1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
|
#!/usr/bin/python
# vim: expandtab ft=python
#
# Unix SMB/CIFS implementation.
# Test validity of smb.conf
# Copyright (C) Karl Auer 1993, 1994-1998
#
# Extensively modified by Andrew Tridgell, 1995
# Converted to popt by Jelmer Vernooij (jelmer@nl.linux.org), 2002
# Updated for Samba4 by Andrew Bartlett <abartlet@samba.org> 2006
# Converted to Python by Jelmer Vernooij <jelmer@samba.org> 2010
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# Testbed for loadparm.c/params.c
#
# This module simply loads a specified configuration file and
# if successful, dumps it's contents to stdout. Note that the
# operation is performed with DEBUGLEVEL at 3.
#
# Useful for a quick 'syntax check' of a configuration file.
#
import logging
import optparse
import os
import sys
# Find right directory when running from source tree
sys.path.insert(0, "bin/python")
import samba
from samba import getopt as options
# Here we do a set of 'hard coded' checks for bad
# configuration settings.
def do_global_checks(lp, logger):
ret = False
lockdir = lp.get("lockdir")
if not os.path.isdir(lockdir):
logger.error("lock directory %s does not exist", lockdir)
ret = True
piddir = lp.get("pid directory")
if os.path.isdir(piddir):
logger.error("pid directory %s does not exist", piddir)
ret = True
winbind_separator = lp.get("winbind separator")
if len(winbind_separator) != 1:
logger.error("the 'winbind separator' parameter must be a single character.")
ret = True
if winbind_separator == '+':
logger.error("'winbind separator = +' might cause problems with group membership.")
return ret
def allow_access(deny_list, allow_list, cname, caddr):
raise NotImplementedError(allow_access)
def do_share_checks(lp, logger):
for s in lp.services():
if len(s) > 12:
logger.warning("You have some share names that are longer than 12 characters. These may not be accessible to some older clients. (Eg. Windows9x, WindowsMe, and not listed in smbclient in Samba 3.0.)")
break
for s in lp.services():
deny_list = lp.get("hosts deny", s)
allow_list = lp.get("hosts allow", s)
if deny_list:
for entry in deny_list:
if "*" in entry or "?" in entry:
logger.error("Invalid character (* or ?) in hosts deny list (%s) for service %s.", entry, s)
if allow_list:
for entry in allow_list:
if "*" in entry or "?" in entry:
logger.error("Invalid character (* or ?) in hosts allow list (%s) for service %s.", entry, s)
def dump(lp, section_name=None, parameter_name=None, silent_mode=False,
show_defaults=False):
if not silent_mode:
print "Press enter to see a dump of your service definitions\n"
sys.stdin.readline()
if section_name is not None or parameter_name is not None:
if parameter_name is None:
lp.dump_service(sys.stdout, section_name, show_defaults)
else:
lp.dump_parameter(sys.stdout, section_name, parameter_name)
else:
lp.dump(sys.stdout, show_defaults)
def check_client_access(lp, cname, caddr):
# this is totally ugly, a real `quick' hack
for s in lp.services():
if (allow_access(lp.get("hosts deny"), lp.get("hosts allow"), cname, caddr) and
allow_access(lp.get("hosts deny", s), lp.get("hosts allow", s), cname, caddr)):
logger.info("Allow connection from %s (%s) to %s",
cname, caddr, s)
else:
logger.info("Deny connection from %s (%s) to %s",
cname, caddr, s)
if __name__ == '__main__':
parser = optparse.OptionParser("testparm [OPTION...] [host-name] [host-ip]")
parser.add_option("--section-name", type="string", metavar="SECTION",
help="Limit testparm to a named section")
parser.add_option("--parameter-name", type="string", metavar="PARAMETER",
help="Limit testparm to a named parameter")
parser.add_option("--client-name", type="string", metavar="HOSTNAME",
help="Client DNS name for 'hosts allow' checking (should match reverse lookup)")
parser.add_option("--client-ip", type="string", metavar="IP",
help="Client IP address for 'hosts allow' checking")
parser.add_option("--suppress-prompt", action="store_true",
help="Suppress prompt for enter")
parser.add_option("--verbose", action="store_true",
help="Show default options too")
parser.add_option_group(options.VersionOptions(parser))
# We need support for smb.conf macros before this will work again
parser.add_option("--server", type="string",
help="Set %%L macro to servername")
# These are harder to do with the new code structure
parser.add_option("--show-all-parameters", action="store_true",
help="Show the parameters, type, possible values")
sambaopts = options.SambaOptions(parser)
parser.add_option_group(sambaopts)
opts, args = parser.parse_args()
#
# if (show_all_parameters) {
# show_parameter_list()
# exit(0)
# }
if len(args) > 0:
cname = args[0]
else:
cname = None
if len(args) > 1:
caddr = args[1]
else:
caddr = None
if cname is not None and caddr is None:
print "ERROR: For 'hosts allow' check you must specify both a DNS name and an IP address.\n"
sys.exit(1)
# FIXME: We need support for smb.conf macros before this will work again
#
# if (new_local_machine) {
# set_local_machine_name(new_local_machine, True)
# }
lp = sambaopts.get_loadparm()
# We need this to force the output
samba.set_debug_level(2)
logger = logging.getLogger("testparm")
print "Loaded smb config files from %s\n" % lp.configfile
logger.info("Loaded services file OK.")
do_global_checks(lp, logger)
do_share_checks(lp, logger)
if cname is not None:
check_client_access(lp, cname, caddr)
else:
dump(lp, opts.section_name, opts.parameter_name,
not opts.suppress_prompt, opts.verbose)
sys.exit(0)
|
