a
    í(a‡  ã                   @   s:  d Z dZddlZddlZddlZddlmZmZ ddlm	Z	 ddl
mZmZmZ ddlmZ ddlmZ dd	lmZ dd
lmZmZmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z  dd„ Z!d)dd„Z"dd„ Z#dd„ Z$dd„ Z%dd„ Z&dd„ Z'dd „ Z(d!ej)iZ*d"d#„ Z+d$d%„ Z,d*d'd(„Z-dS )+z3Support code for upgrading from Samba 3 to Samba 4.ZrestructuredTexté    N)ÚLdbÚregistry)ÚLoadParm)Ú	provisionÚProvisioningErrorÚsetsysvolacl)Ú	FILL_FULL)Úpassdb)Úparam)ÚlsaÚsamrÚsecurity)Údom_sid)ÚCredentials)Údsdb)Úndr_pack)Úunix2nttime)Úgenerate_random_passwordc              
   C   sf  t  ¡ }|  ¡ |_d|v r6t  t|d ƒt jd¡|d< d|v rZt  t|d ƒt jd¡|d< d|v r|d }t| d ƒ}t  t|ƒt jd	¡|d
< d|v rä|d }|dks¸|dks¸|dkr¾d}nt| d ƒ}t  t|ƒt jd¡|d< d|v r|d }t|d ƒ}	t  t|	ƒt jd¡|d< z|  	|¡ W n8 t j
y` }
 z| dt|
ƒ¡ W Y d}
~
n
d}
~
0 0 dS )zŽImport a Samba 3 policy.

    :param samdb: Samba4 SAM database
    :param policy: Samba3 account policy
    :param logger: Logger object
    zmin password lengthZminPwdLengthÚa01zpassword historyZpwdHistoryLengthZa02zminimum password ageg    ÐcAZ	minPwdAgeZa03zmaximum password ageéÿÿÿÿr   l   ÿÿ lûÿÿÿ         Z	maxPwdAgeZa04zlockout durationé<   ZlockoutDurationZa05z"Could not set account policy, (%s)N)ÚldbÚMessageÚget_default_basednÚdnÚMessageElementÚstrÚFLAG_MOD_REPLACEÚintr   ÚmodifyÚLdbErrorÚwarn)ÚsamdbÚpolicyÚloggerÚmZmin_pw_age_unixZmin_pw_age_ntZmax_pw_age_unixZmax_pw_age_ntZlockout_duration_minsZlockout_duration_ntÚe© r'   ú//usr/lib/python3/dist-packages/samba/upgrade.pyÚimport_sam_policy*   sD    
ÿÿÿÿ

ÿr)   c	              
   C   sÖ   z”t  ¡ }	t  |dt|ƒ ¡|	_|dkrpt  t|ƒt jd¡|	d< t  t|ƒt jd¡|	d< t  t|ƒt jd¡|	d< t  t|ƒt jd¡|	d< | |	¡ W n< t jyÐ }
 z"|  	dt|ƒt|
ƒ¡ W Y d}
~
n
d}
~
0 0 dS )	aw  Add posix attributes for the user/group

    :param samdb: Samba4 sam.ldb database
    :param sid: user/group sid
    :param sid: user/group name
    :param nisdomain: name of the (fake) NIS domain
    :param xid_type: type of id (ID_TYPE_UID/ID_TYPE_GID)
    :param home: user homedir (Unix homepath)
    :param shell: user shell
    :param pgid: users primary group id
    ú<SID=%s>ÚID_TYPE_UIDZunixHomeDirectoryÚ
loginShellÚ	gidNumberZmsSFU30NisDomainz7Could not add posix attrs for AD entry for sid=%s, (%s)N)
r   r   ÚDnr   r   r   r   r   r    r!   )r$   r"   ÚsidÚnameÚ	nisdomainÚxid_typeÚhomeÚshellÚpgidr%   r&   r'   r'   r(   Úadd_posix_attrsb   s,    ÿÿÿÿþr6   c                 C   sà   z–t  ¡ }t  | dt|ƒ ¡|_|dkrVt  t|ƒt jd¡|d< t  dt jd¡|d< n4|dkrŠt  t|ƒt jd¡|d< t  dt jd¡|d< |  |¡ W nD t j	yÚ } z*| 
d	t|ƒt|ƒ|t|ƒ¡ W Y d
}~n
d
}~0 0 d
S )zÚCreate idmap entry

