HEX

File: //usr/lib/python3/dist-packages/samba/provision/__pycache__/__init__.cpython-310.pyc
o

f�0bӃ�0@s^dZdZddlmZddlZddlZddlZddlZddlZddl	Z	ddl
Z
ddlZddlZddl
Z
ddlZddlZddlZddlmZmZddlmZddlZddlmZddlmZmZdd	lmZdd
lmZddlmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&ddl'm(Z(m)Z)dd
l*m+Z+m,Z,ddlm-Z-m.Z.m/Z/ddl0m1Z1ddl2m3Z3ddl4m5Z5m6Z6m7Z7ddl8m9Z9m:Z:ddl;m<Z<ddl=m>Z>m?Z?m@Z@mAZAmBZBmCZCmDZDmEZEmFZFmGZGmHZHmIZImJZJmKZKmLZLmMZMmNZNmOZOmPZPmQZQddlRmSZSmTZTmUZUmVZVmWZWmXZXmYZYddlZm[Z[m\Z\m]Z]m^Z^ddl_Zddl`ZddlambZbddlcmdZdddlemfZfddlgmhZhddlcmiZidZjdZkdZldZmd ZnGd!d"�d"eo�ZpGd#d$�d$eo�Zqd%d&�Zrd�d(d)�Zsd*d+�Ztd,d-�Zud.d/�ZvGd0d1�d1eo�Zwd2d3�Zxd4d5�Zyd6d7�Zzd8d9�Z{d:d;�Z|d<d=�Z}				'd�d>d?�Z~		d�d@dA�ZdBdC�Z�	'	d�dDdE�Z�dddddFe,fdGdH�Z�dIdJ�Z�dKdL�Z�dMdN�Z�dOdP�Z�dQdR�Z�dSdT�Z�	d�dUdV�Z�dWdX�Z�dYdZ�Z�d[d\�Z�d]Z�	'		'd�d^d_�Z�	'			d�d`da�Z�dbZ�dcZ�ddZ�e�fdedf�Z�dgdh�Z�didj�Z�dkdl�Z�dmdn�Z�dodp�Z�dqdr�Z�d�dsdt�Z�dudv�Z�ddeVdddwdddddddddddddd'dd'd'ddfdxdy�Z�dzd{d|d|d|d{d|d|d{dzdzd}�Z�d~d�Z�d�d��Z�d�d�d��Z�d�d�d��Z�d�d�d��Z�ddeVddddddddddddwddddddddddddddddddddd'd'dd'd'ddd�d�d'ddd'f0d�d��Z�						F	'd�d�d��Z�d�d��Z�Gd�d��d�e��Z�Gd�d��d�e��Z�Gd�d��d�e��Z�dS)�z/Functions for setting up a Samba configuration.�restructuredText�)�	b64encodeN)�system_session�
admin_session)�system_session_unix)�auth)�smbd�passdb)�param)�DS_DOMAIN_FUNCTION_2000)	�Ldb�MAX_NETBIOS_NAME_LEN�check_all_substituted�is_valid_netbios_char�
setup_file�substitute_var�valid_netbios_name�version�is_heimdal_built)�security�misc)�SEC_CHAN_BDC�SEC_CHAN_WKSTA)�DS_DOMAIN_FUNCTION_2003�DS_DOMAIN_FUNCTION_2008_R2�
ENC_ALL_TYPES)�IDmapDB)�read_ms_ldif)�setntacl�getntacl�dsacl2fsacl)�ndr_pack�
ndr_unpack)�
LDBBackend)�get_empty_descriptor�get_config_descriptor� get_config_partitions_descriptor�get_config_sites_descriptor�!get_config_ntds_quotas_descriptor�'get_config_delete_protected1_descriptor�)get_config_delete_protected1wd_descriptor�'get_config_delete_protected2_descriptor�get_domain_descriptor�$get_domain_infrastructure_descriptor�get_domain_builtin_descriptor�get_domain_computers_descriptor�get_domain_users_descriptor�!get_domain_controllers_descriptor�'get_domain_delete_protected1_descriptor�'get_domain_delete_protected2_descriptor�get_dns_partition_descriptor�'get_dns_forest_microsoft_dns_descriptor�'get_dns_domain_microsoft_dns_descriptor�'get_managed_service_accounts_descriptor)�
setup_path�setup_add_ldif�setup_modify_ldif�	FILL_FULL�FILL_SUBDOMAIN�FILL_NT4SYNC�FILL_DRS)�get_dnsadmins_sid�setup_ad_dns�create_dns_dir_keytab_link�create_dns_update_list)�Schema)�SamDB)�dbcheck)�create_kdc_conf)�get_default_backend_storez$31B2F340-016D-11D2-945F-00C04FB984F9z$6AC1786C-016F-11D2-945F-00C04FB984F9zDefault-First-Site-Name�lastProvisionUSN�c@�eZdZdd�ZdS)�ProvisionPathscCsjd|_d|_d|_d|_d|_d|_d|_d|_d|_d|_	d|_
d|_d|_d|_
d|_d|_d|_dS�N)�	shareconf�hklm�hkcu�hkcr�hku�hkpd�hkpt�samdb�idmapdb�secrets�keytab�
dns_keytab�dns�winsdb�private_dir�binddns_dir�	state_dir��self�r`�:/usr/lib/python3/dist-packages/samba/provision/__init__.py�__init__�s"
zProvisionPaths.__init__N��__name__�
__module__�__qualname__rbr`r`r`rarK��rKc@rJ)�ProvisionNamescCsvd|_d|_d|_d|_d|_d|_d|_d|_d|_d|_	d|_
d|_d|_d|_
d|_d|_d|_d|_i|_dSrL)�ncs�rootdn�domaindn�configdn�schemadn�dnsforestdn�dnsdomaindn�
ldapmanagerdn�	dnsdomain�realm�netbiosname�domain�hostname�sitename�smbconf�	domainsid�	forestsid�
domainguid�name_mapr^r`r`rarb�s&
zProvisionNames.__init__Nrcr`r`r`rarh�rgrhcCs�t�}d|_|�d���|_|�d�|_|j��|_t�	|j�}|j��|_|j
d|jdtjdgd�}t
|dd��d	d
�|_||_|j
dd
tjgd�d�}	t
|	dd
d�|_t
|	ddd�|_t�||�t�||	ddd�d��ks�td|jt
|	ddd�d��|j|f��t
|	ddd�|_t
|	ddd�|_|	dd|_d|_d|_tdt|j��D]'}
t
|j|
�}dt
|j�}||kr�||_q�dt
|j�}
||
kr�|
|_q�q�|j
ddt
|j�tjdgd�}t
|dd�|_ |j
d|jd|tjdgd�}t|�dk�rtd|j|f��t
|dd��d|jd
�|_!|j
d|dj"g|jd�}t
|dj"�|_#|j
dd t
|j#�tjd!d"gd�}t
t$t%j&|dd#d��|_'t
t$t%j&|dd"d��|_(|j
d|tjgd$�d�}t
t$t%j&|dd"d��|_)t$t*j+|dd%d�|_,t$t*j+|dd%d�|_-|d�d&�du�s�t.|dd&d�t/k�r�t/|_0nt.|dd&d�|_0|j
d't1d(|tjdd)gd�}t
|dd��d*d
��d+d
�|_2|j
d't3d(|tjdd)gd�}t|�d,k�rt
|dd��d*d
��d+d
�|_4nd|_4|j
d-t
|j,�t*j5fd.d/gd0�}t|�d,k�r?td1t
|j,�t*j5f��t
|dd/d�d2k�rXt.|dd.d�|_6nt7�8t.|dd.d��j9|_6|j
d3tjd4gd5gd6�}t|�dk�r}d7}nd8}|j
d9|jtjd4gd5gd6�}t|�dk�r�d7}nd8}|jdu�r�|�r�d:|_:nd;|_:n
|�s�|�r�d<|_:nd=|_:t;||j�}t
|�|j<d><|S)?a�Get key provision parameters (realm, domain, ...) from a given provision

