/* Samba Unix/Linux SMB client library Distributed SMB/CIFS Server Management Utility Copyright (C) 2001 Steve French (sfrench@us.ibm.com) Copyright (C) 2001 Jim McDonough (jmcd@us.ibm.com) Copyright (C) 2001 Andrew Tridgell (tridge@samba.org) Copyright (C) 2001 Andrew Bartlett (abartlet@samba.org) Copyright (C) 2008 Kai Blin (kai@samba.org) Originally written by Steve and Jim. Largely rewritten by tridge in November 2001. Reworked again by abartlet in December 2001 Another overhaul, moving functionality into plug-ins loaded on demand by Kai in May 2008. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ /*****************************************************/ /* */ /* Distributed SMB/CIFS Server Management Utility */ /* */ /* The intent was to make the syntax similar */ /* to the NET utility (first developed in DOS */ /* with additional interesting & useful functions */ /* added in later SMB server network operating */ /* systems). */ /* */ /*****************************************************/ #include "includes.h" #include "utils/net.h" extern bool AllowDebugChange; #ifdef WITH_FAKE_KASERVER #include "utils/net_afs.h" #endif /***********************************************************************/ /* Beginning of internationalization section. Translatable constants */ /* should be kept in this area and referenced in the rest of the code. */ /* */ /* No functions, outside of Samba or LSB (Linux Standards Base) should */ /* be used (if possible). */ /***********************************************************************/ #define YES_STRING "Yes" #define NO_STRING "No" /***********************************************************************/ /* end of internationalization section */ /***********************************************************************/ uint32 get_sec_channel_type(const char *param) { if (!(param && *param)) { return get_default_sec_channel(); } else { if (strequal(param, "PDC")) { return SEC_CHAN_BDC; } else if (strequal(param, "BDC")) { return SEC_CHAN_BDC; } else if (strequal(param, "MEMBER")) { return SEC_CHAN_WKSTA; #if 0 } else if (strequal(param, "DOMAIN")) { return SEC_CHAN_DOMAIN; #endif } else { return get_default_sec_channel(); } } } static int net_changetrustpw(struct net_context *c, int argc, const char **argv) { if (net_ads_check_our_domain(c) == 0) return net_ads_changetrustpw(c, argc, argv); return net_rpc_changetrustpw(c, argc, argv); } static void set_line_buffering(FILE *f) { setvbuf(f, NULL, _IOLBF, 0); } static int net_changesecretpw(struct net_context *c, int argc, const char **argv) { char *trust_pw; uint32 sec_channel_type = SEC_CHAN_WKSTA; if(c->opt_force) { if (c->opt_stdin) { set_line_buffering(stdin); set_line_buffering(stdout); set_line_buffering(stderr); } trust_pw = get_pass("Enter machine password: ", c->opt_stdin); if (!secrets_store_machine_password(trust_pw, lp_workgroup(), sec_channel_type)) { d_fprintf(stderr, "Unable to write the machine account password in the secrets database"); return 1; } else { d_printf("Modified trust account password in secrets database\n"); } } else { d_printf("Machine account password change requires the -f flag.\n"); d_printf("Do NOT use this function unless you know what it does!\n"); d_printf("This function will change the ADS Domain member machine account password in the secrets.tdb file!