    :param samdb: Samba4 sam.ldb database
    :param sid: user/group sid
    :param xid: user/group id
    :param xid_type: type of id (ID_TYPE_UID/ID_TYPE_GID)
    :param logger: Logger object
    r*   r+   Z	uidNumberZposixAccountÚobjectClassÚID_TYPE_GIDr-   Z
posixGroupz?Could not modify AD idmap entry for sid=%s, id=%s, type=%s (%s)N)r   r   r.   r   r   r   r   ÚFLAG_MOD_ADDr   r    r!   )r"   r/   Úxidr2   r$   r%   r&   r'   r'   r(   Úadd_ad_posix_idmap_entry…   s.    
ÿÿ
ÿÿþr;   c           	      C   s>  d}| j dt|ƒ d}|jdkr&d}|rÂzPt ¡ }|d d |_t t|ƒtjd¡|d< t |tjd	¡|d	< |  |¡ W nD tj	y¾ } z*| 
d
t|ƒt|ƒ|t|ƒ¡ W Y d}~n
d}~0 0 nxz0|  dt|ƒ t|ƒdt|ƒ|t|ƒdœ¡ W nF tj	y8 } z*| 
dt|ƒt|ƒ|t|ƒ¡ W Y d}~n
d}~0 0 dS )zÚCreate idmap entry

    :param idmapdb: Samba4 IDMAP database
    :param sid: user/group sid
    :param xid: user/group id
    :param xid_type: type of id (ID_TYPE_UID/ID_TYPE_GID)
    :param logger: Logger object
    FzobjectSid=%s)Ú
expressioné   Tr   r   Ú	xidNumberÚtypez<Could not modify idmap entry for sid=%s, id=%s, type=%s (%s)NzCN=%sZsidMap)r   Úcnr7   Ú	objectSidr?   r>   z9Could not add idmap entry for sid=%s, id=%s, type=%s (%s))Úsearchr   Úcountr   r   r   r   r   r   r    r!   Úaddr   )	Úidmapdbr/   r:   r2   r$   ÚfoundÚmsgr%   r&   r'   r'   r(   Úadd_idmap_entry¤   sB    
ÿÿþûþrH   c              
   C   s
  z|  ¡ }W n6 tyB } z| dt|ƒ¡ W Y d}~dS d}~0 0 t| ¡ | ¡ ƒ}|}t ¡ }t 	| d¡|_
t t|ƒtjd¡|d< t t|ƒtjd¡|d< |  |¡ | ¡ D ]R\}}	|dkrÈd}
n|d	krÖd
}
n| d|¡ q²| |	|¡}t| t|ƒ|	|
|ƒ q²dS )z¡Import idmap data.

    :param idmapdb: Samba4 IDMAP database
    :param samba3_idmap: Samba3 IDMAP database to import from
    :param logger: Logger object
    z(Cannot open idmap database, Ignoring: %sNz	CN=CONFIGZ
lowerBoundÚ
lowerboundr>   ZUIDr+   ZGIDr8   z+Wrong type of entry in idmap (%s), Ignoring)Zget_idmap_dbÚIOErrorr!   r   ÚmaxZget_user_hwmZget_group_hwmr   r   r.   r   r   r   r   ZidsZget_sidrH   r   )rE   Úsamba3r$   Zsamba3_idmapr&   Z
currentxidrI   r%   Zid_typer:   r2   r/   r'   r'   r(   Úimport_idmapÏ   s2    ÿÿ
rM   c              
   C   sð  z"| j dt|jƒ tjd}d}W nL tjyn } z2|j\}}|tjkrNd}nt ||¡‚W Y d}~n
d}~0 0 |rœ| dt|jƒ|j	|d d d ¡ nP|j
tjkrÊ|j ¡ \}}	|t tj¡krÊdS t ¡ }
t | d	¡|
_|
j dd
|j	¡ |
j |  ¡ ¡ t dtjd¡|
d< t t|jƒtjd¡|
d< t |j	tjd¡|
d< |jrdt |jtjd¡|
d< |j
tjks€|j
tjkršt ttjƒtjd¡|
d< z| j|
dgd W n< tjyê } z | d|j	t|ƒ¡ W Y d}~n
d}~0 0 dS )zšAdd or modify group from group mapping entry

