summaryrefslogtreecommitdiff
path: root/python
diff options
context:
space:
mode:
Diffstat (limited to 'python')
-rw-r--r--python/samba/join.py2
-rw-r--r--python/samba/netcmd/domain.py9
-rw-r--r--python/samba/provision/__init__.py12
-rw-r--r--python/samba/provision/common.py5
-rw-r--r--python/samba/provision/sambadns.py90
-rw-r--r--python/samba/upgrade.py3
-rw-r--r--python/samba/upgradehelpers.py3
7 files changed, 80 insertions, 44 deletions
diff --git a/python/samba/join.py b/python/samba/join.py
index 1785ab3e88..9cac8f5ed2 100644
--- a/python/samba/join.py
+++ b/python/samba/join.py
@@ -24,6 +24,7 @@ from samba import gensec, Ldb, drs_utils
import ldb, samba, sys, uuid
from samba.ndr import ndr_pack
from samba.dcerpc import security, drsuapi, misc, nbt, lsa, drsblobs
+from samba.dsdb import DS_DOMAIN_FUNCTION_2003
from samba.credentials import Credentials, DONT_USE_KERBEROS
from samba.provision import secretsdb_self_join, provision, provision_fill, FILL_DRS, FILL_SUBDOMAIN
from samba.provision.common import setup_path
@@ -765,6 +766,7 @@ class dc_join(object):
presult = provision_fill(ctx.local_samdb, secrets_ldb,
ctx.logger, ctx.names, ctx.paths, domainsid=security.dom_sid(ctx.domsid),
domainguid=domguid,
+ dom_for_fun_level=DS_DOMAIN_FUNCTION_2003,
targetdir=ctx.targetdir, samdb_fill=FILL_SUBDOMAIN,
machinepass=ctx.acct_pass, serverrole="active directory domain controller",
lp=ctx.lp, hostip=ctx.names.hostip, hostip6=ctx.names.hostip6,
diff --git a/python/samba/netcmd/domain.py b/python/samba/netcmd/domain.py
index 217b5369b7..9824da1610 100644
--- a/python/samba/netcmd/domain.py
+++ b/python/samba/netcmd/domain.py
@@ -67,11 +67,14 @@ from samba.dsdb import (
from samba.credentials import DONT_USE_KERBEROS
from samba.provision import (
provision,
+ ProvisioningError
+ )
+
+from samba.provision.common import (
FILL_FULL,
FILL_NT4SYNC,
- FILL_DRS,
- ProvisioningError,
- )
+ FILL_DRS
+)
def get_testparm_var(testparm, smbconf, varname):
cmd = "%s -s -l --parameter-name='%s' %s 2>/dev/null" % (testparm, varname, smbconf)
diff --git a/python/samba/provision/__init__.py b/python/samba/provision/__init__.py
index 698df94f34..d8f353f54a 100644
--- a/python/samba/provision/__init__.py
+++ b/python/samba/provision/__init__.py
@@ -101,7 +101,11 @@ from samba.provision.common import (
setup_path,
setup_add_ldif,
setup_modify_ldif,
- )
+ FILL_FULL,
+ FILL_SUBDOMAIN,
+ FILL_NT4SYNC,
+ FILL_DRS
+)
from samba.provision.sambadns import (
get_dnsadmins_sid,
setup_ad_dns,
@@ -1462,10 +1466,6 @@ def fill_samdb(samdb, lp, names, logger, domainsid, domainguid, policyguid,
return samdb
-FILL_FULL = "FULL"
-FILL_SUBDOMAIN = "SUBDOMAIN"
-FILL_NT4SYNC = "NT4SYNC"
-FILL_DRS = "DRS"
SYSVOL_ACL = "O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)"
POLICIES_ACL = "O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001301bf;;;PA)"
SYSVOL_SERVICE="sysvol"
@@ -1795,7 +1795,7 @@ def provision_fill(samdb, secrets_ldb, logger, names, paths,
setup_ad_dns(samdb, secrets_ldb, domainsid, names, paths, lp, logger,
hostip=hostip, hostip6=hostip6, dns_backend=dns_backend,
dnspass=dnspass, os_level=dom_for_fun_level,
- targetdir=targetdir, site=DEFAULTSITE)
+ targetdir=targetdir, site=DEFAULTSITE, fill_level=samdb_fill)
domainguid = samdb.searchone(basedn=samdb.get_default_basedn(),
attribute="objectGUID")
diff --git a/python/samba/provision/common.py b/python/samba/provision/common.py
index f96704bcce..03e2278951 100644
--- a/python/samba/provision/common.py
+++ b/python/samba/provision/common.py
@@ -31,6 +31,11 @@ import os
from samba import read_and_sub_file
from samba.param import setup_dir
+FILL_FULL = "FULL"
+FILL_SUBDOMAIN = "SUBDOMAIN"
+FILL_NT4SYNC = "NT4SYNC"
+FILL_DRS = "DRS"
+
def setup_path(file):
"""Return an absolute path to the provision tempate file specified by file"""
