summaryrefslogtreecommitdiff
path: root/python/samba/netcmd
AgeCommit message (Collapse)AuthorFilesLines
2019-07-04samba-tool: implement contact management commandsBjörn Baumbach2-0/+677
Usage: samba-tool contact <subcommand> Contact management. Available subcommands: create - Create a new contact. delete - Delete a contact. edit - Modify a contact. list - List all contacts. move - Move a contact object to an organizational unit or container. show - Display a contact. Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-04samba-tool group: add 'edit' command to edit an AD group objectBjörn Baumbach1-0/+114
Same like the samba-tool user edit command. Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-04samba-tool computer: add 'edit' command to edit an AD computer objectBjörn Baumbach1-1/+122
Similar to the samba-tool user edit command. Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-04samba-tool user edit: avoid base64 encoded strings in editable ldif if possibleBjörn Baumbach2-2/+46
Use clear text arguments strings if possible. Makes it more comfortable for users to edit the user objects attributes. Remove test from knownfail: samba.tests.samba_tool.user_edit.change_attribute_force_no_base64 Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-04samba-tool user edit: simplify codeBjörn Baumbach1-3/+1
Use "None"-changetype here, instead of "Add". This avoids the need to remove the changetype line afterwards. Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-04samba-tool user edit: use ldb methods to create ldif to modify userBjörn Baumbach1-38/+13
Remove tests from knownfail: samba.tests.samba_tool.user_edit.add_attribute_base64 samba.tests.samba_tool.user_edit.add_attribute_base64_control samba.tests.samba_tool.user_edit.change_attribute_base64_control BUG: https://bugzilla.samba.org/show_bug.cgi?id=14003 Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-04samba-tool: fix format of command description (help messages)Björn Baumbach5-18/+18
Need to quote the backslash '\'. Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-02samba-tool domain join: remove the subdomain optionGary Lockyer1-18/+5
Remove the sub domain option from join, as it currently does not work. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-02samba-tool domain dcpromo: add --backend-store-size optionGary Lockyer1-1/+2
Add a new "samba-tool domain dcpromo" option "backend-store-size". This allows the lmdb map size to be set during a promotion, instead of hard-wiring it to 8Gb. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-02samba-tool clone-dc-database: Add --backend-store-size optionGary Lockyer1-3/+13
Add a new "samba-tool drs clone-dc-database" option "backend-store-size". This allows the lmdb map size to be set during a clone, instead of hard-wiring it to 8Gb. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>' Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-02samba-tool domain join: Add --backend-store-size optionGary Lockyer1-2/+4
Add a new "samba-tool domain join" option "backend-store-size". This allows the lmdb map size to be set during a provision, instead of hard-wiring it to 8Gb. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-02provision: Add --backend-store-size optionGary Lockyer1-6/+3
Add a new "samba-tool domain provision" option "backend-store-size". This allows the lmdb map size to be set during a provision, instead of hard-wiring it to 8Gb Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-02samba-tool domain provision: add lmdb database size optionGary Lockyer1-9/+19
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-02samba-tool: Make the 'bytes' option type avaiableGary Lockyer1-1/+2
Allow samba tool to use the custom bytes option type. Option("--size", type="bytes", metavar="SIZE") To allow the input of file and memory sizes using unit suffixes i.e. 2Gb, 4KiB ... Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-06-26schema: changing default base schema to 2012_R2Aaron Haslett1-2/+2
Changing default base schema from 2008_R2 to 2012_R2 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-06-18samba-tool: add ntacl changedomsid commandBjörn Baumbach1-0/+164
This tool is meant to locally change all entries in acl_xattr when the machine's SID has accidentially changed or the data set has been copied to another box either via backup/restore or rsync. Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-06-18samba-tool ntacl: consolidate code for getting the local domain sidBjörn Baumbach1-53/+32
Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-05-30samba-tool: add 'import samba.drs_utils' to fsmo.pyBjörn Baumbach1-0/+1
On some systems we're seeing this: ERROR(<type 'exceptions.AttributeError'>): uncaught exception - 'module' object has no attribute 'drs_utils' File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line 185, in _run return self.run(*args, **kwargs) File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 533, in run transfer_dns_role(self.outf, sambaopts, credopts, role, samdb) File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 136, in transfer_dns_role except samba.drs_utils.drsException as e: E.g. it happens on debian stretch (9.9) with python 2.7.13 (on 4.10.4) While it doesn't happen on ubuntu 18.04 with python 2.7.15rc1 or with python 3.6.7. There were also some reports on the mailing lists, see: https://lists.samba.org/archive/samba-technical/2019-May/133624.html BUG: https://bugzilla.samba.org/show_bug.cgi?id=13973 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Björn Baumbach <bbaumbach@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu May 30 08:27:24 UTC 2019 on sn-devel-184
2019-05-30samba-tool: use only one LDAP modify for dns partition fsmo role transferStefan Metzmacher1-16/+6
We should not risk that we end with no role owner. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13973 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-30samba-tool: fix replication after dns partition fsmo role transferStefan Metzmacher1-1/+3
