From cd5c3f5842984c8ce0a6208dc0a482c5be53606f Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Fri, 8 Feb 2008 12:45:51 +1100 Subject: Ensure expected errors do not leak up to the application. (reset the error string to be sure). Andrew Bartlett (This used to be commit 741d33bf8c9b2e2b1ba4762ca63e90885a702184) --- source4/dsdb/samdb/ldb_modules/schema_fsmo.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'source4') diff --git a/source4/dsdb/samdb/ldb_modules/schema_fsmo.c b/source4/dsdb/samdb/ldb_modules/schema_fsmo.c index 559c91bd2d..f9dd131fd4 100644 --- a/source4/dsdb/samdb/ldb_modules/schema_fsmo.c +++ b/source4/dsdb/samdb/ldb_modules/schema_fsmo.c @@ -59,6 +59,7 @@ static int schema_fsmo_init(struct ldb_module *module) schema_dn = samdb_schema_dn(module->ldb); if (!schema_dn) { + ldb_reset_err_string(module->ldb); ldb_debug(module->ldb, LDB_DEBUG_WARNING, "schema_fsmo_init: no schema dn present: (skip schema loading)\n"); return ldb_next_init(module); @@ -91,6 +92,7 @@ static int schema_fsmo_init(struct ldb_module *module) NULL, schema_attrs, &schema_res); if (ret == LDB_ERR_NO_SUCH_OBJECT) { + ldb_reset_err_string(module->ldb); ldb_debug(module->ldb, LDB_DEBUG_WARNING, "schema_fsmo_init: no schema head present: (skip schema loading)\n"); talloc_free(mem_ctx); -- cgit From d2ea79d1d60f1159efa3a363e884a0b17fba4fed Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Fri, 8 Feb 2008 12:48:11 +1100 Subject: Fix LDAP backend with python provision The backend databases were still hard-coded as 'users.ldb' etc. Andrew Bartlett (This used to be commit 3c5f6cc739b4a8787ce4cc5dc16ffd3027cc4a57) --- source4/scripting/python/samba/provision.py | 44 +++++++++++++++++------------ 1 file changed, 26 insertions(+), 18 deletions(-) (limited to 'source4') diff --git a/source4/scripting/python/samba/provision.py b/source4/scripting/python/samba/provision.py index d2a4f28b64..9a44983d8e 100644 --- a/source4/scripting/python/samba/provision.py +++ b/source4/scripting/python/samba/provision.py @@ -323,9 +323,9 @@ def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info, configdn_ldb = "configuration.ldb" if ldap_backend is not None: configdn_ldb = ldap_backend - schema_ldb = "schema.ldb" + schemadn_ldb = "schema.ldb" if ldap_backend is not None: - schema_ldb = ldap_backend + schemadn_ldb = ldap_backend if ldap_backend_type == "fedora-ds": backend_modules = ["nsuniqueid","paged_searches"] @@ -336,23 +336,31 @@ def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info, else: backend_modules = ["objectguid"] - setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), { - "SCHEMADN": schemadn, - "SCHEMADN_LDB": "schema.ldb", - "SCHEMADN_MOD2": ",objectguid", - "CONFIGDN": configdn, - "CONFIGDN_LDB": "configuration.ldb", - "DOMAINDN": domaindn, - "DOMAINDN_LDB": "users.ldb", - "SCHEMADN_MOD": "schema_fsmo,instancetype", - "CONFIGDN_MOD": "naming_fsmo,instancetype", - "DOMAINDN_MOD": "pdc_fsmo,password_hash,instancetype", - "MODULES_LIST": ",".join(modules_list), - "TDB_MODULES_LIST": ","+",".join(tdb_modules_list), - "MODULES_LIST2": ",".join(modules_list2), - "BACKEND_MOD": ",".join(backend_modules), + samdb.transaction_start() + try: + setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), { + "SCHEMADN": schemadn, + "SCHEMADN_LDB": schemadn_ldb, + "SCHEMADN_MOD2": ",objectguid", + "CONFIGDN": configdn, + "CONFIGDN_LDB": configdn_ldb, + "DOMAINDN": domaindn, + "DOMAINDN_LDB": domaindn_ldb, + "SCHEMADN_MOD": "schema_fsmo,instancetype", + "CONFIGDN_MOD": "naming_fsmo,instancetype", + "DOMAINDN_MOD": "pdc_fsmo,password_hash,instancetype", + "MODULES_LIST": ",".join(modules_list), + "TDB_MODULES_LIST": ","+",".join(tdb_modules_list), + "MODULES_LIST2": ",".join(modules_list2), + "BACKEND_MOD": ",".join(backend_modules), }) + except: + samdb.transaction_cancel() + raise + + samdb.transaction_commit() + samdb = SamDB(samdb_path, session_info=session_info, credentials=credentials, lp=lp) @@ -680,7 +688,7 @@ FILL_NT4SYNC = "NT4SYNC" FILL_DRS = "DRS" def provision(lp, setup_dir, message, paths, session_info, - credentials, ldapbackend, samdb_fill=FILL_FULL, realm=None, rootdn=None, + credentials, samdb_fill=FILL_FULL, realm=None, rootdn=None, domain=None, hostname=None, hostip=None, domainsid=None, hostguid=None, adminpass=None, krbtgtpass=None, domainguid=None, policyguid=None, invocationid=None, machinepass=None, -- cgit From 411ec4b79c2a58ebb77fbd24fa2fb0ad3644b7c8 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Fri, 8 Feb 2008 12:48:58 +1100 Subject: Remove unused ldap_backend argument from provision.py Andrew Bartlett (This used to be commit fbce84a87b086a0024379ab26f6f628e5d210251) --- source4/setup/provision.