diff --git a/python/samba/provision/sambadns.py b/python/samba/provision/sambadns.py
index 46cfc89f4c..5fd3805786 100644
--- a/python/samba/provision/sambadns.py
+++ b/python/samba/provision/sambadns.py
@@ -48,7 +48,11 @@ from samba.provision.common import (
setup_path,
setup_add_ldif,
setup_modify_ldif,
- setup_ldb
+ setup_ldb,
+ FILL_FULL,
+ FILL_SUBDOMAIN,
+ FILL_NT4SYNC,
+ FILL_DRS,
)
@@ -230,15 +234,20 @@ class AgingEnabledTimeProperty(dnsp.DnsProperty):
def setup_dns_partitions(samdb, domainsid, domaindn, forestdn, configdn,
- serverdn):
+ serverdn, fill_level):
domainzone_dn = "DC=DomainDnsZones,%s" % domaindn
forestzone_dn = "DC=ForestDnsZones,%s" % forestdn
descriptor = get_dns_partition_descriptor(domainsid)
+
setup_add_ldif(samdb, setup_path("provision_dnszones_partitions.ldif"), {
- "DOMAINZONE_DN": domainzone_dn,
- "FORESTZONE_DN": forestzone_dn,
+ "ZONE_DN": domainzone_dn,
"SECDESC" : b64encode(descriptor)
})
+ if fill_level != FILL_SUBDOMAIN:
+ setup_add_ldif(samdb, setup_path("provision_dnszones_partitions.ldif"), {
+ "ZONE_DN": forestzone_dn,
+ "SECDESC" : b64encode(descriptor)
+ })
domainzone_guid = get_domainguid(samdb, domainzone_dn)
forestzone_guid = get_domainguid(samdb, forestzone_dn)
@@ -252,25 +261,36 @@ def setup_dns_partitions(samdb, domainsid, domaindn, forestdn, configdn,
protected1_desc = get_domain_delete_protected1_descriptor(domainsid)
protected2_desc = get_domain_delete_protected2_descriptor(domainsid)
setup_add_ldif(samdb, setup_path("provision_dnszones_add.ldif"), {
- "DOMAINZONE_DN": domainzone_dn,
- "FORESTZONE_DN": forestzone_dn,
- "DOMAINZONE_GUID": domainzone_guid,
- "FORESTZONE_GUID": forestzone_guid,
- "DOMAINZONE_DNS": domainzone_dns,
- "FORESTZONE_DNS": forestzone_dns,
+ "ZONE_DN": domainzone_dn,
+ "ZONE_GUID": domainzone_guid,
+ "ZONE_DNS": domainzone_dns,
"CONFIGDN": configdn,
"SERVERDN": serverdn,
"LOSTANDFOUND_DESCRIPTOR": b64encode(protected2_desc),
"INFRASTRUCTURE_DESCRIPTOR": b64encode(protected1_desc),
})
-
setup_modify_ldif(samdb, setup_path("provision_dnszones_modify.ldif"), {
"CONFIGDN": configdn,
"SERVERDN": serverdn,
- "DOMAINZONE_DN": domainzone_dn,
- "FORESTZONE_DN": forestzone_dn,
+ "ZONE_DN": domainzone_dn,
})
+ if fill_level != FILL_SUBDOMAIN:
+ setup_add_ldif(samdb, setup_path("provision_dnszones_add.ldif"), {
+ "ZONE_DN": forestzone_dn,
+ "ZONE_GUID": forestzone_guid,
+ "ZONE_DNS": forestzone_dns,
+ "CONFIGDN": configdn,
+ "SERVERDN": serverdn,
+ "LOSTANDFOUND_DESCRIPTOR": b64encode(protected2_desc),
+ "INFRASTRUCTURE_DESCRIPTOR": b64encode(protected1_desc),
+ })
+ setup_modify_ldif(samdb, setup_path("provision_dnszones_modify.ldif"), {
+ "CONFIGDN": configdn,
+ "SERVERDN": serverdn,
+ "ZONE_DN": forestzone_dn,
+ })
+
def add_dns_accounts(samdb, domaindn):
setup_add_ldif(samdb, setup_path("provision_dns_accounts_add.ldif"), {
@@ -928,21 +948,23 @@ def fill_dns_data_legacy(samdb, domainsid, forestdn, dnsdomain, site, hostname,
def create_dns_partitions(samdb, domainsid, names, domaindn, forestdn,
- dnsadmins_sid):
+ dnsadmins_sid, fill_level):
# Set up additional partitions (DomainDnsZones, ForstDnsZones)
setup_dns_partitions(samdb, domainsid, domaindn, forestdn,
- names.configdn, names.serverdn)
+ names.configdn, names.serverdn, fill_level)
# Set up MicrosoftDNS containers
add_dns_container(samdb, domaindn, "DC=DomainDnsZones", domainsid,
dnsadmins_sid)
- add_dns_container(samdb, forestdn, "DC=ForestDnsZones", domainsid,
- dnsadmins_sid, forest=True)
+ if fill_level != FILL_SUBDOMAIN:
+ add_dns_container(samdb, forestdn, "DC=ForestDnsZones", domainsid,
+ dnsadmins_sid, forest=True)
def fill_dns_data_partitions(samdb, domainsid, site, domaindn, forestdn,
- dnsdomain, dnsforest, hostname, hostip, hostip6,
- domainguid, ntdsguid, dnsadmins_sid, autofill=True):
