mirror of
https://github.com/samba-team/samba.git
synced 2025-08-02 00:22:11 +03:00
gpo: Create a gp_sec_ext module
Move the gp_sec_ext into it's own module, which is how new gp_ext's will be created. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
David Mulder
committed by
Douglas Bagnall
Douglas Bagnall
parent
76cfbb6e8c
commit
477fd77c4d
@ -363,94 +363,6 @@ class gp_ext_setter():
|
||||
def __str__(self):
|
||||
pass
|
||||
|
||||
class inf_to_kdc_tdb(gp_ext_setter):
|
||||
def mins_to_hours(self):
|
||||
return '%d' % (int(self.val)/60)
|
||||
|
||||
def days_to_hours(self):
|
||||
return '%d' % (int(self.val)*24)
|
||||
|
||||
def set_kdc_tdb(self, val):
|
||||
old_val = self.gp_db.gpostore.get(self.attribute)
|
||||
self.logger.info('%s was changed from %s to %s' % (self.attribute,
|
||||
old_val, val))
|
||||
if val is not None:
|
||||
self.gp_db.gpostore.store(self.attribute, val)
|
||||
self.gp_db.store(str(self), self.attribute, old_val)
|
||||
else:
|
||||
self.gp_db.gpostore.delete(self.attribute)
|
||||
self.gp_db.delete(str(self), self.attribute)
|
||||
|
||||
def mapper(self):
|
||||
return { 'kdc:user_ticket_lifetime': (self.set_kdc_tdb, self.explicit),
|
||||
'kdc:service_ticket_lifetime': (self.set_kdc_tdb,
|
||||
self.mins_to_hours),
|
||||
'kdc:renewal_lifetime': (self.set_kdc_tdb,
|
||||
self.days_to_hours),
|
||||
}
|
||||
|
||||
def __str__(self):
|
||||
return 'Kerberos Policy'
|
||||
|
||||
class inf_to_ldb(gp_ext_setter):
|
||||
'''This class takes the .inf file parameter (essentially a GPO file mapped
|
||||
to a GUID), hashmaps it to the Samba parameter, which then uses an ldb
|
||||
object to update the parameter to Samba4. Not registry oriented whatsoever.
|
||||
'''
|
||||
|
||||
def ch_minPwdAge(self, val):
|
||||
old_val = self.ldb.get_minPwdAge()
|
||||
self.logger.info('KDC Minimum Password age was changed from %s to %s' \
|
||||
% (old_val, val))
|
||||
self.gp_db.store(str(self), self.attribute, old_val)
|
||||
self.ldb.set_minPwdAge(val)
|
||||
|
||||
def ch_maxPwdAge(self, val):
|
||||
old_val = self.ldb.get_maxPwdAge()
|
||||
self.logger.info('KDC Maximum Password age was changed from %s to %s' \
|
||||
% (old_val, val))
|
||||
self.gp_db.store(str(self), self.attribute, old_val)
|
||||
self.ldb.set_maxPwdAge(val)
|
||||
|
||||
def ch_minPwdLength(self, val):
|
||||
old_val = self.ldb.get_minPwdLength()
|
||||
self.logger.info(
|
||||
'KDC Minimum Password length was changed from %s to %s' \
|
||||
% (old_val, val))
|
||||
self.gp_db.store(str(self), self.attribute, old_val)
|
||||
self.ldb.set_minPwdLength(val)
|
||||
|
||||
def ch_pwdProperties(self, val):
|
||||
old_val = self.ldb.get_pwdProperties()
|
||||
self.logger.info('KDC Password Properties were changed from %s to %s' \
|
||||
% (old_val, val))
|
||||
self.gp_db.store(str(self), self.attribute, old_val)
|
||||
self.ldb.set_pwdProperties(val)
|
||||
|
||||
def days2rel_nttime(self):
|
||||
seconds = 60
|
||||
minutes = 60
|
||||
hours = 24
|
||||
sam_add = 10000000
|
||||
val = (self.val)
|
||||
val = int(val)
|
||||
return str(-(val * seconds * minutes * hours * sam_add))
|
||||
|
||||
def mapper(self):
|
||||
'''ldap value : samba setter'''
|
||||
return { "minPwdAge" : (self.ch_minPwdAge, self.days2rel_nttime),
|
||||
"maxPwdAge" : (self.ch_maxPwdAge, self.days2rel_nttime),
|
||||
# Could be none, but I like the method assignment in
|
||||
# update_samba
|
||||
"minPwdLength" : (self.ch_minPwdLength, self.explicit),
|
||||
"pwdProperties" : (self.ch_pwdProperties, self.explicit),
|
||||
|
||||
}
|
||||
|
||||
def __str__(self):
|
||||
return 'System Access'
|
||||
|
||||
|
||||
class gp_inf_ext(gp_ext):
|
||||
@abstractmethod
|
||||
def list(self, rootpath):
|
||||
@ -497,52 +409,6 @@ class gp_inf_ext(gp_ext):
|
||||
def __str__(self):
|
||||
pass
|
||||
|
||||
class gp_sec_ext(gp_inf_ext):
|
||||
'''This class does the following two things:
|
||||
1) Identifies the GPO if it has a certain kind of filepath,
|
||||
2) Finally parses it.
|
||||
'''
|
||||
|
||||
count = 0
|
||||
|
||||
def __str__(self):
|
||||
return "Security GPO extension"
|
||||
|
||||
def list(self, rootpath):
|
||||
return os.path.join(rootpath,
|
||||
"MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf")
|
||||
|
||||
def listmachpol(self, rootpath):
|
||||
return os.path.join(rootpath, "Machine/Registry.pol")
|
||||
|
||||
def listuserpol(self, rootpath):
|
||||
return os.path.join(rootpath, "User/Registry.pol")
|
||||
|
||||
def apply_map(self):
|
||||
return {"System Access": {"MinimumPasswordAge": ("minPwdAge",
|
||||
inf_to_ldb),
|
||||
"MaximumPasswordAge": ("maxPwdAge",
|
||||
inf_to_ldb),
|
||||
"MinimumPasswordLength": ("minPwdLength",
|
||||
inf_to_ldb),
|
||||
"PasswordComplexity": ("pwdProperties",
|
||||
inf_to_ldb),
|
||||
},
|
||||
"Kerberos Policy": {"MaxTicketAge": (
|
||||
"kdc:user_ticket_lifetime",
|
||||
inf_to_kdc_tdb
|
||||
),
|
||||
"MaxServiceAge": (
|
||||
"kdc:service_ticket_lifetime",
|
||||
inf_to_kdc_tdb
|
||||
),
|
||||
"MaxRenewAge": (
|
||||
"kdc:renewal_lifetime",
|
||||
inf_to_kdc_tdb
|
||||
),
|
||||
}
|
||||
}
|
||||
|
||||
''' Fetch the hostname of a writable DC '''
|
||||
def get_dc_hostname(creds, lp):
|
||||
net = Net(creds=creds, lp=lp)
|
||||
|
||||
Reference in New Issue
Block a user