summaryrefslogtreecommitdiff
path: root/source4/setup
AgeCommit message (Collapse)AuthorFilesLines
2009-09-25s4:LDIFs - enhance the section commentsMatthias Dieter Wallnöfer2-0/+12
2009-09-21Merge branch 'master' of git://git.samba.org/sambaNadezhda Ivanova9-37/+73
2009-09-21s4:samdb/tools - That should fix now the last failuresMatthias Dieter Wallnöfer2-1/+3
2009-09-21s4:scripts - Reintroduce "-H" parameterMatthias Dieter Wallnöfer6-12/+46
I removed it since on some scripts it was present, on others not - so I thought it wouldn't be really needed. This was a bad decision (pointed out by abartlet). So I reintroduce it on all scripts (to have consistent parameters).
2009-09-20Merge branch 'master' of git://git.samba.org/sambaNadezhda Ivanova3-28/+11
2009-09-20s4:provision split provision of DNS zone and self join keytabAndrew Bartlett3-24/+24
2009-09-20Initial implementation of security descriptor creation in DSNadezhda Ivanova2-0/+2
TODO's: ACE sorting and clarifying the inheritance of object specific ace's.
2009-09-20s4:python tools - try to fix some test problemsMatthias Dieter Wallnöfer2-2/+2
2009-09-20s4:domainlevel - fixed another errorMatthias Dieter Wallnöfer1-26/+9
The second "nTMixedDomain" attribute (under Partitions/Domain-DN) is only a copy of the one under the directory root object. Therefore there doesn't exist the "Windows 2000 Mixed" forest level.
2009-09-20s4:provision_configuration - fix "sPNMappings"Matthias Dieter Wallnöfer1-2/+1
I reread some docs about this attributes and it seems that this as mapping attribute isn't host specific but in common for the whole domain. To allow Windows DCs to join our s4 domain sooner or later we have to provide the full attribute.
2009-09-20s4:domainlevel - further improvementsMatthias Dieter Wallnöfer1-9/+50
- The tool displays now also mixed/interim domain levels and warns about them (s4 isn't capable to run on them) - But it allows now also to raise/step-up from them - It displays now also levels higher than 2008 R2 (altough we don't support them yet) but to be able to get a correct output
2009-09-20s4:provision_basedn_modify - fix the "auditPolicy" attributeMatthias Dieter Wallnöfer1-1/+2
I had to think about how to encode the string 0x0001 (taken from Windows Server). The problem is due to the "0" byte at the beginning of it. BASE64 encoding seems a good method to do it.
2009-09-18s4:provision_configuration - "sPNMappings": "http" missed on regenerationMatthias Dieter Wallnöfer1-1/+1
2009-09-18s4/provision_configuration - re-add the "sPNMappings"Matthias Dieter Wallnöfer1-0/+3
Accidentally removed by a previous commit.
2009-09-18s4:scripts - Cleans also the rest under the "setup" directory upMatthias Dieter Wallnöfer3-30/+43
- I removed also the "-H" parameter since those scripts are all thought for the use on a local s4 domain controller. Another reason is also the bind as SYSTEM account which itself is only possible on local binds.
2009-09-18s4:various scripts under "setup" - UnificationMatthias Dieter Wallnöfer4-73/+74
- This unified the shape of those four scripts (comments, command sequence, call of SamDB) - To consider the samdb.py changes regarding the filter: there is now always the possibility either to specify the username or the search filter
2009-09-18s4:domainlevel/pwsettings - Remove unused importMatthias Dieter Wallnöfer2-2/+0
2009-09-18s4:domainlevel - fix indentationsMatthias Dieter Wallnöfer1-4/+4
2009-09-18s4:domainlevel - Add a script which allows raising the domain/forest levelMatthias Dieter Wallnöfer1-0/+181
This simple script allows raising the domain and/or forest level for s4. I integrated also the basic checks (since we don't perform them in LDB yet): e.g. the forest level can't be higher than the domain level(s).
