diff options
Diffstat (limited to 'source3/utils/pdbedit.c')
-rw-r--r-- | source3/utils/pdbedit.c | 316 |
1 files changed, 226 insertions, 90 deletions
diff --git a/source3/utils/pdbedit.c b/source3/utils/pdbedit.c index b30ab6f38e..51dbbb98c0 100644 --- a/source3/utils/pdbedit.c +++ b/source3/utils/pdbedit.c @@ -23,6 +23,35 @@ #include "includes.h" +#define BIT_CONFIGFILE 0x00000001 +#define BIT_DEBUGLEVEL 0x00000002 +#define BIT_BACKEND 0x00000004 +#define BIT_VERBOSE 0x00000008 +#define BIT_SPSTYLE 0x00000010 +#define BIT_RESERV_1 0x00000020 +#define BIT_RESERV_2 0x00000040 +#define BIT_RESERV_3 0x00000080 +#define BIT_FULLNAME 0x00000100 +#define BIT_HOMEDIR 0x00000200 +#define BIT_HDIRDRIVE 0x00000400 +#define BIT_LOGSCRIPT 0x00000800 +#define BIT_PROFILE 0x00001000 +#define BIT_MACHINE 0x00002000 +#define BIT_RESERV_4 0x00004000 +#define BIT_USER 0x00008000 +#define BIT_LIST 0x00010000 +#define BIT_MODIFY 0x00020000 +#define BIT_CREATE 0x00040000 +#define BIT_DELETE 0x00080000 +#define BIT_ACCPOLICY 0x00100000 +#define BIT_ACCPOLVAL 0x00200000 +#define BIT_RESERV_6 0x00400000 +#define BIT_RESERV_7 0x00800000 +#define BIT_IMPORT 0x01000000 +#define BIT_EXPORT 0x02000000 + +#define MASK_ALWAYS_GOOD 0x0000001F +#define MASK_USER_GOOD 0x00001F00 extern pstring global_myname; extern BOOL AllowDebugChange; @@ -30,27 +59,21 @@ extern BOOL AllowDebugChange; Add all currently available users to another db ********************************************************/ -int export_database (struct pdb_context *in, char *db){ - struct pdb_context *context; +static int export_database (struct pdb_context *in, struct pdb_context *out) { SAM_ACCOUNT *user = NULL; - if (!NT_STATUS_IS_OK(make_pdb_context_string(&context, db))){ - fprintf(stderr, "Can't initialize %s.\n", db); - return 1; - } - - if (!in->pdb_setsampwent(in, 0)){ + if (!in->pdb_setsampwent(in, 0)) { fprintf(stderr, "Can't sampwent!\n"); return 1; } - if (!NT_STATUS_IS_OK(pdb_init_sam(&user))){ + if (!NT_STATUS_IS_OK(pdb_init_sam(&user))) { fprintf(stderr, "Can't initialize new SAM_ACCOUNT!\n"); return 1; } - while (in->pdb_getsampwent(in,user)){ - context->pdb_add_sam_account(context,user); + while (in->pdb_getsampwent(in, user)) { + out->pdb_add_sam_account(out, user); if (!NT_STATUS_IS_OK(pdb_reset_sam(user))){ fprintf(stderr, "Can't reset SAM_ACCOUNT!\n"); return 1; @@ -91,7 +114,7 @@ static int print_sam_info (SAM_ACCOUNT *sam_pwent, BOOL verbosity, BOOL smbpwdst sid_string_static(pdb_get_group_sid(sam_pwent))); printf ("Full Name: %s\n", pdb_get_fullname(sam_pwent)); printf ("Home Directory: %s\n", pdb_get_homedir(sam_pwent)); - printf ("HomeDir Drive: %s\n", pdb_get_dirdrive(sam_pwent)); + printf ("HomeDir Drive: %s\n", pdb_get_dir_drive(sam_pwent)); printf ("Logon Script: %s\n", pdb_get_logon_script(sam_pwent)); printf ("Profile Path: %s\n", pdb_get_profile_path(sam_pwent)); printf ("Domain: %s\n", pdb_get_domain(sam_pwent)); @@ -255,7 +278,7 @@ static int new_user (struct pdb_context *in, char *username, char *fullname, cha { SAM_ACCOUNT *sam_pwent=NULL; struct passwd *pwd = NULL; - char *password1, *password2; + char *password1, *password2, *staticpass; ZERO_STRUCT(sam_pwent); @@ -270,15 +293,27 @@ static int new_user (struct pdb_context *in, char *username, char *fullname, cha } } - password1 = getpass("new password:"); - password2 = getpass("retype new password:"); + staticpass = getpass("new password:"); + password1 = strdup(staticpass); + memset(staticpass, 0, strlen(staticpass)); + staticpass = getpass("retype new password:"); + password2 = strdup(staticpass); + memset(staticpass, 0, strlen(staticpass)); if (strcmp (password1, password2)) { - fprintf (stderr, "Passwords does not match!