+ 4Ssi.<RtRt^RIHt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI t ^RIt^RIt^RIt^RIHtHt^RIHt^RIt^RIHt^RIHtHt^RIHt^R IHtHtHtH t H!t!H"t"H#t#H$t$H%t%^R I&H't'H(t(^R I)H*t*H+t+^R IH,t,H-t-H.t.H/t/H0t0H1t1H2t2^R I3H4t4H5t5^RI6H7t7^RI8H9t9^RI:H;t;HH?t?^RI@HAtAHBtB^RICHDtD^RIEHFtFHGtGHHtHHItIHJtJHKtKHLtLHMtMHNtNHOtOHPtPHQtQHRtRHStSHTtTHUtUHVtV^RIWHXtXHYtYHZtZH[t[H\t\H]t]^RI^H_t_H`t`HataHbtb^RIct^RIdt^RIeHftf^RIgHhth^RIiHjtj^RIkHltl^RIgHmtm^RIHntnRtoRtpRtqR tr^ts!R!R"]t4tu!R#R$]t4tvR%twRmR'ltxR(tyR)tzR*t{!R+R,]t4t|R-t}R.t~R/tR0tR1tR2tRnR3ltRoR4ltR5tRpR6ltRRR^]+3R7ltR8tR9tR:tR;tR<tR=tRqR>ltR?tR@tRAtRrtRsRBltRtRCltRDtREtRFt]3RGltRHtRItRJtRKtRLtRMtRmRNltROtR][RRRPRRRRRRRRRRRRRRR&R&3RQltRRRSRTRURVRWRXRWRYRWRZRUR[RWRWRWRURUR\RSRSRS/ tR]tR^tRuR_ltRvR`ltRvRaltRR][RRRRRRRRRRRRPRRRRRRRRRRRRRRRRRRRR&R&RR&R&RbRc]1R&RRR&3.RdltRwReltRft!RgRh]4t!RiRj]4t!RkRl]4tR#)xz/Functions for setting up a Samba configuration.restructuredText) b64encodeN)system_session admin_session)system_session_unix)auth)smbdpassdb)param) LdbMAX_NETBIOS_NAME_LENcheck_all_substitutedis_valid_netbios_char setup_filesubstitute_varvalid_netbios_nameversionis_heimdal_built)securitymisc) SEC_CHAN_BDCSEC_CHAN_WKSTA)DS_DOMAIN_FUNCTION_2000DS_DOMAIN_FUNCTION_2008DS_DOMAIN_FUNCTION_2008_R2DS_DOMAIN_FUNCTION_2012DS_DOMAIN_FUNCTION_2012_R2DS_DOMAIN_FUNCTION_2016 ENC_ALL_TYPES)KEY_CYCLE_DURATIONMAX_CLOCK_SKEW)IDmapDB) read_ms_ldif)setntaclgetntacl dsacl2fsacl)nt_now)ndr_pack ndr_unpack) LDBBackend)get_deletedobjects_descriptorget_config_descriptor get_config_partitions_descriptorget_config_sites_descriptor!get_config_ntds_quotas_descriptor'get_config_delete_protected1_descriptor)get_config_delete_protected1wd_descriptor'get_config_delete_protected2_descriptorget_domain_descriptor$get_domain_infrastructure_descriptorget_domain_builtin_descriptorget_domain_computers_descriptorget_domain_users_descriptor!get_domain_controllers_descriptor'get_domain_delete_protected1_descriptor'get_domain_delete_protected2_descriptor'get_managed_service_accounts_descriptor) setup_pathsetup_add_ldifsetup_modify_ldif FILL_FULLFILL_SUBDOMAINFILL_DRS)get_dnsadmins_sid setup_ad_dnscreate_dns_dir_keytab_linkcreate_dns_update_list)Schema)SamDB)dbcheck)create_kdc_conf)get_default_backend_store)functional_levelz$31B2F340-016D-11D2-945F-00C04FB984F9z$6AC1786C-016F-11D2-945F-00C04FB984F9zDefault-First-Site-NamelastProvisionUSNc&a]tRt^toRtRtVtR#)ProvisionPathscRVnRVnRVnRVnRVnRVnRVnRVnRVnRVn RVn RVn RVn RVn RVnRVnRVnR#N) shareconfhklmhkcuhkcrhkuhkpdhkptsamdbidmapdbsecretskeytab dns_keytabdnswinsdb private_dir binddns_dir state_dirselfs&:/usr/lib/python3/dist-packages/samba/provision/__init__.py__init__ProvisionPaths.__init__s{          )r_r\r[rSrRrQrUrVrTrXrZr^rWrYrPr`r]N__name__ __module__ __qualname____firstlineno__rd__static_attributes____classdictcell__ __classdict__s@rcrMrMsrfrMc&a]tRt^toRtRtVtR#)ProvisionNamescRVnRVnRVnRVnRVnRVnRVnRVnRVnRVn RVn RVn RVn RVn RVnRVnRVnRVn/VnR#rO)ncsrootdndomaindnconfigdnschemadn dnsforestdn dnsdomaindn ldapmanagerdn dnsdomainrealm netbiosnamedomainhostnamesitenamesmbconf domainsid forestsid domainguidname_mapras&rcrdProvisionNames.__init__s    !      rf)rvr{ryrxr~rurrrrrzrrsr}r|rtrwrrNrgrns@rcrqrqsrfrqc (\4pRVnVPR4P4VnVPR4VnVP P 4Vn\P!VP4pVP P4VnVPRVP,R\PR.R7p\V^,R,4PRR 4VnWFnVPR R \P".RAOR7p \V ^,R ,^,4Vn\V ^,R ,^,4Vn\P(!W4\P(!VV ^,R ,^,P+R448Xg^\-RVP.: R\V ^,R ,^,P+R44: RVP : RV: R2 4h\V ^,R ,^,4Vn\V ^,R,^,4VnV ^,R,VnRVnRVn\;^\=VP444Fsp \VP4V ,4p R\VP24,p W8Xd WnKIR\VP04,p W8XgKmWnKu VPRR\VP$4,\P>R.R7p\V^,R,4Vn VPRVP,RV,\P>R.R7p\=V4^8Xd\-RVP: RV: 24h\V^,R,4PRVP,R 4Vn!VPR V^,PD,.VP$R!7p\V^,PD4Vn#VPR R"\VPF4,\P"R#R$.R7p\\I\JPLV^,R%,^,44Vn'\\I\JPLV^,R$,^,44Vn(VPR V\P".RBOR7p\\I\JPLV^,R$,^,44Vn)\I\TPVV^,R&,^,4Vn,\I\TPVV^,R&,^,4Vn-V^,PR'4e*\]V^,R',^,4\^8d \^Vn0M%\]V^,R',^,4Vn0VPR(\b,R)V,\P>RR*.R7p\V^,R,4PR+R 4PR,R 4Vn2VPR(\f,R)V,\P>RR*.R7p\=V4^8Xd@\V^,R,4PR+R 4PR,R 4Vn4MRVn4VPR-\VPX4: R.\TPj: R/2R0R1.R27p\=V4^8wd5\-R3\VPX4: R.\TPj: 24h\V^,R1,^,4R48Xd'\]V^,R0,^,4Vn6MC\nPp!\]V^,R0,^,44PrVn6VPR5\PR6.R7.R87p\=V4^8dR9pMR:pVPR;VP,\PR6.R7.R87p\=V4^8dR9pMR:pVP8eV'd RVn:MR?Vn:\wWP04p\V4VPxR@&V#)CaGet key provision parameters (realm, domain, ...) from a given provision :param samdb: An LDB object connected to the sam.ldb file :param secretsdb: An LDB object connected to the secrets.ldb file :param idmapdb: An LDB object connected to the idmap.ldb file :param paths: A list of path to provision object :param smbconf: Path to the smb.conf file :param lp: A LoadParm object :return: A list of key provision parameters N workgroupr|z (flatname=%s)zCN=Primary DomainssAMAccountName expressionbasescopeattrs$z(objectClass=*)defaultNamingContextschemaNamingContextconfigurationNamingContextrootDomainNamingContextnamingContextsutf8z basedn in z (z ) and from z)is not the same ...zDC=ForestDnsZones,%szDC=DomainDnsZones,%sz(objectClass=site)z CN=Sites,cnz(CN=%s)zOU=Domain