summaryrefslogtreecommitdiff
path: root/python/samba/netcmd
AgeCommit message (Collapse)AuthorFilesLines
2022-05-31gpo: Move Group Policy code below gp directoryDavid Mulder1-1/+1
Moves the Group Policy extensions and supporting code within the existing python/samba/gp directory. Meant to clean up the clutter that's accumulating in python/samba. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue May 31 20:15:45 UTC 2022 on sn-devel-184
2022-05-10python: Use 'is' for identity when comparing against NoneJoseph Sutton1-2/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Tue May 10 06:12:10 UTC 2022 on sn-devel-184
2022-05-10python: Remove redundant assignmentsJoseph Sutton4-17/+11
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-05-10samba-tool: Don't try to delete local_tdo_handle twice.Joseph Sutton1-8/+0
This code is unreachable, as local_tdo_handle has already been deleted and set to None earlier. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-05-10python: Remove unnecessary 'pass' statementsJoseph Sutton3-3/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-05-10samba-tool gpo: Fix unintended string concatenationsJoseph Sutton1-6/+6
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-05-10samba-tool processes: Remove unused loopJoseph Sutton1-15/+14
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-05-05samba-tool user: Consistently return a tupleJoseph Sutton1-1/+1
We would get an error when get_userPassword_hash() returned None, as get_virtual_crypt_value() would try to unpack the result as a 2-element tuple. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-05-05samba-tool user: Remove unused importsJoseph Sutton1-4/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-28samba-tool: Check specified domain and realm against our ownJoseph Sutton3-17/+40
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Mar 28 03:11:51 UTC 2022 on sn-devel-184
2022-03-28samba-tool: Return correct result for _get_user_realm_domain()Joseph Sutton1-2/+2
We were returning the realm and the domain in the wrong order. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-28samba-tool delegation: Clarify msDS-AllowedToDelegateTo delegation command ↵Joseph Sutton1-2/+2
documentation This makes the difference between msDS-AllowedToDelegateTo and msDS-AllowedToActOnBehalfOfOtherIdentity more clear. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14954 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-28samba-tool delegation: Add commands to add/remove principals for RBCDJoseph Sutton1-1/+275
These commands allow updating the msDS-AllowedToActOnBehalfOfOtherIdentity attribute with principals allowed to delegate to an account. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14954 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-28samba-tool delegation show: Display information for RBCDJoseph Sutton1-2/+22
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14954 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-28samba-tool delegation: Add function to display security descriptor for RBCDJoseph Sutton1-0/+77
We also check some features of the security descriptor, and display warnings if they are not as expected. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14954 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-18samba-tool group: Add --special parameter to add predefined special groupJoseph Sutton1-3/+194
This allows default security groups that have been added since Windows Server 2008 R2, such as Protected Users, to be created in pre-existing domains. An error message is generated if a group already exists with the same name, DN, or SID. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-17samba-tool: Fix typoJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-02-23samba-tool/join_member: let py_net_join_member() choose the passwordStefan Metzmacher1-2/+0
It means we'll let trust_pw_new_value() generate the password. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14984 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2021-12-06samba-tool: Create DNS entries on member joinDavid Mulder1-3/+7
The net ads join command already handles this, and the call was missing from the python bindings for samba-tool domain join member. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-12-03samba-tool domain backup: backup but do not follow symlinksDouglas Bagnall1-2/+2
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14918 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-12-03samba-tool domain backup: cope better with dangling symlinksDouglas Bagnall1-1/+9
Our previous behaviour was to try to os.stat() the non-existent target. The new code greatly improves efficiency for this little task. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14918 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-09CVE-2020-25722 samba-tool spn add: remove --force optionDouglas Bagnall1-4/+2
