summaryrefslogtreecommitdiff
path: root/source3/utils/net.c
AgeCommit message (Collapse)AuthorFilesLines
2026-02-05s3:utils: 'net ads kerberos kinit' should use also default ccache name from ↵Pavel Filipenský1-10/+26
krb5.conf This is re-introducing the behavior from samba-4.20 where both these commands operated on the same ccache (default_ccache_name in [libdefaults] section of krb5.conf) 'net ads kerberos kinit -P' 'klist' With samba-4.21 it no longer works, 'net ads kerberos kinit -P' fallbacks to 'MEMORY:net' (which is of a very limited use, ticket cannot be used by other process) and klist finds no ticket. The order is changed from: --use-krb5-ccache env "KRB5CCNAME" "MEMORY:net" to ("MEMORY:net" is removed): --use-krb5-ccache env "KRB5CCNAME" default_ccache_name '--use-krb5-ccache=MEMORY:net' can be used to validate the credentials. Use smb_force_krb5_cc_default_name() instead of krb5_cc_default_name() because of commit: 1ca6fb5 make sure krb5_cc_default[_name]() is no longer used directly Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2026-01-05s3-net: properly setup krb5 ccache name via --use-krb5-ccacheGünther Deschner1-7/+12
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840 Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2025-09-05s3:net: Pass down the server from cmdline to sync_pw2keytabs()Andreas Schneider1-4/+6
This makes sure that during 'net ads join' the keytab create code - sync_pw2keytabs() talks to the same DC at what the machine account was created. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15905 Signed-off-by: Andreas Schneider <asn@samba.org> Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Pair-Programmed-With: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org> Autobuild-Date(master): Fri Sep 5 13:38:33 UTC 2025 on atb-devel-224
2025-07-24s3-net: fix "net ads kerberos" krb5ccname handlingGünther Deschner1-0/+15
We can only rely on KRB5CCNAME being set, --use-krb5-ccname content is not available. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840 Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Thu Jul 24 17:31:14 UTC 2025 on atb-devel-224
2024-09-13sync machine password to keytab: handle FreeIPA use caseAlexander Bokovoy1-0/+8
FreeIPA uses own procedure to retrieve keytabs and during the setup of Samba on FreeIPA client the keytab is already present, only machine account needs to be set in the secrets database. 'sync machine password to keytab' option handling broke this use case by always attempting to contact a domain controller and failing to do so (Fedora bug https://bugzilla.redhat.com/show_bug.cgi?id=2309199). The original synchronizing machine account password to keytab feature did not have a mechanism to disable its logic at all. Signed-off-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org> Autobuild-User(master): Alexander Bokovoy <ab@samba.org> Autobuild-Date(master): Fri Sep 13 13:16:09 UTC 2024 on atb-devel-224
2024-07-26s3: Sync machine account password in secrets_{prepare,finish}_password_changePavel Filipenský1-2/+15
BUG: https://bugzilla.samba.org/show_bug.cgi?id=6750 Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-06-04lib: Use cli_credentials_add_gensec_features in a few placesVolker Lendecke1-6/+4
Capture a common pattern Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-14s3:net: finally remove net_context->opt_{user_specified,user_name,password}Stefan Metzmacher1-7/+0
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-05-14s3:net: remove unused net_context->smb_encryptStefan Metzmacher1-4/+0
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-05-14s3:net: remove unused net_context->opt_kerberosStefan Metzmacher1-4/+0
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-05-14s3:net: remove useless net_prompt_pass() wrapperStefan Metzmacher1-1/+1
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-05-14s3:net: make use of c->explicit_credentials in order to check for valid ↵Stefan Metzmacher1-1/+1
credentials Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-05-14s3:net: add net_context->explicit_credentials to check if credentials were ↵Stefan Metzmacher1-0/+11
passed Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-05-14s3:net: correctly implement --use-ccache as legacy for --use-winbind-ccache ↵Stefan Metzmacher1-2/+8
for 'net' Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-01-26s3:utils: add 'net witness force-response'Stefan Metzmacher1-0/+6
This allows generating any possible AsyncNotify response for the specified selection of witness registrations from rpcd_witness_registration.tdb. This can be used by developers to test the (windows) client behavior to specific AsyncNotify responses. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2024-01-26s3:utils: add 'net witness client-move' and 'net witness share-move'Stefan Metzmacher1-0/+19