Controllers,%s dNSHostNamezUnable to find DC called CN=z under OU=Domain Controllers,.zserverReference=%s)rrrCN=NTDS Settings,%s invocationID objectGUID invocationId objectSidmsDS-Behavior-Versionz (name={%s})zCN=Policies,CN=System, displayName{}z(cn=-) xidNumbertype)rrz.Unable to find uid/gid for Domain Admins rid ( ID_TYPE_BOTHz(samaccountname=dns)dnsearch_options:1:2)rrrcontrolsTFz(samaccountname=dns-%s) BIND9_DLZSAMBA_INTERNALBIND9_FLATFILENONE DnsAdmins)rrrrr)rrr)=rq adminpassgetupperr~r|lowerr{sambadn_from_dns_namesearchldb SCOPE_SUBTREEstrreplacer}r SCOPE_BASErvrwDndecodeProvisioningErrorrWrurtrsrxryrangelenSCOPE_ONELEVELrrrserverdnr(rGUID invocationntdsguidrrdom_sidrrintr domainlevelDEFAULT_POLICY_GUIDpolicyidDEFAULT_DC_POLICY_GUID policyid_dcDOMAIN_RID_ADMINISTRATORroot_gidpwdgetpwuidpw_gid dns_backendrAr)rW secretsdbrXpathsrlpnamesbasednrescurrentincrxryres3res4 server_resres5res6res7res8res9res10has_legacy_dns_accountres11has_dns_accountdns_admins_sids&&&&&& rcfind_provision_key_parametersrs  EEO66+&,,.EL&&/EKkk'')EO  # #EOO 4F++##%EK   o <<'(.B!$!2!2;K:L  NCCF#345==c2FEMll&7 "#.."45G $@A!DEEN$9:1=>EN FF5 !cffU-4QZ8N-OPQ-R-Y-YZ`-a'c d:?++:=gajI_>`ab>c>j>jkq>r:s:?--"QS S $:;A>?ENwqz";>cFXFXae`f  hDa'EN <<9u/@/@#@7&@!00  ID 4yA~chctctv| }~~a/088u9NPRSEN)=Q )J$&U^^=JA))*EN <<#42S5HH!nn-|<  >D:diia1H1KLMEDIItAw|/DQ/GHIEN <<#46!nn5[  \D:diia1Fq1IJKE !1!147;3G3JKEO !1!147;3G3JKEO Aw{{*+3 Q/03 47N N3Q(? @ CD <<=3F#F5>!00}8M  ODa'//R8@@bIEN <<=3I#I5>!00#]3  5D 4yA~Q .66sB?GGRP  >>u/1R1R&T!,f 5  7D 4yA~Y\]b]l]lYmowpQpQ!RS S 476?1 .0T!W[1!45c$q'+*>q*A&BCJJ LL$:"00#7"8  :E E Q!%!& LL$=@Q@Q$Q"00#7"8  :E E Q $  +E  0E  2,"&unn=N"%n"5ENN; LrfFcJ.pV'gVPR\P\R.R7pV^,\,FUp\P!R\ V44'g\ V4: RV: 2pVP \ V44KW VP V: RV: RV: 24\P!4p\P!VR4Vn \P!V\P\4V\&VPRR\PR.R7p\V4^8Xg\V^,4^8Xd*\P!V\PR4VR&VPV4R #) a3Update the field provisionUSN in sam.ldb This field is used to track range of USN modified by provision and upgradeprovision. This value is used afterward by next provision to figure out if the field have been modified since last provision. :param samdb: An LDB object connect to sam.ldb :param low: The lowest USN modified by this upgrade :param high: The highest USN modified by this upgrade :param id: The invocation id of the samba's dc :param replace: A boolean indicating if the range should replace any existing one or appended (default) @PROVISIONr)rrr;rzprovisionnerID=*provisionnerIDrN)rrrLAST_PROVISION_USN_ATTRIBUTErerappendMessagerrMessageElementFLAG_MOD_REPLACEr FLAG_MOD_ADDmodify) rWlowhighidrtabentryedeltas &&&&& rcupdate_provision_usnr[sF C  ,#&>>$@$#GIq677A99S#a&))"1vr* JJs1v 8 JJS$+, KKMEvve\*EH 3//7 9 &' LL$6*#.. 01  3E 5zQ#eAh-1,"%"4"4R9I9IK["\ LLrfc(.pVPV: RV: RV: 24\P!4p\P!VR4Vn\P !V\P \4V\&VPV4R#)aSet the field provisionUSN in sam.ldb This field is used to track range of USN modified by provision and upgradeprovision. This value is used afterward by next provision to figure out if the field have been modified since last provision. :param samdb: An LDB object connect to sam.ldb :param low: The lowest USN modified by this upgrade :param high: The highest USN modified by this upgrade :param id: The invocationId of the provisionrrrN) rrrrrrrradd)rWrrrrrs&&&& rcset_provision_usnrsn CJJS$+, KKMEvve\*EH 3++7 9 &' IIerfcpVPRV\PR..ROR7pV^,R,#)aThis function return the biggest USN present in the provision :param samdb: A LDB object pointing to the sam.ldb :param basedn: A string containing the base DN of the provision (ie. DC=foo, DC=bar) :return: The biggest USN in the provisionz objectClass=* uSNChanged)rrrrr)rzserver_sort:1:1:uSNChangedzpaged_results:1:1)rrr)rWrrs&& rc get_max_usnrs> ,,/ ..|n!6  7C q6, rfcVPR\,R\P\R.R7p\T4^8Ed@.p/p\P!R4pT^,PR4'd2T^,R,FpTP\T44K T^,\,Fp \T 4PR4p \T 4^8Xd T ^,p MRp \T4^8d Y9dKQTPT ^,4p TPT 4f.Yk&Yk,PT ^,4Yk,PT ^,4K T#R# \Pd0pTP wr4T\P 8XdRp?R#hRp?ii;i) zGet USNs ranges modified by a provision or an upgradeprovision :param sam: An LDB object pointing to the sam.ldb :return: a dictionary which keys are invocation id and values are an array of integer representing the different ranges z%s=*rrrNrrdefault)rrrrLdbErrorargsERR_NO_SUCH_OBJECTrrcompilerrrsplit) samre1ecodeemsgmyidsrprrtab1rtab2s & rcget_last_provision_usnrsw f/K&K ,CNN">@P!QS 5zA~ JJt  8<<( ) )1X.// SV$0q677Aq6<<$D4yA~!WE Q2?7747#Dyy}$ I  T!W % I  T!W %8 7 <<  C** * s4FG #GGG c0a]tRtRtoRtRtRtRtVtR#)ProvisionResultizResult of a provision. :ivar server_role: The server role :ivar paths: ProvisionPaths instance :ivar domaindn: The domain dn, as string cRVnRVnRVnRVnRVnRVnRVnRVnRVnRVn RVn R#rO) server_rolerrurrWidmaprradminpass_generatedrbackend_resultras&rcrdProvisionResult.