def generate_smb4_conf(client, smb4_conf, role):
cifs = Struct(client.call('smb.config'))
if not cifs.guest:
cifs.guest = 'ftp'
if not cifs.filemask:
cifs.filemask = "0666"
if not cifs.dirmask:
cifs.dirmask = "0777"
# standard stuff... should probably do this differently
confset1(smb4_conf, "[global]", space=0)
if os.path.exists("/usr/local/etc/smbusers"):
confset1(smb4_conf, "username map = /usr/local/etc/smbusers")
server_min_protocol = fs().services.smb.config.server_min_protocol
if server_min_protocol != 'NONE':
confset2(smb4_conf, "server min protocol = %s", server_min_protocol)
server_max_protocol = fs().services.smb.config.server_max_protocol
if server_max_protocol != 'NONE':
confset2(smb4_conf, "server max protocol = %s", server_max_protocol)
if cifs.bindip:
interfaces = []
bindips = ' '.join(cifs.bindip)
if role != 'dc':
bindips = "127.0.0.1 %s" % bindips
bindips = bindips.split()
for bindip in bindips:
if not bindip:
continue
bindip = bindip.strip()
iface = client.call('notifier.get_interface', bindip)
is_carp_interface = False
if iface:
try:
is_carp_interface = client.call('notifier.is_carp_interface', iface)
except:
pass
if iface and is_carp_interface:
parent_iface = client.call('notifier.get_parent_interface', iface)
if not parent_iface:
continue
parent_iinfo = client.call('notifier.get_interface_info', parent_iface[0])
if not parent_iinfo:
continue
interfaces.append("%s/%s" % (bindip, parent_iface[2]))
else:
interfaces.append(bindip)
if interfaces:
confset2(smb4_conf, "interfaces = %s", ' '.join(interfaces))
confset1(smb4_conf, "bind interfaces only = yes")
confset1(smb4_conf, "encrypt passwords = yes")
confset1(smb4_conf, "dns proxy = no")
confset1(smb4_conf, "strict locking = no")
confset1(smb4_conf, "oplocks = yes")
confset1(smb4_conf, "deadtime = 15")
confset1(smb4_conf, "max log size = 51200")
confset2(smb4_conf, "max open files = %d",
int(get_sysctl('kern.maxfilesperproc')) - 25)
if cifs.loglevel and cifs.loglevel is not True:
loglevel = cifs.loglevel
else:
loglevel = "0"
if cifs.syslog:
confset1(smb4_conf, "logging = syslog:%s" % loglevel)
else:
confset1(smb4_conf, "logging = file")
confset1(smb4_conf, "load printers = no")
confset1(smb4_conf, "printing = bsd")
confset1(smb4_conf, "printcap name = /dev/null")
confset1(smb4_conf, "disable spoolss = yes")
confset1(smb4_conf, "getwd cache = yes")
confset2(smb4_conf, "guest account = %s", cifs.guest)
confset1(smb4_conf, "map to guest = Bad User")
confset2(smb4_conf, "obey pam restrictions = %s",
"yes" if cifs.obey_pam_restrictions else "no")
confset2(smb4_conf, "ntlm auth = %s",
"yes" if cifs.ntlmv1_auth else "no")
confset1(smb4_conf, "directory name cache size = 0")
confset1(smb4_conf, "kernel change notify = no")
confset1(smb4_conf,
"panic action = /usr/local/libexec/samba/samba-backtrace")
confset1(smb4_conf, "nsupdate command = /usr/local/bin/samba-nsupdate -g")
confset2(smb4_conf, "server string = %s", cifs.description)
confset1(smb4_conf, "ea support = yes")
confset1(smb4_conf, "store dos attributes = yes")
confset1(smb4_conf, "lm announce = yes")
confset2(smb4_conf, "hostname lookups = %s",
"yes" if cifs.hostlookup else False)
confset2(smb4_conf, "unix extensions = %s",
"no" if not cifs.unixext else False)
confset2(smb4_conf, "time server = %s",
"yes" if cifs.timeserver else False)
confset2(smb4_conf, "null passwords = %s",
