mirror of
https://github.com/samba-team/samba.git
synced 2025-02-02 09:47:23 +03:00
samba-tool domain demote: Add --remove-other-dead-server
The new version of this tool now can remove another DC that is itself offline. The --remove-other-dead-server removes as many references to the DC as possible. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
This commit is contained in:
Andrew Bartlett
parent
2191fcaedc
commit
1874f59200
@ -5,7 +5,7 @@
|
||||
# Copyright Jelmer Vernooij 2007-2012
|
||||
# Copyright Giampaolo Lauria 2011
|
||||
# Copyright Matthieu Patou <mat@matws.net> 2011
|
||||
# Copyright Andrew Bartlett 2008
|
||||
# Copyright Andrew Bartlett 2008-2015
|
||||
# Copyright Stefan Metzmacher 2012
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
@ -44,6 +44,7 @@ from samba.dcerpc import lsa
|
||||
from samba.dcerpc import netlogon
|
||||
from samba.dcerpc import security
|
||||
from samba.dcerpc import nbt
|
||||
from samba.dcerpc import misc
|
||||
from samba.dcerpc.samr import DOMAIN_PASSWORD_COMPLEX, DOMAIN_PASSWORD_STORE_CLEARTEXT
|
||||
from samba.netcmd import (
|
||||
Command,
|
||||
@ -58,7 +59,7 @@ from samba.upgrade import upgrade_from_samba3
|
||||
from samba.drs_utils import (
|
||||
sendDsReplicaSync, drsuapi_connect, drsException,
|
||||
sendRemoveDsServer)
|
||||
|
||||
from samba import remove_dc
|
||||
|
||||
from samba.dsdb import (
|
||||
DS_DOMAIN_FUNCTION_2000,
|
||||
@ -666,8 +667,10 @@ class cmd_domain_demote(Command):
|
||||
synopsis = "%prog [options]"
|
||||
|
||||
takes_options = [
|
||||
Option("--server", help="DC to force replication before demote", type=str),
|
||||
Option("--targetdir", help="where provision is stored", type=str),
|
||||
Option("--server", help="writable DC to write demotion changes on", type=str),
|
||||
Option("-H", "--URL", help="LDB URL for database or target server", type=str,
|
||||
metavar="URL", dest="H"),
|
||||
Option("--remove-other-dead-server", help="Dead DC to remove ALL references to (rather than this DC)", type=str),
|
||||
]
|
||||
|
||||
takes_optiongroups = {
|
||||
@ -677,13 +680,24 @@ class cmd_domain_demote(Command):
|
||||
}
|
||||
|
||||
def run(self, sambaopts=None, credopts=None,
|
||||
versionopts=None, server=None, targetdir=None):
|
||||
versionopts=None, server=None,
|
||||
remove_other_dead_server=None, H=None):
|
||||
lp = sambaopts.get_loadparm()
|
||||
creds = credopts.get_credentials(lp)
|
||||
net = Net(creds, lp, server=credopts.ipaddress)
|
||||
|
||||
if remove_other_dead_server is not None:
|
||||
if server is not None:
|
||||
samdb = SamDB(url="ldap://%s" % server,
|
||||
session_info=system_session(),
|
||||
credentials=creds, lp=lp)
|
||||
else:
|
||||
samdb = SamDB(url=H, session_info=system_session(), credentials=creds, lp=lp)
|
||||
remove_dc.remove_dc(samdb, remove_other_dead_server)
|
||||
return
|
||||
|
||||
netbios_name = lp.get("netbios name")
|
||||
samdb = SamDB(session_info=system_session(), credentials=creds, lp=lp)
|
||||
samdb = SamDB(url=H, session_info=system_session(), credentials=creds, lp=lp)
|
||||
if not server:
|
||||
res = samdb.search(expression='(&(objectClass=computer)(serverReferenceBL=*))', attrs=["dnsHostName", "name"])
|
||||
if (len(res) == 0):
