1
0
mirror of https://github.com/samba-team/samba.git synced 2025-07-27 07:42:04 +03:00
Commit Graph

106 Commits

Author SHA1 Message Date
051a1a9c64 samba-tool classicupgrade: Do not print the admin password during upgrade
This changes the code to only set and show a new password if no admin
user is found during the upgrade.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Jan 10 16:55:23 CET 2013 on sn-devel-104
2013-01-10 16:55:23 +01:00
631654ae11 scripting: Handle missing LDAP entries in samba-tool domain classicupgrade
Reported-by: Thomas Simmons <twsnnva@gmail.com>
2012-12-06 13:28:46 +11:00
b4d8629f51 samba-tool: Rework ldap attribute fetch in classicupgrade for missing attributes
Is is not required that these additional attributes be filled in, so
catch KeyError in both the nsswitch and ldap backend case.

We rework get_posix_attr_from_ldap_backend() so it raises KeyError
rather than trying to return None, and does not ignore other errors.

Andrew Bartlett

Tested-by: Chirana Gheorghita Eugeniu Theodor <office@adaptcom.ro>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2012-11-12 00:05:08 +11:00
9eb022c8c6 provision: No longer use the wheel group in new AD Domains
The issue here is that if we set S-1-5-32-544 (administrators) to a
GID only, then users cannot force a mandetory profile to be owned by
administrators (which is a requirement).

There is no particularly useful reason for us to enforce this matching
a system group.

Andrew Bartlett
2012-10-18 17:10:58 +11:00
2a797f29aa s4-python: Various formatting fixes.
* Trailing whitespace
* use of "==" where "is" should be used
* double spaces
2012-09-27 18:45:12 +02:00
c0d4f2462f s4-python: Formatting fixes, break lines.
Autobuild-User(master): Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date(master): Sun Sep 16 15:58:04 CEST 2012 on sn-devel-104
2012-09-16 15:58:04 +02:00
2dd0e7141f s4-classicupgrade: Show more clearly what is wrong with the Adminstrator SID 2012-09-03 19:24:10 +10:00
9e441c4ed9 s3-classicupgrade: Fix import from ldap
We must not reference result before provision(), and do not need
session_info and lp for reading a normal ldap backend anyway.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Aug 28 09:49:39 CEST 2012 on sn-devel-104
2012-08-28 09:49:39 +02:00
444c9ffad7 s4-classicupgrade: Do the setting of the sysvol ACLs last, after idmap is configured
This will allow files to be correctly owned by the idmap that is imported.

This appears to fix an issue that came up after s3fs-compatible ACLs were
merged into provision.

Andrew Bartlett
2012-08-28 07:57:30 +10:00
d5b9972215 s4-classicupgrade: Read WINS DB before the provision 2012-08-28 07:57:29 +10:00
85f1c4fdfd s4-classicupgrade: Do all the queries of data before the provision()
This allows provision to change the s3 smb.conf settings if required.

Andrew Bartlett
2012-08-28 07:57:29 +10:00
738f4ac058 s4-classicupgrade: Use s3param.get_context() instead of result.lp
We should not need the guessed values here, but by changing to using the s3 loadparm context
we can move this block to before the provision.

Andrew Bartlett
2012-08-28 07:57:29 +10:00
97b13799ce s4-classicupgrade: Add --use-ntvfs option
This is an odd option, but is needed because I wish to add assertions about
ACL setting that will not work in make test without the vfs_fake_acls module
loaded.

Andrew Bartlett
2012-08-22 01:31:57 +02:00
a57c5eb848 s4-classicupgrade: Tests if sam policies exist before trying to import them.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-14 08:37:48 +10:00
e2cea8fbea s4-classicupgrade: Add unix attributes during upgrade
Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sun Jul 22 13:20:20 CEST 2012 on sn-devel-104
2012-07-22 13:20:19 +02:00
8f443895f2 s4-classicupgrade: Demote any other 'BDC' accounts back to a member server during upgrade
This makes it clear that they cannot be a DC until they are upgraded with
samba-tool domain dcpromo.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Jul  6 09:59:13 CEST 2012 on sn-devel-104
2012-07-06 09:59:13 +02:00
f199c5dbc0 s4-classicupgrade: Allow DNS backend to be specified 2012-06-24 23:46:09 +10:00
352dbddb6d s4-idmap: Add parameter 'idmap_ldb:use rfc2307' and correct implementation errors 2012-06-20 16:22:41 +10:00
b58dc1826e s4-s3upgrade: Assert that administrator has a SID of -500, and only skip root if it is -500
Many upgraded installations have root as -1000, and so that account needs to be kept.

Andrew Bartlett
2012-06-16 08:18:10 +02:00
d0b60f02dd s4-s3upgrade: improve idmap import to use posixAccount and posixGroup entries 2012-06-16 08:18:10 +02:00
c2b094ffbc s4-s3-upgrade: Max/min password age policy is in seconds, not days
This cases upgraded domains to have a too-long password expiry, which in extreme
cases can cause the KDC to misfunction.

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Sun May  6 14:49:39 CEST 2012 on sn-devel-104
2012-05-06 14:49:39 +02:00
a0a83802fb s4-s3upgrade: Force ldapsam:trusted = yes
While this setting is not the default in Samba3, any domain that is
in a suitable condition to upgrade to Samba4 should already be in the
layout that ldapsam:trusted uses.  It can be turned off by setting
ldapsam:trusted=false in the smb.conf.

Many upgrades to Samba4 happen on a different host to the old Samba3 domain
and this avoids the need to configure nss_ldap only for the duration of
the upgrade.

