1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Commit Graph

29310 Commits

Author SHA1 Message Date
Andrew Bartlett
30253c11cc s4-samba-tool: Ensure we also sync the SACL as well as the DACL during sysvolreset 2012-09-04 09:52:23 +02:00
Andrew Bartlett
9983ad7a80 s3-passdb: Rename pdb_samba4 to samba_dsdb and autoconfigure when we are a AD DC
The name samba_dsdb is not ideal, but it matches the primary ldb
module we use, and more importantly it avoids having '4' in the name.
We should slowly avoid using the term samba4 in long-term places like
the smb.conf because it is confusing to users given we are shipping
Samba 4.0 as an AD DC as well as all the other supported roles (domain
member/standalone server/classic DC)

Additionally, samba4 will be an odd name when we eventually release
Samba 5.0!

samba4 remains accepted as an alias to ensure existing smb.conf files
load, but to allow changes here in the future, we set the value during
the smb.conf load, and not during the provision when we are an AD DC.

This simplifies the default smb.conf for the vast majority of our
users and reduces the number of things listed in smb.conf files that
we later have to work around if we wish to change the
name/implementation of the passdb glue module again.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Sep  4 04:45:16 CEST 2012 on sn-devel-104
2012-09-04 04:45:16 +02:00
Andrew Bartlett
2dd0e7141f s4-classicupgrade: Show more clearly what is wrong with the Adminstrator SID 2012-09-03 19:24:10 +10:00
Jeremy Allison
5e0365dfe8 Now SEC_RIGHTS_PRIV_RESTORE and SEC_RIGHTS_PRIV_BACKUP don't include any generic bits (they're used directly in the fileserver where the generic bits have already been mapped into file specific bits) we need to add the generic bits to the test when we have these privileges.
Mark samba4.base.maximum_allowed knownfail until we implement NTCREATEX_OPTIONS_BACKUP_INTENT.
2012-08-31 20:32:37 -07:00
Jeremy Allison
6550bc0d26 Rewrite torture_samba3_rpc_sharesec() to use a non-privileged user for share security descriptor testing. 2012-08-31 20:29:13 -07:00
Andrew Bartlett
4d7dad1315 s4-dsdb: Remove unused variables
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Sep  1 05:10:47 CEST 2012 on sn-devel-104
2012-09-01 05:10:47 +02:00
Andrew Bartlett
8557c692f6 s4-kdc: Improve grammer and clarity of password change failure messages.
This can still be improved further, but avoid mentioning reasons that
clearly do not apply in this case.

Andrew Bartlett
2012-09-01 03:33:21 +02:00
Andrew Bartlett
01ade93c7c s4-dsdb: Remove unused tmp_ctx leaked onto long-term ldb_context
This was found based on a log provided by Ricky Nance
<ricky.nance@weaubleau.k12.mo.us>.  Thanks Ricky!

Andrew Bartlett
2012-09-01 03:33:20 +02:00
Kai Blin
c256566aa9 s4 dns: Store TKEYs in a ringbuffer
This stops us from potentially being DoSed by tons of TKEYs

Autobuild-User(master): Kai Blin <kai@samba.org>
Autobuild-Date(master): Fri Aug 31 22:46:01 CEST 2012 on sn-devel-104
2012-08-31 22:46:01 +02:00
Kai Blin
7204dc9708 s4 dns: Negotiate GSSAPI-based TKEYs
Autobuild-User(master): Kai Blin <kai@samba.org>
Autobuild-Date(master): Fri Aug 31 10:38:35 CEST 2012 on sn-devel-104
2012-08-31 10:38:35 +02:00
Andrew Bartlett
d2c0387d66 s4-kdc: Give information on how long the password history is
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Aug 31 08:06:17 CEST 2012 on sn-devel-104
2012-08-31 08:06:17 +02:00
Andrew Bartlett
efec5a9299 s4-libnet: Fix memory leak of lsa_RefDomainList and lsa_String onto libnet_ctx
These are only needed for as long as the call, and should be children of the
private context.

This was found based on a log provided by Ricky Nance
<ricky.nance@weaubleau.k12.mo.us>.  Thanks Ricky!

