diff options
Diffstat (limited to 'source4/scripting/devel')
21 files changed, 1476 insertions, 0 deletions
diff --git a/source4/scripting/devel/addlotscontacts b/source4/scripting/devel/addlotscontacts new file mode 100644 index 0000000..9ecd16b --- /dev/null +++ b/source4/scripting/devel/addlotscontacts @@ -0,0 +1,95 @@ +#!/usr/bin/env python3 +# +# Copyright (C) Matthieu Patou <mat@matws.net> 2010 +# +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. + +__docformat__ = "restructuredText" + + +import optparse +import sys +# Allow to run from s4 source directory (without installing samba) +sys.path.insert(0, "bin/python") + +import samba.getopt as options +from samba.credentials import DONT_USE_KERBEROS +from samba.auth import system_session +from samba import param +from samba.provision import find_provision_key_parameters +from samba.upgradehelpers import (get_paths, get_ldbs) +from ldb import SCOPE_BASE, Message, MessageElement, Dn, FLAG_MOD_ADD + +parser = optparse.OptionParser("addlotscontacts [options]") +sambaopts = options.SambaOptions(parser) +parser.add_option_group(sambaopts) +parser.add_option_group(options.VersionOptions(parser)) +credopts = options.CredentialsOptions(parser) +parser.add_option_group(credopts) + +(opts, args) = parser.parse_args() + +lp = sambaopts.get_loadparm() +smbconf = lp.configfile +creds = credopts.get_credentials(lp) +creds.set_kerberos_state(DONT_USE_KERBEROS) + +if len(args) > 0: + num_contacts = int(args[0]) +else: + num_contacts = 10000 + +if __name__ == '__main__': + paths = get_paths(param, smbconf=smbconf) + session = system_session() + + ldbs = get_ldbs(paths, creds, session, lp) + ldbs.startTransactions() + + names = find_provision_key_parameters(ldbs.sam, ldbs.secrets, ldbs.idmap, + paths, smbconf, lp) + + contactdn = "OU=Contacts,%s" % str(names.domaindn) + res = ldbs.sam.search(expression="(distinguishedName=%s)" % contactdn, + base=str(names.domaindn), + scope=SCOPE_BASE) + + if (len(res) == 0): + msg = Message() + msg.dn = Dn(ldbs.sam, contactdn) + msg["objectClass"] = MessageElement("organizationalUnit", FLAG_MOD_ADD, + "objectClass") + + ldbs.sam.add(msg) + + print("Creating %d contacts" % num_contacts) + count = 0 + increment = num_contacts / 10 + if increment > 5000: + increment = 5000 + + while (count < num_contacts): + msg = Message() + msg.dn = Dn(ldbs.sam, "CN=contact%d,%s" % (count + 1, contactdn)) + msg["objectClass"] = MessageElement("contact", FLAG_MOD_ADD, + "objectClass") + + if count !=0 and (count % increment) == 0: + print("Added contacts: %d" % count) + + ldbs.sam.add(msg) + count += 1 + + ldbs.groupedCommit() diff --git a/source4/scripting/devel/chgkrbtgtpass b/source4/scripting/devel/chgkrbtgtpass new file mode 100644 index 0000000..2beb2e7 --- /dev/null +++ b/source4/scripting/devel/chgkrbtgtpass @@ -0,0 +1,60 @@ +#!/usr/bin/env python3 +# +# Copyright (C) Matthieu Patou <mat@matws.net> 2010 +# Copyright (C) Andrew Bartlett <abartlet@samba.org> 2015 +# +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. + + +__docformat__ = "restructuredText" + + +import optparse +import sys +# Allow to run from s4 source directory (without installing samba) +sys.path.insert(0, "bin/python") + +import samba.getopt as options +from samba.credentials import DONT_USE_KERBEROS +from samba.auth import system_session +from samba import param +from samba.provision import find_provision_key_parameters +from samba.upgradehelpers import (get_paths, + get_ldbs, + update_krbtgt_account_password) + +parser = optparse.OptionParser("chgkrbtgtpass [options]") +sambaopts = options.SambaOptions(parser) +parser.add_option_group(sambaopts) +parser.add_option_group(options.VersionOptions(parser)) +credopts = options.CredentialsOptions(parser) +parser.add_option_group(credopts) + +opts = parser.parse_args()[0] + +lp = sambaopts.get_loadparm() +smbconf = lp.configfile +creds = credopts.get_credentials(lp) +creds.set_kerberos_state(DONT_USE_KERBEROS) + + +paths = get_paths(param, smbconf=smbconf) +session = system_session() + +ldbs = get_ldbs(paths, creds, session, lp) +ldbs.startTransactions() + +update_krbtgt_account_password(ldbs.sam) +ldbs.groupedCommit() diff --git a/source4/scripting/devel/chgtdcpass b/source4/scripting/devel/chgtdcpass new file mode 100755 index 0000000..8f2415c --- /dev/null +++ b/source4/scripting/devel/chgtdcpass @@ -0,0 +1,63 @@ +#!/usr/bin/env python3 +# +# Copyright (C) Matthieu Patou <mat@matws.net> 2010 +# +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. + + +__docformat__ = "restructuredText" + + +import optparse +import sys +# Allow to run from s4 source directory (without installing samba) +sys.path.insert(0, "bin/python") + +import samba.getopt as options +from samba.credentials import DONT_USE_KERBEROS +from samba.auth import system_session +from samba import param +from samba.provision import find_provision_key_parameters +from samba.upgradehelpers import (get_paths, + get_ldbs, + update_machine_account_password) + +parser = optparse.OptionParser("chgtdcpass [options]") +sambaopts = options.SambaOptions(parser) +parser.add_option_group(sambaopts) +parser.add_option_group(options.VersionOptions(parser)) +credopts = options.CredentialsOptions(parser) +parser.add_option_group(credopts) + +opts = parser.parse_args()[0] + +lp = sambaopts.get_loadparm() +smbconf = lp.configfile +creds = credopts.get_credentials(lp) +creds.set_kerberos_state(DONT_USE_KERBEROS) + + +if __name__ == '__main__': + paths = get_paths(param, smbconf=smbconf) + session = system_session() + + ldbs = get_ldbs(paths, creds, session, lp) + ldbs.startTransactions() + + names = find_provision_key_parameters(ldbs.sam, ldbs.secrets, ldbs.idmap, + paths, smbconf, lp) + + update_machine_account_password(ldbs.sam, ldbs.secrets, names) + ldbs.groupedCommit() diff --git a/source4/scripting/devel/config_base b/source4/scripting/devel/config_base new file mode 100755 index 0000000..f593f2f --- /dev/null +++ b/source4/scripting/devel/config_base @@ -0,0 +1,39 @@ +#!