summaryrefslogtreecommitdiff
path: root/source4/setup
AgeCommit message (Collapse)AuthorFilesLines
2025-12-10s4/dlz: add support for bind 9.20Michael Tokarev1-2/+2
bind dlz interface does not change much, yet we build dlz_bind9_NN for every bind9 version NN we support - despite many of them differ only in soversion, with the code being identical. For bind9_20, use dlz_bind9_18.so which we already have. It'd be nice to extract actual bind9 version string in sambadns.py and use it in more direct way. Bug: https://bugzilla.samba.org/show_bug.cgi?id=15790 Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Samuel Cabrero <scabrero@samba.org> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Wed Dec 10 22:46:11 UTC 2025 on atb-devel-224
2025-08-27setup:adprep: Import the latest ↵Jennifer Sutton4-90/+428
{Domain-Wide,Forest-Wide,Read-Only-Domain-Controller,Schema}-Updates.md Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-08-27s4:setup: Fix spellingJennifer Sutton1-4/+4
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-08-27schema: Add Validated-Write-Computer Extended Right from Windows Server 2016Jennifer Sutton2-1/+21
Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-06-10dsdb: Prepare to handle smartcard password rolloverAndrew Bartlett1-1/+1
We do this by allowing the password change control to indicate that the password is to be randomised, bypassing the quality checks (as true random passwords often fail these) and re-randomising with the same code as is used for the KDC. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-05-16s4:setup: Update name of dsdb password change controlJo Sutton1-1/+1
Commit 0a907c2f45c34efcac784738c9d75303b9d04d2f renamed this control to DSDB_CONTROL_PASSWORD_CHANGE_OLD_PW_CHECKED_OID. Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-16s4:dsdb: Add dsdb control indicating that gMSA passwords are to be updatedJo Sutton1-0/+1
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-16s4:setup: Remove empty lineJo Sutton1-1/+0
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-16CVE-2018-14628: s4:setup: set the correct nTSecurityDescriptor on the ↵Stefan Metzmacher3-0/+3
CN=Deleted Objects container This revealed a bug in our dirsync code, so we mark test_search_with_dirsync_deleted_objects as knownfail. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13595 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-14s4:setup: Fix script usage lineJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-14s4:setup: Fix code spellingAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19s4:provision: use better values for operatingSystem[Version]Stefan Metzmacher1-2/+2
Some clients (e.g. an exchange server) check operatingSystemVersion in order to check if a domain controller is new enough. So we better use a value matching the dc functional level. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-05CVE-2023-0614 ldb: Prevent disclosure of confidential attributesJoseph Sutton1-0/+1
Add a hook, acl_redact_msg_for_filter(), in the aclread module, that marks inaccessible any message elements used by an LDAP search filter that the user has no right to access. Make the various ldb_match_*() functions check whether message elements are accessible, and refuse to match any that are not. Remaining message elements, not mentioned in the search filter, are checked in aclread_callback(), and any inaccessible elements are removed at this point. Certain attributes, namely objectClass, distinguishedName, name, and objectGUID, are always present, and hence the presence of said attributes is always allowed to be checked in a search filter. This corresponds with the behaviour of Windows. Further, we unconditionally allow the attributes isDeleted and isRecycled in a check for presence or equality. Windows is not known to make this special exception, but it seems mostly harmless, and should mitigate the performance impact on searches made by the show_deleted module. As a result of all these changes, our behaviour regarding confidential attributes happens to match Windows more closely. For the test in confidential_attr.py, we can now model our attribute handling with DC_MODE_RETURN_ALL, which corresponds to the behaviour exhibited by Windows. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270 Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-05CVE-2023-0614 schema_samba4.ldif: Allocate previously added OIDJoseph Sutton1-0/+1
DSDB_CONTROL_CALCULATED_DEFAULT_SD_OID was added in commit 08187833fee57a8dba6c67546dfca516cd1f9d7a. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-22samba-tool: let 'domain provision' to use the 2019 schema by defaultStefan Metzmacher1-5/+25
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-22setup/adprep: import the latest ↵Stefan Metzmacher9-4669/+48729
{Domain-Wide,Forest-Wide,Read-Only-Domain-Controller,Schema}-Updates.md We have Domain-Wide-Updates.md and Read-Only-Domain-Controller-Updates.md only for completeness, they are not parsed/used yet, so we added .unused in order to avoid confusion in future. Initially I tried to go with an ms_domain_updates_markdown.py, but it is easier to add the current updates by hand to domain_update.py, which will follow in the next commits. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-22setup/ad-schema: add the latest v1803 and v1903 schema files from MicrosoftStefan Metzmacher4-0/+79377
