summaryrefslogtreecommitdiffstats
path: root/source4/setup
Commit message (Collapse)AuthorAgeFilesLines
* s4:provision Remove all references to samba4LocalDomainAndrew Bartlett2009-10-122-21/+24
| | | | | | | | | This was a bad idea all along, as Simo said at the time. With the full MS schema and enforcement of it, it is an even worse idea. This fixes the provision of the member server in 'make test' Andrew Bartlett
* s4-provision: match win2003 functional levelAndrew Tridgell2009-10-063-4/+4
| | | | | We are now defaulting to win2003 functional level, and see to report the right revisions of our db and schema
* s4:provision_users.ldif - Put potential primary groups in front of the fileMatthias Dieter Wallnöfer2009-10-021-19/+20
| | | | (So they can be always found by the SAMLDB module)
* s4:dsdb rework instanceType module - put instanceType in provisionAndrew Bartlett2009-10-023-0/+3
| | | | | The instanceType needs to be specified in future because that's how the partitions are actually created.
* s4: Improve provisioning: use relax controlMatthieu Patou2009-10-023-2/+2
| | | | | | | Give the possibility to specify controls when loading ldif files. Relax control is specified by default for all ldb_add_diff (request Andrew B). Set domainguid if specified at the creation of object instead of modifying afterward Allow to specify objectGUID for NTDS object of the first DC this option is used during provision upgrade.
* s4:provision - Change the default forest/domain function level back to ↵Matthias Dieter Wallnöfer2009-10-021-1/+1
| | | | Windows 2003 Native
* s4:pwsettings - Improve error handling and introduce "choice" typeMatthias Dieter Wallnöfer2009-09-301-13/+10
| | | | | | - Improve the error handling according to Jelmer's suggestions - Print out the error messages on "stderr" - Add also here the "choice" type for arguments
* s4:provision - Lets the user choose between the supported forest/domain ↵Matthias Dieter Wallnöfer2009-09-301-8/+17
| | | | | | | function levels Adds a parameter "--function-level" which allows to specify the domain and forest function level.
* s4:provision: Show domains and forests are W2K8 DC capable.Andrew Kroeger2009-09-302-0/+15
| | | | | | | | | | | | | | When adding a W2K8 DC to a domain running earlier DC versions, the "adprep" utility is used to perform schema updates and update other attributes as necessary. Adding these entries provides an indication that the adprep utility has been run with the /forestprep, /domainprep and /rodcprep arguments. Although these entries indicate adprep has been run, nothing has been done to verify that the changes that the adprep utility would have made have actually been done. The values used for the revision atttributes are as seen on a W2K8 DC (not W2K8 R2, which will probably have higher values).
* s4:provision: Update schema version number to W2K8.Andrew Kroeger2009-09-301-1/+1
| | | | We are running the W2K8 schema version, not the W2K3 version.
* s4:domainlevel - General reworkMatthias Dieter Wallnöfer2009-09-301-29/+63
| | | | | | | | | - We support domain/forest function levels >= (Windows) 2003 Native -> adapt the domain/forest and DC function level restrictions. - Consider also the lowest function level of a DC. The domain and forest function levels can never be higher than it. - Improve the error handling by printing out messages to "stderr" - Introduce the "choice" type for choice arguments (saves us some error handling)
* s4:LDIFs - enhance the section commentsMatthias Dieter Wallnöfer2009-09-252-0/+12
|
* Merge branch 'master' of git://git.samba.org/sambaNadezhda Ivanova2009-09-219-37/+73
|\
| * s4:samdb/tools - That should fix now the last failuresMatthias Dieter Wallnöfer2009-09-212-1/+3
| |
| * s4:scripts - Reintroduce "-H" parameterMatthias Dieter Wallnöfer2009-09-216-12/+46
| | | | | | | | | | | | I removed it since on some scripts it was present, on others not - so I thought it wouldn't be really needed. This was a bad decision (pointed out by abartlet). So I reintroduce it on all scripts (to have consistent parameters).
| * s4:provision split provision of DNS zone and self join keytabAndrew Bartlett2009-09-203-24/+24
| |
* | Merge branch 'master' of git://git.samba.org/sambaNadezhda Ivanova2009-09-203-28/+11
|\|
| * s4:python tools - try to fix some test problemsMatthias Dieter Wallnöfer2009-09-202-2/+2
| |
| * s4:domainlevel - fixed another errorMatthias Dieter Wallnöfer2009-09-201-26/+9
| | | | | | | | | | | | The second "nTMixedDomain" attribute (under Partitions/Domain-DN) is only a copy of the one under the directory root object. Therefore there doesn't exist the "Windows 2000 Mixed" forest level.