/usr/bin/env python3 + +# this is useful for running samba tools with a different prefix + +# for example: +# samba-tool $(scripting/devel/config_base /tmp/testprefix) join ..... + +import sys, os + +vars = { + "ncalrpc dir" : "${PREFIX}/var/ncalrpc", + "private dir" : "${PREFIX}/private", + "lock dir" : "${PREFIX}/var/locks", + "pid directory" : "${PREFIX}/var/run", + "winbindd socket directory" : "${PREFIX}/var/run/winbindd", + "ntp signd socket directory" : "${PREFIX}/var/run/ntp_signd" +} + +if len(sys.argv) != 2: + print("Usage: config_base BASEDIRECTORY") + sys.exit(1) + +prefix = sys.argv[1] + +config_dir = prefix + "/etc" +config_file = config_dir + "/smb.conf" + +if not os.path.isdir(config_dir): + os.makedirs(config_dir, mode=0o755) +if not os.path.isfile(config_file): + open(config_file, mode='w').close() + +options = ( + " --configfile=${PREFIX}/etc/smb.conf" + "".join(" --option=%s=%s" % (v.replace(" ",""), vars[v]) for v in vars) + ).replace("${PREFIX}", prefix) + + +print(options) diff --git a/source4/scripting/devel/crackname b/source4/scripting/devel/crackname new file mode 100755 index 0000000..021adfa --- /dev/null +++ b/source4/scripting/devel/crackname @@ -0,0 +1,77 @@ +#!/usr/bin/env python3 + +# Copyright Matthieu Patou <mat@matws.net> 2011 +# script to call a DRSUAPI crackname +# this is useful for plugfest testing and replication debug +import sys +from optparse import OptionParser + +sys.path.insert(0, "bin/python") + +import samba.getopt as options +from samba.dcerpc import drsuapi, misc + +def do_DsBind(drs): + '''make a DsBind call, returning the binding handle''' + bind_info = drsuapi.DsBindInfoCtr() + bind_info.length = 28 + bind_info.info = drsuapi.DsBindInfo28() + bind_info.info.supported_extensions = 0 + (info, handle) = drs.DsBind(misc.GUID(drsuapi.DRSUAPI_DS_BIND_GUID), bind_info) + return handle + + +########### main code ########### +if __name__ == "__main__": + parser = OptionParser("crackname server [options]") + sambaopts = options.SambaOptions(parser) + parser.add_option_group(sambaopts) + credopts = options.CredentialsOptionsDouble(parser) + parser.add_option_group(credopts) + + parser.add_option("", "--name", type='str', + default='{ED9F5546-9729-4B04-9385-3FCFE2B17BA1}', help="name to crack") + parser.add_option("", "--outformat", type='int', + default=drsuapi.DRSUAPI_DS_NAME_FORMAT_FQDN_1779, + help='format desired') + parser.add_option("", "--informat", type='int', + default=drsuapi.DRSUAPI_DS_NAME_FORMAT_GUID, + help='format offered') + + (opts, args) = parser.parse_args() + + lp = sambaopts.get_loadparm() + creds = credopts.get_credentials(lp) + + if len(args) != 1: + parser.error("You must supply a server") + + if creds.is_anonymous(): + parser.error("You must supply credentials") + + server = args[0] + + binding_str = "ncacn_ip_tcp:%s[seal,print]" % server + + drs = drsuapi.drsuapi(binding_str, lp, creds) + drs_handle = do_DsBind(drs) + print("DRS Handle: %s" % drs_handle) + + req = drsuapi.DsNameRequest1() + names = drsuapi.DsNameString() + names.str = opts.name + + req.codepage = 1252 + req.language = 1033 + req.format_flags = 0 + req.format_offered = opts.informat + req.format_desired = opts.outformat + req.count = 1 + req.names = [names] + + (result, ctr) = drs.DsCrackNames(drs_handle, 1, req) + print("# of result = %d" %ctr.count) + if ctr.count: + print("status = %d" % ctr.array[0].status) + print("result name = %s" % ctr.array[0].result_name) + print("domain = %s" % ctr.array[0].dns_domain_name) diff --git a/source4/scripting/devel/demodirsync.py b/source4/scripting/devel/demodirsync.py new file mode 100755 index 0000000..6be3366 --- /dev/null +++ b/source4/scripting/devel/demodirsync.py @@ -0,0 +1,159 @@ +#!/usr/bin/python + +import optparse +import sys +import base64 + +sys.path.insert(0, "bin/python") + +import samba.getopt as options +from samba.dcerpc import drsblobs, misc +from samba.ndr import ndr_pack, ndr_unpack +from samba import Ldb + +parser = optparse.OptionParser("demodirsync [options]") +sambaopts = options.SambaOptions(parser) +credopts = options.CredentialsOptions(parser) +parser.add_option_group(credopts) + +parser.add_option("-b", type="string", metavar="BASE", + help="set base DN for the search") +parser.add_option("--host", type="string", metavar="HOST", + help="Ip of the host") + +lp = sambaopts.get_loadparm() +creds = credopts.get_credentials(lp) + +opts = parser.parse_args()[0] + +if opts.host is None: + print("Usage: demodirsync.py --host HOST [-b BASE]") + sys.exit(1) + +def printdirsync(ctl): + arr = ctl.split(':') + if arr[0] == 'dirsync': + print("Need to continue: %s" % arr[1]) + cookie = ndr_unpack(drsblobs.ldapControlDirSyncCookie, base64.b64decode(arr[3])) + print("DC's NTDS guid: %s " % cookie.blob.guid1) + print("highest usn %s" % cookie.blob.highwatermark.highest_usn) + print("tmp highest usn %s" % cookie.blob.highwatermark.tmp_highest_usn) + print("reserved usn %s" % cookie.blob.highwatermark.reserved_usn) + if cookie.blob.extra_length > 0: + print("highest usn in extra %s" % cookie.blob.extra.ctr.cursors[0].highest_usn) + return cookie + + +remote_ldb = Ldb("ldap://" + opts.host + ":389", credentials=creds, lp=lp) +tab = [] +if opts.b: + base = opts.b +else: + base = None + +guid = None +(msgs, ctrls) = remote_ldb.search(expression="(samaccountname=administrator)", base=base, attrs=["objectClass"], controls=["dirsync:1:1:50"]) +if (len(ctrls)): + for ctl in ctrls: + arr = ctl.split(':') + if arr[0] == 'dirsync': + cookie = ndr_unpack(drsblobs.ldapControlDirSyncCookie, base64.b64decode(arr[3])) + guid = cookie.blob.guid1 +if not guid: + print("No dirsync control ... strange") + sys.exit(1) + +print("") +print("Getting first guest without any cookie") +(msgs, ctrls) = remote_ldb.searchex(expression="(samaccountname=guest)", base=base, attrs=["objectClass"], controls=["dirsync:1:1:50"]) +cookie = None +if (len(ctrls)): + for ctl in ctrls: + cookie = printdirsync(ctl) + print("Returned %d entries" % len(msgs)) + +savedcookie = cookie + +print("") +print("Getting allusers with cookie") +controls = ["dirsync:1:1:50:%s" % base64.b64encode(ndr_pack(cookie)).decode('utf8')] +(msgs, ctrls) = remote_ldb.searchex(expression="(samaccountname=*)", base=base, attrs=["objectClass"], controls=controls) +if (len(ctrls)): + for ctl in ctrls: + printdirsync(ctl) + print("Returned %d entries" % len(msgs)) + +cookie = savedcookie +cookie.blob.guid1 = misc.GUID("128a99bf-e2df-4832-ac0a-1fb625e530db") +if cookie.blob.extra_length > 0: + cookie.blob.extra.ctr.cursors[0].source_dsa_invocation_id = misc.GUID("128a99bf-e2df-4832-ac0a-1fb625e530db") + +print("") +print("Getting all the entries") +controls = ["dirsync:1:1:50:%s" % base64.b64encode(ndr_pack(cookie)).decode('utf8')] +(msgs, ctrls) = remote_ldb.searchex(expression="(objectclass=*)", base=base, controls=controls) +cont = 0 +if (len(ctrls)): + for ctl in ctrls: + cookie = printdirsync(ctl) + if cookie is not None: + cont = (ctl.split(':'))[1] + print("Returned %d entries" % len(msgs)) + +usn = cookie.blob.highwatermark.tmp_highest_usn +if cookie.blob.extra_length > 0: + bigusn = cookie.blob.extra.ctr.cursors[0].highest_usn +else: + bigusn = usn + 1000 +while (cont == "1"): + print("") + controls = ["dirsync:1:1:50:%s" % base64.b64encode(ndr_pack(cookie)).decode('utf8')] + (msgs, ctrls) = remote_ldb.searchex(expression="(objectclass=*)", base=base, controls=controls) + if (len(ctrls)): + for ctl in ctrls: + cookie = printdirsync(ctl) + if cookie is not None: + cont = (ctl.split(':'))[1] + print("Returned %d entries" % len(msgs)) + +print("") +print("Getting with cookie but usn changed to %d we should use the one in extra" % (bigusn - 1)) +cookie.blob.highwatermark.highest_usn = 0 +cookie.blob.highwatermark.tmp_highest_usn = usn - 2 +if cookie.blob.extra_length > 0: + print("here") + cookie.blob.extra.ctr.cursors[0].highest_usn = bigusn - 1 +controls = ["dirsync:1:1:50:%s" % base64.b64encode(ndr_pack(cookie)).decode('utf8')] +(msgs, ctrls) = remote_ldb.searchex(expression="(objectclass=*)", base=base, controls=controls) +if (len(ctrls)): + for ctl in ctrls: + cookie = printdirsync(ctl) + print("Returned %d entries" % len(msgs)) + +print("") +print("Getting with cookie but usn %d changed and extra/cursor GUID too" % (usn - 2)) +print(" so that it's (tmp)highest_usn that drives the limit") +cookie.blob.highwatermark.highest_usn = 0 +cookie.blob.highwatermark.tmp_highest_usn = usn - 2 +if cookie.blob.extra_length > 0: + cookie.blob.extra.ctr.cursors[0].source_dsa_invocation_id = misc.GUID("128a99bf-e2df-4832-ac0a-1fb625e530db") + cookie.blob.extra.ctr.cursors[0].highest_usn = bigusn - 1 +controls = ["dirsync:1:1:50:%s" % base64.b64encode(ndr_pack(cookie)).decode('utf8')] +(msgs, ctrls) = remote_ldb.searchex(expression="(objectclass=*)", base=base, controls=controls) +if (len(ctrls)): + for ctl in ctrls: + cookie = printdirsync(ctl) + print("Returned %d entries" % len(msgs)) + +print("") +print("Getting with cookie but usn changed to %d" % (usn - 2)) +cookie.blob.highwatermark.highest_usn = 0 +cookie.blob.highwatermark.tmp_highest_usn = (usn - 2) +if cookie.blob.extra_length > 0: + cookie.blob.extra.ctr.cursors[0].highest_usn = (usn - 2) +controls = ["dirsync:1:1:50:%s" % base64.b64encode(ndr_pack(cookie)).decode('utf8')] +(msgs, ctrls) = remote_ldb.searchex(expression="(objectclass=*)", base=base, controls=controls) +if (len(ctrls)): + for ctl in ctrls: + cookie = printdirsync(ctl) + print("Returned %d entries" % len(msgs)) diff --git a/source4/scripting/devel/drs/fsmo.ldif.template b/source4/scripting/devel/drs/fsmo.ldif.template new file mode 100644 index 0000000..d5b373a --- /dev/null +++ b/source4/scripting/devel/drs/fsmo.ldif.template @@ -0,0 +1,75 @@ +dn: CN=RID Manager$,CN=System,BASEDN +changetype: modify +replace: fSMORoleOwner +fSMORoleOwner: CN=NTDS Settings,CN=MACHINE,CN=Servers,CN=Default-First-Site-Name,C + N=Sites,CN=Configuration,BASEDN +- + +dn: BASEDN +changetype: modify +replace: fSMORoleOwner +fSMORoleOwner: CN=NTDS Settings,CN=MACHINE,CN=Servers,CN=Default-First-Site-Name,C + N=Sites,CN=Configuration,BASEDN +- + +dn: CN=Infrastructure,BASEDN +changetype: modify +replace: fSMORoleOwner +fSMORoleOwner: CN=NTDS Settings,CN=MACHINE,CN=Servers,CN=Default-First-Site-Name,C + N=Sites,CN=Configuration,BASEDN +- + +dn: CN=Partitions,CN=Configuration,BASEDN +changetype: modify +replace: fSMORoleOwner +fSMORoleOwner: CN=NTDS Settings,CN=MACHINE,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,BASEDN +- + +dn: CN=Schema,CN=Configuration,BASEDN +changetype: modify +replace: fSMORoleOwner +fSMORoleOwner: CN=NTDS Settings,CN=MACHINE,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,BASEDN +- + +dn: CN=NTDS Settings,CN=MACHINE,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,BASEDN +changetype: modify +replace: options +options: 1 +- + +dn: CN=MACHINE,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,BASEDN +changetype: modify +replace: dNSHostName +dNSHostName: MACHINE.DNSDOMAIN +- + +dn: CN=NTDS Site Settings,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,BASEDN +changetype: modify +replace: interSiteTopologyGenerator +interSiteTopologyGenerator: CN=NTDS Settings,CN=MACHINE,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,BASEDN +- + +dn: CN=MACHINE,OU=Domain Controllers,BASEDN +changetype: modify +replace: servicePrincipalName +servicePrincipalName: GC/MACHINE.DNSDOMAIN/DNSDOMAIN +servicePrincipalName: HOST/MACHINE/NETBIOSDOMAIN +servicePrincipalName: ldap/MACHINE/NETBIOSDOMAIN +servicePrincipalName: ldap/MACHINE.DNSDOMAIN/ForestDnsZones.DNSDOMAIN +servicePrincipalName: ldap/MACHINE.DNSDOMAIN/DomainDnsZones.DNSDOMAIN +servicePrincipalName: DNS/MACHINE.DNSDOMAIN +servicePrincipalName: RestrictedKrbHost/MACHINE.DNSDOMAIN +servicePrincipalName: RestrictedKrbHost/MACHINE +servicePrincipalName: HOST/MACHINE.DNSDOMAIN/NETBIOSDOMAIN +servicePrincipalName: HOST/MACHINE +servicePrincipalName: HOST/MACHINE.DNSDOMAIN +servicePrincipalName: HOST/MACHINE.DNSDOMAIN/DNSDOMAIN +servicePrincipalName: ldap/MACHINE.DNSDOMAIN/NETBIOSDOMAIN +servicePrincipalName: ldap/MACHINE +servicePrincipalName: ldap/MACHINE.DNSDOMAIN +servicePrincipalName: ldap/MACHINE.DNSDOMAIN/DNSDOMAIN +servicePrincipalName: E3514235-4B06-11D1-AB04-00C04FC2DCD2/NTDSGUID/DNSDOMAIN +servicePrincipalName: ldap/NTDSGUID._msdcs.DNSDOMAIN +servicePrincipalName: Dfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/MACHINE.DNSDOMAIN +servicePrincipalName: NtFrs-88f5d2bd-b646-11d2-a6d3-00c04fc9b232/MACHINE.DNSDOMAIN +- diff --git a/source4/scripting/devel/drs/named.conf.ad.template b/source4/scripting/devel/drs/named.conf.ad.template new file mode 100644 index 0000000..071c98c --- /dev/null +++ b/source4/scripting/devel/drs/named.conf.ad.template @@ -0,0 +1,6 @@ +zone "DNSDOMAIN" IN { + type forward; + forwarders { + SERVERIP; + }; +}; diff --git a/source4/scripting/devel/drs/revampire_ad.sh b/source4/scripting/devel/drs/revampire_ad.sh new file mode 100755 index 0000000..cd3164c --- /dev/null +++ b/source4/scripting/devel/drs/revampire_ad.sh @@ -0,0 +1,23 @@ +#!