HEX
Server: Apache/2.4.52 (Ubuntu)
System: Linux spn-python 5.15.0-89-generic #99-Ubuntu SMP Mon Oct 30 20:42:41 UTC 2023 x86_64
User: arjun (1000)
PHP: 8.1.2-1ubuntu2.20
Disabled: NONE
$ pwd: /usr/lib/python3/dist-packages/samba/netcmd/__pycache__/
Upload Files
File: //usr/lib/python3/dist-packages/samba/netcmd/__pycache__/pso.cpython-310.pyc
o

�/a���
@s�ddlmZddlZddlmZddlmZmZm	Z	m
Z
ddlmZm
Z
ddlmZddlmZmZmZdd�Zd	d
�Zdd�ZdHdd�Zdd�Zdd�Zdd�Z					dIdd�Z		dJdd�Ze	ddddgdd�e	d dddgd!d�e	d"d#ed$�e	d%d&ed$�e	d'd(ed$�e	d)d*ed$�e	d+ed,d-�e	d.ed/d-�e	d0d1ed$�g	Zd2d3�ZGd4d5�d5e�Z Gd6d7�d7e�Z!Gd8d9�d9e�Z"d:d;�Z#Gd<d=�d=e�Z$Gd>d?�d?e�Z%Gd@dA�dAe�Z&GdBdC�dCe�Z'GdDdE�dEe�Z(GdFdG�dGe
�Z)dS)K�N)�SamDB)�Command�CommandError�Option�SuperCommand)�DOMAIN_PASSWORD_COMPLEX�DOMAIN_PASSWORD_STORE_CLEARTEXT)�system_session)�NEVER_TIMESTAMP�timestamp_to_mins�timestamp_to_dayscCsd|��S)Nz+CN=Password Settings Container,CN=System,%s)�	domain_dn)�samdb�r�2/usr/lib/python3/dist-packages/samba/netcmd/pso.py�
pso_containersrcCstd|�}t|�S)z4Converts a value in minutes to -100 nanosecond unitsg��A)�int�str)�mins�	timestamprrr�mins_to_timestamp"srcCst|dd�}t|�S)z1Converts a value in days to -100 nanosecond units�<�)rr)�daysrrrr�days_to_timestamp(srTc	Cs�ddd�}gd�}|j|tj|d�}|d}|�d|d�|�d	�|�d
|d�t|d�}|�d
||�t|d�}|�d||�|�d|d�|�d|d�|�dt|dd��|�dt|dd��|�dt|dd��|�d|d�|�dt|dd��|r�d|vr�|�dt|d��|dD]	}|�d |�q�d"S|�d!�d"Sd"S)#z8Displays the password settings for a PSO specified by DN�on�off)�TRUE�FALSE)�name�msDS-PasswordSettingsPrecedence�(msDS-PasswordReversibleEncryptionEnabled�msDS-PasswordHistoryLength�msDS-MinimumPasswordLength�msDS-PasswordComplexityEnabled�msDS-MinimumPasswordAge�msDS-MaximumPasswordAge�msDS-LockoutObservationWindow�msDS-LockoutThreshold�msDS-LockoutDuration�msDS-PSOAppliesTo��scope�attrsrz"Password information for PSO '%s'
r�
z Precedence (lowest is best): %s
r r$zPassword complexity: %s
r!zStore plaintext passwords: %s
zPassword history length: %s
r"zMinimum password length: %s
r#z Minimum password age (days): %d
r%z Maximum password age (days): %d
r&z$Account lockout duration (mins): %d
r)z)Account lockout threshold (attempts): %s
r(z'Reset account lockout after (mins): %d
r'r*z*
PSO applies directly to %d groups/users:
z  %s
z2
Note: PSO does not apply to any users or groups.
N)�search�ldb�
SCOPE_BASE�writerrr�len)	�outfr�dn�show_applies_to�
on_off_str�	pso_attrs�res�pso_res�bool_strrrr�show_pso_by_dn.sX

��������
���r<c
Csjz|j|tjdgd�}Wntjy(}z|jdtjkr#td|���d}~wwd|dvr3td��dS)z=Gracefully bail out if we can't view/modify the PSO specifiedr r+rzUnable to find PSO '%s'Nz/You may not have permission to view/modify PSOs)r/r0r1�LdbError�args�ERR_NO_SUCH_OBJECTr)r�pso_dnrr9�errr�check_pso_valid`s

����rBcCs�d|}|j|��tj|ddgd�}t|�dkr!|�d|�dSd|dvr5|�d|�|�d�dSt||dddd	�|�d
|�t|||ddddd�d|dvrc|�d
�dS|�d�dS)z2Displays the password settings for a specific userz((&(sAMAccountName=%s)(objectClass=user))zmsDS-ResultantPSOzmsDS-PSOApplied)r,�
expressionr-rzUser '%s' not found.
z@No PSO applies to user '%s'. The default domain settings apply.
z4Refer to 'samba-tool domain passwordsettings show'.
z???z0The following PSO settings apply to user '%s'.