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'source4') diff --git a/source4/setup/provision.py b/source4/setup/provision.py index c8087f7bd7..9f887e8b3b 100755 --- a/source4/setup/provision.py +++ b/source4/setup/provision.py @@ -150,7 +150,7 @@ elif opts.partitions_only: samdb_fill = FILL_DRS provision(lp, setup_dir, message, paths, - system_session(), creds, opts.ldap_backend, + system_session(), creds, samdb_fill=samdb_fill, realm=opts.realm, domainguid=opts.domain_guid, domainsid=opts.domain_sid, policyguid=opts.policy_guid, hostname=opts.host_name, -- cgit From cc61c1d5f44b8873618e9c3522011e9318eb1a0f Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Fri, 8 Feb 2008 12:49:30 +1100 Subject: LDAP backend provision now works with python. Andrew Bartlett (This used to be commit 3e6a6e6b210a4089cf9f9db80c1ab30da3872845) --- source4/scripting/python/STATUS | 1 - 1 file changed, 1 deletion(-) (limited to 'source4') diff --git a/source4/scripting/python/STATUS b/source4/scripting/python/STATUS index 6e6475bfde..ee67b8bc7a 100644 --- a/source4/scripting/python/STATUS +++ b/source4/scripting/python/STATUS @@ -1,6 +1,5 @@ dsdb/samdb/ldb_modules/tests/samba3sam.py: Fix remaining failing tests lib/ldb/tests/python/ldap.py: Fix remaining 3 FIXME's -provisioning in LDAP mode(TEST_LDAP=yes PROVISION_PYTHON=yes make test) command-line vampire provisioning: combine some of the python dictionaries finish scripting/bin/smbstatus.py -- cgit From 0fc670308e3c97a5c1805c9caecf6b590e0a6eb4 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Fri, 8 Feb 2008 12:52:54 +1100 Subject: Remove unused argument to provision(). Andrew Bartlett (This used to be commit 2f98ec1e6417c70a48370a62e7a54dfc4f6291c1) --- source4/setup/provision | 367 +++++++++++++++++++++++------------------------- 1 file changed, 173 insertions(+), 194 deletions(-) (limited to 'source4') diff --git a/source4/setup/provision b/source4/setup/provision index 9e135cddbb..9f887e8b3b 100755 --- a/source4/setup/provision +++ b/source4/setup/provision @@ -1,194 +1,173 @@ -#!/bin/sh -exec smbscript "$0" ${1+"$@"} -/* - provision a Samba4 server - Copyright Andrew Tridgell 2005 - Released under the GNU GPL v2 or later -*/ - -options = GetOptions(ARGV, - "POPT_AUTOHELP", - "POPT_COMMON_SAMBA", - "POPT_COMMON_VERSION", - "POPT_COMMON_CREDENTIALS", - 'realm=s', - 'domain=s', - 'domain-guid=s', - 'domain-sid=s', - 'policy-guid=s', - 'host-name=s', - 'host-ip=s', - 'host-guid=s', - 'invocationid=s', - 'adminpass=s', - 'krbtgtpass=s', - 'machinepass=s', - 'dnspass=s', - 'root=s', - 'nobody=s', - 'nogroup=s', - 'wheel=s', - 'users=s', - 'quiet', - 'blank', - 'server-role=s', - 'partitions-only', - 'ldap-base', - 'ldap-backend=s', - 'ldap-module=s', - 'aci=s'); - -if (options == undefined) { - println("Failed to parse options"); - return -1; -} - -libinclude("base.js"); -libinclude("provision.js"); - -/* - print a message if quiet is not set -*/ -function message() -{ - if (options["quiet"] == undefined) { - print(vsprintf(arguments)); - } -} - -/* - show some help -*/ -function ShowHelp() -{ - print(" -Samba4 provisioning - -provision [options] - --realm REALM set realm - --domain DOMAIN set domain - --domain-guid GUID set domainguid (otherwise random) - --domain-sid SID set domainsid (otherwise random) - --host-name HOSTNAME set hostname - --host-ip IPADDRESS set ipaddress - --host-guid GUID set hostguid (otherwise random) - --policy-guid GUID set group policy guid (otherwise random) - --invocationid GUID set invocationid (otherwise random) - --adminpass PASSWORD choose admin password (otherwise random) - --krbtgtpass PASSWORD choose krbtgt password (otherwise random) - --machinepass PASSWORD choose machine password (otherwise random) - --root USERNAME choose 'root' unix username - --nobody USERNAME choose 'nobody' user - --nogroup GROUPNAME choose 'nogroup' group - --wheel GROUPNAME choose 'wheel' privileged group - --users GROUPNAME choose 'users' group - --quiet Be quiet - --blank do not add users or groups, just the structure - --server-role ROLE Set server role to provision for (default