    :param samdb: An LDB object connected to the sam.ldb file
    :param secretsdb: An LDB object connected to the secrets.ldb file
    :param idmapdb: An LDB object connected to the idmap.ldb file
    :param paths: A list of path to provision object
    :param smbconf: Path to the smb.conf file
    :param lp: A LoadParm object
    :return: A list of key provision parameters
    N�	workgrouprrz
(flatname=%s)zCN=Primary Domains�sAMAccountName��
expression�base�scope�attrsr�$�z(objectClass=*))�defaultNamingContext�schemaNamingContext�configurationNamingContext�rootDomainNamingContext�namingContextsr�r�r��utf8z5basedn in %s (%s) and from %s (%s)is not the same ...r�r�zDC=ForestDnsZones,%szDC=DomainDnsZones,%sz(objectClass=site)z	CN=Sites,�cnz(CN=%s)zOU=Domain Controllers,%s�dNSHostNamez=Unable to find DC called CN=%s under OU=Domain Controllers,%s�.zserverReference=%s)rr�r��CN=NTDS Settings,%s�invocationID�
objectGUID�invocationId)r��	objectSid�msDS-Behavior-Versionr�r�z(name={%s})zCN=Policies,CN=System,�displayName�{�}�z
(cn=%s-%s)�	xidNumber�type)rr�z3Unable to find uid/gid for Domain Admins rid (%s-%s�ID_TYPE_BOTHz(samaccountname=dns)�dn�search_options:1:2)rr�r��controlsTFz(samaccountname=dns-%s)�	BIND9_DLZ�SAMBA_INTERNAL�BIND9_FLATFILE�NONE�	DnsAdmins)=rh�	adminpass�get�upperrtrr�lowerrq�samba�dn_from_dns_name�search�ldb�
SCOPE_SUBTREE�str�replacersrw�
SCOPE_BASErlrm�Dn�decode�ProvisioningErrorrTrkrjrirnro�range�len�SCOPE_ONELEVELrvrur��serverdnr"r�GUID�
invocation�ntdsguidrzr�dom_sidrxry�intr�domainlevel�DEFAULT_POLICY_GUID�policyid�DEFAULT_DC_POLICY_GUID�policyid_dc�DOMAIN_RID_ADMINISTRATOR�root_gid�pwd�getpwuid�pw_gid�dns_backendr?r{)rT�	secretsdbrU�pathsrw�lp�names�basedn�res�current�i�ncrnro�res3�res4�
server_res�res5�res6�res7�res8�res9�res10�has_legacy_dns_account�res11�has_dns_account�dns_admins_sidr`r`ra�find_provision_key_parameters�s���������� ��
�

�"
�$����r�Fc	Cs�g}|s/|jdtjtdgd�}|dtD]}t�dt|��s'dt|�|f}|�t|��q|�d|||f�t��}t�|d�|_	t�
|tjt�|t<|jddtjd	gd
�}t|�dksgt|d�dkrqt�
|tj
d	�|d	<|�|�dS)a_Update the field provisionUSN in sam.ldb

    This field is used to track range of USN modified by provision and
    upgradeprovision.
    This value is used afterward by next provision to figure out if
    the field have been modified since last provision.

    :param samdb: An LDB object connect to sam.ldb
    :param low: The lowest USN modified by this upgrade
    :param high: The highest USN modified by this upgrade
    :param id: The invocation id of the samba's dc
    :param replace: A boolean indicating if the range should replace any
                    existing one or appended (default)
    �
@PROVISIONr�)r�r�r�r�;z%s;%s�%s-%s;%szprovisionnerID=*�provisionnerIDr~N)r�r�r��LAST_PROVISION_USN_ATTRIBUTE�rer��append�Messager�r��MessageElement�FLAG_MOD_REPLACEr��FLAG_MOD_ADD�modify)	rT�low�high�idr��tab�entry�e�deltar`r`ra�update_provision_usnVs2����r�cCsPg}|�d|||f�t��}t�|d�|_t�|tjt�|t<|�|�dS)a�Set the field provisionUSN in sam.ldb
    This field is used to track range of USN modified by provision and
    upgradeprovision.
    This value is used afterward by next provision to figure out if
    the field have been modified since last provision.

    :param samdb: An LDB object connect to sam.ldb
    :param low: The lowest USN modified by this upgrade
    :param high: The highest USN modified by this upgrade
    :param id: The invocationId of the provisionr�r�N)	r�r�r�r�r�r�r�r��add)rTr�r�r�r�r�r`r`ra�set_provision_usns��r�cCs(|jd|tjdggd�d�}|ddS)a This function return the biggest USN present in the provision

    :param samdb: A LDB object pointing to the sam.ldb
    :param basedn: A string containing the base DN of the provision
                    (ie. DC=foo, DC=bar)
    :return: The biggest USN in the provisionz
objectClass=*�
uSNChanged)r�zserver_sort:1:1:uSNChangedzpaged_results:1:1)rr�r�r�r�r)r�r�r�)rTr�r�r`r`ra�get_max_usn�s
�r�c

CsLz|jdtdtjtdgd�}Wntjy/}z|j\}}|tjkr*WYd}~dS�d}~wwt|�dkr�g}i}t�	d�}|d�
d�rV|ddD]	}|�t|��qL|dtD]E}	t|	��
d�}
t|
�d	krp|
d
}nd}t|�dkr}||vr}q\|�
|
d�}|�
|�dur�g||<||�|d�||�|d
�q\|SdS)aGet USNs ranges modified by a provision or an upgradeprovision

    :param sam: An LDB object pointing to the sam.ldb
    :return: a dictionary which keys are invocation id and values are an array
             of integer representing the different ranges
    z%s=*r�r�r~Nr�-r��r��default)r�r�r�r��LdbError�args�ERR_NO_SUCH_OBJECTr�r��compiler�r�r��split)
�samr��e1�ecode�emsg�myidsr��pr��r�tab1r��tab2r`r`ra�get_last_provision_usn�sB

�

��

rc@� eZdZdZdd�Zdd�ZdS)�ProvisionResultz�Result of a provision.

    :ivar server_role: The server role
    :ivar paths: ProvisionPaths instance
    :ivar domaindn: The domain dn, as string
    cCsFd|_d|_d|_d|_d|_d|_d|_d|_d|_d|_	d|_
dSrL)�server_roler�rkr�rT�idmapr�rx�adminpass_generatedr��backend_resultr^r`r`rarb�s
zProvisionResult.__init__cCs�|�d�|jr|�d|j�|�d|j�|�d|jj�|�d|jj�|�d|jj�|�d|j�|j	r@|j	�
|�dSdS)	z)Report this provision result to a logger.zMOnce the above files are installed, your Samba AD server will be ready to usezAdmin password:        %szServer Role:           %szHostname:              %szNetBIOS Domain:        %szDNS Domain:            %szDOMAIN SID:            %sN)�inforr�r	r�rurtrqrxr�
report_logger)r_�loggerr`r`rar�s��zProvisionResult.report_loggerN)rdrerf�__doc__rbrr`r`r`rar�s
rc	Cs6|D]}z||�WStyYqwtd|��)z�Find a user or group from a list of possibilities.

