summaryrefslogtreecommitdiff
path: root/source4/setup
AgeCommit message (Collapse)AuthorFilesLines
2009-10-02s4:dsdb rework instanceType module - put instanceType in provisionAndrew Bartlett3-0/+3
The instanceType needs to be specified in future because that's how the partitions are actually created.
2009-10-02s4: Improve provisioning: use relax controlMatthieu Patou3-2/+2
Give the possibility to specify controls when loading ldif files. Relax control is specified by default for all ldb_add_diff (request Andrew B). Set domainguid if specified at the creation of object instead of modifying afterward Allow to specify objectGUID for NTDS object of the first DC this option is used during provision upgrade.
2009-10-02s4:provision - Change the default forest/domain function level back to ↵Matthias Dieter Wallnöfer1-1/+1
Windows 2003 Native
2009-09-30s4:pwsettings - Improve error handling and introduce "choice" typeMatthias Dieter Wallnöfer1-13/+10
- Improve the error handling according to Jelmer's suggestions - Print out the error messages on "stderr" - Add also here the "choice" type for arguments
2009-09-30s4:provision - Lets the user choose between the supported forest/domain ↵Matthias Dieter Wallnöfer1-8/+17
function levels Adds a parameter "--function-level" which allows to specify the domain and forest function level.
2009-09-30s4:provision: Show domains and forests are W2K8 DC capable.Andrew Kroeger2-0/+15
When adding a W2K8 DC to a domain running earlier DC versions, the "adprep" utility is used to perform schema updates and update other attributes as necessary. Adding these entries provides an indication that the adprep utility has been run with the /forestprep, /domainprep and /rodcprep arguments. Although these entries indicate adprep has been run, nothing has been done to verify that the changes that the adprep utility would have made have actually been done. The values used for the revision atttributes are as seen on a W2K8 DC (not W2K8 R2, which will probably have higher values).
2009-09-30s4:provision: Update schema version number to W2K8.Andrew Kroeger1-1/+1
We are running the W2K8 schema version, not the W2K3 version.
2009-09-30s4:domainlevel - General reworkMatthias Dieter Wallnöfer1-29/+63
- We support domain/forest function levels >= (Windows) 2003 Native -> adapt the domain/forest and DC function level restrictions. - Consider also the lowest function level of a DC. The domain and forest function levels can never be higher than it. - Improve the error handling by printing out messages to "stderr" - Introduce the "choice" type for choice arguments (saves us some error handling)
2009-09-25s4:LDIFs - enhance the section commentsMatthias Dieter Wallnöfer2-0/+12
2009-09-21Merge branch 'master' of git://git.samba.org/sambaNadezhda Ivanova9-37/+73
2009-09-21s4:samdb/tools - That should fix now the last failuresMatthias Dieter Wallnöfer2-1/+3
2009-09-21s4:scripts - Reintroduce "-H" parameterMatthias Dieter Wallnöfer6-12/+46
I removed it since on some scripts it was present, on others not - so I thought it wouldn't be really needed. This was a bad decision (pointed out by abartlet). So I reintroduce it on all scripts (to have consistent parameters).
2009-09-20Merge branch 'master' of git://git.samba.org/sambaNadezhda Ivanova3-28/+11
2009-09-20s4:provision split provision of DNS zone and self join keytabAndrew Bartlett3-24/+24
2009-09-20Initial implementation of security descriptor creation in DSNadezhda Ivanova2-0/+2
TODO's: ACE sorting and clarifying the inheritance of object specific ace's.
2009-09-20s4:python tools - try to fix some test problemsMatthias Dieter Wallnöfer2-2/+2
2009-09-20s4:domainlevel - fixed another errorMatthias Dieter Wallnöfer1-26/+9
The second "nTMixedDomain" attribute (under Partitions/Domain-DN) is only a copy of the one under the directory root object. Therefore there doesn't exist the "Windows 2000 Mixed" forest level.
2009-09-20s4:provision_configuration - fix "sPNMappings"Matthias Dieter Wallnöfer1-2/+1
I reread some docs about this attributes and it seems that this as mapping attribute isn't host specific but in common for the whole domain. To allow Windows DCs to join our s4 domain sooner or later we have to provide the full attribute.
