Age | Commit message (Collapse) | Author | Files | Lines |
|
merge to 3_0, as the pdb interfaces has changed a bit between the two.
This has not been tested too severly (which means it's completely broken ;-),
but I want it in for review. Feel free to revert it :-)
TODO:
make 'net groupmap' a bit more friendly for alias members.
Put that stuff into pdb_ldap.
Getting the information over to winbind. One plan without linking pdb into
winbind would be to fill group_mapping.tdb with the membership information and
have that as a cache (or use gencache.tdb?). smbd on a PDC or stand-alone
could trigger that itself, the problem is a BDC using LDAP. This needs to do
it on a regular basis. The BDC smbd needs to be informed about SAM changes
somehow...
Volker
(This used to be commit 30ef8fe1e85c0ca229b54f3f1595c4330f7191d1)
|
|
Jeremy.
(This used to be commit 755b66303d04b73a855fa8db5fe3ae920a901bf3)
|
|
group_info4 in set_dom_group_info also has the level in the record
itself. This seems not to be an align. Tested with NT4 usrmgr.exe. It can
still create a domain group on a samba machine.
Volker
(This used to be commit 9cadd14aa53d390a2419d7ce4fe48d58cf372279)
|
|
Jeremy.
(This used to be commit d236372876918be2a886a89383cf843b82d4c8db)
|
|
(This used to be commit 2fa56111d37a09702b31e1769a687b630aff1c1b)
|
|
Jeremy.
(This used to be commit a6cb7af9bad1610e802fa5cddbf68fb887bc2974)
|
|
SuSE 8.2
(This used to be commit bf271b96cf6bc42c8a23309d890febf003e1627f)
|
|
(This used to be commit fb90b4140ec45ff4088c41dffce3680b5c4dc170)
|
|
(This used to be commit 9f496e113c60bde1746c7f1063e83735117b2fe8)
|
|
Jeremy.
(This used to be commit a7d4a6d1167f7657113148cdf68ea3c491b51b14)
|
|
- passdb.h: replace UNKNOWN_3 with FIELDS_PRESENT
- parse_samr.c: put comment back in...seems like we shouldn't lose info like this
(This used to be commit 6b9efd2f4cd5cf042e2a04a08719a9fe83d54116)
|
|
(This used to be commit b354fa606d65ff3621b2870a2ef85d980913f319)
|
|
Remove more unused portions of the 'password cache'.
Andrew Bartlett
(This used to be commit 33cdb2bd18daca31461bbc45251679f50fd3567f)
|
|
If we are providing strndup(), ensure we provide a prototype too.
Andrew Bartlett
(This used to be commit 5536c7448e88caa95b13c01956c37deee899dd92)
|
|
meaning of fields_present bit mask. Also avoid it being saved in backends (0
is saved where removing the unit32 would have produced a format change).
Also add support in samr functions to correctly interpret the flags.
Flags still not set properly (eg. still set all flags 0xffffff as previous
code), need a tool to test this properly (I',ve done preliminary tests with
samba4 rpc torture and it seem to work properly against w2k).
2. Patch for handlig the flag user must change password at next logon
in usrmgr based on Jianliang Lu <j.lu@tiesse.com> patch
(This used to be commit 78975e9483e64412e436c5dbfe2b71e20b79de29)
|
|
* Fix XFS quotas: XFS_USER_QUOTA -> USRQUOTA
XFS_GROUP_QUOTA -> GRPQUOTA
* Fix disk_free calculation with group quotas.
* Add debug class 'quota' and a lot of DEBUG()'s
to the quota code.
metze
(This used to be commit 33c6ca3b4bc0898893b5d95ea2485b7694b9d198)
|
|
rafal
(This used to be commit ea15c148fd6393512f2fd95d88db6546d40cf14c)
|
|
unix jobs back to the client. Allows windows client to remove print jobs submitted from lpr
(This used to be commit 6a7f9ebccd6a40455cb5446551f3d68ea9a7a824)
|
|
(This used to be commit c98399e3c9d74e19b7c9d806ca8028b48866931e)
|
|
code changes form 3.0
(This used to be commit 2279e98cb81faaf8a4e971fec339955f14c23858)
|
|
backend-independent part ie. interface - does build and (it seems)
doesn't break anything else.
rafal
(This used to be commit 9ce6dc6476202d9db6ea1c2deab93e454e4db546)
|
|
Andrew Bartlett
(This used to be commit f7d39c787771616ddb015bd77e3e6cd33f0c7a15)
|
|
Andrew Bartlett
(This used to be commit ec24c7f42ac344d14c0e29d4b49c07d8ce213448)
|
|
using pread/pwrite. Modified a little to ensure fsp->pos is correct.
Fix for #889.
Jeremy.
