def generate_smb4_conf(client, smb4_conf, role): cifs = Struct(client.call('smb.config')) if not cifs.guest: cifs.guest = 'ftp' if not cifs.filemask: cifs.filemask = "0666" if not cifs.dirmask: cifs.dirmask = "0777" # standard stuff... should probably do this differently confset1(smb4_conf, "[global]", space=0) if os.path.exists("/usr/local/etc/smbusers"): confset1(smb4_conf, "username map = /usr/local/etc/smbusers") server_min_protocol = fs().services.smb.config.server_min_protocol if server_min_protocol != 'NONE': confset2(smb4_conf, "server min protocol = %s", server_min_protocol) server_max_protocol = fs().services.smb.config.server_max_protocol if server_max_protocol != 'NONE': confset2(smb4_conf, "server max protocol = %s", server_max_protocol) if cifs.bindip: interfaces = [] bindips = ' '.join(cifs.bindip) if role != 'dc': bindips = "127.0.0.1 %s" % bindips bindips = bindips.split() for bindip in bindips: if not bindip: continue bindip = bindip.strip() iface = client.call('notifier.get_interface', bindip) is_carp_interface = False if iface: try: is_carp_interface = client.call('notifier.is_carp_interface', iface) except: pass if iface and is_carp_interface: parent_iface = client.call('notifier.get_parent_interface', iface) if not parent_iface: continue parent_iinfo = client.call('notifier.get_interface_info', parent_iface[0]) if not parent_iinfo: continue interfaces.append("%s/%s" % (bindip, parent_iface[2])) else: interfaces.append(bindip) if interfaces: confset2(smb4_conf, "interfaces = %s", ' '.join(interfaces)) confset1(smb4_conf, "bind interfaces only = yes") confset1(smb4_conf, "encrypt passwords = yes") confset1(smb4_conf, "dns proxy = no") confset1(smb4_conf, "strict locking = no") confset1(smb4_conf, "oplocks = yes") confset1(smb4_conf, "deadtime = 15") confset1(smb4_conf, "max log size = 51200") confset2(smb4_conf, "max open files = %d", int(get_sysctl('kern.maxfilesperproc')) - 25) if cifs.loglevel and cifs.loglevel is not True: loglevel = cifs.loglevel else: loglevel = "0" if cifs.syslog: confset1(smb4_conf, "logging = syslog:%s" % loglevel) else: confset1(smb4_conf, "logging = file") confset1(smb4_conf, "load printers = no") confset1(smb4_conf, "printing = bsd") confset1(smb4_conf, "printcap name = /dev/null") confset1(smb4_conf, "disable spoolss = yes") confset1(smb4_conf, "getwd cache = yes") confset2(smb4_conf, "guest account = %s", cifs.guest) confset1(smb4_conf, "map to guest = Bad User") confset2(smb4_conf, "obey pam restrictions = %s", "yes" if cifs.obey_pam_restrictions else "no") confset2(smb4_conf, "ntlm auth = %s", "yes" if cifs.ntlmv1_auth else "no") confset1(smb4_conf, "directory name cache size = 0") confset1(smb4_conf, "kernel change notify = no") confset1(smb4_conf, "panic action = /usr/local/libexec/samba/samba-backtrace") confset1(smb4_conf, "nsupdate command = /usr/local/bin/samba-nsupdate -g") confset2(smb4_conf, "server string = %s", cifs.description) confset1(smb4_conf, "ea support = yes") confset1(smb4_conf, "store dos attributes = yes") confset1(smb4_conf, "lm announce = yes") confset2(smb4_conf, "hostname lookups = %s", "yes" if cifs.hostlookup else False) confset2(smb4_conf, "unix extensions = %s", "no" if not cifs.unixext else False) confset2(smb4_conf, "time server = %s", "yes" if cifs.timeserver else False) confset2(smb4_conf, "null