Andrew Bartlett
2012-08-31 14:30:38 +10:00
Jeremy Allison
7c4ae72851 Now ACL inheritance flags are working, add test_inheritance_flags() back into raw.acls to ensure we don't regress. 2012-08-30 11:01:30 -07:00
Andrew Bartlett
5131359eda auth/credentials: Support match-by-key in cli_credentials_get_server_gss_creds()
This allows a password alone to be used to accept kerberos tickets.

Of course, we need to have got the salt right, but we do not need also
the correct kvno.  This allows gensec_gssapi to accept tickets based on
a secrets.tdb entry.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Aug 30 01:26:12 CEST 2012 on sn-devel-104
2012-08-30 01:26:12 +02:00
Andrew Bartlett
a58bf44c1e s4-torture: Add start of a test to confirm winbindd PAC parsing
So far this confirms that we can accept a ticket using the secrets.tdb
entry.

Andrew Bartlett
2012-08-29 23:46:17 +02:00
Andrew Bartlett
e39cce4214 s4-libnet: Fix passing samba_all_enctypes as a fn rather than the encrypt array it returns
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Aug 29 09:56:27 CEST 2012 on sn-devel-104
2012-08-29 09:56:27 +02:00
Andrew Bartlett
3a303ae5ab selftest: Add a test for smbclient --machine-pass without secrets.tdb
Errors in handling the upgrade case without a matching secrets.tdb caused segfaults
in the server.  This essentially tests both sides.

Andrew Bartlett
2012-08-29 09:10:40 +10:00
Andrew Bartlett
9e441c4ed9 s3-classicupgrade: Fix import from ldap
We must not reference result before provision(), and do not need
session_info and lp for reading a normal ldap backend anyway.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Aug 28 09:49:39 CEST 2012 on sn-devel-104
2012-08-28 09:49:39 +02:00
Andrew Bartlett
24f3147019 selftest: Fix comment in blackbox_s3upgrade.sh 2012-08-28 07:57:30 +10:00
Andrew Bartlett
444c9ffad7 s4-classicupgrade: Do the setting of the sysvol ACLs last, after idmap is configured
This will allow files to be correctly owned by the idmap that is imported.

This appears to fix an issue that came up after s3fs-compatible ACLs were
merged into provision.

Andrew Bartlett
2012-08-28 07:57:30 +10:00
Andrew Bartlett
5aa9a6c936 s3-passdb: Allow reload of the static passdb from python
This is then used in provision when the passdb backend is forced.

Andrew Bartlett
2012-08-28 07:57:30 +10:00
Andrew Bartlett
1a8fd711d7 selftest: Add test of smbclient --machine-pass against and using both s3 and s4
This uses both smbclient binaries to ensure that both work in both environments.

Andrew Bartlett
2012-08-28 07:57:29 +10:00
Andrew Bartlett
43904cb4f5 s4-dsdb: Remove double-free in update_keytab module 2012-08-28 07:57:29 +10:00
Andrew Bartlett
8c205395c6 s4-dsdb: Add secrets_tdb_sync - an ldb module to keep secrets.tdb in sync
secrets_tdb_sync is a new ldb module designed to sync secrets.ldb
entries with the secrets.tdb file.

While not ideal to keep two copies of this data, this routine will
assist in allowing the samba-tool domain join code to operate
correctly in most cases where winbindd and smbd are used.

Andrew Bartlett
2012-08-28 07:57:29 +10:00
Andrew Bartlett
62373b8a50 lib/krb5_wrap: Move enctype conversion functions into a simple helper file 2012-08-28 07:57:29 +10:00
Andrew Bartlett
d5b9972215 s4-classicupgrade: Read WINS DB before the provision 2012-08-28 07:57:29 +10:00
Andrew Bartlett
85f1c4fdfd s4-classicupgrade: Do all the queries of data before the provision()
This allows provision to change the s3 smb.conf settings if required.

Andrew Bartlett
2012-08-28 07:57:29 +10:00
Andrew Bartlett
738f4ac058 s4-classicupgrade: Use s3param.get_context() instead of result.lp
We should not need the guessed values here, but by changing to using the s3 loadparm context
we can move this block to before the provision.