(This used to be commit 3a24dc868d95c9bcc2ac3a0dbd50e6e226ac0841)
|
|
rpc_parse/parse_lsa.c:
nsswitch/winbindd_rpc.c:
nsswitch/winbindd.h:
- Add const
libads/ads_ldap.c:
- Add ads_sid_to_dn utility function
nsswitch/winbindd_ads.c:
- Use new utility function ads_sid_to_dn
- Don't search for 'dn=', rather call the ads_search_retry_dn()
nsswitch/winbindd_ads.c:
include/rpc_ds.h:
rpc_client/cli_ds.c:
- Fixup braindamage in cli_ds_enum_domain_trusts():
- This function was returning a UNISTR2 up to the caller, and
was doing nasty (invalid, per valgrind) things with memcpy()
- Create a new structure that represents this informaiton in a useful way
and use talloc.
Andrew Bartlett
(This used to be commit 627d33d1667f0d4b1070f988494885b74c4c04dd)
|
|
(This used to be commit 61cbd5c9be1962d0c33c28ff472a2f82d3aa2a80)
|
|
When smb.conf tells us to write to a read-only LDAP replica and we are
redirected by the LDAP server, the replication might take some seconds,
especially over slow links. This patch delays the next read after a rebind for
'ldap rebind sleep' milliseconds.
Metze, thanks for your patience.
Volker
(This used to be commit 7293550e3642e2553684a7011084dabb0b78fd24)
|
|
(This used to be commit 426a02cf678236f902c143b56eaaf854fca2237f)
|
|
on local files on on domain members; bug 875
(This used to be commit a5c5dde1c34ba44f8d9bbb38720a089a6d61806c)
|
|
(This used to be commit acf9eae7b0c95776358292c3463951477575bcc6)
|
|
* don't fall back to unmapped UNIX group for
get_local_group_from_sid()
* remove an extra become/unbecome_root() pair
from group enumeration
(This used to be commit c0f34b42a6a4af09ae4b76721bc350784d87f686)
|
|
Changes all over the shop, but all towards:
- NTLM2 support in the server
- KEY_EXCH support in the server
- variable length session keys.
In detail:
- NTLM2 is an extension of NTLMv1, that is compatible with existing
domain controllers (unlike NTLMv2, which requires a DC upgrade).
* This is known as 'NTLMv2 session security' *
(This is not yet implemented on the RPC pipes however, so there may
well still be issues for PDC setups, particuarly around password
changes. We do not fully understand the sign/seal implications of
NTLM2 on RPC pipes.)
This requires modifications to our authentication subsystem, as we
must handle the 'challege' input into the challenge-response algorithm
being changed. This also needs to be turned off for
'security=server', which does not support this.
- KEY_EXCH is another 'security' mechanism, whereby the session key
actually used by the server is sent by the client, rather than being
the shared-secret directly or indirectly.
- As both these methods change the session key, the auth subsystem
needed to be changed, to 'override' session keys provided by the
backend.
- There has also been a major overhaul of the NTLMSSP subsystem, to
merge the 'client' and 'server' functions, so they both operate on a
single structure. This should help the SPNEGO implementation.
- The 'names blob' in NTLMSSP is always in unicode - never in ascii.
Don't make an ascii version ever.
- The other big change is to allow variable length session keys. We
have always assumed that session keys are 16 bytes long - and padded
to this length if shorter. However, Kerberos session keys are 8 bytes
long, when the krb5 login uses DES.
* This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. *
- Add better DEBUG() messages to ntlm_auth, warning administrators of
misconfigurations that prevent access to the privileged pipe. This
should help reduce some of the 'it just doesn't work' issues.
- Fix data_blob_talloc() to behave the same way data_blob() does when
passed a NULL data pointer. (just allocate)
REMEMBER to make clean after this commit - I have changed plenty of
data structures...
Andrew Bartlett
(This used to be commit 57a895aaabacc0c9147344d097d333793b77c947)
|
|
(This used to be commit d1394f02cb0e369701217ce6610f4efe54438c3a)
|
|
Add module support for configuration loading
Add a first implementation of config_ldap module to put samba configuration
on ldap
It worked on my test machine, please try it out and send bugfixes :-)
have fun,
Simo.
INSTRUCTIONS:
Just add something like this to your smb.conf file:
config backend = config_ldap:ldap://localhost
config_ldap:basedn = dc=samba,dc=org
the config tree must follow this scheme:
ou=foo, dc=samba, dc=org <- global section
|- sambaOptionName=log level, ou=foo, ... <- options
|- ...