    param samdb: Samba4 SAM database
    param groupmap: Groupmap entry
    param logger: Logger object
    r*   )ÚbaseÚscopeTFNzJGroup already exists sid=%s, groupname=%s existing_groupname=%s, Ignoring.r   ZsAMAccountNamezCN=X,CN=UsersZCNÚgroupr7   rA   ZdescriptionZ	groupTypezrelax:0)Zcontrolsz Could not add group name=%s (%s))rB   r   r/   r   Z
SCOPE_BASEr    ÚargsÚERR_NO_SUCH_OBJECTr!   Únt_nameÚsid_name_user   ÚSID_NAME_WKN_GRPÚsplitr   r   ÚSID_BUILTINr   r.   r   Zset_componentZadd_baser   r   r9   r   ZcommentÚSID_NAME_ALIASr   Z!GTYPE_SECURITY_DOMAIN_LOCAL_GROUPrD   )r"   Zgroupmapr$   rG   rF   Ze1ÚecodeÚemsgÚgroup_dom_sidÚridr%   r&   r'   r'   r(   Úadd_group_from_mapping_entryö   sR    	ÿ

"ÿÿÿÿÿr]   c           	      C   sÜ   |D ]Ò}t  ¡ }t  | dt|jƒ ¡|_t  dt|ƒ t jd¡|d< z|  |¡ W q t j	yÔ } zh|j
\}}|t jkrŒ| d||j|¡ n4|t jkr¬td||j|f ƒ‚ntd||j|f ƒ‚W Y d}~qd}~0 0 qdS )z±Add user/member to group/alias

    param samdb: Samba4 SAM database
    param group: Groupmap object
    param members: List of member SIDs
    param logger: Logger object
    r*   Úmemberr   z/skipped re-adding member '%s' to group '%s': %szXCould not add member '%s' to group '%s' as either group or user record doesn't exist: %sz+Could not add member '%s' to group '%s': %sN)r   r   r.   r   r/   r   r   r9   r   r    rQ   ZERR_ENTRY_ALREADY_EXISTSÚdebugrR   r   )	r"   rP   Úmembersr$   Z
member_sidr%   r&   rY   rZ   r'   r'   r(   Úadd_users_to_group.  s    


ra   c                 C   s  d}|  ¡ D ]ì\}\}}}|d7 }t| dd¡d dƒ}|dkrFd}n6|d@ rft|ƒdkr`d}q|d}nt|ƒdkrxd}nd}|t ¡ krŽd}	nd}	|d	@ d
? }
|  dt| d¡ƒ | d¡d | d¡d dt|ƒt|	ƒt|
ƒt 	|¡dt|ƒ|dœ¡ q|  dddt|ƒdœ¡ dS )zžImport settings from a Samba3 WINS database.

    :param samba4_winsdb: WINS database to import to
    :param samba3_winsdb: WINS database to import from
    r   r=   ú#é   é   é   é€   é   é`   é   zname=%s,type=0x%sZ
winsRecordÚ0)r   r?   r0   r7   Z
recordTypeZrecordStateZnodeTypeZ
expireTimeZisStaticZ	versionIDZaddressz
cn=VERSIONZVERSIONZwinsMaxVersion)r   r@   r7   Z
maxVersionN)
Úitemsr   rV   ÚlenÚtimerD   Útupler   r   Z
timestring)Zsamba4_winsdbÚsamba3_winsdbZ
version_idr0   ZttlZipsZnb_flagsr?   ZrTypeZrStateZnTyper'   r'   r(   Úimport_winsG  sD    ö
ýrp   ZHKLMc           	         sh   ‡ fdd„}|  ¡ D ]N}||ƒ}| |¡D ]}||ƒ q*| |¡ ¡ D ]\}\}}| |||¡ qFqdS )z³Import a Samba 3 registry database into the Samba 4 registry.