__init__sR     #' "rfc 6VPR4VP'dVPRVP4VPRVP4VPRVPP 4VPRVPP 4VPRVPP4VPRVP4VP'dVPPV4R#R#) z)Report this provision result to a logger.zMOnce the above files are installed, your Samba AD server will be ready to usezAdmin password: %szServer Role: %szHostname: %szNetBIOS Domain: %szDNS Domain: %szDOMAIN SID: %sN) inforrrrrr~r{rr report_logger)rbloggers&&rcrProvisionResult.report_loggers     # # # KK3T^^ D /1A1AB /1D1DE /1B1BC /1E1EF /@        - -f 5 rf) rrrrurrrrrrWrN) rhrirjrk__doc__rdrrlrmrns@rcrrs #66rfrcnVF pV!V4u# \RV,4h \dK0i;i)zFind a user or group from a list of possibilities. :param nssfn: NSS Function to try (should raise KeyError if not found) :param names: Names to check. :return: Value return by first names list. zUnable to find user/group in %r)KeyError)nssfnrnames&& rcfindnssr'sD ;  4u< ==   s % 44cD\\PV4^,#)r'rgetpwnamrs&rc findnss_uidr-  3<< ' **rfcD\\PV4^,#r))r'grpgetgrnamr,s&rc findnss_gidr2r.rfc\V4pV# \d0pTPT4TPR4^pRp?T#Rp?ii;i)zAssuming root user has UID zeroN)r-r$r)rootr root_uidrs&& rc get_root_uidr6sLt$ O  A 56 O s  A $AA c|\4pVPR4VnVPR4VnVPR4VnRVnRVn\PPVPR4Vn \PPVPR4Vn \PPVPR4Vn \PPVPR 4Vn \PPVPR 4Vn\PPVPR 4Vn\PPVPR 4Vn\PPVPR 4Vn\PPVPR4Vn\PPVPR4Vn\PPVPR4Vn\PPVPR4Vn\PPVPRVR,4Vn\PPVPR4Vn\PPVPR4Vn\PPVPR4VnRVnRVnRVnRVnRVnRVnVPRR4Vn VPRR4Vn!VPDVn#V#) zhSet the default paths for provisioning. :param lp: Loadparm context. :param dnsdomain: DNS Domain name private dir binddns dirstate directoryz dns.keytabsecrets.keytabz share.ldbzsam.ldbz idmap.ldbz secrets.ldbz privilege.ldbdns_update_listspn_update_list krb5.confzkdc.confzwins.ldbldapizencrypted_secrets.keyr\z.zonez named.confznamed.conf.updatez named.txtzhklm.ldbzhkcr.ldbzhkcu.ldbzhku.ldbzhkpd.ldbzhkpt.ldbpathsysvolnetlogon)$rMrr^r_r`r[rZosr@joinrPrWrXrY privileger<r=krb5confkdcconfr] s4_ldapi_pathencrypted_secrets_key_pathr\ namedconfnamedconf_updatenamedtxtrQrSrRrTrUrVrArB configfiler)rr{rs&& rcprovision_paths_from_lprNs  E}-E}-Eff./EO$E#ELggll5#4#4kBEO'',,u00)EL'',,u'8'8'BE')ww|| (!E$ U..y77JKEIggll5#4#4lCEOWW\\%*;*;=PQEWW\\%"3"3[AENEJEJEJEIEJEJ66&(+ELVVFJ/ENMMEM LrfcRPVUu.uFp\V4'gKVNK up4pVR\P4#uupi)z)Determine a netbios name from a hostname.rN)rDrr r)rxr}s& rcdetermine_netbios_namerQLsI''hKh2G2J11hKLK ,, - 3 3 55Ls A A c 6Vf,\P!4PR4^,pVPR4p V f \ V4p V P 4p \ V 4'g \V 4hVf9VPR4pVeVR8Xd\RVP,4hVP4pVf2VPR4pVf\RVP,4hVP4pVP 4p VPR4R8Xd\RVP,4hVPR4P 4V 8wd@\R VPR4P 4: R VP: R V : R 24hVPR4P4V8wd2\R VPR4: R VP: RV: R 24hVR8XdVfVPR4pVP 4pVPR4P 4V8wd@\RVPR4P 4: RV: RVP: R24hVf\P!V4pW,8Xd\RV: RV : R24hMT pVf RV ,p\ V4'g \V4hVP 4V 8Xd\RV : RV: R24hV P 4V 8Xd\RV : RV : R24hW-8XdV 'g\RV : RV: R24hVR8wdT p V P4pVfTpVf RV,pVf RV,pV f\p V fRV : R V : R!V: 2p \4pW^nWnnW~nWnR"V,VnW>nW.nWnWnWnWnWnV#)#z$Guess configuration settings to use.r netbios namer|rz2guess_names: 'realm' not specified in supplied %s! server rolez8guess_names: 'server role' not specified in supplied %s!zwguess_names: 'realm =' was not specified in supplied %s. Please remove the smb.conf file and let provision generate itzguess_names: 'realm=z' in z must match chosen realm 'zA'! Please remove the smb.conf file and let provision generate itzguess_names: 'server role=z must match chosen server role '"active directory domain controllerrzguess_names: Workgroup 'z(' in smb.conf must match chosen domain 'z'! Please remove the z# file and let provision generate itzguess_names: Domain 'z(' must not be equal to short host name 'z'!zDC=zguess_names: Realm 'z!' must not be equal to hostname 'z)' must not be equal to NetBIOS hostname 'z*' must not be equal to short domain name 'zCN=Configuration,z CN=Schema,zCN=z,CN=Servers,CN=z ,CN=Sites,z CN=Manager,)socket gethostnamer rrQrrInvalidNetbiosNamerrMrrr DEFAULTSITErqrtrurvrwrzr{r~r|r}rrr)rrr~r{ serverrolertrurvrwrrdomain_names_forcedr}r|rs&&&&&&&&&&&& rc guess_namesr\Ss_ %%'--c215&&(K,X6 ##%K k * * --FF7O   R#D  !IVVM*  #$^acanan$no o!!#J OO E vvg"!Z]_]j]j!jk k vvg%'acagaghoapavavaxz|zGzGIN!OP P vvm""$ 2momsmstAmBDFDQDQS]!^_ _99 >VVK(F 66+  $ $ && 0#jljpjpq|j}jCjCjEGMOQO\O\%]^ ^  --i8H  #msvA%BC C !  {*H f % % ((~~5 afhp qrre#inp{ |}} 2joqw xyy99%%'  ~&/(* 8-  ELNNN'&0EOLK#NNN Lrfc 8 VfQhVf,\P!4PR4^,p\V4p VfRpVfQhVP 4pVfQhVP 4pRV RVRVRV/p Vf\ P P4p\PPV4'dVPV4V e/V F(p W,fKRPW,4W&K* VEe\PP\PPVR 44V R &\PPV4V R &\PP\PPVR 44V R &\PP\PPVR44V R&\PP\PPVR44V R&VPR \PPV44VPR V R ,4VPRV R,4VPRV R,4V'EdV'dVep\PPVR 4p VPR\PP\PPV R444EM]VPR4'g_VPR 4p VPR\PP\PPV R444MVeo\PPVR 4pVPR\PP\PPVR444MuVPR4'g_VPR 4pVPR\PP\PPVR444/pVR8Xdm\PPVPR 4R4VR&\PPVR,VP!4R4VR&MRV R&\#VR4pVP%R4V P'4F wppVP%RV: RV: R 24K" VP%R 4VP'4FXwppVP%R!V,4VP%R"V,4VP%R#4VP%R 4KZ VP)4VPV4VP+R$V4R# TP)4i;i)%zDCreate a new smb.conf file based on a couple of basic settings. Nrstandalone serverrSrr|rT privater8zlock dirstater:cachezcache directoryzbind-dnsr9z posix:eadbzeadb.tdbzxattr_tdb:filez xattr.tdbrUrAscriptsrB samba_dsdbpassdb backendwz [globals]  z =  z[%s] z path = %s z read only = no F)rVrWr rQrrr LoadParmrCr@existsloadrDabspathsetrropenwriteitemsclosedump)rrr~r| targetdirrZeadb use_ntvfsr global_paramr}global_settingsentprivdirstatedirsharesfkeyvalr&r@s&&&&&&&&&& rc make_smbconfrs}   %%'--c215(2K(    \\^F    KKME  Vz O z [[ ! ! # ww~~g C ,'*xx 0A'B$ )+iQZ9[)\ &&(ggooi&@ #-/WW__RWW\\)U\=]-^)*-/WW__RWW\\)U\=]-^)*)+iQ[9\)] & z277??956  /2C"DE  /2C"DE }om<= t $'',,y)<|wwrww||GZ'HIKVVL))&&/|wwrww||GZ'HIK$77<< 7;'wwrww||Hk'JKMVV,--66"34'wwrww||Hk'JKMF9977<</@(A8LxWW\\&*:EKKM*35z-9() WcA   '--/HC GGS#. /0   ,,.JD$ GGHtO $ GGOd* + GG( ) GGDM )  GGG GGE7  s CXXcVPRVPV4VPVR,VPV4VPVR,VPV4R#)a?setup reasonable name mappings for sam names to unix names. :param samdb: SamDB object. :param idmap: IDmap db object. :param sid: The domain sid. :param domaindn: The domain DN. :param root_uid: uid of the UNIX root user. :param nobody_uid: uid of the UNIX nobody user. :param users_gid: gid of the UNIX users group. zS-1-5-7z-500z-513N)setup_name_mappingTYPE_UIDTYPE_GID)rsidr5 nobody_uid users_gids&&&&&rcsetup_name_mappingsr1sN Y C S6\5>>8D S6\5>>9Erfc VfQh\P!V4\WVR.R7p Rp VPR8wdRVP ,p Rp V'gRp Vf \ 4pRV,p VR 8XdV e V R , p MR p V R , p V fR p V P4VPR4\V \R4RV RV /4\V \R4RVPRVRV /4VPR4\W4V P4R# \dELi;i T P4h;i)aSSetup the partitions for the SAM database. Alternatively, provision() may call this, and then populate the database. :note: This will wipe the Sam Database! :note: This function always removes the local SAM LDB file. The erase parameter controls whether to erase the existing data, which may not be stored locally but in LDAP. Nzmodules:)url session_inforoptionsz# No LDAP backendrzldapBackend: %sz"requiredFeatures: encryptedSecretszbackendStore: %smdbrhrzrequiredFeatures: lmdbLevelOnez# No required featuresz*Setting up sam.ldb partitions and settingszprovision_partitions.ldifLDAP_BACKEND_LINE BACKEND_STOREzprovision_init.ldif BACKEND_TYPE SERVER_ROLEREQUIRED_FEATURESzSetting up sam.ldb rootDSE)rCunlinkOSErrorr rldap_urirItransaction_startrr<r;setup_samdb_rootdsetransaction_committransaction_cancel) samdb_pathr rrprovision_backendrrZplaintext_secrets backend_storerWldap_backend_linerequired_featuresbackend_store_lines &&&&&&&&& rcsetup_samdb_partitionsrCs  ## #   * J | -E,&-0A0J0JJ @13 +m;  (  %  " == 4 # @Auj)DE#%6!3H  uj)>? 1 6 6z#%6B   01E)   "a    X   " sD,-A-D>, D;:D;>Ec n.R#Op Ve;VfVP4pVP4: RVP4: 2p MRp VP4p \P!\P!VRV,44p \ V4.V R &R R .V R &V e?.R$OV R &V.V R &RV : RVP 4: 2.V R&\ V4.V R&R.V R&VP R4.V R&RV,.V R&\ V4.V R &Ve\V4.V R&VPRV RV: RV: R\ V4: R\ V P4: R2 \PR7p V FpVPVP4K VPV PV \PR7p \V 4^8XdV ^,R,^,.V R&V ^,R,^,.V R&V ^,R,^,.V R&V ^,R,^,.V R&V F1pVR 8wgK W,P\P 4K3 VP#V 4VP%V ^,PV P4R#R!V ,.pV\&8XdV eVP)R!V ,.4VV R"&VP+V 4R# \dELi;i \dLi;i \dLi;i)%zAdd domain join-specific bits to a secrets database. :param secretsdb: Ldb Handle to the secrets database :param machinepass: Machine password whenChangedsecret priorSecret krb5Keytab privateKeytabNrzflatname=%s,cn=Primary DomainssecureChannelTypetop primaryDomain objectClassr|zhost/@ saltPrincipalzmsDS-KeyVersionNumberr;utf-8z%s$samAccountNamerzcn=Primary Domainsz(&(|(flatname=z)(realm=z )(objectSid=z2))(objectclass=primaryDomain)(!(distinguishedName=z)))rrrr)rrrpriorWhenChangedrzHOST/%sservicePrincipalName)rrr priorChangedrr)rrkerberosSecret)rrrrrrencoder'rrrdeleterrr$ set_flagsrrrenamerextendr)rr~r} machinepassrr|r{key_version_numbersecure_channel_typerdnsname shortnamemsgrdel_msgelspns&&&&&&&&& rcsecretsdb_self_joinrsJ E    I(..0)//2CD!!#I ++cffY(H6(QR SC #$7 89C1C GMwG 07 GHO(+,>(?'@ #$ 01O ''01CM"[01C #$7 89C$Y/0K    4EMSUZ\_`i\jlopspvpvlw(x!$!3!3  5C$   e3>>  JC 3x1}!!fX.q12M '*1vm'#?C  !$Q !5a!8 9C BTz!!#"6"67 QCFF+9$% , .73F JJ G+, -&) "# c5           s6/L L'L& LL L#"L#& L43L4c`\PPVP4'd!\P!VP4\PP VP VP4p\PPV4'd\P!V4\PP VPVP4p\PPV4'd\P!V4\PP VP VP4p\PPV4'd\P!V4VPp\WaVR7pVP4VP\R44\WaVR7pVP4VP\R44V# TP4h;i)a2Setup the secrets database. :note: This function does not handle exceptions and transaction on purpose, it's up to the caller to do this job. :param path: Path to the secrets database. :param session_info: Session info. :param lp: Loadparm context :return: LDB handle for the created secrets database rrzsecrets_init.ldifz secrets.ldif)rCr@rjrYrrDr^rZr_r[r eraseload_ldif_file_addr;rr)rrr keytab_pathbind_dns_keytab_pathdns_keytab_pathr@ secrets_ldbs&&& rcsetup_secretsdbrsl ww~~emm$$ %-- '',,u00%,,?K ww~~k"" +77<<(9(95;K;KL ww~~*++ &'ggll5#4#4e6F6FGO ww~~o&& /" ==Dd"=K"":.A#BCd"=K!!#&&z.'AB &&( s >HH-c\PPV4'd\P!V4\ WVR7pVP 4VP \R44R#)zSetup the privileges database. :param path: Path to the privileges database. :param session_info: Session info. :param lp: Loadparm context :return: LDB handle for the created secrets database rzprovision_privilege.ldifN)rCr@rjrr rrr;)r@rr privilege_ldbs&&& rcsetup_privilegesrsN ww~~d $B?M$$Z0J%KLrfc\PPV4'd\P!V4\P\P ,\P ,p\P\P,p\P!^4p\P!WV4p\P!V4\P!VR4;_uu_4p\P!