadn=None, configdn=None,
+ serverdn=None,
domain=None, hostname=None, domainsid=None,
adminpass=None, krbtgtpass=None, domainguid=None,
policyguid=None, invocationid=None, machinepass=None,
dnspass=None, root=None, nobody=None, nogroup=None, users=None,
wheel=None, backup=None, aci=None, serverrole=None,
- ldap_backend=None, ldap_backend_type=None, sitename=DEFAULTSITE):
+ ldap_backend=None, ldap_backend_type=None, sitename=None):
def message(text):
"""print a message if quiet is not set."""
print text
- provision(setup_dir, message, system_session(), None,
+ return provision(setup_dir, message, system_session(), None,
smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS, realm=realm,
- rootdn=rootdn, domaindn=domaindn, schemadn=schemadn, configdn=configdn,
+ rootdn=rootdn, domaindn=domaindn, schemadn=schemadn, configdn=configdn, serverdn=serverdn,
domain=domain, hostname=hostname, hostip="127.0.0.1", domainsid=domainsid, machinepass=machinepass, serverrole="domain controller", sitename=sitename);
-def setup_db_config(setup_path, file, dbdir):
+def setup_db_config(setup_path, dbdir):
+ """Setup a Berkeley database.
+
+ :param setup_path: Setup path function.
+ :param dbdir: Database directory."""
if not os.path.isdir(os.path.join(dbdir, "bdb-logs")):
os.makedirs(os.path.join(dbdir, "bdb-logs"), 0700);
if not os.path.isdir(os.path.join(dbdir, "tmp")):
smbconf=None, targetdir=None, realm=None,
rootdn=None, domaindn=None, schemadn=None, configdn=None,
domain=None, hostname=None, adminpass=None, root=None, serverrole=None,
- ldap_backend_type=None):
+ ldap_backend_type=None, ldap_backend_port=None):
def setup_path(file):
return os.path.join(setup_dir, file)
"NETBIOSNAME": names.netbiosname,
"DEFAULTSITE": DEFAULTSITE,
"CONFIGDN": names.configdn,
+ "SERVERDN": names.serverdn
})
setup_add_ldif(schemadb, setup_path("schema_samba4.ldif"),
{"SCHEMADN": names.schemadn})
if ldap_backend_type == "fedora-ds":
- setup_file(setup_path("fedora-ds.inf"), paths.fedoradsinf,
+ if ldap_backend_port is not None:
+ serverport = "ServerPort=%d" % ldap_backend_port
+ else:
+ serverport = ""
+
+ setup_file(setup_path("fedorads.inf"), paths.fedoradsinf,
{"ROOT": root,
"HOSTNAME": hostname,
"DNSDOMAIN": names.dnsdomain,
"DOMAINDN": names.domaindn,
"LDAPMANAGERDN": names.ldapmanagerdn,
"LDAPMANAGERPASS": adminpass,
- "SERVERPORT": ""})
+ "SERVERPORT": serverport})
- setup_file(setup_path("fedora-partitions.ldif"), paths.fedoradspartitions,
+ setup_file(setup_path("fedorads-partitions.ldif"), paths.fedoradspartitions,
{"CONFIGDN": names.configdn,
"SCHEMADN": names.schemadn,
})
- setup_file(setup_path("fedora-partitions.ldif"), paths.fedoradspartitions,
- {"CONFIGDN": names.configdn,
- "SCHEMADN": names.schemadn,
- })
mapping = "schema-map-fedora-ds-1.0"
backend_schema = "99_ad.ldif"
+
+ slapdcommand="Initailise Fedora DS with: setup-ds.pl --file=%s" % paths.fedoradsinf
+
elif ldap_backend_type == "openldap":
attrs = ["linkID", "lDAPDisplayName"]
res = schemadb.search(expression="(&(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1)))(objectclass=attributeSchema))", base=names.schemadn, scope=SCOPE_SUBTREE, attrs=attrs);
setup_file(setup_path("modules.conf"), paths.modulesconf,
{"REALM": names.realm})
- setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "user"))
- setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "config"))
- setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "schema"))
- mapping = "schema-map-openldap-2.3"
- backend_schema = "backend-schema.schema"
-
-
- ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