|- sambaShareName=testlc, ou=foo, ... == [testlc]
|- sambaOptionName=path, sambaShareName=testlc, ou=foo, ... <- option
here is a sample ldif:
# foo, samba, org
dn: ou=foo, dc=samba, dc=org
objectClass: organizationalUnit
objectClass: sambaConfig
ou: foo
description: Test Foo
# log level, foo, samba, org
dn: sambaOptionName=log level, ou=foo, dc=samba, dc=org
objectClass: sambaConfigOption
sambaOptionName: log level
sambaIntegerOption: 10
description: log level 10 is suitable for good debugging
# testlc, foo, samba, org
dn: sambaShareName=testlc, ou=foo, dc=samba, dc=org
objectClass: sambaShare
sambaShareName: testlc
description: share to test ldap config module actually works
# path, testlc, foo, samba, org
dn: sambaOptionName=path, sambaShareName=testlc, ou=foo, dc=samba, dc=org
objectClass: sambaConfigOption
sambaOptionName: path
sambaStringOption: /tmp
description: Path for share testlc
# read only, testlc, foo, samba, org
dn: sambaOptionName=read only, sambaShareName=testlc, ou=foo, dc=samba,
dc=org
objectClass: sambaConfigOption
sambaOptionName: read only
sambaBoolOption: TRUE
description: Share testlc is read only
# guest ok, testlc, foo, samba, org
dn: sambaOptionName=guest ok, sambaShareName=testlc, ou=foo, dc=samba,
dc=org
objectClass: sambaConfigOption
sambaOptionName: guest ok
sambaBoolOption: TRUE
description: Guest users are allowed to connect to testlc share
(This used to be commit 207968eafc2c2a185e50e2132702d7bab2142aba)
|
|
Revision 1.16.2.6:
Add prototype for smbc_remove_unused_server() to fix
compiler warning. Bug #706.
(This used to be commit 99f70d86fe17ce39d803fa23a135169e24d8a34e)
|
|
files; will watch the build farm on this to make sure things don't blow up
(This used to be commit b4d80ee74727a72aa8fe070d13e3ca5de71837ca)
|
|
(This used to be commit 9746ef376d2a52ef6ef6b84421d6b7e988a6ca13)
|
|
(This used to be commit 98881672f5c094181be7988b4d39b451f292e423)
|
|
(This used to be commit 3cd8acb6c362bca82d7268aa283d3f6360b24604)
|
|
GUID has been removed. If you are dealing with a flattened version of a
[gu]uid, use UUID_FLAT. smb_pack_uuid and smb_unpack_uuid will switch
between the two.
I'm not sure exactly what the genparse stuff is doing here, so I just
switched it to a UUID_FLAT (no functional change), but I suspect this
may not be the right way to go.
(This used to be commit 001e9d0e814109a26d598001b3c23dfdb04510ff)
|
|
Takes care of secdescs.
Had to move the uuid marshall/unmarshalling code to parse_misc, because
it's needed outside of parse_rpc.c (for no-auth calls)
(This used to be commit 5d2bb079b65ccfec14604d8dcf0ce789d1795b46)
|
|
Takes care of the lsass pipe
(This used to be commit 3dca3efa4b427fa3094a8cd392fe5744b5f6f6a8)
|
|
This eliminates RPC_UUID. It creates the following struct:
struct uuid
{
uint32 time_low;
uint16 time_mid;
uint16 time_hi_and_version;
uint8 clock_seq[2];
uint8 node[6];
};
which replaces RPC_UUID and various random struct uuid definitions
and a flat version:
#define UUID_FLAT_SIZE 16
typedef struct uuid_flat
{
uint8 info[UUID_FLAT_SIZE];
} UUID_FLAT;
which pretty much looks like GUID (which I will start eliminating).
I want us to use the FLAT one only on the wire (perhaps in files, too?), and
I want it to be obvious to the coder that it is the FLAT version.
This leaves a couple of compiler warnings, where GUID isn't completely
replaced by FLAT_UUID yet...I'll get to those soon.
(This used to be commit 1532b5d2e3c61df232b16394acedf6eac387588b)
|
|
parameterise the listen backlog in smbd and make it larger by default. A backlog of 5 is way too small these days.
Jeremy.
(This used to be commit 58b8f673945ad114d056dd79f509c93ab42b96d1)
|
|
#534
(This used to be commit 99f4fa54497ba1c0fc0ba39d51b3ce201a8e6cd2)
|
|
to all requests on the winreg pipe, so we need to handle this new pipe.
First part of fix for bug #534
(This used to be commit 532fab74c12d8c55872c2bad2abead2647f919d7)
|
|
of the problems with this.
From: Derrell.Lipman@unwireduniverse.com
(This used to be commit 8e3d2708c5e5a9968aeb9a6fe6c828aa8a5b22a9)
|
|
in iconv.c and nsswitch/). Using them means you're not thinking about multibyte at
all and I really want to discourage that.
Jeremy.
(This used to be commit 5c050a735f86927c7ef2a98b6f3a56abe39e4674)
|
|
(This used to be commit ff29be16e74361b02b0b7fbd83e393d68ae5b897)
|
|
errors.
(This used to be commit 9d0f322a851f487cea320e57076213435e5c6481)
|