\n"); } return 0; } /* Retrieve our local SID or the SID for the specified name */ static int net_getlocalsid(struct net_context *c, int argc, const char **argv) { DOM_SID sid; const char *name; fstring sid_str; if (argc >= 1) { name = argv[0]; } else { name = global_myname(); } if(!initialize_password_db(false, NULL)) { DEBUG(0, ("WARNING: Could not open passdb - local sid may not reflect passdb\n" "backend knowledge (such as the sid stored in LDAP)\n")); } /* first check to see if we can even access secrets, so we don't panic when we can't. */ if (!secrets_init()) { d_fprintf(stderr, "Unable to open secrets.tdb. Can't fetch domain SID for name: %s\n", name); return 1; } /* Generate one, if it doesn't exist */ get_global_sam_sid(); if (!secrets_fetch_domain_sid(name, &sid)) { DEBUG(0, ("Can't fetch domain SID for name: %s\n", name)); return 1; } sid_to_fstring(sid_str, &sid); d_printf("SID for domain %s is: %s\n", name, sid_str); return 0; } static int net_setlocalsid(struct net_context *c, int argc, const char **argv) { DOM_SID sid; if ( (argc != 1) || (strncmp(argv[0], "S-1-5-21-", strlen("S-1-5-21-")) != 0) || (!string_to_sid(&sid, argv[0])) || (sid.num_auths != 4)) { d_printf("usage: net setlocalsid S-1-5-21-x-y-z\n"); return 1; } if (!secrets_store_domain_sid(global_myname(), &sid)) { DEBUG(0,("Can't store domain SID as a pdc/bdc.\n")); return 1; } return 0; } static int net_setdomainsid(struct net_context *c, int argc, const char **argv) { DOM_SID sid; if ( (argc != 1) || (strncmp(argv[0], "S-1-5-21-", strlen("S-1-5-21-")) != 0) || (!string_to_sid(&sid, argv[0])) || (sid.num_auths != 4)) { d_printf("usage: net setdomainsid S-1-5-21-x-y-z\n"); return 1; } if (!secrets_store_domain_sid(lp_workgroup(), &sid)) { DEBUG(0,("Can't store domain SID.\n")); return 1; } return 0; } static int net_getdomainsid(struct net_context *c, int argc, const char **argv) { DOM_SID domain_sid; fstring sid_str; if (argc > 0) { d_printf("usage: net getdomainsid\n"); return 1; } if(!initialize_password_db(false, NULL)) { DEBUG(0, ("WARNING: Could not open passdb - domain SID may " "not reflect passdb\n" "backend knowledge (such as the SID stored in " "LDAP)\n")); } /* first check to see if we can even access secrets, so we don't panic when we can't. */ if (!secrets_init()) { d_fprintf(stderr, "Unable to open secrets.tdb. Can't fetch domain" "SID for name: %s\n", get_global_sam_name()); return 1; } /* Generate one, if it doesn't exist */ get_global_sam_sid(); if (!secrets_fetch_domain_sid(global_myname(), &domain_sid)) { d_fprintf(stderr, "Could not fetch local SID\n"); return 1; } sid_to_fstring(sid_str, &domain_sid); d_printf("SID for local machine %s is: %s\n", global_myname(), sid_str); if (!secrets_fetch_domain_sid(c->opt_workgroup, &domain_sid)) { d_fprintf(stderr, "Could not fetch domain SID\n"); return 1; } sid_to_fstring(sid_str, &domain_sid); d_printf("SID for domain %s is: %s\n", c->opt_workgroup, sid_str); return 0; } static bool search_maxrid(struct pdb_search *search, const char *type, uint32 *max_rid) { struct samr_displayentry *entries; uint32 i, num_entries; if (search == NULL) { d_fprintf(stderr, "get_maxrid: Could not search %s\n", type); return false; } num_entries = pdb_search_entries(search, 0, 0xffffffff, &entries); for (i=0; iopt_target_workgroup}, {"user", 'U', POPT_ARG_STRING, &c->opt_user_name, 'U'}, {"ipaddress", 'I', POPT_ARG_STRING, 0,'I'}, {"port", 'p', POPT_ARG_INT, &c->opt_port}, {"myname", 'n', POPT_ARG_STRING, &c->opt_requester_name}, {"server", 'S', POPT_ARG_STRING, &c->opt_host}, {"encrypt", 'e', POPT_ARG_NONE, NULL, 