a
    W×a´Œ ã                0   @   sX  d Z dZddlmZ ddlmZ ddlmZ ddlm	Z	 ddl
Z
ddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlmZmZ dd	lmZ ddlZdd
lmZ ddlmZm Z  ddlm!Z" ddlm#Z# ddlm$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z, ddl-m.Z.m/Z/ ddl0m1Z1m2Z2 ddlm3Z3m4Z4m5Z5 ddl6m7Z7 ddl8m9Z9 ddl:m;Z;m<Z<m=Z= ddl>m?Z?m@Z@ ddlAmBZB ddlCmDZDmEZEmFZFmGZGmHZHmIZImJZJmKZKmLZLmMZMmNZNmOZOmPZPmQZQmRZRmSZSmTZTmUZUmVZVmWZW ddlXmYZYmZZZm[Z[m\Z\m]Z]m^Z^m_Z_ ddl`maZambZbmcZc ddldZddleZddlfmgZg ddlhmiZi ddljmkZk ddllmmZm ddlhmnZn dZod Zpd!Zqd"Zrd#ZsG d$d%„ d%etƒZuG d&d'„ d'etƒZvd(d)„ Zwdœd+d,„Zxd-d.„ Zyd/d0„ Zzd1d2„ Z{G d3d4„ d4etƒZ|d5d6„ Z}d7d8„ Z~d9d:„ Zd;d<„ Z€d=d>„ Zd?d@„ Z‚dAdB„ ZƒddCdD„Z„dždEdF„Z…dGdH„ Z†dŸdIdJ„Z‡dddddKe2fdLdM„ZˆdNdO„ Z‰dPdQ„ ZŠdRdS„ Z‹dTdU„ ZŒdVdW„ ZdXdY„ ZŽd dZd[„Zd\d]„ Zd^d_„ Z‘d`da„ Z’dbZ“d¡dcdd„Z”d¢dedf„Z•dgZ–dhZ—diZ˜e˜fdjdk„Z™dldm„ Zšdndo„ Z›dpdq„ Zœdrds„ Zdtdu„ Zždvdw„ ZŸd£dxdy„Z dzd{„ Z¡dde\ddd|dddddddddddddd*dd*d*ddfd}d~„Z¢dd€dddd€ddd€ddd‚œZ£dƒd„„ Z¤d…d†„ Z¥d¤dˆd‰„Z¦d¥dŠd‹„Z§d¦dŒd„Z¨dde\dddddddddddd|ddddddddddddddddddddd*d*dd*d*dddŽdd*ddd*f0dd‘„Z©d§d’d“„Zªd”d•„ Z«G d–d—„ d—e¬ƒZ­G d˜d™„ d™e¬ƒZ®G dšd›„ d›e­ƒZ¯dS )¨z/Functions for setting up a Samba configuration.ZrestructuredTexté    )Úquote)Ústring_types)Úbinary_type)Ú	b64encodeN)Úsystem_sessionÚadmin_session)Úsystem_session_unix)Úauth)ÚsmbdÚpassdb)Úparam)ÚDS_DOMAIN_FUNCTION_2000)	ÚLdbÚMAX_NETBIOS_NAME_LENÚcheck_all_substitutedÚis_valid_netbios_charÚ
setup_fileÚsubstitute_varÚvalid_netbios_nameÚversionÚis_heimdal_built)ÚsecurityÚmisc)ÚSEC_CHAN_BDCÚSEC_CHAN_WKSTA)ÚDS_DOMAIN_FUNCTION_2003ÚDS_DOMAIN_FUNCTION_2008_R2ÚENC_ALL_TYPES)ÚIDmapDB)Úread_ms_ldif)ÚsetntaclÚgetntaclÚdsacl2fsacl)Úndr_packÚ
ndr_unpack)Ú
LDBBackend)Úget_empty_descriptorÚget_config_descriptorÚ get_config_partitions_descriptorÚget_config_sites_descriptorÚ!get_config_ntds_quotas_descriptorÚ'get_config_delete_protected1_descriptorÚ)get_config_delete_protected1wd_descriptorÚ'get_config_delete_protected2_descriptorÚget_domain_descriptorÚ$get_domain_infrastructure_descriptorÚget_domain_builtin_descriptorÚget_domain_computers_descriptorÚget_domain_users_descriptorÚ!get_domain_controllers_descriptorÚ'get_domain_delete_protected1_descriptorÚ'get_domain_delete_protected2_descriptorÚget_dns_partition_descriptorÚ'get_dns_forest_microsoft_dns_descriptorÚ'get_dns_domain_microsoft_dns_descriptorÚ'get_managed_service_accounts_descriptor)Ú
setup_pathÚsetup_add_ldifÚsetup_modify_ldifÚ	FILL_FULLÚFILL_SUBDOMAINÚFILL_NT4SYNCÚFILL_DRS)Úget_dnsadmins_sidÚsetup_ad_dnsÚcreate_dns_update_list)ÚSchema)ÚSamDB)Údbcheck)Úcreate_kdc_conf)Úget_default_backend_storez$31B2F340-016D-11D2-945F-00C04FB984F9z$6AC1786C-016F-11D2-945F-00C04FB984F9zDefault-First-Site-NameZlastProvisionUSNé   c                   @   s   e Zd Zdd„ ZdS )ÚProvisionPathsc                 C   sj   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d | _	d | _
d | _d | _d | _d | _d | _d | _d S ©N)Ú	shareconfÚhklmÚhkcuÚhkcrÚhkuÚhkpdÚhkptÚsamdbÚidmapdbÚsecretsÚkeytabÚ
dns_keytabÚdnsÚwinsdbÚprivate_dirÚbinddns_dirÚ	state_dir©Úself© r_   ú:/usr/lib/python3/dist-packages/samba/provision/__init__.pyÚ__init__Š   s"    zProvisionPaths.__init__N©Ú__name__Ú
__module__Ú__qualname__ra   r_   r_   r_   r`   rJ   ˆ   s   rJ   c                   @   s   e Zd Zdd„ ZdS )ÚProvisionNamesc                 C   sv   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d | _	d | _
d | _d | _d | _d | _d | _d | _d | _i | _d S rK   )ÚncsÚrootdnÚdomaindnÚconfigdnÚschemadnÚdnsforestdnÚdnsdomaindnÚldapmanagerdnÚ	dnsdomainÚrealmÚnetbiosnameÚdomainÚhostnameÚsitenameÚsmbconfÚ	domainsidÚ	forestsidÚ
domainguidÚname_mapr]   r_   r_   r`   ra       s&    zProvisionNames.__init__Nrb   r_   r_   r_   r`   rf   ž   s   rf   c                 C   sš  t ƒ }d|_| d¡ ¡ |_| d¡|_|j ¡ |_t 	|j¡}|j ¡ |_|j
d|j dtjdgd}t|d d ƒ d	d
¡|_||_| j
dd
tjg d¢d}	t|	d d d ƒ|_t|	d d d ƒ|_t | |¡t | |	d d d  d¡¡ks&td|jt|	d d d  d¡ƒ|j|f ƒ‚t|	d d d ƒ|_t|	d d d ƒ|_|	d d |_d|_d|_tdt|jƒƒD ]X}
t|j|
 ƒ}dt|jƒ }||kr°||_q|dt|jƒ }||kr|||_q|q|| j
ddt|jƒ tjdgd}t|d d ƒ|_ | j
d|j d| tjdgd}t|ƒdkrHtd|j|f ƒ‚t|d d ƒ d|j d
¡|_!| j
d|d j" g |jd}t|d j"ƒ|_#| j
dd t|j#ƒ tjd!d"gd}tt$t%j&|d d# d ƒƒ|_'tt$t%j&|d d" d ƒƒ|_(| j
d|tjg d$¢d}tt$t%j&|d d" d ƒƒ|_)t$t*j+|d d% d ƒ|_,t$t*j+|d d% d ƒ|_-|d  d&¡du sŠt.|d d& d ƒt/k r’t/|_0nt.|d d& d ƒ|_0| j
d't1 d(| tjdd)gd}t|d d ƒ d*d
¡ d+d
¡|_2| j
d't3 d(| tjdd)gd}t|ƒd,kr<t|d d ƒ d*d
¡ d+d
¡|_4nd|_4|j
d-t|j,ƒt*j5f d.d/gd0}t|ƒd,krŠtd1t|j,ƒt*j5f ƒ‚t|d d/ d ƒd2kr¼t.|d d. d ƒ|_6nt7 8t.|d d. d ƒ¡j9|_6| j
d3tjd4gd5gd6}t|ƒdkrd7}nd8}| j
d9|j tjd4gd5gd6}t|ƒdkr<d7}nd8}|jdurb|rZd:|_:nd;|_:n|sn|rvd<|_:nd=|_:t;| |jƒ}t|ƒ|j<d>< |S )?aÈ  Get key provision parameters (realm, domain, ...) from a given provision

