File: //lib/python3.6/site-packages/ipaclient/install/__pycache__/ipa_client_samba.cpython-36.pyc
3
�d[e-h � @ s� d dl mZ d dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
d dl m Z d dl
mZmZ d dlmZmZ d d lmZ d d
lmZ d d lmZ d d lmZ d d
lm Z d dl m Z d dl m Z d dl!m"Z" d dl#m$Z$ d dl%m&Z& d dl'm(Z( d dl)m*Z* d dl+m,Z, ej-ej.j/e0��Z1e1j2ej3� e
dd� �Z4dd� Z5dZ6dd � Z7d d d d �Z8d d!d d �Z9d"d#� Z:d$Z;d%Z<d&Z=d'd(� Z>d)d*� Z?d+d,� Z@d-d.� ZAd/d0� ZBd:d2d3�ZCd4d5� ZDd6d7� ZEd8d9� ZFdS );� )�print_functionN)�urlsplit)� OptionParser)�contextmanager)� discovery)�CLIENT_NOT_CONFIGURED�CLIENT_ALREADY_CONFIGURED)�api�errors)�
sysrestore)�check_client_configuration)�context)�ipautil)�SetseboolError)�standard_logging_setup)�DNSName)�tasks)�paths)� constants)�services)� ScriptError)�generate_random_passwordc c s� t j� ��}z�ttdd �}tj| tjj�}||d�}tj|d|d� t j
d�sTt j � y.t j j
j� rnt j j
j� t j j
j� d V W n< tjjk
r� } z td| |t|�f ��W Y d d }~X nX W d t j j
j� r�t j j
j� ttd|� X W d Q R X d S )N� principal)ZccacheZ
client_keytabZinitiate)�name�usage�store�finalizezGUnable to bind to IPA server. Error initializing principal %s in %s: %s)r Zprivate_ccache�getattrr
�gssapi�NameZNameTypeZkerberos_principalZ Credentialsr Zisdoner ZBackendZ rpcclientZ isconnectedZ
disconnectZconnect�
exceptionsZGSSError� Exception�str�setattr)r ZkeytabZ ccache_fileZ
old_principalr r �e� r% �&/usr/lib/python3.6/ipa_client_samba.py�use_api_as_principal' s(
( r' c C s� d} t | d�}|jdddd� |jddd d d
� |jd d d
ddd� |jddd
ddd� |jddd
ddd� |jdddd
ddd� |jdd d d
dd d� |jd d d
dd!d� |j� \}}||fS )"Nz%prog [options]
)r z--server�serverz FQDN of IPA server to connect to)�dest�helpz--netbios-name� netbiosnamez NetBIOS name of this machine)r) r* �defaultz
--no-homes�no_homes�
store_trueFz=Do not add [homes] share to the generated Samba configuration)r) �actionr, r* z--no-nfs�no_nfsz/Do not allow NFS integration (SELinux booleans)z--force�forcez'force installation by redoing all stepsz-dz--debug�debugzprint debugging informationz-Uz --unattended�
unattendedz.unattended installation never prompts the userz --uninstall� uninstallz+Revert configuration and remove SMB service)r Z
add_option�
parse_args)r �parser�options�argsr% r% r& �
parse_optionsE sf
r9 z�
Domain name: {domain_name}
NetBIOS name: {netbios_name}
SID: {domain_sid}
ID range: {range_id_min} - {range_id_max}
c C s. g }x | D ]}|j tjf |�� q
W dj|�S )N�
)�append�domain_information_template�format�join)�info�result�domainr% r% r& � pretty_print_domain_information� s
rB Z
ipantflatnameZipantsecurityidentifier�cn)� netbios_name�
domain_sid� domain_nameZipanttrusteddomainsidc C s� y | j j}W n tk
r g S X y|� d }W n tjk
rF g S X t� }x*tj� D ] \}}|j|d g�d ||< qXW dj | j
j d�}| j j |�d }t
|d d �|d< t
|d d �t
|d d � d |d < |g}| j j� d }x�|D ]�}| j j|d
d d d d �d } x�| D ]�}
t� } x(tD ] }|
jt| d g�d | |< �q(W dj | d
j� d�} | j j | �d }
t
|
d d �| d< t
|
d d �t
|
d d � d | d < |j| � �qW q�W |S )Nr@ r z{realm}_id_range)�realmZ ipabaseidZ range_id_minZipaidrangesize� Z range_id_maxrC T)�all�rawrF )�CommandZtrustconfig_show�AttributeErrorr
� PublicError�dict� trust_keymap�items�getr= �envrG Z idrange_show�intZ
trust_findZtrustdomain_find�trust_keymap_trustdomain�upperr; )r Z
tc_commandr@ Zl_domain�key�valZ
idrange_local�domainsZforest�r�domZr_domZr_idrange_nameZ r_idranger% r% r& �retrieve_domain_information� s> (
(r[ a-
[global]
# Limit number of forked processes to avoid SMBLoris attack
max smbd processes = 1000
# Use dedicated Samba keytab. The key there must be synchronized
# with Samba tdb databases or nothing will work
dedicated keytab file = FILE:${samba_keytab}
kerberos method = dedicated keytab
# Set up logging per machine and Samba process
log file = /var/log/samba/log.%m
log level = 1
# We force 'member server' role to allow winbind automatically
# discover what is supported by the domain controller side
server role = member server
realm = ${realm}
netbios name = ${machine_name}
workgroup = ${netbios_name}
# Local writable range for IDs not coming from IPA or trusted domains
idmap config * : range = 0 - 0
idmap config * : backend = tdb
z
idmap config ${netbios_name} : range = ${range_id_min} - ${range_id_max}
idmap config ${netbios_name} : backend = sss
z2
# Default homes share
[homes]
read only = no
c C s� t jtjj|jd�}|d d |d< tg}x |D ]}|jtj t
|�g� q0W |j s^|jt g� | j
t j� tt jd�� }|jtj dj|�|�� W d Q R X tjt j� d S )N)Z samba_keytabrG Z machine_namer rD �wr: )r � SAMBA_KEYTABr rR rG r+ �smb_conf_template�extendr Z template_str�idmap_conf_domain_snippetr- �homes_conf_snippetZ backup_file�SMB_CONF�open�writer> r Zrestore_context)�fstore�
statestorer7 rX Zsub_dict�templaterZ �fr% r% r& �configure_smb_conf s
"ri c C s
t dd�S )N� � )r )re rf r7 rA r% r% r& � generate_smb_machine_account s rl c C s� t jd|dt jdddg}y tj||d | dd� W n2 tjk
rf } ztjd |� � W Y d d }~X nX d
}ytj j
||d � W n4 t j k
r� } ztjd ||� � W Y d d }~X nX d S )
Nz-pz-kz-Pz-ez<aes128-cts-hmac-sha1-96,aes256-cts-hmac-sha1-96,arcfour-hmacr: zutf-8)�stdin�encodingz8Cannot set machine account password at IPA DC. Error: %szipaNTHash=MagicRegen)Zaddattrz<Cannot update %s principal NT hash value due to an error: %s)
r Z
IPA_GETKEYTABr] r �run�CalledProcessError�logger�errorr rK Z service_modr
rM ) re rf r7 rA r �passwordr8 r$ �valuer% r% r& �retrieve_service_principal# s0 ru c : C sr t jd|d g}ytj|� W n2 tjk
rP } ztjd|� � W Y d d }~X nX dj|d �}t jt j d|dg}ytj|� W n2 tjk
r� } ztjd|� � W Y d d }~X nX d j|d �}t jt j d|dg}ytj|� W n4 tjk
�r } ztjd|� � W Y d d }~X nX t jd
d g}ytj||d d
� W n4 tjk
�rl } ztjd|� � W Y d d }~X nX d S )NZ setdomainsidrE z)Cannot set domain SID in Samba. Error: %sz#SECRETS/MACHINE_LAST_CHANGE_TIME/{}rD r z2\00z8Cannot prepare machine account creds in Samba. Error: %szSECRETS/MACHINE_PASSWORD/{}Zchangesecretpwz-fzutf-8)rm rn z4Cannot set machine account creds in Samba. Error: %s)
r �NETr ro rp rq rr r= ZTDBTOOLZ SECRETS_TDB)re rf r7 rA rs r8 r$ Z secrets_keyr% r% r& �populate_samba_databasesI s<
rw c C sl t jdddddg}tjd� ytj|� W n< tjk
rf } z d|jkrVtjd|� � W Y d d }~X nX d S ) N�groupmap�addzsid=S-1-5-32-546zunixgroup=nobodyz type=builtinz&Map BUILTIN\Guests to a group 'nobody'z"already mapped to SID S-1-5-32-546z8Cannot map BUILTIN\Guests to a group "nobody". Error: %s) r rv rq r? r ro rp �stdoutrr )re rf r7 rA r8 r$ r% r% r& �configure_default_groupmapv s
r{ Tc sn � fdd�}|r|nd }yt j| |d� W n> tk
rh } z"tdt|� � tjd|� W Y d d }~X nX d S )Nc s � j d| |� d S )N�selinux)� backup_state)r rt )rf r% r& �default_backup_func� s z1set_selinux_booleans.<locals>.default_backup_func)� backup_funcz WARNING: z WARNING: %s)r �set_selinux_booleansr �printr" rq r? )Zbooleansrf �backupr~ r r$ r% )rf r& r� � s r� c C s0 |j sttjd |� |js,ttjd |� d S )NZshare_home_dirsZreshare_nfs_with_samba)r- r� r �SELINUX_BOOLEAN_SMBSERVICEr0 )re rf r7 rA r% r% r& �harden_configuration� s r� c % sH t jdt�}t jdt�}x(||fD ] }|j� r6|j� |j� q"W i }x,tjD ]"}x |D ]}|jd|�||< qXW qNW |r�t ||dd� t
j t j
d� | jt j�r�t
jt j� | jt j� x^t jtjjt jd�tjjt jd�fD ]6� � fd d
�tj� �D �} x| D ]}
t
j|
� �q W q�W tjjt j��r�y t
jt jd tjj d t jg� W nB t
j k
�r� } z"| j d
k�rzt j dtjj � W Y d d } ~ X nX t!tjj"t j#��� ytj$j%tjj � W n� t&j'k
�r� } zt(dt)| � � W Y d d } ~ X nR t&j*k
�r t j+d� Y n2 t&j,k
�r8 } zt j-d| � W Y d d } ~ X nX W d Q R X d S )N�smb�winbindr| F)r� )Z ccache_pathZprivate�lockc s$ g | ] }|j d �rtjj� |��qS )z.tdb)�endswith�os�pathr> )�.0�tdb_file)�smbpathr% r& �
<listcomp>� s z uninstall.<locals>.<listcomp>z --principalz-k� z Failed to remove old key for %sz This client is incompatible: z.No SMB service principal exists, OK to proceedz7Cannot connect to the server due to a generic error: %s).r Zservicer Z
is_running�stop�disabler r� Z
restore_stater� r Z
remove_ccacher Z KRB5CC_SAMBAZhas_filerb Z remove_fileZ restore_fileZ SAMBA_DIRr� r� r> �listdir�existsr] ro Z IPA_RMKEYTABrR � smb_princrp �
returncoderq Zcriticalr' �
host_princ� KRB5_KEYTABrK � service_delr
� VersionErrorr� r" �NotFoundr2 rM rr ) re rf r7 r� r� ZsvcZboolean_statesZusecaser Z tdb_filesr� r$ r% )r� r& r4 � s\
r4 c 8 C s� y
t � W n, tk
r6 } zt| j� | jS d } ~ X nX tjtj�}tj tj�}t
� \}}tj }|j rltj
}t|d|jddd� tdtjd|jdd�}tjf |� ttdtjjtjjf �td tjjtjjf �d
�}tjjf |� |j �rn|jd ��rbt |||� y$d9}x|D ]} |jd | � �qW W n. tk
�rV } ztd| � dS d } ~ X n
X td� ntd� dS d }
t j j tj ��r�tj }
|jd ��r�|j �r�td� t!S t j j tj"��s�td� t#S d} t$j%� } |j&�sjtd� | j'|
d�}
t(jd� |
t$j)k�r2t(jd� t*tjj+�}|j,g}t(jd |j,� n6d } | j-�sJtd � dS t(jd d j.| j-�� | j-d }n�|j&}t(jd!|� | j/|tjj|
�}|d t$j0k�r�td"� td#� td$� n:|d t$j1k�r�t(j2d%� n |d dk�r�td&| � dS | �std'| � t(jd(|� ntd)� t(j3d*� tjj|k�r@t(j4d+� dS |j5�s`t6j7tjj�d j8� |_5|j5j9� |_5t:tjj;tj<���: yHtj=j>}tj=j?tjj@� td,tjj@ � |j �s�dS tj=jAtjj@� W n� tBk
�r� t(j4d-|� dS tCjDk
�r } ztd.t| � � dS d } ~ X nP tCjEk
�r< t(jd/� Y n0 tCjFk
�rj } zt(j4d0| � dS d } ~ X nX td1| � td2tjj@ � td3|j5 � t(j3d1|� t(j3d2tjj@� t(j3d3|j5� tGt�}tH|�dk�r�t(j4d4� dS tI|�}t(j3d5|� td5| � |jJ �r*tKjLd6d� �r*td7� dS |jMd d� �sB|j �r`|tjj|j5� |jNd dd � tO||||d �}|jMd d� �s�|j �r�tP||||� |jNd dd � |jMd d�d k�r�tQ||||d tjj@|� |jNd dd � |jMd d� �s�|j �rtR||||d |� |jNd dd � |jMd d� �s2|j �rRtS||||d � |jNd dd � |jMd d
� �sj|j �r�tT||||d � |jNd d
d � |jNd d d � td8tjU � t(j3d8tjU� W d Q R X dS ):NF�az %(message)s)�verboser2 �filemodeZconsole_formatZ
cli_installerr )r
ZconfdirZ in_serverr2 r� z
host/%s@%sz
cifs/%s@%s)r� r� Z
domain_member�
configured� hardeningrx �tdb�service.principal�smb.confz9Error: Failed to remove the domain_member statestores: %srH z�Samba configuration is reverted. However, Samba databases were fully cleaned and old configuration file will not be usable anymore.z)Samba domain member is not configured yetz)Samba domain member is already configuredz Samba suite is not installedzSearching for IPA server...)� ca_cert_pathzExecuting DNS discoveryz&Autodiscovery did not find LDAP serverzSetting server to %sTz7Autodiscovery was successful but didn't return a serverz*Autodiscovery success, possible servers %s�,z"Verifying that %s is an IPA serverz0Anonymous access to the LDAP server is disabled.z'Proceeding without strict verification.zNNote: This is not an error if anonymous access has been explicitly restricted.z,Unencrypted access to LDAP is not supported.z*Unable to confirm that %s is an IPA serverzIPA server: %szUsing fixed server %szIPA server: DNS discoveryz Configured to use DNS discoveryz�Cannot run on IPA master. Cannot configure Samba as a domain member on a domain controller. Please use ipa-adtrust-install for that!zUWARNING: SMB service principal %s already exists. Please remove it before proceeding.zIChosen IPA master %s does not have support to set up Samba domain membersz This client is incompatible: z.No SMB service principal exists, OK to proceedz7Cannot connect to the server due to a generic error: %szChosen IPA master: %sz SMB principal to be created: %szNetBIOS name to be used: %sz�No configured trust controller detected on IPA masters. Use ipa-adtrust-install on an IPA master to configure trust controller role.z Discovered domains to use:
%sz3Continue to configure the system with these values?zInstallation abortedzfSamba domain member is configured. Please check configuration at %s and start smb and winbind services)r� r� rx r� r� r� )Vr r r� �msgZrvalr Z FileStorer ZIPA_CLIENT_SYSRESTOREZ StateFiler9 ZIPACLIENTSAMBA_INSTALL_LOGr4 Z IPACLIENTSAMBA_UNINSTALL_LOGr r2 rN ZETC_IPAr Z bootstrapr" rR �hostrG Z_mergeZ has_stateZ delete_stater! r� r� r� Z
IPA_CA_CRTr1 r ZSMBDr r Z IPADiscoveryr( �searchrq ZNO_LDAP_SERVERr Z
xmlrpc_uriZnetlocZserversr> Z ipacheckldapZNO_ACCESS_TO_LDAPZ NO_TLS_LDAPZwarningr? rr r+ r Z from_text�decoderU r' r� r� rK �service_add_smbZ service_showr� r� rL r
r� r� rM r[ �lenrB r3 r Z
user_inputZ get_stater} rl ri ru rw r{ r� rb )r$ re rf r7 Z_argsZlogfileZcfgZ local_config�keysrV r� Z autodiscoverZds�ret�sr( Zldapretr� rX Zstr_infors r% r% r& ro � sf
ro )T)GZ
__future__r Zloggingr� r Z urllib.parser Zoptparser �
contextlibr Z ipaclientr Zipaclient.install.clientr r Zipalibr r
Zipalib.installr Z ipalib.utilr Zipalib.requestr
Z ipapythonr Zipapython.errorsr Zipapython.ipa_log_managerr Zipapython.dnsutilr Zipaplatform.tasksr Zipaplatform.pathsr Zipaplatform.constantsr Z ipaplatformr Zipapython.admintoolr Zsambar Z getLoggerr� �basename�__file__rq ZsetLevel�DEBUGr' r9 r< rB rO rT r[ r^ r` ra ri rl ru rw r{ r� r� r4 ro r% r% r% r& �<module> s^ DS&-
F