added a few more examples prior to the 2.2.1 release.

5 files changed, 436 insertions, 8 deletions

diff --git a/examples/LDAP/README b/examples/LDAP/README
index f7eaeda7269..281a66e65aa 100644
--- a/examples/LDAP/README
+++ b/examples/LDAP/README
@@ -14,8 +14,8 @@ Be aware of search limits on your client or server which prevent
 all entries from being returned in the search result.
 
 
-Pre-requisites
---------------
+Pre-requisites for import_smbpasswd.pl & export_smbpasswd.pl
+------------------------------------------------------------
 You must install Mozilla PerLDAP which is available at:
 
 	http://www.mozilla.org/directory
@@ -26,6 +26,16 @@ available for download at:
 	http:// www.iplanet.com/downloads/developer/
 
 
+Pre-requisites for import2_smbpasswd.pl & export2_smbpasswd.pl
+--------------------------------------------------------------
+These two scripts are modified versions of 
+[import|export]_smbpasswd.pl rewritten to use the Net::LDAP
+perl module available from 
+
+	http://perl-ldap.sourceforge.net
+
+
+
 OpenLDAP 2.0.x
 --------------
 
@@ -58,8 +68,8 @@ You must restart the LDAP server for these new included schema files
 to become active.
 
 
-import_smbpasswd.pl
---------------------
+import[2]_smbpasswd.pl
+----------------------
 
 Make sure you customize the local site variable in the perl script
 (i.e. ldapserver, rootdn, rootpw, etc...).  The script reads from
@@ -70,17 +80,17 @@ refer to RFC2307 and http://www.padl.com/software.html).
 
 The following will import an smbpasswd file into an LDAP directory
 
-	$ cat smbpasswd | import_smbpasswd.pl
+	$ cat smbpasswd | import[2]_smbpasswd.pl
 
 
-export_smbpasswd.pl
--------------------
+export[2]_smbpasswd.pl
+----------------------
 
 Make sure you customize the local site variable in the perl script
 (i.e. ldapserver, rootdn, rootpw, etc...).  You can then generate
 an smbpasswd file by executing
 
-	$ export_smbpasswd.pl > smbpasswd
+	$ export[2]_smbpasswd.pl > smbpasswd
 
 NOTE: Server side (or client side) search limites may prevent
 all users from being listed.  Check you directory server documentation
@@ -88,6 +98,17 @@ for details.
 
 
 