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08selftest: Expect setting domain-local group as primary group to failJoseph Sutton1-2/+1
This will no longer be allowed. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-23s4:setup:tests: Use system ldbdump if we build with system ldbAndreas Schneider1-1/+4
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Fri Dec 23 15:31:31 UTC 2022 on sn-devel-184
2022-08-25python:tests: Allocate OID range for testing to avoid collisionsJoseph Sutton1-0/+1
sid_strings.py used the same OID range as ldap_schema.py, which occasionally led to test failures when the same OID was generated twice. Using a different range, and making use of the expected RID if we have it, should reduce the likelihood of collisions. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Thu Aug 25 13:55:47 UTC 2022 on sn-devel-184
2022-08-25schema_samba4.ldif: Allocate previously added OIDsJoseph Sutton1-0/+2
DSDB_CONTROL_FORCE_ALLOW_VALIDATED_DNS_HOSTNAME_SPN_WRITE_OID was added to source4/dsdb/samdb/samdb.h in commit c2ab1f4696fa3f52918a126d0b37993a07f68bcb. DSDB_EXTENDED_SCHEMA_LOAD was added in commit 1fd4cdfafaa6a41c824d1b3d76635bf3e446de0f. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-08-22s4:setup: Fix shellcheck errors in provision_fileperms.shAndreas Schneider1-5/+3
source4/setup/tests/provision_fileperms.sh:27:14: error: Iterating over ls output is fragile. Use globs. [SC2045] Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2022-07-15s4:setup: Reformat shell scriptsAndreas Schneider10-155/+162
shfmt -f source4/setup/ | xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2022-05-23s4/dlz: add support for bind 9.18Douglas Bagnall1-0/+3
It seems nothing has changed since 9.16 for our purposes. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14986 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Signed-off-by: Andreas Hasenack <andreas@canonical.com> Pair-programmed-with: Andreas Hasenack <andreas@canonical.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Mon May 23 00:53:09 UTC 2022 on sn-devel-184
2022-03-18s4:provision_users.ldif: Add Protected Users groupJoseph Sutton1-0/+9
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2021-11-09CVE-2020-25722 blackbox/upgrades tests: ignore SPN for ldapcmpDouglas Bagnall1-4/+4
We need to have the SPNs there before someone else nabs them, which makes the re-provisioned old releases different from the reference versions that we keep for this comparison. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-09CVE-2020-25722 s4/provision: add host/ SPNs at the startDouglas Bagnall1-2/+7
There are two reasons for this. Firstly, leaving SPNs unclaimed is dangerous, as someone else could grab them first. Secondly, in some circumstances (self join) we try to add a DNS/ SPN a little bit later in provision. Under the rules we are introducing for CVE-2020-25722, this will make our later attempts to add HOST/ fail. This causes a few errors in samba4.blackbox.dbcheck.* tests, which assert that revivified old domains match stored reference versions. Now they don't, because they have servicePrincipalNames. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-09CVE-2020-25722 tests: blackbox samba-tool spn non-admin testDouglas Bagnall1-0/+2
It is soon going to be impossible to add duplicate SPNs (short of going behind DSDB's back on the local filesystem). Our test of adding SPNs on non-admin users doubled as the test for adding a duplicate (using --force). As --force is gone, we add these tests on Guest after the SPN on Administrator is gone. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-09CVE-2020-25722 samba-tool spn add: remove --force optionDouglas Bagnall1-4/+1
This did not actually *force* the creation of a duplicate SPN, it just ignored the client-side check for the existing copy. Soon we are going to enforce SPN uniqueness on the server side, and this --force will not work. This will make the --force test fail, and if that tests fail, so will others that depend the duplicate values. So we remove those tests. It is wrong-headed to try to make duplicate SPNs in any case, which is probably why there is no sign of anyone ever having used this option. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-29s4:samba: Migrate samba daemon to new cmdline option parserAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28tests: Use --configfile instead of -sAndreas Schneider3-8/+8
We should use long options in tests to make clear what we are trying to do. Also the -s short option will be removed for --configfile later. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28tests: Use ldbsearch '--scope instead of '-s'Andreas Schneider1-2/+2
We should use long options in tests to make clear what we are trying to do. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-26test samba-tool group listmembers: test listing contacts as group membersBjörn Baumbach1-0/+9
