uUc@sdZdZddlZddlZddlZddlmZmZddlm Z ddl m Z m Z m Z ddlmZddlmZdd lmZdd lmZmZmZdd lmZdd lmZdd lmZddlmZddlmZddlm Z dZ!ddddZ#dZ$dZ%dZ&dZ'dZ(dZ)iej*d6Z+dZ,dZ-de.de.dZ/dS(s3Support code for upgrading from Samba 3 to Samba 4.trestructuredTextiN(tLdbtregistry(tLoadParm(t provisiontProvisioningErrort setsysvolacl(t FILL_FULL(tpassdb(tparam(tlsatsamrtsecurity(tdom_sid(t Credentials(tdsdb(tndr_pack(t unix2nttime(tgenerate_random_passwordc Cstj}|j|_d|krPtjt|dtjd|d|d }|d ks|d krd}nt| d}tjt|tjd|dt ID_TYPE_UIDtunixHomeDirectoryt loginShellt gidNumbertmsSFU30NisDomains7Could not add posix attrs for AD entry for sid=%s, (%s)N( RRtDnR"R R!R#R%R&R'( R*R(tsidtnamet nisdomaintxid_typethometshelltpgidR+R2((s1/usr/lib/python2.7/dist-packages/samba/upgrade.pytadd_posix_attrsbs"  cCsytj}tj|dt||_|dkr{tjt|tjd|dR4t uidNumbert posixAccountt objectClasst ID_TYPE_GIDR7t posixGroups?Could not modify AD idmap entry for sid=%s, id=%s, type=%s (%s)N( RRR9R"R R!R#t FLAG_MOD_ADDR%R&R'(R(R:txidR=R*R+R2((s1/usr/lib/python2.7/dist-packages/samba/upgrade.pytadd_ad_posix_idmap_entrys$    c Cst}|jddt|}|jdkr:t}n|ryltj}|dd|_tjt|tj d|dtscopesJGroup already exists sid=%s, groupname=%s existing_groupname=%s, Ignoring.itsAMAccountNameNsCN=%s,CN=Users,%sRMtgroupRDROt descriptiont groupTypetcontrolssrelax:0s Could not add group name=%s (%s)(RQR"R:Rt SCOPE_BASERSR&tERR_NO_SUCH_OBJECTRPR'tnt_namet sid_name_useR tSID_NAME_WKN_GRPtsplitR R t SID_BUILTINRR9RR R!RGRtcommenttSID_NAME_ALIASRt!GTYPE_SECURITY_DOMAIN_LOCAL_GROUPRT( R(tgroupmapR*RWRVtecodetemsgt group_dom_sidtridR+R2((s1/usr/lib/python2.7/dist-packages/samba/upgrade.pytadd_group_from_mapping_entrysB     ( (   $cCsx|D]}tj}tj|dt|j|_tjdt|tjd|dtmemberRs/skipped re-adding member '%s' to group '%s': %ssXCould not add member '%s' to group '%s' as either group or user record doesn't exist: %ss+Could not add member '%s' to group '%s': %sN(RRR9R"R:R R!RGR%R&tERR_ENTRY_ALREADY_EXISTStdebugRqR(R(RltmembersR*t member_sidR+R{R|((s1/usr/lib/python2.7/dist-packages/samba/upgrade.pytadd_users_to_group*s  "&c Csd}x|jD]y\}\}}}|d7}t|jdddd}|dkrfd}nO|d@rt|dkrd}qd}n!t|dkrd}nd}|tjkrd} nd} |d @d ?} |ji d t|jdd 6|jddd 6|jddd6dd6t|d6t| d6t| d6tj |d6dd6t|d6|d6qW|jidd 6dd6dd6t|d6dS(sImport settings from a Samba3 WINS database. :param samba4_winsdb: WINS database to import to :param samba3_winsdb: WINS database to import from iit#iiiiii`isname=%s,type=0x%sR RLR;t winsRecordRDt recordTypet recordStatetnodeTypet expireTimet0tisStatict versionIDtaddresss cn=VERSIONtVERSIONRMtwinsMaxVersiont maxVersionN( titemsR$RutlenttimeRTttupleR"Rt timestring( t samba4_winsdbt samba3_winsdbt version_idR;tttltipstnb_flagsRLtrTypetrStatetnType((s1/usr/lib/python2.7/dist-packages/samba/upgrade.pyt import_winsBs@"        #    tHKLMc sfd}x|jD]u}||}x!|j|D]}||q>Wx<|j|jD]%\}\}}|j|||qhWqWdS(sImport a Samba 3 registry database into the Samba 4 registry. :param samba4_registry: Samba 4 registry handle. :param samba3_regdb: Samba 3 registry database handle. csD|jdd\}}t|}|jdd}j||S(Nt/is\(RutSAMBA3_PREDEF_NAMEStreplacet create_key(tkeypatht predef_namet predef_id(tsamba4_registry(s1/usr/lib/python2.7/dist-packages/samba/upgrade.pytensure_key_existss N(tkeystsubkeystvaluesRt set_value( Rt samba3_regdbRtkeyt key_handletsubkeyt value_namet value_typet value_data((Rs1/usr/lib/python2.7/dist-packages/samba/upgrade.pytimport_registry{s (cCsy/|j|dtjdd|d|g}Wn/tjk r`}td|||fn9X|jdkr|d|dS|jd||td S( sGet posix attributes from a samba3 ldap backend :param ldbs: a list of ldb connection objects :param base_dn: the base_dn of the connection :param user: the user to get the attribute for :param attr: the attribute to be retrieved