\n"); - pdb_free_sam (&sam_pwent); - return -1; + fprintf (stderr, "Passwords does not match!\n"); + memset(password1, 0, strlen(password1)); + SAFE_FREE(password1); + memset(password2, 0, strlen(password2)); + SAFE_FREE(password2); + pdb_free_sam (&sam_pwent); + return -1; } pdb_set_plaintext_passwd(sam_pwent, password1); + memset(password1, 0, strlen(password1)); + SAFE_FREE(password1); + memset(password2, 0, strlen(password2)); + SAFE_FREE(password2); if (fullname) pdb_set_fullname(sam_pwent, fullname); @@ -384,7 +419,7 @@ static int delete_machine_entry (struct pdb_context *in, char *machinename) } if (!in->pdb_getsampwnam(in, samaccount, name)) { - fprintf (stderr, "user %s does not exist in the passdb\n", name); + fprintf (stderr, "machine %s does not exist in the passdb\n", name); return -1; } @@ -400,129 +435,230 @@ int main (int argc, char **argv) static BOOL list_users = False; static BOOL verbose = False; static BOOL spstyle = False; - static BOOL setparms = False; static BOOL machine = False; static BOOL add_user = False; static BOOL delete_user = False; - static BOOL import = False; + static BOOL modify_user = False; + uint32 setparms, checkparms; int opt; static char *full_name = NULL; static char *user_name = NULL; static char *home_dir = NULL; static char *home_drive = NULL; + static char *backend = NULL; static char *backend_in = NULL; static char *backend_out = NULL; static char *logon_script = NULL; static char *profile_path = NULL; static char *config_file = dyn_CONFIGFILE; static char *new_debuglevel = NULL; + static char *account_policy = NULL; + static long int account_policy_value = 0; + BOOL account_policy_value_set = False; - struct pdb_context *in; + struct pdb_context *bin; + struct pdb_context *bout; + struct pdb_context *bdef; poptContext pc; struct poptOption long_options[] = { POPT_AUTOHELP - {"list", 'l',POPT_ARG_VAL, &list_users, 1, "list all users", NULL}, - {"verbose", 'v',POPT_ARG_VAL, &verbose, 1, "be verbose", NULL }, - {"smbpasswd-style", 'w',POPT_ARG_VAL, &spstyle, 1, "give output in smbpasswd style", NULL}, - {"user", 'u',POPT_ARG_STRING,&user_name, 0, "use username", "USER" }, - {"fullname", 'f',POPT_ARG_STRING,&full_name, 0, "set full name", NULL}, - {"homedir", 'h',POPT_ARG_STRING,&home_dir, 0, "set home directory", NULL}, - {"drive", 'd',POPT_ARG_STRING,&home_drive, 0, "set home drive", NULL}, - {"script", 's',POPT_ARG_STRING,&logon_script, 0, "set logon script", NULL}, - {"profile", 'p',POPT_ARG_STRING,&profile_path, 0, "set profile path", NULL}, - {"create", 'a',POPT_ARG_VAL,&add_user, 1, "create user", NULL}, - {"machine", 'm',POPT_ARG_VAL,&machine, 1,"account is a machine account",NULL}, - {"delete", 'x',POPT_ARG_VAL,&delete_user,1,"delete user",NULL}, - {"import", 'i',POPT_ARG_STRING,&backend_in,0,"use different passdb backend",NULL}, - {"export", 'e',POPT_ARG_STRING,&backend_out,0,"export user accounts to backend", NULL}, - {"debuglevel",'D', POPT_ARG_STRING, &new_debuglevel,0,"set debuglevel",NULL}, - {"configfile",'c',POPT_ARG_STRING, &config_file,0,"use different configuration file",NULL}, + {"list", 'l', POPT_ARG_NONE, &list_users, 0, "list all users", NULL}, + {"verbose", 'v', POPT_ARG_NONE, &verbose, 0, "be verbose", NULL }, + {"smbpasswd-style", 'w',POPT_ARG_NONE, &spstyle, 0, "give output in smbpasswd style", NULL}, + {"user", 'u', POPT_ARG_STRING, &user_name, 0, "use username", "USER" }, + {"fullname", 'f', POPT_ARG_STRING, &full_name, 0, "set full name", NULL}, + {"homedir", 'h', POPT_ARG_STRING, &home_dir, 0, "set home directory", NULL}, + {"drive", 'd', POPT_ARG_STRING, &home_drive, 0, "set home drive", NULL}, + {"script", 's', POPT_ARG_STRING, &logon_script, 0, "set logon script", NULL}, + {"profile", 'p', POPT_ARG_STRING, &profile_path, 0, "set profile