    :param samdb: An LDB object connected to the sam.ldb file
    :param secretsdb: An LDB object connected to the secrets.ldb file
    :param idmapdb: An LDB object connected to the idmap.ldb file
    :param paths: A list of path to provision object
    :param smbconf: Path to the smb.conf file
    :param lp: A LoadParm object
    :return: A list of key provision parameters
    NÚ	workgrouprp   z(flatname=%s)zCN=Primary DomainsZsAMAccountName©Ú
expressionÚbaseÚscopeÚattrsr   ú$Ú z(objectClass=*))ÚdefaultNamingContextÚschemaNamingContextÚconfigurationNamingContextÚrootDomainNamingContextÚnamingContextsr„   rƒ   r‚   Úutf8z5basedn in %s (%s) and from %s (%s)is not the same ...r…   r†   zDC=ForestDnsZones,%szDC=DomainDnsZones,%sz(objectClass=site)z	CN=Sites,Úcnz(CN=%s)zOU=Domain Controllers,%sZdNSHostNamez=Unable to find DC called CN=%s under OU=Domain Controllers,%sÚ.zserverReference=%s)r|   r   r}   úCN=NTDS Settings,%sZinvocationIDÚ
objectGUIDZinvocationId)r‹   Ú	objectSidúmsDS-Behavior-VersionrŒ   r   z(name={%s})zCN=Policies,CN=System,ZdisplayNameú{ú}é   z
(cn=%s-%s)Z	xidNumberÚtype)r|   r   z3Unable to find uid/gid for Domain Admins rid (%s-%sZID_TYPE_BOTHz(samaccountname=dns)Údnúsearch_options:1:2)r|   r~   r   ÚcontrolsTFz(samaccountname=dns-%s)Z	BIND9_DLZÚSAMBA_INTERNALZBIND9_FLATFILEZNONEZ	DnsAdmins)=rf   Ú	adminpassÚgetÚupperrr   rp   Úlowerro   ÚsambaÚdn_from_dns_nameÚsearchÚldbÚSCOPE_SUBTREEÚstrÚreplacerq   ru   Ú
SCOPE_BASErj   rk   ÚDnÚdecodeÚProvisioningErrorrS   ri   rh   rg   rl   rm   ÚrangeÚlenÚSCOPE_ONELEVELrt   rs   r’   Úserverdnr$   r   ZGUIDZ
invocationÚntdsguidrx   r   Údom_sidrv   rw   Úintr   ZdomainlevelÚDEFAULT_POLICY_GUIDZpolicyidÚDEFAULT_DC_POLICY_GUIDZpolicyid_dcÚDOMAIN_RID_ADMINISTRATORÚroot_gidÚpwdÚgetpwuidÚpw_gidÚdns_backendrA   ry   )rS   Ú	secretsdbrT   Úpathsru   ÚlpÚnamesÚbasednÚresZcurrentÚiZncrl   rm   Zres3Zres4Z
server_resZres5Zres6Zres7Zres8Zres9Zres10Zhas_legacy_dns_accountZres11Zhas_dns_accountZdns_admins_sidr_   r_   r`   Úfind_provision_key_parameters¶   sú    ÿþþÿþÿ

ÿþ ÿý
ÿÿ

þ"
ý$ÿþþþr»   Fc           	      C   sð   g }|s^| j dtjtdgd}|d t D ]2}t  dt|ƒ¡sNdt|ƒ|f }| t|ƒ¡ q*| d|||f ¡ t ¡ }t | d¡|_	t 
|tjt¡|t< | j ddtjd	gd
}t|ƒdksÎt|d ƒdkrât 
|tjd	¡|d	< |  |¡ dS )a_  Update the field provisionUSN in sam.ldb

    This field is used to track range of USN modified by provision and
    upgradeprovision.
    This value is used afterward by next provision to figure out if
    the field have been modified since last provision.

    :param samdb: An LDB object connect to sam.ldb
    :param low: The lowest USN modified by this upgrade
    :param high: The highest USN modified by this upgrade
    :param id: The invocation id of the samba's dc
    :param replace: A boolean indicating if the range should replace any
                    existing one or appended (default)
    ú
@PROVISIONr’   )r}   r~   r   r   ú;z%s;%sú%s-%s;%szprovisionnerID=*ÚprovisionnerIDr{   N)rœ   r   r¡   ÚLAST_PROVISION_USN_ATTRIBUTEÚrerŸ   ÚappendÚMessager¢   r’   ÚMessageElementÚFLAG_MOD_REPLACEr¦   ÚFLAG_MOD_ADDÚmodify)	rS   ÚlowÚhighÚidr    ÚtabÚentryÚeÚdeltar_   r_   r`   Úupdate_provision_usnX  s2    þþÿþrÏ   c                 C   sP   g }|  d|||f ¡ t ¡ }t | d¡|_t |tjt¡|t< |  |¡ dS )aÔ  Set the field provisionUSN in sam.ldb
    This field is used to track range of USN modified by provision and
    upgradeprovision.
    This value is used afterward by next provision to figure out if
    the field have been modified since last provision.

    :param samdb: An LDB object connect to sam.ldb
    :param low: The lowest USN modified by this upgrade
    :param high: The highest USN modified by this upgrade
    :param id: The invocationId of the provisionr¾   r¼   N)	rÂ   r   rÃ   r¢   r’   rÄ   rÆ   rÀ   Úadd)rS   rÈ   rÉ   rÊ   rË   rÎ   r_   r_   r`   Úset_provision_usn  s    þÿrÑ   c                 C   s(   | j d|tjdgg d¢d}|d d S )a   This function return the biggest USN present in the provision

    :param samdb: A LDB object pointing to the sam.ldb
    :param basedn: A string containing the base DN of the provision
                    (ie. DC=foo, DC=bar)
    :return: The biggest USN in the provisionzobjectClass=*Z
uSNChanged)r“   zserver_sort:1:1:uSNChangedzpaged_results:1:1)r|   r}   r~   r   r”   r   )rœ   r   rž   )rS   r¸   r¹   r_   r_   r`   Úget_max_usn™  s
    þrÒ   c              
   C   sd  z | j dt dtjtdgd}W nJ tjyj } z0|j\}}|tjkrTW Y d}~dS ‚ W Y d}~n
d}~0 0 t|ƒdkr\g }i }t 	d¡}|d  
d¡rº|d d D ]}| t|ƒ¡ q¦|d t D ]}	t|	ƒ d¡}
t|
ƒd	krî|
d
 }nd}t|ƒdkr||vrqÆ| |
d ¡}| 
|¡du r2g ||< ||  |d ¡ ||  |d
 ¡ qÆ|S dS dS )a  Get USNs ranges modified by a provision or an upgradeprovision

    :param sam: An LDB object pointing to the sam.ldb
    :return: a dictionary which keys are invocation id and values are an array
             of integer representing the different ranges
    z%s=*r¼   r¿   r{   Nr   ú-r½   é   r   Údefault)rœ   rÀ   r   r¡   ÚLdbErrorÚargsZERR_NO_SUCH_OBJECTr¦   rÁ   Úcompiler—   rÂ   rŸ   Úsplit)ZsamrÌ   Ze1ZecodeZemsgZmyidsr¥   ÚprÍ   ÚrZtab1rÊ   Ztab2r_   r_   r`   Úget_last_provision_usn©  s>    
þ




rÜ   c                   @   s    e Zd ZdZdd„ Zdd„ ZdS )ÚProvisionResultz™Result of a provision.

    :ivar server_role: The server role
    :ivar paths: ProvisionPaths instance
    :ivar domaindn: The domain dn, as string
    c                 C   sF   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d | _	d | _
d S rK   )Úserver_rolerµ   ri   r¶   rS   Úidmapr·   rv   Úadminpass_generatedr–   Úbackend_resultr]   r_   r_   r`   ra   Ú  s    zProvisionResult.__init__c                 C   s€   |  d¡ | jr|  d| j¡ |  d| j¡ |  d| jj¡ |  d| jj¡ |  d| jj¡ |  d| j¡ | j	r|| j	 
|¡ dS )	z)Report this provision result to a logger.zMOnce the above files are installed, your Samba AD server will be ready to usezAdmin password:        %szServer Role:           %szHostname:              %szNetBIOS Domain:        %szDNS Domain:            %szDOMAIN SID:            %sN)Úinforà   r–   rÞ   r·   rs   rr   ro   rv   rá   Úreport_logger)r^   Úloggerr_   r_   r`   rã   ç  s    ÿzProvisionResult.report_loggerN)rc   rd   re   Ú__doc__ra   rã   r_   r_   r_   r`   rÝ   Ò  s   rÝ   c                 C   sH   |   d¡dkrtdƒ‚t|  ¡ ||| d}t| d¡ƒdkrDtdƒ‚dS )	z¢Check whether the current install seems ok.

    :param lp: Loadparm context
    :param session_info: Session information
    :param credentials: Credentials
    rp   r   zRealm empty)Úsession_infoÚcredentialsr¶   z(cn=Administrator)r   zNo administrator account foundN)r—   Ú	Exceptionr   Z	samdb_urlr¦   rœ   r¤   )r¶   ræ   rç   rS   r_   r_   r`   Úcheck_installø  s    
ÿré   c              	   C   s<   |D ]&}z| |ƒW   S  t y(   Y q0 qt d| ƒ‚dS )zÔFind a user or group from a list of possibilities.

    :param nssfn: NSS Function to try (should raise KeyError if not found)
    :param names: Names to check.
    :return: Value return by first names list.
    zUnable to find user/group in %rN)ÚKeyError)Znssfnr·   Únamer_   r_   r`   Úfindnss  s    rì   c                 C   s   t tj| ƒd S ©NrÔ   )rì   r°   Úgetpwnam©r·   r_   r_   r`   Úfindnss_uid  s    rð   c                 C   s   t tj| ƒd S rí   )rì   ÚgrpZgetgrnamrï   r_   r_   r`   Úfindnss_gid  s    rò   c              
   C   sN   zt | ƒ}W n< tyH } z$| |¡ | d¡ d}W Y d }~n
d }~0 0 |S )NzAssuming root user has UID zeror   )rð   rê   râ   )Úrooträ   Úroot_uidrÍ   r_   r_   r`   Úget_root_uid  s    

rõ   c                 C   s¨  t ƒ }|  d¡|_|  d¡|_|  d¡|_d|_d|_tj 	|jd¡|_
tj 	|jd¡|_tj 	|jd¡|_tj 	|jd	¡|_tj 	|jd
¡|_tj 	|jd¡|_tj 	|jd¡|_tj 	|jd¡|_tj 	|jd¡|_tj 	|jd¡|_tj 	|jd¡|_tj 	|jd¡|_tj 	|jd|d ¡|_tj 	|jd¡|_tj 	|jd¡|_tj 	|jd¡|_d|_d|_d|_d|_d|_d|_|  dd¡|_ |  dd¡|_!| j"|_#|S ) ztSet the default paths for provisioning.

