1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Commit Graph

516 Commits

Author SHA1 Message Date
Matthias Dieter Wallnöfer
0dadb566a9 s4:pwsettings - Improve error handling and introduce "choice" type
- Improve the error handling according to Jelmer's suggestions
- Print out the error messages on "stderr"
- Add also here the "choice" type for arguments
2009-09-30 16:00:29 +02:00
Matthias Dieter Wallnöfer
cb50af5fe1 s4:provision - Lets the user choose between the supported forest/domain function levels
Adds a parameter "--function-level" which allows to specify the domain and
forest function level.
2009-09-30 16:00:07 +02:00
Andrew Kroeger
b2e8519e32 s4:provision: Show domains and forests are W2K8 DC capable.
When adding a W2K8 DC to a domain running earlier DC versions, the "adprep"
utility is used to perform schema updates and update other attributes as
necessary.

Adding these entries provides an indication that the adprep utility has been run
with the /forestprep, /domainprep and /rodcprep arguments.  Although these
entries indicate adprep has been run, nothing has been done to verify that the
changes that the adprep utility would have made have actually been done.

The values used for the revision atttributes are as seen on a W2K8 DC (not
W2K8 R2, which will probably have higher values).
2009-09-30 15:59:38 +02:00
Andrew Kroeger
955dab0ed7 s4:provision: Update schema version number to W2K8.
We are running the W2K8 schema version, not the W2K3 version.
2009-09-30 15:59:16 +02:00
Matthias Dieter Wallnöfer
d6f69ebcc2 s4:domainlevel - General rework
- We support domain/forest function levels >= (Windows) 2003 Native -> adapt the
  domain/forest and DC function level restrictions.
- Consider also the lowest function level of a DC. The domain and forest function
  levels can never be higher than it.
- Improve the error handling by printing out messages to "stderr"
- Introduce the "choice" type for choice arguments (saves us some error handling)
2009-09-30 15:58:16 +02:00
Matthias Dieter Wallnöfer
956740aa6f s4:LDIFs - enhance the section comments 2009-09-25 10:59:13 +02:00
Nadezhda Ivanova
13b979b03d Merge branch 'master' of git://git.samba.org/samba 2009-09-21 14:26:15 -07:00
Matthias Dieter Wallnöfer
7373bb79d4 s4:samdb/tools - That should fix now the last failures 2009-09-21 13:53:47 +02:00
Matthias Dieter Wallnöfer
f0c080a484 s4:scripts - Reintroduce "-H" parameter
I removed it since on some scripts it was present, on others not - so I thought
it wouldn't be really needed. This was a bad decision (pointed out by abartlet).
So I reintroduce it on all scripts (to have consistent parameters).
2009-09-21 11:53:19 +02:00
Nadezhda Ivanova
025590e7a4 Merge branch 'master' of git://git.samba.org/samba 2009-09-20 17:43:46 -07:00
Andrew Bartlett
509a2bb97c s4:provision split provision of DNS zone and self join keytab 2009-09-20 16:29:37 -07:00
Nadezhda Ivanova
6283f2caaa Initial implementation of security descriptor creation in DS
TODO's:
ACE sorting and clarifying the inheritance of object specific ace's.
2009-09-20 15:16:17 -07:00
Matthias Dieter Wallnöfer
c1527612b9 s4:python tools - try to fix some test problems 2009-09-20 23:49:05 +02:00
Matthias Dieter Wallnöfer
10fe59bed9 s4:domainlevel - fixed another error
The second "nTMixedDomain" attribute (under Partitions/Domain-DN) is only a
copy of the one under the directory root object. Therefore there doesn't exist
the "Windows 2000 Mixed" forest level.
2009-09-20 21:25:49 +02:00
Matthias Dieter Wallnöfer
b8e65e6974 s4:provision_configuration - fix "sPNMappings"
I reread some docs about this attributes and it seems that this as mapping
attribute isn't host specific but in common for the whole domain. To allow
Windows DCs to join our s4 domain sooner or later we have to provide the full
attribute.
2009-09-20 11:57:54 +02:00
Matthias Dieter Wallnöfer
bb65cd4f68 s4:domainlevel - further improvements
- The tool displays now also mixed/interim domain levels and warns about them
  (s4 isn't capable to run on them)
- But it allows now also to raise/step-up from them
- It displays now also levels higher than 2008 R2 (altough we don't support them
  yet) but to be able to get a correct output
2009-09-20 11:48:26 +02:00
Matthias Dieter Wallnöfer