^4pVPV4RRR4R# \P!T4i;i +'giR#;i)zSetup the encrypted secrets key file. Any existing key file will be deleted and a new random key generated. :param path: Path to the secrets key file. wbN)rCr@rjrO_WRONLYO_CREATO_EXCLstatS_IRUSRS_IWUSRumaskrnfdopenrgenerate_random_bytesro)r@flagsmodeumask_originalfdr|r}s& rcsetup_encrypted_secrets_keyrs ww~~d $ KK"** $ryy 0E <<$,, &DXXa[N! WWT$ '  2t  ))"-        s2D0>(E 0E E c^\PP4p\PPWVR7pVP V\PP 4\ R4p\PPV4'gQhVPV4R#)zSetup the registry. :param path: Path to the registry database :param session_info: Session information :param lp: Loadparm context )rlp_ctxz provision.regN) rregistryRegistryopen_ldb mount_hiveHKEY_LOCAL_MACHINEr;rCr@rj diff_apply)r@rrreghive provision_regs&&& rcsetup_registryr6sv .. ! ! #C >> " "42 " NDNN4::;/M 77>>- ( (( (NN=!rfc\PPV4'd\P!V4\ WVR7pVP 4VP \R44V#)zSetup the idmap database. :param path: path to the idmap database :param session_info: Session information :param lp: Loadparm context rzidmap_init.ldif)rCr@rjrr!rrr;)r@rr idmap_ldbs&&& rc setup_idmapdbrEsR ww~~d $B?I OO   ,=!>? rfc\V\R4RVPRVPRVPRVP RVP /4R#)zr=rrset_session_infor)rWadmin_session_inforfillrrdnspassrnext_rid invocationid policyguid policyguid_dcdomainControllerFunctionalityrdc_rid ntdsguid_lineoperatingSystemVersionsystem_session_infos&&&&&&&&&&&&&&& rcsetup_self_joinrcs lC ( (( (*X5   ~#ZZAAB_`5*%?@C=%..C=%..C=%..C=%.. C= l C= U.. C=ENNEOODC= ;+=+=k+J!K!R!RSY!ZC=3y>C=s6{C=!*w"6C=)*@C=-C=0/21C= #C3$7!C="!#hns&:";#C=>&5*%BCJ}5??%.. F*+ yuj)JKENNENNENNENN u00enneooF!9[-?-? -L#M#T#TU[#\S^V&M13143N4 5" %$%MN(%..(%..Q%29#=  ? %$%MN(%..+U^^+U->->(%.. Q )* ./eZ(IJ%..%..U..M  -.&& uj)GH5??%..Yw~~k'BCJJ6R%..##))+U__-B-B-DF K 'rfcvV^,R8wd RV,p\PPWRV4pV#)zReturn the physical path of policy given its guid. :param sysvolpath: Path to the sysvol folder :param dnsdomain: DNS name of the AD domain :param guid: The GUID of the policy :return: A string with the complete path to the policy folder rz{%s}Policies)rCr@rD) sysvolpathr{guid policy_paths&&& rc getpolicypathr!s4 Aw#~}'',,zj$GK rfc\PPV4'g\P!VR4\ \PP VR4R4pVP R4VP4\PP VR4p\PPV4'g\P!VR4\PP VR4p\PPV4'g\P!VR4R#R# TP4i;i)zGPT.INIrfz[General] Version=0MACHINEUSERN)rCr@rjmakedirsrnrDrorq)r r|rs& rccreate_gpo_structr's 77>>+ & & K' RWW\\+y 137A ()    [),A 77>>!   Au  [&)A 77>>!   Au   s (EEcb\WV4p\V4\WV4p\V4R#)aCreate the default GPO for a domain :param sysvolpath: Physical path for the sysvol folder :param dnsdomain: DNS domain name of the AD domain :param policyguid: GUID of the default domain policy :param policyguid_dc: GUID of the default domain controller policy N)r!r')rr{rrr s&&&& rccreate_default_gpor)s, zBKk" }EKk"rfc \WVW!WFV V R7 \p V 'dT p .pV R8Xd"VPR\V 4,4V 'dVPR4VPR4\ VRRVRWR7pVP R 4VP VRR 7VPR VP,4VPWR 7TP TRR 7T# \Pd=pTPwppT\P8Xd\R T,4hhRp?ii;i)zRSetup a complete SAM Database. :note: This will wipe the main SAM database file! )r rrrrrZrrrzlmdb_env_size:z batch_mode:1z#transaction_index_cache_size:200000NF)rr auto_connectr global_schemaam_rodcrz%Pre-loading the Samba 4 and AD schema)write_indices_and_attributesr)rz!&Qb)68 &J' G'#j/9:~& NN89 |E %w IE KK78 V%@ 4u~~EF d , V$? L << ggl 355 5#$bei$ij j  sC55E 7EEc (VfRpVR8gVR8d%RV,pVRRb,, p\V4h\P!V4pVf\pVV8d&\P!V4p\RV R24hTpTpVP RVP ,4VPRV4VPR V4VPR V4VP\VP44VPV 4VPR VP,4\V\VP44pVPV4VP eR VP ,pMR p\#\%VP44P'R4p\)V\+R4RVPR\VP4RVRV/4\-V\+R4RVPR\\.P0!\3\4P4!4444R\V4RVP6RVP8RVR\V4R\:R\\<4/ 4V\>8XEd%VPR4\#\AVP44P'R4p\)V\+R4RVP8RV/4R\.PBPD,pR R!V.pVPR"4VPGVPHVR#7VPKVPLVR#7VPO4VPGVPPVR#7\)V\+R$4R%VPR/VR#7\TPV!\TPX!WP44p\TPZ!VP8\TP\R&4VR&&\#\_VP44P'R4pWn0V\>8XEdVPR'4\#\cVP44P'R4p\#\eVP44P'R4p\#\gVP44P'R4p \#\iVP44P'R4p!\#\kVP44P'R4p"\#\mVP44P'R4p#R(VPn9dR)p$MR p$\)V\+R*4/RVP8bR+VPpbRVP6bR,VPrbR-VPtbR%VPRbRVPbR.VP bR/\V4bR\V4bR0V bR1VbR2V"bR3V!bR4V"bR5V"bR6V#bR7VR8V/C4\)V\+R94RVP8R:V$/4VPR;4\w\+R<44p%\yV%RVP8/4p%\{V%4VPGV%4VPR=4\-V\+R>4RVP8R?V#/4VPR@4\#\}VP44P'R4p&\)V\+RA4RVPRBV&/4VPRC4\-V\+RD4RVP/4VPRE4\#\VP44P'R4p'\)V\+RF4RVPRGV'/4VPRH4\-V\+RI4RVP/4VPRJ4\#\VP44P'R4p(\#\VP44P'R4p)\#\VP44P'R4p*\#\VP44P'R4p+\#\VP44P'R4p,\)V\+RK4R\\.P0!\3\4P4!4444RVPR+VPpRVP6RVP8R.VP RL\VRM,4RNVROV(R1VR2V)RPV*RQV+RRV,/4V\>8Xd\#\VP44P'R4p-\-V\+RS4RVP8R%VPR/4VPRT4\#\kVP44P'R4p"\)V\+RU4RVP8RVV"/R!R .R#7V\>8Xg V\8XEdc\-V\+RW4RVPRXX-/4VPRY4\)V\+RZ4RVPR\VP4R[\#VPR\44P'R4R]\#VPR\44P'R4/R!R .R#7VPR^4\VVW&V V V V VPVVVVVV R_7RVP ,p.VPV.R`R \TPRa7P'R4VnK\VP\4'gQhV#)cNʚ;z/You want to run SAMBA 4 with a next_rid of %u, z,the valid range is %u-%u. The default is %u.zxYou want to run SAMBA 4 on a domain and forest function level which itself is higher than its actual DC function level (z). This won't work!rdomainFunctionalityforestFunctionalityrzAdding DomainDN: %szobjectGUID: %s -rrzprovision_basedn.ldifrr DESCRIPTOR DOMAINGUIDzprovision_basedn_modify.ldif CREATTIMENEXTRIDrYrrDOMAIN_FUNCTIONALITYrMIN_PWD_LENGTHzAdding configuration containerz#provision_configuration_basedn.ldifzlocal_oid:%s:0rrzSetting up sam.ldb schemarzaggregate_schema.ldifrsubRefsz%Setting up sam.ldb configuration data2008#zprovision_configuration.ldifrrDOMAINrFOREST_FUNCTIONALITYNTDSQUOTAS_DESCRIPTORDELETEDOBJECTS_DESCRIPTORLOSTANDFOUND_DESCRIPTORSERVICES_DESCRIPTORPHYSICALLOCATIONS_DESCRIPTORFORESTUPDATES_DESCRIPTOREXTENDEDRIGHTS_DESCRIPTORPARTITIONS_DESCRIPTORSITES_DESCRIPTORzextended-rights.ldifINC2012zSetting