    :param lp: Loadparm context.
    :param dnsdomain: DNS Domain name
    úprivate dirúbinddns dirústate directoryz
dns.keytabúsecrets.keytabz	share.ldbzsam.ldbz	idmap.ldbzsecrets.ldbzprivilege.ldbÚdns_update_listÚspn_update_listú	krb5.confzkdc.confzwins.ldbZldapizencrypted_secrets.keyrX   z.zonez
named.confznamed.conf.updatez	named.txtzhklm.ldbzhkcr.ldbzhkcu.ldbzhku.ldbzhkpd.ldbzhkpt.ldbÚpathÚsysvolÚnetlogon)$rJ   r—   rZ   r[   r\   rW   rV   Úosrý   ÚjoinrL   rS   rT   rU   Ú	privilegerú   rû   Úkrb5confÚkdcconfrY   Ús4_ldapi_pathÚencrypted_secrets_key_pathrX   Z	namedconfZnamedconf_updateZnamedtxtrM   rO   rN   rP   rQ   rR   rþ   rÿ   Ú
configfileru   )r¶   ro   rµ   r_   r_   r`   Úprovision_paths_from_lp(  sF    þr  c                 C   s$   d  dd„ | D ƒ¡}|dt…  ¡ S )z)Determine a netbios name from a hostname.r   c                 S   s   g | ]}t |ƒr|‘qS r_   )r   )Ú.0Úxr_   r_   r`   Ú
<listcomp>[  ó    z*determine_netbios_name.<locals>.<listcomp>N)r  r   r˜   )rs   rq   r_   r_   r`   Údetermine_netbios_nameX  s    r  c                 C   sú  |du rt  ¡  d¡d }|  d¡}|du r4t|ƒ}| ¡ }t|ƒsLt|ƒ‚|du r||  d¡}|du sn|dkr|td| j	 ƒ‚| 
¡ }|du r¬|  d¡}|du r¬td	| j	 ƒ‚| 
¡ }| ¡ }|  d¡dkrØtd
| j	 ƒ‚|  d¡ ¡ |kr
td|  d¡ ¡ | j	|f ƒ‚|  d¡ 
¡ |kr8td|  d¡| j	|f ƒ‚|dkrÀ|du rV|  d¡}| ¡ }|  d¡ ¡ |krtd|  d¡ ¡ || j	f ƒ‚|du r¤t |¡}||krÖtd||f ƒ‚n|}|du rÖd| }t|ƒsèt|ƒ‚| ¡ |krtd||f ƒ‚| ¡ |kr$td||f ƒ‚||krD|sDtd||f ƒ‚|dkrZ|}| 
¡ }|du rh|}|du rzd| }|du rŒd| }|
du ršt}
tƒ }||_||_||_||_d| |_||_||_||_||_||_|
|_d||
|f |_|S )z$Guess configuration settings to use.Nr‰   r   únetbios namerp   r   z2guess_names: 'realm' not specified in supplied %s!úserver rolez8guess_names: 'server role' not specified in supplied %s!zwguess_names: 'realm =' was not specified in supplied %s.  Please remove the smb.conf file and let provision generate itzzguess_names: 'realm=%s' in %s must match chosen realm '%s'!  Please remove the smb.conf file and let provision generate itz†guess_names: 'server role=%s' in %s must match chosen server role '%s'!  Please remove the smb.conf file and let provision generate itú"active directory domain controllerrz   zguess_names: Workgroup '%s' in smb.conf must match chosen domain '%s'!  Please remove the %s file and let provision generate itzCguess_names: Domain '%s' must not be equal to short host name '%s'!zDC=z;guess_names: Realm '%s' must not be equal to hostname '%s'!zCguess_names: Realm '%s' must not be equal to NetBIOS hostname '%s'!zDguess_names: Realm '%s' must not be equal to short domain name '%s'!zCN=Configuration,z
CN=Schema,zCN=Manager,z"CN=%s,CN=Servers,CN=%s,CN=Sites,%s)ÚsocketÚgethostnamerÙ   r—   r  r˜   r   ÚInvalidNetbiosNamer¤   r  r™   rš   r›   ÚDEFAULTSITErf   rh   ri   rj   rk   rn   ro   rr   rp   rq   rs   rt   r¨   )r¶   rs   rr   ro   Ú
serverrolerh   ri   rj   rk   r¨   rt   Údomain_names_forcedrq   rp   r·   r_   r_   r`   Úguess_names_  sš    

ÿÿ














ÿr  c
              	   C   sz  | dusJ ‚|du r&t  ¡  d¡d }t|ƒ}
|du r:d}|dusFJ ‚| ¡ }|dusZJ ‚| ¡ }|
|||dœ}|du r‚tj ¡ }tj	 
| ¡r˜| | ¡ |	durÈ|	D ]"}|	| dur¤d |	| ¡||< q¤|durŽtj	 tj	 |d¡¡|d< tj	 |¡|d	< tj	 tj	 |d
¡¡|d< tj	 tj	 |d¡¡|d< tj	 tj	 |d¡¡|d< | d	tj	 |¡¡ | d|d ¡ | d|d ¡ | d|d ¡ |rt|r|durÒtj	 |d¡}| dtj	 tj	 |d¡¡¡ n4| d¡st| d¡}| dtj	 tj	 |d¡¡¡ nl|dur@tj	 |d
¡}| dtj	 tj	 |d¡¡¡ n4| d¡st| d¡}| dtj	 tj	 |d¡¡¡ i }|dkr¸tj	 | d¡d¡|d< tj	 |d | ¡ d¡|d< nd|d< t| dƒ}zŠ| d¡ | ¡ D ]\}}| d||f ¡ qÞ| d¡ | ¡ D ]:\}}| d| ¡ | d| ¡ | d ¡ | d¡ qW | ¡  n
| ¡  0 | | ¡ | d!| ¡ dS )"zDCreate a new smb.conf file based on a couple of basic settings.
    Nr‰   r   ústandalone server)r  rz   rp   r  ú Zprivaterö   zlock dirÚstaterø   Úcachezcache directoryzbind-dnsr÷   z
posix:eadbzeadb.tdbzxattr_tdb:filez	xattr.tdbr  rþ   Zscriptsrÿ   Z
samba_dsdbúpassdb backendÚwz
[globals]
z		%s = %s
Ú
z[%s]
z	path = %s
z	read only = no
F)r  r  rÙ   r  r˜   rš   r   ÚLoadParmr   rý   ÚexistsÚloadr  ÚabspathÚsetr—   r™   ÚopenÚwriteÚitemsÚcloseÚdump)ru   rs   rr   rp   Ú	targetdirr  ÚeadbÚ	use_ntvfsr¶   Úglobal_paramrq   Zglobal_settingsZentZprivdirZstatedirZsharesÚfÚkeyÚvalrë   rý   r_   r_   r`   Úmake_smbconfÔ  s˜    ü



ÿ
ÿ
ÿ
ÿ
ÿ





r0  c                 C   s<   |   d| j|¡ |   |d | j|¡ |   |d | j|¡ dS )a  setup reasonable name mappings for sam names to unix names.

    :param samdb: SamDB object.
    :param idmap: IDmap db object.
    :param sid: The domain sid.
    :param domaindn: The domain DN.
    :param root_uid: uid of the UNIX root user.
    :param nobody_uid: uid of the UNIX nobody user.
    :param users_gid: gid of the UNIX users group.
    :param root_gid: gid of the UNIX root group.
    zS-1-5-7z-500z-513N)Zsetup_name_mappingZTYPE_UIDZTYPE_GID)rß   Úsidrô   Ú
nobody_uidÚ	users_gidr¯   r_   r_   r`   Úsetup_name_mappings:  s    r4  c                 C   s*  |dusJ ‚zt  | ¡ W n ty,   Y n0 t| ||dgd}d}|jdkrXd|j }d}|sdd}|	du rrtƒ }	d|	 }|	d	kr |dur”|d
7 }nd}|d7 }|du r¬d}| ¡  zR| d¡ t	|t
dƒ||dœƒ t	|t
dƒ|j||dœƒ | d¡ t||ƒ W n   | ¡  ‚ Y n
0 | ¡  dS )ak  Setup the partitions for the SAM database.

    Alternatively, provision() may call this, and then populate the database.

    :note: This will wipe the Sam Database!

    :note: This function always removes the local SAM LDB file. The erase
        parameter controls whether to erase the existing data, which
        may not be stored locally but in LDAP.