'e', "Encrypt SMB transport (UNIX extended servers only)" }, {"container", 'c', POPT_ARG_STRING, &c->opt_container}, {"comment", 'C', POPT_ARG_STRING, &c->opt_comment}, {"maxusers", 'M', POPT_ARG_INT, &c->opt_maxusers}, {"flags", 'F', POPT_ARG_INT, &c->opt_flags}, {"long", 'l', POPT_ARG_NONE, &c->opt_long_list_entries}, {"reboot", 'r', POPT_ARG_NONE, &c->opt_reboot}, {"force", 'f', POPT_ARG_NONE, &c->opt_force}, {"stdin", 'i', POPT_ARG_NONE, &c->opt_stdin}, {"timeout", 't', POPT_ARG_INT, &c->opt_timeout}, {"machine-pass",'P', POPT_ARG_NONE, &c->opt_machine_pass}, {"myworkgroup", 'W', POPT_ARG_STRING, &c->opt_workgroup}, {"verbose", 'v', POPT_ARG_NONE, &c->opt_verbose}, {"test", 'T', POPT_ARG_NONE, &c->opt_testmode}, /* Options for 'net groupmap set' */ {"local", 'L', POPT_ARG_NONE, &c->opt_localgroup}, {"domain", 'D', POPT_ARG_NONE, &c->opt_domaingroup}, {"ntname", 'N', POPT_ARG_STRING, &c->opt_newntname}, {"rid", 'R', POPT_ARG_INT, &c->opt_rid}, /* Options for 'net rpc share migrate' */ {"acls", 0, POPT_ARG_NONE, &c->opt_acls}, {"attrs", 0, POPT_ARG_NONE, &c->opt_attrs}, {"timestamps", 0, POPT_ARG_NONE, &c->opt_timestamps}, {"exclude", 'X', POPT_ARG_STRING, &c->opt_exclude}, {"destination", 0, POPT_ARG_STRING, &c->opt_destination}, {"tallocreport", 0, POPT_ARG_NONE, &c->do_talloc_report}, POPT_COMMON_SAMBA { 0, 0, 0, 0} }; zero_addr(&c->opt_dest_ip); load_case_tables(); /* set default debug level to 0 regardless of what smb.conf sets */ DEBUGLEVEL_CLASS[DBGC_ALL] = 0; dbf = x_stderr; pc = poptGetContext(NULL, argc, (const char **) argv, long_options, POPT_CONTEXT_KEEP_FIRST); while((opt = poptGetNextOpt(pc)) != -1) { switch (opt) { case 'h': net_help(c, argc, argv); exit(0); break; case 'e': c->smb_encrypt = true; break; case 'I': if (!interpret_string_addr(&c->opt_dest_ip, poptGetOptArg(pc), 0)) { d_fprintf(stderr, "\nInvalid ip address specified\n"); } else { c->opt_have_ip = true; } break; case 'U': c->opt_user_specified = true; c->opt_user_name = SMB_STRDUP(c->opt_user_name); p = strchr(c->opt_user_name,'%'); if (p) { *p = 0; c->opt_password = p+1; } break; default: d_fprintf(stderr, "\nInvalid option %s: %s\n", poptBadOption(pc, 0), poptStrerror(opt)); net_help(c, argc, argv); exit(1); } } /* * Don't load debug level from smb.conf. It should be * set by cmdline arg or remain default (0) */ AllowDebugChange = false; lp_load(get_dyn_CONFIGFILE(), true, false, false, true); argv_new = (const char **)poptGetArgs(pc); argc_new = argc; for (i=0; ido_talloc_report) { talloc_enable_leak_report(); } if (c->opt_requester_name) { set_global_myname(c->opt_requester_name); } if (!c->opt_user_name && getenv("LOGNAME")) { c->opt_user_name = getenv("LOGNAME"); } if (!c->opt_workgroup) { c->opt_workgroup = smb_xstrdup(lp_workgroup()); } if (!c->opt_target_workgroup) { c->opt_target_workgroup = smb_xstrdup(lp_workgroup()); } if (!init_names()) exit(1); load_interfaces(); /* this makes sure that when we do things like call scripts, that it won't assert becouse we are not root */ sec_init(); if (c->opt_machine_pass) { /* it is very useful to be able to make ads queries as the machine account for testing purposes and for domain leave */ net_use_krb_machine_account(c); } if (!c->opt_password) { c->opt_password = getenv("PASSWD"); } rc = net_run_function2(c, argc_new-1, argv_new+1, "net", net_func); DEBUG(2,("return code = %d\n", rc)); libnetapi_free(c->netapi_ctx); poptFreeContext(pc); TALLOC_FREE(frame); return rc; }