Current File : //lib/python3/dist-packages/samba/netcmd/fsmo.py
# Changes a FSMO role owner
#
# Copyright Nadezhda Ivanova 2009
# Copyright Jelmer Vernooij 2009
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
import samba
import samba.getopt as options
import ldb
from ldb import LdbError
from samba.dcerpc import drsuapi, misc
from samba.auth import system_session
import samba.drs_utils
from samba.netcmd import (
Command,
CommandError,
SuperCommand,
Option,
)
from samba.samdb import SamDB
def get_fsmo_roleowner(samdb, roledn, role):
"""Gets the owner of an FSMO role
:param roledn: The DN of the FSMO role
:param role: The FSMO role
"""
try:
res = samdb.search(roledn,
scope=ldb.SCOPE_BASE, attrs=["fSMORoleOwner"])
except LdbError as e7:
(num, msg) = e7.args
if num == ldb.ERR_NO_SUCH_OBJECT:
raise CommandError("The '%s' role is not present in this domain" % role)
raise
if 'fSMORoleOwner' in res[0]:
master_owner = (ldb.Dn(samdb, res[0]["fSMORoleOwner"][0].decode('utf8')))
else:
master_owner = None
return master_owner
def transfer_dns_role(outf, sambaopts, credopts, role, samdb):
"""Transfer dns FSMO role. """
if role == "domaindns":
domain_dn = samdb.domain_dn()
role_object = "CN=Infrastructure,DC=DomainDnsZones," + domain_dn
elif role == "forestdns":
forest_dn = samba.dn_from_dns_name(samdb.forest_dns_name())
role_object = "CN=Infrastructure,DC=ForestDnsZones," + forest_dn
new_host_dns_name = samdb.host_dns_name()
res = samdb.search(role_object,
attrs=["fSMORoleOwner"],
scope=ldb.SCOPE_BASE,
controls=["extended_dn:1:1"])
if 'fSMORoleOwner' in res[0]:
try:
master_guid = str(misc.GUID(ldb.Dn(samdb,
res[0]['fSMORoleOwner'][0].decode('utf8'))
.get_extended_component('GUID')))
master_owner = str(ldb.Dn(samdb, res[0]['fSMORoleOwner'][0].decode('utf8')))
except LdbError as e3:
(num, msg) = e3.args
raise CommandError("No GUID found in naming master DN %s : %s \n" %
(res[0]['fSMORoleOwner'][0], msg))
else:
outf.write("* The '%s' role does not have an FSMO roleowner\n" % role)
return False
if role == "domaindns":
master_dns_name = '%s._msdcs.%s' % (master_guid,
samdb.domain_dns_name())
new_dns_name = '%s._msdcs.%s' % (samdb.get_ntds_GUID(),
samdb.domain_dns_name())
elif role == "forestdns":
master_dns_name = '%s._msdcs.%s' % (master_guid,
samdb.forest_dns_name())
new_dns_name = '%s._msdcs.%s' % (samdb.get_ntds_GUID(),
samdb.forest_dns_name())
new_owner = samdb.get_dsServiceName()
if master_dns_name != new_dns_name:
lp = sambaopts.get_loadparm()
creds = credopts.get_credentials(lp, fallback_machine=True)
samdb = SamDB(url="ldap://%s" % (master_dns_name),
session_info=system_session(),
credentials=creds, lp=lp)
m = ldb.Message()
m.dn = ldb.Dn(samdb, role_object)
m["fSMORoleOwner_Del"] = ldb.MessageElement(master_owner,
ldb.FLAG_MOD_DELETE,
"fSMORoleOwner")
m["fSMORoleOwner_Add"] = ldb.MessageElement(new_owner,
ldb.FLAG_MOD_ADD,
"fSMORoleOwner")
try:
samdb.modify(m)
except LdbError as e5:
(num, msg) = e5.args
raise CommandError("Failed to add role '%s': %s" % (role, msg))
try:
connection = samba.drs_utils.drsuapi_connect(new_host_dns_name,
lp, creds)
except samba.drs_utils.drsException as e:
raise CommandError("Drsuapi Connect failed", e)
try:
drsuapi_connection = connection[0]
drsuapi_handle = connection[1]
req_options = drsuapi.DRSUAPI_DRS_WRIT_REP
NC = role_object[18:]
samba.drs_utils.sendDsReplicaSync(drsuapi_connection,
drsuapi_handle,
master_guid,
NC, req_options)
except samba.drs_utils.drsException as estr:
raise CommandError("Replication failed", estr)
outf.write("FSMO transfer of '%s' role successful\n" % role)
return True
else:
outf.write("This DC already has the '%s' FSMO role\n" % role)
return False
def transfer_role(outf, role, samdb):
"""Transfer standard FSMO role. """
domain_dn = samdb.domain_dn()
rid_dn = "CN=RID Manager$,CN=System," + domain_dn
naming_dn = "CN=Partitions,%s" % samdb.get_config_basedn()
infrastructure_dn = "CN=Infrastructure," + domain_dn
schema_dn = str(samdb.get_schema_basedn())
new_owner = ldb.Dn(samdb, samdb.get_dsServiceName())
m = ldb.Message()
m.dn = ldb.Dn(samdb, "")
if role == "rid":
master_owner = get_fsmo_roleowner(samdb, rid_dn, role)
m["becomeRidMaster"] = ldb.MessageElement(
"1", ldb.FLAG_MOD_REPLACE,
"becomeRidMaster")
elif role == "pdc":
master_owner = get_fsmo_roleowner(samdb, domain_dn, role)
res = samdb.search(domain_dn,
scope=ldb.SCOPE_BASE, attrs=["objectSid"])
assert len(res) == 1
sid = res[0]["objectSid"][0]
m["becomePdc"] = ldb.MessageElement(
sid, ldb.FLAG_MOD_REPLACE,
"becomePdc")
elif role == "naming":
master_owner = get_fsmo_roleowner(samdb, naming_dn, role)
m["becomeDomainMaster"] = ldb.MessageElement(
"1", ldb.FLAG_MOD_REPLACE,
"becomeDomainMaster")
elif role == "infrastructure":
master_owner = get_fsmo_roleowner(samdb, infrastructure_dn, role)
m["becomeInfrastructureMaster"] = ldb.MessageElement(
"1", ldb.FLAG_MOD_REPLACE,
"becomeInfrastructureMaster")
elif role == "schema":
master_owner = get_fsmo_roleowner(samdb, schema_dn, role)
m["becomeSchemaMaster"] = ldb.MessageElement(
"1", ldb.FLAG_MOD_REPLACE,
"becomeSchemaMaster")
else:
raise CommandError("Invalid FSMO role.")
if master_owner is None:
outf.write("Cannot transfer, no DC assigned to the %s role. Try 'seize' instead\n" % role)
return False
if master_owner != new_owner:
try:
samdb.modify(m)
except LdbError as e6:
(num, msg) = e6.args
raise CommandError("Transfer of '%s' role failed: %s" %
(role, msg))
outf.write("FSMO transfer of '%s' role successful\n" % role)
return True
else:
outf.write("This DC already has the '%s' FSMO role\n" % role)
return False
class cmd_fsmo_seize(Command):
"""Seize the role."""
synopsis = "%prog [options]"
takes_optiongroups = {
"sambaopts": options.SambaOptions,
"credopts": options.CredentialsOptions,
"versionopts": options.VersionOptions,
}
takes_options = [
Option("-H", "--URL", help="LDB URL for database or target server",
type=str, metavar="URL", dest="H"),
Option("--force",
help="Force seizing of role without attempting to transfer.",
action="store_true"),
Option("--role", type="choice", choices=["rid", "pdc", "infrastructure",
"schema", "naming", "domaindns", "forestdns", "all"],
help="""The FSMO role to seize or transfer.\n
rid=RidAllocationMasterRole\n
schema=SchemaMasterRole\n
pdc=PdcEmulationMasterRole\n
naming=DomainNamingMasterRole\n
infrastructure=InfrastructureMasterRole\n
domaindns=DomainDnsZonesMasterRole\n
forestdns=ForestDnsZonesMasterRole\n
all=all of the above\n
You must provide an Admin user and password."""),
]
takes_args = []
def seize_role(self, role, samdb, force):
"""Seize standard fsmo role. """
serviceName = samdb.get_dsServiceName()
domain_dn = samdb.domain_dn()
self.infrastructure_dn = "CN=Infrastructure," + domain_dn
self.naming_dn = "CN=Partitions,%s" % samdb.get_config_basedn()
self.schema_dn = str(samdb.get_schema_basedn())
self.rid_dn = "CN=RID Manager$,CN=System," + domain_dn
m = ldb.Message()
if role == "rid":
m.dn = ldb.Dn(samdb, self.rid_dn)
elif role == "pdc":
m.dn = ldb.Dn(samdb, domain_dn)
elif role == "naming":
m.dn = ldb.Dn(samdb, self.naming_dn)
elif role == "infrastructure":
m.dn = ldb.Dn(samdb, self.infrastructure_dn)
elif role == "schema":
m.dn = ldb.Dn(samdb, self.schema_dn)
else:
raise CommandError("Invalid FSMO role.")
