Samba4-Pythonスクリプトインターフェイスの使用

 #!/usr/bin/env python # -*- coding: utf-8 -*- import sys import string import ldb from struct import unpack #from samba.idmap import IDmapDB from samba.samdb import SamDB from samba.auth import system_session from samba.ndr import ndr_unpack from samba.dcerpc import security import samba.param import base64 from conf import * def get_1out(cmd): # 1     import subprocess return subprocess.Popen(cmd, stdout=subprocess.PIPE).stdout.read().splitlines()[0] if not 'host' in globals(): host = get_1out('hostname').upper() if not 'smb3db' in globals(): smb3db = None my_log = lambda *x: None chgDc = lambda x: x def set_my_log(): #   -.   .   from datetime import datetime global my_log f_log = open(datetime.strftime(datetime.now(), "log_%y-%m-%d_%H:%M:%S.txt"),'w') def my_log(*x): try: xx = ' '.join(x) except: xx = ' '.join(map(lambda a: str(a),x)) f_log.write(xx+'\n') print xx def mk_chg(d0=d0,d1=d1): #  . d0,d1      . !!!: len(d0) >= len(d1) import re global chgDc if d0 == d1: return dif = len(d0)-len(d1)+1 #      , ddx = [d0[0],] + d0[dif:] #     ,  ddx == d0 #1  , 2   , 3 .. : myRe = [('',re.compile(r'\b(DC=)?%s\b[,.]?' % x, re.I)) for x in d0[1:dif]] +\ [(b,re.compile(r'\b%s\b' % a)) for (a,b) in zip(ddx,d1)] +\ [(b.upper(),re.compile(r'\b%s\b' % a.upper(), re.I)) for (a,b) in zip(ddx,d1)] def chg(s): #    d0 -> d1 for r in myRe: s = r[1].sub(r[0],s) return s chgDc = chg return chg def mk_sam0(smb_priv0=smb_priv0): #    . smb_priv0 - private directory   (    smb.conf!) import os global sam0 lp0 = samba.param.LoadParm() lp0.load(smb_priv0+'/smb.conf') # smb.conf     private directory!!! lp0.set('private directory',smb_priv0) sam0 = SamDB(lp=lp0,session_info=system_session()) os.unsetenv('SMB_CONF_PATH') return sam0 def mk_sam(host=host): #         global sam, ridSet, ridMan, sfu, idmap, minRid, nis lp = samba.param.LoadParm() lp.load(smb_conf) lp.set('private directory',smb_priv) sam = SamDB(lp=lp,session_info=system_session()) # idmap = IDmapDB(lp=lp) sfu = "CN=%s,CN=ypservers,CN=ypServ30,CN=RpcServices,CN=System,%s" % (dom,base) # dn  sfu (msSFU30OrderNumber...) ridSet = "CN=RID Set,CN=%s,OU=Domain Controllers,%s" % (host, base) # dn  rIDNextRID ridMan = "CN=RID Manager$,CN=System,"+base # dn  RID Manager if not 'minRid' in globals(): minRid = int(sam.search(base = ridSet, attrs=["rIDNextRID"])[0]["rIDNextRID"][0]) my_log('\tminRid=%s' % str(minRid)) if not 'nis' in globals(): nis = str(sam.search(base=sfu, attrs=['msSFU30Domains'])[0]['msSFU30Domains'][0]) sam.nis = nis return sam def get_map0(i=None, path=smb3db, maps = {}): #  sAMAccountName <-> UID   idmap smb3 -  maps if not maps: if path != None: from samba.samba3 import DbDatabase mapdb = DbDatabase(path+'/group_mapping') for x in mapdb.db.iterkeys(): if x.startswith('UNIXGROUP') : y = mapdb.db.get(x) maps[y[8:-2]] = ('GID',unpack('<L',y[0:4])[0]) mapdb.close() mapdb = DbDatabase(path+'/winbindd_idmap') for x in mapdb.db.iterkeys(): if x.startswith('S-1'): y = mapdb.db.get(x) res = sam0.search(base=base0,expression="(objectSid=%s)" % x.rstrip("\x00"), scope=ldb.SCOPE_SUBTREE, attrs=["sAMAccountName"]) if len(res) > 0 and 'sAMAccountName' in res[0]: maps[str(res[0]["sAMAccountName"][0])] = y.rstrip("\x00").split(" ") mapdb.close() else: #     idmap,       ID 'Domain Users' my_log('!? Not MAP0') maps['Domain Users'] = ['GID',start_unix_id] if 'sam' in globals(): res = sam.search(base=base,expression="(sAMAccountName=Domain Users)",attrs=['gidNumber']) if len(res) > 0 and 'gidNumber' in res[0]: maps['Domain Users'][1] = int(res[0]['gidNumber'][0]) maps['_users'] = maps['Domain Users'][1] # .    