2b5d1dfe6b s4:provision_basedn_modify - fix the "auditPolicy" attribute
I had to think about how to encode the string 0x0001 (taken from Windows Server).
The problem is due to the "0" byte at the beginning of it. BASE64 encoding
seems a good method to do it.
2009-09-20 00:14:51 +02:00
Matthias Dieter Wallnöfer
8dffa2300b s4:provision_configuration - "sPNMappings": "http" missed on regeneration 2009-09-18 21:06:19 +02:00
Matthias Dieter Wallnöfer
2e7fc37912 s4/provision_configuration - re-add the "sPNMappings"
Accidentally removed by a previous commit.
2009-09-18 21:00:49 +02:00
Matthias Dieter Wallnöfer
72ba2fa375 s4:scripts - Cleans also the rest under the "setup" directory up
- I removed also the "-H" parameter since those scripts are all thought for the
  use on a local s4 domain controller. Another reason is also the bind as SYSTEM
  account which itself is only possible on local binds.
2009-09-18 20:45:46 +02:00
Matthias Dieter Wallnöfer
1f38aa0995 s4:various scripts under "setup" - Unification
- This unified the shape of those four scripts (comments, command sequence, call
  of SamDB)
- To consider the samdb.py changes regarding the filter: there is now always the
  possibility either to specify the username or the search filter
2009-09-18 20:27:30 +02:00
Matthias Dieter Wallnöfer
bc2a05f001 s4:domainlevel/pwsettings - Remove unused import 2009-09-18 20:27:30 +02:00
Matthias Dieter Wallnöfer
ac3b58b851 s4:domainlevel - fix indentations 2009-09-18 17:54:25 +02:00
Matthias Dieter Wallnöfer
752904f12c s4:domainlevel - Add a script which allows raising the domain/forest level
This simple script allows raising the domain and/or forest level for s4.
I integrated also the basic checks (since we don't perform them in LDB yet):
e.g. the forest level can't be higher than the domain level(s).
2009-09-18 17:46:16 +02:00
Matthias Dieter Wallnöfer
b15ef6d854 s4:pwsettings - Simplify the error handling a bit 2009-09-18 17:33:24 +02:00
Matthias Dieter Wallnöfer
89f5df6fa7 s4:provision - Bump down the domain and forest level to Windows 2000
- The DC level we keep on Windows Server 2008 R2 (we should call ourself
  always the newest server type)
- The domain/forest level we set to the minimum (Windows 2000 native) to
  allow all AD DC types (from Windows 2000 on) in our domain - the NT4 "mixed"
  mode isn't supported by us (discussed on mailing list) -> "nTMixedDomain" is
  set always to 0
- I'll add a script which allows to bump the DC level (basically sets the
  "msDS-Behaviour-Version" attributes on the "Partitions/Configuration/DC" and
  on the "DC" object)
2009-09-18 16:21:29 +02:00
Matthias Dieter Wallnöfer
fa4023d6f7 s4:provision - Some rework (continuation)
- Fix up "servicePrincipalNames" attributes on the DC object
- Add some informative comments (most in "provision_self_join.ldif")
- Add also comments where objects are missing which we may add later when we
  support the feature (mainly for FRS)
- Add "domain updates" objects also under "CN=Configuration" (they exist twice)
- Add the default services under "Services" to allow interoperability with some
  MS client tools
- Smaller changes
2009-09-17 21:19:24 +02:00
Matthias Dieter Wallnöfer
4fa327a19f s4:provision - Some rework
- Add/change "wellKnownObjects" attributes
- Order entries in "provision_basedn_modify.ldif"
- Add/change "delete entries" object under BASEDN and CONFIGDN
- Fix default version number of "Default domain policy" group policy
- Add "domain updates" objects for interoperability with MS AD maintaining tools
- Show version number in the "oEMInformation" attribute (suggested by ekacnet)
- Smaller fixups
2009-09-17 18:27:31 +02:00
Matthieu Patou
96a36bf06d s4:sites & services - Adds Intersite transport containers
This patch brings up those subcontainers and fixes up the "systemFlags" on the
"Subnet" entry.
2009-09-12 14:54:45 +02:00
Matthias Dieter Wallnöfer
77100924d9 s4:group policies - the default group policy objects are all system-critical 2009-09-12 11:13:36 +02:00
Matthias Dieter Wallnöfer
10833f641a s4:group policies - add the domain controller group policy
This patches fixes the last difference between s4 and Windows Server regarding
group policy objects: we hadn't the domain controller policy.