up display specifiersz1display-specifiers/DisplaySpecifiers-Win2k8R2.txtz0Modifying display specifiers and extended rightsz#provision_configuration_modify.ldifDISPLAYSPECIFIERS_DESCRIPTORzAdding users containerzprovision_users_add.ldifUSERS_DESCRIPTORzModifying users containerzprovision_users_modify.ldifzAdding computers containerzprovision_computers_add.ldifCOMPUTERS_DESCRIPTORzModifying computers containerzprovision_computers_modify.ldifzSetting up sam.ldb datazprovision.ldifRIDAVAILABLESTARTiXrINFRASTRUCTURE_DESCRIPTORSYSTEM_DESCRIPTORBUILTIN_DESCRIPTORDOMAIN_CONTROLLERS_DESCRIPTORz'provision_configuration_references.ldifz)Setting up well known security principalsz#provision_well_known_sec_princ.ldifWELLKNOWNPRINCIPALS_DESCRIPTORz provision_basedn_references.ldifMANAGEDSERVICE_DESCRIPTORz#Setting up sam.ldb users and groupszprovision_users.ldif ADMINPASS_B64rKRBTGTPASS_B64zSetting up self join) rrrrrrrrrrrrrr)r attributerr)r=r>r=)MrrJdc_level_from_lprlevel_to_stringr1r set_opaqueset_domain_sidrrset_invocation_idrrurrrrr2rr<r;r=r unix2nttimertimerrvrDEFAULT_MIN_PWD_LENGTHr>r+r &DSDB_CONTROL_SKIP_DUPLICATES_CHECK_OIDadd_ldif schema_dn_add modify_ldifschema_dn_modifywrite_prefixes_from_schema schema_datarwrrrrrr* invocation_idr,r-r.r/r0r1 base_schemar}r{r~r"rr r6r5r3r9r8r4r7r:r?rr searchonerrr )/rWrrr rrrr krbtgtpassrrrrrdom_for_fun_levelr4rrerrorrlevelr?r@rdomainguid_linedescrignore_checks_oidschema_controlsrdeletedobjects_descrpartitions_descr sites_descrntdsquotas_descrprotected1_descrprotected1wd_descrprotected2_descr incl_2012display_specifiers_ldif users_desccomputers_descinfrastructure_desclostandfound_desc system_desc builtin_desccontrollers_descmanagedservice_descrntds_dns/&&&&&&&&&&&&&&&&&& rc fill_samdbr<s9  $(Z/AXN ?C$$ $&&$4$E$Eb$I! 688 001NO#[\a[bbu!vw w++ 4u~~EF *,?@ *,?@ 424 U__-. L) KK%67'r3u+?@ -. #-0@0@@ +EOO< = D DV LE5*%<=  U__- % / @eZ(FGENNS**3tyy{+;<=3x=u~~ENNj$7 8#45 J  y 45/@AHHPuj)NOENNeR  -uzz/`/``      /0 v++oF &11OL ((* v))ODuj)@A"ENN3 / 1 ++cffUNN3 4C''8H8H(13C N%%B5??%ST[[\bc& y ;<$%Eeoo%VW^^_ef ;EOO LMTTU[\ $%Fu%WX__`fg$%LU__%]^eeflm&'PQVQ`Q`'abiijpq$%LU__%]^eeflm V'' 'IIuj)GHKENNKu00Ku~~KU__ K %,, K ENN KENNKENNK',?(@K',?(@K()9K,-AK*+=K&'7K/0BK +,>!K",-=#K$()9"K'K , uj)?@ENN9C   34". J K#M"01H2NN   KK()6uGHOOPVWJ5*%?@   C KK+,eZ(EF I() KK,->uOPWWX^_N5*%CD  "NG KK/0e !BC$ennF67 KK)*#$H$YZaabhi!"I%//"Z[bbcijCEOOTU\\]cdK:5??KLSSTZ[L !B5??!ST[[\bc5*%56S**3tyy{+;<=ENNu((u~~ENNENNSC0#%8#%9!#4[l')99$ y()PQVQ`Q`)abiijpq%$%NO(%..(%..R: ;  ?@&'PQVQ`Q`'abiijpquj)NO  ,.@R  . 0  yDN2%$%GH(%..9;OK   9:uj)?@  U__- Yy'7'7 'DELLVT i (9(9+(FGNNvV C  .  0  *+1%1$/ '$/"'//!)%#-&36S!) +(%..83?BVYVdVd)fflflmsft %..#.... LrfzWO:LAG:BAD:P(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;SO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)zmO:LAG:BAD:P(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;SO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1301bf;;;PA)rAc^\4p\W WWtRWVR7 \P!VRR7Fvwrp V F2p \V\PP W4WVVRWVR7 K4 V F2p \V\PP W4WVVRWVR7 K4 Kx R#)Truskip_invalid_chownr serviceFtopdownN)rr#rCwalkr@rD) r@aclrdomsidrur rrr4dirsfilesr&s &&&&&&& rc set_dir_aclrLs&(L RsLZ^gmWWT59ED Rd13 (T& cD Rd13 (T& c :rfc \PPWR4p\4p \ WX\ \ V4V VRV\R7 VPRV,RR.R\PR7p V Fzp \\PV R,^,4P4p \W\ V R,44p \!V \#WR R 7V\ V4VVR 7K| R #) NSet ACL on the sysvol//Policies folder and the policy folders beneath. :param sysvol: Physical path for the sysvol folder :param dnsdomain: The DNS name of the domain :param domainsid: The SID of the domain :param domaindn: The DN of the domain (ie. DC=...) :param samdb: An LDB object on the SAM db :param lp: an LP object rTrCN=Policies,CN=System,%srnTSecurityDescriptorrrF)as_sddlr N)rCr@rDrr# POLICIES_ACLrSYSVOL_SERVICErrrr(r descriptorrr!rr%)rAr{rrurWrrur root_policy_pathrrpolicyrr s&&&&&&&& rc set_gpos_aclrXsww||FzB&(L R<Y T&R`b ,,6B"$:;"$C,>,>  @C,, 67:<\<P@,\<PB,p\<PD!VSV VR7o\<PF!SSRVVR7VVVVV3RlpV!V4\ PH!VRR7FwpppVFopS'd?V 'd7\ P !\ PPKVV4RV4V!\ PPKVV44Kq VFopS'd?V 'd7\ P !\ PPKVV4RV4V!\ PPKVV44Kq K \MWSW`SSSR7R# \d3\P!4'g \R4h\R4hi;i \d \R4hi;i T P#4i;i \dRp EL@i;i)aSet the ACL for the sysvol share and the subfolders :param samdb: An LDB object on the SAM db :param sysvol: Physical path for the sysvol folder :param uid: The UID of the "Administrator" user :param gid: The GID of the "Domain administrators" group :param domainsid: The SID of the domain :param dnsdomain: The DNS name of the domain :param domaindn: The DN of the domain (ie. DC=...) N)dirzSamba was compiled without the posix ACL support that s3fs requires. Try installing libacl1-dev or libacl-devel, then re-run configure and make.zYour filesystem or build does not support posix ACLs, which s3fs requires. Try the mounting the filesystem with the 