    Nzmodules:)Úurlræ   r¶   Úoptionsz# No LDAP backendr   zldapBackend: %sz"requiredFeatures: encryptedSecretszbackendStore: %sÚmdbr  r   zrequiredFeatures: lmdbLevelOnez# No required featuresz*Setting up sam.ldb partitions and settingszprovision_partitions.ldif)ZLDAP_BACKEND_LINEZBACKEND_STOREzprovision_init.ldif)ZBACKEND_TYPEZSERVER_ROLEZREQUIRED_FEATURESzSetting up sam.ldb rootDSE)r   ÚunlinkÚOSErrorr   r‘   Zldap_urirH   Útransaction_startrâ   r;   r:   Úsetup_samdb_rootdseÚtransaction_cancelÚtransaction_commit)Z
samdb_pathrä   r¶   ræ   Úprovision_backendr·   r  ÚeraseÚplaintext_secretsÚbackend_storeÚbackend_store_sizerS   Zldap_backend_lineZrequired_featuresZbackend_store_liner_   r_   r`   Úsetup_samdb_partitionsM  sT    ÿ




þ
ý
rC  r   c
              	   C   s–  g d¢}
|dur6|du r |  ¡ }d|  ¡ |  ¡ f }nd}|  ¡ }t t | d| ¡¡}t|	ƒg|d< ddg|d< |dur¾g d	¢|d< |g|d
< d|| ¡ f g|d< t|ƒg|d< dg|d< | d¡g|d< d| g|d< t|	ƒg|d< |durt|ƒg|d< | jd|
d||t|ƒt|j	ƒf tj
d}|D ]}|  |j	¡ q0| j|j	|
tjd}t|ƒdkrR|d d d g|d< z|d d d g|d< W n tyª   Y n0 z|d d d g|d< W n tyÚ   Y n0 z|d d d g|d< W n ty
   Y n0 |D ] }|dkr||  tj¡ q|  |¡ |  |d j	|j	¡ n@d | g}|	tkr€|dur€| d | g¡ ||d!< |  |¡ dS )"zœAdd domain join-specific bits to a secrets database.

    :param secretsdb: Ldb Handle to the secrets database
    :param machinepass: Machine password
    )ÚwhenChangedÚsecretÚpriorSecretZpriorChangedÚ
krb5KeytabÚprivateKeytabNú%s.%szflatname=%s,cn=Primary DomainsZsecureChannelTypeÚtopÚprimaryDomainZobjectClass)rJ  rK  ZkerberosSecretrp   z
host/%s@%sZsaltPrincipalzmsDS-KeyVersionNumberrù   rH  úutf-8rE  z%s$ZsamAccountNamerŒ   zcn=Primary Domainsz_(&(|(flatname=%s)(realm=%s)(objectSid=%s))(objectclass=primaryDomain)(!(distinguishedName=%s)))©r}   r   r|   r~   )r}   r   r~   r   r   rF  rD  ZpriorWhenChangedrG  r’   zHOST/%sZservicePrincipalName)r™   r   rÃ   r¢   rŸ   r˜   Úencoder#   rœ   r’   r§   Údeleter¡   r¦   rê   Z	set_flagsrÅ   rÇ   Úrenamer   ÚextendrÐ   )r´   rr   rq   Úmachinepassrv   rp   ro   Úkeytab_pathZkey_version_numberÚsecure_channel_typer   ZdnsnameZ	shortnameÚmsgr¹   Zdel_msgZelZspnr_   r_   r`   Úsecretsdb_self_join–  sh    


þ


rV  c                 C   s   t j | j¡rt  | j¡ t j | j| j¡}t j |¡rBt  |¡ t j | j| j	¡}t j |¡rjt  |¡ t j | j| j	¡}t j |¡r’t  |¡ | j}t
|||d}| ¡  | tdƒ¡ t
|||d}| ¡  z| tdƒ¡ W n   | ¡  ‚ Y n0 |S )ar  Setup the secrets database.

    :note: This function does not handle exceptions and transaction on purpose,
       it's up to the caller to do this job.

    :param path: Path to the secrets database.
    :param session_info: Session info.
    :param credentials: Credentials
    :param lp: Loadparm context
    :return: LDB handle for the created secrets database
    ©ræ   r¶   zsecrets_init.ldifzsecrets.ldif)r   rý   r   rU   r8  r  rZ   rV   r[   rW   r   r?  Úload_ldif_file_addr:   r:  r<  )rµ   ræ   r¶   rS  Úbind_dns_keytab_pathZdns_keytab_pathrý   Úsecrets_ldbr_   r_   r`   Úsetup_secretsdbð  s.    


r[  c                 C   s>   t j | ¡rt  | ¡ t| ||d}| ¡  | tdƒ¡ dS )zúSetup the privileges database.

    :param path: Path to the privileges database.
    :param session_info: Session info.
    :param credentials: Credentials
    :param lp: Loadparm context
    :return: LDB handle for the created secrets database
    rW  zprovision_privilege.ldifN)r   rý   r   r8  r   r?  rX  r:   )rý   ræ   r¶   Zprivilege_ldbr_   r_   r`   Úsetup_privileges  s
    	
r\  c              	   C   s¬   t j | ¡rt  | ¡ t jt jB t jB }tjtj	B }t  
d¡}zt  | ||¡}W t  
|¡ nt  
|¡ 0 t  |d¡$}t d¡}| |¡ W d  ƒ n1 sž0    Y  dS )z¦Setup the encrypted secrets key file.

    Any existing key file will be deleted and a new random key generated.

    :param path: Path to the secrets key file.

    r   Úwbé   N)r   rý   r   r8  ÚO_WRONLYÚO_CREATÚO_EXCLÚstatÚS_IRUSRÚS_IWUSRÚumaskr$  Úfdopenrš   Zgenerate_random_bytesr%  )rý   ÚflagsÚmodeZumask_originalÚfdr-  r.  r_   r_   r`   Úsetup_encrypted_secrets_key*  s    


rj  c                 C   sR   t j ¡ }t jj| ||d}| |t jj¡ tdƒ}tj 	|¡sDJ ‚| 
|¡ dS )z¹Setup the registry.

    :param path: Path to the registry database
    :param session_info: Session information
    :param credentials: Credentials
    :param lp: Loadparm context
    )ræ   Úlp_ctxzprovision.regN)rš   ÚregistryZRegistryZopen_ldbZ
mount_hiveÚHKEY_LOCAL_MACHINEr:   r   rý   r   Z
diff_apply)rý   ræ   r¶   ZregZhiveZprovision_regr_   r_   r`   Úsetup_registryC  s    
rn  c                 C   s>   t j | ¡rt  | ¡ t| ||d}| ¡  | tdƒ¡ |S )z¼Setup the idmap database.

    :param path: path to the idmap database
    :param session_info: Session information
    :param credentials: Credentials
    :param lp: Loadparm context
    rW  zidmap_init.ldif)r   rý   r   r8  r   r?  rX  r:   )rý   ræ   r¶   Z	idmap_ldbr_   r_   r`   Úsetup_idmapdbS  s    
ro  c              	   C   s*   t | tdƒ|j|j|j|j|jdœƒ dS )zDSetup the SamDB rootdse.

    :param samdb: Sam Database handle
    zprovision_rootdse_add.ldif)ÚSCHEMADNÚDOMAINDNZROOTDNÚCONFIGDNÚSERVERDNN)r;   r:   rk   ri   rh   rj   r¨   )rS   r·   r_   r_   r`   r;  d  s    
ûr;  c                 C   sü  t |	tƒsJ ‚|dur d| }nd}|du r0|}t| tdƒ|j|j|j|j|	|jd|j	|j
f t| d¡ƒ d¡t|ƒt|ƒt|t|ƒt|d ƒt|d d	 ƒd
œƒ t| tdƒ|
||j
|jdœƒ |tkrpt| tdƒ|j|j|j|j|	|jd|j	|j
f t| d¡ƒ d¡t|ƒt|ƒt|t|ƒdœƒ t| tdƒ|j|jdœddgd t| tdƒ|j|j|j|jdœƒ tƒ }|  |¡ t| tdƒ|j|j|jdœƒ |  |¡ |dkrøt| tdƒ|j
|jt| d¡ƒ d¡|j	d|j ¡ |j
 ¡ f dœƒ dS )zJoin a host to its own domain.NzobjectGUID: %s
r   zprovision_self_join.ldifrI  ú	utf-16-ler‡   éd   ió  )rr  rp  rq  rs  ÚINVOCATIONIDÚNETBIOSNAMEÚDNSNAMEÚMACHINEPASS_B64Ú	DOMAINSIDÚDCRIDÚSAMBA_VERSION_STRINGÚNTDSGUIDÚDOMAIN_CONTROLLER_FUNCTIONALITYZRIDALLOCATIONSTARTZRIDALLOCATIONENDzprovision_group_policy.ldif)Ú
POLICYGUIDÚPOLICYGUID_DCÚ	DNSDOMAINrq  zprovision_self_join_config.ldif)rr  rp  rq  rs  rv  rw  rx  ry  rz  r{  r|  r}  r~  z&provision_self_join_modify_schema.ldif)rp  rs  úprovision:0úrelax:0©r”   z&provision_self_join_modify_config.ldif)rr  r  rw  rs  zprovision_self_join_modify.ldif)rq  rs  rw  r•   zprovision_dns_add_samba.ldif)r  rq  ZDNSPASS_B64ÚHOSTNAMErx  )Ú
isinstancerŸ   r;   r:   rj   rk   ri   r¨   rq   rs   ro   r   rN  r£   r   r=   r<   rt   r   Úset_session_infor™   )rS   Úadmin_session_infor·   ÚfillrR  r³   Údnspassrv   Únext_ridÚinvocationidÚ
policyguidÚpolicyguid_dcÚdomainControllerFunctionalityr©   Údc_ridZntdsguid_lineZsystem_session_infor_   r_   r`   Úsetup_self_joinr  s¤    

ÿ
ð
ü

ÿóþûüÿ

ý


ÿûr‘  c                 C   s*   |d dkrd| }t j | |d|¡}|S )a  Return the physical path of policy given its guid.

