1
0
mirror of https://github.com/samba-team/samba.git synced 2025-07-06 08:59:08 +03:00
Commit Graph

390 Commits

Author SHA1 Message Date
5a72eca574 s4-provision: move zone file to dns subdirectory
This allows the permissions to be correctly set for bind to write to
a journal file. It also sets the right group ownership and permissions
on the files that bind needs to access.

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-02-11 21:04:11 +11:00
5a2ff4d16f s4:provision Be more polite to long-suffering Samba testers.
Our testers put up with a lot of odd things when testing out Samba4.

Andrew Bartlett
2010-02-11 17:16:55 +11:00
f299fe565a s4:provision Just 'do the right thing' with empty smb.conf files
For some reason, JHT keeps on creating an empty smb.conf file,
expecting it to be the same as a non-existant one.  It is easier to
just realise what he meant.

Andrew Bartlett
2010-02-10 16:18:21 +11:00
4291e28a93 s4-python: Fix formatting. 2010-01-25 15:18:02 +01:00
d4514a6539 provision: introduce use-xattr parameter for defining where to store attributes
This option allow simple user (non root) to invoke provision without facing an error
  while insuring that ACL on shared files will always be set
2010-01-21 07:11:17 +13:00
e78626dc2e s4: Set acls correctly on all sysvol and scripts shares 2010-01-21 07:11:15 +13:00
028c9b1c15 s4: regroup gpo modification in one function, set acl on files accordingly with ACL in LDAP 2010-01-21 07:11:14 +13:00
a4eaa11134 Fixed a problem with incorrect default SD owner/group. 2010-01-13 15:16:38 +02:00
a7fffe8da0 s4-provision: do a self join for all server types
We need a machine account so the RID allocation code can work. It
seems better to use the same code paths for a domain controller and
standalone server to avoid testing headaches with little used code.
2010-01-08 13:03:05 +11:00
1f25d0a5ad s4-provision: re-open sam.ldb after creating the schema
This enables the full schema during the rest of the provision, which
means indexing is enabled (along with index error checking, such as
duplicate SIDs)
2010-01-08 13:03:03 +11:00
53d10d139e s4-provision: don't hard wire the creation of the RID Set object
We now create it automatically in the samldb module when the first
user is created. 

The creation of the dns user also had to move to the _modify.ldif as
it now relies on the fSMO role being setup for the RID Manager

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-08 13:03:00 +11:00
5eb3b919c5 s4-provision: the DC object itself needs a fixed objectSID
We can't allocate a objectSID until we have rIDSetReferences, but that
is in the DC object, so we have to force the objectSID of the DC

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-08 13:02:58 +11:00
dbda2c2db5 s4-provision: added a note about where invocationIDs come from
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2009-12-21 23:41:04 +11:00
c3d1e5ca0c s4:provision Give a more useful error message in guess_names
The problem here is that as we start to get 'real users' they still
decide to do silly things, like load empty but existing smb.conf
files.  Let's give them a better chance to discover what they did
wrong.

Andrew Bartlett
2009-12-18 14:27:43 +11:00
bf2c1e9c4f s4: load the domain level of the current provision and create a provision with the same domain level
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-12-01 12:17:32 +11:00
db41a0afc6 s4: fix SD update and password change in upgrade script
- reserve a new Samba OID for recalculate SD control
- fix the update SD function
- fix handling of kvno in the update_machine_account_password function
- fix handling of handles in RPC winreg server

Signed-off-by: Andrew Tridgell <tridge@samba.org>
2009-11-28 09:56:06 +11:00
f749e22cca s4:provision.py - remove hardcoded SIDs and RIDs
After rework of the SDDL modules this is possible. In future: Never hardcode
them anymore! Always use the abbreviations.
2009-11-27 22:46:05 +01:00
33188999b5 s4:provision.py - cosmetic 2009-11-27 17:39:02 +01:00
a5d854afbc s4:provision - Fix up the provision of "standalone" and "member" mode
Both modes weren't possible anymore since 1.) the secrets entry wasn't created,
2.) a lookup in winbindd was done using "lp_workgroup()" rather than
"lp_sam_name()" (since on the mentioned two configurations we use the netbios
name as domainname - and not the workgroup).
2009-11-27 14:51:14 +01:00
a7fa3a9703 s4:provision.py - cosmetic output correction 2009-11-27 13:07:52 +01:00
09338e60bc s4:provision Make setting the domain SID in the self join optional 2009-11-27 16:05:04 +11:00
3ed0cae14b s4: Fix missing TLS dir when targetdir is not the default one 2009-11-24 15:21:56 +11:00
fdb5914b27 s4:provision Move exceptions into a new file
This allows provisionbackend and provision to both raise ProvisionException
2009-11-24 11:09:30 +11:00
401ba9c9cf s4:dsdb Move module configuration from each ldb into samba_dsdb.c
This makes getting the module order correct, the obligation of Samba4
developers, and not system administrators.  In particular, once an ldb
is updated to use only the 'samba_dsdb' module, no further changes to the
ldb should be required when upgrading to later Samba4 versions.

(thanks to metze for the suggestion of samba_dsdb as a long-term
stable name for the module)

Andrew Bartlett
2009-11-23 14:15:07 +01:00
e297af00fa s4:provision Simplify the module list
This makes the member server much more like the DC, the objectGUID
module replaces the repl_meta_data module.

We also generally rework the construction of the list, building a full
list in python, and then transforming it into a string, rather than
playing string concatonation games

Andrew Bartlett
2009-11-23 14:15:06 +01:00
5c3ef6dbae s4:provision Split up reference creation, load schema earlier in the stack
The schema needs to be loaded above the extended_dn_out modules as
otherwise we don't get an extended DN in the search results.

The reference split is to ensure we create references after the
objects they reference exist.

Andrew Bartlett
2009-11-17 10:38:04 +11:00
8e5f5e3f05 s4:provision - Removed dependency on full Samba 3 schema from FDS 2009-11-16 07:57:40 +11:00
f3bc54a8f1 s4:provision - Added LDBBackend and ExistingBackend. 2009-11-12 22:23:22 +11:00
55bb60a5db s4:provision - Added constructors for FDSBackend and OpenLDAPBackend. 2009-11-12 22:23:22 +11:00
1564067fbc s4:provision - Added setup() method in LDAPBackend. 2009-11-12 22:23:21 +11:00
ba12eb99a0 s4:provision - Moved provision_xxx_backend() into backend-specific provision() method. 2009-11-12 22:23:21 +11:00
be766a3841 s4:provision - Added start() method in LDAPBackend. 2009-11-12 22:23:21 +11:00
fbc5696e38 s4:provision - Added initial implementation of FDSBackend and OpenLDAPBackend. 2009-11-12 22:23:21 +11:00
6437c38aeb s4:provision Remove unused 'sambadn' parameter 2009-11-12 16:34:10 +11:00
1fc47e1228 Version 1.0 of the directory service acls module.
At this point, support for checks on LDAP add, delete, rename and modify.
Old kludge_acl is still there to handle the searches.
This module is synchronous as the async version was impossible to debug,
will be converted to async after some user testing.
2009-11-05 17:34:12 +02:00
b8ecf39d9f Added security descriptor for the domain NC to provisioning.
Necessary for correct descriptor inheritance. Based on the default state
of a single DC. Will be modified later when we support multiple DCs.
2009-11-04 15:58:54 +02:00
371afc47dc s4:provision Remove LDB backend files in provision
Rather than try and remove the records in the LDB files, make the
provision remove the whole file.  This also removes the need to try
and carry forward the old ldb filenames.

Andrew Bartlett
2009-11-02 16:36:56 +11:00
6439bdeb3a s4:provision Split ProvisionBackend out of the main provision script
This splits the code, while keeping the original behaviour.  The
provision.py file had become just too long.

Andrew Bartlett
2009-11-02 16:36:56 +11:00
aa37db5a12 s4:provision Inline 'ldap_backend_shutdown' for clarity 2009-11-02 16:36:55 +11:00
4be253fe2f s4:provision Move 'Schema' into it's own file 2009-11-02 16:36:55 +11:00
76d289bb0e s4:provision Make 'linked_attributes' and 'dnsyntax_attributes' a property of the Schema 2009-11-02 16:36:55 +11:00
350e963545 s4:provision Rework provision to always have a ProvisionBackend
Rather than treat the LDAP backend as a special case, treat all
backends the same, with different callbacks.

Andrew Bartlett
2009-11-02 16:36:54 +11:00
e035433bab s4 - SID allocation using FDS DNA plugin 2009-11-02 16:36:54 +11:00
1fc19ee7d0 s4:dsdb - Fixed attribute dereferencing for FDS 2009-11-02 16:36:53 +11:00
e5b86d2674 s4:dsdb Split schema loading and schema data management
By splitting the module this way, we can load the schema at startup, after
the partitions module is operational, but we leave the 'mess with details of
entries in the partitions' module to operate only on the partitions module.

Loading the schema later allows us to set the @ATTRIBUTES correctly on all
the databases.

Andrew Bartlett
2009-10-23 15:41:00 +11:00
2b82b8e2d3 s4:provision - Reintroduce accidentally removed parameters and checks from "guess_names"
abartlet pointed out that those are essential for a safe and consistent provision.
2009-10-22 09:17:27 +02:00
33f3d54de4 s4:provision - rework the "guess_names" and "make_smbconf" method
- Cleans it up from unnecessary "lower()/upper()" and parameters which can be
  derived through "lp" calls.
- Substitute the "HOSTNAME" caption in the "smb.conf" templates with
  "NETBIOS_NAME" which fits better.
- Now the "realm" and "domain" parameter of the provision are totally case
  insensitive and the script itself up/downcases them appropriately depending
  on the use (e.g. "realm" upcase for KERBEROS, lowcase for DNS domainname).
2009-10-21 23:43:04 +02:00
47fcde1922 s4:provision - important fix for DNS domainname: lower realm 2009-10-21 18:46:44 +02:00
4c36cac5ad s4:provision Use schema to casefold partitions on 'upgrade'.
This helps us upgrade from sam.ldb files before the dynamic partitions
work, and ensures we use the right casefolding functions.

Andrew Bartlett
2009-10-21 22:43:55 +11:00
27c28d34a7 s4:Handle reprovision with existing partitions
The issue here is that if we don't put the partitions metadata in the
database before we wipe it, we won't wipe the partitions contents, and
so the provision will later fail (entry already exists)

Andrew Bartlett
2009-10-21 22:43:51 +11:00