    :param nssfn: NSS Function to try (should raise KeyError if not found)
    :param names: Names to check.
    :return: Value return by first names list.
    zUnable to find user/group in %r)�KeyError)�nssfnr��namer`r`ra�findnss�s�rcC�ttj|�dS�Nr�)rr��getpwnam�r�r`r`ra�findnss_uid�rcCrr)r�grp�getgrnamrr`r`ra�findnss_gid	rrc
CsNzt|�}W|Sty&}z|�|�|�d�d}WYd}~|Sd}~ww)NzAssuming root user has UID zeror)rrr
)�rootr�root_uidr�r`r`ra�get_root_uid
s
�

��r cCs�t�}|�d�|_|�d�|_|�d�|_d|_d|_tj�	|jd�|_
tj�	|jd�|_tj�	|jd�|_tj�	|jd	�|_
tj�	|jd
�|_tj�	|jd�|_tj�	|jd�|_tj�	|jd
�|_tj�	|jd�|_tj�	|jd�|_tj�	|jd�|_tj�	|jd�|_tj�	|jd|d�|_tj�	|jd�|_tj�	|jd�|_tj�	|jd�|_d|_d|_d|_d|_d|_d|_|�dd�|_ |�dd�|_!|j"|_#|S) ztSet the default paths for provisioning.

    :param lp: Loadparm context.
    :param dnsdomain: DNS Domain name
    �private dir�binddns dir�state directoryz
dns.keytab�secrets.keytabz	share.ldbzsam.ldbz	idmap.ldbzsecrets.ldbz
privilege.ldb�dns_update_list�spn_update_list�	krb5.confzkdc.confzwins.ldb�ldapizencrypted_secrets.keyrYz.zonez
named.confznamed.conf.updatez	named.txtzhklm.ldbzhkcr.ldbzhkcu.ldbzhku.ldbzhkpd.ldbzhkpt.ldb�path�sysvol�netlogon)$rKr�r[r\r]rXrW�osr)�joinrMrTrUrV�	privileger%r&�krb5conf�kdcconfrZ�
s4_ldapi_path�encrypted_secrets_key_pathrY�	namedconf�namedconf_update�namedtxtrNrPrOrQrRrSr*r+�
configfilerw)r�rqr�r`r`ra�provision_paths_from_lpsF�r7cCs$d�dd�|D��}|dt���S)z)Determine a netbios name from a hostname.r�cSsg|]}t|�r|�qSr`)r)�.0�xr`r`ra�
<listcomp>Jsz*determine_netbios_name.<locals>.<listcomp>N)r-r
r�)rursr`r`ra�determine_netbios_nameGsr;cCs�|dur
t���d�d}|�d�}|durt|�}|��}t|�s&t|��|dur>|�d�}|dus7|dkr>td|j	��|�
�}|durV|�d�}|durVtd	|j	��|�
�}|��}
|�d�dkrltd
|j	��|�d���|
kr�td|�d���|j	|
f��|�d��
�|kr�td|�d�|j	|f��|d
kr�|dur�|�d�}|��}|�d���|kr�td|�d���||j	f��|dur�t�|�}||kr�td||f��n
|}|dur�d|}t|�s�t|��|��|
kr�td|
|f��|��|
k�rtd|
|f��||
k�r|�std|
|f��|d
k�r#|}
|�
�}|du�r*|}|du�r3d|}|du�r<d|}|
du�rCt
}
t�}||_||_||_||_d||_||_||_|
|_||_||_|
|_d||
|f|_|S)z$Guess configuration settings to use.Nr�r�netbios namerrr�z2guess_names: 'realm' not specified in supplied %s!�server rolez8guess_names: 'server role' not specified in supplied %s!zwguess_names: 'realm =' was not specified in supplied %s.  Please remove the smb.conf file and let provision generate itzzguess_names: 'realm=%s' in %s must match chosen realm '%s'!  Please remove the smb.conf file and let provision generate itz�guess_names: 'server role=%s' in %s must match chosen server role '%s'!  Please remove the smb.conf file and let provision generate it�"active directory domain controllerr|zguess_names: Workgroup '%s' in smb.conf must match chosen domain '%s'!  Please remove the %s file and let provision generate itzCguess_names: Domain '%s' must not be equal to short host name '%s'!zDC=z;guess_names: Realm '%s' must not be equal to hostname '%s'!zCguess_names: Realm '%s' must not be equal to NetBIOS hostname '%s'!zDguess_names: Realm '%s' must not be equal to short domain name '%s'!zCN=Configuration,z
CN=Schema,zCN=Manager,z"CN=%s,CN=Servers,CN=%s,CN=Sites,%s)�socket�gethostnamer�r�r;r�r�InvalidNetbiosNamer�r6r�r�r��DEFAULTSITErhrjrkrlrmrprqrtrrrsrurvr�)r�rurtrq�
serverrolerjrkrlrmr�rv�domain_names_forcedrsrrr�r`r`ra�guess_namesNs�

��


�






�rEc
	Csv|dusJ�|durt���d�d}t|�}
|durd}|dus#J�|��}|dus-J�|��}|
|||d�}|durAtj��}tj	�
|�rL|�|�|	durd|	D]}|	|durcd�|	|�||<qR|dur�tj	�
tj	�|d��|d<tj	�
|�|d	<tj	�
tj	�|d
��|d<tj	�
tj	�|d��|d
<tj	�
tj	�|d��|d<|�d	tj	�
|��|�d|d�|�d
|d
�|�d|d�|�r8|�r|dur�tj	�|d�}
|�dtj	�
tj	�|
d���nQ|�d��s|�d�}
|�dtj	�
tj	�|
d���n6|du�rtj	�|d
�}|�dtj	�
tj	�|d���n|�d��s8|�d�}|�dtj	�
tj	�|d���i}|dk�rZtj	�|�d�d�|d<tj	�|d|��d�|d<nd|d<t|d�}zE|�d�|��D]\}}|�d||f��qm|�d�|��D]\}}|�d|�|�d|�|�d �|�d��q�W|��n|��w|�|�|�d!|�dS)"zDCreate a new smb.conf file based on a couple of basic settings.
    Nr�r�standalone server)r<r|rrr=� �privater!zlock dir�stater#�cachezcache directoryzbind-dnsr"z
posix:eadbzeadb.tdbzxattr_tdb:filez	xattr.tdbr>r*�scriptsr+�
samba_dsdb�passdb backend�wz
[globals]
z		%s = %s
�
z[%s]
z	path = %s
z	read only = no
F)r?r@r�r;r�r�r
�LoadParmr,r)�exists�loadr-�abspath�setr�r��open�write�items�close�dump)rwrurtrr�	targetdirrC�eadb�	use_ntvfsr��global_paramrs�global_settings�ent�privdir�statedir�shares�f�key�valrr)r`r`ra�make_smbconf�s��

��
��
�
�

�



�
rfcCs<|�d|j|�|�|d|j|�|�|d|j|�dS)a�setup reasonable name mappings for sam names to unix names.

    :param samdb: SamDB object.
    :param idmap: IDmap db object.
    :param sid: The domain sid.
    :param domaindn: The domain DN.
    :param root_uid: uid of the UNIX root user.
    :param nobody_uid: uid of the UNIX nobody user.
    :param users_gid: gid of the UNIX users group.
    :param root_gid: gid of the UNIX root group.
    zS-1-5-7z-500z-513N)�setup_name_mapping�TYPE_UID�TYPE_GID)r
�sidr�
nobody_uid�	users_gidr�r`r`ra�setup_name_mappings)s
rmcCs$|dusJ�zt�|�Wn	tyYnwt|||dgd�}d}|jdkr,d|j}d}
|s2d}
|	dur9t�}	d|	}|	d	krP|
durJ|
d
7}
nd}
|
d7}
|
durVd
}
|��z)|�d�t	|t
d�||d��t	|t
d�|j||
d��|�d�t||�Wn|���|�
�dS)akSetup the partitions for the SAM database.

