1
0
mirror of https://github.com/samba-team/samba.git synced 2025-06-19 23:17:05 +03:00

103 Commits

Author SHA1 Message Date
Andrew Bartlett
9eb022c8c6 provision: No longer use the wheel group in new AD Domains
The issue here is that if we set S-1-5-32-544 (administrators) to a
GID only, then users cannot force a mandetory profile to be owned by
administrators (which is a requirement).

There is no particularly useful reason for us to enforce this matching
a system group.

Andrew Bartlett
2012-10-18 17:10:58 +11:00
Jelmer Vernooij
2a797f29aa s4-python: Various formatting fixes.
* Trailing whitespace
* use of "==" where "is" should be used
* double spaces
2012-09-27 18:45:12 +02:00
Jelmer Vernooij
c0d4f2462f s4-python: Formatting fixes, break lines.
Autobuild-User(master): Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date(master): Sun Sep 16 15:58:04 CEST 2012 on sn-devel-104
2012-09-16 15:58:04 +02:00
Andrew Bartlett
2dd0e7141f s4-classicupgrade: Show more clearly what is wrong with the Adminstrator SID 2012-09-03 19:24:10 +10:00
Andrew Bartlett
9e441c4ed9 s3-classicupgrade: Fix import from ldap
We must not reference result before provision(), and do not need
session_info and lp for reading a normal ldap backend anyway.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Aug 28 09:49:39 CEST 2012 on sn-devel-104
2012-08-28 09:49:39 +02:00
Andrew Bartlett
444c9ffad7 s4-classicupgrade: Do the setting of the sysvol ACLs last, after idmap is configured
This will allow files to be correctly owned by the idmap that is imported.

This appears to fix an issue that came up after s3fs-compatible ACLs were
merged into provision.

Andrew Bartlett
2012-08-28 07:57:30 +10:00
Andrew Bartlett
d5b9972215 s4-classicupgrade: Read WINS DB before the provision 2012-08-28 07:57:29 +10:00
Andrew Bartlett
85f1c4fdfd s4-classicupgrade: Do all the queries of data before the provision()
This allows provision to change the s3 smb.conf settings if required.

Andrew Bartlett
2012-08-28 07:57:29 +10:00
Andrew Bartlett
738f4ac058 s4-classicupgrade: Use s3param.get_context() instead of result.lp
We should not need the guessed values here, but by changing to using the s3 loadparm context
we can move this block to before the provision.

Andrew Bartlett
2012-08-28 07:57:29 +10:00
Andrew Bartlett
97b13799ce s4-classicupgrade: Add --use-ntvfs option
This is an odd option, but is needed because I wish to add assertions about
ACL setting that will not work in make test without the vfs_fake_acls module
loaded.

Andrew Bartlett
2012-08-22 01:31:57 +02:00
Wesley Young
a57c5eb848 s4-classicupgrade: Tests if sam policies exist before trying to import them.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-14 08:37:48 +10:00
Geza Gemes
e2cea8fbea s4-classicupgrade: Add unix attributes during upgrade
Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sun Jul 22 13:20:20 CEST 2012 on sn-devel-104
2012-07-22 13:20:19 +02:00
Andrew Bartlett
8f443895f2 s4-classicupgrade: Demote any other 'BDC' accounts back to a member server during upgrade
This makes it clear that they cannot be a DC until they are upgraded with
samba-tool domain dcpromo.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Jul  6 09:59:13 CEST 2012 on sn-devel-104
2012-07-06 09:59:13 +02:00
Andrew Bartlett
f199c5dbc0 s4-classicupgrade: Allow DNS backend to be specified 2012-06-24 23:46:09 +10:00
Andrew Bartlett
352dbddb6d s4-idmap: Add parameter 'idmap_ldb:use rfc2307' and correct implementation errors 2012-06-20 16:22:41 +10:00
Andrew Bartlett
b58dc1826e s4-s3upgrade: Assert that administrator has a SID of -500, and only skip root if it is -500
Many upgraded installations have root as -1000, and so that account needs to be kept.