These can be used to generate CLIENT_MOVE or SHARE_MOVE message to the specified selection of witness registrations from rpcd_witness_registration.tdb Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2024-01-26s3:utils: add 'net witness list' commandStefan Metzmacher1-0/+39
It lists the entries from the rpcd_witness_registration.tdb. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2023-10-25s3:utils: Call gfree_all() before exit in netAndreas Schneider1-0/+3
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-23s3:utils: Use lpcfg_set_cmdline() in netPavel Kalugin1-3/+4
Signed-off-by: Pavel Kalugin <pkalugin@inno.tech> Reviewed-by: Andreas Schneider <asn@samba.org>
2023-03-03net: add new --dns-ttl option to specify the ttl of dns recordsBjörn Baumbach1-0/+7
Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-38023 s3:net: add and use net_warn_member_options() helperStefan Metzmacher1-0/+6
This makes sure domain member related 'net' commands print warnings about unsecure smb.conf options. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2022-08-26s3:net: Zero password in secrets_fetch_ipc_userpass() callersPavel Filipenský1-2/+2
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2022-08-26s3:net: Fix trailing whitespace in net.cPavel Filipenský1-1/+1
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2021-07-14s3-net: add "net offlinejoin" commandGünther Deschner1-0/+7
Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2021-05-28s3:utils: Use connection and credentials parser in net utilAndreas Schneider1-110/+36
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-05-28s3:utils: Migrate net to new cmdline option parserAndreas Schneider1-12/+22
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-05-28s3:utils: Remove '-l' for '--long' from netAndreas Schneider1-1/+0
This conflicts with '--log-basename' from the commend cmdline parser. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-03-30s3:utils: Use secrets_store_creds() in net utilityAndreas Schneider1-12/+9
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2021-03-16lib: Remove init_names()Volker Lendecke1-3/+0
is_myname() looks at lp_* directly, nmbd maintains its own list: We don't need the baroque loadparm handler anymore. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-01-05s3:utils - explicitly free cmdline_messaging_contextAndrew Walker1-0/+1
Some command line utilities do not free their messaging context which results in extra entries being left in the msg.lock directory. Signed-off-by: Andrew Walker <awalker@ixsystems.com> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Jan 5 21:30:08 UTC 2021 on sn-devel-184
2020-07-13net: ignore possible SIGPIPE upon ldap_unbind when over TLSIsaac Boukris1-0/+3
From local tests with strace: socket(AF_UNIX, SOCK_STREAM, 0) = 12 write(2, "Connecting to 10.53.57.21 at por"..., 38) = 38 ... write(2, "ads_domain_func_level: 3\n", 25) = 25 write(12, "\27\3\3\0\37\0\0\0\0\0\0\0\16nl[\374\375i\325\334\25\227kxG@\326\311R\225x"..., 36) = 36 write(12, "\25\3\3\0\32\0\0\0\0\0\0\0\17Hh\304\254\244\17\342<\334\210L&\20_\177\307\232P", 31) = -1 EPIPE (Broken pipe) --- SIGPIPE {si_signo=SIGPIPE, si_code=SI_USER, si_pid=12089, si_uid=1000} --- +++ killed by SIGPIPE +++ BUG: https://bugzilla.samba.org/show_bug.cgi?id=14439 Signed-off-by: Isaac Boukris <iboukris@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Isaac Boukris <iboukris@samba.org> Autobuild-Date(master): Mon Jul 13 12:06:07 UTC 2020 on sn-devel-184
2019-12-02lib: Remove duplicate get_pass() prototypesVolker Lendecke1-0/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Martin Schwenke <martins@samba.org>
2019-07-12s3:net: add 'vfs' hierarchy with 'stream2adouble' commandRalph Boehme1-0/+27
This adds a new top-level command hierarchy 'vfs' that can be used to add commands that access the smbd VFS stack. The first command to be implemented is 'stream2adouble' which can be used to convert stream metadata to AppleDouble files. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-28s3:utils: Use C99 initializer in functable in netAndreas Schneider1-9/+15
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-01-28s3:utils: Use C99 initializer for poptOption in netAndreas Schneider1-50/+302
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-12-07net: Use dom_sid_str_bufVolker Lendecke1-8/+10
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2018-11-30net: Add support for a credentials fileOlly Betts1-0/+25