+ldapsync.pl & ldapchgpasswd.pl
+------------------------------
+For more information on these scripts, see
+
+	http://www.mami.net/univr/tng-ldap/howto/
+
+
+The ldapsync.pl script requires a small command (smbencrypt) 
+for generating LanMan and NT password hashes which 
+can be found at ftp://samba.org/pub/samba/contributed/
+
 !==
 !== end of README
 !==
diff --git a/examples/LDAP/export2_smbpasswd.pl b/examples/LDAP/export2_smbpasswd.pl
new file mode 100644
index 00000000000..90f5805e55f
--- /dev/null
+++ b/examples/LDAP/export2_smbpasswd.pl
@@ -0,0 +1,64 @@
+#!/usr/bin/perl
+##
+## Example script to export ldap entries into an smbpasswd file format
+## using the Mozilla PerLDAP module.
+##
+## writen by jerry@samba.org
+##
+## ported to Net::LDAP by dkrovich@slackworks.com
+
+use Net::LDAP;
+
+######################################################
+## Set these values to whatever you need for your site
+##
+
+$DN="dc=samba,dc=my-domain,dc=com";
+$ROOTDN="cn=Manager,dc=my-domain,dc=com";
+$rootpw = "secret";
+$LDAPSERVER="localhost";
+
+##
+## end local site variables
+######################################################
+
+$ldap = Net::LDAP->new($LDAPSERVER) or die "Unable to connect to LDAP server $LDAPSERVER";
+
+print "##\n";
+print "## Autogenerated smbpasswd file via ldapsearch\n";
+print "## from $LDAPSERVER ($DN)\n";
+print "##\n";
+
+## scheck for the existence of the posixAccount first
+$result = $ldap->search ( base => "$DN",
+			  scope => "sub",
+			  filter => "(objectclass=smbpasswordentry)"
+			);
+
+
+
+## loop over the entries we found
+while ( $entry = $result->shift_entry() ) {
+
+	@uid         = $entry->get_value("uid");
+	@uidNumber   = $entry->get_value("uidNumber");
+	@lm_pw       = $entry->get_value("lmpassword");
+	@nt_pw       = $entry->get_value("ntpassword");
+	@acct        = $entry->get_value("acctFlags");
+	@pwdLastSet  = $entry->get_value("pwdLastSet");
+
+	if (($#uid+1) && ($#uidNumber+1)) {
+
+		$lm_pw[0]      = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" if (! ($#lm_pw+1));
+		$nt_pw[0]      = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" if (! ($#nt_pw+1));
+		$acct[0]       = "[DU         ]" if (! ($#acct+1));
+		$pwdLastSet[0] = "FFFFFFFF" if (! ($#pwdLastSet+1));
+
+		print "$uid[0]:$uidNumber[0]:$lm_pw[0]:$nt_pw[0]:$acct[0]:LCT-$pwdLastSet[0]\n";
+	}
+
+}
+
+$ldap->unbind();
+exit 0;
+
diff --git a/examples/LDAP/import2_smbpasswd.pl b/examples/LDAP/import2_smbpasswd.pl
new file mode 100644
index 00000000000..948bf8a62da
--- /dev/null
+++ b/examples/LDAP/import2_smbpasswd.pl
@@ -0,0 +1,74 @@
+#!/usr/bin/perl
+##
+## Example script of how you could import and smbpasswd file into an LDAP
+## directory using the Mozilla PerLDAP module.
+##
+## written by jerry@samba.org
+##
+## ported to Net::LDAP by dkrovich@slackworks.com
+
+use Net::LDAP;
+
+#################################################
+## set these to a value appropriate for your site
+##
+
+$DN="dc=samba,dc=my-domain,dc=com";
+$ROOTDN="cn=Manager,dc=my-domain,dc=com";
+$rootpw = "secret";
+$LDAPSERVER="localhost";
+
+##
+## end local site variables
+#################################################
+
+$ldap = Net::LDAP->new($LDAPSERVER) or die "Unable to connect to LDAP server $LDAPSERVER";
+
+## Bind as $ROOTDN so you can do updates
+$mesg = $ldap->bind($ROOTDN, password => $rootpw);
+
+while ( $string = <STDIN> ) {
+	chop ($string);
+
+	## get the account information
+	@smbentry = split (/:/, $string);
+
+	## check for the existence of the posixAccount first
+
+	## FIXME!!  Should do a getownam() and let the NSS modules lookup the account
+	## This way you can have a UNIX account in /etc/passwd and the smbpasswd i
+	## entry in LDAP.
+        $result = $ldap->search ( base => "$DN",
+				  scope => "sub",
+				  filter  =>"(&(uid=$smbentry[0])(objectclass=posixAccount))"
+				);
+
+	if ( $result->count != 1 ) {
+		print STDERR "uid=$smbentry[0] does not have a posixAccount entry in the directory!\n";
+		next;
+	}
+
+	# Put the results into an entry object
+	$entry = $result->shift_entry;
+