F�r6zD
Note: PSO applies directly to user (any group PSOs are overridden)
z+
PSO applies to user via group membership.
N)r/r
r0�
SCOPE_SUBTREEr3r2rBr<)r4r�username�
search_filterr9rrr�show_pso_for_userqs,����rHcCst�|||�||<dS)N)r0�MessageElement)�msg�	attr_name�value�ldb_operrrr�msg_add_attr�srNcCsxt��}t�||�|_|rtj}t�d|d�|d<ntj}|dur*t|dt|�|�|dur=|dkr4dnd}t|d	||�|durP|dkrGdnd}t|d
||�|dur]t|dt|�|�|	durjt|dt|	�|�|
duryt	|
�}t|d
||�|dur�|dkr�tt
�}nt	|�}t|d||�|dur�t|�}t|d||�|dur�t|dt|�|�|
dur�t|dt|
�|�|S)z0Packs the given PSO settings into an LDB messagezmsDS-PasswordSettings�objectClasszmsDS-objectClassNr rrrr$r!r"r#r%rr&r)r(r')r0�Message�Dnr5�FLAG_MOD_ADDrI�FLAG_MOD_REPLACErNrrr
r)r4rr@�create�lockout_threshold�
complexity�
precedence�store_plaintext�history_length�min_pwd_length�min_pwd_age�max_pwd_age�lockout_duration�reset_lockout_after�mrMr;�min_pwd_age_ticks�max_pwd_age_ticks�lockout_duration_ticksrrr�make_pso_ldb_msg�sh
������
���rccCsh|dur|dkrtd��|dur|dkrtd��|dur,|dur.||kr0|dkr2td��dSdSdSdS)z,Checks PSO settings fall within valid rangesNiz5Bad password history length: valid range is 0 to 1024�z4Bad minimum password length: valid range is 0 to 255rz2Minimum password age must be less than maximum age)r)rZrYr[r\rrr�check_pso_constraints�s�rez--complexity�choicerrz#The password complexity (on | off).)�type�choices�helpz--store-plaintextziStore plaintext passwords where account have 'store passwords with reversible encryption' set (on | off).z--history-lengthz(The password history length (<integer>).)rirgz--min-pwd-lengthz(The minimum password length (<integer>).z
--min-pwd-agezHThe minimum password age (<integer in days>). Default is domain setting.z
--max-pwd-agezHThe maximum password age (<integer in days>). Default is domain setting.z--account-lockout-durationz�The length of time an account is locked out after exceeding the limit on bad password attempts (<integer in mins>). Default is domain setting�rgriz--account-lockout-thresholdzrThe number of bad password attempts allowed before locking out the account (<integer>). Default is domain setting.z--reset-account-lockout-afterz~After this time is elapsed, the recorded number of attempts restarts from zero (<integer in mins>). Default is domain setting.cCs0d}|D]}|D]}t|�|vr|d7}qq|S)z�
    Returns the number of options specified that are present in the args.
    (There can be other args besides just the ones we're interested in, which
    is why argc on its own is not enough)
    r�)r)�optionsr>�num_opts�opt�argrrr�num_options_in_argss��rpc	@s^eZdZdZdZejejejd�Z	e
eddddded	�gZ
d
dgZ						dd
d�ZdS)�!cmd_domain_pwdsettings_pso_createa�Creates a new Password Settings Object (PSO).

    PSOs are a way to tailor different password settings (lockout policy,
    minimum password length, etc) for specific users or groups.

    The psoname is a unique name for the new Password Settings Object.
    When multiple PSOs apply to a user, the precedence determines which PSO
    will take effect. The PSO with the lowest precedence will take effect.

    For most arguments, the default value (if unspecified) is the current
    domain passwordsettings value. To see these values, enter the command
    'samba-tool domain passwordsettings show'.