- message("Start slapd with: slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri)
-
+ setup_db_config(setup_path, os.path.join(paths.ldapdir, os.path.join("db", "user")))
+ setup_db_config(setup_path, os.path.join(paths.ldapdir, os.path.join("db", "config")))
+ setup_db_config(setup_path, os.path.join(paths.ldapdir, os.path.join("db", "schema")))
+ mapping = "schema-map-openldap-2.3"
+ backend_schema = "backend-schema.schema"
+
+ ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
+ if ldap_backend_port is not None:
+ server_port_string = " -h ldap://0.0.0.0:%d" % ldap_backend_port
+ else:
+ server_port_string = ""
+ slapdcommand="Start slapd with: slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri + server_port_string
schema_command = "bin/ad2oLschema --option=convert:target=" + ldap_backend_type + " -I " + setup_path(mapping) + " -H tdb://" + schemadb_path + " -O " + os.path.join(paths.ldapdir, backend_schema);
os.system(schema_command)
+ message("Your %s Backend for Samba4 is now configured, and is ready to be started" % ( ldap_backend_type) )
+ message("Server Role: %s" % serverrole)
+ message("Hostname: %s" % names.hostname)
+ message("DNS Domain: %s" % names.dnsdomain)
+ message("Base DN: %s" % names.domaindn)
+ message("LDAP admin DN: %s" % names.ldapmanagerdn)
+ message("LDAP admin password: %s" % adminpass)
+ message(slapdcommand)
+
def create_phpldapadmin_config(path, setup_path, ldapi_uri):
"""Create a PHP LDAP admin configuration file.
{"S4_LDAPI_URI": ldapi_uri})
-def create_zone_file(path, setup_path, samdb, dnsdomain, domaindn,
- hostip, hostip6, hostname, dnspass, realm, domainguid, hostguid):
+def create_zone_file(path, setup_path, dnsdomain, domaindn,
+ hostip, hostip6, hostname, dnspass, realm, domainguid, hostguid):
"""Write out a DNS zone file, from the info in the current database.
-
- :param path: Path of the new file.
- :param setup_path": Setup path function.
- :param samdb: SamDB object
+
+ :param path: Path of the new zone file.
+ :param setup_path: Setup path function.
:param dnsdomain: DNS Domain name
:param domaindn: DN of the Domain
:param hostip: Local IPv4 IP
"HOSTIP6_HOST_LINE": hostip6_host_line,
})
+def create_named_conf(path, setup_path, realm, dnsdomain,
+ private_dir, keytab_name):
+ """Write out a file containing zone statements suitable for inclusion in a
+ named.conf file (including GSS-TSIG configuration).
+
+ :param path: Path of the new named.conf file.
+ :param setup_path: Setup path function.
+ :param realm: Realm name
+ :param dnsdomain: DNS Domain name
+ :param private_dir: Path to private directory
+ :param keytab_name: File name of DNS keytab file
+ """
+
+ setup_file(setup_path("named.conf"), path, {
+ "DNSDOMAIN": dnsdomain,
+ "REALM": realm,
+ "REALM_WC": "*." + ".".join(realm.split(".")[1:]),
+ "DNS_KEYTAB": keytab_name,
+ "DNS_KEYTAB_ABS": os.path.join(private_dir, keytab_name),
+ })
+
+def create_krb5_conf(path, setup_path, dnsdomain, hostname, realm):
+ """Write out a file containing zone statements suitable for inclusion in a
+ named.conf file (including GSS-TSIG configuration).
+
+ :param path: Path of the new named.conf file.
+ :param setup_path: Setup path function.
+ :param dnsdomain: DNS Domain name
+ :param hostname: Local hostname
+ :param realm: Realm name
+ """
+
+ setup_file(setup_path("krb5.conf"), path, {
+ "DNSDOMAIN": dnsdomain,
+ "HOSTNAME": hostname,
+ "REALM": realm,
+ })
+
def load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename):
"""Load schema for the SamDB.
git.samba.org / sfrench / samba-autobuild / .git / blobdiff