This did not actually *force* the creation of a duplicate SPN, it just ignored the client-side check for the existing copy. Soon we are going to enforce SPN uniqueness on the server side, and this --force will not work. This will make the --force test fail, and if that tests fail, so will others that depend the duplicate values. So we remove those tests. It is wrong-headed to try to make duplicate SPNs in any case, which is probably why there is no sign of anyone ever having used this option. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-09CVE-2020-25722 samba-tool spn: accept -H for database urlDouglas Bagnall1-11/+22
Following the convention and making testing easier BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-04samba-tool: Add domain member leaveDavid Mulder1-0/+31
Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Rowland Penny <rpenny@samba.org> Autobuild-User(master): David Mulder <dmulder@samba.org> Autobuild-Date(master): Thu Nov 4 20:43:32 UTC 2021 on sn-devel-184
2021-10-26Revert "samba-tool: Pick local host if calling samba-tool from DC"David Mulder1-5/+0
This reverts commit 7c9195e28bc51ac375d609f8306db2456f348167. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): David Mulder <dmulder@samba.org> Autobuild-Date(master): Tue Oct 26 16:00:28 UTC 2021 on sn-devel-184
2021-10-26samba-tool: Pick local host if calling samba-tool from DCDavid Mulder1-0/+5
It is reasonable to assume, that if we are running a command from a DC, that a user expects that the command will run against this DC. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Rowland Penny <rpenny@samba.org> Autobuild-User(master): David Mulder <dmulder@samba.org> Autobuild-Date(master): Tue Oct 26 14:23:42 UTC 2021 on sn-devel-184
2021-09-07samba-tool: Fix a typoVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-08-24samba-tool domain backup: Use tdbbackup on metadata.tdbAndrew Bartlett1-0/+3
metadata.tdb is inside sam.ldb.d/ but should be backed up with tdbbackup. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Tue Aug 24 13:22:04 UTC 2021 on sn-devel-184
2021-08-24samba-tool: Rework transations/locks to hold a lock during mdb backupAndrew Bartlett1-6/+32
We now also get sidForRestore under that lock, rather than after the backup. This avoids using the database again after the backup process While not entirely clear how/why this matters with LMDB as seen in Fedora 34, likely due to the same issues seen with 0.9.26 or later fixed by commmit bb3dcd403ced922574a89011dd3814c4fe87dd76. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14676 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2021-08-24samba-tool domain backup offline: Use passed in samdb when backing up sam.ldbAndrew Bartlett1-7/+8
This avoids opening the database again by having the caller pass in the DB open BUG: https://bugzilla.samba.org/show_bug.cgi?id=14676 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2021-07-05samba-tool: dns update rejects malformed addressesDouglas Bagnall1-2/+11
Because neither filling out the struct will not necessarily tell you you got it wrong, and the RPC could succeed in setting an arbitrary wrong address (typically, an IPv6 address would set an A record to "255.255.255.255"). Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-22samba-tool: Demote computer to wellknown containerDavid Mulder1-1/+4
BUG: https://bugzilla.samba.org/show_bug.cgi?id=9143 Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-20samba-tool: Disable AD DC options in samba-tool domainDavid Mulder1-14/+16
Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-17netcmd: Incorrect arguments to Exception constructorGarming Sam1-1/+1
Discovered by Semmle code analysis: https://lgtm.com/projects/g/samba-team/samba Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Thu Jun 17 05:12:03 UTC 2021 on sn-devel-184
2021-06-11netcmd: Avoid conflicting SIDs when creating an offline backupJoseph Sutton1-1/+2
To allow the new DC object to be created in a restored domain while avoiding conflicts with existing SIDS, we fetch a SID that is available at the time of backing up and store it in the backed-up database. However, if a new security principal is created on this DC during the backup process, the stored SID may be reused for that object, resulting in an error on restoration. By getting the SID for restore only after all the database files have been backed up, we ensure that the chosen SID does not conflict with any objects in the backed-up database. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-06-11netcmd: Use next_free_rid() function to calculate a SID for restoring a backupJoseph Sutton1-43/+14
This means we won't get errors if the DC doesn't have a rIDNextRID attribute, but we will still error if there is no RID Set or if all its pools are exhausted. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14669 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-06-11netcmd: Refactor seizing DNS roles while restoring from a backupJoseph Sutton1-12/+5
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-06-11netcmd: Use correct path for state directory during offline backupJoseph Sutton1-1/+1