path", NULL}, + {"create", 'a', POPT_ARG_NONE, &add_user, 0, "create user", NULL}, + {"modify", 'r', POPT_ARG_NONE, &modify_user, 0, "modify user", NULL}, + {"machine", 'm', POPT_ARG_NONE, &machine, 0, "account is a machine account", NULL}, + {"delete", 'x', POPT_ARG_NONE, &delete_user, 0, "delete user", NULL}, + {"backend", 'b', POPT_ARG_STRING, &backend, 0, "use different passdb backend as default backend", NULL}, + {"import", 'i', POPT_ARG_STRING, &backend_in, 0, "import user accounts from this backend", NULL}, + {"export", 'e', POPT_ARG_STRING, &backend_out, 0, "export user accounts to this backend", NULL}, + {"debuglevel", 'D', POPT_ARG_STRING, &new_debuglevel, 0,"set debuglevel",NULL}, + {"configfile", 'c', POPT_ARG_STRING, &config_file, 0,"use different configuration file",NULL}, + {"account-policy", 'P', POPT_ARG_STRING, &account_policy, 0,"value of an account policy (like maximum password age)",NULL}, + {"value", 'V', POPT_ARG_LONG, &account_policy_value, 'V',"set the account policy to this value", NULL}, {0,0,0,0} }; - + setup_logging("pdbedit", True); - + pc = poptGetContext(NULL, argc, (const char **) argv, long_options, - POPT_CONTEXT_KEEP_FIRST); - - while((opt = poptGetNextOpt(pc)) != -1); - - if (new_debuglevel){ + POPT_CONTEXT_KEEP_FIRST); + + while((opt = poptGetNextOpt(pc)) != -1) { + switch (opt) { + case 'V': + account_policy_value_set = True; + break; + } + } + + if (new_debuglevel) { debug_parse_levels(new_debuglevel); AllowDebugChange = False; } - + if (!lp_load(config_file,True,False,False)) { - fprintf(stderr, "Can't load %s - run testparm to debug it\n", - config_file); + fprintf(stderr, "Can't load %s - run testparm to debug it\n", config_file); exit(1); } - - setparms = (full_name || home_dir || home_drive || logon_script || profile_path); - - if (((add_user?1:0) + (delete_user?1:0) + (list_users?1:0) + (import?1:0) + (setparms?1:0)) + (backend_out?1:0) > 1) { - fprintf (stderr, "Incompatible options on command line!\n"); - exit(1); - } - - if (!backend_in) { - if (!NT_STATUS_IS_OK(make_pdb_context_list(&in, lp_passdb_backend()))){ + setparms = (config_file ? BIT_CONFIGFILE : 0) + + (new_debuglevel ? BIT_DEBUGLEVEL : 0) + + (backend ? BIT_BACKEND : 0) + + (verbose ? BIT_VERBOSE : 0) + + (spstyle ? BIT_SPSTYLE : 0) + + (full_name ? BIT_FULLNAME : 0) + + (home_dir ? BIT_HOMEDIR : 0) + + (home_drive ? BIT_HDIRDRIVE : 0) + + (logon_script ? BIT_LOGSCRIPT : 0) + + (profile_path ? BIT_PROFILE : 0) + + (machine ? BIT_MACHINE : 0) + + (user_name ? BIT_USER : 0) + + (list_users ? BIT_LIST : 0) + + (modify_user ? BIT_MODIFY : 0) + + (add_user ? BIT_CREATE : 0) + + (delete_user ? BIT_DELETE : 0) + + (account_policy ? BIT_ACCPOLICY : 0) + + (account_policy_value_set ? BIT_ACCPOLVAL : 0) + + (backend_in ? BIT_IMPORT : 0) + + (backend_out ? BIT_EXPORT : 0); + + if (setparms & BIT_BACKEND) { + if (!NT_STATUS_IS_OK(make_pdb_context_string(&bdef, backend))) { fprintf(stderr, "Can't initialize passdb backend.\n"); return 1; } } else { - if (!NT_STATUS_IS_OK(make_pdb_context_string(&in, backend_in))){ + if (!NT_STATUS_IS_OK(make_pdb_context_list(&bdef, lp_passdb_backend()))) { fprintf(stderr, "Can't initialize passdb backend.\n"); return 1; } } + + /* the lowest bit options are always accepted */ + checkparms = setparms & ~MASK_ALWAYS_GOOD; + + /* accoun tpolicy operations */ + if ((checkparms & BIT_ACCPOLICY) && !(checkparms & ~(BIT_ACCPOLICY + BIT_ACCPOLVAL))) { + uint32 value; + int field = account_policy_name_to_fieldnum(account_policy); + if (field == 0) { + fprintf(stderr, "No account policy by that name\n"); + exit(1); + } + if (!account_policy_get(field, &value)) { + fprintf(stderr, "valid account policy, but unable to fetch value!