2009-09-20s4:domainlevel - further improvementsMatthias Dieter Wallnöfer1-9/+50
- The tool displays now also mixed/interim domain levels and warns about them (s4 isn't capable to run on them) - But it allows now also to raise/step-up from them - It displays now also levels higher than 2008 R2 (altough we don't support them yet) but to be able to get a correct output
2009-09-20s4:provision_basedn_modify - fix the "auditPolicy" attributeMatthias Dieter Wallnöfer1-1/+2
I had to think about how to encode the string 0x0001 (taken from Windows Server). The problem is due to the "0" byte at the beginning of it. BASE64 encoding seems a good method to do it.
2009-09-18s4:provision_configuration - "sPNMappings": "http" missed on regenerationMatthias Dieter Wallnöfer1-1/+1
2009-09-18s4/provision_configuration - re-add the "sPNMappings"Matthias Dieter Wallnöfer1-0/+3
Accidentally removed by a previous commit.
2009-09-18s4:scripts - Cleans also the rest under the "setup" directory upMatthias Dieter Wallnöfer3-30/+43
- I removed also the "-H" parameter since those scripts are all thought for the use on a local s4 domain controller. Another reason is also the bind as SYSTEM account which itself is only possible on local binds.
2009-09-18s4:various scripts under "setup" - UnificationMatthias Dieter Wallnöfer4-73/+74
- This unified the shape of those four scripts (comments, command sequence, call of SamDB) - To consider the samdb.py changes regarding the filter: there is now always the possibility either to specify the username or the search filter
2009-09-18s4:domainlevel/pwsettings - Remove unused importMatthias Dieter Wallnöfer2-2/+0
2009-09-18s4:domainlevel - fix indentationsMatthias Dieter Wallnöfer1-4/+4
2009-09-18s4:domainlevel - Add a script which allows raising the domain/forest levelMatthias Dieter Wallnöfer1-0/+181
This simple script allows raising the domain and/or forest level for s4. I integrated also the basic checks (since we don't perform them in LDB yet): e.g. the forest level can't be higher than the domain level(s).
2009-09-18s4:pwsettings - Simplify the error handling a bitMatthias Dieter Wallnöfer1-5/+2
2009-09-18s4:provision - Bump down the domain and forest level to Windows 2000Matthias Dieter Wallnöfer1-6/+7
- The DC level we keep on Windows Server 2008 R2 (we should call ourself always the newest server type) - The domain/forest level we set to the minimum (Windows 2000 native) to allow all AD DC types (from Windows 2000 on) in our domain - the NT4 "mixed" mode isn't supported by us (discussed on mailing list) -> "nTMixedDomain" is set always to 0 - I'll add a script which allows to bump the DC level (basically sets the "msDS-Behaviour-Version" attributes on the "Partitions/Configuration/DC" and on the "DC" object)
2009-09-17s4:provision - Some rework (continuation)Matthias Dieter Wallnöfer3-37/+307
- Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17s4:provision - Some reworkMatthias Dieter Wallnöfer11-23607/+23874
- Add/change "wellKnownObjects" attributes - Order entries in "provision_basedn_modify.ldif" - Add/change "delete entries" object under BASEDN and CONFIGDN - Fix default version number of "Default domain policy" group policy - Add "domain updates" objects for interoperability with MS AD maintaining tools - Show version number in the "oEMInformation" attribute (suggested by ekacnet) - Smaller fixups
2009-09-12s4:sites & services - Adds Intersite transport containersMatthieu Patou1-5/+28
This patch brings up those subcontainers and fixes up the "systemFlags" on the "Subnet" entry.
2009-09-12s4:group policies - the default group policy objects are all system-criticalMatthias Dieter Wallnöfer1-0/+6
2009-09-11s4:group policies - add the domain controller group policyMatthias Dieter Wallnöfer3-3/+32
This patches fixes the last difference between s4 and Windows Server regarding group policy objects: we hadn't the domain controller policy. - Adds the domain controller policy as it is found in the "original" AD - Adds also the right version number in the GPT.INI file for the domain group policy (was missing)
2009-09-11s4-provision: revert _gc_tcp priorityAndrew Tridgell1-1/+1
thanks to id10ts for spotting this. I was a victim of emacs zone mode, which increaed it with each edit.