Andrew Bartlett
2012-06-16 08:18:10 +02:00
Andrew Bartlett
d0b60f02dd s4-s3upgrade: improve idmap import to use posixAccount and posixGroup entries 2012-06-16 08:18:10 +02:00
Andrew Bartlett
c2b094ffbc s4-s3-upgrade: Max/min password age policy is in seconds, not days
This cases upgraded domains to have a too-long password expiry, which in extreme
cases can cause the KDC to misfunction.

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Sun May  6 14:49:39 CEST 2012 on sn-devel-104
2012-05-06 14:49:39 +02:00
Andrew Bartlett
a0a83802fb s4-s3upgrade: Force ldapsam:trusted = yes
While this setting is not the default in Samba3, any domain that is
in a suitable condition to upgrade to Samba4 should already be in the
layout that ldapsam:trusted uses.  It can be turned off by setting
ldapsam:trusted=false in the smb.conf.

Many upgrades to Samba4 happen on a different host to the old Samba3 domain
and this avoids the need to configure nss_ldap only for the duration of
the upgrade.

Andrew Bartlett
2012-05-03 08:09:09 +10:00
Andrew Bartlett
d2c8ebe2c7 s4-s3upgrade: Try harder to get group memberships on upgrade
This fixes an issue where some group types were not upgraded, as we
did not upgrade alias memberships.

It also uses enum_group_memberships() to try and find the memberships
from the other direction, by asking which groups a user is a member
of.  As Samba3 (and NT4) does not implement nested groups, this should
be safe.

Andrew Bartlett
2012-05-03 08:09:09 +10:00
Andrew Bartlett
0d5d45c2df s4-s3upgrade: print the error message from passdb.error exceptions
This gives more information on why a group membership lookup failed.

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Tue Apr 24 04:34:44 CEST 2012 on sn-devel-104
2012-04-24 04:34:44 +02:00
Andrew Bartlett
6b2753d71e s4-samba-tool: Fix samba-tool fsmo seize
This is currently untested, and a restructure broke it.

Andrew Bartlett
2012-04-19 14:19:09 +10:00
Andrew Bartlett
a2b7a9e2a2 s4-s3upgrade: Do not ever set a domain-wide maxPwdAge of 0
This means no-expiry in s3, and so we must treat it like -1.

Andrew Bartlett
2012-04-19 14:19:09 +10:00
Andrew Bartlett
a5905bfb39 s4-s3upgrade: Ignore (with warning) groups that are listed but we cannot list members for 2012-04-19 09:59:40 +10:00
Jelmer Vernooij
21f443eb82 provision: Leave result reporting up to caller. 2012-02-26 16:27:06 +01:00
Amitay Isaacs
bfa951db97 s4-s3-upgrade: Check if there are duplicate sids for users and groups
Autobuild-User: Amitay Isaacs <amitay@samba.org>
Autobuild-Date: Tue Jan 31 02:23:17 CET 2012 on sn-devel-104
2012-01-31 02:23:17 +01:00
Amitay Isaacs
449ca75759 s4-s3-upgrade: Use lowercase hostname as hostname for provision 2012-01-31 00:49:07 +01:00
Amitay Isaacs
1e935d1bdc s4-provision: Make BIND9_DLZ as the default backend for DNS 2011-11-29 16:00:36 +11:00
Amitay Isaacs
cd3f552f4f s3-py-passdb: Fix handling of uninitialized gid values
Uninitialized gid value is set to -1 and return as such from python
passdb api.

Autobuild-User: Amitay Isaacs <amitay@samba.org>
Autobuild-Date: Fri Nov 18 06:18:33 CET 2011 on sn-devel-104
2011-11-18 06:18:33 +01:00
Amitay Isaacs
244ecc844d s4-s3-upgrade: Add --verbose option to print extra details 2011-11-18 14:38:28 +11:00
Amitay Isaacs
e6c77f523b s4-s3-upgrade: Fix idmap types ID_TYPE_UID/ID_TYPE_GID instead of UID/GID 2011-11-18 14:38:28 +11:00
Amitay Isaacs
c48a2aa438 s4-s3-upgrade: Fix the minimum and maximum password age calculation
Windows sets maxPwdAge to -0x8000000000000000 when maximum password age
is set to 0 days.
2011-11-18 14:38:27 +11:00
Andrew Bartlett
e80dbdcab1 s4-s3-upgrade now look for -1 as the special 'not set' value
this is possible because we know the py_passdb will always set -1
here, not passing though 0xFFFFFFFF.

Andrew Bartlett
2011-11-18 14:38:27 +11:00
Andrew Bartlett
29cd8ae6fd s4-provision permit server role to be the ROLE_ strings from s3
Also convert between the aliases in one single place.

Andrew Bartlett

Pair-Programmed-With: Amitay Isaacs <amitay@samba.org>
2011-11-17 00:34:09 +01:00
Amitay Isaacs
80113755c4 s3-s4-upgrade: do not add description if it is empty string or none
Autobuild-User: Amitay Isaacs <amitay@samba.org>
Autobuild-Date: Wed Nov 16 05:53:41 CET 2011 on sn-devel-104
2011-11-16 05:53:41 +01:00
Andrew Bartlett
d61d28bccc s4-s3-upgrade Add my copyright 2011-11-08 02:58:06 +01:00
Andrew Bartlett
43f23b55c4 s4-s3-upgrade rename samba-tool domain samba3upgrade --libdir to --dbdir for clarity
The things pointed at are not typically in a directory called lib,
so avoid confusing our administrators.

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Wed Oct 19 15:43:04 CEST 2011 on sn-devel-104
2011-10-19 15:43:04 +02:00
Andrew Bartlett
be9378e41e s4-s3-upgrade fix format string for secrets.tdb exception 2011-10-19 14:13:09 +02:00
Andrew Bartlett
596d6cceab s4-s3-upgrade Fix samba3upgrade code to cope with a missing wins.dat 2011-10-19 14:13:09 +02:00
Andrew Bartlett
5f11615810 s4-s3-upgrade: Give a better clue when we cannot open secrets.tdb
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-10-18 13:13:31 +11:00
Kai Blin
8c076862ad s4 provision: DNS backend should be set by caller
Autobuild-User: Kai Blin <kai@samba.org>
Autobuild-Date: Mon Oct 17 09:51:12 CEST 2011 on sn-devel-104
2011-10-17 09:51:12 +02:00
Jelmer Vernooij
c6481f4f24 samba.upgrade: Use list comprehension.
Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Wed Oct 12 22:44:40 CEST 2011 on sn-devel-104
2011-10-12 22:44:40 +02:00
Andrew Bartlett
1255383140 s4-s3-upgrade: Allow import (just without a uid mapping) where getpwnam fails
This allows the tests to pass on systems without a jelmer user :-)

Andrew Bartlett
2011-10-11 13:41:36 +11:00
Jelmer Vernooij
dc3df567be upgrade: Avoid catching all exceptions, just catch the ones we care about. 2011-10-08 14:15:11 +02:00
Jelmer Vernooij
0ee22a2dec s4-python: Fix some formatting issues.
Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Tue Sep 13 03:51:13 CEST 2011 on sn-devel-104
2011-09-13 03:51:13 +02:00
Amitay Isaacs
c7b1f156bb s4-s3-upgrade: Check for duplicate sids before provisioning
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2011-09-12 20:42:20 +10:00
Amitay Isaacs
c6a40942b2 s4-s3-upgrade: Check for common user/group names before provisioning
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2011-09-12 20:42:17 +10:00
Andrew Bartlett
47130f97fd s4-s3-upgrade Do not use python 2.6 style exceptions
Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Fri Sep  9 08:54:16 CEST 2011 on sn-devel-104
2011-09-09 08:54:16 +02:00
Andrew Bartlett
b8aa4e513c s4-s3-upgrade do not convert min password length as a time
Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Fri Sep  9 01:53:55 CEST 2011 on sn-devel-104
2011-09-09 01:53:55 +02:00
Andrew Bartlett
c640e9235f s4-s3-upgrade: convert password age policies to the negative NTTIME format
This previously caused all accounts to be locked out.

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Wed Sep  7 13:44:44 CEST 2011 on sn-devel-104
2011-09-07 13:44:44 +02:00