|
||||
|
||||
183
python/samba/remove_dc.py
Normal file
183
python/samba/remove_dc.py
Normal file
@ -0,0 +1,183 @@
|
||||
# Unix SMB/CIFS implementation.
|
||||
# Copyright Matthieu Patou <mat@matws.net> 2011
|
||||
# Copyright Andrew Bartlett <abartlet@samba.org> 2008-2015
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import ldb
|
||||
from samba.ndr import ndr_unpack
|
||||
from samba.dcerpc import misc
|
||||
|
||||
|
||||
def remove_sysvol_references(samdb, rdn):
|
||||
realm = samdb.domain_dns_name()
|
||||
for s in ("CN=Enterprise,CN=Microsoft System Volumes,CN=System,CN=Configuration",
|
||||
"CN=%s,CN=Microsoft System Volumes,CN=System,CN=Configuration" % realm,
|
||||
"CN=Domain System Volumes (SYSVOL share),CN=File Replication Service,CN=System"):
|
||||
try:
|
||||
samdb.delete(ldb.Dn(samdb,
|
||||
"%s,%s,%s" % (str(rdn), s, str(samdb.get_root_basedn()))))
|
||||
except ldb.LdbError, l:
|
||||
pass
|
||||
|
||||
def remove_dns_references(samdb, dnsHostName):
|
||||
|
||||
# Check we are using in-database DNS
|
||||
zones = samdb.search(base="", scope=ldb.SCOPE_SUBTREE,
|
||||
expression="(&(objectClass=dnsZone)(!(dc=RootDNSServers)))",
|
||||
attrs=[],
|
||||
controls=["search_options:0:2"])
|
||||
if len(zones) == 0:
|
||||
return
|
||||
|
||||
try:
|
||||
rec = samdb.dns_lookup(dnsHostName)
|
||||
except RuntimeError as (enum, estr):
|
||||
if enum == 0x000025F2: #WERR_DNS_ERROR_NAME_DOES_NOT_EXIST
|
||||
return
|
||||
raise demoteException("lookup of %s failed: %s" % (dnsHostName, estr))
|
||||
samdb.dns_replace(dnsHostName, [])
|
||||
|
||||
def offline_remove_dc(samdb, ntds_dn,
|
||||
remove_computer_obj=False,
|
||||
remove_server_obj=False,
|
||||
remove_connection_obj=False,
|
||||
seize_stale_fsmo=False,
|
||||
remove_sysvol_obj=False,
|
||||
remove_dns_names=False):
|
||||
res = samdb.search("",
|
||||
scope=ldb.SCOPE_BASE, attrs=["dsServiceName"])
|
||||
assert len(res) == 1
|
||||
my_serviceName = res[0]["dsServiceName"][0]
|
||||
server_dn = ntds_dn.parent()
|
||||
|
||||
# Confirm this is really a server object
|
||||
msgs = samdb.search(base=server_dn,
|
||||
attrs=["serverReference", "cn",
|
||||
"dnsHostName"],
|
||||
scope=ldb.SCOPE_BASE,
|
||||
expression="(objectClass=server)")
|
||||
msg = msgs[0]
|
||||
dc_name = msgs[0]["cn"]
|
||||
|
||||
try:
|
||||
computer_dn = ldb.Dn(samdb, msgs[0]["serverReference"][0])
|
||||
except KeyError:
|
||||
computer_dn = None
|
||||
|
||||
try:
|
||||
dnsHostName = msgs[0]["dnsHostName"][0]
|
||||
except KeyError:
|
||||
dnsHostName = None
|
||||
|
||||
ntds_dn = msg.dn
|
||||
ntds_dn.add_child(ldb.Dn(samdb, "CN=NTDS Settings"))
|
||||
msgs = samdb.search(base=ntds_dn, expression="objectClass=ntdsDSA",
|
||||
attrs=["objectGUID"])
|
||||
msg = msgs[0]
|
||||
ntds_guid = ndr_unpack(misc.GUID, msg["objectGUID"][0])
|
||||
|
||||
if remove_connection_obj:
|
||||
# Find any nTDSConnection objects with that DC as the fromServer.
|
||||
# We use the GUID to avoid issues with any () chars in a server
|
||||
# name.
|
||||
stale_connections = samdb.search(base=samdb.get_config_basedn(),
|
||||
expression="(&(objectclass=nTDSConnection)(fromServer=<GUID=%s>))" % ntds_guid)
|
||||
for conn in stale_connections:
|
||||
samdb.delete(conn.dn)
|
||||
|
||||
if seize_stale_fsmo:
|
||||
stale_fsmo_roles = samdb.search(base="", scope=ldb.SCOPE_SUBTREE,
|
||||
expression="(fsmoRoleOwner=<GUID=%s>))" % ntds_guid,
|
||||
controls=["search_options:0:2"])
|
||||
# Find any FSMO roles they have, give them to this server
|
||||
|
||||
for role in stale_fsmo_roles:
|
||||
val = str(my_serviceName)
|
||||
m = ldb.Message()
|
||||
m.dn = role.dn
|
||||
m['value'] = ldb.MessageElement(val, ldb.FLAG_MOD_REPLACE, 'fsmoRoleOwner')
|
||||
samdb.modify(mod)
|
||||
|
||||
# Remove the NTDS setting tree
|
||||
samdb.delete(ntds_dn, ["tree_delete:0"])
|
||||
|
||||
if remove_server_obj:
|
||||
# Remove the server DN
|
||||
samdb.delete(server_dn)
|
||||
|
||||
if computer_dn is not None:
|
||||
computer_msgs = samdb.search(base=computer_dn,
|
||||
expression="objectclass=computer",
|
||||
attrs=["msDS-KrbTgtLink",
|
||||
"rIDSetReferences"],
|
||||
scope=ldb.SCOPE_BASE)
|
||||
if "rIDSetReferences" in computer_msgs[0]:
|
||||
samdb.delete(computer_msgs[0]["rIDSetReferences"][0])
|
||||
if "msDS-KrbTgtLink" in computer_msgs[0]:
|
||||
samdb.delete(computer_msgs[0]["msDS-KrbTgtLink"][0])
|
||||
|
||||
if remove_computer_obj:
|
||||
# Delete the computer tree
|
||||
samdb.delete(computer_dn, ["tree_delete:0"])
|
||||
|
||||
if "dnsHostName" in msgs[0]:
|
||||
dnsHostName = msgs[0]["dnsHostName"][0]
|
||||
|
||||
if dnsHostName is not None and remove_dns_names:
|
||||
remove_dns_references(samdb, dnsHostName)
|
||||
|
||||
if remove_sysvol_obj:
|
||||
remove_sysvol_references(samdb, "CN=%s" % dc_name)
|
||||
|
||||
|
||||
def remove_dc(samdb, dc_name):
|
||||
|
||||
# TODO: Check if this is the last server
|
||||
|
||||
samdb.transaction_start()
|
||||
|
||||
msgs = samdb.search(base=samdb.get_config_basedn(),
|
||||
attrs=["serverReference"],
|
||||
expression="(&(objectClass=server)(cn=%s))"
|
||||
% ldb.binary_encode(dc_name))
|
||||
server_dn = msgs[0].dn
|
||||
|
||||
ntds_dn = ldb.Dn(samdb, "CN=NTDS Settings")
|
||||
ntds_dn.add_base(msgs[0].dn)
|
||||
|
||||
# Confirm this is really an ntdsDSA object
|
||||
msgs = samdb.search(base=ntds_dn, attrs=[], scope=ldb.SCOPE_BASE,
|
||||
expression="(objectClass=ntdsdsa)")
|
||||
|
||||
offline_remove_dc(samdb, msgs[0].dn,
|
||||
remove_computer_obj=True,
|
||||
remove_server_obj=True,
|
||||
remove_connection_obj=True,
|
||||
seize_stale_fsmo=True,
|
||||
remove_sysvol_obj=True,
|
||||
remove_dns_names=True)
|
||||
|
||||
samdb.transaction_commit()
|
||||
|
||||
|
||||
|
||||
def offline_remove_dc_RemoveDsServer(samdb, ntds_dn):
|
||||
|
||||
samdb.start_transaction()
|
||||
|
||||
offline_remove_dc(samdb, ntds_dn)
|
||||
|
||||
samdb.commit_transaction()
|
||||
Loading…
x
Reference in New Issue
Block a user