2009-09-18s4:pwsettings - Simplify the error handling a bitMatthias Dieter Wallnöfer1-5/+2
2009-09-18s4:provision - Bump down the domain and forest level to Windows 2000Matthias Dieter Wallnöfer1-6/+7
- The DC level we keep on Windows Server 2008 R2 (we should call ourself always the newest server type) - The domain/forest level we set to the minimum (Windows 2000 native) to allow all AD DC types (from Windows 2000 on) in our domain - the NT4 "mixed" mode isn't supported by us (discussed on mailing list) -> "nTMixedDomain" is set always to 0 - I'll add a script which allows to bump the DC level (basically sets the "msDS-Behaviour-Version" attributes on the "Partitions/Configuration/DC" and on the "DC" object)
2009-09-17s4:provision - Some rework (continuation)Matthias Dieter Wallnöfer3-37/+307
- Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17s4:provision - Some reworkMatthias Dieter Wallnöfer11-23607/+23874
- Add/change "wellKnownObjects" attributes - Order entries in "provision_basedn_modify.ldif" - Add/change "delete entries" object under BASEDN and CONFIGDN - Fix default version number of "Default domain policy" group policy - Add "domain updates" objects for interoperability with MS AD maintaining tools - Show version number in the "oEMInformation" attribute (suggested by ekacnet) - Smaller fixups
2009-09-12s4:sites & services - Adds Intersite transport containersMatthieu Patou1-5/+28
This patch brings up those subcontainers and fixes up the "systemFlags" on the "Subnet" entry.
2009-09-12s4:group policies - the default group policy objects are all system-criticalMatthias Dieter Wallnöfer1-0/+6
2009-09-11s4:group policies - add the domain controller group policyMatthias Dieter Wallnöfer3-3/+32
This patches fixes the last difference between s4 and Windows Server regarding group policy objects: we hadn't the domain controller policy. - Adds the domain controller policy as it is found in the "original" AD - Adds also the right version number in the GPT.INI file for the domain group policy (was missing)
2009-09-11s4-provision: revert _gc_tcp priorityAndrew Tridgell1-1/+1
thanks to id10ts for spotting this. I was a victim of emacs zone mode, which increaed it with each edit.
2009-09-11s4-provision: use DNS name, not domain nameAndrew Tridgell1-2/+2
The SPNs end in the DNS domain name
2009-09-11s4/provision: add the nTDSDSA GUID based DNS entries and SPNsAndrew Tridgell2-3/+8
The DNS entries and SPNs are needed for samba<->samba DRS replication. This patch adds them for a standalone DC configure. A separate patch will add them for the vampire configure
2009-09-11s4:setup Updated Display Specifiers from Microsoft (with #s)Andrew Bartlett5-91/+30
This fixes the issue with the original files that they didn't have a leading # in front of the comments, which caused our parsing scripts much pain. The files are now exactly as delivered. Andrew Bartlett
2009-09-10s4:pwsettings: Added blackbox tests.Andrew Kroeger1-0/+2
The added tests include basic validation that the script runs and accepts all custom arguments. The tests also verify changes to the password complexity, minimum password length, and minimum password length settings.
2009-09-10s4:pwsettings: Show default values in help messages.Andrew Kroeger1-4/+4
2009-09-10s4:pwsettings: Add 'default' option for password complexity.Andrew Kroeger1-2/+2
2009-09-10s4:pwsettings: Added validation.Andrew Kroeger1-4/+26
Validate that each field is within its allowed range. Also validate that the maximum password age is greater than the minimum password length (if the maximum password age is set). I could not find these values documented anywhere in the WSPP docs. I used the values shown in the W2K8 GPMC, as it appears that the GPMC actuaally performs the validation of values.
2009-09-10s4:pwsettings: Don't assume a value for pwdProperties.Andrew Kroeger1-2/+2
If we cannot retrieve the value, do not assume a particular value. The fact that we could not retrieve the value indicates a larger problem that we don't want to make worse bypossibly clearing bit fields in the pwdProperties attribute.
2009-09-10s4:pwsettings: Run all updates as a single modify() operation.Andrew Kroeger1-31/+19
This ensures that all changes are made, or none are made. It also makes it possible to do validation as we go and abort in case of an error, while always leaving things in a consistent state.
2009-09-10s4:pwsettings: Added --quiet option.Andrew Kroeger1-16/+17
Also changed all non-error status output to use the message() function, which respects the --quiet option.