Andrew Bartlett
2012-05-03 08:09:09 +10:00
d2c8ebe2c7 s4-s3upgrade: Try harder to get group memberships on upgrade
This fixes an issue where some group types were not upgraded, as we
did not upgrade alias memberships.

It also uses enum_group_memberships() to try and find the memberships
from the other direction, by asking which groups a user is a member
of.  As Samba3 (and NT4) does not implement nested groups, this should
be safe.

Andrew Bartlett
2012-05-03 08:09:09 +10:00
0d5d45c2df s4-s3upgrade: print the error message from passdb.error exceptions
This gives more information on why a group membership lookup failed.

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Tue Apr 24 04:34:44 CEST 2012 on sn-devel-104
2012-04-24 04:34:44 +02:00
6b2753d71e s4-samba-tool: Fix samba-tool fsmo seize
This is currently untested, and a restructure broke it.

Andrew Bartlett
2012-04-19 14:19:09 +10:00
a2b7a9e2a2 s4-s3upgrade: Do not ever set a domain-wide maxPwdAge of 0
This means no-expiry in s3, and so we must treat it like -1.

Andrew Bartlett
2012-04-19 14:19:09 +10:00
a5905bfb39 s4-s3upgrade: Ignore (with warning) groups that are listed but we cannot list members for 2012-04-19 09:59:40 +10:00
21f443eb82 provision: Leave result reporting up to caller. 2012-02-26 16:27:06 +01:00
bfa951db97 s4-s3-upgrade: Check if there are duplicate sids for users and groups
Autobuild-User: Amitay Isaacs <amitay@samba.org>
Autobuild-Date: Tue Jan 31 02:23:17 CET 2012 on sn-devel-104
2012-01-31 02:23:17 +01:00
449ca75759 s4-s3-upgrade: Use lowercase hostname as hostname for provision 2012-01-31 00:49:07 +01:00
1e935d1bdc s4-provision: Make BIND9_DLZ as the default backend for DNS 2011-11-29 16:00:36 +11:00
cd3f552f4f s3-py-passdb: Fix handling of uninitialized gid values
Uninitialized gid value is set to -1 and return as such from python
passdb api.

Autobuild-User: Amitay Isaacs <amitay@samba.org>
Autobuild-Date: Fri Nov 18 06:18:33 CET 2011 on sn-devel-104
2011-11-18 06:18:33 +01:00
244ecc844d s4-s3-upgrade: Add --verbose option to print extra details 2011-11-18 14:38:28 +11:00
e6c77f523b s4-s3-upgrade: Fix idmap types ID_TYPE_UID/ID_TYPE_GID instead of UID/GID 2011-11-18 14:38:28 +11:00
c48a2aa438 s4-s3-upgrade: Fix the minimum and maximum password age calculation
Windows sets maxPwdAge to -0x8000000000000000 when maximum password age
is set to 0 days.
2011-11-18 14:38:27 +11:00
e80dbdcab1 s4-s3-upgrade now look for -1 as the special 'not set' value
this is possible because we know the py_passdb will always set -1
here, not passing though 0xFFFFFFFF.

Andrew Bartlett
2011-11-18 14:38:27 +11:00
29cd8ae6fd s4-provision permit server role to be the ROLE_ strings from s3
Also convert between the aliases in one single place.

Andrew Bartlett

Pair-Programmed-With: Amitay Isaacs <amitay@samba.org>
2011-11-17 00:34:09 +01:00
80113755c4 s3-s4-upgrade: do not add description if it is empty string or none
Autobuild-User: Amitay Isaacs <amitay@samba.org>
Autobuild-Date: Wed Nov 16 05:53:41 CET 2011 on sn-devel-104
2011-11-16 05:53:41 +01:00
d61d28bccc s4-s3-upgrade Add my copyright 2011-11-08 02:58:06 +01:00
43f23b55c4 s4-s3-upgrade rename samba-tool domain samba3upgrade --libdir to --dbdir for clarity
The things pointed at are not typically in a directory called lib,
so avoid confusing our administrators.

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Wed Oct 19 15:43:04 CEST 2011 on sn-devel-104
2011-10-19 15:43:04 +02:00
be9378e41e s4-s3-upgrade fix format string for secrets.tdb exception 2011-10-19 14:13:09 +02:00
596d6cceab s4-s3-upgrade Fix samba3upgrade code to cope with a missing wins.dat 2011-10-19 14:13:09 +02:00
5f11615810 s4-s3-upgrade: Give a better clue when we cannot open secrets.tdb
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-10-18 13:13:31 +11:00
8c076862ad s4 provision: DNS backend should be set by caller
Autobuild-User: Kai Blin <kai@samba.org>
Autobuild-Date: Mon Oct 17 09:51:12 CEST 2011 on sn-devel-104
2011-10-17 09:51:12 +02:00
c6481f4f24 samba.upgrade: Use list comprehension.
Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Wed Oct 12 22:44:40 CEST 2011 on sn-devel-104
2011-10-12 22:44:40 +02:00
1255383140 s4-s3-upgrade: Allow import (just without a uid mapping) where getpwnam fails
This allows the tests to pass on systems without a jelmer user :-)

Andrew Bartlett
2011-10-11 13:41:36 +11:00
dc3df567be upgrade: Avoid catching all exceptions, just catch the ones we care about. 2011-10-08 14:15:11 +02:00
0ee22a2dec s4-python: Fix some formatting issues.
Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Tue Sep 13 03:51:13 CEST 2011 on sn-devel-104
2011-09-13 03:51:13 +02:00
c7b1f156bb s4-s3-upgrade: Check for duplicate sids before provisioning
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2011-09-12 20:42:20 +10:00
c6a40942b2 s4-s3-upgrade: Check for common user/group names before provisioning
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2011-09-12 20:42:17 +10:00