RjRJs%(&(objectClass=posixAccount)(uid=%s))tattrss=Failed to retrieve attribute %s for user %s, the error is: %siis0LDAP entry for user %s contains more than one %sN(RQRt SCOPE_SUBTREER&RRRtwarningtKeyError(R*t ldb_objecttbase_dntusertattrRWR2((s1/usr/lib/python2.7/dist-packages/samba/upgrade.pyt get_posix_attr_from_ldap_backendsc?'Cs|jj}|jjd}|jjd} |jjd} |jjddskrs|jjddny|j} Wn8tk r} td|jdt | fnX|s| j d}|j d |n| s3|d ks|d krtd q3|j } |j d | nd} y| j | }Wntk reds}nX|jjdjddjdkr|jjd}|jjd}| j|}|dskrtdn|jd}t}nds}ds}t}| jtj|jjd|j}ytj}Wn$tjk rntd|nXy|jd| }Wn tjk rds}ds}nX|jj\}}|jd|j}|jd|j}i}x|D] }|j j\}}||kr@|| kr@|d} q@n|j!t"j#kry)|j$|j }||t |j |j|5j?||5j@||jjdjdddjd7}6x]|6jD]L}7ytA|7d8|5}8Wn,tBjCk r } td9|7| fq? XPq? Wn|jd:|j-d} xV| D]N}$|$d!}%|%|"jDkr y?|r tE||8||%d;|2|%ds}9y|jJ}9Wn)tk rU } |j%d?t | nX|d kpk |d ksw d@}n|#r tKdAdB}:nds}:tL||dC|d| dD|dE|dF| dG|dH|:dItMjNdJ| j8dK|dL|dMtOdN|dO|dPtdQ|dRt};|;jP||jdS|9rOtQtA|;jRjS|9n|jdTtT|;jU|||jdUtV|;jW||tXjY}<|<jZ|;jj[|<jd|;jjd|<jdV|;jjdV|<jdW|;jjdWtj\|<jd}=|;jUj]|jdXy|jdYx|D]})|)j^d$krKt_|;jU|)|t`|;jU|)j |)j^dZ|tad[|;jUd\|)j d]|)j&d^|j8d_dZd`|qKqKWWn|;jUjbnX|jda|;jUjc|jdb|;jUj]y|jdcx|!D]}%|%j8d,kr|!|%jt+t |ddkr|jde|!|%jt+t |ddftdfqn|%j8d+kr |!|%jt+t |ddkr|j%dgq |j%dhn|=jd|!|%|%|"kr9t`|;jU|!|%j|"|%di||%|2kr|2|%dsk r|%|3kr|3|%dsk r|%|4kr|4|%dsk rtad[|;jUd\|!|%jd]|%d^|j8d_didj|2|%dk|3|%dl|4|%d`| qq9q9WWn|;jUjbnX|jdm|;jUjc|jdn|;jUj]yPxI|D]A})t |)j |krZte|;jU|)|t |)j |qZqZWWn|;jUjbnX|jdo|;jUjc|#rv|jdp|=jd,}>|!|#jf|>_f|!|#jgr&|!|#jg|>_gn|!|#jh|>_h|!|#jirV|!|#ji|>_in|=jj|>|jdq|#n|;jdrkrtk|;jU|;jRjl|;jRjm|;jRjn|;jRjot*j+|;jp|;jqjr|;jqjs|;j| ndsS(tsUpgrade from samba3 database to samba4 AD database :param samba3: samba3 object :param logger: Logger object :param targetdir: samba4 database directory :param session_info: Session information t workgrouptrealms netbios namesldapsam:trustedtyessCould not open '%s', the Samba3 secrets database: %s. Perhaps you specified the incorrect smb.conf, --testparm or --dbdir option?s secrets.tdbis6No workgroup specified in smb.conf file, assuming '%s'tROLE_DOMAIN_BDCtROLE_DOMAIN_PDCsNo realm specified in smb.conf file and being a DC. That upgrade path doesn't work! Please add a 'realm' directive to your old smb.conf to let us know which one you want to use (it is the DNS name of the AD domain you wish to create.s2No realm specified in smb.conf file, assuming '%s'ispassdb backendt:tldapsams ldap suffixs ldap admin dnsldapsam passdb backend detected but no LDAP Bind PW found in secrets.tdb for user %s. Please point this tool at the secrets.tdb that was used by the previous installation.ts private dirs(Can't find domain sid for '%s', Exiting.s%s$sExporting account policysExporting groupsis4Ignoring group '%s' %s listed but then not found: %ssOIgnoring 'well known' group '%s' (should already be in AD, and have no members)s+Ignoring group '%s' %s with sid_name_use=%dsExporting usersR~t account_names- Skipping wellknown rid=%d (for username=%s)sk Demoting BDC account trust for %s, this DC must be elevated to an AD DC using 'samba-tool domain dcpromo'isZ Skipping inter-domain trust from domain %s, this trust must be re-created as an AD trustt$s Skipping account %s that has ACB_WSTRUST (W) set but does not end in $. This account can not have worked, and is probably left over from a misconfiguration.s Fixing account %s which had both ACB_NORMAL (U) and ACB_WSTRUST (W) set. Account will be marked as ACB_WSTRUST (W), i.e. as a domain members Fixing account %s which had both ACB_NORMAL (U) and ACB_SVRTRUST (S) set. Account will be marked as ACB_WSTRUST (S), i.e. as a domain membersFailed to upgrade due to invalid account %s, account control flags 0x%08X must have exactly one of ACB_NORMAL (N, 0x%08X), ACB_WSTRUST (W 0x%08X), ACB_SVRTRUST (S 0x%08X) or ACB_DOMTRUST (D 0x%08X). Please fix this account before attempting to upgrade again troott administrators)Ignoring group memberships of '%s' %s: %ss Next rid = %ds4Following names are both user names and group names:s %ss5Please remove common user/group names before upgrade.s9Please remove duplicate group sid entries before upgrade.s%s-%us8Please remove duplicate user sid entries before upgrade.s,Following sids are both user and group sids:s3Please remove duplicate sid entries before upgrade.t"t credentialss=Could not open ldb connection to %s, the error message is: %ssExporting posix attributest homeDirectoryR6R7sReading WINS databases'Cannot open wins database, Ignoring: %stNONEi i t targetdirtdomaint domainsidtnext_ridtdc_ridt adminpasstdom_for_fun_levelthostnamet machinepasst serverrolet samdb_filltuseeadbt dns_backendt use_rfc2307t use_ntvfstskip_sysvolaclsImporting WINS databasesImporting Account policysImporting idmap databasesstate directoryslock directorys Adding groupssImporting groupsRER(R:R;R<R=R*s+Committing 'add groups' transaction to disks Adding userssImporting userss-500sPUser 'Administrator' in your existing directory has SID %s, expected it to be %ssPUser 'Administrator' in your existing directory does not have SID ending in -500s,User root has been replaced by AdministratorsbUser root has been kept in the directory, it should be removed in favour of the Administrator userR4R>R?R@s*Committing 'add users' transaction to disksAdding users to groupss4Committing 'add users to groups' transaction to disks"Setting password for administrators<Administrator password has been set to password of user '%s's"active directory domain controllerN(ttlpt server_roletgettNonetsettget_secrets_dbR^Rtprivatedir_pathR"tdomainsRtuppertget_machine_passwordRRutstriptget_ldap_bind_pwRSRPtcloseRtset_secrets_dirt get_sam_dbtget_global_sam_sidterrort Exceptiont getsampwnamtuser_sidtinfotget_account_policytenum_group_mappingR:RsR Rxt enum_aliasmemR'RrtSID_NAME_DOM_GRPtenum_group_membersRtR R Rvt search_userst acct_ctrlR t ACB_NORMALt ACB_WSTRUSTt ACB_SVRTRUSTt ACB_DOMTRUSTt sid_to_idtpwdtgetpwnamtpw_uidtlowertenum_group_membershipstappendt intersectionRRtguesst set_bind_dnt set_passwordRRR&RRtpw_dirt IndexErrortpw_shelltpw_gidt get_wins_dbRRRtDS_DOMAIN_FUNCTION_2003Rt report_loggerRtpathstwinsdbR3R(Rhtidmapts3paramt get_contexttloadt configfiletPDBttransaction_starttgidRRIRAttransaction_cancelttransaction_committadd_sam_accountRt nt_passwdt lanman_passwdtpass_last_set_timet pw_historytupdate_sam_accountRtnetlogontsysvoltroot_uidtroot_gidRtnamest dnsdomaintdomaindn(?RdR*Rt session_infoRRRRt domainnameRt netbiosnamet secrets_dbR2RRRtldapusertldappasstldapts3dbRt machineacctt machineridt machinesidR)t grouplistt groupmembersRlR:R~RR}tuserlisttuserdatatuidst admin_usertentrytusernameRt acct_typetgroup_membershipstgt group_namestut user_namest common_namesR;t group_sidst user_sidst common_sidsthomestshellstpgidstcredsturlsturlRRRtresultt new_lp_ctxt s4_passdbtadmin_userdata((s1/usr/lib/python2.7/dist-packages/samba/upgrade.pytupgrade_from_samba3sz )       +                        %&& "       "#  (-     +                          E       #.# $g      .       (0t__doc__t __docformat__RRRtsambaRRt samba.paramRtsamba.provisionRRRtsamba.provision.commonRt samba.samba3RR Rt samba.dcerpcR R R tsamba.dcerpc.securityR tsamba.credentialsRRt samba.ndrRRRR3RRARIRXRhRRRtHKEY_LOCAL_MACHINERRRRPRS(((s1/usr/lib/python2.7/dist-packages/samba/upgrade.pyts@    8!  + ' 5  4