During the restore process, we use make_smbconf() to create a new smb.conf file with the default paths. The default location for 'state directory' is 'state', but we currently rename this directory to 'statedir' on backing up, so it will end up pointing to a non-existent directory. This commit ensures the names are consistent. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-06-11netcmd: Fix error-checking conditionJoseph Sutton1-3/+4
This condition probably meant to check the argument of the most recently thrown exception, rather than the previous one again. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14669 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-06-10samba-tool: stick to the point with --versionDouglas Bagnall1-1/+1
We were doing this: $ bin/samba-tool --version samba-tool: no such subcommand: --version 4.15.0pre1-DEVELOPERBUILD $ which is silly. Now we'll just see the version. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-06-10samba-tool dns zoneoptions --help improvementDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-06-10samba-tool domain: improve error message when `patch` failsDouglas Bagnall1-1/+2
The old message confused even the wisest among us: https://lists.samba.org/archive/samba/2021-May/236021.html and while /user/bin/patch might be overly specific, it should point people in the right direction. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-06-09samba-tool: gpo admxload mkdir -pDavid Mulder1-1/+1
Ensure all directories in the path are created, otherwise admx upload fails here. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): David Mulder <dmulder@samba.org> Autobuild-Date(master): Wed Jun 9 22:26:42 UTC 2021 on sn-devel-184
2021-06-02samba-tool dns zoneoptions: timestamp manipulation optionsDouglas Bagnall1-2/+202
There was a bug in Samba before 4.9 that marked all records intended to be static with a current timestamp, and all records intended to be dynamic with a zero timestamp. This was exactly the opposite of correct behaviour. It follows that a domain which has been upgraded past 4.9, but on which aging is not enabled, records intended to be static will have a timestamp from before the upgrade date (unless their nodes have suffered a DNS update, which due to another bug, will change the timestmap). The following command will make these truly static: $ samba-tool dns zoneoptions --mark-old-records-static=2018-07-23 -U... where '2018-07-23' should be replaced by the approximate date of the upgrade beyond 4.9. It seems riskier making blanket conversions of static records into dynamic records, but there are sometimes useful patterns in the names given to machines that we can exploit. For example, if there is a group of machines with names like 'desktop-123' that are all supposed to using dynamic DNS, the adminstrator can go $ samba-tool dns zoneoptions --mark-records-dynamic-regex='desktop-\d+' and there's a --mark-records-static-regex for symmetry. These options are deliberately long and cumbersome to type, so people have a chance to think before they get to the end. We also introduce a '--dry-run' (or '-n') option so they can inspect the likely results before going ahead. *NOTE* ageing will still not work properly after this commit, due to other bugs that will be fixed in other commits. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-02samba-tool dns: remove unused importsDouglas Bagnall1-4/+0
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-06-02samba-tool dns: move dns_record_match to dnsserver.pyDouglas Bagnall1-81/+7
This function is used here and in tests, but the tests should not be importing things from netcmd.dns, which is really supposed to be UI code. So we move to a common place. the only difference is the function raises DNSParseError instead of CommandError, and netcmd.dns has to catch and wrap that. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-05-17samba-tool:testparm: Display nicer parameter dump error messagesJoseph Sutton1-2/+10
Now we catch errors for unknown sections or parameters and turn them into CommandErrors. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14143 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Rowland Penny <rpenny@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-05-17samba-tool:testparm: Fix error with --section-nameJoseph Sutton1-1/+1
Pass the correct parameters into LoadparmService.dump() so that --section-name works properly. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14143 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Rowland Penny <rpenny@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28python: remove all 'from __future__ import division'Douglas Bagnall1-1/+0
This made '//' and '/' in Python 2 behave as in Python 3. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28python: remove all 'from __future__ import print_function'Douglas Bagnall5-6/+0
This made Python 2's print behave like Python 3's print(). In some cases, where we had: from __future__ import print_function """Intended module documentation...""" this will have the side effect of making the intended module documentation work as the actual module documentation (i.e. becoming __doc__), because it is once again the first statement in the module. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 11:46:23 +0000