my_log('Set Domain Users = %d' % maps['_users']) maps['Administrator'] = ('UID',0) maps['Administrators'] = ('GID',0) if i == None: return maps return maps[i] if i in maps else False def mk_fill_matrix(m,r): # helper    m  cp_usr()  cp_grp() def rp(k,chg=0): #  chg!=0 -   ! if k in r: m[k] = str(r[k][0]) if chg==0 else chgDc(str(r[k][0])) return rp def mk_fill_ldb_msg(dn): # helper      ldb.Message m2 m2 = ldb.Message() m2.dn = ldb.Dn(sam, str(dn)) def rp(fld=None,val='',flg=ldb.FLAG_MOD_REPLACE): if fld: m2[fld] = ldb.MessageElement(str(val), flg, fld) return m2 return rp def usn_sort(res): #    res    -     (ou, grp) x = [r for r in res] x.sort(key = lambda r: int(r["uSNCreated"][0])) return x def rid_sort(res): #    res   RID x = [r for r in res] x.sort(key = lambda r: int(unpack('<I',r['objectSid'][0][-4:])[0])) return x def set_grp_gid(r,gid): # Unix GID   rp = mk_fill_ldb_msg(r.dn) rp("msSFU30NisDomain",nis) rp("msSFU30Name",r['sAMAccountName'][0]) rp("gidNumber",gid) sam.modify(rp()) def set_usr_gid_uid(r,uid): # Unix GID, UID   rp = mk_fill_ldb_msg(r.dn) rp("msSFU30NisDomain",nis) rp("uid",r['sAMAccountName'][0]) rp("uidNumber",uid) rp("gidNumber",get_map0('_users')) # rp('objectClass','posixAccount',ldb.FLAG_MOD_ADD) sam.modify(rp()) def map_grp(): #   GID  IdMap  Samba 3 res = sam.search(base=base,expression="(objectClass=group)") my_log( "\tmap_grp ALL GRP COUNT: %s" % len(res)) sam.transaction_start() try: for r in res: x = get_map0(str(r['sAMAccountName'][0])) if x: set_grp_gid(r,x[1]) except: sam.transaction_cancel() my_log( '!!! ERROR MAP GRP %s' % r['sAMAccountName']) else: sam.transaction_commit() def map_usr(): #   UID  IdMap  Samba 3 res = sam.search(base=base,expression="(&(objectCategory=person)(objectClass=user))",attrs=["sAMAccountName"]) my_log( "\tmap_usr ALL USR COUNT: %s" % len(res)) sam.transaction_start() try: for r in res: x = get_map0(str(r['sAMAccountName'][0])) if x: set_usr_gid_uid(r,x[1]) except: sam.transaction_cancel() my_log( '!!! ERROR SET SFU30 ATTR. USER %s !!!' % x[1]) else: sam.transaction_commit() def cp_ou(): #  organizationalUnit ous = [str(r.dn) for r in sam.search(base=base,expression="(objectClass=organizationalUnit)", attrs=[])] res = sam0.search(base=base0,expression="(objectClass=organizationalUnit)") my_log( "\tOU COUNT: %s" % len(res)) for r in usn_sort(res): dn = chgDc(str(r.dn)) if not dn in ous: m = {"dn": dn, "objectClass": "organizationalUnit", "name": str(r["name"][0])} try: sam.add(m) except: my_log("!!!Error Add OU : %s" % dn) def cp_usr(): #   users = [str(r.dn) for r in sam.search(base=base,expression="(&(objectCategory=person)(objectClass=user))", attrs=[])] res = sam0.search(base=base0,expression="(&(objectCategory=person)(objectClass=user))", attrs=['*','unicodePwd']) my_log( "\tNEW USR COUNT: %s" % len(res)) for r in res: dn = chgDc(str(r.dn)) if dn in users: continue sd = ndr_unpack(security.dom_sid,r['objectSid'][0]) (group_dom_sid, rid) = sd.split() if rid <= minRid: my_log( '!! MinRid ERR : ', r['sAMAccountName'][0] ) continue m = {"dn": dn, "objectClass": "user"} rp = mk_fill_matrix(m,r) rp('userPrincipalName',1) rp('sAMAccountName') rp('sn') rp('name') rp('initials') rp('displayName') rp('scriptPath') rp('description') rp('userAccountControl') rp('pwdLastSet') m["nTSecurityDescriptor"] = r['objectSid'] if 'maildom' in