    :param samba4_registry: Samba 4 registry handle.
    :param samba3_regdb: Samba 3 registry database handle.
    c                    s0   |   dd¡\}} t| }|  dd¡} ˆ  || ¡S )Nú/r=   ú\)rV   ÚSAMBA3_PREDEF_NAMESÚreplaceZ
create_key)ZkeypathZpredef_nameZ	predef_id©Úsamba4_registryr'   r(   Úensure_key_exists†  s    z*import_registry.<locals>.ensure_key_existsN)ÚkeysZsubkeysÚvaluesrk   Z	set_value)	rv   Zsamba3_regdbrw   ÚkeyZ
key_handleZsubkeyZ
value_nameZ
value_typeZ
value_datar'   ru   r(   Úimport_registry€  s    
r{   c              
   C   sˆ   z|j |tjd| |gd}W n8 tjyV } ztd|||f ƒ‚W Y d}~n6d}~0 0 |jdkrr|d | d S |  d||¡ t‚dS )zúGet posix attributes from a samba3 ldap backend
    :param ldbs: a list of ldb connection objects
    :param base_dn: the base_dn of the connection
    :param user: the user to get the attribute for
    :param attr: the attribute to be retrieved
    z%(&(objectClass=posixAccount)(uid=%s)))rO   r<   Úattrsz=Failed to retrieve attribute %s for user %s, the error is: %sNr=   r   z0LDAP entry for user %s contains more than one %s)rB   r   ZSCOPE_SUBTREEr    r   rC   ÚwarningÚKeyError)r$   Ú
ldb_objectÚbase_dnÚuserÚattrrG   r&   r'   r'   r(   Ú get_posix_attr_from_ldap_backend”  s    
ÿþ
(
rƒ   Fc           =         sN  | j  ¡ }| j  d¡}| j  d¡}	| j  d¡}
| j  d¡du rL| j  dd¡ z|  ¡ }W n> ty– } z&td|  d¡t|ƒf ƒ‚W Y d}~n
d}~0 0 |s´| 	¡ d	 }| 
d
|¡ |	sæ|dksÈ|dkrÒtdƒ‚n| ¡ }	| 
d|	¡ d}z| |
¡}W n ty   d}Y n0 | j  d¡ d¡d	  ¡ dkr|| j  d¡}| j  d¡}| |¡}|du rftdƒ‚| d¡ d¡}d}nd}d}d}| ¡  t | j  d¡¡ |  ¡ }zt ¡ ‰ W n" tjyØ   td| ƒ‚Y n0 z| d|
 ¡}W n tjy
   d}d}Y n0 |j ¡ \}}| d¡ | ¡ }| d¡ | ¡ }i }|D ]ì}|j ¡ \}}|ˆ krv||krv|d }|jt j!kròz| "|j¡}||t|jƒ< W nJ tjyì } z.| #d |j$|j|¡ W Y d}~qFW Y d}~n
d}~0 0 qF|jt j%krlz| &|j¡}||t|jƒ< W nJ tjyh } z.| #d |j$|j|¡ W Y d}~qFW Y d}~n
d}~0 0 nÆ|jt j'kr|j ¡ \}}|t( )t(j*¡kr¬| #d!|j$¡ qFz| "|j¡}||t|jƒ< W nJ tjy } z.| #d |j$|j|¡ W Y d}~qFW Y d}~n