+	print "Updating [" . $entry->dn . "]\n";
+
+	## Add the objectclass: smbPasswordEntry attribute.
+        ## If the attribute is already there nothing bad happens.
+        $entry->add(objectclass => "smbPasswordEntry");
+
+	## Set other attribute values
+	$entry->replace(lmPassword => $smbentry[2]);
+        $entry->replace(ntPassword => $smbentry[3]);
+        $entry->replace(acctFlags => $smbentry[4]);
+        $entry->replace(pwdLastSet => substr($smbentry[5],4));
+
+        ## Update the LDAP server
+	if (! $entry->update($ldap) ) {
+		print "Error updating!\n";
+	}
+}
+
+$ldap->unbind();
+exit 0;
+
diff --git a/examples/LDAP/ldapchpasswd b/examples/LDAP/ldapchpasswd
new file mode 100644
index 00000000000..0776d9bed1a
--- /dev/null
+++ b/examples/LDAP/ldapchpasswd
@@ -0,0 +1,152 @@
+#!/usr/bin/perl -w
+
+# LDAP to unix password sync script for samba-tng
+# originally by Jody Haynes <Jody.Haynes@isunnetworks.com>
+# 2000/12/12    milos@interactivesi.com
+#               modified for use with MD5 passwords
+# 2000/12/16	mami@arena.sci.univr.it
+#		modified to change lmpassword and ntpassword for samba
+# 2001/01/05	mami@arena.sci.univr.it
+#		modified for being also a /bin/passwd replacement
+# 2001/01/29	mami@arena.sci.univr.it
+#		now there are two small programs: ldapchpasswd to
+#		change password from unix and ldapsync.pl to sync
+#		from NT/2000. ldapchpasswd do not need clear password.
+# 2001/01/31	mami@arena.sci.univr.it
+#		add server parameter to ldap commands
+# 2001/06/20	mami@arena.sci.univr.it
+#		add pwdlastset and shadowlastchange update
+
+$basedn = "ou=Students,dc=univr, dc=it";
+$binddn = "uid=root,dc=univr,dc=it";
+$scope = "sub";
+$server = "my_server";
+
+foreach $arg (@ARGV) {
+	if ($< != 0) {
+		die "Only root can specify parameters\n";
+	} else {
+		if ( ($arg eq '-?') || ($arg eq '--help') ) {
+			print "Usage: $0 [-o] [username]\n";
+			print "  -o, --without-old-password	do not ask for old password (root only)\n";
+			print "  -?, --help			show this help message\n";
+			exit (-1);
+		} elsif ( ($arg eq '-o') || ($arg eq '--without-old-password') ) {
+			$oldpass = 1;
+		} elsif (substr($arg,0) ne '-')  {
+			$user = $arg;
+			if (!defined(getpwnam($user))) {
+				die "$0: Unknown user name '$user'\n";	;
+			}
+		}
+	}
+}
+
+if (!defined($user)) {
+	$user=$ENV{"USER"};
+}
+
+# current user's dn
+my $dn = '';
+
+if ($< == 0) {
+	system "stty -echo";
+	print "LDAP password for root DN: ";
+	chomp($passwd=<STDIN>);
+	print "\n";
+	system "stty echo";
+	# Find dn for user $user binding as root's dn
+	chomp($dn=`ldapsearch -h '$server' -b '$basedn' -s '$scope' -D '$binddn' -w '$passwd' '(uid=$user)'|head -1`);
+	if ( ($dn eq '') || ($passwd eq '') ) {
+		print "Wrong LDAP password for root DN!\n";
+		exit (-1);
+	}
+} else {
+	if (!defined($oldpass)) {
+		system "stty -echo";
+		print "Old password for user $user: ";
+		chomp($oldpass=<STDIN>);
+		print "\n";
+		system "stty echo";
+
+		# Find path to uid
+		chomp($path_to_uid=`ldapsearch -h '$server' -b '$basedn' -s '$scope' '(uid=$user)'|head -1`);
+		# Find old password for user $user binding as self
+		chomp($dn=`ldapsearch -h '$server' -b '$basedn' -s '$scope' -D '$path_to_uid' -w '$oldpass' '(uid=$user)'|head -1`);
+
+		if ( ($dn eq '') || ($oldpass eq '') ) {
+			print "Wrong password for user $user!\n";
+			exit (-1);
+		}
+	} 
+}
+
+system "stty -echo";
+print "New password for user $user: ";
+chomp($pass=<STDIN>);
+print "\n";
+system "stty echo";
+
+system "stty -echo";
+print "Retype new password for user $user: ";
+chomp($pass2=<STDIN>);
+print "\n";
+system "stty echo";
+
+if ( ($pass ne $pass2) || (length($pass)<1) ) {
+	die "Wrong password!\n";
+} else {
+# MD5 password
+$random = join '', ('.', '/', 0..9, 'A'..'Z', 'a'..'z')[rand 64, rand 64, rand 64, rand 64, rand 64, rand 64, rand 64, rand 64];
+$bsalt = "\$1\$"; $esalt = "\$";
+$modsalt = $bsalt.$random.$esalt;
+$password = crypt($pass, $modsalt);
+
+# LanManager and NT clear text passwords
+$ntpwd = `/usr/local/sbin/mkntpwd '$pass'`;
+chomp($lmpassword = substr($ntpwd, 0, index($ntpwd, ':')));