# first try to transfer to avoid problem if the owner is still active
seize = False
master_owner = get_fsmo_roleowner(samdb, m.dn, role)
# if there is a different owner
if master_owner is not None:
# if there is a different owner
if master_owner != serviceName:
# if --force isn't given, attempt transfer
if force is None:
self.message("Attempting transfer...")
try:
transfer_role(self.outf, role, samdb)
except:
# transfer failed, use the big axe...
seize = True
self.message("Transfer unsuccessful, seizing...")
else:
self.message("Transfer successful, not seizing role")
return True
else:
self.outf.write("This DC already has the '%s' FSMO role\n" %
role)
return False
else:
seize = True
if force is not None or seize:
self.message("Seizing %s FSMO role..." % role)
m["fSMORoleOwner"] = ldb.MessageElement(
serviceName, ldb.FLAG_MOD_REPLACE,
"fSMORoleOwner")
samdb.transaction_start()
try:
samdb.modify(m)
if role == "rid":
# We may need to allocate the initial RID Set
samdb.create_own_rid_set()
except LdbError as e1:
(num, msg) = e1.args
if role == "rid" and num == ldb.ERR_ENTRY_ALREADY_EXISTS:
# Try again without the RID Set allocation
# (normal). We have to manage the transaction as
# we do not have nested transactions and creating
# a RID set touches multiple objects. :-(
samdb.transaction_cancel()
samdb.transaction_start()
try:
samdb.modify(m)
except LdbError as e:
(num, msg) = e.args
samdb.transaction_cancel()
raise CommandError("Failed to seize '%s' role: %s" %
(role, msg))
else:
samdb.transaction_cancel()
raise CommandError("Failed to seize '%s' role: %s" %
(role, msg))
samdb.transaction_commit()
self.outf.write("FSMO seize of '%s' role successful\n" % role)
return True
def seize_dns_role(self, role, samdb, credopts, sambaopts,
versionopts, force):
"""Seize DNS FSMO role. """
serviceName = samdb.get_dsServiceName()
domain_dn = samdb.domain_dn()
forest_dn = samba.dn_from_dns_name(samdb.forest_dns_name())
self.domaindns_dn = "CN=Infrastructure,DC=DomainDnsZones," + domain_dn
self.forestdns_dn = "CN=Infrastructure,DC=ForestDnsZones," + forest_dn
m = ldb.Message()
if role == "domaindns":
m.dn = ldb.Dn(samdb, self.domaindns_dn)
elif role == "forestdns":
m.dn = ldb.Dn(samdb, self.forestdns_dn)
else:
raise CommandError("Invalid FSMO role.")
# first try to transfer to avoid problem if the owner is still active
seize = False
master_owner = get_fsmo_roleowner(samdb, m.dn, role)
if master_owner is not None:
# if there is a different owner
if master_owner != serviceName:
# if --force isn't given, attempt transfer
if force is None:
self.message("Attempting transfer...")
try:
transfer_dns_role(self.outf, sambaopts, credopts, role,
samdb)
except:
# transfer failed, use the big axe...
seize = True
self.message("Transfer unsuccessful, seizing...")
else:
self.message("Transfer successful, not seizing role\n")
return True
else:
self.outf.write("This DC already has the '%s' FSMO role\n" %
role)
return False
else:
seize = True
if force is not None or seize:
self.message("Seizing %s FSMO role..." % role)
m["fSMORoleOwner"] = ldb.MessageElement(
serviceName, ldb.FLAG_MOD_REPLACE,
"fSMORoleOwner")
try:
samdb.modify(m)
except LdbError as e2:
(num, msg) = e2.args
raise CommandError("Failed to seize '%s' role: %s" %
(role, msg))
self.outf.write("FSMO seize of '%s' role successful\n" % role)
return True
def run(self, force=None, H=None, role=None,
credopts=None, sambaopts=None, versionopts=None):
lp = sambaopts.get_loadparm()
creds = credopts.get_credentials(lp, fallback_machine=True)
samdb = SamDB(url=H, session_info=system_session(),
credentials=creds, lp=lp)
if role == "all":
self.seize_role("rid", samdb, force)
self.seize_role("pdc", samdb, force)
self.seize_role("naming", samdb, force)
self.seize_role("infrastructure", samdb, force)
self.seize_role("schema", samdb, force)
self.seize_dns_role("domaindns", samdb, credopts, sambaopts,
versionopts, force)
self.seize_dns_role("forestdns", samdb, credopts, sambaopts,
versionopts, force)
else:
if role == "domaindns" or role == "forestdns":
self.seize_dns_role(role, samdb, credopts, sambaopts,
versionopts, force)
else:
self.seize_role(role, samdb, force)
class cmd_fsmo_show(Command):
"""Show the roles."""