    Alternatively, provision() may call this, and then populate the database.

    :note: This will wipe the Sam Database!

    :note: This function always removes the local SAM LDB file. The erase
        parameter controls whether to erase the existing data, which
        may not be stored locally but in LDAP.

    Nzmodules:)�url�session_infor��optionsz# No LDAP backendr�zldapBackend: %sz"requiredFeatures: encryptedSecretszbackendStore: %s�mdbrOr�zrequiredFeatures: lmdbLevelOnez# No required featuresz*Setting up sam.ldb partitions and settingszprovision_partitions.ldif)�LDAP_BACKEND_LINE�
BACKEND_STOREzprovision_init.ldif)�BACKEND_TYPE�SERVER_ROLE�REQUIRED_FEATURESzSetting up sam.ldb rootDSE)r,�unlink�OSErrorrr��ldap_urirG�transaction_startr
r9r8�setup_samdb_rootdse�transaction_cancel�transaction_commit)�
samdb_pathrr�ro�provision_backendr�rC�erase�plaintext_secrets�
backend_store�backend_store_sizerT�ldap_backend_line�required_features�backend_store_liner`r`ra�setup_samdb_partitions<sV��




�
�
r�r�c
	Cs�gd�}
|dur|dur|��}d|��|��f}nd}|��}t�t�|d|��}
t|	�g|
d<ddg|
d<|dur_gd	�|
d<|g|
d
<d||��fg|
d<t|�g|
d
<dg|
d<|�d�g|
d<d|g|
d<t|	�g|
d<|dur�t|�g|
d<|jd|
d||t|�t|
j	�ftj
d�}|D]}|�|j	�q�|j|
j	|
tjd�}t
|�dk�r&|dddg|
d<z
|dddg|
d<Wn	ty�Ynwz
|dddg|
d<Wn	ty�Ynwz
|dddg|
d<Wn
t�yYnw|
D]}|dk�r|
|�tj��q|�|
�|�|dj	|
j	�dSd |g}|	tk�r=|du�r=|�d |g�||
d!<|�|
�dS)"z�Add domain join-specific bits to a secrets database.

    :param secretsdb: Ldb Handle to the secrets database
    :param machinepass: Machine password
    )�whenChanged�secret�priorSecret�priorChanged�
krb5Keytab�
privateKeytabN�%s.%szflatname=%s,cn=Primary Domains�secureChannelType�top�
primaryDomain�objectClass)r�r��kerberosSecretrrz
host/%s@%s�
saltPrincipalzmsDS-KeyVersionNumberr$r��utf-8r�z%s$�samAccountNamer�zcn=Primary Domainsz_(&(|(flatname=%s)(realm=%s)(objectSid=%s))(objectclass=primaryDomain)(!(distinguishedName=%s)))�r�r�rr�)r�r�r�r�rr�r��priorWhenChangedr�r�zHOST/%s�servicePrincipalName)r�r�r�r�r�r��encoder!r�r�r��deleter�r�r�	set_flagsr�r��renamer�extendr�)r�rtrs�machinepassrxrrrq�keytab_path�key_version_number�secure_channel_typer��dnsname�	shortname�msgr��del_msg�el�spnr`r`ra�secretsdb_self_join�sp

����
�

r�cCs�tj�|j�r
t�|j�tj�|j|j�}tj�|�r!t�|�tj�|j|j	�}tj�|�r5t�|�tj�|j|j	�}tj�|�rIt�|�|j}t
|||d�}|��|�t
d��t
|||d�}|��z
|�t
d��W|S|���)arSetup the secrets database.

    :note: This function does not handle exceptions and transaction on purpose,
       it's up to the caller to do this job.

    :param path: Path to the secrets database.
    :param session_info: Session info.
    :param credentials: Credentials
    :param lp: Loadparm context
    :return: LDB handle for the created secrets database
    �ror�zsecrets_init.ldifzsecrets.ldif)r,r)rQrVrwr-r[rWr\rXrr��load_ldif_file_addr8rzr|)r�ror�r��bind_dns_keytab_path�dns_keytab_pathr)�secrets_ldbr`r`ra�setup_secretsdb�s.


�r�cCs>tj�|�rt�|�t|||d�}|��|�td��dS)z�Setup the privileges database.

    :param path: Path to the privileges database.
    :param session_info: Session info.
    :param credentials: Credentials
    :param lp: Loadparm context
    :return: LDB handle for the created secrets database
    r�zprovision_privilege.ldifN)r,r)rQrwrr�r�r8)r)ror��
privilege_ldbr`r`ra�setup_privileges	s
	
r�c	Cs�tj�|�rt�|�tjtjBtjB}tjtj	B}t�
d�}zt�|||�}Wt�
|�nt�
|�wt�|d��}t
�d�}|�|�Wd�dS1sPwYdS)z�Setup the encrypted secrets key file.

    Any existing key file will be deleted and a new random key generated.

    :param path: Path to the secrets key file.

    r�wb�N)r,r)rQrw�O_WRONLY�O_CREAT�O_EXCL�stat�S_IRUSR�S_IWUSR�umaskrU�fdopenr��generate_random_bytesrV)r)�flags�mode�umask_original�fdrcrdr`r`ra�setup_encrypted_secrets_keys


"�r�cCsRtj��}tjj|||d�}|�|tjj�td�}tj�	|�s"J�|�
|�dS)z�Setup the registry.

    :param path: Path to the registry database
    :param session_info: Session information
    :param credentials: Credentials
    :param lp: Loadparm context
    )ro�lp_ctxz
provision.regN)r��registry�Registry�open_ldb�
mount_hive�HKEY_LOCAL_MACHINEr8r,r)rQ�
diff_apply)r)ror��reg�hive�
provision_regr`r`ra�setup_registry2s
r�cCs>tj�|�rt�|�t|||d�}|��|�td��|S)z�Setup the idmap database.

    :param path: path to the idmap database
    :param session_info: Session information
    :param credentials: Credentials
    :param lp: Loadparm context
    r�zidmap_init.ldif)r,r)rQrwrr�r�r8)r)ror��	idmap_ldbr`r`ra�
setup_idmapdbBs
r�c	Cs*t|td�|j|j|j|j|jd��dS)zDSetup the SamDB rootdse.

    :param samdb: Sam Database handle
    zprovision_rootdse_add.ldif)�SCHEMADN�DOMAINDN�ROOTDN�CONFIGDN�SERVERDNN)r9r8rmrkrjrlr�)rTr�r`r`rar{Ss
�r{cCs�t|	t�sJ�|
durd|
}nd}|dur|}t|td�|j|j|j|j|	|jd|j	|j
ft|�d���
d�t|�t|�t|t|�t|d�t|dd	�d
��t|td�|
||j
|jd��|tkr�t|td
�|j|j|j|j|	|jd|j	|j
ft|�d���
d�t|�t|�t|t|�d�
�t|td�|j|jd�ddgd�t|td�|j|j|j|jd��t�}|�|�t|td�|j|j|jd��|�|�|dkr�t|td�|j
|jt|�d���
d�|j	d|j��|j
��fd��dSdS)zJoin a host to its own domain.NzobjectGUID: %s
r�zprovision_self_join.ldifr��	utf-16-ler��di�)r�r�r�r��INVOCATIONID�NETBIOSNAME�DNSNAME�MACHINEPASS_B64�	DOMAINSID�DCRID�SAMBA_VERSION_STRING�NTDSGUID�DOMAIN_CONTROLLER_FUNCTIONALITY�RIDALLOCATIONSTART�RIDALLOCATIONENDzprovision_group_policy.ldif)�
POLICYGUID�
POLICYGUID_DC�	DNSDOMAINr�zprovision_self_join_config.ldif)
r�r�r�r�r�r�r�r�r�r�r�r�r�z&provision_self_join_modify_schema.ldif)r�r��provision:0�relax:0�r�z&provision_self_join_modify_config.ldif)r�rBr�r�zprovision_self_join_modify.ldif)r�r�r�r�zprovision_dns_add_samba.ldif)r�r��DNSPASS_B64�HOSTNAMEr�)�
isinstancer�r9r8rlrmrkr�rsrurqrr�r�rr;r:rvr�set_session_infor�)rT�admin_session_infor��fillr�r��dnspassrx�next_rid�invocationid�
policyguid�
policyguid_dc�domainControllerFunctionalityr��dc_rid�
ntdsguid_line�system_session_infor`r`ra�setup_self_joinas�

�
�
�
������

�

���r�cCs*|ddkr
d|}tj�||d|�}|S)aReturn the physical path of policy given its guid.

