samba.git/source4/setup, branch talloc-2.3.1

samba-tool: create working private krb5.conf

2019-10-08T12:50:38+00:00

DNS update tool uses private krb5.conf which should have enough details
to authenticate with GSS-TSIG when running nsupdate.

Unfortunately, the configuration we provide is not enough. We set
defaults to not lookup REALM via DNS but at the same time we don't
provide any realm definition. As result, MIT Kerberos cannot actually
find a working realm for Samba AD deployment because it cannot query DNS
for a realm discovery or pick it up from the configuration.

Extend private krb5.conf with a realm definition that will allow MIT
Kerberos to look up KDC over DNS.

Signed-off-by: Alexander Bokovoy 
Reviewed-by: Andreas Schneider

samba-tool domain provision: Remove experimental OpenLDAP support

2019-08-30T08:32:30+00:00

This feature has long been obsolete, remaining only in the hope
that it might be revived in the future.

Specifically, in 2011 the S4 OpenLDAP backend HOWTO was removed:

 commit 1d46325af8541ea467c79cd86e65f93ce6a14ff4
 Author: Andrew Bartlett 
 Date:   Wed Apr 27 22:42:29 2011 +1000

     Remove outdated S4 OpenLDAP backend HOWTO.

There is a project to revive this, hosted here:

https://github.com/Symas/samba
and
https://github.com/Symas/samba_overlays

However discussions at SambaXP with Nadezhda Ivanova
indicate a new approach with slapd being started by Samba
and taught to read native Samba ldb files is more likely
in the short term.

This has the advantage that Samba's provision and offline
tooling would not need to change, with the solution looking
more like how BIND9_DLZ has access to the Samba DB.

If any of this is required then reverting these patches will be
the least of the difficulties in bringing this to production.

Signed-off-by: Andrew Bartlett 
Reviewed-by: Nadezhda Ivanova

sefltest: Remove tests for obsolete OpenLDAP backend

2019-08-30T08:32:30+00:00

Signed-off-by: Andrew Bartlett 
Reviewed-by: Nadezhda Ivanova

selftest: schema version check in provision test

2019-06-26T05:31:03+00:00

Modifying blackbox provision test to check schema version.

Signed-off-by: Aaron Haslett 
Reviewed-by: Garming Sam 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Wed Jun 26 05:31:03 UTC 2019 on sn-devel-184

selftest: specifying 2008_R2 base schema for tests that need it

2019-06-26T04:12:33+00:00

We're going to change the default base schema so this patch changes all
tests and testenvs requiring the current default (2008_R2) to specify it
in all provision commands using --base-schema.

Signed-off-by: Aaron Haslett 
Reviewed-by: Garming Sam 
Reviewed-by: Andrew Bartlett

provision: Suggest "minimal-responses yes;" by default

2019-06-21T00:52:19+00:00

This improves Samba AD DC performance as a DNS server dramatically, because NS records do not
need to be looked up and there is less risk the response will have to fall back
to TCP, doubling the cost again.

Signed-off-by: Andrew Bartlett 
Reviewed-by: Gary Lockyer 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Fri Jun 21 00:52:19 UTC 2019 on sn-devel-184

repl: test for schema object and LA repl across chunks

2019-04-11T04:17:11+00:00

During replication, transmission of objects and linked attributes are
split into chunks.  These two tests check behavioural consistency across
chunks for regular schema objects and linked attributes.

Signed-off-by: Aaron Haslett 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Garming Sam

s4:provision: split out provision_self_join_modify_schema.ldif

2019-04-11T04:17:10+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13799

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Garming Sam

CVE-2019-3870 tests: Add test to check file-permissions are correct after provision

2019-04-08T10:27:34+00:00

This provisions a new DC and checks there are no world-writable
files in the new DC's private directory.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13834

Signed-off-by: Tim Beale 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Jeremy Allison

provision: use ASCII quotes

2019-04-03T10:11:49+00:00

Remove some Unicode quotes that cause problems under the C
locale.

Signed-off-by: Philipp Gesang 
Reviewed-by: Douglas Bagnall