sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-22 13:34:15 +03:00
Code
8b84282008
samba-mirror/source4/setup/provision_self_join.ldif

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

35 lines
1.2 KiB
Plaintext
Raw Normal View History

s4:provision - Some rework (continuation) - Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17 23:19:24 +04:00
# Accounts for selfjoin (joins DC to itself)
r23720: Allow the member server to work against an LDAP Backend. Another case where LDB isn't as strict as OpenLDAP, the self join record contains duplicate servicePrincipalNames once the DNS name and domain name are made equal. (Easier to just skip the useless self-join). Andrew Bartlett (This used to be commit 49ff929be6fcf57721532de13bdd7a7e1617af6f)
2007-07-05 10:15:40 +04:00
s4:provision - Some rework (continuation) - Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17 23:19:24 +04:00
# Object under "Domain Controllers"
r23815: Thanks to Matthias Wallnoefer <mwallnoefer@yahoo.de> for pointing out that we had the wrong objectClass for OU=Domain Controllers,${DOMAINDN} (was CN=Domain Controllers,${DOMAINDN}) This fixes both the SAMR server and the LDIF templates. Andrew Bartlett (This used to be commit 625a9e6c041bedc93925bdebb3a60af1dbdde317)
2007-07-10 17:26:10 +04:00
dn: CN=${NETBIOSNAME},OU=Domain Controllers,${DOMAINDN}
[SAMBA 4 directory] Adds the complete "objectclass path" to our self-created DC object Found after some comparisons against Windows Server 2003 R2.
2009-06-30 15:52:39 +04:00
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
r23720: Allow the member server to work against an LDAP Backend. Another case where LDB isn't as strict as OpenLDAP, the self join record contains duplicate servicePrincipalNames once the DNS name and domain name are made equal. (Easier to just skip the useless self-join). Andrew Bartlett (This used to be commit 49ff929be6fcf57721532de13bdd7a7e1617af6f)
2007-07-05 10:15:40 +04:00
objectClass: computer
accountExpires: 9223372036854775807
s4:provision - Some rework (continuation) - Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17 23:19:24 +04:00
dNSHostName: ${DNSNAME}
s4:AD content - Add the DFSR objects which exist on Windows Server >= 2008 Those replace the FRS ones.
2010-02-20 13:15:25 +03:00
# "MSDFSR-ComputerReferenceBL" doesn't exist since we still miss DFSR support
s4:setup/provision_self_join.ldif - let the samldb LDB module fill in "isCriticalSystemObject" It recognizes it now automatically.
2010-10-07 10:24:29 +04:00
# "isCritcalSystemObject" is now filled in by the samldb LDB module
s4:provision - Some rework (continuation) - Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17 23:19:24 +04:00
localPolicyFlags: 0
s4:provision: use better values for operatingSystem[Version] Some clients (e.g. an exchange server) check operatingSystemVersion in order to check if a domain controller is new enough. So we better use a value matching the dc functional level. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2015-07-22 13:44:32 +03:00
operatingSystem: ${OPERATING_SYSTEM}
operatingSystemVersion: ${OPERATING_SYSTEM_VERSION}
s4:provision - Some rework (continuation) - Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17 23:19:24 +04:00
sAMAccountName: ${NETBIOSNAME}$
userAccountControl: 532480
s4:provision - switch to "clearTextPassword" for setting passwords This is the default password set/change attribute for s4 specific purposes (otherwise in respect to Windows it's "unicodePwd"). We move away from "userPassword" since on Windows it's not activated by default - and s4 will follow soon.
2010-11-09 15:22:00 +03:00
clearTextPassword:: ${MACHINEPASS_B64}
s4:provision_self_join.ldif - the object SID in AD is called "objectSid" Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org> Autobuild-Date: Tue Nov 9 13:18:29 UTC 2010 on sn-devel-104
2010-11-09 15:27:57 +03:00
objectSid: ${DOMAINSID}-${DCRID}
CVE-2020-25722 s4/provision: add host/ SPNs at the start There are two reasons for this. Firstly, leaving SPNs unclaimed is dangerous, as someone else could grab them first. Secondly, in some circumstances (self join) we try to add a DNS/ SPN a little bit later in provision. Under the rules we are introducing for CVE-2020-25722, this will make our later attempts to add HOST/ fail. This causes a few errors in samba4.blackbox.dbcheck.* tests, which assert that revivified old domains match stored reference versions. Now they don't, because they have servicePrincipalNames. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-10-27 23:45:36 +03:00
# While some "servicePrincipalName" updates might be handled by the
# "samba_spnupdate" script, we need to get the basics in here before
# we add any others.
servicePrincipalName: HOST/${DNSNAME}
servicePrincipalName: HOST/${NETBIOSNAME}
servicePrincipalName: HOST/${DNSNAME}/${DNSNAME}
s4-provision Perform 'modify' operations as system We need this so that we can modify the cn=configuration partition when we are setting up a new subdomain. The serverReference on our ${SERVERDN} is in that partition, and without this change creating a new subdomain fails due to ACLs. Andrew Bartlett
2011-08-25 13:15:13 +04:00
dn: CN=RID Set,CN=${NETBIOSNAME},OU=Domain Controllers,${DOMAINDN}
objectClass: rIDSet
rIDAllocationPool: ${RIDALLOCATIONSTART}-${RIDALLOCATIONEND}
rIDPreviousAllocationPool: ${RIDALLOCATIONSTART}-${RIDALLOCATIONEND}
rIDUsedPool: 0
rIDNextRID: ${RIDALLOCATIONSTART}
Copy Permalink