    :param sysvolpath: Path to the sysvol folder
    :param dnsdomain: DNS name of the AD domain
    :param guid: The GUID of the policy
    :return: A string with the complete path to the policy folder
    rr�z{%s}�Policies)r,r)r-)�
sysvolpathrq�guid�policy_pathr`r`ra�
getpolicypath�sr�cCs�tj�|�st�|d�ttj�|d�d�}z|�d�W|��n|��wtj�|d�}tj�|�s:t�|d�tj�|d�}tj�|�sOt�|d�dSdS)N�zGPT.INIrNz[General]
Version=0�MACHINE�USER)r,r)rQ�makedirsrUr-rVrX)r�rcrr`r`ra�create_gpo_struct�s�rcCs,t|||�}t|�t|||�}t|�dS)aCreate the default GPO for a domain

    :param sysvolpath: Physical path for the sysvol folder
    :param dnsdomain: DNS domain name of the AD domain
    :param policyguid: GUID of the default domain policy
    :param policyguid_dc: GUID of the default domain controler policy
    N)r�r)r�rqr�r�r�r`r`ra�create_default_gpo�srlcCst||||||||
||d�
t}|r|}g}|dkr#|�dt|��|
r*|�d�|
r=t|d�d}|�dt|��t|dd	|d	|	|d
�}|�d�|j|d	d�|�d
|j	�z	|j
||d�Wntjy�}z|j
\}}|tjkr~td|���d}~ww|j|dd�|S)zZSetup a complete SAM Database.

    :note: This will wipe the main SAM database file!
    )	rr�rror�rCr�r�r�rqzlmdb_env_size:zbatch_mode:1i��r�ztransaction_index_cache_size:NF)rorn�auto_connectr��
global_schema�am_rodcrpz%Pre-loading the Samba 4 and AD schema)�write_indices_and_attributesr�)rpz<Permission denied connecting to %s, are you running as root?T)r��DEFAULT_BACKEND_SIZEr�r�r�rDr
�
set_schema�set_ntds_settings_dnr��connectr�r�r��ERR_INSUFFICIENT_ACCESS_RIGHTSr�)r)rorr�r�rr�rC�schemarr�r�r��
batch_mode�
store_sizerp�
cache_sizerT�e2�num�string_errorr`r`ra�setup_samdb�sF
�
�


��
rc1Cs�|durd}|dks|dkrd|}|dd7}t|��t}|dur$t}||kr,td��|}|}|�d|j�|�d|�|�d	|�|�d
|�|�t|j��|�|�|�	d|j
�t|t|j��}|�|�|j
durwd|j
}nd
}tt|j���d�}t|td�|j
t|j�||d��t|td�|j
tt�tt�����t|�|j|j|t|�ttt�d�	�|tk�r|�	d�tt|j���d�}t|td�|j|d��dtjj}dd|g}|�	d�|j |j!|d�|j"|j#|d�|�$�|j |j%|d�t|td�d|j&i|d�t'�(t'�)||j
��}t'�*|jt'j+d�|d<||_,|tk�r�|�	d�tt-|j���d�} tt.|j���d�}!tt/|j���d�}"tt0|j���d�}#tt1|j���d�}$tt2|j���d�}%d|j3v�rxd }&nd
}&t|td!�id"|j�d#|j4�d$|j�d%|j5�d&|j6�d|j&�d'|j
�d(|j�d)t|��d*t|��d+|"�d,|$�d-|#�d.|$�d/|$�d0|%�d1| �d2|!i��t|td3�|j|&d4��|�	d5�t7td6��}'t8|'d"|ji�}'t9|'�|� |'�|�	d7�t|td8�|j|%d9��|�	d:�tt:|j���d�}(t|td;�|j
|(d<��|�	d=�t|td>�d'|j
i�|�	d?�tt;|j���d�})t|td@�|j
|)dA��|�	dB�t|tdC�d'|j
i�|�	dD�tt<|j���d�}*tt=|j���d�}+tt>|j���d�},tt?|j���d�}-tt@|j���d�}.t|tdE�tt�tt�����|j
|j4|j|j|jt|dF�||*|+|,|-|.dG�
�|tk�r�ttA|j���d�}/t|tdH�|j|j&dI��|�	dJ�tt1|j���d�}$t|tdK�|j|$dL�ddgd�|tk�s�|tBk�rct|tdM�|j
|/dN��|�	dO�t|tdP�|j
t|j�t|�CdQ���d�t|�CdQ���d�dR�ddgd�|�	dS�tD||||||
||	|j||||||
dT�d|j}0|jE|0dUd
t'jFdV��d�|_GtH|jGt��scJ�|S)WN���ʚ;z/You want to run SAMBA 4 with a next_rid of %u, z,the valid range is %u-%u. The default is %u.)rrrz�You want to run SAMBA 4 on a domain and forest function level which itself is higher than its actual DC function level (2008_R2). This won't work!r��domainFunctionality�forestFunctionalityr�zAdding DomainDN: %szobjectGUID: %s
-r�r�zprovision_basedn.ldif)r�r��
DESCRIPTOR�
DOMAINGUIDzprovision_basedn_modify.ldif)	r��	CREATTIME�NEXTRIDrBr�r��DOMAIN_FUNCTIONALITYr��MIN_PWD_LENGTHzAdding configuration containerz#provision_configuration_basedn.ldif)r�rzlocal_oid:%s:0r�r�zSetting up sam.ldb schemar�zaggregate_schema.ldifr��subRefsz%Setting up sam.ldb configuration data�2008�#zprovision_configuration.ldifr�r�rBr��DOMAINr�r��FOREST_FUNCTIONALITYr�NTDSQUOTAS_DESCRIPTOR�LOSTANDFOUND_DESCRIPTOR�SERVICES_DESCRIPTOR�PHYSICALLOCATIONS_DESCRIPTOR�FORESTUPDATES_DESCRIPTOR�EXTENDEDRIGHTS_DESCRIPTOR�PARTITIONS_DESCRIPTOR�SITES_DESCRIPTORzextended-rights.ldif)r��INC2012zSetting up display specifiersz1display-specifiers/DisplaySpecifiers-Win2k8R2.txtz0Modifying display specifiers and extended rightsz#provision_configuration_modify.ldif)r��DISPLAYSPECIFIERS_DESCRIPTORzAdding users containerzprovision_users_add.ldif)r��USERS_DESCRIPTORzModifying users containerzprovision_users_modify.ldifzAdding computers containerzprovision_computers_add.ldif)r��COMPUTERS_DESCRIPTORzModifying computers containerzprovision_computers_modify.ldifzSetting up sam.ldb datazprovision.ldifiX)
rr�r�rBr�r��RIDAVAILABLESTARTr��INFRASTRUCTURE_DESCRIPTORr#�SYSTEM_DESCRIPTOR�BUILTIN_DESCRIPTOR�DOMAIN_CONTROLLERS_DESCRIPTORz'provision_configuration_references.ldif)r�r�z)Setting up well known security principalsz#provision_well_known_sec_princ.ldif)r��WELLKNOWNPRINCIPALS_DESCRIPTORz provision_basedn_references.ldif)r��MANAGEDSERVICE_DESCRIPTORz#Setting up sam.ldb users and groupszprovision_users.ldifr�)r�r��
ADMINPASS_B64�KRBTGTPASS_B64zSetting up self join)
r�r�r�r�r�r�rxr�r�r�r�r�r�r�)r��	attributerr�)Ir�rrr��set_opaque_integer�set_domain_sidr�rx�set_invocation_idr
rkrr�rzrr,r�r9r8r:r��unix2nttimer��timervrlr�DEFAULT_MIN_PWD_LENGTHr;r%�dsdb�&DSDB_CONTROL_SKIP_DUPLICATES_CHECK_OID�add_ldif�
schema_dn_add�modify_ldif�schema_dn_modify�write_prefixes_from_schema�schema_datarmr�r�r�r�r��
invocation_idr&r'r(r)r*r+�base_schemarsrqrtrrrr0r/r-r3r2r.r1r7r<r�r��	searchoner�r�r�)1rTr�r�rr�r�r�r��
krbtgtpassr�r�r�r�r�rCr�dom_for_fun_levelrr�r�r�r��errorr�rrr��domainguid_line�descr�ignore_checks_oid�schema_controlsr��partitions_descr�sites_descr�ntdsquotas_descr�protected1_descr�protected1wd_descr�protected2_descr�	incl_2012�display_specifiers_ldif�
users_desc�computers_desc�infrastructure_desc�lostandfound_desc�system_desc�builtin_desc�controllers_desc�managedservice_descr�ntds_dnr`r`ra�
fill_samdb5s��



�
�


��

��

��������	�
���
������
�
��

��

�

�

�
��


�
��

����

��

�

��razkO:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)z�O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001301bf;;;PA)r*c
Cs�t�}t||||||d||d�	tj|dd�D]3\}}	}
|
D]}t|tj�||�||||d||d�	q|	D]}t|tj�||�||||d||d�	q5qdS)NT�r\�skip_invalid_chownr	�serviceF��topdown)rrr,�walkr)r-)r)�aclr��domsidr\r	rdror�dirs�filesrr`r`ra�set_dir_aclBs����rlcCs�tj�||d�}t�}	t||tt|�|	|d|td�	|jd|ddgdt	j
d�}
|
D]'}ttj
|dd	���}t||t|d��}
t|
t||�|t|�||d
�q*dS)�nSet ACL on the sysvol/<dnsname>/Policies folder and the policy
    folders beneath.

    :param sysvol: Physical path for the sysvol folder
    :param dnsdomain: The DNS name of the domain
    :param domainsid: The SID of the domain
    :param domaindn: The DN of the domain (ie. DC=...)
    :param samdb: An LDB object on the SAM db
    :param lp: an LP object
    r�Trb�CN=Policies,CN=System,%sr��nTSecurityDescriptorr�r�r�r	N)r,r)r-rr�POLICIES_ACLr��SYSVOL_SERVICEr�r�r�r"r�
descriptor�as_sddlr�rlr )r*rqrxrkrTr�r\r	�root_policy_pathror��policyrhr�r`r`ra�set_gpos_aclNs*
�
�
����rwc

s�d��s�t��}
|
��j�tjtj�|�d�}z>zt	�
|jdt�|�Wnt
y8t	��s4td��td��wzt	�|j||t��Wnt
yPtd��wW|��n|��wt��}
|
��j�|
�dd|j�t��t�|
�d���t���kr�td	t���f�����}|d
�kr�td|d
�f��|d��|��kr�td
|d��|��f��z�r�t�|d|�Wnt
y�d}
Ynwd}
d��tj�}tjtj Btj!B}tj"|�||d��tj#��d||d������fdd�}||�tj$|dd�D]H\}}}|D]}��r#|
�r#t�tj�%||�d|�|tj�%||���q|D]}��rD|
�rDt�tj�%||�d|�|tj�%||���q0�qt&||�||���d�dS)��Set the ACL for the sysvol share and the subfolders

    :param samdb: An LDB object on the SAM db
    :param netlogon: Physical path for the netlogon folder
    :param sysvol: Physical path for the sysvol folder
    :param uid: The UID of the "Administrator" user
    :param gid: The GID of the "Domain adminstrators" group
    :param domainsid: The SID of the domain
    :param dnsdomain: The DNS name of the domain
    :param domaindn: The DN of the domain (ie. DC=...)
    N)�dir��z�Samba was compiled without the posix ACL support that s3fs requires.  Try installing libacl1-dev or libacl-devel, then re-run configure and make.z�Your filesystem or build does not support posix ACLs, which s3fs requires.  Try the mounting the filesystem with the 'acl' option.zUUnable to chown a file on your filesystem.  You may not be running provision as root.rM�
samba_dsdb:%s�QSID as seen by smbd [%s] does not match SID as seen by the provision script [%s]!r��[SID as seen by pdb_samba_dsdb [%s] does not match SID as seen by the provision script [%s]!�
dns_domain�_Realm as seen by pdb_samba_dsdb [%s] does not match Realm as seen by the provision script [%s]!���FTz<SID={}-{}>)r�r��session_info_flags�
Administrator)r��	user_name�uid�gidcst�|tt����d�td�	S)zA helper to reuse argsTrb)r�
SYSVOL_ACLr�rr)r)�rxr��	s4_passdbror\r`ra�	_setntacl�s
�zsetsysvolacl.<locals>._setntaclrerp)'�s3param�get_contextrRr6�tempfile�NamedTemporaryFiler,r)rSr�set_simple_aclrrrx�have_posix_aclsr��chownrXrTrnr	�reload_static_pdb�PDBr��get_global_sam_sid�domain_infor��formatrr�r� AUTH_SESSION_INFO_DEFAULT_GROUPS�AUTH_SESSION_INFO_AUTHENTICATED�#AUTH_SESSION_INFO_SIMPLE_PRIVILEGES�user_session�session_info_set_unixrgr-rw)rTr+r*r�r�rxrqrkr�r\�s3conf�filer��canchown�userdnr�r�rrjrkrr`r�ra�setsysvolaclns�
�
������
���r�cCs|rdSdS)N�DB�VFSr`)�direct_db_accessr`r`ra�acl_type�sr�c	Cs`t�}t||||td�}|�|�}||kr!tdt|�|||f��tj|dd�D]�\}}	}
|
D]=}t|tj�	||�||td�}|durRtdt|�tj�	||�f��|�|�}||krltdt|�tj�	||�||f��q/|	D]=}t|tj�	||�||td�}|dur�tdt|�tj�	||�f��|�|�}||kr�tdt|�tj�	||�||f��qoq(dS)N�r�rdzN%s ACL on GPO directory %s %s does not match expected value %s from GPO objectFrez %s ACL on GPO file %s not found!zI%s ACL on GPO file %s %s does not match expected value %s from GPO objectz%%s ACL on GPO directory %s not found!)
rrrrrtr�r�r,rgr)r-)r)rhr�rxr�ro�fsacl�
fsacl_sddlrrjrkrr`r`ra�
check_dir_acl�sH
���
"����
"���r�cCs�tj�||d�}t�}t||||td�}	|	dur"tdt|�|f��|	�|�}
|
t	kr7tdt|�||
|	f��|j
d|ddgd	tjd
�}|D]#}t
tj|dd���}
t||t|d��}t|t|
|�|||�qGdS)rmr�r�Nz&DB ACL on policy root %s %s not found!zK%s ACL on policy root %s %s does not match expected value %s from provisionrnr�ror�r�r)r,r)r-rrrrr�r�rtrqr�r�r�r"rrsr�r�r�r )r*rqrxrkrTr�r�ruror�r�r�rvrhr�r`r`ra�check_gpos_acls2�

�
����r�c	CsFt��}|�|j�|�dd|j�t�|�d��}t�	�|kr+t
dt�	�|f��|��}	|	d|kr?t
d|	d|f��|	d��|��krWt
d|	d��|��f��t
�}
dD]D}tj�||�|fD].}t|||
|td	�}
|
d
ur�t
dt|�|f��|
�|�}|tkr�t
dt|�||tf��qgt|||||||�q\d
S)
rxrMr{r|r�r}r~r)TFr�Nz(%s ACL on sysvol directory %s not found!zP%s ACL on sysvol directory %s %s does not match expected value %s from provision)r�r�rRr6rTrnr	r�r�r�r�r�r�rr,r)r-rrrr�rtr�r�)rTr+r*rxrqrkr�r�r�r�ror��dir_pathr�r�r`r`ra�checksysvolacl&s2
���r�cCs6t�||�}g}|D]}|�d�dkr|�|�q
|S)zreturn only IPv4 IPs�:r��r��
interface_ips�findr�)r��all_interfaces�ips�retr�r`r`ra�interface_ips_v4X�
�r�cCs6t�|d�}g}|D]}|�d�dkr|�|�q
|S)zreturn only IPv6 IPsFr�r�r�)r�r�r�r�r`r`ra�interface_ips_v6br�r�rc'Cs�|durt}|��}|durt}|��}|durtt���}|
dur(t�dd�}
|dur2t�dd�}|dur<t�dd�}|�	�zPt
|||fid|�d|�d|�d|�d|�d	|�d
|
�d|�d|�d
|�d|�d|�d|�d|�d|�d|
�d|�d|�d|��}|dkr�t|j|j
||�Wn|���|��|dk�rB|s�t||j|j|j|j|j|j
|j||�
n|�d�t||j|j|j
|j|j|td�tt�}z(t�t�||j dd|jtj!d��"d���}tj#|tj$dd�|d<|�%|�Wn tj&�y} z| j'\}!}"|!tj(k�r�WYd} ~ nd} ~ wwt)||||||||	||||||d �|j |�*�d!d"��"d�}t+|t��sBJ�t,|�}#t-|t|j.��}$|#du�r\t/|d#|$|d$�nt0|d#|$|�|�d%�t1|t2d&�d'|j3i�|�d(�t4||d)d*d*d*d+�}%|�	�z8d,D]}&|%j5d-|&|j6ftj7d.gd/��q�|%j5d0|jtj8gd1�d/�|%j5|j6tj!d2d3gd/�d#k�r�t9d4��Wn|���|��dS)5N���xrrr�r�r�r�rIr�r�r�r�r�rCrJrr�r�r�r�r>zSetting acl on sysvol skipped)rtrrrqrsrxr�r��distinguishedNamezsamAccountName=%s$)rr�r�zmsDS-SupportedEncryptionTypes)�elementsr�r)�hostip�hostip6r�r��os_levelrZ�
fill_levelr�r�)r�r7rr�z2Setting up sam.ldb rootDSE marking as synchronizedzprovision_rootdse_modify.ldifr�zFixing provision GUIDsFT)�samdb_schema�verbose�fix�yes�quiet)z	CN=DomainzCN=Organizational-Personz
CN=ContactzCN=inetOrgPersonz%s,%s�defaultObjectCategory)�DNr�r�zCN=IP Security,CN=System,%s)�ipsecOwnersReference�ipsecFilterReference�ipsecISAKMPReference�ipsecNegotiationPolicyReference�ipsecNFAReference�attributeId�	governsIdzFDuplicate attributeId or governsId in schema. Must be fixed manually!!):r�r�r�r��uuid�uuid4r�� generate_random_machine_password�generate_random_passwordrzrarr*rqr|r}r�r+rr�rxrkr
r�rtrrrsrrr�r�r�rHr�r�r�r�r�r�r��ERR_NO_SUCH_ATTRIBUTEr@�get_default_basednr�rr�rjr�r�r:r8r�rE�check_databasermr�r�r�)'rTr�rr�r�rrZ�
samdb_fillr�r�r�r�r�rIrzr�r�r�r�r�r�r�rCrJrr�r\�skip_sysvolaclr�r��kerberos_enctypesr�r��enum�estr�lastProvisionUSNs�maxUSN�chk�
schema_objr`r`ra�provision_fillls����������������	�
���
�
�
��
�
����
��


�
�
�����r�rF�
member serverr>)�ROLE_STANDALONE�ROLE_DOMAIN_MEMBER�ROLE_DOMAIN_BDC�ROLE_DOMAIN_PDC�dc�memberzdomain controllerr>r��
standalonerFcCs"zt|WStyt|��w)z�Sanitize a server role name.

    :param role: Server role
    :raise ValueError: If the role can not be interpreted
    :return: Sanitized server role (one of "member server",
        "active directory domain controller", "standalone server")
    )�
_ROLES_MAPr�
ValueError)�roler`r`ra�sanitize_server_roles

�r�cCsL|��z|�d�t|td�|||d��Wn|���|��dS)ztCreate AD entries for the fake ypserver.

    This is needed for being able to manipulate posix attrs via ADUC.
    z"Setting up fake yp server settingsz
ypServ30.ldif)r�r��	NISDOMAINN)rzr
r9r8r|r}�rrTrkrs�	nisdomain�maxuid�maxgidr`r`ra�provision_fake_ypservers

�r�rzc
Csltj�|�s4z	t�||�WdSty3}z|jtjfvrn	td||jf��WYd}~dSd}~wwdS)Nz!Failed to create directory %s: %s)	r,r)rQ�mkdirrx�errno�EEXISTr��strerror)r)r�r�r`r`ra�directory_create_or_exists/s����r�cCsh|dur#|�d�t|�}t|�dkr#|d}t|�dkr#|�d|�|dkr)d}|dur2|�d�|S)NzLooking up IPv4 addressesrr�z*More than one IPv4 address found. Using %sz	127.0.0.1z No IPv4 address will be assigned)r
r�r��warning)rr�r��hostipsr`r`ra�determine_host_ip:s
�
r�cCsT|dur|�d�t|�}|r|d}t|�dkr|�d|�|dur(|�d�|S)NzLooking up IPv6 addressesrr�z*More than one IPv6 address found. Using %sz No IPv6 address will be assigned)r
r�r�r�)rr�r�r�r`r`ra�determine_host_ip6Ks