Make sure that contacts are listed as group members, even if the --hide-expired option is used. Expect failure. Fix follows up. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14692 Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Rowland penny <rpenny@samba.org>
2020-09-24provision: Add support for BIND 9.16.xAmitay Isaacs1-0/+3
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14487 Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Rowland Penny <rpenny@samba.org>
2020-09-24provision: Add support for BIND 9.14.xAmitay Isaacs1-0/+3
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14487 Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Rowland Penny <rpenny@samba.org>
2020-04-23provision: Remove final code for the LDAP backendAndrew Bartlett1-1/+1
The LDAP backend for the Samba AD DC, aiming to store the AD DC in an existing LDAP server was largely removed many years aga, but the other parts were removed in 2b0fc74a0916a6ab0d5ac007cc5e100d4682b2ea. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Apr 23 06:12:20 UTC 2020 on sn-devel-184
2020-04-23source4/setup: Remove files unused since the LDAP backend was removedAndrew Bartlett21-306/+0
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2020-01-21selftest: add test for samba-tool groupmember --member-base-dn optionBjörn Baumbach1-0/+7
Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21selftest: add tests for samba-tool group addmembers --object-types optionBjörn Baumbach1-1/+59
Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21selftest: add test for new samba-tool group addmembers --member-dn optionBjörn Baumbach1-0/+46
Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-21samba-tool tests: add test-case for 'user getgrouops --full-dn'Björn Baumbach1-0/+17
Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Ralph Boehme <slow@samba.org>
2020-01-15tests: Test samba-tool user setprimarygroup commandBjörn Baumbach1-0/+17
Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Wed Jan 15 13:30:53 UTC 2020 on sn-devel-184
2020-01-15tests: Test samba-tool user getgroups commandBjörn Baumbach1-0/+24
Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Andreas Schneider <asn@samba.org>
2020-01-15selftest: create working directory for blackbox testBjörn Baumbach1-0/+1
Required to run test separately. Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Andreas Schneider <asn@samba.org>
2019-10-08samba-tool: create working private krb5.confAlexander Bokovoy1-0/+8
DNS update tool uses private krb5.conf which should have enough details to authenticate with GSS-TSIG when running nsupdate. Unfortunately, the configuration we provide is not enough. We set defaults to not lookup REALM via DNS but at the same time we don't provide any realm definition. As result, MIT Kerberos cannot actually find a working realm for Samba AD deployment because it cannot query DNS for a realm discovery or pick it up from the configuration. Extend private krb5.conf with a realm definition that will allow MIT Kerberos to look up KDC over DNS. Signed-off-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2019-08-30samba-tool domain provision: Remove experimental OpenLDAP supportAndrew Bartlett7-342/+0
This feature has long been obsolete, remaining only in the hope that it might be revived in the future. Specifically, in 2011 the S4 OpenLDAP backend HOWTO was removed: commit 1d46325af8541ea467c79cd86e65f93ce6a14ff4 Author: Andrew Bartlett <abartlet@samba.org> Date: Wed Apr 27 22:42:29 2011 +1000 Remove outdated S4 OpenLDAP backend HOWTO. There is a project to revive this, hosted here: https://github.com/Symas/samba and https://github.com/Symas/samba_overlays However discussions at SambaXP with Nadezhda Ivanova indicate a new approach with slapd being started by Samba and taught to read native Samba ldb files is more likely in the short term. This has the advantage that Samba's provision and offline tooling would not need to change, with the solution looking more like how BIND9_DLZ has access to the Samba DB. If any of this is required then reverting these patches will be the least of the difficulties in bringing this to production. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
2019-08-30sefltest: Remove tests for obsolete OpenLDAP backendAndrew Bartlett1-26/+0
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
2019-06-26selftest: schema version check in provision testAaron Haslett1-0/+38
Modifying blackbox provision test to check schema version. Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Jun 26 05:31:03 UTC 2019 on sn-devel-184
2019-06-26selftest: specifying 2008_R2 base schema for tests that need itAaron Haslett1-3/+3
We're going to change the default base schema so this patch changes all tests and testenvs requiring the current default (2008_R2) to specify it in all provision commands using --base-schema. Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-06-21provision: Suggest "minimal-responses yes;" by defaultAndrew Bartlett1-3/+3
This improves Samba AD DC performance as a DNS server dramatically, because NS records do not need to be looked up and there is less risk the response will have to fall back to TCP, doubling the cost again. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Jun 21 00:52:19 UTC 2019 on sn-devel-184
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 00:10:41 +0000