standalone) - --partitions-only Configure Samba's partitions, but do not modify them (ie, join a BDC) - --ldap-base output only an LDIF file, suitable for creating an LDAP baseDN - --ldap-backend LDAPSERVER LDAP server to use for this provision - --ldap-module MODULE LDB mapping module to use for the LDAP backend - --aci ACI An arbitary LDIF fragment, particularly useful to loading a backend ACI value into a target LDAP server -You must provide at least a realm and domain - -"); - exit(1); -} - -if (options['host-name'] == undefined) { - options['host-name'] = hostname(); -} - -/* - main program -*/ -if (options["realm"] == undefined || - options["domain"] == undefined || - options["host-name"] == undefined) { - ShowHelp(); -} - -/* cope with an initially blank smb.conf */ -var lp = loadparm_init(); -lp.set("realm", options.realm); -lp.set("workgroup", options.domain); -lp.set("server role", options["server-role"]); -lp.reload(); - -var subobj = provision_guess(); -for (r in options) { - var key = strupper(join("", split("-", r))); - subobj[key] = options[r]; -} - -var blank = (options["blank"] != undefined); -var ldapbackend = (options["ldap-backend"] != undefined); -var ldapmodule = (options["ldap-module"] != undefined); -var partitions_only = (options["partitions-only"] != undefined); -var paths = provision_default_paths(subobj); -if (options["aci"] != undefined) { - message("set ACI: %s\n", subobj["ACI"]); -} - -message("set DOMAIN SID: %s\n", subobj["DOMAINSID"]); - -provision_fix_subobj(subobj, paths); - -if (ldapbackend) { - if (options["ldap-backend"] == "ldapi") { - subobj.LDAPBACKEND = subobj.LDAPI_URI; - } - if (!ldapmodule) { - subobj.LDAPMODULE = "normalise,entryuuid"; - subobj.TDB_MODULES_LIST = ""; - } - subobj.BACKEND_MOD = subobj.LDAPMODULE + ",paged_searches"; - subobj.DOMAINDN_LDB = subobj.LDAPBACKEND; - subobj.CONFIGDN_LDB = subobj.LDAPBACKEND; - subobj.SCHEMADN_LDB = subobj.LDAPBACKEND; - message("LDAP module: %s on backend: %s\n", subobj.LDAPMODULE, subobj.LDAPBACKEND); -} - -if (!provision_validate(subobj, message)) { - return -1; -} - -var system_session = system_session(); -var creds = options.get_credentials(); -message("Provisioning for %s in realm %s\n", subobj.DOMAIN, subobj.REALM); -message("Using administrator password: %s\n", subobj.ADMINPASS); -if (partitions_only) { - provision_become_dc(subobj, message, false, paths, system_session); -} else { - provision(subobj, message, blank, paths, system_session, creds, ldapbackend); - provision_dns(subobj, message, paths, system_session, creds); - message("To reproduce this provision, run with:\n"); -/* There has to be a better way than this... */ - message("--realm='%s' --domain='%s' \\\n", subobj.REALM_CONF, subobj.DOMAIN_CONF); - if (subobj.DOMAINGUID != undefined) { - message("--domain-guid='%s' \\\n", subobj.DOMAINGUID); - } - if (subobj.HOSTGUID != undefined) { - message("--host-guid='%s' \\\n", subobj.HOSTGUID); - } - message("--policy-guid='%s' --host-name='%s' --host-ip='%s' \\\n", subobj.POLICYGUID, subobj.HOSTNAME, subobj.HOSTIP); - if (subobj.INVOCATIONID != undefined) { - message("--invocationid='%s' \\\n", subobj.INVOCATIONID); - } - message("--adminpass='%s' --krbtgtpass='%s' \\\n", subobj.ADMINPASS, subobj.KRBTGTPASS); - message("--machinepass='%s' --dnspass='%s' \\\n", subobj.MACHINEPASS, subobj.DNSPASS); - message("--root='%s' --nobody='%s' --nogroup='%s' \\\n", subobj.ROOT, subobj.NOBODY, subobj.NOGROUP); - message("--wheel='%s' --users='%s' --server-role='%s' \\\n", subobj.WHEEL, subobj.USERS, subobj.SERVERROLE); - if (ldapbackend) { - message("--ldap-backend='%s' \\\n", subobj.LDAPBACKEND); - } - if (ldapmodule) { - message("--ldap-module='%s' \\\n", + subobj.LDAPMODULE); - } - message("--aci='" + subobj.ACI + "' \\\n") -} - - -message("All OK\n"); -return 0; +#!