synopsis = "%prog [options]"
takes_optiongroups = {
"sambaopts": options.SambaOptions,
"credopts": options.CredentialsOptions,
"versionopts": options.VersionOptions,
}
takes_options = [
Option("-H", "--URL", help="LDB URL for database or target server",
type=str, metavar="URL", dest="H"),
]
takes_args = []
def run(self, H=None, credopts=None, sambaopts=None, versionopts=None):
lp = sambaopts.get_loadparm()
creds = credopts.get_credentials(lp, fallback_machine=True)
samdb = SamDB(url=H, session_info=system_session(),
credentials=creds, lp=lp)
domain_dn = samdb.domain_dn()
forest_dn = samba.dn_from_dns_name(samdb.forest_dns_name())
infrastructure_dn = "CN=Infrastructure," + domain_dn
naming_dn = "CN=Partitions,%s" % samdb.get_config_basedn()
schema_dn = samdb.get_schema_basedn()
rid_dn = "CN=RID Manager$,CN=System," + domain_dn
domaindns_dn = "CN=Infrastructure,DC=DomainDnsZones," + domain_dn
forestdns_dn = "CN=Infrastructure,DC=ForestDnsZones," + forest_dn
masters = [(schema_dn, "schema", "SchemaMasterRole"),
(infrastructure_dn, "infrastructure", "InfrastructureMasterRole"),
(rid_dn, "rid", "RidAllocationMasterRole"),
(domain_dn, "pdc", "PdcEmulationMasterRole"),
(naming_dn, "naming", "DomainNamingMasterRole"),
(domaindns_dn, "domaindns", "DomainDnsZonesMasterRole"),
(forestdns_dn, "forestdns", "ForestDnsZonesMasterRole"),
]
for master in masters:
(dn, short_name, long_name) = master
try:
master = get_fsmo_roleowner(samdb, dn, short_name)
if master is not None:
self.message("%s owner: %s" % (long_name, str(master)))
else:
self.message("%s has no current owner" % (long_name))
except CommandError as e:
self.message("%s: * %s" % (long_name, e.message))
class cmd_fsmo_transfer(Command):
"""Transfer the role."""
synopsis = "%prog [options]"
takes_optiongroups = {
"sambaopts": options.SambaOptions,
"credopts": options.CredentialsOptions,
"versionopts": options.VersionOptions,
}
takes_options = [
Option("-H", "--URL", help="LDB URL for database or target server",
type=str, metavar="URL", dest="H"),
Option("--role", type="choice", choices=["rid", "pdc", "infrastructure",
"schema", "naming", "domaindns", "forestdns", "all"],
help="""The FSMO role to seize or transfer.\n
rid=RidAllocationMasterRole\n
schema=SchemaMasterRole\n
pdc=PdcEmulationMasterRole\n
naming=DomainNamingMasterRole\n
infrastructure=InfrastructureMasterRole\n
domaindns=DomainDnsZonesMasterRole\n
forestdns=ForestDnsZonesMasterRole\n
all=all of the above\n
You must provide an Admin user and password."""),
]
takes_args = []
def run(self, force=None, H=None, role=None,
credopts=None, sambaopts=None, versionopts=None):
lp = sambaopts.get_loadparm()
creds = credopts.get_credentials(lp, fallback_machine=True)
samdb = SamDB(url=H, session_info=system_session(),
credentials=creds, lp=lp)
if role == "all":
transfer_role(self.outf, "rid", samdb)
transfer_role(self.outf, "pdc", samdb)
transfer_role(self.outf, "naming", samdb)
transfer_role(self.outf, "infrastructure", samdb)
transfer_role(self.outf, "schema", samdb)
transfer_dns_role(self.outf, sambaopts, credopts,
"domaindns", samdb)
transfer_dns_role(self.outf, sambaopts, credopts, "forestdns",
samdb)
else:
if role == "domaindns" or role == "forestdns":
transfer_dns_role(self.outf, sambaopts, credopts, role, samdb)
else:
transfer_role(self.outf, role, samdb)
class cmd_fsmo(SuperCommand):
"""Flexible Single Master Operations (FSMO) roles management."""
subcommands = {}
subcommands["seize"] = cmd_fsmo_seize()
subcommands["show"] = cmd_fsmo_show()
subcommands["transfer"] = cmd_fsmo_transfer()
Mini Shell