"yes" if cifs.nullpw else False)
confset2(smb4_conf, "acl allow execute always = %s",
"true" if cifs.allow_execute_always else "false")
confset1(smb4_conf, "dos filemode = yes")
confset2(smb4_conf, "multicast dns register = %s",
"yes" if cifs.zeroconf else "no")
if not smb4_ldap_enabled(client):
confset2(smb4_conf, "domain logons = %s",
"yes" if cifs.domain_logons else "no")
if not client.call('notifier.common', 'system', 'activedirectory_enabled'):
confset2(smb4_conf, "local master = %s",
"yes" if cifs.localmaster else "no")
if not smb4_autorid_enabled(client):
# 5 = DS_TYPE_CIFS
idmap = Struct(client.call('notifier.ds_get_idmap_object', 5, cifs.id, 'tdb'))
configure_idmap_backend(client, smb4_conf, idmap, None)
if role == 'auto':
confset1(smb4_conf, "server role = auto")
elif role == 'classic':
confset1(smb4_conf, "server role = classic primary domain controller")
elif role == 'netbios':
confset1(smb4_conf, "server role = netbios backup domain controller")
elif role == 'dc':
confset1(smb4_conf, "server role = active directory domain controller")
add_domaincontroller_conf(client, smb4_conf)
elif role == 'member':
confset1(smb4_conf, "server role = member server")
if smb4_ldap_enabled(client):
add_ldap_conf(client, smb4_conf)
elif client.call('notifier.common', 'system', 'activedirectory_enabled'):
add_activedirectory_conf(client, smb4_conf)
confset2(smb4_conf, "netbios name = %s", cifs.netbiosname.upper())
if cifs.netbiosalias:
confset2(smb4_conf, "netbios aliases = %s", cifs.netbiosalias.upper())
elif role == 'standalone':
confset1(smb4_conf, "server role = standalone")
confset2(smb4_conf, "netbios name = %s", cifs.netbiosname.upper())
if cifs.netbiosalias:
confset2(smb4_conf, "netbios aliases = %s", cifs.netbiosalias.upper())
confset2(smb4_conf, "workgroup = %s", cifs.workgroup.upper())
confset1(smb4_conf, "security = user")
confset2(smb4_conf, "create mask = %s", cifs.filemask)
confset2(smb4_conf, "directory mask = %s", cifs.dirmask)
confset2(smb4_conf, "client ntlmv2 auth = %s",
"yes" if not cifs.ntlmv1_auth else "no")
confset2(smb4_conf, "dos charset = %s", cifs.doscharset)
confset2(smb4_conf, "unix charset = %s", cifs.unixcharset)
if cifs.loglevel and cifs.loglevel is not True:
confset2(smb4_conf, "log level = %s", cifs.loglevel)
smb_options = cifs.smb_options.strip()
for line in smb_options.split('\n'):
line = line.strip()
if not line:
continue
confset1(smb4_conf, line)
def main():
client = Client()
realms = client.call('datastore.query', 'directoryservice.KerberosRealm')
try:
settings = client.call('datastore.query', 'directoryservice.KerberosSettings')
if settings:
settings = Struct(settings[0])
else:
settings = None
except:
settings = None
default_realm = None
if len(sys.argv) == 3 and sys.argv[1].lower() == 'default':
default_realm = sys.argv[2].upper()
kc = KerberosConfig(settings=settings, default_realm=default_realm)
kc.create_default_config()
ad = ldap = None
ldap_objects = client.call('datastore.query', 'directoryservice.LDAP')
if ldap_objects and ldap_objects[0]['ldap_enable']:
ldap = Struct(client.call('notifier.directoryservice', 'LDAP',
timeout=fs().directoryservice.kerberos.timeout.start))
ad_objects = client.call('datastore.query', 'directoryservice.ActiveDirectory')
if ad_objects and ad_objects[0]['ad_enable']:
ad = Struct(client.call('notifier.directoryservice', 'AD',
timeout=fs().directoryservice.kerberos.timeout.start))
for kr in realms:
kr = Struct(kr)
if not kr.krb_realm:
continue
krb_kdc, krb_admin_server, krb_kpasswd_server = get_kerberos_servers(
kr, ad, ldap
)
bc = KerberosConfigBindingCollection(name=kr.krb_realm)
if krb_kdc:
bc.append(
KerberosConfigBinding(
name="kdc", value=krb_kdc
)
)
if krb_admin_server:
bc.append(
KerberosConfigBinding(
name="admin_server", value=krb_admin_server
)
)
if krb_kpasswd_server:
bc.append(
KerberosConfigBinding(
name="kpasswd_server", value=krb_kpasswd_server
)
)
bc.append(
KerberosConfigBinding(
name="default_domain", value=kr.krb_realm
)
)
kc.add_bindings(['realms'], bc)
bc = KerberosConfigBindingCollection()
bc.append(
KerberosConfigBinding(
name=kr.krb_realm.lower(), value=kr.krb_realm.upper()
)
)
bc.append(
KerberosConfigBinding(
name=".%s" % kr.krb_realm.lower(), value=kr.krb_realm.upper()
)
)
bc.append(
KerberosConfigBinding(
name=kr.krb_realm.upper(), value=kr.krb_realm.upper()
)
)
bc.append(
KerberosConfigBinding(
name=".%s" % kr.krb_realm.upper(), value=kr.krb_realm.upper()
)
)
kc.add_bindings(['domain_realm'], bc)
fp = open("/etc/krb5.conf", "w+")
kc.generate_krb5_conf(stdout=fp)
fp.close()
def main():
client = Client()
realms = client.call('datastore.query', 'directoryservice.KerberosRealm')
try:
settings = client.call('datastore.query',
'directoryservice.KerberosSettings')
if settings:
settings = Struct(settings[0])
else:
settings = None
except:
settings = None
default_realm = None
if len(sys.argv) == 3 and sys.argv[1].lower() == 'default':
default_realm = sys.argv[2].upper()
kc = KerberosConfig(settings=settings, default_realm=default_realm)
kc.create_default_config()
ad = ldap = None
ldap_objects = client.call('datastore.query', 'directoryservice.LDAP')
if ldap_objects and ldap_objects[0]['ldap_enable']:
ldap = Struct(
client.call('notifier.directoryservice',
'LDAP',
timeout=fs().directoryservice.kerberos.timeout.start))
ad_objects = client.call('datastore.query',
'directoryservice.ActiveDirectory')
if ad_objects and ad_objects[0]['ad_enable']:
ad = Struct(
client.call('notifier.directoryservice',
'AD',
timeout=fs().directoryservice.kerberos.timeout.start))
for kr in realms:
kr = Struct(kr)
if not kr.krb_realm:
continue
krb_kdc, krb_admin_server, krb_kpasswd_server = get_kerberos_servers(
kr, ad, ldap)
bc = KerberosConfigBindingCollection(name=kr.krb_realm)
if krb_kdc:
bc.append(KerberosConfigBinding(name="kdc", value=krb_kdc))
if krb_admin_server:
bc.append(
KerberosConfigBinding(name="admin_server",
value=krb_admin_server))
if krb_kpasswd_server:
bc.append(
KerberosConfigBinding(name="kpasswd_server",
value=krb_kpasswd_server))
bc.append(
KerberosConfigBinding(name="default_domain", value=kr.krb_realm))
kc.add_bindings(['realms'], bc)
bc = KerberosConfigBindingCollection()
bc.append(
KerberosConfigBinding(name=kr.krb_realm.lower(),
value=kr.krb_realm.upper()))
bc.append(
KerberosConfigBinding(name=".%s" % kr.krb_realm.lower(),
value=kr.krb_realm.upper()))
bc.append(
KerberosConfigBinding(name=kr.krb_realm.upper(),
value=kr.krb_realm.upper()))
bc.append(
KerberosConfigBinding(name=".%s" % kr.krb_realm.upper(),
value=kr.krb_realm.upper()))
kc.add_bindings(['domain_realm'], bc)
fp = open("/etc/krb5.conf", "w+")
kc.generate_krb5_conf(stdout=fp)
fp.close()