/usr/bin/python +# +# Unix SMB/CIFS implementation. +# provision a Samba4 server +# Copyright (C) Jelmer Vernooij 2007-2008 +# Copyright (C) Andrew Bartlett 2008 +# +# Based on the original in EJS: +# Copyright (C) Andrew Tridgell 2005 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +import getopt +import optparse +import os, sys + +# Add path to the library for in-tree use +sys.path.append("scripting/python") + +import samba + +from auth import system_session +import samba.getopt as options +import param +from samba.provision import (provision, + provision_paths_from_lp, + FILL_FULL, FILL_NT4SYNC, + FILL_DRS) + +parser = optparse.OptionParser("provision [options]") +sambaopts = options.SambaOptions(parser) +parser.add_option_group(sambaopts) +parser.add_option_group(options.VersionOptions(parser)) +credopts = options.CredentialsOptions(parser) +parser.add_option_group(credopts) +parser.add_option("--setupdir", type="string", metavar="DIR", + help="directory with setup files") +parser.add_option("--realm", type="string", metavar="REALM", help="set realm") +parser.add_option("--domain", type="string", metavar="DOMAIN", + help="set domain") +parser.add_option("--domain-guid", type="string", metavar="GUID", + help="set domainguid (otherwise random)") +parser.add_option("--domain-sid", type="string", metavar="SID", + help="set domainsid (otherwise random)") +parser.add_option("--policy-guid", type="string", metavar="GUID", + help="set policy guid") +parser.add_option("--host-name", type="string", metavar="HOSTNAME", + help="set hostname") +parser.add_option("--host-ip", type="string", metavar="IPADDRESS", + help="set ipaddress") +parser.add_option("--host-guid", type="string", metavar="GUID", + help="set hostguid (otherwise random)") +parser.add_option("--invocationid", type="string", metavar="GUID", + help="set invocationid (otherwise random)") +parser.add_option("--adminpass", type="string", metavar="PASSWORD", + help="choose admin password (otherwise random)") +parser.add_option("--krbtgtpass", type="string", metavar="PASSWORD", + help="choose krbtgt password (otherwise random)") +parser.add_option("--machinepass", type="string", metavar="PASSWORD", + help="choose machine password (otherwise random)") +parser.add_option("--dnspass", type="string", metavar="PASSWORD", + help="choose dns password (otherwise random)") +parser.add_option("--root", type="string", metavar="USERNAME", + help="choose 'root' unix username") +parser.add_option("--nobody", type="string", metavar="USERNAME", + help="choose 'nobody' user") +parser.add_option("--nogroup", type="string", metavar="GROUPNAME", + help="choose 'nogroup' group") +parser.add_option("--wheel", type="string", metavar="GROUPNAME", + help="choose 'wheel' privileged group") +parser.add_option("--users", type="string", metavar="GROUPNAME", + help="choose 'users' group") +parser.add_option("--quiet", help="Be quiet", action="store_true") +parser.add_option("--blank", action="store_true", + help="do not add users or groups, just the structure") +parser.add_option("--ldap-backend", type="string", metavar="LDAPSERVER", + help="LDAP server to use for this provision") +parser.add_option("--ldap-backend-type", type="choice", metavar="LDAP-BACKEND-TYPE", + help="LDB mapping module to use for the LDAP backend", + choices=["fedora-ds", "openldap"]) +parser.add_option("--aci", type="string", metavar="ACI", + help="An arbitary LDIF fragment, particularly useful to loading a backend ACI value into a target LDAP server. You must provide at least a realm and domain") +parser.add_option("--server-role", type="choice", metavar="ROLE", + choices=["domain controller", "member server"], + help="Set server role to provision for (default standalone)") +parser.add_option("--partitions-only", + help="Configure Samba's partitions, but do not modify them (ie, join a BDC)", action="store_true") +parser.add_option("--targetdir", type="string", metavar="DIR", + help="Set target directory") + +opts = parser.parse_args()[0] + +def message(text): + """print a message if quiet is not set.""" + if not opts.quiet: + print text + +if opts.realm is None or opts.domain is None: + if opts.realm is None: + print >>sys.stderr, "No realm set" + if opts.domain is None: + print >>sys.stderr, "No domain set" + parser.print_usage() + sys.exit(1) + +# cope with an initially blank smb.conf +private_dir = None +lp = sambaopts.get_loadparm() +if opts.targetdir is not None: + if not os.path.exists(opts.targetdir): + os.mkdir(opts.targetdir) + private_dir = os.path.join(opts.targetdir, "private") + if not os.path.exists(private_dir): + os.mkdir(private_dir) + lp.set("private dir", os.path.abspath(private_dir)) + lp.set("lock dir", os.path.abspath(opts.targetdir)) +lp.set("realm", opts.realm) +lp.set("workgroup", opts.domain) +lp.set("server role", opts.server_role or "domain controller") + + +if opts.aci is not None: + print "set ACI: %s" % opts.aci + +paths = provision_paths_from_lp(lp, opts.realm.lower(), private_dir) +paths.smbconf = sambaopts.get_loadparm_path() + +creds = credopts.get_credentials() + +setup_dir = opts.setupdir +if setup_dir is None: + setup_dir = "setup" + +samdb_fill = FILL_FULL +if opts.blank: + samdb_fill = FILL_NT4SYNC +elif opts.partitions_only: + samdb_fill = FILL_DRS + +provision(lp, setup_dir, message, paths, + system_session(), creds, + samdb_fill=samdb_fill, realm=opts.realm, + domainguid=opts.domain_guid, domainsid=opts.domain_sid, + policyguid=opts.policy_guid, hostname=opts.host_name, + hostip=opts.host_ip, hostguid=opts.host_guid, + invocationid=opts.invocationid, adminpass=opts.adminpass, + krbtgtpass=opts.krbtgtpass, machinepass=opts.machinepass, + dnspass=opts.dnspass, root=opts.root, nobody=opts.nobody, + nogroup=opts.nogroup, wheel=opts.wheel, users=opts.users, + aci=opts.aci, serverrole=opts.server_role, + ldap_backend=opts.ldap_backend, + ldap_backend_type=opts.ldap_backend_type) + +message("To reproduce this provision, run with:") +def shell_escape(arg): + if " " in arg: + return '"%s"' % arg + return arg +message(" ".join([shell_escape(arg) for arg in sys.argv])) + +message("All OK") -- cgit From 9e547f43036c2487e1a7e9fa3de9acb2d5bf579f Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Fri, 8 Feb 2008 12:54:09 +1100 Subject: Revert to ejs for 'provision' Andrew Bartlett (This used to be commit fa1098959ad0016770ce1c327665df08ce3f69d2) --- source4/setup/provision | 367 +++++++++++++++++++++++++----------------------- 1 file changed, 194 insertions(+), 173 deletions(-) (limited to 'source4') diff --git a/source4/setup/provision b/source4/setup/provision index 9f887e8b3b..9e135cddbb 100755 --- a/source4/setup/provision +++ b/source4/setup/provision @@ -1,173 +1,194 @@ -#!/usr/bin/python -# -# Unix SMB/CIFS implementation. -# provision a Samba4 server -# Copyright (C) Jelmer Vernooij 2007-2008 -# Copyright (C) Andrew Bartlett 2008 -# -# Based on the original in EJS: -# Copyright (C) Andrew Tridgell 2005 -# -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 3 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see . -# - -import getopt -import optparse -import os, sys - -# Add path to the library for in-tree use -sys.path.append("scripting/python") - -import samba - -from auth import system_session -import samba.getopt as options -import param -from samba.provision import (provision, - provision_paths_from_lp, - FILL_FULL, FILL_NT4SYNC, - FILL_DRS) - -parser = optparse.OptionParser("provision [options]") -sambaopts = options.SambaOptions(parser) -parser.add_option_group(sambaopts) -parser.add_option_group(options.VersionOptions(parser)) -credopts = options.CredentialsOptions(parser) -parser.add_option_group(credopts) -parser.add_option("--setupdir", type="string", metavar="DIR", - help="directory with setup files") -parser.add_option("--realm", type="string", metavar="REALM", help="set realm") -parser.add_option("--domain", type="string", metavar="DOMAIN", - help="set domain") -parser.add_option("--domain-guid", type="string", metavar="GUID", - help="set domainguid (otherwise random)") -parser.add_option("--domain-sid", type="string", metavar="SID", - help="set domainsid (otherwise random)") -parser.add_option("--policy-guid", type="string", metavar="GUID", - help="set policy guid") -parser.add_option("--host-name", type="string", metavar="HOSTNAME", - help="set hostname") -parser.add_option("--host-ip", type="string", metavar="IPADDRESS", - help="set ipaddress") -parser.add_option("--host-guid", type="string", metavar="GUID", - help="set hostguid (otherwise random)") -parser.add_option("--invocationid", type="string", metavar="GUID", - help="set invocationid (otherwise random)") -parser.add_option("--adminpass", type="string", metavar="PASSWORD", - help="choose admin password (otherwise random)") -parser.add_option("--krbtgtpass", type="string", metavar="PASSWORD", - help="choose krbtgt password (otherwise random)") -parser.add_option("--machinepass", type="string", metavar="PASSWORD", - help="choose machine password (otherwise random)") -parser.add_option("--dnspass", type="string", metavar="PASSWORD", - help="choose dns password (otherwise random)") -parser.add_option("--root", type="string", metavar="USERNAME", - help="choose 'root' unix username") -parser.add_option("--nobody", type="string", metavar="USERNAME", - help="choose 