+chomp($ntpassword = substr($ntpwd, index($ntpwd, ':')+1));
+
+#$FILE="|/usr/bin/ldapmodify -h '$server' -D '$binddn' -w $passwd";
+if ($< != 0) {
+        $FILE="|/usr/bin/ldapmodify -h '$server' -D '$dn' -w '$oldpass'";
+} else {
+        $FILE="|/usr/bin/ldapmodify -h '$server' -D '$binddn' -w '$passwd'";
+}
+
+# Chenge time
+$shadowlastchange=int(time/24/3600);
+$pwdlastset=sprintf('%x',time);
+
+open FILE or die;
+
+print FILE <<EOF;
+dn: $dn
+changetype: modify
+replace: userPassword
+userPassword: {crypt}$password
+-
+changetype: modify
+replace: lmpassword
+lmpassword: $lmpassword
+-
+changetype: modify
+replace: ntpassword
+ntpassword: $ntpassword
+-
+changetype: modify
+replace: shadowlastchange
+shadowlastchange: $shadowlastchange
+-
+changetype: modify
+replace: pwdlastset
+pwdlastset: $pwdlastset
+-
+
+EOF
+close FILE;
+
+}
+
+exit 0;
+
diff --git a/examples/LDAP/ldapsync.pl b/examples/LDAP/ldapsync.pl
new file mode 100644
index 00000000000..fecc594c2d2
--- /dev/null
+++ b/examples/LDAP/ldapsync.pl
@@ -0,0 +1,117 @@
+#!/usr/bin/perl -w
+
+# LDAP to unix password sync script for samba-tng
+# originally by Jody Haynes <Jody.Haynes@isunnetworks.com>
+# 12/12/2000    milos@interactivesi.com
+#               modified for use with MD5 passwords
+# 12/16/2000	mami@arena.sci.univr.it
+#		modified to change lmpassword and ntpassword for samba
+# 05/01/2001	mami@arena.sci.univr.it
+#		modified for being also a /bin/passwd replacement
+
+$basedn = "ou=Students,dc=univr, dc=it";
+$binddn = "uid=root,dc=univr,dc=it";
+$scope = "sub";
+$passwd = "mysecret";
+
+foreach $arg (@ARGV) {
+	if ($< != 0) {
+		die "Only root can specify parameters\n";
+	} else {
+		if ( ($arg eq '-?') || ($arg eq '--help') ) {
+			print "Usage: $0 [-o] [username]\n";
+			print "  -o, --without-old-password	do not ask for old password (root only)\n";
+			print "  -?, --help			show this help message\n";
+			exit (-1);
+		} elsif ( ($arg eq '-o') || ($arg eq '--without-old-password') ) {
+			$oldpass = 1;
+		} elsif (substr($arg,0) ne '-')  {
+			$user = $arg;
+			if (!defined(getpwnam($user))) {
+				die "$0: Unknown user name '$user'\n";	;
+			}
+		}
+	}
+}
+
+if (!defined($user)) {
+	$user=$ENV{"USER"};
+}
+
+if (!defined($oldpass)) {
+	system "stty -echo";
+	print "Old password for user $user: ";
+	chomp($oldpass=<STDIN>);
+	print "\n";
+	system "stty echo";
+
+	$ntpwd = `/usr/local/sbin/smbencrypt '$oldpass'`;
+	$lmpassword = substr($ntpwd, 0, index($ntpwd, ':')); chomp $lmpassword;
+	$ntpassword = substr($ntpwd, index($ntpwd, ':')+1); chomp $ntpassword;
+
+	# Find dn for user $user (maybe check unix password too?)
+	$dn=`ldapsearch -b '$basedn' -s '$scope' '(&(uid=$user)(lmpassword=$lmpassword)(ntpassword=$ntpassword))'|head -1`;
+	chomp $dn;
+
+	if ($dn eq '') {
+		print "Wrong password for user $user!\n";
+		exit (-1);
+	}
+} else {
+	# Find dn for user $user
+	$dn=`ldapsearch -b '$basedn' -s '$scope' '(uid=$user)'|head -1`;
+	chomp $dn;
+}
+
+system "stty -echo";
+print "New password for user $user: ";
+chomp($pass=<STDIN>);
+print "\n";
+system "stty echo";
+
+system "stty -echo";
+print "Retype new password for user $user: ";
+chomp($pass2=<STDIN>);
+print "\n";
+system "stty echo";
+
+if ($pass ne $pass2) {
+	die "Wrong password!\n";
+} else {
+# MD5 password
+$random = join '', ('.', '/', 0..9, 'A'..'Z', 'a'..'z')[rand 64, rand 64, rand 64, rand 64, rand 64, rand 64, rand 64, rand 64];
+$bsalt = "\$1\$"; $esalt = "\$";
+$modsalt = $bsalt.$random.$esalt;
+$password = crypt($pass, $modsalt);
+
+# LanManager and NT clear text passwords
+$ntpwd = `/usr/local/sbin/smbencrypt '$pass'`;
+chomp($lmpassword = substr($ntpwd, 0, index($ntpwd, ':')));
+chomp($ntpassword = substr($ntpwd, index($ntpwd, ':')+1));
+
+$FILE="|/usr/bin/ldapmodify -D '$binddn' -w $passwd";
+
+open FILE or die;
+
+print FILE <<EOF;
+dn: $dn
+changetype: modify
+replace: userPassword
+userPassword: {crypt}$password
+-
+changetype: modify
+replace: lmpassword
+lmpassword: $lmpassword
+-
+changetype: modify
+replace: ntpassword
+ntpassword: $ntpassword
+-
+
+EOF
+close FILE;
+
+}
+
+exit 0;
+