'acl' option.zUUnable to chown a file on your filesystem. You may not be running provision as root.re samba_dsdb:%sSID as seen by smbd [6] does not match SID as seen by the provision script []!rSID as seen by pdb_samba_dsdb [ dns_domain!Realm as seen by pdb_samba_dsdb [8] does not match Realm as seen by the provision script [TFz )rrsession_info_flags Administrator)r user_nameuidgidc N<\SV\\S4SSRS\R7 #)zA helper to reuse argsTr)r# SYSVOL_ACLrr)r@rr s4_passdbrrus&rc _setntaclsetsysvolacl.._setntacls) j#i.,D"$ $rfrr)'s3param get_contextrkrMtempfileNamedTemporaryFilerCr@rlrset_simple_aclr&rrhave_posix_aclsrchownrqrmrr reload_static_pdbPDBrget_global_sam_sid domain_inforformatrrr AUTH_SESSION_INFO_DEFAULT_GROUPSAUTH_SESSION_INFO_AUTHENTICATED#AUTH_SESSION_INFO_SIMPLE_PRIVILEGES user_sessionsession_info_set_unixrrDr)rWrArrrr{rurrus3conffilercanchownuserdnrrr4rrr&rrs&&&&f&&ff @@rc setsysvolaclrxsI 9$$& BMM"**rwwv/FG  b##DIIu6I6KSQ U 499c0C0EF JJL$$& BMM" #_uyy%@A  "JJvzz*:;<   $ $ &) 3#|B|U|U|WYb%cd d++- y !Y .#FQR[F\F\^g%hi i | $ * * , 0A A#JUVbJcJiJiJkmvm|m|m~%@ @  HHVR % ! !)X-N-N OF  2 2  1 12  5 56E$$U2&8=?L|&()8#&#& ( $$fWWVU;dEDXdD12s; bggll4. /DXdD12s; bggll4. / <IxIV_`k b++--,-z{{()abb b U')TUU U JJL8 sH7+P*#*Q*RR*%Q'Q''R*RRR R*)R*cV'dR#R#)DBVFS)direct_db_accesss&rcacl_typers rfc 8\4p\W WT\R7pVPV4pWq8wd%\ \ V4: RV: RV: RV: R24h\ P!VRR7EFwrp V Fp \V\ PPW4VV\R7pVf:\ \ V4: R\ PPW4: R 24hVPV4pWq8wgK\ \ V4: R\ PPW4: RV: RV: R24h V Fp \V\ PPW4VV\R7pVf:\ \ V4: R\ PPW4: R 24hVPV4pWq8wgK\ \ V4: R\ PPW4: RV: RV: R24h EK R#) rrz ACL on GPO directory r_ does not match expected value z from GPO objectFrNz ACL on GPO file not found!) rr$rrrrrCrr@rD) r@rrrrrfsacl fsacl_sddlr4rrr&s &&&&& rc check_dir_aclrsA&(L R|Xf gEy)Jt|~NuOQUWacf!gh hWWT599EDRd!9<.>XE}')12B)C)+d)A)CDDy1J 'wAQxRTVT[T[T`T`aeTlnxz})~DRd!9<.>XE}'+34D+E+-77<<+C)EFFy1J '}EFV}WY[Y`Y`YeYefjYqs}B)CDD:rfc ~\PPWR4p\4p\ WWVV\ R7p V f\ R\V4: RV: R24hV PV4p V \8wd%\ \V4: RV: RV : RV : R 24hVPR V,R R .R \PR7p V Flp \\PV R ,^,4P4p \!W\#V R ,44p\%V\'W4VW&4Kn R#)rrrNzDB ACL on policy root r_rz ACL on policy root r from provisionrrrrr)rCr@rDrr$rrrrrrrrr(rrr!rrr%)rAr{rrurWrrrrrrrrrr s&&&&&&& rccheck_gpos_aclr s3ww||FzB&(L R<&6 PE }HUeLfhx yzzy)J\!qy{KrLN^`jlq!rs s ,,6B"$:;"$C,>,>  @C,, 67:< 3 rfc *\P!4pVPVP4VP RRVP ,4\ P!VPR44p\ P!4V8wd(\R\ P!4: RV: R24hVP4p V R,V8wd\RV R,: RV: R24hV R,P4VP48wd8\R V R,P4: R VP4: R24h\4p RFp \PP!W$4V3Fyp \#WlW\$R 7p V f\\'V 4: R V : R24hV P)V4pV\*8wgKS\\'V 4: R V : RV: R\*: R24h \-W$W5WV 4K R #)aSet the ACL for the sysvol share and the subfolders :param samdb: An LDB object on the SAM db :param netlogon: Physical path for the netlogon folder :param sysvol: Physical path for the sysvol folder :param uid: The UID of the "Administrator" user :param gid: The GID of the "Domain administrators" group :param domainsid: The SID of the domain :param dnsdomain: The DNS name of the domain :param domaindn: The DN of the domain (ie. DC=...) rerrrrrrrrrrNz ACL on sysvol directory rr_rr)TF)rrrkrMrmrr rrrrrrrrCr@rDr$rrrrr)rWrBrArr{rurrrrrrdir_pathrrs&&&&&&& rcchecksysvolaclr/s* "F KK  JJ599!<= 6::&678I  "i/w}xQxQxSU^!_` `'')K9*BMNWBXBXZc!de e< &&(IOO,==FQR^F_FeFeFgirixixiz!{| |'(L)f8(CHR;L;L&5&NNTfU[n^_C473E3E*#2F2F446C/ 0 LL  Uv"$/@ * , __E,D,D,F/;%==CVF^ *c****.u5 ELL 1 2F$UAv|Q?%FL9 KKDEeZ(GH!5>>24 KK() %U$ C #fJ   Z"H%(^^&=%>  @f ;ennL!$!3!3"7  8   s7H7H%2K$@  BEF G#$lm m G   "m   " @|| 66LT4s0001 `   " s39AQ$B&Q/B0R7Q,/R4%R//R47S ROLE_STANDALONEr^ROLE_DOMAIN_MEMBERz member serverROLE_DOMAIN_BDCrUROLE_DOMAIN_PDCdcmemberzdomain controller standalonecR\V,# \d \T4hi;i)zSanitize a server role name. :param role: Server role :raise ValueError: If the role can not be interpreted :return: Sanitized server role (one of "member server", "active directory domain controller", "standalone server") ) _ROLES_MAPr$ ValueError)roles&rcsanitize_server_roler$s,$ s &c VP4VPR4\V\R4RVRVRV/4VP 4R# TP 4h;i)zlCreate AD entries for the fake ypserver. This is needed for being able to manipulate posix attrs via ADUC. z"Setting up fake yp server settingsz ypServ30.ldifrr NISDOMAINN)rrr<r;rrr rWrur} nisdomains&&&&&rcprovision_fake_ypserverr)sk   # 89uj9  ; <     "    " s -AA$c.\PPV4'g\P!W4R#R# \dIpTP \ P 39dRp?R#\RT: RTP: 24hRp?ii;i)zFailed to create directory z: N) rCr@rjmkdirrerrnoEEXISTrstrerror)r@rrs&& rcdirectory_create_or_existsr/3sl 77>>$   b HHT   bww5<<.