2009-09-10s4: Use SASL authentication against Fedora DS.Endi Sukma Dewata5-18/+35
1. During instance creation the provisioning script will import the SASL mapping for samba-admin. It's done here due to missing config schema preventing adding the mapping via ldapi. 2. After that it will use ldif2db to import the cn=samba-admin user as the target of SASL mapping. 3. Then it will start FDS and continue to do provisioning using the Directory Manager with simple bind. 4. The SASL credentials will be stored in secrets.ldb, so when Samba server runs later it will use the SASL credentials. 5. After the provisioning is done (just before stopping the slapd) it will use the DM over direct ldapi to delete the default SASL mappings included automatically by FDS, leaving just the new samba-admin mapping. 6. Also before stopping slapd it will use the DM over direct ldapi to set the ACL on the root entries of the user, configuration, and schema partitions. The ACL will give samba-admin the full access to these partitions. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-09-07s4:pwsettings: Correct off by factor of 10 for ticks.Andrew Kroeger1-4/+4
The tick conversion math was off by a factor of 10 due to the incorrect usage of the "e" notation. The expression "XeY" means "X * (10^Y)", so the correct expression is 1e7 to get the correct adjustment for ticks.
2009-09-07s4:Foreign security principals - Fix them upMatthias Dieter Wallnöfer2-0/+31
I fixed them up to match with Windows Server 2003. I don't think that the creation of them in the provision script is needed so I put them in the "provision_users.ldif" file.
2009-09-07s4:samldb - Major reworkMatthias Dieter Wallnöfer2-53/+0
This fixes up the change of the primary group of a user when using the ADUC console: - When the "primaryGroupId" attribute changes, we have to delete the "member"/"memberOf" attribute reference of the new primary group and add one for the old primary group. - Deny deletion of primary groups according to Windows Server (so we cannot have invalid "primaryGroupID" attributes in our AD). - We cannot add a primary group directly before it isn't a secondary one of a user account. - We cannot add a secondary reference ("member" attribute) when the group has been chosen as primary one. This also removes the LDB templates which are basically overhead now. This should also fix bug #6599.
2009-09-07s4:provision - Change the "provision_users.ldif" file to support the ↵Matthias Dieter Wallnöfer1-26/+35
"samldb" changes The "provision_users.ldif" file needs some rework to pass against the changed and improved "samldb" module (see next commit).
2009-09-07s4:setup: Remove display_specifiers.ldif.Andrew Kroeger1-482/+0
This file is no longer needed as the DisplaySpecifiers are now generated from files provided by Microsoft.
2009-09-07s4:setup: Updated comment to reflect new DisplaySpecifiers location.Andrew Kroeger1-1/+3
2009-09-07s4:setup: Change license headers to LDIF comments.Andrew Kroeger5-86/+146
The original license headers provided by Microsoft cannot be parsed as valid LDIF. Changed the license headers to be valid LDIF comments, and added a new header section detailing the exact changes that were made to the original document. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-09-07s4:setup Add DisplaySpecifiers from Microsoft.Andrew Bartlett5-0/+148158
Like the schema, these are provided under the licence at the head of the file, which is not the GPL, but allows us to distribute them with Samba. Andrew Bartlett
2009-09-06s4:pwsettings - Introduce the LDB modify flags in the right wayMatthias Dieter Wallnöfer1-27/+8
We can't emulate them through the LDB changetype flags since they haven't the same constants! The previous behaviour led to huge problems.
2009-08-26s4:provision Ensure that @OPTIONS is mirrored into each partitionAndrew Bartlett2-3/+3
The previous patches to the provision system cut down on the number of reconnects, and disabled the partition handling for part of the process. This means we lost the setting of @OPTIONS as a replicated attribute into the partitions. Andrew Bartlett
2009-08-26s4:provison Add prefixes to ldb using same code a later modify will useAndrew Bartlett1-3/+0
This allows us to test out the code that will do the modify of the prefixMap, and to provide the bindings that may assist a future upgrade script. Andrew Bartlett
2009-08-26s4:provision Only create references to our server DN after the self joinAndrew Bartlett5-9/+29
This will ensure that the GUID can be filled in correctly, and assist us to validate DN targets in the future. Andrew Bartlett