+ dnsdomain, dnsforest, hostname, hostip, hostip6,
+ domainguid, ntdsguid, dnsadmins_sid, autofill=True,
+ fill_level=FILL_FULL):
"""Fill data in various AD partitions
:param samdb: LDB object connected to sam.ldb file
@@ -974,20 +996,21 @@ def fill_dns_data_partitions(samdb, domainsid, site, domaindn, forestdn,
add_dc_domain_records(samdb, domaindn, "DC=DomainDnsZones", site,
dnsdomain, hostname, hostip, hostip6)
- ##### Set up DC=ForestDnsZones,<DOMAINDN>
- # Add _msdcs record
- add_msdcs_record(samdb, forestdn, "DC=ForestDnsZones", dnsforest)
+ if fill_level != FILL_SUBDOMAIN:
+ ##### Set up DC=ForestDnsZones,<FORESTDN>
+ # Add _msdcs record
+ add_msdcs_record(samdb, forestdn, "DC=ForestDnsZones", dnsforest)
- # Add DNS records for a DC in forest
- if autofill:
- add_dc_msdcs_records(samdb, forestdn, "DC=ForestDnsZones", site,
- dnsforest, hostname, hostip, hostip6,
- domainguid, ntdsguid)
+ # Add DNS records for a DC in forest
+ if autofill:
+ add_dc_msdcs_records(samdb, forestdn, "DC=ForestDnsZones", site,
+ dnsforest, hostname, hostip, hostip6,
+ domainguid, ntdsguid)
def setup_ad_dns(samdb, secretsdb, domainsid, names, paths, lp, logger,
dns_backend, os_level, site, dnspass=None, hostip=None, hostip6=None,
- targetdir=None):
+ targetdir=None, fill_level=FILL_FULL):
"""Provision DNS information (assuming GC role)
:param samdb: LDB object connected to sam.ldb file
@@ -1062,18 +1085,19 @@ def setup_ad_dns(samdb, secretsdb, domainsid, names, paths, lp, logger,
# Create DNS partitions
logger.info("Creating DomainDnsZones and ForestDnsZones partitions")
create_dns_partitions(samdb, domainsid, names, domaindn, forestdn,
- dnsadmins_sid)
+ dnsadmins_sid, fill_level)
# Populating dns partitions
logger.info("Populating DomainDnsZones and ForestDnsZones partitions")
fill_dns_data_partitions(samdb, domainsid, site, domaindn, forestdn,
- dnsdomain, dnsforest, hostname, hostip, hostip6,
- domainguid, names.ntdsguid, dnsadmins_sid)
+ dnsdomain, dnsforest, hostname, hostip, hostip6,
+ domainguid, names.ntdsguid, dnsadmins_sid,
+ fill_level=fill_level)
if dns_backend.startswith("BIND9_"):
setup_bind9_dns(samdb, secretsdb, domainsid, names, paths, lp, logger,
- dns_backend, os_level, site=site, dnspass=dnspass, hostip=hostip,
- hostip6=hostip6, targetdir=targetdir)
+ dns_backend, os_level, site=site, dnspass=dnspass, hostip=hostip,
+ hostip6=hostip6, targetdir=targetdir)
def setup_bind9_dns(samdb, secretsdb, domainsid, names, paths, lp, logger,
diff --git a/python/samba/upgrade.py b/python/samba/upgrade.py
index 6b55ed76a7..ff5990c667 100644
--- a/python/samba/upgrade.py
+++ b/python/samba/upgrade.py
@@ -26,7 +26,8 @@ import pwd
from samba import Ldb, registry
from samba.param import LoadParm
-from samba.provision import provision, FILL_FULL, ProvisioningError, setsysvolacl
+from samba.provision import provision, ProvisioningError, setsysvolacl
+from samba.provision.common import FILL_FULL
from samba.samba3 import passdb
from samba.samba3 import param as s3param
from samba.dcerpc import lsa, samr, security
diff --git a/python/samba/upgradehelpers.py b/python/samba/upgradehelpers.py
index b6750eb430..d2b0a1872f 100644
--- a/python/samba/upgradehelpers.py
+++ b/python/samba/upgradehelpers.py
@@ -31,8 +31,9 @@ from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE
import ldb
from samba.provision import (provision_paths_from_lp,
getpolicypath, set_gpos_acl, create_gpo_struct,
- FILL_FULL, provision, ProvisioningError,
+ provision, ProvisioningError,
setsysvolacl, secretsdb_self_join)
+from samba.provision.common import FILL_FULL
from samba.dcerpc import xattr, drsblobs, security
from samba.dcerpc.misc import SEC_CHAN_BDC
from samba.ndr import ndr_unpack
generated by cgit (git 2.34.1) at 2024-11-22 03:46:08 +0000