d}~0 0 n| #d"|j$|j|j¡ qFqF| d#¡ | +d	¡}i } i }!d}"|D ].}#|rx||#d$ krxqZ|#d% }$|#d$ dk r¤| d&|#d$ |$¡ qZ|#d$ |kr¾|#d$ d }| |$¡}%|%j,t-j.t-j/B t-j0B t-j1B @ }&|&t-j0kr"| #d'|$dd(…  ¡ |%j,t-j0 @ t-j/B |%_,n<|&t-j1krL| #d)|$dd(…  ¡ qZn|&t-j/krz|$d( d*krz| #d+|$ ¡ qZnä|&t-j.t-j/B krº|$d( d*krº| #d,|$ ¡ |%j,t-j. @ |%_,n¤|&t-j.t-j0B krú|$d( d*krú| #d-|$ ¡ |%j,t-j. @ |%_,nd|&d	kr"|$d( d*kr"|%j,t-j.B |%_,n<|&t-j.ks^|&t-j/kr<n"td.|$|%j,t-j.t-j/t-j0t-j1f ƒ‚|%| |$< z| 2|%j¡d	 |!|$< W n@ tjy¾   zt3 4|$¡j5|!|$< W n ty¸   Y n0 Y n0 |"sØ|$ 6¡ d/krØ|$}"|$ 6¡ d0krê|$}"zb| 7|%¡}'|'D ]N}t|ƒ|v r6|%j|t|ƒ vrF|t|ƒ  8|%j¡ n|%jg|t|ƒ< qúW n: tjy† } z| #d1|$|%j|¡ W Y d}~n
d}~0 0 qZ| d2|¡ td3d4„ |D ƒƒ}(td5d4„ |D ƒƒ})|( 9|)¡}*|*rø| d6¡ |*D ]}+| d7|+ ¡ qÚtd8ƒ‚td9d4„ |D ƒƒ},t:|ƒt:|,ƒkr$td:ƒ‚t‡ fd;d4„|D ƒƒ}-t:|ƒt:|-ƒkrTtd<ƒ‚|, 9|-¡}.|.r”| d=¡ |.D ]}| d7t|ƒ ¡ qrtd>ƒ‚i }/i }0i }1|	rJt;ƒ }2|2 <| j ¡ |2 =|¡ |2 >|¡ | j  d¡ dd¡d  d?¡}3|3 ¡ D ]V}4zt?|4|2d@}5W n8 t@jA	y> } ztdA|4|f ƒ‚W Y d}~nd}~0 0  	qJqò| dB¡ | +d	¡}|D ]$}#|#d% }$|$|! B¡ v 	rbz0|	rœtC||5||$dCƒ|/|$< nt3 4|$¡jD|/|$< W n& t	yÂ   Y n tE	yÔ   Y n0 z0|	rôtC||5||$dDƒ|0|$< nt3 4|$¡jF|0|$< W n& t
y   Y n tE
y,   Y n0 z0|
rLtC||5||$dEƒ|1|$< nt3 4|$¡jG|1|$< W n& t
yr   Y n tE
y„   Y n0 	qb| dF¡ d}6z|  H¡ }6W n6 t
yÚ } z| #dGt|ƒ¡ W Y d}~n
d}~0 0 |dk
sô|dk
sôdH}|"rtIdIdJƒ}7nd}7tJ||||	|ˆ |||7tKjL|
 6¡ ||tM||d|ddK}8|8 N|¡ | dL¡ |6rjtOt?|8jPjQƒ|6ƒ | dM¡ tR|8jS||ƒ | dN¡ tT|8jU| |ƒ tV W¡ }9|9 X|8j jY¡ |9 d|8j  d¡¡ |9 dO|8j  dO¡¡ |9 dP|8j  dP¡¡ t Z|9 d¡¡}:|8jS [¡  | dQ¡ zh| dR¡ |D ]T};|;j\d(kr t]|8jS|;|ƒ t^|8jS|;j|;j\dS|ƒ t_|8jS|;j|;j$| 6¡ dS|dT q W n   |8jS `¡  ‚ Y n0 | dU¡ |8jS a¡  | dV¡ | dW¡ | D ]J}$|$ 6¡ d0kr| |$ jt)tˆ ƒdX ƒkr| dY| |$ jt)tˆ ƒdX ƒf ¡ tdZƒ‚|$ 6¡ d/krZ| |$ jt)tˆ ƒdX ƒkrP| #d[¡ n
| #d\¡ |: b| |$ ¡ |$|!v r¾t^|8jS| |$ j|!|$ d]|ƒ |$|/v r¾|/|$ dur¾|$|0v r¾|0|$ dur¾|$|1v r¾|1|$ dur¾t_|8jS| |$ j|$| 6¡ d]|/|$ |0|$ |1|$ |d^	 q¾| d_¡ |8jS [¡  z:|D ]0};t|;jƒ|v r&tc|8jS|;|t|;jƒ |ƒ q&W n   |8jS `¡  ‚ Y n0 | d`¡ |8jS a¡  |"r | da¡ |: d0¡}<| |" jd|<_d| |" jerÆ| |" je|<_e| |" jf|<_f| |" jgrê| |" jg|<_g|: h|<¡ | db|"¡ |8jdckrJti|8jS|8jPjj|8jPjk|8jPjl|8jPjmt( )|8jn¡|8jojp|8jojq|8j |ƒ
 dS )dz×Upgrade from samba3 database to samba4 AD database