globals(): m["mail"] = "%s@%s" % (r['sAMAccountName'][0], maildom) if 'homeDirectory' in globals(): m["homeDirectory"] = r"%s\%s" % (homeDirectory,r['sAMAccountName'][0]) if 'homeDrive' in globals(): m["homeDrive"] = homeDrive sam.transaction_start() try: sam.add(m) except: sam.transaction_cancel() my_log( '!!! ERROR ADD USER : %s' % m['sAMAccountName']) else: sam.transaction_commit() # Copy the password for it if not 'unicodePwd' in r: my_log( '!!! NOT PASSWD FOR USER : %s' % m['sAMAccountName']) continue setpw = """ dn: %s changetype: modify replace: unicodePwd unicodePwd:: %s """ % (dn, base64.b64encode(str(r['unicodePwd']))) sam.transaction_start() try: sam.modify_ldif(setpw,["local_oid:1.3.6.1.4.1.7165.4.3.12:0"]) except: sam.transaction_cancel() my_log( '!!! ERROR SET PASSWORD USER : %s' % m['sAMAccountName']) else: sam.transaction_commit() def cp_grp(): #   grps = [str(r.dn) for r in sam.search(base=base,expression="(objectClass=group)", attrs=[])] res = sam0.search(base=base0,expression="(&(objectClass=group)(objectCategory=Group))") my_log( "\tNEW GRP COUNT: %s" % len(res)) for r in usn_sort(res): dn = chgDc(str(r.dn)) if dn in grps: continue sd = ndr_unpack(security.dom_sid,r['objectSid'][0]) (group_dom_sid, rid) = sd.split() if rid <= minRid: my_log( '!! MinRid ERR : ', r['name'][0] ) continue m = {"dn": dn, "objectClass": "group"} rp = mk_fill_matrix(m,r) rp('sAMAccountName') rp('groupType') rp('description') m["nTSecurityDescriptor"] = r['objectSid'] sam.transaction_start() try: sam.add(m) except: sam.transaction_cancel() my_log( '!!! ERROR add GRP %s !!!' % m['sAMAccountName']) else: sam.transaction_commit() def grp_fill(): #   my_log( "\tgrp_fill") grps ={} for r in sam.search(base=base,expression="(&(objectClass=group)(objectCategory=Group))",attrs=['member']): grps[str(r.dn)] = r['member'] if 'member' in r else [] users = [str(r.dn) for r in sam.search(base=base,expression="(&(objectCategory=person)(objectClass=user))", attrs=[])] for r in sam0.search(base=base0,expression="(&(objectClass=group)(objectCategory=Group))",attrs=['member']): if not 'member' in r: continue grp = chgDc(str(r.dn)) if not grps.has_key(grp): my_log( "!!not found group:\t",grp) continue add_m = '' for m in r['member']: m = chgDc(m) if m in grps[grp]: continue if not m in users: try: sam.search(base=m, attrs=[]) except: my_log( "!? err (not found) add %s \tto %s" % (m,grp)) continue add_m += "add: member\nmember: %s\n" % (m) if add_m == '': continue add_m = "\ndn: %s\nchangetype: modify\n%s\n" % (grp,add_m) sam.transaction_start() try: sam.modify_ldif(add_m) except: sam.transaction_cancel() my_log( "!!!Error fill grp "+grp) else: sam.transaction_commit() def set_max_gid_uid(max_gid=start_unix_id, max_uid=start_unix_id): #  max GID, UID   my_log('set_max_gid_uid start: set max_gid=%s, max_uid=%s' % (max_gid, max_uid)) chg = '' r = sam.search(base=sfu)[0] for x in (['msSFU30MaxGidNumber',max_gid],['msSFU30MaxUidNumber',max_uid]): x[1] = max(x[1],start_unix_id) if not x[0] in r or x[1] > int(r[x[0]][0]): chg += "replace: %s\n%s: %d\n" % (x[0],x[0],x[1]) if chg != '': chg = "\ndn: %s\nchangetype: modify\n%s\n" % (sfu,chg) sam.transaction_start() try: sam.modify_ldif(chg) except: sam.transaction_cancel() my_log( "!!!Error set msSFU30Max...") else: sam.transaction_commit() def get_next_uid(): #   UID   nm = 'msSFU30MaxUidNumber' r = sam.search(base=sfu)[0] x = start_unix_id if nm in r: x = max(x, int(r[nm][0])) sam.transaction_start() try: sam.modify_ldif("\ndn: %s\nchangetype: modify\nreplace: %s\n%s: %d\n" % (sfu,nm,nm,x+1)) except: sam.transaction_cancel() my_log( "!!!Error set msSFU30Max...") raise else: sam.transaction_commit() return x def set_max_id(): # max GID, UID,   ,   +1 max_gid = max([int(r['gidNumber'][0]) for r in sam.search(base=base,expression="(&(objectClass=group)(gidNumber=*))",attrs=['gidNumber'])]+[0]) max_uid = max([int(r['uidNumber'][0]) for r in sam.search(base=base,expression="(&(objectCategory=person)(objectClass=user)(uidNumber=*))",attrs=['uidNumber'])]+[0]) set_max_gid_uid(max_gid=max_gid+1,max_uid=max_uid+1) def check_id(): # . GID, UID   r = sam.search(base=sfu)[0] (max_gid,max_uid) = [int(r[x][0]) if x in r else start_unix_id for x in ('msSFU30MaxGidNumber','msSFU30MaxUidNumber')] my_log('check_id start: initial max_gid=%d, max_uid=%d' % (max_gid, max_uid)) sam.transaction_start() try: for r in rid_sort(sam.search(base=base,expression="(&(objectClass=group)(!(gidNumber=*)))",attrs=['sAMAccountName','objectSid'])): set_grp_gid(r,max_gid) max_gid += 1 for r in usn_sort(sam.search(base=base,expression="(&(objectCategory=person)(objectClass=user)(!(uidNumber=*)))",attrs=['sAMAccountName','uSNCreated'])): set_usr_gid_uid(r,max_uid) max_uid += 1 except: sam.transaction_cancel() my_log( '!!! ERROR check_id %s' % r['sAMAccountName']) else: sam.transaction_commit() set_max_gid_uid(max_gid=max_gid,max_uid=max_uid) def set_max_rid(): # max RID  ,   "RID Set"  "RID Manager" res = sam.search(base=base,expression="(&(sAMAccountName=*)(objectSid=*))",attrs=["objectSid"]) my_log( "\tSID COUNT: %s" % len(res)) x = max([int(unpack('<I',r['objectSid'][0][-4:])[0]) for r in res]) rmin = (x-100)/500*500+100 pool = rmin + ((rmin + 499) << 32) my_log("\tRid Set: %d %d %d " % (rmin,x,rmin + 499)) m = mk_fill_ldb_msg(ridSet) m('rIDNextRID',x) m('rIDAllocationPool',pool) m('rIDPreviousAllocationPool',pool) m2 = mk_fill_ldb_msg(ridMan) m2('rIDAvailablePool',rmin + 500 + (1073741823 << 32)) sam.transaction_start() try: sam.modify(m()) sam.modify(m2()) except: sam.transaction_cancel() my_log( '!!! ERROR Set rIDNextRID %s' % x) else: sam.transaction_commit() return x def mk_dom(): #     samba 4   SID,       administrator = "1" !!! from samba.netcmd.main import cmd_sambatool def cmd(args, subcom='domain'): cmd = cmd_sambatool() try: retval = cmd._run("samba-tool", subcom, *args) except SystemExit, e: retval = e.code except Exception, e: cmd.show_command_error(e) retval = 1 if retval: sys.exit(retval) cmd(('provision', '--host-name=%s' % host, '--realm=%s' % realm, '--domain=%s' % dom, '--domain-sid=%s' % get_1out('./get_dom_sid.py'), '--adminpass=UJHkjhm7KH$$2vrXy', '--function-level=2003', '--server-role=dc', '--use-rfc2307', '--dns-backend=SAMBA_INTERNAL')) cmd(('passwordsettings', 'set', '--complexity=off', '--history-length=0', '--min-pwd-length=0', '--min-pwd-age=0', '--max-pwd-age=0')) cmd(('setpassword', 'administrator', '--newpassword=1'),subcom='user') #    1.     !! 

 #!/usr/bin/env python from lib1 import mk_sam0 print mk_sam0().domain_sid 

 samba-tool domain exportkeytab /etc/krb5.sssd.keytab --principal=<myHostName>$ chown root:root /etc/krb5.sssd.keytab chmod 600 /etc/krb5.sssd.keytab 

 [sssd] services = nss, pam config_file_version = 2 domains = newdom.lan [nss] [pam] [domain/newdom.lan] id_provider = ad auth_provider = ad ldap_schema = ad krb5_keytab = /etc/krb5.sssd.keytab access_provider = ad ldap_id_mapping=false enumerate = true 

 sss_cache -GU 

 restart sssd