Andrew Bartlett
2012-08-28 07:57:29 +10:00
Andrew Bartlett
1ed6070570 lib/krb5_wrap: Move kerberos_enctype_to_bitmap() into krb5_wrap 2012-08-28 07:57:28 +10:00
Andrew Bartlett
0f7aa3db52 lib/krb5_wrap: Bring list of all enc types into krb5_wrap 2012-08-28 07:57:28 +10:00
Andrew Bartlett
861353972d s4-libnet: Ensure termination of enctype array in libnet_export_keytab() 2012-08-28 07:57:28 +10:00
Volker Lendecke
f118eae76d s4-torture: Test for #9058
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Mon Aug 27 17:43:09 CEST 2012 on sn-devel-104
2012-08-27 17:43:08 +02:00
Stefan Metzmacher
b05d28ebdd s4:winbind: let wb_update_rodc_dns_send/recv use netlogon_queue (bug #9097)
metze

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Sat Aug 25 05:06:18 CEST 2012 on sn-devel-104
2012-08-25 05:06:18 +02:00
Stefan Metzmacher
646012954c s4:winbind: let wb_sam_logon_send/recv() use the netlogon_queue (bug #9097)
metze
2012-08-25 01:39:42 +02:00
Stefan Metzmacher
19daec6a95 s4:winbind: add a netlogon_queue (tevent_queue)
This will protect the netlogon_creds later.

metze
2012-08-25 01:39:41 +02:00
Stefan Metzmacher
d4aa8978cc s4:winbind: convert wb_update_rodc_dns_send/recv to tevent_req
metze
2012-08-25 01:39:41 +02:00
Stefan Metzmacher
0ccdaa940a s4:winbind: convert wb_sam_logon_send/recv to tevent_req
metze
2012-08-25 01:39:41 +02:00
Stefan Metzmacher
d3756d8738 s4:winbind: convert wb_sid2domain to tevent_req internally
The public wrapper still uses composite_context, because I don't
have time to fix all the callers...

metze
2012-08-25 01:39:41 +02:00
Stefan Metzmacher
89a5a71654 s4:librpc/rpc: don't do async requests if gensec doesn't support async replies (bug #9097)
metze
2012-08-25 01:39:41 +02:00
Stefan Metzmacher
0bd0ad967d s4:librpc/rpc: also call dcerpc_schedule_io_trigger() after bind and alter_context responses
metze
2012-08-25 01:39:41 +02:00
Stefan Metzmacher
e44b5bdb2c s4:librpc/rpc: use dcerpc_req_dequeue() in dcerpc_request_recv_data()
metze
2012-08-25 01:39:41 +02:00
Stefan Metzmacher
81bc57d395 s4:librpc/rpc: use talloc_zero for 'struct rpc_request'
metze
2012-08-25 01:39:41 +02:00
Andrew Bartlett
123ee7f9b5 s4-selftest: Add test for samba-tool ntacl sysvolcheck 2012-08-23 15:02:26 +02:00
Andrew Bartlett
ebcdc4a36b s4-samba-tool: Add samba-tool ntacl sysvolcheck command
This command verifies that the current on-disk ACLs match the directory and
the defaults from provision.

Unlike sysvolreset, this does not change any of the permissions.

Andrew Bartlett
2012-08-23 15:02:26 +02:00
Andrew Bartlett
0aed29105e s3-smbd: Add security_info_wanted argument to get_nt_acl_no_snum
I need to get at the owner, group, DACL and SACL when testing correct
ACL storage.

Andrew Bartlett
2012-08-23 15:02:26 +02:00
Andrew Bartlett
7cf50b9f30 s4-selftest: Add testing of samba-tool ntacl sysvolreset 2012-08-23 15:02:26 +02:00
Andrew Bartlett
8c71dc3505 param: Add startup checks for valid server role/binary combinations
This should eliminate confusion from our users about what they can
expect to successfully run.

Andrew Bartlett
2012-08-23 15:02:26 +02:00
Andrew Bartlett
7e7ed72bbe s4-provision: Fix internal documentation 2012-08-23 15:02:26 +02:00
Andrew Bartlett
51e3547426 s3-pysmbd: Allow a mode to be specified for the simple ACL
The additional group for the ACL is now optional.

Andrew Bartlett
2012-08-23 15:02:26 +02:00
Andrew Bartlett
8f909199c4 s4-samba-tool: Add 'samba-tool ntacl sysvolreset' tool
This will reset the NT ACL on the sysvol share to the default from
provision, with GPO objects matching the LDAP ACL (as required).

Andrew Bartlett
2012-08-23 15:02:26 +02:00