2009-09-11s4-provision: use DNS name, not domain nameAndrew Tridgell1-2/+2
The SPNs end in the DNS domain name
2009-09-11s4/provision: add the nTDSDSA GUID based DNS entries and SPNsAndrew Tridgell2-3/+8
The DNS entries and SPNs are needed for samba<->samba DRS replication. This patch adds them for a standalone DC configure. A separate patch will add them for the vampire configure
2009-09-11s4:setup Updated Display Specifiers from Microsoft (with #s)Andrew Bartlett5-91/+30
This fixes the issue with the original files that they didn't have a leading # in front of the comments, which caused our parsing scripts much pain. The files are now exactly as delivered. Andrew Bartlett
2009-09-10s4:pwsettings: Added blackbox tests.Andrew Kroeger1-0/+2
The added tests include basic validation that the script runs and accepts all custom arguments. The tests also verify changes to the password complexity, minimum password length, and minimum password length settings.
2009-09-10s4:pwsettings: Show default values in help messages.Andrew Kroeger1-4/+4
2009-09-10s4:pwsettings: Add 'default' option for password complexity.Andrew Kroeger1-2/+2
2009-09-10s4:pwsettings: Added validation.Andrew Kroeger1-4/+26
Validate that each field is within its allowed range. Also validate that the maximum password age is greater than the minimum password length (if the maximum password age is set). I could not find these values documented anywhere in the WSPP docs. I used the values shown in the W2K8 GPMC, as it appears that the GPMC actuaally performs the validation of values.
2009-09-10s4:pwsettings: Don't assume a value for pwdProperties.Andrew Kroeger1-2/+2
If we cannot retrieve the value, do not assume a particular value. The fact that we could not retrieve the value indicates a larger problem that we don't want to make worse bypossibly clearing bit fields in the pwdProperties attribute.
2009-09-10s4:pwsettings: Run all updates as a single modify() operation.Andrew Kroeger1-31/+19
This ensures that all changes are made, or none are made. It also makes it possible to do validation as we go and abort in case of an error, while always leaving things in a consistent state.
2009-09-10s4:pwsettings: Added --quiet option.Andrew Kroeger1-16/+17
Also changed all non-error status output to use the message() function, which respects the --quiet option.
2009-09-10s4: Use SASL authentication against Fedora DS.Endi Sukma Dewata5-18/+35
1. During instance creation the provisioning script will import the SASL mapping for samba-admin. It's done here due to missing config schema preventing adding the mapping via ldapi. 2. After that it will use ldif2db to import the cn=samba-admin user as the target of SASL mapping. 3. Then it will start FDS and continue to do provisioning using the Directory Manager with simple bind. 4. The SASL credentials will be stored in secrets.ldb, so when Samba server runs later it will use the SASL credentials. 5. After the provisioning is done (just before stopping the slapd) it will use the DM over direct ldapi to delete the default SASL mappings included automatically by FDS, leaving just the new samba-admin mapping. 6. Also before stopping slapd it will use the DM over direct ldapi to set the ACL on the root entries of the user, configuration, and schema partitions. The ACL will give samba-admin the full access to these partitions. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-09-07s4:pwsettings: Correct off by factor of 10 for ticks.Andrew Kroeger1-4/+4
The tick conversion math was off by a factor of 10 due to the incorrect usage of the "e" notation. The expression "XeY" means "X * (10^Y)", so the correct expression is 1e7 to get the correct adjustment for ticks.
2009-09-07s4:Foreign security principals - Fix them upMatthias Dieter Wallnöfer2-0/+31
I fixed them up to match with Windows Server 2003. I don't think that the creation of them in the provision script is needed so I put them in the "provision_users.ldif" file.
2009-09-07s4:samldb - Major reworkMatthias Dieter Wallnöfer2-53/+0
This fixes up the change of the primary group of a user when using the ADUC console: - When the "primaryGroupId" attribute changes, we have to delete the "member"/"memberOf" attribute reference of the new primary group and add one for the old primary group. - Deny deletion of primary groups according to Windows Server (so we cannot have invalid "primaryGroupID" attributes in our AD). - We cannot add a primary group directly before it isn't a secondary one of a user account. - We cannot add a secondary reference ("member" attribute) when the group has been chosen as primary one. This also removes the LDB templates which are basically overhead now. This should also fix bug #6599.
2009-09-07s4:provision - Change the "provision_users.ldif" file to support the ↵Matthias Dieter Wallnöfer1-26/+35
"samldb" changes The "provision_users.ldif" file needs some rework to pass against the changed and improved "samldb" module (see next commit).