The new role owner need to replicate from the old role owner. Before we told the old role owner to replicate from itself. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13973 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-29samba-tool dns: use bytes for inet_ntopDouglas Bagnall1-2/+3
From Python's point of view, array.AddrArray is a list of byte-valued integers. In Python 3 we can convert directly using the likes of bytes(array.AddrArray[i].MaxSa[8:24]) but in 4.10 we need to support both, so we use struct. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org> Autobuild-User(master): Noel Power <npower@samba.org> Autobuild-Date(master): Wed May 29 11:29:17 UTC 2019 on sn-devel-184
2019-04-11ldapcmp: ignore 'schemaInfo' if two domains are comparedStefan Metzmacher1-1/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13799 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2019-04-05netcmd: Fix passwordsettings --max-pwd-age commandTim Beale1-2/+12
The min_pwd_age and max_pwd_age parameters are both optional and default to None. However, if we just set the max-pwd-age, then the check 'min_pwd_age >= max_pwd_age' will throw a Python exception because it's trying to compare an int to NoneType (min_pwd_age). This works on Python 2 but is a problem on Python 3. We could just add a check that min_pwd_age is not None, but that defeats the point of having the check if you're only setting either the min or max age indepedently. This patch gets the current min/max password age from the DB (in ticks). If either setting is changed, the ticks will be updated. Then at the end we check the min is still less than the max (to do this, we convert the ticks back to days in the interests of readability). BUG: https://bugzilla.samba.org/show_bug.cgi?id=13873 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Apr 5 08:03:08 UTC 2019 on sn-devel-144
2019-04-05netcmd: Add some timestamp conversion helper functionsTim Beale1-10/+22
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13873 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-05netcmd: Use python constant for -0x8000000000000000Tim Beale1-5/+9
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13873 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-02Spelling fix s/informations/information/Mathieu Parent2-2/+2
Signed-off-by: Mathieu Parent <math.parent@gmail.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
2019-03-30samba-tool: fix some typosBjörn Baumbach2-4/+4
All command descriptions have a dot '.' at the end. The ou and visualize command need this too. ... group - Group management. ldapcmp - Compare two ldap databases. ntacl - NT ACLs manipulation. ou - Organizational Units (OU) management ... user - User management. visualize - Produces graphical representations of Samba network state Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-03-14dbcheck: don't check expired tombstone objects by default anymoreStefan Metzmacher1-1/+2
These will be removed anyway and any change on them risks to be an originating update that causes replication problems. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13816 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Mar 14 03:12:27 UTC 2019 on sn-devel-144
2019-03-14dbcheck: add --selftest-check-expired-tombstones cmdline optionStefan Metzmacher1-1/+6
This will be used by dbcheck tests which operate on static/old provision dumps in the following commits. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-14python/samba/netcmd: provide SUPPRESS_HELP via Option classStefan Metzmacher1-0/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13816 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-12samba-tool domain provision: Fix --interactive module in python3Andrew Bartlett1-0/+1
The prompts were not being printed to the screen because the stream was not being flushed. As reported on the samba mailing list by Adam Xu: https://lists.samba.org/archive/samba/2019-March/221753.html BUG: https://bugzilla.samba.org/show_bug.cgi?id=13828 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Tim Beale <timbeale@catalyst.net.nz>
2019-03-12gpo: Backup a policy folder containing GPE.INIGarming Sam1-0/+6
The GPE.INI file does not appear to be documented anywhere in the protocol specifications and seems to be due to legacy code. It appears that it used to be how the gPCUserExtensionNames and gPCMachineExtensionNames were maintained without the requirement for LDAP. All we do is ignore the parsing of this file and copy it over as binary. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13825 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Mar 12 01:41:32 UTC 2019 on sn-devel-144
2019-03-12gpo: During restore clobber GPT.INI with a blank versionGarming Sam1-5/+18
Generally speaking, there is not much value to keeping this file. The display name does not ever seem to be used and the version only applies to the original domain or DC it was on. The command line option to revert this behaviour is mostly for the tests or for having a straight 1:1 backup-restore for pure restoration. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13806 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-12gpo: Restore gPCMachineExtensionNames and gPCUserExtensionNamesGarming Sam1-1/+25
After creating a backup and calling 'gpo restore', this makes it so that restoring a GPO will instantly enable it for use. There might be some cases where we might not want to do this, but for now just do it. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13627 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-03-12gpo: Ensure that gplink works when emptyGarming Sam1-1/+5
It appears that RSAT can leave a space in the gPLink field, which we need to handle. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13564 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-21samba-tool dsacl: Mark old and new descriptor output correctlyAndrew Bartlett1-4/+7