    :param sysvolpath: Path to the sysvol folder
    :param dnsdomain: DNS name of the AD domain
    :param guid: The GUID of the policy
    :return: A string with the complete path to the policy folder
    r   rŽ   z{%s}ÚPolicies)r   rý   r  )Ú
sysvolpathro   ZguidÚpolicy_pathr_   r_   r`   ÚgetpolicypathÔ  s    r•  c                 C   sž   t j | ¡st  | d¡ tt j | d¡dƒ}z| d¡ W | ¡  n
| ¡  0 t j | d¡}t j |¡stt  |d¡ t j | d¡}t j |¡sšt  |d¡ d S )Néý  zGPT.INIr  z[General]
Version=0ZMACHINEZUSER)r   rý   r   Úmakedirsr$  r  r%  r'  )r”  r-  rÚ   r_   r_   r`   Úcreate_gpo_structâ  s    r˜  c                 C   s,   t | ||ƒ}t|ƒ t | ||ƒ}t|ƒ dS )a  Create the default GPO for a domain

    :param sysvolpath: Physical path for the sysvol folder
    :param dnsdomain: DNS domain name of the AD domain
    :param policyguid: GUID of the default domain policy
    :param policyguid_dc: GUID of the default domain controler policy
    N)r•  r˜  )r“  ro   r  rŽ  r”  r_   r_   r`   Úcreate_default_gpoò  s    r™  l        c                 C   s,  t | |||||||
||d
 t}|r(|}g }|dkrF| dt|ƒ ¡ |rT| d¡ |rzt|d ƒd }| dt|ƒ ¡ t|dd	|d	|	|d
}| d¡ |j|d	d | d|j	 ¡ z|j
| |d W nN tjy } z2|j\}}|tjkrtd|  ƒ‚n‚ W Y d}~n
d}~0 0 |j|dd |S )zZSetup a complete SAM Database.

    :note: This will wipe the main SAM database file!
    )	rä   r¶   r>  ræ   r·   r  r@  rA  rB  r7  zlmdb_env_size:zbatch_mode:1i·¥  r   ztransaction_index_cache_size:NF)ræ   r5  Zauto_connectr¶   Zglobal_schemaÚam_rodcr6  z%Pre-loading the Samba 4 and AD schema)Zwrite_indices_and_attributesrŠ   )r6  z<Permission denied connecting to %s, are you running as root?T)rC  ÚDEFAULT_BACKEND_SIZErÂ   rŸ   r«   rE   râ   Z
set_schemaÚset_ntds_settings_dnr¨   Zconnectr   rÖ   r×   ZERR_INSUFFICIENT_ACCESS_RIGHTSr¤   )rý   ræ   r>  r¶   r·   rä   r‰  r  Úschemarš  r@  rA  rB  Ú
batch_modeZ
store_sizer6  Z
cache_sizerS   Ze2ZnumZstring_errorr_   r_   r`   Úsetup_samdb  sB    
ü
þ

rŸ  c           1      C   s‚  |d u rd}|dk s|dkr8d| }|dd 7 }t |ƒ‚t}|d u rHt}||krXt dƒ‚|}|}|  d|j ¡ |  d|¡ |  d	|¡ |  d
|¡ |  t|jƒ¡ |  |¡ | 	d|j
 ¡ t|t|jƒƒ}|  |¡ |jd urîd|j }nd}tt|jƒƒ d¡}t| tdƒ|j
t|jƒ||dœƒ t| tdƒ|j
tt tt ¡ ƒ¡ƒt|ƒ|j|j|t|ƒtttƒdœ	ƒ |tkr"| 	d¡ tt|jƒƒ d¡}t| tdƒ|j|dœƒ dtjj }dd|g}| 	d¡ | j |j!|d | j"|j#|d |  $¡  | j |j%|d t| tdƒd|j&i|d t' (t' )| |j
¡¡}t' *|jt'j+d¡|d< || _,|tkr´| 	d¡ tt-|jƒƒ d¡} tt.|jƒƒ d¡}!tt/|jƒƒ d¡}"tt0|jƒƒ d¡}#tt1|jƒƒ d¡}$tt2|jƒƒ d¡}%d|j3v rðd }&nd}&t| td!ƒ|j|j4|j|j5|j6|j&|j
|jt|ƒt|ƒ|"|$|#|$|$|%| |!d"œƒ t| td#ƒ|j|&d$œƒ | 	d%¡ t7td&ƒƒ}'t8|'d'|jiƒ}'t9|'ƒ |   |'¡ | 	d(¡ t| td)ƒ|j|%d*œƒ | 	d+¡ tt:|jƒƒ d¡}(t| td,ƒ|j
|(d-œƒ | 	d.¡ t| td/ƒd0|j
iƒ | 	d1¡ tt;|jƒƒ d¡})t| td2ƒ|j
|)d3œƒ | 	d4¡ t| td5ƒd0|j
iƒ | 	d6¡ tt<|jƒƒ d¡}*tt=|jƒƒ d¡}+tt>|jƒƒ d¡},tt?|jƒƒ d¡}-tt@|jƒƒ d¡}.t| td7ƒtt tt ¡ ƒ¡ƒ|j
|j4|j|j|jt|d8 ƒ||*|+|,|-|.d9œƒ |tkr”ttA|jƒƒ d¡}/t| td:ƒ|j|j&d;œƒ | 	d<¡ tt1|jƒƒ d¡}$t| td=ƒ|j|$d>œddgd |tks¨|tBkr~t| td?ƒ|j
|/d@œƒ | 	dA¡ t| tdBƒ|j
t|jƒt| CdC¡ƒ d¡t| CdC¡ƒ d¡dDœddgd | 	dE¡ tD| |||||
||	|j||||||dF d|j }0| jE|0dGdt'jFdH d¡|_GtH|jGtIƒs~J ‚| S )INéè  é Êš;z/You want to run SAMBA 4 with a next_rid of %u, z,the valid range is %u-%u. The default is %u.)r   r¡  r   z’You want to run SAMBA 4 on a domain and forest function level which itself is higher than its actual DC function level (2008_R2). This won't work!rŠ   ÚdomainFunctionalityÚforestFunctionalityr  zAdding DomainDN: %szobjectGUID: %s
-r   r‡   zprovision_basedn.ldif)rq  rz  Ú
DESCRIPTORZ
DOMAINGUIDzprovision_basedn_modify.ldif)	rq  Ú	CREATTIMEZNEXTRIDr  rr  r  ÚDOMAIN_FUNCTIONALITYr|  ZMIN_PWD_LENGTHzAdding configuration containerz#provision_configuration_basedn.ldif)rr  r¤  zlocal_oid:%s:0r‚  rƒ  zSetting up sam.ldb schemar„  zaggregate_schema.ldifrp  ZsubRefsz%Setting up sam.ldb configuration dataZ2008ú#zprovision_configuration.ldif)rr  rw  r  r  ZDOMAINrp  rq  rs  ZFOREST_FUNCTIONALITYr¦  ZNTDSQUOTAS_DESCRIPTORÚLOSTANDFOUND_DESCRIPTORZSERVICES_DESCRIPTORZPHYSICALLOCATIONS_DESCRIPTORZFORESTUPDATES_DESCRIPTORZEXTENDEDRIGHTS_DESCRIPTORZPARTITIONS_DESCRIPTORZSITES_DESCRIPTORzextended-rights.ldif)rr  ZINC2012zSetting up display specifiersz1display-specifiers/DisplaySpecifiers-Win2k8R2.txtrr  z0Modifying display specifiers and extended rightsz#provision_configuration_modify.ldif)rr  ZDISPLAYSPECIFIERS_DESCRIPTORzAdding users containerzprovision_users_add.ldif)rq  ZUSERS_DESCRIPTORzModifying users containerzprovision_users_modify.ldifrq  zAdding computers containerzprovision_computers_add.ldif)rq  ZCOMPUTERS_DESCRIPTORzModifying computers containerzprovision_computers_modify.ldifzSetting up sam.ldb datazprovision.ldifiX  )r¥  rq  rw  r  rr  rs  ZRIDAVAILABLESTARTr€  ZINFRASTRUCTURE_DESCRIPTORr¨  ZSYSTEM_DESCRIPTORZBUILTIN_DESCRIPTORZDOMAIN_CONTROLLERS_DESCRIPTORz'provision_configuration_references.ldif)rr  rp  z)Setting up well known security principalsz#provision_well_known_sec_princ.ldif)rr  ZWELLKNOWNPRINCIPALS_DESCRIPTORz provision_basedn_references.ldif)rq  ZMANAGEDSERVICE_DESCRIPTORz#Setting up sam.ldb users and groupszprovision_users.ldifrt  )rq  rz  ZADMINPASS_B64ZKRBTGTPASS_B64zSetting up self join)r·   r‰  rŒ  r³   rŠ  rR  rv   r‹  r  r  rŽ  r  r©   r‹   )r¸   Ú	attributer|   r~   )Jr¤   r   rœ  r¨   Zset_opaque_integerZset_domain_sidrŸ   rv   Zset_invocation_idrâ   ri   r   r‡  rx   r   r.   r£   r;   r:   r<   rš   Zunix2nttimer«   Útimert   rj   r   ÚDEFAULT_MIN_PWD_LENGTHr=   r'   ZdsdbZ&DSDB_CONTROL_SKIP_DUPLICATES_CHECK_OIDZadd_ldifZschema_dn_addZmodify_ldifZschema_dn_modifyZwrite_prefixes_from_schemaZschema_datark   r   rÃ   r¢   rÄ   rÆ   Zinvocation_idr(   r)   r*   r+   r,   r-   Úbase_schemarq   ro   rr   r   r   r   r2   r1   r/   r5   r4   r0   r3   r9   r>   rN  r‘  Ú	searchoner¡   r©   r†  r   )1rS   r¶   r·   rä   r  rŽ  r‰  r–   Ú
krbtgtpassrR  r³   rŠ  rŒ  r©   r  rš  Údom_for_fun_levelr  r‹  r  rA  rB  Úerrorr  r¢  r£  rˆ  Zdomainguid_lineZdescrZignore_checks_oidZschema_controlsrU  Zpartitions_descrZsites_descrZntdsquotas_descrZprotected1_descrZprotected1wd_descrZprotected2_descrZ	incl_2012Zdisplay_specifiers_ldifZ
users_descZcomputers_descZinfrastructure_descZlostandfound_descZsystem_descZbuiltin_descZcontrollers_descZmanagedservice_descrZntds_dnr_   r_   r`   Ú
fill_samdbF  s¶   ÿ