Add support for the same -A authfile/--authentication-file authfile option that most of the other tools already do. Signed-off-by: Olly Betts <olly@survex.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-11-06gencache: Remove transaction-based tdbVolker Lendecke1-2/+0
At more than one large site I've seen significant problems due to gencache_stabilize. gencache_stabilize was mainly introduced to survive machine crashes with the cache still being in place. Given that most installations crash rarely and this is still a cache, this safety is overkill and causes real problems. With the recent changes to tdb, we should be safe enough to run on completely corrupted databases and properly detect errors. A further commit will introduce code that wipes the gencache.tdb if such a corruption is detected. There is one kind of corruption that we don't properly handle: Orphaned space in the database. I don't have a good idea yet how to handle this in a graceful and efficient way during normal operations, but maybe this idea pops up at some point. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2018-10-19lib: Remove gencache.h from proto.hVolker Lendecke1-0/+1
It's a pain to recompile the world if gencache.h changes Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Fri Oct 19 18:52:50 CEST 2018 on sn-devel-144
2018-09-22s3: net: implement json output for ads infoPhilipp Gesang1-0/+1
Add the switch '--json' to 'net' to format the output as JSON. The rationale is to supply the information in a machine-readable fashion to complement the text version of the output which is neither particularly well defined nor locale-safe. The output differs from that of plain 'info' in that times are not formatted as timestamps. Currently affects only the 'net ads info' subcommand. Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-09-07s3:net: Use cmdline_messaging_contextChristof Schmitt1-27/+2
Use cmdline_messaging_context with its error checking instead of open coding the same steps. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2018-09-07s3:lib: Move popt_common_credentials to separate fileChristof Schmitt1-1/+1
This is only used by command line utilities and has additional dependencies. Move to a separate file to contain the dependencies to the command line tools. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13465 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2018-07-30s3:libads: Add net ads leave keep-account optionJustin Stephenson1-1/+2
Add the ability to leave the domain with --keep-account argument to avoid removal of the host machine account. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13498 Signed-off-by: Justin Stephenson <jstephen@redhat.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2018-03-29net: Fix CID 1128559 Dereference null return valueVolker Lendecke1-3/+7
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-06-27net: make use of secrets_*_password_change() for "net changesecretpw"Stefan Metzmacher1-7/+44
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2017-06-27net: add "net primarytrust dumpinfo" command that dumps the details of the ↵Stefan Metzmacher1-0/+85
workstation trust BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2017-06-27s3:secrets: rename secrets_delete() to secrets_delete_entry()Stefan Metzmacher1-3/+3
secrets_delete_entry() fails if the key doesn't exist. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2017-05-08net: Add net tdb command to print information from tdb recordsChristof Schmitt1-0/+8
The main purpose is to debug "hot" records from ctdb. ctdb tracks contended records and identifies them by key in the dbstatistics: DB Statistics: locking.tdb [...] Num Hot Keys: 1 Count:3 Key:6a4128e3ced4681b02a00000000000000000000000000000 This command allows querying additional information for the associated key to identify the affected file. For now this only adds a subcommand for the locking.tdb, but could be extended to others: net tdb locking 6a4128e3ced4681b02a00000000000000000000000000000 Share path: /test/share Name: testfile Number of share modes: 2 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2016-11-16s3:net: Use messaging_init_client()Andreas Schneider1-5/+17
Pair-Programmed-With: Jeremy Allison <jra@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Signed-off-by: Jeremy Allison <jra@samba.org>
2015-12-22s3: fix encryption help messagesRalph Boehme1-1/+1
Encryption is a SMB3 feature and not tied to UNIX extensions, so fix the help messages of various utilities. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Michael Adam <obnox@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Dec 22 02:22:50 CET 2015 on sn-devel-144
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 23:44:00 +0000