'nobody' user") -parser.add_option("--nogroup", type="string", metavar="GROUPNAME", - help="choose 'nogroup' group") -parser.add_option("--wheel", type="string", metavar="GROUPNAME", - help="choose 'wheel' privileged group") -parser.add_option("--users", type="string", metavar="GROUPNAME", - help="choose 'users' group") -parser.add_option("--quiet", help="Be quiet", action="store_true") -parser.add_option("--blank", action="store_true", - help="do not add users or groups, just the structure") -parser.add_option("--ldap-backend", type="string", metavar="LDAPSERVER", - help="LDAP server to use for this provision") -parser.add_option("--ldap-backend-type", type="choice", metavar="LDAP-BACKEND-TYPE", - help="LDB mapping module to use for the LDAP backend", - choices=["fedora-ds", "openldap"]) -parser.add_option("--aci", type="string", metavar="ACI", - help="An arbitary LDIF fragment, particularly useful to loading a backend ACI value into a target LDAP server. You must provide at least a realm and domain") -parser.add_option("--server-role", type="choice", metavar="ROLE", - choices=["domain controller", "member server"], - help="Set server role to provision for (default standalone)") -parser.add_option("--partitions-only", - help="Configure Samba's partitions, but do not modify them (ie, join a BDC)", action="store_true") -parser.add_option("--targetdir", type="string", metavar="DIR", - help="Set target directory") - -opts = parser.parse_args()[0] - -def message(text): - """print a message if quiet is not set.""" - if not opts.quiet: - print text - -if opts.realm is None or opts.domain is None: - if opts.realm is None: - print >>sys.stderr, "No realm set" - if opts.domain is None: - print >>sys.stderr, "No domain set" - parser.print_usage() - sys.exit(1) - -# cope with an initially blank smb.conf -private_dir = None -lp = sambaopts.get_loadparm() -if opts.targetdir is not None: - if not os.path.exists(opts.targetdir): - os.mkdir(opts.targetdir) - private_dir = os.path.join(opts.targetdir, "private") - if not os.path.exists(private_dir): - os.mkdir(private_dir) - lp.set("private dir", os.path.abspath(private_dir)) - lp.set("lock dir", os.path.abspath(opts.targetdir)) -lp.set("realm", opts.realm) -lp.set("workgroup", opts.domain) -lp.set("server role", opts.server_role or "domain controller") - - -if opts.aci is not None: - print "set ACI: %s" % opts.aci - -paths = provision_paths_from_lp(lp, opts.realm.lower(), private_dir) -paths.smbconf = sambaopts.get_loadparm_path() - -creds = credopts.get_credentials() - -setup_dir = opts.setupdir -if setup_dir is None: - setup_dir = "setup" - -samdb_fill = FILL_FULL -if opts.blank: - samdb_fill = FILL_NT4SYNC -elif opts.partitions_only: - samdb_fill = FILL_DRS - -provision(lp, setup_dir, message, paths, - system_session(), creds, - samdb_fill=samdb_fill, realm=opts.realm, - domainguid=opts.domain_guid, domainsid=opts.domain_sid, - policyguid=opts.policy_guid, hostname=opts.host_name, - hostip=opts.host_ip, hostguid=opts.host_guid, - invocationid=opts.invocationid, adminpass=opts.adminpass, - krbtgtpass=opts.krbtgtpass, machinepass=opts.machinepass, - dnspass=opts.dnspass, root=opts.root, nobody=opts.nobody, - nogroup=opts.nogroup, wheel=opts.wheel, users=opts.users, - aci=opts.aci, serverrole=opts.server_role, - ldap_backend=opts.ldap_backend, - ldap_backend_type=opts.ldap_backend_type) - -message("To reproduce this provision, run with:") -def shell_escape(arg): - if " " in arg: - return '"%s"' % arg - return arg -message(" ".join([shell_escape(arg) for arg in sys.argv])) - -message("All OK") +#!/bin/sh +exec smbscript "$0" ${1+"$@"} +/* + provision a Samba4 server + Copyright Andrew Tridgell 2005 + Released under the GNU GPL v2 or later +*/ + +options = GetOptions(ARGV, + "POPT_AUTOHELP", + "POPT_COMMON_SAMBA", + "POPT_COMMON_VERSION", + "POPT_COMMON_CREDENTIALS", + 'realm=s', + 'domain=s', + 'domain-guid=s', + 'domain-sid=s', + 'policy-guid=s', + 'host-name=s', + 'host-ip=s', + 'host-guid=s', + 'invocationid=s', + 'adminpass=s', + 'krbtgtpass=s', + 'machinepass=s', + 'dnspass=s', + 'root=s', + 'nobody=s', + 'nogroup=s', + 'wheel=s', + 'users=s', + 'quiet', + 'blank', + 'server-role=s', + 'partitions-only', + 'ldap-base', + 'ldap-backend=s', + 'ldap-module=s', + 'aci=s'); + +if (options == undefined) { + println("Failed to parse options"); + return -1; +} + +libinclude("base.js"); +libinclude("provision.js"); + +/* + print