ü
÷


þý

þÿ


î
þ
ÿÿ

þÿ

þ

ÿ

þ
ÿÿ


ó
þÿ

þýþÿ

üû

õ
ÿÿr±  zkO:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)zƒO:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001301bf;;;PA)rþ   c                 C   sš   t ƒ }t|| ||||d||d	 tj| ddD ]f\}}	}
|
D ](}t|tj ||¡||||d||d	 q<|	D ](}t|tj ||¡||||d||d	 qjq.d S )NT©r+  Zskip_invalid_chownr   ÚserviceF©Útopdown)r   r    r   Úwalkrý   r  )rý   Úaclr¶   Zdomsidr+  r   r³  ræ   ró   ÚdirsÚfilesrë   r_   r_   r`   Úset_dir_aclS  s    ÿÿrº  c                 C   s¨   t j | |d¡}tƒ }	t||tt|ƒ|	|d|td	 |jd| ddgdt	j
d}
|
D ]N}ttj|d d	 ƒ ¡ }t| |t|d ƒƒ}t|t||ƒ|t|ƒ||d
 qTdS )án  Set ACL on the sysvol/<dnsname>/Policies folder and the policy
    folders beneath.

    :param sysvol: Physical path for the sysvol folder
    :param dnsdomain: The DNS name of the domain
    :param domainsid: The SID of the domain
    :param domaindn: The DN of the domain (ie. DC=...)
    :param samdb: An LDB object on the SAM db
    :param lp: an LP object
    r’  Tr²  úCN=Policies,CN=System,%srˆ   ÚnTSecurityDescriptorr   rM  r   ©r   N)r   rý   r  r   r    ÚPOLICIES_ACLrŸ   ÚSYSVOL_SERVICErœ   r   r§   r$   r   Ú
descriptorÚas_sddlr•  rº  r"   )rþ   ro   rv   ri   rS   r¶   r+  r   Úroot_policy_pathræ   r¹   Úpolicyr·  r”  r_   r_   r`   Úset_gpos_acl_  s$    ÿ
þ
ÿþrÅ  c
              
      sÒ  d‰ˆs~t  ¡ }
|
 ˆj¡ tjtj |¡d}z„zt	 
|jdtƒ |¡ W n* tyv   t	 ¡ sjtdƒ‚tdƒ‚Y n0 zt	 |j||tƒ ¡ W n tyª   tdƒ‚Y n0 W | ¡  n
| ¡  0 t  ¡ }
|
 ˆj¡ |
 dd| j ¡ t ¡  t |
 d¡¡‰t ¡ ˆ kr"td	t ¡ ˆ f ƒ‚ˆ ¡ }|d
 ˆ krLtd|d
 ˆ f ƒ‚|d  ¡ | ¡ kr~td|d  ¡ | ¡ f ƒ‚zˆr”t |d|¡ W n ty®   d}Y n0 d}d ˆ tj¡}tjtj B tj!B }tj"| ˆ||d‰tj#ˆˆd||d ‡ ‡‡‡‡fdd„}||ƒ tj$|ddD ]\}}}|D ]<}ˆrZ|rZt tj %||¡d|¡ |tj %||¡ƒ q2|D ]<}ˆrœ|rœt tj %||¡d|¡ |tj %||¡ƒ qtq$t&||ˆ || ˆˆˆd dS )áÝ  Set the ACL for the sysvol share and the subfolders

    :param samdb: An LDB object on the SAM db
    :param netlogon: Physical path for the netlogon folder
    :param sysvol: Physical path for the sysvol folder
    :param uid: The UID of the "Administrator" user
    :param gid: The GID of the "Domain adminstrators" group
    :param domainsid: The SID of the domain
    :param dnsdomain: The DNS name of the domain
    :param domaindn: The DN of the domain (ie. DC=...)
    N)Údiréí  z‘Samba was compiled without the posix ACL support that s3fs requires.  Try installing libacl1-dev or libacl-devel, then re-run configure and make.z‚Your filesystem or build does not support posix ACLs, which s3fs requires.  Try the mounting the filesystem with the 'acl' option.zUUnable to chown a file on your filesystem.  You may not be running provision as root.r  úsamba_dsdb:%súQSID as seen by smbd [%s] does not match SID as seen by the provision script [%s]!rª   ú[SID as seen by pdb_samba_dsdb [%s] does not match SID as seen by the provision script [%s]!Ú
dns_domainú_Realm as seen by pdb_samba_dsdb [%s] does not match Realm as seen by the provision script [%s]!éÿÿÿÿFTz<SID={}-{}>)rk  r’   Zsession_info_flagsZAdministrator)rk  Z	user_nameÚuidÚgidc                    s   t ˆ| ttˆ ƒˆˆdˆtd	S )zA helper to reuse argsTr²  )r    Ú
SYSVOL_ACLrŸ   rÀ  )rý   ©rv   r¶   Ú	s4_passdbræ   r+  r_   r`   Ú	_setntacl×  s
    ýzsetsysvolacl.<locals>._setntaclr´  r¾  )'Ús3paramÚget_contextr!  r  ÚtempfileZNamedTemporaryFiler   rý   r"  r
   Zset_simple_aclrë   r   r9  Zhave_posix_aclsr¤   Úchownr'  r#  r5  r   Zreload_static_pdbÚPDBr—   Úget_global_sam_sidÚdomain_infor˜   Úformatr   r®   r	   Z AUTH_SESSION_INFO_DEFAULT_GROUPSZAUTH_SESSION_INFO_AUTHENTICATEDZ#AUTH_SESSION_INFO_SIMPLE_PRIVILEGESZuser_sessionZsession_info_set_unixr¶  r  rÅ  )rS   rÿ   rþ   rÏ  rÐ  rv   ro   ri   r¶   r+  Ús3confÚfilerÛ  ZcanchownZuserdnrg  rÔ  ró   r¸  r¹  rë   r_   rÒ  r`   Úsetsysvolacl  s|    
ÿþ
ÿürß  c                 C   s   | rdS dS d S )NZDBZVFSr_   )Údirect_db_accessr_   r_   r`   Úacl_typeî  s    rá  c              	   C   sd  t ƒ }t|| ||td}| |¡}||krBtdt|ƒ| ||f ƒ‚tj| ddD ]\}}	}
|
D ]z}t|tj 	||¡||td}|d u r¦tdt|ƒtj 	||¡f ƒ‚| |¡}||kr`tdt|ƒtj 	||¡||f ƒ‚q`|	D ]|}t|tj 	||¡||td}|d u r(tdt|ƒtj 	||¡f ƒ‚| |¡}||kràtdt|ƒtj 	||¡||f ƒ‚qàqPd S )N©rà  r³  zN%s ACL on GPO directory %s %s does not match expected value %s from GPO objectFr´  z %s ACL on GPO file %s not found!zI%s ACL on GPO file %s %s does not match expected value %s from GPO objectz%%s ACL on GPO directory %s not found!)
r   r!   rÀ  rÂ  r¤   rá  r   r¶  rý   r  )rý   r·  r¶   rv   rà  ræ   ÚfsaclÚ
fsacl_sddlró   r¸  r¹  rë   r_   r_   r`   Úcheck_dir_aclõ  s@    
ÿÿÿ
$ÿ
ÿÿ
rå  c                 C   sÚ   t j | |d¡}tƒ }t||||td}	|	du rDtdt|ƒ|f ƒ‚|	 |¡}
|
t	krntdt|ƒ||
|	f ƒ‚|j
d| ddgd	tjd
}|D ]F}ttj|d d ƒ ¡ }t| |t|d ƒƒ}t|t||ƒ|||ƒ qŽdS )r»  r’  râ  Nz&DB ACL on policy root %s %s not found!zK%s ACL on policy root %s %s does not match expected value %s from provisionr¼  rˆ   r½  r   rM  r   )r   rý   r  r   r!   rÀ  r¤   rá  rÂ  r¿  rœ   r   r§   r$   r   rÁ  r•  rŸ   rå  r"   )rþ   ro   rv   ri   rS   r¶   rà  rÃ  ræ   rã  rä  r¹   rÄ  r·  r”  r_   r_   r`   Úcheck_gpos_acl  s,    ÿ

þ
ÿÿræ  c              	   C   sH  t  ¡ }| |j¡ | dd| j ¡ t | d¡¡}t 	¡ |krVt
dt 	¡ |f ƒ‚| ¡ }	|	d |kr~t
d|	d |f ƒ‚|	d  ¡ | ¡ kr®t
d|	d  ¡ | ¡ f ƒ‚tƒ }
dD ]Š}tj ||¡|fD ]^}t|||
|td	}|d
u rt
dt|ƒ|f ƒ‚| |¡}|tkrÎt
dt|ƒ||tf ƒ‚qÎt||||| ||ƒ q¸d
S )rÆ  r  rÉ  rÊ  rª   rË  rÌ  rÍ  )TFrâ  Nz(%s ACL on sysvol directory %s not found!zP%s ACL on sysvol directory %s %s does not match expected value %s from provision)rÕ  rÖ  r!  r  r#  r5  r   rÙ  r—   rÚ  r¤   rÛ  r˜   r   r   rý   r  r!   rÀ  rá  rÂ  rÑ  ræ  )rS   rÿ   rþ   rv   ro   ri   r¶   rÝ  rÓ  rÛ  ræ   rà  Zdir_pathrã  rä  r_   r_   r`   Úchecksysvolacl7  s.    