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-02-21Add command "samba-tool dsacl get" This code is very equal to "samba-tool ↵Martin Krämer1-0/+48
dsacl set", except it only prints out the current sddl of an object. Signed-off-by: Martin Krämer <mk.maddin@gmail.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-21Update dsacl.py - add_ace to handle/verify sddl parameter correctMartin Krämer1-14/+17
Test for samba-tool dsacl set --sddl parmeter Update tests.py - add dsacl (dsacl.py / samba-tool dsacl set) test Signed-off-by: <Martin Krämer mk.maddin@gmail.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-21dbcheck: skip reverse member link checks when cli option specifiedJoe Guo1-1/+9
currently dbcheck cmd tooks about 1 day to finish on a 100k user database. We can skip member reverse link checks to speed it up dramatically. A new cli option is added to enable the skipping. Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-13spelling of associatedDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-02-01netcmd: Improve error handling of gpo aclcheck as non-adminTim Beale1-0/+4
Reading the nTSecurityDescriptor attribute over LDAP requires admin creds. However, if you don't specify admin creds, then you get an error like this: bin/samba-tool gpo aclcheck ERROR(<class 'KeyError'>): uncaught exception - 'No such element' File "bin/python/samba/netcmd/__init__.py", line 184, in _run return self.run(*args, **kwargs) File "bin/python/samba/netcmd/gpo.py", line 1536, in run ds_sd_ndr = m['nTSecurityDescriptor'][0] This patch adds an explicit check/error message to make the problem clearer. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-01-21netcmd: Try to improve domain backup error messageTim Beale1-2/+3
I ran this command as non-root by mistake and didn't find the error message particularly helpful. Tweak the error message so it reminds the user that they should be root. Also display the path we're looking for the sam.ldb file in, to give them more clues. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org> Autobuild-User(master): Noel Power <npower@samba.org> Autobuild-Date(master): Mon Jan 21 16:34:06 CET 2019 on sn-devel-144
2019-01-18python: dsal: Fix possibility of identical ACE's being added.Martin Krämer1-1/+1
Currently it is possible to add the same ace multiple times if the case sensitivity does not match the existing one using "--sddl" parameter. As an example while an ace "OA;CIIO;RPWP;3e978925-8c01-11d0-afda-00c04fd930c9;bf967a86-0de6-11d0-a285-00aa003049e2;PS" already exists a sddl "OA;CIIO;RPWP;3E978925-8C01-11D0-AFDA-00C04FD930C9;BF967A86-0DE6-11D0-A285-00AA003049E2;PS" can be added without detection (and can be added multiple times). As an end result after a high number of addings (in my tests it was about 1600-1800 aces for one object) no further changes on that object are possible. Signed-off-by: Martin Krämer <mk.maddin@gmail.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Rowland Penny <rpenny@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Jan 18 23:19:13 CET 2019 on sn-devel-144
2019-01-17netcmd: Change GPO commands to use s3 SMB Py bindingsTim Beale1-2/+5
This means we can now use GPO commands on a DC that has SMBv1 disabled. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-17netcmd: Change SMB flags from s4 Py bindings to s3Tim Beale1-6/+7
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-16join: Fix TypeError when handling exceptionTim Beale1-1/+1
When we can't resolve a domain name, we were inadvertently throwing a TypeError whilst trying to output a helpful message. E.g. ERROR(<class 'TypeError'>): uncaught exception - 'NTSTATUSError' object does not support indexing Instead of indexing the object, we want to index the Exception.args so that we just display the string portion of the exception error. The same problem is also present for the domain trust commands. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13747 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Rowland Penny <rpenny@samba.org> Reviewed-by: Jeremy Allison <rpenny@samba.org>
2019-01-14netcmd: Change domain backup commands to use s3 SMB Py bindingsTim Beale1-2/+6
This means we can now backup a DC that has SMBv1 disabled. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Tim Beale <timbeale@samba.org> Autobuild-Date(master): Mon Jan 14 06:49:09 CET 2019 on sn-devel-144
2019-01-10netcmd: Fix broken samba-tool gpo commandsTim Beale1-0/+1
samba-tool gpo create|fetch|backup commands throw exceptions due to a missing Python import: ERROR(<class 'NameError'>): uncaught exception - name 'tempfile' is not defined File "bin/python/samba/netcmd/__init__.py", line 184, in _run return self.run(*args, **kwargs) File "bin/python/samba/netcmd/gpo.py", line 980, in run tmpdir, gpodir = self.construct_tmpdir(tmpdir, gpo) File "bin/python/samba/netcmd/gpo.py", line 386, in construct_tmpdir tmpdir = tempfile.mkdtemp() Introduced by commit e3320b6d3df7a0c7b refactor. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org> Autobuild-User(master): Noel Power <npower@samba.org> Autobuild-Date(master): Thu Jan 10 16:21:23 CET 2019 on sn-devel-144
2019-01-09netcmd/user: python[3]-gpgme unsupported and replaced by python[3]-gpgJoe Guo1-25/+61
python[3]-gpgme is deprecated since ubuntu 1804 and debian 9. use python[3]-gpg instead, and adapt the API. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13728 Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-01-08netcmd: Small refactor to SMB connection in domain backupTim Beale1-2/+7
Rework the code so we only do this in one place. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13676 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Tim Beale <timbeale@samba.org> Autobuild-Date(master): Tue Jan 8 03:13:48 CET 2019 on sn-devel-144
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 04:23:38 +0000