a message if quiet is not set +*/ +function message() +{ + if (options["quiet"] == undefined) { + print(vsprintf(arguments)); + } +} + +/* + show some help +*/ +function ShowHelp() +{ + print(" +Samba4 provisioning + +provision [options] + --realm REALM set realm + --domain DOMAIN set domain + --domain-guid GUID set domainguid (otherwise random) + --domain-sid SID set domainsid (otherwise random) + --host-name HOSTNAME set hostname + --host-ip IPADDRESS set ipaddress + --host-guid GUID set hostguid (otherwise random) + --policy-guid GUID set group policy guid (otherwise random) + --invocationid GUID set invocationid (otherwise random) + --adminpass PASSWORD choose admin password (otherwise random) + --krbtgtpass PASSWORD choose krbtgt password (otherwise random) + --machinepass PASSWORD choose machine password (otherwise random) + --root USERNAME choose 'root' unix username + --nobody USERNAME choose 'nobody' user + --nogroup GROUPNAME choose 'nogroup' group + --wheel GROUPNAME choose 'wheel' privileged group + --users GROUPNAME choose 'users' group + --quiet Be quiet + --blank do not add users or groups, just the structure + --server-role ROLE Set server role to provision for (default standalone) + --partitions-only Configure Samba's partitions, but do not modify them (ie, join a BDC) + --ldap-base output only an LDIF file, suitable for creating an LDAP baseDN + --ldap-backend LDAPSERVER LDAP server to use for this provision + --ldap-module MODULE LDB mapping module to use for the LDAP backend + --aci ACI An arbitary LDIF fragment, particularly useful to loading a backend ACI value into a target LDAP server +You must provide at least a realm and domain + +"); + exit(1); +} + +if (options['host-name'] == undefined) { + options['host-name'] = hostname(); +} + +/* + main program +*/ +if (options["realm"] == undefined || + options["domain"] == undefined || + options["host-name"] == undefined) { + ShowHelp(); +} + +/* cope with an initially blank smb.conf */ +var lp = loadparm_init(); +lp.set("realm", options.realm); +lp.set("workgroup", options.domain); +lp.set("server role", options["server-role"]); +lp.reload(); + +var subobj = provision_guess(); +for (r in options) { + var key = strupper(join("", split("-", r))); + subobj[key] = options[r]; +} + +var blank = (options["blank"] != undefined); +var ldapbackend = (options["ldap-backend"] != undefined); +var ldapmodule = (options["ldap-module"] != undefined); +var partitions_only = (options["partitions-only"] != undefined); +var paths = provision_default_paths(subobj); +if (options["aci"] != undefined) { + message("set ACI: %s\n", subobj["ACI"]); +} + +message("set DOMAIN SID: %s\n", subobj["DOMAINSID"]); + +provision_fix_subobj(subobj, paths); + +if (ldapbackend) { + if (options["ldap-backend"] == "ldapi") { + subobj.LDAPBACKEND = subobj.LDAPI_URI; + } + if (!ldapmodule) { + subobj.LDAPMODULE = "normalise,entryuuid"; + subobj.TDB_MODULES_LIST = ""; + } + subobj.BACKEND_MOD = subobj.LDAPMODULE + ",paged_searches"; + subobj.DOMAINDN_LDB = subobj.LDAPBACKEND; + subobj.CONFIGDN_LDB = subobj.LDAPBACKEND; + subobj.SCHEMADN_LDB = subobj.LDAPBACKEND; + message("LDAP module: %s on backend: %s\n", subobj.LDAPMODULE, subobj.LDAPBACKEND); +} + +if (!provision_validate(subobj, message)) { + return -1; +} + +var system_session = system_session(); +var creds = options.get_credentials(); +message("Provisioning for %s in realm %s\n", subobj.DOMAIN, subobj.REALM); +message("Using administrator password: %s\n", subobj.ADMINPASS); +if (partitions_only) { + provision_become_dc(subobj, message, false, paths, system_session); +} else { + provision(subobj, message, blank, paths, system_session, creds, ldapbackend); + provision_dns(subobj, message, paths, system_session, creds); + message("To reproduce this provision, run with:\n"); +/* There has to be a better way than this... */ + message("--realm='%s' --domain='%s' \\\n", subobj.REALM_CONF, subobj.DOMAIN_CONF); + if (subobj.DOMAINGUID != undefined) { + message("--domain-guid='%s' \\\n", subobj.DOMAINGUID); + } + if (subobj.HOSTGUID != undefined) { + message("--host-guid='%s' \\\n", subobj.HOSTGUID); + } + message("--policy-guid='%s' --host-name='%s' --host-ip='%s' \\\n", subobj.POLICYGUID, subobj.HOSTNAME, subobj.HOSTIP); + if (subobj.INVOCATIONID != undefined) { + message("--invocationid='%s' \\\n", subobj.INVOCATIONID); + } + message("--adminpass='%s' --krbtgtpass='%s' \\\n", subobj.ADMINPASS, subobj.KRBTGTPASS); + message("--machinepass='%s' --dnspass='%s' \\\n", subobj.MACHINEPASS, subobj.DNSPASS); + message("--root='%s' --nobody='%s' --nogroup='%s' \\\n", subobj.ROOT, subobj.NOBODY, subobj.NOGROUP); + message("--wheel='%s' --users='%s' --server-role='%s' \\\n", subobj.WHEEL, subobj.USERS, subobj.SERVERROLE); + if (ldapbackend) { + message("--ldap-backend='%s' \\\n", subobj.LDAPBACKEND); + } + if (ldapmodule) { + message("--ldap-module='%s' \\\n", + subobj.LDAPMODULE); + } + message("--aci='" + subobj.ACI + "' \\\n") +} + + +message("All OK\n"); +return 0; -- cgit From 6e965b139d89cfebbb1c3fcf3a885f4b83f5788f Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Sat, 9 Feb 2008 14:01:37 +1100 Subject: Make the provision test more real, use a foo.example.com for the realm. Andrew Bartlett (This used to be commit b7ea06850a91b0593178227f713803e9ce98cc47) --- source4/selftest/samba4_tests.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'source4') diff --git a/source4/selftest/samba4_tests.sh b/source4/selftest/samba4_tests.sh index 17b6020abb..d00b492953 100755 --- a/source4/selftest/samba4_tests.sh +++ b/source4/selftest/samba4_tests.sh @@ -330,5 +330,5 @@ then rm -rf $PREFIX/upgrade plantest "blackbox.upgrade" none $PYTHON setup/upgrade.py $CONFIGURATION --targetdir=$PREFIX/upgrade ../testdata/samba3 ../testdata/samba3/smb.conf rm -rf $PREFIX/provision - plantest "blackbox.provision.py" none $PYTHON ./setup/provision.py $CONFIGURATION --domain=FOO --realm=foo --targetdir=$PREFIX/provision + plantest "blackbox.provision.py" none $PYTHON ./setup/provision.py $CONFIGURATION --domain=FOO --realm=foo.example.com --targetdir=$PREFIX/provision fi -- cgit From 19fcdb2e8ad2be30903d694eb2b76a08db54a205 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Sat, 9 Feb 2008 14:02:14 +1100 Subject: Give a more useful error when the templates.ldb can't be found. Andrew Bartlett (This used to be commit 26108eb66b4b5d4b339dfc845e8a018190068e81) --- source4/dsdb/samdb/samdb.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'source4') diff --git a/source4/dsdb/samdb/samdb.c b/source4/dsdb/samdb/samdb.c index c11eea1757..a01e442587 100644 --- a/source4/dsdb/samdb/samdb.c +++ b/source4/dsdb/samdb/samdb.c @@ -103,8 +103,8 @@ int samdb_copy_template(struct ldb_context *ldb, if (!templates_ldb) { templates_ldb_path = samdb_relative_path(ldb, - msg, - "templates.ldb"); + msg, + "templates.ldb"); if (!templates_ldb_path) { *errstring = talloc_asprintf(msg, "samdb_copy_template: ERROR: Failed to contruct path for template db"); return LDB_ERR_OPERATIONS_ERROR; @@ -115,6 +115,8 @@ int samdb_copy_template(struct ldb_context *ldb, NULL, 0, NULL); talloc_free(templates_ldb_path); if (!templates_ldb) { + *errstring = talloc_asprintf(msg, "samdb_copy_template: ERROR: Failed to connect to templates db at: %s", + templates_ldb_path); return LDB_ERR_OPERATIONS_ERROR; } -- cgit From d08eabdf91cade7f034468811d6228e75c69c1b5 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Sat, 9 Feb 2008 14:13:23 +1100 Subject: Remove the forced 'krb5' from the NET-API-BECOME-DC test. If we want to try this authenication mechanism, we can always manually specify the binding string. Andrew Bartlett (This used to be commit 191d56d41e5af34e78e1ad711fb1c63c189f0b48) --- source4/libnet/libnet_become_dc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'source4') diff --git a/source4/libnet/libnet_become_dc.c b/source4/libnet/libnet_become_dc.c index f2c1f70bfc..c9185c749b 100644 --- a/source4/libnet/libnet_become_dc.c +++ b/source4/libnet/libnet_become_dc.c @@ -1514,10 +1514,10 @@ static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s, if (!drsuapi->binding) { if (lp_parm_bool(s->libnet->lp_ctx, NULL, "become_dc", "print", false)) { - binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[krb5,print,seal]", s->source_dsa.dns_name); + binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[print,seal]", s->source_dsa.dns_name); if (composite_nomem(binding_str, c)) return; } else { - binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[krb5,seal]", s->source_dsa.dns_name); + binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[seal]", s->source_dsa.dns_name); if (composite_nomem(binding_str, c)) return; } c->status = dcerpc_parse_binding(s, binding_str, &drsuapi->binding); -- cgit