/bin/bash + +set -x + +. $(dirname $0)/vars + +$(dirname $0)/vampire_ad.sh || exit 1 + +ntds_guid=$(sudo bin/ldbsearch -H $PREFIX/private/sam.ldb -b "CN=NTDS Settings,CN=$machine,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,$dn" objectGUID | grep ^objectGUID | awk '{print $2}') + +cp $PREFIX/private/$DNSDOMAIN.zone{.template,} +sed -i "s/NTDSGUID/$ntds_guid/g" $PREFIX/private/$DNSDOMAIN.zone +cp $PREFIX/private/named.conf{.local,} +sudo rndc reconfig +fsmotmp=$(mktemp fsmo.ldif.XXXXXXXXX) +cp $(dirname $0)/fsmo.ldif.template $fsmotmp +sed -i "s/NTDSGUID/$ntds_guid/g" $fsmotmp +sed -i "s/MACHINE/$machine/g" $fsmotmp +sed -i "s/DNSDOMAIN/$DNSDOMAIN/g" $fsmotmp +sed -i "s/BASEDN/$dn/g" $fsmotmp +sed -i "s/NETBIOSDOMAIN/$workgroup/g" $fsmotmp +sudo bin/ldbmodify -H $PREFIX/private/sam.ldb $fsmotmp +rm $fsmotmp diff --git a/source4/scripting/devel/drs/unvampire_ad.sh b/source4/scripting/devel/drs/unvampire_ad.sh new file mode 100755 index 0000000..c005374 --- /dev/null +++ b/source4/scripting/devel/drs/unvampire_ad.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +set -x + +. $(dirname $0)/vars + +if [ -z "$site" ]; then + site="Default-First-Site-Name" +fi + +bin/ldbdel -r -H ldap://$server.$DNSDOMAIN -U$workgroup/administrator%$pass "CN=$machine,CN=Computers,$dn" +bin/ldbdel -r -H ldap://$server.$DNSDOMAIN -U$workgroup/administrator%$pass "CN=$machine,OU=Domain Controllers,$dn" +bin/ldbdel -r -H ldap://$server.$DNSDOMAIN -U$workgroup/administrator%$pass "CN=$machine,CN=Servers,CN=$site,CN=Sites,CN=Configuration,$dn" +rm -f $PREFIX/private/*.ldb diff --git a/source4/scripting/devel/drs/vampire_ad.sh b/source4/scripting/devel/drs/vampire_ad.sh new file mode 100755 index 0000000..f3cdc3c --- /dev/null +++ b/source4/scripting/devel/drs/vampire_ad.sh @@ -0,0 +1,28 @@ +#!/bin/bash + +set -x + +. $(dirname $0)/vars + +namedtmp=$(mktemp named.conf.ad.XXXXXXXXX) +cp $(dirname $0)/named.conf.ad.template $namedtmp +sed -i "s/DNSDOMAIN/$DNSDOMAIN/g" $namedtmp +sed -i "s/SERVERIP/$server_ip/g" $namedtmp +chmod a+r $namedtmp +mv -f $namedtmp $PREFIX/private/named.conf +sudo rndc reconfig +$(dirname $0)/unvampire_ad.sh + +cat <<EOF >nsupdate.txt +update delete $DNSDOMAIN A $machine_ip +show +send +EOF +echo "$pass" | kinit administrator +nsupdate -g nsupdate.txt + +REALM="$(echo $DNSDOMAIN | tr '[a-z]' '[A-Z]')" + +sudo $GDB bin/samba-tool domain join $DNSDOMAIN DC -Uadministrator%$pass -s $PREFIX/etc/smb.conf --option=realm=$REALM --option="ads:dc function level=4" --option="ads:min function level=0" -d2 "$@" || exit 1 +# PRIVATEDIR=$PREFIX/private sudo -E scripting/bin/setup_dns.sh $machine $DNSDOMAIN $machine_ip || exit 1 +#sudo rndc flush diff --git a/source4/scripting/devel/drs/vars b/source4/scripting/devel/drs/vars new file mode 100644 index 0000000..b69b9f9 --- /dev/null +++ b/source4/scripting/devel/drs/vars @@ -0,0 +1,12 @@ +DNSDOMAIN=ad.samba.example.com +PREFIX="/data/samba/samba4/prefix.ad" +export PYTHONPATH=$PYTHONPATH:$PREFIX/lib/python2.6/site-packages +pass="penguin" +machine="ruth" +machine_ip="192.168.122.1" +workgroup=adruth +dn="DC=ad,DC=samba,DC=example,DC=com" +server=win2008-1 +server_ip=192.168.122.53 +site="Default-First-Site-Name" + diff --git a/source4/scripting/devel/enumprivs b/source4/scripting/devel/enumprivs new file mode 100755 index 0000000..389f7d0 --- /dev/null +++ b/source4/scripting/devel/enumprivs @@ -0,0 +1,58 @@ +#!/usr/bin/env python3 + +# script to enumerate LSA privileges on a server + +import sys +from optparse import OptionParser + +sys.path.insert(0, "bin/python") + +import samba +import samba.getopt as options +from samba.dcerpc import lsa, security + +def get_display_name(lsaconn, pol_handle, name): + '''get the display name for a privilege''' + string = lsa.String() + string.string = name + + (disp_names, ret_lang) = lsaconn.LookupPrivDisplayName(pol_handle, string, 0x409, 0) + return disp_names.string + + + + +########### main code ########### +if __name__ == "__main__": + parser = OptionParser("enumprivs [options] server") + sambaopts = options.SambaOptions(parser) + credopts = options.CredentialsOptionsDouble(parser) + parser.add_option_group(credopts) + + (opts, args) = parser.parse_args() + + lp = sambaopts.get_loadparm() + creds = credopts.get_credentials(lp) + + if len(args) != 1: + parser.error("You must supply a server") + + if not creds.authentication_requested(): + parser.error("You must supply credentials") + + server = args[0] + + binding_str = "ncacn_np:%s[print]" % server + + lsaconn = lsa.lsarpc(binding_str, lp, creds) + + objectAttr = lsa.ObjectAttribute() + objectAttr.sec_qos = lsa.QosInfo() + + pol_handle = lsaconn.OpenPolicy2(''.decode('utf-8'), + objectAttr, security.SEC_FLAG_MAXIMUM_ALLOWED) + + (handle, privs) = lsaconn.EnumPrivs(pol_handle, 0, 100) + for p in privs.privs: + disp_name = get_display_name(lsaconn, pol_handle, p.name.string) + print("0x%08x %31s \"%s\"" % (p.luid.low, p.name.string, disp_name)) diff --git a/source4/scripting/devel/getncchanges b/source4/scripting/devel/getncchanges new file mode 100755 index 0000000..a1a4d14 --- /dev/null +++ b/source4/scripting/devel/getncchanges @@ -0,0 +1,143 @@ +#!