    To apply the new PSO to user(s) or group(s), enter the command
    'samba-tool domain passwordsettings pso apply'.
    z&%prog <psoname> <precedence> [options]��	sambaopts�versionopts�credopts�-H�--URL�%LDB URL for database or target server�URL�H�ri�metavar�destrg�psonamerWNcCs�|��}|
�|�}t|t�||d�}zt|�}Wnty#td��wd|t|�f}z
|j|t	j
d�}Wnt	jyS}z|jdt	j
krHn�WYd}~nd}~wwtd|��tt|j�}|dkrhtd��|tt�krx|�d�|�d	�|j|��t	j
gd
�d�}t|�dks�J�t|dd
d�}|dur�t}||@r�dnd}|dur�t}||@r�dnd}|dur�t|ddd�}|	dur�t|ddd�}	|dur�t|ddd�}|dur�t|ddd�}|
dur�t|ddd�}
|du�rt|ddd�}|du�rt|ddd�}t||||	d�t|j||d|||||	|||
||d�}z|�|�|�d|�t|j||dd�WdSt	j�yo}z|j\}}|t	jk�rctd��td||f��d}~ww)N��url�session_info�credentials�lpz<The PSO's precedence should be a numerical value. Try --help�CN=%s,%s)r,rzPSO '%s' already exists�?Please specify at least one password policy setting. Try --helpz4Not all password policy options have been specified.zaFor unspecified options, the current domain password settings will be used as the default values.)�
pwdProperties�pwdHistoryLength�minPwdLength�	minPwdAge�	maxPwdAge�lockoutDuration�lockoutThreshold�lockOutObservationWindowr+rkr�rrr�r�r�r�r�r�r��r\r[rYrZT�rTrVrWrXrYrZr[r\r]rUr^zPSO successfully created: %sFrDz5Administrator permissions are needed to create a PSO.zFailed to create PSO '%s': %s)�get_loadparm�get_credentialsrr	r�
ValueErrorrrr/r0r1r=r>r?rp�pwd_settings_options�raw_argvr3�messager
rrrrrercr4�addr<�ERR_INSUFFICIENT_ACCESS_RIGHTS)�selfr~rWrzr[r\rVrXrYrZ�account_lockout_duration�account_lockout_threshold�reset_account_lockout_afterrursrtr��credsrr@r9rA�num_pwd_args�	pwd_props�	prop_flagr_�numrJrrr�run:s�
�����

��

���

���z%cmd_domain_pwdsettings_pso_create.run)
NNNNNNNNNNNNN)�__name__�
__module__�__qualname__�__doc__�synopsisrl�SambaOptions�VersionOptions�CredentialsOptions�takes_optiongroupsr�rr�
takes_options�
takes_argsr�rrrrrqs(����rqc
@sheZdZdZdZejejejd�Z	e
ededd�eddd	e
d
dd�gZd
gZ						ddd�ZdS)�cmd_domain_pwdsettings_pso_setz*Modifies a Password Settings Object (PSO).�%prog <psoname> [options]rrz--precedencezUThis PSO's precedence relative to other PSOs. Lower precedence is better (<integer>).rjrvrwrxryrz)rirgr|r}r~NcCsf|��}|
�|�}t|t�||d�}d|t|�f}t|||�tt|j�}|dkr2|dur2t	d��|dus:|dure|j
|tjddgd�}|durU|ddd}t
|�}|dure|ddd}t
|�}t||||	d�t|j||d	|||||	|||
||d
�}z|�|�|�d|�t|j||d	d�WdStjy�}z
|j\}}t	d
||f��d}~ww)Nrr�rr�r%r&r+r�Fr�zSuccessfully updated PSO: %srD�Failed to update PSO '%s': %s)r�r�rr	rrBrpr�r�rr/r0r1rrercr4�modifyr�r<r=r>)r�r~rzrWr[r\rVrXrYrZr�r�r�rursrtr�r�rr@r�r9�
min_pwd_ticks�
max_pwd_ticksr_rAr�rJrrrr��sZ
�
����

��z"cmd_domain_pwdsettings_pso_set.run)NNNNNNNNNNNNNN)r�r�r�r�r�rlr�r�r�r�r�rrrr�r�r�rrrrr��s.�����r�c@�PeZdZdZdZejejejd�Z	e
ddddded	�gZd
gZ
		ddd
�ZdS)�!cmd_domain_pwdsettings_pso_deletez)Deletes a Password Settings Object (PSO).r�rrrvrwrxryrzr{r~Nc
Cs\|��}|�|�}t|t�||d�}d|t|�f}	t||	|�|�|	�|�d|�dS)Nrr�zDeleted PSO %s)r�r�rr	rrB�deleter��
r�r~rzrursrtr�r�rr@rrrr�s
�
z%cmd_domain_pwdsettings_pso_delete.run�NNNN�r�r�r�r�r�rlr�r�r�r�rrr�r�r�rrrrr������r�cCst|dd�}|S)Nr r)r)�a�a_precedencerrr�pso_key#sr�c@sFeZdZdZdZejejejd�Z	e
ddddded	�gZd
dd�Z
d
S)�cmd_domain_pwdsettings_pso_listz+Lists all Password Settings Objects (PSOs).z%prog [options]rrrvrwrxryrzr{NcCs�|��}|�|�}t|t�||d�}|jt|�tjddgdd�}t|�dks,d|dvr4|j	�
d�dSt|td�}	|j	�
d	�|j	�
d
�|	D]}
|
d}|j	�
d||
df�qHdS)Nrrr z#(objectClass=msDS-PasswordSettings))r,r-rCrz@No PSOs are present, or you don't have permission to view them.
)�keyzPrecedence | PSO name
z3--------------------------------------------------
z%-10s | %s
)
r�r�rr	r/rr0rEr3r4r2�sortedr�)r�rzrursrtr�r�rr9�pso_list�psorWrrrr�8s&
���z#cmd_domain_pwdsettings_pso_list.runr�)r�r�r�r�r�rlr�r�r�r�rrr�r�rrrrr�(s���r�c@r�)�cmd_domain_pwdsettings_pso_showz-Display a Password Settings Object's details.r�rrrvrwrxryrzr{r~Nc
CsR|��}|�|�}t|t�||d�}d|t|�f}	t||	|�t|j||	�dS)Nrr�)r�r�rr	rrBr<r4r�rrrr�fs
�z#cmd_domain_pwdsettings_pso_show.runr�r�rrrrr�Ur�r�c@r�)�$cmd_domain_pwdsettings_pso_show_userz4Displays the Password Settings that apply to a user.z%prog <username> [options]rrrvrwrxryrzr{rFNc	Cs6|��}|�|�}t|t�||d�}t|j||�dS)Nr)r�r�rr	rHr4)	r�rFrzrursrtr�r�rrrrr��s
�z(cmd_domain_pwdsettings_pso_show_user.runr�r�rrrrr�sr�r�c@�ReZdZdZdZejejejd�Z	e
ddddded	�gZd
dgZ
		dd
d�ZdS)� cmd_domain_pwdsettings_pso_applya�Applies a PSO's password policy to a user or group.

    When a PSO is applied to a group, it will apply to all users (and groups)
    that are members of that group. If a PSO applies directly to a user, it
    will override any group membership PSOs for that user.

    When multiple PSOs apply to a user, either directly or through group
    membership, the PSO with the lowest precedence will take effect.
    �.%prog <psoname> <user-or-group-name> [options]rrrvrwrxryrzr{r~�
user_or_groupNc
C�"|��}|�|�}t|t�||d�}	d|t|	�f}
t|	|
|�d|}|	j|	��tj	|d�}t
|�dkr;td|��t|dj
�}
t��}t�|	|
�|_
t�|
tjd�|d<z|	�|�Wn'tjy�}z|j\}}|tjkrytd||f��td	||f��d}~ww|�d
||f�dS)Nrr��(sAMAccountName=%s)�r,rCr�.The specified user or group '%s' was not foundr*z PSO '%s' already applies to '%s'r�zPSO '%s' applied to '%s')r�r�rr	rrBr/r
r0rEr3rrr5rPrQrIrRr�r=r>�ERR_ATTRIBUTE_OR_VALUE_EXISTSr��r�r~r�rzrursrtr�r�rr@rGr9�	target_dnr_rAr�rJrrrr��sH
����

����
z$cmd_domain_pwdsettings_pso_apply.runr�r�rrrrr��s
����r�c@r�)�"cmd_domain_pwdsettings_pso_unapplyz4Updates a PSO to no longer apply to a user or group.r�rrrvrwrxryrzr{r~r�Nc
Cr�)Nrr�r�r�rr�r*zPSO '%s' doesn't apply to '%s'r�z"PSO '%s' no longer applies to '%s')r�r�rr	rrBr/r
r0rEr3rrr5rPrQrI�FLAG_MOD_DELETEr�r=r>�ERR_NO_SUCH_ATTRIBUTEr�r�rrrr��sL
����

����	�z&cmd_domain_pwdsettings_pso_unapply.runr�r�rrrrr��s����r�c@sdeZdZdZiZe�ed<e�ed<e�ed<e�ed<e	�ed<e
�ed<e�ed<e�ed	<d
S)�cmd_domain_passwordsettings_psoz5Manage fine-grained Password Settings Objects (PSOs).�applyrTr��list�set�showz	show-user�unapplyN)
r�r�r�r��subcommandsr�rqr�r�r�r�r�r�rrrrr�s






r�)T)
NNNNNNNNNNr�)*�samba.getopt�getoptrlr0�samba.samdbr�samba.netcmdrrrr�samba.dcerpc.samrrr�
samba.authr	�samba.netcmd.commonr
rrrrrr<rBrHrNrcrerr�rprqr�r�r�r�r�r�r�r�r�rrrr�<module>s�
2 
�D
�����������S!-D<
@ Telegram