    :param samba3: samba3 object
    :param logger: Logger object
    :param targetdir: samba4 database directory
    :param session_info: Session information
    Z	workgroupÚrealmznetbios namezldapsam:trustedNZyesz‚Could not open '%s', the Samba3 secrets database: %s.  Perhaps you specified the incorrect smb.conf, --testparm or --dbdir option?zsecrets.tdbr   z6No workgroup specified in smb.conf file, assuming '%s'ZROLE_DOMAIN_BDCZROLE_DOMAIN_PDCzéNo realm specified in smb.conf file and being a DC. That upgrade path doesn't work! Please add a 'realm' directive to your old smb.conf to let us know which one you want to use (it is the DNS name of the AD domain you wish to create.z2No realm specified in smb.conf file, assuming '%s'iè  zpassdb backendú:Zldapsamzldap suffixzldap admin dnz¬ldapsam passdb backend detected but no LDAP Bind PW found in secrets.tdb for user %s.  Please point this tool at the secrets.tdb that was used by the previous installation.zutf-8ú TFzprivate dirz(Can't find domain sid for '%s', Exiting.z%s$zExporting account policyzExporting groupsr=   z4Ignoring group '%s' %s listed but then not found: %szOIgnoring 'well known' group '%s' (should already be in AD, and have no members)z+Ignoring group '%s' %s with sid_name_use=%dzExporting usersr\   Úaccount_namez-  Skipping wellknown rid=%d (for username=%s)zk  Demoting BDC account trust for %s, this DC must be elevated to an AD DC using 'samba-tool domain dcpromo'r   zZ  Skipping inter-domain trust from domain %s, this trust must be re-created as an AD trustú$zŸ  Skipping account %s that has ACB_WSTRUST (W) set but does not end in $.  This account can not have worked, and is probably left over from a misconfiguration.zŽ  Fixing account %s which had both ACB_NORMAL (U) and ACB_WSTRUST (W) set.  Account will be marked as ACB_WSTRUST (W), i.e. as a domain memberz  Fixing account %s which had both ACB_NORMAL (U) and ACB_SVRTRUST (S) set.  Account will be marked as ACB_WSTRUST (S), i.e. as a domain membera  Failed to upgrade due to invalid account %s, account control flags 0x%08X must have exactly one of
ACB_NORMAL (N, 0x%08X), ACB_WSTRUST (W 0x%08X), ACB_SVRTRUST (S 0x%08X) or ACB_DOMTRUST (D 0x%08X).