passwords = %s", "yes" if cifs.nullpw else False) confset2(smb4_conf, "acl allow execute always = %s", "true" if cifs.allow_execute_always else "false") confset1(smb4_conf, "dos filemode = yes") confset2(smb4_conf, "multicast dns register = %s", "yes" if cifs.zeroconf else "no") if not smb4_ldap_enabled(client): confset2(smb4_conf, "domain logons = %s", "yes" if cifs.domain_logons else "no") if not client.call('notifier.common', 'system', 'activedirectory_enabled'): confset2(smb4_conf, "local master = %s", "yes" if cifs.localmaster else "no") if not smb4_autorid_enabled(client): # 5 = DS_TYPE_CIFS idmap = Struct(client.call('notifier.ds_get_idmap_object', 5, cifs.id, 'tdb')) configure_idmap_backend(client, smb4_conf, idmap, None) if role == 'auto': confset1(smb4_conf, "server role = auto") elif role == 'classic': confset1(smb4_conf, "server role = classic primary domain controller") elif role == 'netbios': confset1(smb4_conf, "server role = netbios backup domain controller") elif role == 'dc': confset1(smb4_conf, "server role = active directory domain controller") add_domaincontroller_conf(client, smb4_conf) elif role == 'member': confset1(smb4_conf, "server role = member server") if smb4_ldap_enabled(client): add_ldap_conf(client, smb4_conf) elif client.call('notifier.common', 'system', 'activedirectory_enabled'): add_activedirectory_conf(client, smb4_conf) confset2(smb4_conf, "netbios name = %s", cifs.netbiosname.upper()) if cifs.netbiosalias: confset2(smb4_conf, "netbios aliases = %s", cifs.netbiosalias.upper()) elif role == 'standalone': confset1(smb4_conf, "server role = standalone") confset2(smb4_conf, "netbios name = %s", cifs.netbiosname.upper()) if cifs.netbiosalias: confset2(smb4_conf, "netbios aliases = %s", cifs.netbiosalias.upper()) confset2(smb4_conf, "workgroup = %s", cifs.workgroup.upper()) confset1(smb4_conf, "security = user") confset2(smb4_conf, "create mask = %s", cifs.filemask) confset2(smb4_conf, "directory mask = %s", cifs.dirmask) confset2(smb4_conf, "client ntlmv2 auth = %s", "yes" if not cifs.ntlmv1_auth else "no") confset2(smb4_conf, "dos charset = %s", cifs.doscharset) confset2(smb4_conf, "unix charset = %s", cifs.unixcharset) if cifs.loglevel and cifs.loglevel is not True: confset2(smb4_conf, "log level = %s", cifs.loglevel) smb_options = cifs.smb_options.strip() for line in smb_options.split('\n'): line = line.strip() if not line: continue confset1(smb4_conf, line)
def main(): client = Client() realms = client.call('datastore.query', 'directoryservice.KerberosRealm') try: settings = client.call('datastore.query', 'directoryservice.KerberosSettings') if settings: settings = Struct(settings[0]) else: settings = None except: settings = None default_realm = None if len(sys.argv) == 3 and sys.argv[1].lower() == 'default': default_realm = sys.argv[2].upper() kc = KerberosConfig(settings=settings, default_realm=default_realm) kc.create_default_config() ad = ldap = None ldap_objects = client.call('datastore.query', 'directoryservice.LDAP') if ldap_objects and ldap_objects[0]['ldap_enable']: ldap = Struct(client.call('notifier.directoryservice', 'LDAP', timeout=fs().directoryservice.kerberos.timeout.start)) ad_objects = client.call('datastore.query', 'directoryservice.ActiveDirectory') if ad_objects and ad_objects[0]['ad_enable']: ad = Struct(client.call('notifier.directoryservice', 'AD', timeout=fs().directoryservice.kerberos.timeout.start)) for kr in realms: kr = Struct(kr) if not kr.krb_realm: continue krb_kdc, krb_admin_server, krb_kpasswd_server = get_kerberos_servers( kr, ad, ldap ) bc = KerberosConfigBindingCollection(name=kr.krb_realm) if krb_kdc: bc.append( KerberosConfigBinding( name="kdc", value=krb_kdc ) ) if krb_admin_server: bc.append( KerberosConfigBinding( name="admin_server", value=krb_admin_server ) ) if krb_kpasswd_server: bc.append( KerberosConfigBinding( name="kpasswd_server", value=krb_kpasswd_server ) ) bc.append( KerberosConfigBinding( name="default_domain", value=kr.krb_realm ) ) kc.add_bindings(['realms'], bc) bc = KerberosConfigBindingCollection() bc.append( KerberosConfigBinding( name=kr.krb_realm.lower(), value=kr.krb_realm.upper() ) ) bc.append( KerberosConfigBinding( name=".%s" % kr.krb_realm.lower(), value=kr.krb_realm.upper() ) ) bc.append( KerberosConfigBinding( name=kr.krb_realm.upper(), value=kr.krb_realm.upper() ) ) bc.append( KerberosConfigBinding( name=".%s" % kr.krb_realm.upper(), value=kr.krb_realm.upper() ) ) kc.add_bindings(['domain_realm'], bc) fp = open("/etc/krb5.conf", "w+") kc.generate_krb5_conf(stdout=fp) fp.close()
def main(): client = Client() realms = client.call('datastore.query', 'directoryservice.KerberosRealm') try: settings = client.call('datastore.query', 'directoryservice.KerberosSettings') if settings: settings = Struct(settings[0]) else: settings = None except: settings = None default_realm = None if len(sys.argv) == 3 and sys.argv[1].lower() == 'default': default_realm = sys.argv[2].upper() kc = KerberosConfig(settings=settings, default_realm=default_realm) kc.create_default_config() ad = ldap = None ldap_objects = client.call('datastore.query', 'directoryservice.LDAP') if ldap_objects and ldap_objects[0]['ldap_enable']: ldap = Struct( client.call('notifier.directoryservice', 'LDAP', timeout=fs().directoryservice.kerberos.timeout.start)) ad_objects = client.call('datastore.query', 'directoryservice.ActiveDirectory') if ad_objects and ad_objects[0]['ad_enable']: ad = Struct( client.call('notifier.directoryservice', 'AD', timeout=fs().directoryservice.kerberos.timeout.start)) for kr in realms: kr = Struct(kr) if not kr.krb_realm: continue krb_kdc, krb_admin_server, krb_kpasswd_server = get_kerberos_servers( kr, ad, ldap) bc = KerberosConfigBindingCollection(name=kr.krb_realm) if krb_kdc: bc.append(KerberosConfigBinding(name="kdc", value=krb_kdc)) if krb_admin_server: bc.append( KerberosConfigBinding(name="admin_server", value=krb_admin_server)) if krb_kpasswd_server: bc.append( KerberosConfigBinding(name="kpasswd_server", value=krb_kpasswd_server)) bc.append( KerberosConfigBinding(name="default_domain", value=kr.krb_realm)) kc.add_bindings(['realms'], bc) bc = KerberosConfigBindingCollection() bc.append( KerberosConfigBinding(name=kr.krb_realm.lower(), value=kr.krb_realm.upper())) bc.append( KerberosConfigBinding(name=".%s" % kr.krb_realm.lower(), value=kr.krb_realm.upper())) bc.append( KerberosConfigBinding(name=kr.krb_realm.upper(), value=kr.krb_realm.upper())) bc.append( KerberosConfigBinding(name=".%s" % kr.krb_realm.upper(), value=kr.krb_realm.upper())) kc.add_bindings(['domain_realm'], bc) fp = open("/etc/krb5.conf", "w+") kc.generate_krb5_conf(stdout=fp) fp.close()