/usr/bin/env python3 + +# script to call a DRS GetNCChanges from the command line +# this is useful for plugfest testing +import sys +from optparse import OptionParser + +sys.path.insert(0, "bin/python") + +import samba, ldb +import samba.getopt as options +from samba.dcerpc import drsuapi, misc +from samba.samdb import SamDB +from samba.auth import system_session +from samba.ndr import ndr_unpack +from samba.drs_utils import drs_get_rodc_partial_attribute_set, drs_DsBind + + +########### main code ########### +if __name__ == "__main__": + parser = OptionParser("getncchanges [options] server") + sambaopts = options.SambaOptions(parser) + parser.add_option_group(sambaopts) + credopts = options.CredentialsOptionsDouble(parser) + parser.add_option_group(credopts) + + parser.add_option("", "--dn", dest="dn", help="DN to replicate",) + parser.add_option("", "--exop", dest="exop", help="extended operation",) + parser.add_option("", "--pas", dest="use_pas", action='store_true', default=False, + help="send partial attribute set (for RODC)") + parser.add_option("", "--nb-iter", type='int', help="Number of getncchange iterations") + parser.add_option("", "--dest-dsa", type='str', help="destination DSA GUID") + parser.add_option("", "--rodc", action='store_true', default=False, + help='use RODC replica flags') + parser.add_option("", "--partial-rw", action='store_true', default=False, + help='use RW partial replica flags, not be confused with --pas') + parser.add_option("", "--replica-flags", type='int', + default=drsuapi.DRSUAPI_DRS_INIT_SYNC | + drsuapi.DRSUAPI_DRS_PER_SYNC | + drsuapi.DRSUAPI_DRS_WRIT_REP | + drsuapi.DRSUAPI_DRS_GET_ANC | + drsuapi.DRSUAPI_DRS_NEVER_SYNCED, + help='replica flags') + + (opts, args) = parser.parse_args() + if opts.rodc: + opts.replica_flags = drsuapi.DRSUAPI_DRS_INIT_SYNC |\ + drsuapi.DRSUAPI_DRS_PER_SYNC |\ + drsuapi.DRSUAPI_DRS_GET_ANC |\ + drsuapi.DRSUAPI_DRS_NEVER_SYNCED |\ + drsuapi.DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING |\ + drsuapi.DRSUAPI_DRS_GET_ALL_GROUP_MEMBERSHIP + + if opts.partial_rw: + opts.replica_flags = drsuapi.DRSUAPI_DRS_INIT_SYNC |\ + drsuapi.DRSUAPI_DRS_PER_SYNC |\ + drsuapi.DRSUAPI_DRS_GET_ANC |\ + drsuapi.DRSUAPI_DRS_NEVER_SYNCED + + lp = sambaopts.get_loadparm() + creds = credopts.get_credentials(lp) + + if len(args) != 1: + parser.error("You must supply a server") + + if creds.is_anonymous(): + parser.error("You must supply credentials") + + if opts.partial_rw and opts.rodc: + parser.error("Can't specify --partial-rw and --rodc") + + server = args[0] + + binding_str = "ncacn_ip_tcp:%s[seal,print]" % server + + drs = drsuapi.drsuapi(binding_str, lp, creds) + drs_handle, supported_extensions = drs_DsBind(drs) + print("DRS Handle: %s" % drs_handle) + + req8 = drsuapi.DsGetNCChangesRequest8() + + samdb = SamDB(url="ldap://%s" % server, + session_info=system_session(), + credentials=creds, lp=lp) + + if opts.use_pas: + local_samdb = SamDB(url=None, session_info=system_session(), + credentials=creds, lp=lp) + + if opts.dn is None: + opts.dn = str(samdb.get_default_basedn()) + + if opts.exop is None: + exop = drsuapi.DRSUAPI_EXOP_NONE + else: + exop = int(opts.exop) + + dest_dsa = opts.dest_dsa + if not dest_dsa: + print("no dest_dsa specified trying to figure out from ldap") + msgs = samdb.search(controls=["search_options:1:2"], + expression='(objectclass=ntdsdsa)') + if len(msgs) == 1: + dest_dsa = str(ndr_unpack(misc.GUID, msgs[0]["invocationId"][0])) + print("Found this dsa: %s" % dest_dsa) + else: + # TODO fixme + pass + if not dest_dsa: + print("Unable to find the dest_dsa automatically please specify it") + import sys + sys.exit(1) + + null_guid = misc.GUID() + req8.destination_dsa_guid = misc.GUID(dest_dsa) + req8.source_dsa_invocation_id = misc.GUID(samdb.get_invocation_id()) + req8.naming_context = drsuapi.DsReplicaObjectIdentifier() + req8.naming_context.dn = opts.dn.decode("utf-8") + req8.highwatermark = drsuapi.DsReplicaHighWaterMark() + req8.highwatermark.tmp_highest_usn = 0 + req8.highwatermark.reserved_usn = 0 + req8.highwatermark.highest_usn = 0 + req8.uptodateness_vector = None + req8.replica_flags = opts.replica_flags + req8.max_object_count = 402 + req8.max_ndr_size = 402116 + req8.extended_op = exop + req8.fsmo_info = 0 + if opts.use_pas: + req8.partial_attribute_set = drs_get_rodc_partial_attribute_set(local_samdb) + else: + req8.partial_attribute_set = None + req8.partial_attribute_set_ex = None + req8.mapping_ctr.num_mappings = 0 + req8.mapping_ctr.mappings = None + + nb_iter = 0 + while True: + (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8) + nb_iter += 1 + if ctr.more_data == 0 or opts.nb_iter == nb_iter: + break + req8.highwatermark = ctr.new_highwatermark diff --git a/source4/scripting/devel/nmfind b/source4/scripting/devel/nmfind new file mode 100755 index 0000000..865c0d7 --- /dev/null +++ b/source4/scripting/devel/nmfind @@ -0,0 +1,15 @@ +#!/bin/sh + +# find object files containing a symbol +# for example: +# nmfind foo_function $(find bin/default -name '*.o') + +TARGET=$1 +shift +for f in $*; do + if nm $f 2>&1 | grep $TARGET >/dev/null; then + echo [$f] + nm $f | grep $TARGET + echo + fi +done diff --git a/source4/scripting/devel/pfm_verify.py b/source4/scripting/devel/pfm_verify.py new file mode 100755 index 0000000..f29c1e5 --- /dev/null +++ b/source4/scripting/devel/pfm_verify.py @@ -0,0 +1,192 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- +# +# script to verify cached prefixMap on remote +# server against the prefixMap stored in Schema NC +# +# Copyright (C) Kamen Mazdrashki <kamenim@samba.org> 2010 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +# + +import os +import sys +from optparse import OptionParser + +sys.path.insert(0, "bin/python") + +import samba +import samba.getopt as options +from ldb import SCOPE_BASE, SCOPE_SUBTREE +from samba.dcerpc import drsuapi, misc, drsblobs +from samba.drs_utils import drs_DsBind +from samba.samdb import SamDB +from samba.auth import system_session +from samba.ndr import ndr_pack, ndr_unpack + + +def _samdb_fetch_pfm(samdb): + """Fetch prefixMap stored in SamDB using LDB