Please fix this account before attempting to upgrade again
ÚrootZadministratorz)Ignoring group memberships of '%s' %s: %szNext rid = %dc                 S   s   g | ]
}|j ‘qS r'   )rS   ©Ú.0Úgr'   r'   r(   Ú
<listcomp>  ó    z'upgrade_from_samba3.<locals>.<listcomp>c                 S   s   g | ]}|d  ‘qS )r‡   r'   ©r‹   Úur'   r'   r(   r   ‚  rŽ   z4Following names are both user names and group names:z   %sz5Please remove common user/group names before upgrade.c                 S   s   g | ]}t |jƒ‘qS r'   )r   r/   rŠ   r'   r'   r(   r   ‹  rŽ   z9Please remove duplicate group sid entries before upgrade.c                    s   g | ]}d ˆ |d f ‘qS )z%s-%ur\   r'   r   ©Ú	domainsidr'   r(   r   Ž  rŽ   z8Please remove duplicate user sid entries before upgrade.z,Following sids are both user and group sids:z3Please remove duplicate sid entries before upgrade.ú")Zcredentialsz=Could not open ldb connection to %s, the error message is: %szExporting posix attributesZhomeDirectoryr,   r-   zReading WINS databasez'Cannot open wins database, Ignoring: %sZNONEé   é    )Ú	targetdirr„   Zdomainr’   Únext_ridZdc_ridÚ	adminpassZdom_for_fun_levelZhostnameÚmachinepassÚ
serverroleZ
samdb_fillÚuseeadbÚdns_backendZuse_rfc2307Ú	use_ntvfsZskip_sysvolaclzImporting WINS databasezImporting Account policyzImporting idmap databasezstate directoryzlock directoryzAdding groupszImporting groupsr8   )r"   r/   r0   r1   r2   r$   z+Committing 'add groups' transaction to diskzAdding userszImporting usersz-500zPUser 'Administrator' in your existing directory has SID %s, expected it to be %szPUser 'Administrator' in your existing directory does not have SID ending in -500z,User root has been replaced by AdministratorzbUser root has been kept in the directory, it should be removed in favour of the Administrator userr+   )	r"   r/   r0   r1   r2   r3   r4   r5   r$   zAdding users to groupsz4Committing 'add users to groups' transaction to diskz"Setting password for administratorz<Administrator password has been set to password of user '%s'z"active directory domain controller)rZlpZserver_roleÚgetÚsetZget_secrets_dbrJ   r   Zprivatedir_pathr   Zdomainsr}   ÚupperZget_machine_passwordr~   rV   ÚstripZget_ldap_bind_pwÚdecodeÚcloser	   Zset_secrets_dirZ
get_sam_dbZget_global_sam_sidÚerrorÚ	ExceptionZgetsampwnamZuser_sidÚinfoZget_account_policyZenum_group_mappingr/   rT   r   rX   Zenum_aliasmemr!   rS   ZSID_NAME_DOM_GRPZenum_group_membersrU   r   r   rW   Zsearch_usersZ	acct_ctrlr   Z
ACB_NORMALZACB_WSTRUSTZACB_SVRTRUSTZACB_DOMTRUSTZ	sid_to_idÚpwdÚgetpwnamZpw_uidÚlowerZenum_group_membershipsÚappendÚintersectionrl   r   ZguessZset_bind_dnZset_passwordr   r   r    rx   rƒ   Úpw_dirÚ
IndexErrorZpw_shellZpw_gidZget_wins_dbr   r   r   ZDS_DOMAIN_FUNCTION_2003r   Zreport_loggerrp   ÚpathsZwinsdbr)   r"   rM   ZidmapÚs3paramZget_contextÚloadZ
configfileZPDBZtransaction_startÚgidr]   r;   r6   Ztransaction_cancelZtransaction_commitZadd_sam_accountra   Z	nt_passwdZlanman_passwdZpass_last_set_timeZ
pw_historyZupdate_sam_accountr   ZnetlogonZsysvolZroot_uidZroot_gidr’   ÚnamesZ	dnsdomainZdomaindn)=rL   r$   r–   Zsession_infor›   rœ   r   rš   Z
domainnamer„   ZnetbiosnameZ
secrets_dbr&   r—   r™   r€   ZldapuserZldappassZldapZs3dbZmachineacctZ
machineridZ
machinesidr#   Z	grouplistZgroupmembersrP   r/   r\   r`   r[   ZuserlistZuserdataZuidsZ
admin_userÚentryZusernamer   Z	acct_typeZgroup_membershipsZgroup_namesZ
user_namesZcommon_namesr0   Z
group_sidsZ	user_sidsZcommon_sidsZhomesZshellsZpgidsZcredsZurlsZurlr   ro   r˜   ÚresultZ
new_lp_ctxZ	s4_passdbrŒ   Zadmin_userdatar'   r‘   r(   Úupgrade_from_samba3ª  sš   	
0ÿ
ÿ
 








ÿ(
ÿ&ÿ
ÿ&ÿ



ÿþý  ÿû
ÿ





&





&ø	






&





$

ÿ
ÿþ
þ6

"





ýrµ   )NNN)NFNF).Ú__doc__Z__docformat__r   rm   r§   Zsambar   r   Zsamba.paramr   Zsamba.provisionr   r   r   Zsamba.provision.commonr   Zsamba.samba3r	   r
   r¯   Zsamba.dcerpcr   r   r   Zsamba.dcerpc.securityr   Zsamba.credentialsr   r   Z	samba.ndrr   r   r   r)   r6   r;   rH   rM   r]   ra   rp   ÚHKEY_LOCAL_MACHINErs   r{   rƒ   rµ   r'   r'   r'   r(   Ú<module>   sD   8  ÿ
#+'85ÿ  ÿ