- Adds the domain controller policy as it is found in the "original" AD
- Adds also the right version number in the GPT.INI file for the domain group
  policy (was missing)
2009-09-11 22:41:58 +02:00
Andrew Tridgell
e4683bfb3b s4-provision: revert _gc_tcp priority
thanks to id10ts for spotting this. I was a victim of emacs zone mode,
which increaed it with each edit.
2009-09-11 23:13:39 +10:00
Andrew Tridgell
f009fa15a1 s4-provision: use DNS name, not domain name
The SPNs end in the DNS domain name
2009-09-11 17:14:01 +10:00
Andrew Tridgell
d26c42f5bf s4/provision: add the nTDSDSA GUID based DNS entries and SPNs
The DNS entries and SPNs are needed for samba<->samba DRS
replication. This patch adds them for a standalone DC configure. A
separate patch will add them for the vampire configure
2009-09-11 14:07:22 +10:00
Andrew Bartlett
bda7061334 s4:setup Updated Display Specifiers from Microsoft (with #s)
This fixes the issue with the original files that they didn't have a
leading # in front of the comments, which caused our parsing scripts
much pain.  The files are now exactly as delivered.

Andrew Bartlett
2009-09-11 07:29:57 +10:00
Andrew Kroeger
e3a2a22451 s4:pwsettings: Added blackbox tests.
The added tests include basic validation that the script runs and accepts all
custom arguments.  The tests also verify changes to the password complexity,
minimum password length, and minimum password length settings.
2009-09-10 01:09:56 +02:00
Andrew Kroeger
ebdb9da78e s4:pwsettings: Show default values in help messages. 2009-09-10 01:09:55 +02:00
Andrew Kroeger
3cbcaa139c s4:pwsettings: Add 'default' option for password complexity. 2009-09-10 01:09:55 +02:00
Andrew Kroeger
4b68cfe15d s4:pwsettings: Added validation.
Validate that each field is within its allowed range.  Also validate that the
maximum password age is greater than the minimum password length (if the maximum
password age is set).

I could not find these values documented anywhere in the WSPP docs.  I used the
values shown in the W2K8 GPMC, as it appears that the GPMC actuaally performs
the validation of values.
2009-09-10 01:09:54 +02:00
Andrew Kroeger
0206b1d6f9 s4:pwsettings: Don't assume a value for pwdProperties.
If we cannot retrieve the value, do not assume a particular value.  The fact
that we could not retrieve the value indicates a larger problem that we don't
want to make worse bypossibly clearing bit fields in the pwdProperties
attribute.
2009-09-10 01:09:54 +02:00
Andrew Kroeger
5f6ebc3483 s4:pwsettings: Run all updates as a single modify() operation.
This ensures that all changes are made, or none are made.  It also makes it
possible to do validation as we go and abort in case of an error, while always
leaving things in a consistent state.
2009-09-10 01:09:53 +02:00
Andrew Kroeger
e71383eed7 s4:pwsettings: Added --quiet option.
Also changed all non-error status output to use the message() function, which
respects the --quiet option.
2009-09-10 01:09:52 +02:00
Endi Sukma Dewata
b1dabb1133 s4: Use SASL authentication against Fedora DS.
1. During instance creation the provisioning script will import the SASL
   mapping for samba-admin. It's done here due to missing config schema
   preventing adding the mapping via ldapi.

2. After that it will use ldif2db to import the cn=samba-admin user as
   the target of SASL mapping.

3. Then it will start FDS and continue to do provisioning using the
   Directory Manager with simple bind.

4. The SASL credentials will be stored in secrets.ldb, so when Samba
   server runs later it will use the SASL credentials.

5. After the provisioning is done (just before stopping the slapd)
   it will use the DM over direct ldapi to delete the default SASL
   mappings included automatically by FDS, leaving just the new
   samba-admin mapping.

6. Also before stopping slapd it will use the DM over direct ldapi to
   set the ACL on the root entries of the user, configuration, and
   schema partitions. The ACL will give samba-admin the full access
   to these partitions.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-09-10 09:52:22 +10:00
Andrew Kroeger
41ce496691 s4:pwsettings: Correct off by factor of 10 for ticks.
The tick conversion math was off by a factor of 10 due to the incorrect usage of
the "e" notation.  The expression "XeY" means "X * (10^Y)", so the correct
expression is 1e7 to get the correct adjustment for ticks.
2009-09-07 12:29:35 +02:00
Matthias Dieter Wallnöfer
90d6829f8a s4:Foreign security principals - Fix them up
I fixed them up to match with Windows Server 2003. I don't think that the
creation of them in the provision script is needed so I put them in the
"provision_users.ldif" file.
2009-09-07 08:37:25 +02:00
Matthias Dieter Wallnöfer
5f2832a5dc s4:samldb - Major rework
This fixes up the change of the primary group of a user when using the ADUC
console:
- When the "primaryGroupId" attribute changes, we have to delete the
  "member"/"memberOf" attribute reference of the new primary group and add one
  for the old primary group.
- Deny deletion of primary groups according to Windows Server (so we cannot
  have invalid "primaryGroupID" attributes in our AD).
- We cannot add a primary group directly before it isn't a secondary one of a
  user account.
- We cannot add a secondary reference ("member" attribute) when the group has
  been chosen as primary one.

This also removes the LDB templates which are basically overhead now.

This should also fix bug #6599.
2009-09-07 08:37:24 +02:00
Matthias Dieter Wallnöfer
931aa4e8bd s4:provision - Change the "provision_users.ldif" file to support the "samldb" changes
The "provision_users.ldif" file needs some rework to pass against the changed
and improved "samldb" module (see next commit).
2009-09-07 08:37:23 +02:00
Andrew Kroeger
9cf2d053cd s4:setup: Remove display_specifiers.ldif.
This file is no longer needed as the DisplaySpecifiers are now generated from
files provided by Microsoft.
2009-09-07 11:18:18 +10:00
Andrew Kroeger
76f23f0b46 s4:setup: Updated comment to reflect new DisplaySpecifiers location. 2009-09-07 11:18:18 +10:00
Andrew Kroeger
65130fa021 s4:setup: Change license headers to LDIF comments.
The original license headers provided by Microsoft cannot be parsed as valid
LDIF.

Changed the license headers to be valid LDIF comments, and added a new header
section detailing the exact changes that were made to the original document.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-09-07 11:18:17 +10:00