ÿrç  c                 C   s6   t  | |¡}g }|D ]}| d¡dkr| |¡ q|S )zreturn only IPv4 IPsú:rÎ  ©rš   Zinterface_ipsÚfindrÂ   )r¶   Zall_interfacesÚipsÚretrº   r_   r_   r`   Úinterface_ips_v4i  s    rí  c                 C   s6   t  | d¡}g }|D ]}| d¡dkr| |¡ q|S )zreturn only IPv6 IPsFrè  rÎ  ré  )r¶   rë  rì  rº   r_   r_   r`   Úinterface_ips_v6s  s    rî  r   c           '      C   sZ  |d u rt }| ¡ }|d u r t}| ¡ }|d u r<tt ¡ ƒ}|d u rPt dd¡}|d u rdt dd¡}|d u rxt dd¡}|  	¡  zRt
| ||||||||||||||||||
|||d} |dkrÐt|j|j||ƒ W n   |  ¡  ‚ Y n
0 |  ¡  |dkr>|s,t| |j|j|j|j|j|j|j||ƒ
 n
| d¡ t||j|j|j|j|j|td ttƒ}zPt t | | j dd|j tj!d	 "d
¡¡¡}tj#|tj$dd|d< |  %|¡ W n@ tj&yð }  z$| j'\}!}"|!tj(krÜ‚ W Y d } ~ n
d } ~ 0 0 t)| |||||||	||||||d | j |  *¡ dd "d
¡}t+|t,ƒs>J ‚t-| ƒ}#t.| t|j/ƒƒ}$|#d urrt0| d|$|dƒ nt1| d|$|ƒ | d¡ t2| t3dƒd|j4iƒ | d¡ t5| | ddddd}%|  	¡  zpdD ]$}&|%j6d|&|j7f tj8dgd qÌ|%j6d|j tj9g d¢d |%j6|j7tj!dd gddkr4t:d!ƒ‚W n   |  ¡  ‚ Y n
0 |  ¡  d S )"Né€   éÿ   )rä   r  r  rŽ  r‰  r–   r®  rŒ  rR  r³   rŠ  r©   r  r¯  rš  r‹  r  rA  rB  r  zSetting acl on sysvol skipped)rr   rp   ro   rq   rv   rR  rT  ZdistinguishedNamezsamAccountName=%s$)r|   r~   r‡   zmsDS-SupportedEncryptionTypes)Úelementsrg  rë   )ÚhostipÚhostip6r³   rŠ  Zos_levelr)  Z
fill_levelrA  r‹   )r¸   r©  r   r   z2Setting up sam.ldb rootDSE marking as synchronizedzprovision_rootdse_modify.ldifr}  zFixing provision GUIDsFT)Zsamdb_schemaÚverboseZfixÚyesÚquiet)z	CN=DomainzCN=Organizational-Personz
CN=ContactzCN=inetOrgPersonz%s,%sZdefaultObjectCategory)ZDNr~   r   zCN=IP Security,CN=System,%s)ZipsecOwnersReferenceZipsecFilterReferenceZipsecISAKMPReferenceZipsecNegotiationPolicyReferenceZipsecNFAReferenceZattributeIdZ	governsIdzFDuplicate attributeId or governsId in schema. Must be fixed manually!!);r¬   r˜   r­   rŸ   ÚuuidZuuid4rš   Z generate_random_machine_passwordÚgenerate_random_passwordr:  r±  r™  rþ   ro   r<  r=  rß  rÿ   rô   r¯   rv   ri   râ   rV  rr   rp   rq   r   r   r   rÃ   r¢   r­  rž   r£   rÄ   rÅ   rÇ   rÖ   r×   ZERR_NO_SUCH_ATTRIBUTErB   Zget_default_basednr†  r   rÜ   rÒ   rh   rÏ   rÑ   r<   r:   r©   rF   Zcheck_databaserk   r¡   r§   r¤   )'rS   rZ  rä   r·   rµ   r  r)  Ú
samdb_fillrò  ró  r‹  r  r–   r®  rx   r  rŽ  rŒ  rR  r©   r³   rŠ  r  r¯  rš  r¶   r+  Úskip_sysvolaclrA  rB  Zkerberos_enctypesrU  rÍ   ÚenumZestrZlastProvisionUSNsZmaxUSNZchkZ
schema_objr_   r_   r`   Úprovision_fill}  sâ    
öÿ
þ
ý
þþÿþ

ü
ÿÿ


ÿ
ÿþ
þÿÿrü  r  úmember serverr  )ZROLE_STANDALONEZROLE_DOMAIN_MEMBERZROLE_DOMAIN_BDCZROLE_DOMAIN_PDCZdcÚmemberzdomain controllerr  rý  Z
standaloner  c                 C   s*   z
t |  W S  ty$   t| ƒ‚Y n0 dS )zøSanitize a server role name.

    :param role: Server role
    :raise ValueError: If the role can not be interpreted
    :return: Sanitized server role (one of "member server",
        "active directory domain controller", "standalone server")
    N)Ú
_ROLES_MAPrê   Ú
ValueError)Zroler_   r_   r`   Úsanitize_server_role  s    
r  c                 C   sR   |  ¡  z&|  d¡ t|tdƒ|||dœƒ W n   | ¡  ‚ Y n
0 | ¡  dS )ztCreate AD entries for the fake ypserver.

    This is needed for being able to manipulate posix attrs via ADUC.
    z"Setting up fake yp server settingszypServ30.ldif)rq  rw  Z	NISDOMAINN)r:  râ   r;   r:   r<  r=  ©rä   rS   ri   rq   Z	nisdomainÚmaxuidÚmaxgidr_   r_   r`   Úprovision_fake_ypserver(  s    

ýr  rÈ  c              
   C   sh   t j | ¡sdzt  | |¡ W nF tyb } z.|jtjfv r<ntd| |jf ƒ‚W Y d }~n
d }~0 0 d S )Nz!Failed to create directory %s: %s)	r   rý   r   Úmkdirr9  ÚerrnoZEEXISTr¤   Ústrerror)rý   rh  rÍ   r_   r_   r`   Údirectory_create_or_exists=  s    r	  c                 C   sh   |d u rF|   d¡ t|ƒ}t|ƒdkrF|d }t|ƒdkrF|  d|¡ |dkrRd }|d u rd|  d¡ |S )NzLooking up IPv4 addressesr   r   z*More than one IPv4 address found. Using %sz	127.0.0.1z No IPv4 address will be assigned)râ   rí  r¦   Úwarning)rä   r¶   rò  Úhostipsr_   r_   r`   Údetermine_host_ipH  s    
ÿ
r  c                 C   sT   |d u r>|   d¡ t|ƒ}|r&|d }t|ƒdkr>|  d|¡ |d u rP|  d¡ |S )NzLooking up IPv6 addressesr   r   z*More than one IPv6 address found. Using %sz No IPv6 address will be assigned)râ   rî  r¦   r
  )rä   r¶   ró  r  r_   r_   r`   Údetermine_host_ip6Y  s    

r  TZ2012_R2c2           J      C   s  zt |#ƒ}#W n ty*   td|# ƒ‚Y n0 |du r@t dd¡}|/du rNtƒ }/|du r^t ¡ }t|pfdg| ƒ}2t	|pvdgƒ}3t
| p„dddd	gƒ}4t |2¡j}5zt
d
dgƒ}6W n tyÂ   d}6Y n0 |durÞtj |dd¡}n|du rðtj ¡ }tj tj |¡¡st tj |¡¡ g }7i }8|)r0dg|8d< |dkrF|7 d¡ n|durZ|g|8d< |(r€|7 d¡ |7 d¡ ddg|8d< t|7ƒdkr–|7|8d< tj |¡rt|dƒ}9z|9 ¡  ¡ }:W |9 ¡  n
|9 ¡  0 |:du sæ|:dkr t||||||#|%|(|'|8d
 nt||||||#|%|(|'|8d
 |'du r4tj ¡ }'|' |¡ t |'||||#||	||
|"||t!kd};t"|'|;j#ƒ}<|6|<_$|2|<_%|5|<_&t'| |'|ƒ}t(| |'|ƒ}||;_)||;_*||;_+||;_,||;_-|#du rÊ|' .d¡}#t/|<j0dƒ t/|<j1d ƒ t/tj |<j0d!¡ƒ t/|<j2ƒ |.st3|<j4ƒ |<j5r6tj |<j5¡s6t |<j5d"¡ d#t6|<j7dd$ }=t8|||;j9|-d%}>t:|<|'|;| d&}?|? ;¡  |? <¡  tj |<j=¡s²|  >d'¡ t?|<j=||'d(}@|@ @tAd)ƒ¡ |  >d*¡ tB|<||'d(}Azþ|  >d+¡ tC|<jD||'d, |  >d-¡ tE|<jF||'d, |  >d.¡ tG|<jH||'d(}BtI|BtJ|ƒ|2|3|4|5d/ |  >d0¡ tK|<jL||?|'|;| |#|>||&|.|/|0|1d1}C|#d2kr¼|<jMdu r†tNd3|<jOƒ‚|<j5du ržtNd4|<jOƒ‚tj P|<jM¡s¼t |<jMd5¡ |du rØt d6d7¡}d8}DntQ|tRƒrî| Sd9¡}d:}D|tTkr>tU|C|A| |;|<|>||||||||||||||||#|$|&|'|(|,|/|0d; tVƒ srtW|<jX||tj |' .d<¡¡ƒ |  >d=|<jX¡ tY|<jZ|;j#|;j[|;j\d> |  >d?|<jZ¡ |  >d@¡ |#d2kr¸t]|'| |<ƒ |? ^¡ }E|? _¡  W n   |A `¡  ‚ Y n0 |A a¡  tj |<j0|<jb¡}Ftj |<j1|<jb¡}Gtj c|F¡rxtj c|G¡rtzt d|G¡ W n: teyr }H z |  fdA|G|Hjgf ¡ W Y d}H~Hn
d}H~H0 0 zt h|F|G¡ W n< teyÀ }H z"|  fdB|F|G|Hjgf ¡ W Y d}H~Hn
d}H~H0 0 |<j$durxz$t i|<j1d ¡ t j|<j1dC|<j$¡ W n2 tey$   dDtjkvr |  >dE|<j1|<j$¡ Y n0 z t i|GdF¡ t j|GdC|<j$¡ W n0 teyv   dDtjkvrr|  >dE|G|<j$¡ Y n0 tlƒ }I|#|I_m||I_n|<|I_o|;|I_p|'|I_q|C|I_L|B|I_rtJ|ƒ|I_,|tTkrÊ|D|I_s||I_tnd:|I_sd|I_t|E|I_u|)rtv| |C|;jn|;jw|;jx y¡ |*|+dG |IS )HzHProvision samba4