('tUVU_U_(`aa  bsA B B2BBcVfXVPR4\V4p\V4^8d,V^,p\V4^8dVPRV4VR8XdRpVfVPR4V#)NzLooking up IPv4 addressesz*More than one IPv4 address found. Using %sz 127.0.0.1z No IPv4 address will be assigned)rrrwarning)r rrhostipss&&& rcdetermine_host_ipr3>su ~ /0"2& wT>P\R'44TPR(4\T;TT&R&7p?TPR)4\T;PTT&R*7TPR+4\T;PTT&R*7TPR,4\T;PTT&R&7p@\T@\T4T1T2T3R-7TPR.4\T;PTT=T&T:TT"TTbR?TbR@TbRATbRBTbRCTbRDTbRETbRFT"bRGT#bRHT&bRIT'bRJT)bT+EeJR6pCT&PeRK4f T&PRKR4\RL4R4pCXAP4^RMI[H\pDTD!TAR4RN7pETEP.R^O4TEPT+\R4RO7TAP4XAP4^RPIbHcpGTG!TAR4R4RQ7PT+\R4RO7TAP4XC'dT&PRKRR4\4pHTH\, \, pIXAPTHTIRS7pJTPRTTJP4 24\4'g`\T;PY[\&P(P3T&PeRU444TPRVT;P4\T;PT:PNT:PT:PRW7TPRXT;P4TPRY4T"R08Xd \T;4T=P4pKT=P4T?P4\TT;4\4pLT"TLnvTTLnwT;TLnxT:TLnyT&TLnzXATLnNX@TLn{\T4TLn0T\8XdXBXLn|TTLn}MR6XLn|RTLn}XKXLn~T('d@\TXAT:PT:EPT:EPEP4RZ7XL# \d\RT",4hi;i \$dRp5E Li;i T8PA4i;i \dpFXAP4TFhRpF?Fii;i \dpFXAP4TFhRpF?Fii;i T?P4h;i)_z@Provision samba4 :note: caution, this wipes all existing data! zlserver role (%s) should be one of "active directory domain controller", "member server", "standalone server"Nz7dom_for_fun_level[%u] incompatible with base_schema[%s]z2base_schema[%s] incompatible with adprep_level[%u]z8dom_for_fun_level[%u] incompatible with adprep_level[%u]r4nobodyusersotherstaffbindnamedetczsmb.confrzidmap_ldb:use rfc2307rz-dnsz dns forwarderz+smbz-s3fsz+winregz+srvsvczdcerpc endpoint serverszserver servicesrr)rZrtrurrv) rrr~r{rZrurvrwrrrtr[rTiitlsr#)rrwrs)rrrr zSetting up share.ldbrz share.ldifzSetting up secrets.ldbzSetting up the registry)rz"Setting up the privileges databasezSetting up idmap db)rr5rrzSetting up SAM db)r rZr4r-rrr5r6rUrBrArTrFr4rrrrrrrurrrrrrrrZrvrrurzdsdb:schema update allowedz;Temporarily overriding 'dsdb:schema update allowed' setting) ForestUpdate)r)update_revision) DomainUpdate) new_installrno) current_timeuse_start_timez#gkdi/gmsa root key added with guid zlog filezrrmprintrsamba.forest_updater@check_updates_iteratorcheck_updates_functional_levelr Exceptionrsamba.domain_updaterBrr&rr new_gkdi_root_key get_rdn_valuerrHrGcreate_krb5_confrFrr|rD post_setupshutdownrCrrrurrrrrrrr)r}r~r)Mr rrrsrr|rtrurwrvrr~rrrrrrr ldapadminpassrurrrr dns_forwarderrrrrr4r8r9rrZrvuseeadbr-rru use_rfc2307rrs adprep_levelrrr5r6max_adprep_levelr5rrrrWserver_servicesrvr|datarrr4r share_ldbrrrWrupdates_allowed_overriddenr@forestrrBrErFgkdi_root_key_dnrresultsM&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& rc provisionru]s (])*5  6005  2  #52++ Y!2K @!AB B$4|$C T!,l ;!<= =L3D$D Z!2L A!BC C66sC@ 13 '') T^^V,f5Hf0012JU--gwIJI||H%,,H01'',,y%< ++**, 77>>"''//'2 3 3 BGGOOG,-OL16 ,-&&v&  $-:OL )v&w'3>%// * * *+lrJ $$Z %=> KK()!%/;DKA -.uzz )*emm,2NEs9~%-*&/ 1  '(EKK-r5'1#)7.?*7/A'13 = =~~%' EMMBB||#'%--@@77==00 ENNE2  66r2>I"& )U++%,,W5 "'   " 5+vue :"( :5? :"( :29 :%- :6< :HQ :'1 : '1 : AN : )5 : CN :%- :;F :$+ :8B :.? :! :-6 :+9 :'-2*6667?FF7?WX15.'') @)%T:F112NO99,:TJN:P,,. '')@ -1%)++I+I$/(,,J, ,,. .FF7>%x !-(")+9":#(#:#: JX$;$Z  A/==?@BC !! EMM5"''//"&&Q[J\:] ^ KK(). 8 #(??U^^${{ ,  &',~~ 7   = = "5 )*557""$""$vu-  F#FFOFLFLFIFLFL9~FY%8"$%*"*FvU).UEVEV*/,,*<*<*> @ Mi ]!OR\!\] ]]X L GGIV!,,.G"!,,.GH&&( s k- ll"8En=DnA l7n!7mn E.n-l  ll"l47 mmmn m>'m99m>>nncH\P!R4p\P!V4\ V\ 43/RVbRVbR\ bRVbRVbRVbRVbRVbR VbR VbR V bR R bRV bRV bRRbRVbRV bRV bRVbpVPPR\V44V#)rurrsrr|rtrurwrvrr~rrNrrrZrUrrrru debuglevel) logging getLoggerrset_debug_levelrurr@rrmr)rrsr|rtrurwrvrr~rrrrrrrwrur rs&&&&&&&&&&&&&&&&& rcprovision_become_dcr{ s  { +F *% FN, )# )/8 )EM ) )(. )9A )LT )& )19 )BH )&  )/3  )?H  ) !,  ) D  )& )4? )IP )( )CFFJJ|S_- Jrfc >\\R4VRVRVRV/4R#)zWrite out a file containing a valid krb5.conf file :param path: Path of the new krb5.conf file. :param dnsdomain: DNS Domain name :param hostname: Local hostname :param realm: Realm name r>rr REALMN)rr;)r@r{rr|s&&&&rcrere s)z+&   U/rfc0a]tRtRtoRtRtRtRtVtR#)ri zA generic provision error.cWnR#rOvalue)rbrs&&rcrdProvisioningError.__init__ s rfc(RVP,#)zProvisioningError: rras&rc__str__ProvisioningError.__str__ s$tzz11rfrN) rhrirjrkr"rdrrlrmrns@rcrr s$22rfrc6aa]tRtRtoRtV3RltRtVtV;t#)rXi z.A specified name was not a valid NetBIOS name.c4<\SV`RV,4R#)z)The name '%r' is not a valid NetBIOS nameNsuperrd)rbr& __class__s&&rcrdInvalidNetbiosName.__init__ s  7$ > @rfr) rhrirjrkr"rdrlrm __classcell__rros@@rcrXrX s8@@rfrXc2aa]tRtRtoV3RltRtVtV;t#)rZi c8<\SV`RV: RV: R24R#)z#Existing smb.conf does not have a [z5] share, but you are configuring a DC. Please remove z or add the share manually.Nr)rbr&rrs&&&rcrdMissingShareError.__init__ s 7  rfr)rhrirjrkrdrlrmrrs@@rcrZrZ srfrZ)F) NNNNNNNNNNNF)NFFNN)FN)NNl)FFNNF)NNNN)rrO)NNNNNNNNNNNNNNNF)r" __docformat__base64rr,rCrrrr0rxrirrVr samba.dsdbrr samba.authrrsamba.auth_utilrr samba.samba3rr r rr r r rrrrrr samba.dcerpcrrsamba.dcerpc.miscrrrrrrrrr samba.gkdirr samba.idmapr!samba.ms_display_specifiersr" samba.ntaclsr#r$r% samba.nt_timer& samba.ndrr'r(samba.provision.backendr)samba.descriptorr*r+r,r-r.r/r0r1r2r3r4r5r6r7r8r9r:samba.provision.commonr;r<r=r>r?r@samba.provision.sambadnsrArBrCrD samba.paramsamba.registry samba.schemarE samba.samdbrFsamba.dbcheckerrGsamba.provision.kerberosrHrIrJrrrYrrjobjectrMrqrrrrrrr'r-r2r6rNrQr\rrrrrrrrrrrr!r'r)r/r;rrrrrrrrrrrrrrr!r$r)r/r3r5rur{rerarrXrZrrfrcrsg26"    4/ %)   ( 488 *&#41"<?' 1V,V0_D&R0  &R#6f#6L >++-`6upcLF$F#T=A"d+,,: Vr&R M2 "  hV   # -;|HVg ~ CQ c#@ka\D> 3F/)d' $"t4 $$#T"de"'J#\*/;; . o=(*N_%,   #(b" -1$tdTDDttDD$4tdDTDDUtu /F %T!%%JZ 0 2 2@@)rf