\n"); + exit(1); + } + if (account_policy_value_set) { + printf("account policy value for %s was %u\n", account_policy, value); + if (!account_policy_set(field, account_policy_value)) { + fprintf(stderr, "valid account policy, but unable to set value!\n"); + exit(1); + } + printf("account policy value for %s is now %lu\n", account_policy, account_policy_value); + exit(0); + } else { + printf("account policy value for %s is %u\n", account_policy, value); + exit(0); + } + } - if (add_user) { - if (!user_name) { - fprintf (stderr, "Username not specified! (use -u option)\n"); - return -1; + /* import and export operations */ + if (((checkparms & BIT_IMPORT) || (checkparms & BIT_EXPORT)) + && !(checkparms & ~(BIT_IMPORT +BIT_EXPORT))) { + if (backend_in) { + if (!NT_STATUS_IS_OK(make_pdb_context_string(&bin, backend_in))) { + fprintf(stderr, "Can't initialize passdb backend.\n"); + return 1; + } + } else { + bin = bdef; } - if (machine) - return new_machine (in, user_name); - else - return new_user (in, user_name, full_name, home_dir, - home_drive, logon_script, - profile_path); + if (backend_out) { + if (!NT_STATUS_IS_OK(make_pdb_context_string(&bout, backend_out))) { + fprintf(stderr, "Can't initialize %s.\n", backend_out); + return 1; + } + } else { + bout = bdef; + } + return export_database(bin, bout); } - if (delete_user) { - if (!user_name) { + /* if BIT_USER is defined but nothing else then threat it as -l -u for compatibility */ + /* fake up BIT_LIST if only BIT_USER is defined */ + if ((checkparms & BIT_USER) && !(checkparms & ~BIT_USER)) { + checkparms += BIT_LIST; + } + + /* modify flag is optional to maintain backwards compatibility */ + /* fake up BIT_MODIFY if BIT_USER and at least one of MASK_USER_GOOD is defined */ + if (!((checkparms & ~MASK_USER_GOOD) & ~BIT_USER) && (checkparms & MASK_USER_GOOD)) { + checkparms += BIT_MODIFY; + } + + /* list users operations */ + if (checkparms & BIT_LIST) { + if (!(checkparms & ~BIT_LIST)) { + return print_users_list (bdef, verbose, spstyle); + } + if (!(checkparms & ~(BIT_USER + BIT_LIST))) { + return print_user_info (bdef, user_name, verbose, spstyle); + } + } + + /* mask out users options */ + checkparms &= ~MASK_USER_GOOD; + + /* account operation */ + if ((checkparms & BIT_CREATE) || (checkparms & BIT_MODIFY) || (checkparms & BIT_DELETE)) { + /* check use of -u option */ + if (!(checkparms & BIT_USER)) { fprintf (stderr, "Username not specified! (use -u option)\n"); return -1; } - if (machine) - return delete_machine_entry (in, user_name); - else - return delete_user_entry (in, user_name); - } - if (user_name) { - if (setparms) - return set_user_info (in, user_name, full_name, + /* account creation operations */ + if (!(checkparms & ~(BIT_CREATE + BIT_USER + BIT_MACHINE))) { + if (checkparms & BIT_MACHINE) { + return new_machine (bdef, user_name); + } else { + return new_user (bdef, user_name, full_name, home_dir, + home_drive, logon_script, + profile_path); + } + } + + /* account deletion operations */ + if (!(checkparms & ~(BIT_DELETE + BIT_USER + BIT_MACHINE))) { + if (checkparms & BIT_MACHINE) { + return delete_machine_entry (bdef, user_name); + } else { + return delete_user_entry (bdef, user_name); + } + } + + /* account modification operations */ + if (!(checkparms & ~(BIT_MODIFY + BIT_USER))) { + return set_user_info (bdef, user_name, full_name, home_dir, home_drive, logon_script, profile_path); - else - return print_user_info (in, user_name, verbose, - spstyle); + } } - if (list_users) - return print_users_list (in, verbose, spstyle); - - if (backend_out) - return export_database(in, backend_out); - + if (setparms >= 0x20) { + fprintf (stderr, "Incompatible or insufficient options on command line!\n"); + } poptPrintHelp(pc, stderr, 0); return 1; } - - |