    :note: caution, this wipes all existing data!
    zlserver role (%s) should be one of "active directory domain controller", "member server", "standalone server"Nrï  rð  ró   ÚnobodyÚusersÚotherZstaffZbindZnamedÚetczsmb.confrõ  zidmap_ldb:use rfc2307r•   z-dnszdns forwarderz+smbz-s3fsz+winregz+srvsvczdcerpc endpoint serversr   zserver servicesrÛ   r   )r  r*  r+  r¶   r,  )r¶   rs   rr   ro   r  ri   rj   rk   r¨   rt   rh   r  r  iÀ  iø  Ztlsr–  z
ldapi://%s)Zsafe)rŒ  rk   r¬  )rµ   r¶   r·   rä   zSetting up share.ldbrW  z
share.ldifzSetting up secrets.ldbzSetting up the registry)r¶   z"Setting up the privileges databasezSetting up idmap db)r1  rô   r2  r3  r¯   zSetting up SAM db)	rä   r  r  r‰  rš  r@  rA  rB  rž  r  rÿ   rþ   rÈ  é   é    TrL  F)r  r)  rù  rò  ró  r‹  r  r–   r®  r  rŽ  rŒ  rR  r©   r³   rŠ  r  r¯  rš  r¶   r+  rú  rA  rB  zlog filez<The Kerberos KDC configuration for Samba AD is located at %s)ro   rs   rp   zGA Kerberos configuration suitable for Samba AD has been generated at %szpMerge the contents of this file with your system krb5.conf or replace it with this one. Do not create a symlink!zFailed to remove %s: %sz"Failed to create link %s -> %s: %srÎ  ZSAMBA_SELFTESTz!Failed to chown %s to bind gid %ui   r  )zr  r   r¤   rš   rø  rH   r   Z
random_sidrõ   rð   rò   r°   r±   r²   rê   r   rý   r  r   Zdefault_pathr   Údirnamer—  rÂ   r¦   r$  ÚreadÚlstripr'  r0  r  r!  r  r@   r  ro   Úbind_gidrô   r¯   r  r  rò  ró  rx   rv   rw   r—   r	  rZ   r[   r\   rj  r  rþ   Úurllib_quoter  rD   rk   r%   ZinitÚstartrL   râ   r   rX  r:   r[  rn  rM   r\  r  ro  rT   r4  rŸ   rŸ  rS   rÿ   ÚMissingShareErrorru   Úisdirr†  r   r£   r=   rü  r   rG   r  Úcreate_krb5_confr  rs   rp   rC   Z
post_setupZshutdownr<  r=  rW   Úisfiler8  r9  r°  r  ÚlinkÚchmodrØ  ÚenvironrÝ   rÞ   ri   rµ   r·   r¶   rß   rà   r–   rá   r  rq   rr   r™   )Jrä   ræ   ru   r)  rù  rp   rh   ri   rk   rj   r¨   rr   rs   rò  ró  rv   r‹  r  r–   Zldapadminpassr®  rx   r  rŽ  r³   Zdns_forwarderrŠ  rŒ  rR  r©   ró   r  r  Úbackuprt   r  r¯  Zuseeadbrš  r¶   r+  Zuse_rfc2307r  r  rú  r¬  r@  rA  rB  rž  rô   r2  r3  r¯   r  Zserver_servicesr,  r-  Údatar·   rµ   Z	ldapi_urlr  r>  Z	share_ldbrZ  rß   rS   rà   rá   Zprivate_dns_keytab_pathrY  rÍ   Úresultr_   r_   r`   Ú	provisiong  sÂ   









ýþ



ý



ÿþ

ÿ



þ
ù	



óÿþÿ

ÿ
ÿÿ
ÿ


þr$  c                 C   s^   t  d¡}t |¡ t|tƒ | |t||||||||	d |
|d||||d}|j dt	|ƒ¡ |S )Nr$  r  )ru   r)  rù  rp   rh   ri   rk   rj   r¨   rr   rs   rò  rv   rR  r  rt   r³   rŠ  r+  Ú
debuglevel)
ÚloggingZ	getLoggerrš   Zset_debug_levelr$  r   r@   r¶   r#  rŸ   )ru   r)  rp   rh   ri   rk   rj   r¨   rr   rs   rv   r–   r®  rx   r  rŽ  rŒ  rR  rŠ  r³   ró   r  r  r!  r  rt   r%  r+  rä   r¹   r_   r_   r`   Úprovision_become_dc	  s    

ø	r'  c                 C   s   t tdƒ| |||dœƒ dS )zÐWrite out a file containing a valid krb5.conf file

    :param path: Path of the new krb5.conf file.
    :param dnsdomain: DNS Domain name
    :param hostname: Local hostname
    :param realm: Realm name
    rü   )r  r…  ZREALMN)r   r:   )rý   ro   rs   rp   r_   r_   r`   r  §	  s
    
ýr  c                   @   s    e Zd ZdZdd„ Zdd„ ZdS )r¤   zA generic provision error.c                 C   s
   || _ d S rK   ©Úvalue)r^   r)  r_   r_   r`   ra   ¹	  s    zProvisioningError.__init__c                 C   s
   d| j  S )NzProvisioningError: r(  r]   r_   r_   r`   Ú__str__¼	  s    zProvisioningError.__str__N)rc   rd   re   rå   ra   r*  r_   r_   r_   r`   r¤   ¶	  s   r¤   c                       s    e Zd ZdZ‡ fdd„Z‡  ZS )r  z.A specified name was not a valid NetBIOS name.c                    s   t t| ƒ d| ¡ d S )Nz)The name '%r' is not a valid NetBIOS name)Úsuperr  ra   )r^   rë   ©Ú	__class__r_   r`   ra   Ã	  s    
ÿzInvalidNetbiosName.__init__)rc   rd   re   rå   ra   Ú__classcell__r_   r_   r,  r`   r  À	  s   r  c                       s   e Zd Z‡ fdd„Z‡  ZS )r  c                    s   t t| ƒ d||f ¡ d S )NzwExisting smb.conf does not have a [%s] share, but you are configuring a DC. Please remove %s or add the share manually.)r+  r  ra   )r^   rë   ru   r,  r_   r`   ra   Ê	  s
    
þÿzMissingShareError.__init__)rc   rd   re   ra   r.  r_   r_   r,  r`   r  È	  s   r  )F)NNNNNNNNNNNF)NFFNN)FFNN)NN)FFNNF)FNNNNNN)F)rÈ  )N)N)NNNNNNNNNNNNNNNNNNNNNNNNNNr   F)°rå   Z__docformat__Zurllib.parser   r  Zsamba.compatr   r   Úbase64r   r  r   rb  rÁ   r°   rñ   r&  rª  r÷  r  r×  Z
samba.dsdbrš   r   Z
samba.authr   r   Zsamba.auth_utilr   r	   Zsamba.samba3r
   r   r   rÕ  r   r   r   r   r   r   r   r   r   r   Zsamba.dcerpcr   r   Zsamba.dcerpc.miscr   r   r   r   r   Zsamba.idmapr   Zsamba.ms_display_specifiersr   Zsamba.ntaclsr    r!   r"   Z	samba.ndrr#   r$   Zsamba.provision.backendr%   Zsamba.descriptorr&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r0   r1   r2   r3   r4   r5   r6   r7   r8   r9   Zsamba.provision.commonr:   r;   r<   r=   r>   r?   r@   Zsamba.provision.sambadnsrA   rB   rC   Zsamba.paramZsamba.registryZsamba.schemarD   Zsamba.samdbrE   Zsamba.dbcheckerrF   Zsamba.provision.kerberosrG   rH   r¬   r­   r  rÀ   r«  ÚobjectrJ   rf   r»   rÏ   rÑ   rÒ   rÜ   rÝ   ré   rì   rð   rò   rõ   r  r  r  r0  r4  rC  rV  r[  r\  rj  rn  ro  r;  r‘  r•  r˜  r™  r›  rŸ  r±  rÑ  r¿  rÀ  rº  rÅ  rß  rá  rå  ræ  rç  rí  rî  rü  rÿ  r  r  r	  r  r  r$  r'  r  rè   r¤   r  r  r_   r_   r_   r`   Ú<module>   sd  ,X$	 #
))&
0    ý
v  þ
f  ý
Jû
Z* ý
b   ý
D    û
  
 o#2

õ
 õ



ò
  *       ú