connection""" + res = samdb.search(base=samdb.get_schema_basedn(), expression="", scope=SCOPE_BASE, attrs=["*"]) + assert len(res) == 1 + pfm = ndr_unpack(drsblobs.prefixMapBlob, + str(res[0]['prefixMap'])) + + pfm_schi = _samdb_fetch_schi(samdb) + + return (pfm.ctr, pfm_schi) + + +def _samdb_fetch_schi(samdb): + """Fetch schemaInfo stored in SamDB using LDB connection""" + res = samdb.search(base=samdb.get_schema_basedn(), expression="", scope=SCOPE_BASE, attrs=["*"]) + assert len(res) == 1 + if 'schemaInfo' in res[0]: + pfm_schi = ndr_unpack(drsblobs.schemaInfoBlob, + str(res[0]['schemaInfo'])) + else: + pfm_schi = drsblobs.schemaInfoBlob() + pfm_schi.marker = 0xFF + return pfm_schi + + +def _drs_fetch_pfm(server, samdb, creds, lp): + """Fetch prefixMap using DRS interface""" + binding_str = "ncacn_ip_tcp:%s[print,seal]" % server + + drs = drsuapi.drsuapi(binding_str, lp, creds) + (drs_handle, supported_extensions) = drs_DsBind(drs) + print("DRS Handle: %s" % drs_handle) + + req8 = drsuapi.DsGetNCChangesRequest8() + + dest_dsa = misc.GUID("9c637462-5b8c-4467-aef2-bdb1f57bc4ef") + replica_flags = 0 + + req8.destination_dsa_guid = dest_dsa + req8.source_dsa_invocation_id = misc.GUID(samdb.get_invocation_id()) + req8.naming_context = drsuapi.DsReplicaObjectIdentifier() + req8.naming_context.dn = samdb.get_schema_basedn() + req8.highwatermark = drsuapi.DsReplicaHighWaterMark() + req8.highwatermark.tmp_highest_usn = 0 + req8.highwatermark.reserved_usn = 0 + req8.highwatermark.highest_usn = 0 + req8.uptodateness_vector = None + req8.replica_flags = replica_flags + req8.max_object_count = 0 + req8.max_ndr_size = 402116 + req8.extended_op = 0 + req8.fsmo_info = 0 + req8.partial_attribute_set = None + req8.partial_attribute_set_ex = None + req8.mapping_ctr.num_mappings = 0 + req8.mapping_ctr.mappings = None + + (level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8) + pfm = ctr.mapping_ctr + # check for schemaInfo element + pfm_it = pfm.mappings[-1] + assert pfm_it.id_prefix == 0 + assert pfm_it.oid.length == 21 + s = "".join(chr(x) for x in pfm_it.oid.binary_oid) + pfm_schi = ndr_unpack(drsblobs.schemaInfoBlob, s) + assert pfm_schi.marker == 0xFF + # remove schemaInfo element + pfm.num_mappings -= 1 + return (pfm, pfm_schi) + + +def _pfm_verify(drs_pfm, ldb_pfm): + errors = [] + if drs_pfm.num_mappings != ldb_pfm.num_mappings: + errors.append("Different count of prefixes: drs = %d, ldb = %d" + % (drs_pfm.num_mappings, ldb_pfm.num_mappings)) + count = min(drs_pfm.num_mappings, ldb_pfm.num_mappings) + for i in range(0, count): + it_err = [] + drs_it = drs_pfm.mappings[i] + ldb_it = ldb_pfm.mappings[i] + if drs_it.id_prefix != ldb_it.id_prefix: + it_err.append("id_prefix") + if drs_it.oid.length != ldb_it.oid.length: + it_err.append("oid.length") + if drs_it.oid.binary_oid != ldb_it.oid.binary_oid: + it_err.append("oid.binary_oid") + if len(it_err): + errors.append("[%2d] differences in (%s)" % (i, it_err)) + return errors + + +def _pfm_schi_verify(drs_schi, ldb_schi): + errors = [] + print(drs_schi.revision) + print(drs_schi.invocation_id) + if drs_schi.marker != ldb_schi.marker: + errors.append("Different marker in schemaInfo: drs = %d, ldb = %d" + % (drs_schi.marker, ldb_schi.marker)) + if drs_schi.revision != ldb_schi.revision: + errors.append("Different revision in schemaInfo: drs = %d, ldb = %d" + % (drs_schi.revision, ldb_schi.revision)) + if drs_schi.invocation_id != ldb_schi.invocation_id: + errors.append("Different invocation_id in schemaInfo: drs = %s, ldb = %s" + % (drs_schi.invocation_id, ldb_schi.invocation_id)) + return errors + + +########### main code ########### +if __name__ == "__main__": + # command line parsing + parser = OptionParser("pfm_verify.py [options] server") + sambaopts = options.SambaOptions(parser) + parser.add_option_group(sambaopts) + credopts = options.CredentialsOptionsDouble(parser) + parser.add_option_group(credopts) + + (opts, args) = parser.parse_args() + + lp = sambaopts.get_loadparm() + creds = credopts.get_credentials(lp) + + if len(args) != 1: + if "DC_SERVER" not in os.environ.keys(): + parser.error("You must supply a server") + args.append(os.environ["DC_SERVER"]) + + if creds.is_anonymous(): + parser.error("You must supply credentials") + + server = args[0] + + samdb = SamDB(url="ldap://%s" % server, + session_info=system_session(lp), + credentials=creds, lp=lp) + + exit_code = 0 + (drs_pfm, drs_schi) = _drs_fetch_pfm(server, samdb, creds, lp) + (ldb_pfm, ldb_schi) = _samdb_fetch_pfm(samdb) + # verify prefixMaps + errors = _pfm_verify(drs_pfm, ldb_pfm) + if len(errors): + print("prefixMap verification errors:") + print("%s" % errors) + exit_code = 1 + # verify schemaInfos + errors = _pfm_schi_verify(drs_schi, ldb_schi) + if len(errors): + print("schemaInfo verification errors:") + print("%s" % errors) + exit_code = 2 + + if exit_code != 0: + sys.exit(exit_code) diff --git a/source4/scripting/devel/rebuild_zone.sh b/source4/scripting/devel/rebuild_zone.sh new file mode 100755 index 0000000..94d1f9e --- /dev/null +++ b/source4/scripting/devel/rebuild_zone.sh @@ -0,0 +1,109 @@ +#!/bin/sh +# rebuild a zone file, adding all DCs + +[ $# -eq 2 ] || { + echo "rebuild_zone.sh <sam.ldb> <zonefile>" + exit 1 +} + +LDB="$1" +ZFILE="$2" + +dnshostname=$(bin/ldbsearch -H $LDB --scope=base -b '' dnsHostname | grep ^dns | cut -d' ' -f2) +host=$(echo $dnshostname | cut -d. -f1) +realm=$(echo $dnshostname | cut -d. -f2-) +GUIDs=$(bin/ldbsearch -H $LDB objectclass=ntdsdsa objectguid --cross-ncs | grep ^objectGUID | cut -d' ' -f2) +DOMAINGUID=$(bin/ldbsearch -H $LDB --scope=base objectguid | grep ^objectGUID | cut -d' ' -f2) + +dcname() +{ + GUID=$1 + echo $(bin/ldbsearch -H $LDB objectguid=$GUID dn --cross-ncs | grep CN=NTDS.Settings | cut -d, -f2 | cut -d= -f2) +} + +getip() +{ + NAME=$1 + ret=$(nmblookup $NAME | egrep '^[0-9]' | head -1 | cut -d' ' -f1) + test -n "$ret" || { + echo "Unable to find IP for $NAME. Using XX.XX.XX.XX. Please edit" 1>&2 + echo "XX.XX.XX.XX" + } + echo $ret +} + +echo "Generating header for host $host in realm $realm" +cat <<EOF >$ZFILE +; -*- zone -*- +; generated by rebuild_zone.sh +\$ORIGIN $realm. +\$TTL 1W +@ IN SOA @ hostmaster ( + $(date +%Y%m%d%H) ; serial + 2D ; refresh + 4H ; retry + 6W ; expiry + 1W ) ; minimum + IN NS $host + +EOF + +for GUID in $GUIDs; do + dc=$(dcname $GUID) + echo "Generating IP for DC $dc" + ip=$(getip $dc) + test -n "$ip" || exit 1 + echo " IN A $ip" >>$ZFILE +done + +echo "; IP Addresses" >>$ZFILE +for GUID in $GUIDs; do + dc=$(dcname $GUID) + ip=$(getip $dc) + test -n "$ip" || exit 1 + echo "$dc IN A $ip" >>$ZFILE +done + +for GUID in $GUIDs; do + dc=$(dcname $GUID) + ip=$(getip $dc) + test -n "$ip" || exit 1 + echo "Generating zone body for DC $dc with IP $ip" + cat <<EOF >>$ZFILE +; +; Entries for $dc +gc._msdcs IN A $ip +$GUID._msdcs IN CNAME $dc +_gc._tcp IN SRV 0 100 3268 $dc +_gc._tcp.Default-First-Site-Name._sites IN SRV 0 100 3268 $dc +_ldap._tcp.gc._msdcs IN SRV 0 100 389 $dc +_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs IN SRV 0 100 389 $dc +_ldap._tcp IN SRV 0 100 389 $dc +_ldap._tcp.dc._msdcs IN SRV 0 100 389 $dc +_ldap._tcp.pdc._msdcs IN SRV 0 100 389 $dc +_ldap._tcp.$DOMAINGUID.domains._msdcs IN SRV 0 100 389 $dc +_ldap._tcp.Default-First-Site-Name._sites IN SRV 0 100 389 $dc +_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 389 $dc +_kerberos._tcp IN SRV 0 100 88 $dc +_kerberos._tcp.dc._msdcs IN SRV 0 100 88 $dc +_kerberos._tcp.Default-First-Site-Name._sites IN SRV 0 100 88 $dc +_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 $dc +_kerberos._udp IN SRV 0 100 88 $dc +_kerberos-master._tcp IN SRV 0 100 88 $dc +_kerberos-master._udp IN SRV 0 100 88 $dc +_kpasswd._tcp IN SRV 0 100 464 $dc +_kpasswd._udp IN SRV 0 100 464 $dc +EOF +done + +cat <<EOF >>$ZFILE + +; kerberos hack +_kerberos IN TXT $(echo $realm | tr [a-z] [A-Z]) +EOF + +echo "Rebuilt zone file $ZFILE OK" + +echo "Reloading bind config" +PATH="/usr/sbin:$PATH" rndc reload +exit 0 diff --git a/source4/scripting/devel/rodcdns b/source4/scripting/devel/rodcdns new file mode 100755 index 0000000..6830580 --- /dev/null +++ b/source4/scripting/devel/rodcdns @@ -0,0 +1,43 @@ +#!/usr/bin/env python3 + +# script to call a netlogon RODC DNS update + +import sys +from optparse import OptionParser + +sys.path.insert(0, "bin/python") + +import samba +import samba.getopt as options +from samba.dcerpc import netlogon, winbind + +########### main code ########### +if __name__ == "__main__": + parser = OptionParser("rodcdns [options]") + sambaopts = options.SambaOptions(parser) + + parser.add_option("", "--weight", dest="weight", help="record weight", default=0, type='int') + parser.add_option("", "--priority", dest="priority", help="record priority", default=100, type='int') + parser.add_option("", "--port", dest="port", help="port number", default=389, type='int') + parser.add_option("", "--type", dest="type", help="record type", default=netlogon.NlDnsLdapAtSite, type='int') + parser.add_option("", "--site", dest="site", help="site name", default="Default-First-Site-Name") + + (opts, args) = parser.parse_args() + + lp = sambaopts.get_loadparm() + + w = winbind.winbind("irpc:winbind_server", lp) + + dns_names = netlogon.NL_DNS_NAME_INFO_ARRAY() + dns_names.count = 1 + name = netlogon.NL_DNS_NAME_INFO() + name.type = opts.type + name.priority = opts.priority + name.weight = opts.weight + name.port = opts.port + name.dns_register = True + dns_names.names = [ name ] + site_name = opts.site + + ret_names = w.DsrUpdateReadOnlyServerDnsRecords(site_name, 600, dns_names) + print("Status: %u" % ret_names.names[0].status) diff --git a/source4/scripting/devel/speedtest.py b/source4/scripting/devel/speedtest.py new file mode 100755 index 0000000..8c044c4 --- /dev/null +++ b/source4/scripting/devel/speedtest.py @@ -0,0 +1,235 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- +# +# Unix SMB/CIFS implementation. +# This speed test aims to show difference in execution time for bulk +# creation of user objects. This will help us compare +# Samba4 vs MS Active Directory performance. + +# Copyright (C) Zahari Zahariev <zahari.zahariev@postpath.com> 2010 +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +# + +import optparse +import sys +import time +import base64 +from decimal import Decimal + +sys.path.insert(0, "bin/python") +import samba +from samba.tests.subunitrun import TestProgram, SubunitOptions + +import samba.getopt as options + +from ldb import SCOPE_BASE, SCOPE_SUBTREE +from samba.ndr import ndr_unpack +from samba.dcerpc import security + +from samba.auth import system_session +from samba import gensec, sd_utils +from samba.samdb import SamDB +from samba.credentials import Credentials +import samba.tests +from samba.tests import delete_force + +parser = optparse.OptionParser("speedtest.py [options] <host>") +sambaopts = options.SambaOptions(parser) +parser.add_option_group(sambaopts) +parser.add_option_group(options.VersionOptions(parser)) + +# use command line creds if available +credopts = options.CredentialsOptions(parser) +parser.add_option_group(credopts) +subunitopts = SubunitOptions(parser) +parser.add_option_group(subunitopts) +opts, args = parser.parse_args() + +if len(args) < 1: + parser.print_usage() + sys.exit(1) + +host = args[0] + +lp = sambaopts.get_loadparm() +creds = credopts.get_credentials(lp) +creds.set_gensec_features(creds.get_gensec_features() | gensec.FEATURE_SEAL) + +# +# Tests start here +# + + +class SpeedTest(samba.tests.TestCase): + + def find_domain_sid(self, ldb): + res = ldb.search(base=self.base_dn, expression="(objectClass=*)", scope=SCOPE_BASE) + return ndr_unpack(security.dom_sid, res[0]["objectSid"][0]) + + def setUp(self): + super(SpeedTest, self).setUp() + self.ldb_admin = ldb + self.base_dn = ldb.domain_dn() + self.domain_sid = security.dom_sid(ldb.get_domain_sid()) + self.user_pass = "samba123@" + print("baseDN: %s" % self.base_dn) + + def create_user(self, user_dn): + ldif = """ +dn: """ + user_dn + """ +sAMAccountName: """ + user_dn.split(",")[0][3:] + """ +objectClass: user +unicodePwd:: """ + base64.b64encode(("\"%s\"" % self.user_pass).encode('utf-16-le')).decode('utf8') + """ +url: www.example.com +""" + self.ldb_admin.add_ldif(ldif) + + def create_group(self, group_dn, desc=None): + ldif = """ +dn: """ + group_dn + """ +objectClass: group +sAMAccountName: """ + group_dn.split(",")[0][3:] + """ +groupType: 4 +url: www.example.com +""" + self.ldb_admin.add_ldif(ldif) + + def create_bundle(self, count): + for i in range(count): + self.create_user("cn=speedtestuser%d,cn=Users,%s" % (i + 1, self.base_dn)) + + def remove_bundle(self, count): + for i in range(count): + delete_force(self.ldb_admin, "cn=speedtestuser%d,cn=Users,%s" % (i + 1, self.base_dn)) + + def remove_test_users(self): + res = ldb.search(base="cn=Users,%s" % self.base_dn, expression="(objectClass=user)", scope=SCOPE_SUBTREE) + dn_list = [item.dn for item in res if "speedtestuser" in str(item.dn)] + for dn in dn_list: + delete_force(self.ldb_admin, dn) + + +class SpeedTestAddDel(SpeedTest): + + def setUp(self): + super(SpeedTestAddDel, self).setUp() + + def run_bundle(self, num): + print("\n=== Test ADD/DEL %s user objects ===\n" % num) + avg_add = Decimal("0.0") + avg_del = Decimal("0.0") + for x in [1, 2, 3]: + start = time.time() + self.create_bundle(num) + res_add = Decimal(str(time.time() - start)) + avg_add += res_add + print(" Attempt %s ADD: %.3fs" % (x, float(res_add))) + # + start = time.time() + self.remove_bundle(num) + res_del = Decimal(str(time.time() - start)) + avg_del += res_del + print(" Attempt %s DEL: %.3fs" % (x, float(res_del))) + print("Average ADD: %.3fs" % float(Decimal(avg_add) / Decimal("3.0"))) + print("Average DEL: %.3fs" % float(Decimal(avg_del) / Decimal("3.0"))) + print("") + + def test_00000(self): + """ Remove possibly undeleted test users from previous test + """ + self.remove_test_users() + + def test_00010(self): + self.run_bundle(10) + + def test_00100(self): + self.run_bundle(100) + + def test_01000(self): + self.run_bundle(1000) + + def _test_10000(self): + """ This test should be enabled preferably against MS Active Directory. + It takes quite the time against Samba4 (1-2 days). + """ + self.run_bundle(10000) + + +class AclSearchSpeedTest(SpeedTest): + + def setUp(self): + super(AclSearchSpeedTest, self).setUp() + self.ldb_admin.newuser("acltestuser", "samba123@") + self.sd_utils = sd_utils.SDUtils(self.ldb_admin) + self.ldb_user = self.get_ldb_connection("acltestuser", "samba123@") + self.user_sid = self.sd_utils.get_object_sid(self.get_user_dn("acltestuser")) + + def tearDown(self): + super(AclSearchSpeedTest, self).tearDown() + delete_force(self.ldb_admin, self.get_user_dn("acltestuser")) + + def run_search_bundle(self, num, _ldb): + print("\n=== Creating %s user objects ===\n" % num) + self.create_bundle(num) + mod = "(A;;LC;;;%s)(D;;RP;;;%s)" % (str(self.user_sid), str(self.user_sid)) + for i in range(num): + self.sd_utils.dacl_add_ace("cn=speedtestuser%d,cn=Users,%s" % + (i + 1, self.base_dn), mod) + print("\n=== %s user objects created ===\n" % num) + print("\n=== Test search on %s user objects ===\n" % num) + avg_search = Decimal("0.0") + for x in [1, 2, 3]: + start = time.time() + res = _ldb.search(base=self.base_dn, expression="(objectClass=*)", scope=SCOPE_SUBTREE) + res_search = Decimal(str(time.time() - start)) + avg_search += res_search + print(" Attempt %s SEARCH: %.3fs" % (x, float(res_search))) + print("Average Search: %.3fs" % float(Decimal(avg_search) / Decimal("3.0"))) + self.remove_bundle(num) + + def get_user_dn(self, name): + return "CN=%s,CN=Users,%s" % (name, self.base_dn) + + def get_ldb_connection(self, target_username, target_password): + creds_tmp = Credentials() + creds_tmp.set_username(target_username) + creds_tmp.set_password(target_password) + creds_tmp.set_domain(creds.get_domain()) + creds_tmp.set_realm(creds.get_realm()) + creds_tmp.set_workstation(creds.get_workstation()) + creds_tmp.set_gensec_features(creds_tmp.get_gensec_features() + | gensec.FEATURE_SEAL) + ldb_target = SamDB(url=host, credentials=creds_tmp, lp=lp) + return ldb_target + + def test_search_01000(self): + self.run_search_bundle(1000, self.ldb_admin) + + def test_search2_01000(self): + # allow the user to see objects but not attributes, all attributes will be filtered out + mod = "(A;;LC;;;%s)(D;;RP;;;%s)" % (str(self.user_sid), str(self.user_sid)) + self.sd_utils.dacl_add_ace("CN=Users,%s" % self.base_dn, mod) + self.run_search_bundle(1000, self.ldb_user) + +# Important unit running information + + +if "://" not in host: + host = "ldap://%s" % host + +ldb_options = ["modules:paged_searches"] +ldb = SamDB(host, credentials=creds, session_info=system_session(), lp=lp, options=ldb_options) + +TestProgram(module=__name__, opts=subunitopts) diff --git a/source4/scripting/devel/tmpfs.sh b/source4/scripting/devel/tmpfs.sh new file mode 100755 index 0000000..e4798ec --- /dev/null +++ b/source4/scripting/devel/tmpfs.sh @@ -0,0 +1,16 @@ +#!/bin/bash + +# This sets up bin/ and st/ as tmpfs filesystems, which saves a lot of +# time waiting on the disk! + +sudo echo "About to (re)mount bin and st as tmpfs" +rm -rf bin st +sudo umount bin >/dev/null 2>&1 +sudo umount st >/dev/null 2>&1 +mkdir -p bin st || exit 1 +sudo mount -t tmpfs /dev/null bin || exit 1 +sudo chown $USER bin/. || exit 1 +echo "tmpfs setup for bin/" +sudo mount -t tmpfs /dev/null st || exit 1 +sudo chown $USER st/. || exit 1 +echo "tmpfs setup for st/" diff --git a/source4/scripting/devel/watch_servers.sh b/source4/scripting/devel/watch_servers.sh new file mode 100644 index 0000000..88d66a2 --- /dev/null +++ b/source4/scripting/devel/watch_servers.sh @@ -0,0 +1,14 @@ +#!/bin/sh + +[ $# -ge 3 ] || { + echo "Usage: watch_servers.sh DB1 DB2 PASSWORD SEARCH <attrs>" + exit 1 +} + +host1="$1" +host2="$2" +password="$3" +search="$4" +shift 4 + +watch -n1 "echo '$host1:'; bin/ldbsearch -S -H $host1 -Uadministrator%$password '$search' description $* | egrep -v '^ref|Ref|returned|entries|referrals' | uniq; echo; echo '$host2:'; bin/ldbsearch -S -H $host2 -Uadministrator%$password '$search' description $* | egrep -v '^ref|Ref|returned|entries|referrals' | uniq;" |