r�T�2012_R2c2FCs�zt|#�}#Wn
tytd|#��w|durt�dd�}|/dur%t�}/|dur-t��}t|p1dg|�}2t	|p9dg�}3t
| p@dddd	g�}4t�|2�j
}5zt
d
dg�}6Wnty_d}6Ynw|durmtj�|dd
�}n	|durvtj��}tj�tj�|��s�t�tj�|��g}7i}8|)r�dg|8d<|dkr�|7�d�n	|dur�|g|8d<|(r�|7�d�|7�d�ddg|8d<t|7�dkr�|7|8d<tj�|�r�t|d�}9z|9����}:W|9��n|9��w|:dus�|:dkr�t||||||#|%|(|'|8d�
nt||||||#|%|(|'|8d�
|'du�rtj��}'|'�|�t |'||||#||	||
|"||t!kd�};t"|'|;j#�}<|6|<_$|2|<_%|5|<_&t'||'|
�}
t(||'|�}|
|;_)||;_*||;_+||;_,||;_-|#du�rZ|'�.d�}#t/|<j0d�t/|<j1d �t/tj�|<j0d!��t/|<j2�|.�s}t3|<j4�|<j5�r�tj�|<j5��s�t�|<j5d"�t6|||;j7|-d#�}=t8|<|'|;|d$�}>|>�9�|>�:�tj�|<j;��s�|�<d%�t=|<j;||'d&�}?|?�>t?d'��|�<d(�t@|<||'d&�}@�z0|�<d)�tA|<jB||'d*�|�<d+�tC|<jD||'d*�|�<d,�tE|<jF||'d&�}AtG|AtH|�|2|3|4|5d-�|�<d.�tI|<jJ||>|'|;||#|=||&|.|/|0|1d/�}B|#d0k�rJ|<jKdu�r/tLd1|<jM��|<j5du�r;tLd2|<jM��tj�N|<jK��sJt�|<jKd3�|du�rXt�d4d5�}d6}Cn
tO|tP��rc|�Qd7�}d8}C|tRk�r�tS|B|@||;|<fid9|=�d:|�d;|�d<|
�d=|�d>|�d?|�d@|�dA|�dB|�dC|�dD|�dE|�dF|�dG|�dH|�dI|#�dJ|$�dK|&�dL|'�dM|(�dN|,�dO|/�dP|0��tT��s�tU|<jV||tj�|'�.dQ���|�<dR|<jV�tW|<jX|;j#|;jY|;jZdS�|�<dT|<jX�|�<dU�|#d0k�r�t[|'||<�|>�\�}D|>�]�Wn|@�^��|@�_�t`||<�ta�}E|#|E_b||E_c|<|E_d|;|E_e|'|E_f|B|E_J|A|E_gtH|�|E_,|tRk�r=|C|E_h||E_ind8|E_hd|E_i|D|E_j|)�rYtk||B|;jc|;jl|;jm�n�|*|+dV�|ES)WzHProvision samba4

    :note: caution, this wipes all existing data!
    zlserver role (%s) should be one of "active directory domain controller", "member server", "standalone server"Nr�r�r�nobody�users�other�staff�bind�named�etczsmb.confr�zidmap_ldb:use rfc2307r�z-dnsz
dns forwarderz+smbz-s3fsz+winregz+srvsvczdcerpc endpoint serversrzserver servicesrr�)rCr[r\r�r])r�rurtrqrCrkrlrmr�rvrjrDr=i�i��tlsr�)r�rmrG)r�r�r�rzSetting up share.ldbr�z
share.ldifzSetting up secrets.ldbzSetting up the registry)r�z"Setting up the privileges databasezSetting up idmap db)rjrrkrlr�zSetting up SAM db)	rrCrr�rr�r�r�rr>r+r*rz�� Tr�FrrZr�r�r�r�r�r�rIr�r�r�r�r�r�r�rCrJrr�r\r�r�r�zlog filez<The Kerberos KDC configuration for Samba AD is located at %s)rqrurrzGA Kerberos configuration suitable for Samba AD has been generated at %szpMerge the contents of this file with your system krb5.conf or replace it with this one. Do not create a symlink!r�)or�r�r�r�r�rGr�
random_sidr rrr�r�r�rr,r)r-r
�default_pathrQ�dirnamer�r�r�rU�read�lstriprXrfrPrRrEr>r7rq�bind_gidrr�r�r�r�r�rzrxryr�r�r[r\r]r�r2r*rCrmr#�init�startrMr
rr�r8r�r�rNr�r.r�rUrmr�rrTr+�MissingShareErrorrw�isdirr��bytesr�r;r�rrFr0�create_krb5_confr/rurrrB�
post_setup�shutdownr|r}rArr	rkr�r�r�r
rr�rr�rsrtr�)FrrorwrZr�rrrjrkrmrlr�rtrur�r�rxr�r�r��
ldapadminpassrIrzr�r�r��
dns_forwarderr�r�r�r�rr�r��backuprvrCrJ�useeadbrr�r\�use_rfc2307r�r�r�rGr�r�r�rrrkrlr�r�server_servicesr]rc�datar�r�rr�	share_ldbr�r
rTrr�resultr`r`ra�	provisionYs���






���



�



��

�



�
�
	


�����������������	�	�
�
���
����




�rcCs�t�d�}t�|�t|t�fid|�d|�dt�d|�d|�d|�d|�d	|�d
|�d|�d|	�d
d�d|
�d|�dd�d|�d|
�d|�d|��}|j�dt	|��|S)NrrwrZr�rrrjrkrmrlr�rtrur�rxr�rCr>rvr�r�r\�
debuglevel)
�logging�	getLoggerr��set_debug_levelrrr>r�rTr�)rwrZrrrjrkrmrlr�rtrurxr�r�r�rvrr\rr�r`r`ra�provision_become_dc]	sV

�������������������	rcCsttd�||||d��dS)z�Write out a file containing a valid krb5.conf file

    :param path: Path of the new krb5.conf file.
    :param dnsdomain: DNS Domain name
    :param hostname: Local hostname
    :param realm: Realm name
    r')r�r��REALMN)rr8)r)rqrurrr`r`raru	s

�rc@r)r�zA generic provision error.cCs
||_dSrL��value)r_r"r`r`rarb�	�
zProvisioningError.__init__cCs
d|jS)NzProvisioningError: r!r^r`r`ra�__str__�	r#zProvisioningError.__str__N)rdrerfrrbr$r`r`r`rar��	sr�cs eZdZdZ�fdd�Z�ZS)rAz.A specified name was not a valid NetBIOS name.cstt|��d|�dS)Nz)The name '%r' is not a valid NetBIOS name)�superrArb)r_r��	__class__r`rarb�	s
�zInvalidNetbiosName.__init__)rdrerfrrb�
__classcell__r`r`r&rarA�	srAcseZdZ�fdd�Z�ZS)rcstt|��d||f�dS)NzwExisting smb.conf does not have a [%s] share, but you are configuring a DC. Please remove %s or add the share manually.)r%rrb)r_rrwr&r`rarb�	s

��zMissingShareError.__init__)rdrerfrbr(r`r`r&rar�	sr)F)NNNNNNNNNNNF)NFFNN)FFNN)NN)FFNNF)FNNNNNN)rzrL)NNNNNNNNNNNNNNNr�F)�r�
__docformat__�base64rr�r,r�r�r�rrr<r�r?r��
samba.dsdbr�r��
samba.authrr�samba.auth_utilrr�samba.samba3rr	r
r�rrr
rrrrrrr�samba.dcerpcrr�samba.dcerpc.miscrrrrr�samba.idmapr�samba.ms_display_specifiersr�samba.ntaclsrrr �	samba.ndrr!r"�samba.provision.backendr#�samba.descriptorr$r%r&r'r(r)r*r+r,r-r.r/r0r1r2r3r4r5r6r7�samba.provision.commonr8r9r:r;r<r=r>�samba.provision.sambadnsr?r@rArB�samba.param�samba.registry�samba.schemarC�samba.samdbrD�samba.dbcheckerrE�samba.provision.kerberosrFrGr�r�rBr�r=�objectrKrhr�r�r�r�rrrrrr r7r;rErfrmr�r�r�r�r�r�r�r{r�r�rrrrrar�rqrrrlrwr�r�r�r�r�r�r�r�r�r�r�r�r�r�rrr�	Exceptionr�rArr`r`r`ra�<module>s^,X$	
#))&
0
�v
�f
�J
�Z*
�b
�D
�
 o#
2

��




�
