File: //usr/lib/python3.9/site-packages/ipaclient/install/__pycache__/ipa_client_samba.cpython-39.pyc
a
�N(ih � @ s� d dl mZ d dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
d dl m Z m
Z
d dlmZmZ d dlmZ d d lmZ d d
lmZ d d lmZ d d lmZ d d
lm Z d dl m Z d dl m Z d dl!m"Z" d dl#m$Z$ d dl%m&Z& d dl'm(Z( d dl)m*Z* d dl+m,Z, e�-ej.�/e0��Z1e1�2ej3� edd� �Z4dd� Z5dZ6dd � Z7d d d d �Z8d d!d d �Z9d"d#� Z:d$Z;d%Z<d&Z=d'd(� Z>d)d*� Z?d+d,� Z@d-d.� ZAd/d0� ZBd:d2d3�ZCd4d5� ZDd6d7� ZEd8d9� ZFdS );� )�print_functionN)�urlsplit)�contextmanager)� discovery)�CLIENT_NOT_CONFIGURED�CLIENT_ALREADY_CONFIGURED)�api�errors)�
sysrestore)�check_client_configuration)�context)�ipautil)�SetseboolError)�standard_logging_setup)�DNSName)�tasks)�paths)� constants)�services)� ScriptError��generate_random_password)�IPAOptionParserc c s8 t �� ��}ttdd �}z�t�| tjj�}||d�}tj|d|d� t �
d�sVt � � z.t j j
�� rpt j j
�� t j j
�� d V W n> tjjy� } z"td| |t|�f ��W Y d }~n
d }~0 0 W t j j
�� r�t j j
�� ttd|� n(t j j
�� �rt j j
�� ttd|� 0 W d � n1 �s*0 Y d S )N� principal)ZccacheZ
client_keytabZinitiate)�name�usage�store�finalizezGUnable to bind to IPA server. Error initializing principal %s in %s: %s)r
Zprivate_ccache�getattrr �gssapi�NameZNameTypeZkerberos_principalZ Credentialsr Zisdoner ZBackendZ rpcclientZ isconnectedZ
disconnectZconnect�
exceptionsZGSSError� Exception�str�setattr)r ZkeytabZ ccache_fileZ
old_principalr r �e� r& �F/usr/lib/python3.9/site-packages/ipaclient/install/ipa_client_samba.py�use_api_as_principal' s2
�� � r( c C s� d} t | d�}|jdddd� |jddd d d
� |jd d d
ddd� |jddd
ddd� |jddd
ddd� |jdddd
ddd� |jdd d d
dd d� |jd d d
dd!d� |�� \}}||fS )"Nz%prog [options]
)r z--server�serverz FQDN of IPA server to connect to)�dest�helpz--netbios-name� netbiosnamez NetBIOS name of this machine)r* r+ �defaultz
--no-homes�no_homes�
store_trueFz=Do not add [homes] share to the generated Samba configuration)r* �actionr- r+ z--no-nfs�no_nfsz/Do not allow NFS integration (SELinux booleans)z--force�forcez'force installation by redoing all stepsz-dz--debug�debugzprint debugging informationz-Uz --unattended�
unattendedz.unattended installation never prompts the userz --uninstall� uninstallz+Revert configuration and remove SMB service)r Z
add_option�
parse_args)r �parser�options�argsr& r& r' �
parse_optionsE sv
�������� r: z�
Domain name: {domain_name}
NetBIOS name: {netbios_name}
SID: {domain_sid}
ID range: {range_id_min} - {range_id_max}
c C s. g }| D ]}|� tjf i |��� qd�|�S )N�
)�append�domain_information_template�format�join)�info�result�domainr& r& r' � pretty_print_domain_information� s rC Z
ipantflatnameZipantsecurityidentifier�cn)� netbios_name�
domain_sid� domain_nameZipanttrusteddomainsidc C s� z | j j}W n ty" g Y S 0 z|� d }W n tjyJ g Y S 0 t� }t�� D ] \}}|�|d g�d ||< qZdj | j
j d�}| j � |�d }t
|d d �|d< t
|d d �t
|d d � d |d < |g}| j �� d }|D ]�}| j j|d
d d d d �d } | D ]�}
t� } tD ] }|
�t| d g�d | |< �q"dj | d
�� d�} | j � | �d }
t
|
d d �| d< t
|
d d �t
|
d d � d | d < |�| � �qq�|S )NrA r z{realm}_id_range)�realmZ ipabaseidZ range_id_minZipaidrangesize� Z range_id_maxrD T)�all�rawrG )�CommandZtrustconfig_show�AttributeErrorr � PublicError�dict� trust_keymap�items�getr> �envrH Z idrange_show�intZ
trust_findZtrustdomain_find�trust_keymap_trustdomain�upperr< )r Z
tc_commandrA Zl_domain�key�valZ
idrange_local�domainsZforest�r�domZr_domZr_idrange_nameZ r_idranger& r& r' �retrieve_domain_information� sN
"��
����r\ a-
[global]
# Limit number of forked processes to avoid SMBLoris attack
max smbd processes = 1000
# Use dedicated Samba keytab. The key there must be synchronized
# with Samba tdb databases or nothing will work
dedicated keytab file = FILE:${samba_keytab}
kerberos method = dedicated keytab
# Set up logging per machine and Samba process
log file = /var/log/samba/log.%m
log level = 1
# We force 'member server' role to allow winbind automatically
# discover what is supported by the domain controller side
server role = member server
realm = ${realm}
netbios name = ${machine_name}
workgroup = ${netbios_name}
# Local writable range for IDs not coming from IPA or trusted domains
idmap config * : range = 0 - 0
idmap config * : backend = tdb
z
idmap config ${netbios_name} : range = ${range_id_min} - ${range_id_max}
idmap config ${netbios_name} : backend = sss
z2
# Default homes share
[homes]
read only = no
c C s� t jtjj|jd�}|d d |d< tg}|D ]}|�t� t
|�g� q.|j sZ|�t g� | �
t j� tt jd��(}|�t� d�|�|�� W d � n1 s�0 Y t�t j� d S )N)Z samba_keytabrH Z machine_namer rE �wr; )r � SAMBA_KEYTABr rS rH r, �smb_conf_template�extendr
Z template_str�idmap_conf_domain_snippetr. �homes_conf_snippetZ backup_file�SMB_CONF�open�writer? r Zrestore_context)�fstore�
statestorer8 rY Zsub_dict�templater[ �fr& r& r' �configure_smb_conf s � 6rj c C s
t dd�S )N� � r �rf rg r8 rB r& r& r' � generate_smb_machine_account s rn c
C s� t jd|dt jdddg}z tj||d | dd� W n4 tjyh } zt�d |� � W Y d }~n
d }~0 0 d
}ztj j
||d � W n6 t j y� } z t�d ||� � W Y d }~n
d }~0 0 d S )
Nz-p�-kz-Pz-ez<aes128-cts-hmac-sha1-96,aes256-cts-hmac-sha1-96,arcfour-hmacr; �utf-8��stdin�encodingz8Cannot set machine account password at IPA DC. Error: %szipaNTHash=MagicRegen)Zaddattrz<Cannot update %s principal NT hash value due to an error: %s)
r Z
IPA_GETKEYTABr^ r
�run�CalledProcessError�logger�errorr rL Z service_modr rN ) rf rg r8 rB r �passwordr9 r% �valuer& r& r' �retrieve_service_principal# s6 �
��rz c
C sz t jd|d g}zt�|� W n4 tjyR } zt�d|� � W Y d }~n
d }~0 0 d�|d �}t jt j d|dg}zt�|� W n4 tjy� } zt�d|� � W Y d }~n
d }~0 0 d �|d �}t jt j d|dg}zt�|� W n6 tj�y } zt�d|� � W Y d }~n
d }~0 0 t jd
d g}ztj||d d
� W n6 tj�yt } zt�d|� � W Y d }~n
d }~0 0 d S )NZ setdomainsidrF z)Cannot set domain SID in Samba. Error: %sz#SECRETS/MACHINE_LAST_CHANGE_TIME/{}rE r z2\00z8Cannot prepare machine account creds in Samba. Error: %szSECRETS/MACHINE_PASSWORD/{}Zchangesecretpwz-frp rq z4Cannot set machine account creds in Samba. Error: %s)
r �NETr
rt ru rv rw r> ZTDBTOOLZ SECRETS_TDB)rf rg r8 rB rx r9 r% Z secrets_keyr& r& r' �populate_samba_databasesI sD ��� �r| c
C sn t jdddddg}t�d� zt�|� W n> tjyh } z$d|jvrTt�d|� � W Y d }~n
d }~0 0 d S ) N�groupmap�addzsid=S-1-5-32-546zunixgroup=nobodyz type=builtinz&Map BUILTIN\Guests to a group 'nobody'z"already mapped to SID S-1-5-32-546z8Cannot map BUILTIN\Guests to a group "nobody". Error: %s) r r{ rv r@ r
rt ru �stdoutrw )rf rg r8 rB r9 r% r& r& r' �configure_default_groupmapv s" �
�r� Tc
sp � fdd�}|r|nd }zt j| |d� W n@ tyj } z(tdt|� � t�d|� W Y d }~n
d }~0 0 d S )Nc s � � d| |� d S )N�selinux)� backup_state)r ry �rg r& r' �default_backup_func� s z1set_selinux_booleans.<locals>.default_backup_func)� backup_funcz WARNING: z WARNING: %s)r �set_selinux_booleansr �printr# rv r@ )Zbooleansrg �backupr� r� r% r& r� r' r� � s r� c C s0 |j sttjd |� |js,ttjd |� d S )NZshare_home_dirsZreshare_nfs_with_samba)r. r� r �SELINUX_BOOLEAN_SMBSERVICEr1 rm r& r& r' �harden_configuration� s
��r� c sL t �dt�}t �dt�}||fD ] }|�� r4|�� |�� q i }tjD ] }|D ]}|�d|�||< qPqH|rzt ||dd� t
j t j
d� | �t j�r�t
�t j� | �t j� t jtj�t jd�tj�t jd�fD ]0� � fd d
�t�� �D �} | D ]}
t
�|
� q�q�tj�t j��rxz t
�t jd tjj d t jg� W nD t
j �yv } z(| j d
k�rbt � dtjj � W Y d } ~ n
d } ~ 0 0 t!tjj"t j#��� ztj$�%tjj � W n� t&j'�y� } z t(dt)| � � W Y d } ~ nZd } ~ 0 t&j*�y� t �+d� Y n4 t&j,�y& } zt �-d| � W Y d } ~ n
d } ~ 0 0 W d � n1 �s>0 Y d S )N�smb�winbindr� F)r� )Z ccache_pathZprivate�lockc s$ g | ] }|� d �rtj�� |��qS )z.tdb)�endswith�os�pathr? )�.0�tdb_file�Zsmbpathr& r' �
<listcomp>� s
�z uninstall.<locals>.<listcomp>z --principalro � z Failed to remove old key for %s� This client is incompatible: �.No SMB service principal exists, OK to proceed�7Cannot connect to the server due to a generic error: %s).r Zservicer Z
is_running�stop�disabler r� Z
restore_stater� r
Z
remove_ccacher Z KRB5CC_SAMBAZhas_filerc Z remove_fileZ restore_fileZ SAMBA_DIRr� r� r? �listdir�existsr^ rt Z IPA_RMKEYTABrS � smb_princru �
returncoderv Zcriticalr( �
host_princ� KRB5_KEYTABrL � service_delr � VersionErrorr� r# �NotFoundr3 rN rw ) rf rg r8 r� r� ZsvcZboolean_statesZusecaser Z tdb_filesr� r% r& r� r' r5 � sh
�
��� �$�r5 c C s. z
t � W n4 ty> } z t| j� | jW Y d } ~ S d } ~ 0 0 t�tj�}t� tj�}t
� \}}tj }|j rttj
}t|d|jddd� tdtjd|jdd�}tjf i |�� ttdtjjtjjf �td tjjtjjf �d
�}tjjf i |�� |j �r�|�d ��rtt |||� z d }|D ]} |�d | � �q W n4 t�yh } ztd
| � W Y d } ~ dS d } ~ 0 0 td� ntd� dS d }
t j � tj ��r�tj }
|�d ��r�|j �s�td� t!S t j � tj"��s�td� t#S d} t$�%� } |j&�sztd� | j'|
d�}
t(�d� |
t$j)k�rBt(�d� t*tjj+�}|j,g}t(�d|j,� n6d} | j-�sZtd� dS t(�dd�.| j-�� | j-d }n�|j&}t(�d |� | �/|tjj|
�}|d t$j0k�r�td � td � td � n:|d t$j1k�r�t(�2d � n |d dk�rtd!| � dS | �s"td"| � t(�d#|� ntd$� t(�3d%� tjj|k�rPt(�4d&� dS |j5�spt6�7tjj�d �8� |_5|j5�9� |_5t:tjj;tj<���� zVtj=j>}tj=�?tjj@� td'tjj@ � |j �s�W W d � dS tj=�Atjj@� W n� tB�y t(�4d(|� Y W d � dS tCjD�yX } z*td)t| � � W Y d } ~ W d � dS d } ~ 0 tCjE�yv t(�d*� Y nB tCjF�y� } z&t(�4d+| � W Y d } ~ W d � dS d } ~ 0 0 td,| � td-tjj@ � td.|j5 � t(�3d,|� t(�3d-tjj@� t(�3d.|j5� tGt�}tH|�dk�r<t(�4d/� W d � dS tI|�}t(�3d0|� td0| � |jJ�s�tK�Ld1d��s�td2� W d � dS |�Md d3��r�|j �r�|tjj|j5� |�Nd d3d4� tO||||d �}|�Md d5��r�|j �rtP||||� |�Nd d5d4� |�Md d3�d4k�r<tQ||||d tjj@|� |�Nd d3d4� |�Md d6��rR|j �rttR||||d |� |�Nd d6d4� |�Md d7��r�|j �r�tS||||d � |�Nd d7d4� |�Md d8��r�|j �r�tT||||d � |�Nd d8d4� |�Nd d4d� td9tjU � t(�3d9tjU� W d � n1 �s 0 Y dS ):NF�az %(message)s)�verboser3 �filemodeZconsole_formatZ
cli_installerr )r ZconfdirZ in_serverr3 r� z
host/%s@%sz
cifs/%s@%s)r� r� Z
domain_member)�
configured� hardeningr} �tdb�service.principal�smb.confz9Error: Failed to remove the domain_member statestores: %srI z�Samba configuration is reverted. However, Samba databases were fully cleaned and old configuration file will not be usable anymore.z)Samba domain member is not configured yetz)Samba domain member is already configuredz Samba suite is not installedzSearching for IPA server...)� ca_cert_pathzExecuting DNS discoveryz&Autodiscovery did not find LDAP serverzSetting server to %sTz7Autodiscovery was successful but didn't return a serverz*Autodiscovery success, possible servers %s�,z"Verifying that %s is an IPA serverz0Anonymous access to the LDAP server is disabled.z'Proceeding without strict verification.zNNote: This is not an error if anonymous access has been explicitly restricted.z,Unencrypted access to LDAP is not supported.z*Unable to confirm that %s is an IPA serverzIPA server: %szUsing fixed server %szIPA server: DNS discoveryz Configured to use DNS discoveryz�Cannot run on IPA master. Cannot configure Samba as a domain member on a domain controller. Please use ipa-adtrust-install for that!zUWARNING: SMB service principal %s already exists. Please remove it before proceeding.zIChosen IPA master %s does not have support to set up Samba domain membersr� r� r� zChosen IPA master: %sz SMB principal to be created: %szNetBIOS name to be used: %sz�No configured trust controller detected on IPA masters. Use ipa-adtrust-install on an IPA master to configure trust controller role.z Discovered domains to use:
%sz3Continue to configure the system with these values?zInstallation abortedr� r� r� r� r} r� zfSamba domain member is configured. Please check configuration at %s and start smb and winbind services)Vr r r� �msgZrvalr
Z FileStorer ZIPA_CLIENT_SYSRESTOREZ StateFiler: ZIPACLIENTSAMBA_INSTALL_LOGr5 Z IPACLIENTSAMBA_UNINSTALL_LOGr r3 rO ZETC_IPAr Z bootstrapr# rS �hostrH Z_mergeZ has_stateZ delete_stater" r� r� r� Z
IPA_CA_CRTr2 r ZSMBDr r Z IPADiscoveryr) �searchrv ZNO_LDAP_SERVERr Z
xmlrpc_uri�netlocZserversr? Z ipacheckldapZNO_ACCESS_TO_LDAPZ NO_TLS_LDAPZwarningr@ rw r, r Z from_text�decoderV r( r� r� rL �service_add_smbZ service_showr� r� rM r r� r� rN r\ �lenrC r4 r
Z
user_inputZ get_stater� rn rj rz r| r� r� rc )r% rf rg r8 �_argsZlogfileZcfgZ local_config�keysrW r� Z autodiscoverZds�ret�sr) Zldapretr� rY Zstr_inforx r& r& r' rt � s�
�� � ���
�
� �
� ���"�$
�
��� �
���� ���
��
�����$rt )T)GZ
__future__r Zloggingr� r � urllib.parser �
contextlibr Z ipaclientr Zipaclient.install.clientr r Zipalibr r Zipalib.installr
Z ipalib.utilr Zipalib.requestr Z ipapythonr
Zipapython.errorsr Zipapython.ipa_log_managerr Zipapython.dnsutilr Zipaplatform.tasksr Zipaplatform.pathsr Zipaplatform.constantsr Z ipaplatformr Zipapython.admintoolr Zsambar Zipapython.configr Z getLoggerr� �basename�__file__rv ZsetLevel�DEBUGr( r: r= rC rP rU r\ r_ ra rb rj rn rz r| r� r� r� r5 rt r& r& r& r' �<module> sd
?��?&-
F