* | Initial implementation of security descriptor creation in DSNadezhda Ivanova2009-09-202-0/+2
|/ | | | | TODO's: ACE sorting and clarifying the inheritance of object specific ace's.
* s4:provision_configuration - fix "sPNMappings"Matthias Dieter Wallnöfer2009-09-201-2/+1
| | | | | | | I reread some docs about this attributes and it seems that this as mapping attribute isn't host specific but in common for the whole domain. To allow Windows DCs to join our s4 domain sooner or later we have to provide the full attribute.
* s4:domainlevel - further improvementsMatthias Dieter Wallnöfer2009-09-201-9/+50
| | | | | | | | - The tool displays now also mixed/interim domain levels and warns about them (s4 isn't capable to run on them) - But it allows now also to raise/step-up from them - It displays now also levels higher than 2008 R2 (altough we don't support them yet) but to be able to get a correct output
* s4:provision_basedn_modify - fix the "auditPolicy" attributeMatthias Dieter Wallnöfer2009-09-201-1/+2
| | | | | | I had to think about how to encode the string 0x0001 (taken from Windows Server). The problem is due to the "0" byte at the beginning of it. BASE64 encoding seems a good method to do it.
* s4:provision_configuration - "sPNMappings": "http" missed on regenerationMatthias Dieter Wallnöfer2009-09-181-1/+1
|
* s4/provision_configuration - re-add the "sPNMappings"Matthias Dieter Wallnöfer2009-09-181-0/+3
| | | | Accidentally removed by a previous commit.
* s4:scripts - Cleans also the rest under the "setup" directory upMatthias Dieter Wallnöfer2009-09-183-30/+43
| | | | | | - I removed also the "-H" parameter since those scripts are all thought for the use on a local s4 domain controller. Another reason is also the bind as SYSTEM account which itself is only possible on local binds.
* s4:various scripts under "setup" - UnificationMatthias Dieter Wallnöfer2009-09-184-73/+74
| | | | | | | - This unified the shape of those four scripts (comments, command sequence, call of SamDB) - To consider the samdb.py changes regarding the filter: there is now always the possibility either to specify the username or the search filter
* s4:domainlevel/pwsettings - Remove unused importMatthias Dieter Wallnöfer2009-09-182-2/+0
|
* s4:domainlevel - fix indentationsMatthias Dieter Wallnöfer2009-09-181-4/+4
|
* s4:domainlevel - Add a script which allows raising the domain/forest levelMatthias Dieter Wallnöfer2009-09-181-0/+181
| | | | | | This simple script allows raising the domain and/or forest level for s4. I integrated also the basic checks (since we don't perform them in LDB yet): e.g. the forest level can't be higher than the domain level(s).
* s4:pwsettings - Simplify the error handling a bitMatthias Dieter Wallnöfer2009-09-181-5/+2
|
* s4:provision - Bump down the domain and forest level to Windows 2000Matthias Dieter Wallnöfer2009-09-181-6/+7
| | | | | | | | | | | | - The DC level we keep on Windows Server 2008 R2 (we should call ourself always the newest server type) - The domain/forest level we set to the minimum (Windows 2000 native) to allow all AD DC types (from Windows 2000 on) in our domain - the NT4 "mixed" mode isn't supported by us (discussed on mailing list) -> "nTMixedDomain" is set always to 0 - I'll add a script which allows to bump the DC level (basically sets the "msDS-Behaviour-Version" attributes on the "Partitions/Configuration/DC" and on the "DC" object)
* s4:provision - Some rework (continuation)Matthias Dieter Wallnöfer2009-09-173-37/+307
| | | | | | | | | | | - Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
* s4:provision - Some reworkMatthias Dieter Wallnöfer2009-09-1711-23607/+23874
| | | | | | | | | | - Add/change "wellKnownObjects" attributes - Order entries in "provision_basedn_modify.ldif" - Add/change "delete entries" object under BASEDN and CONFIGDN - Fix default version number of "Default domain policy" group policy - Add "domain updates" objects for interoperability with MS AD maintaining tools - Show version number in the "oEMInformation" attribute (suggested by ekacnet) - Smaller fixups
* s4:sites & services - Adds Intersite transport containersMatthieu Patou2009-09-121-5/+28
| | | | | This patch brings up those subcontainers and fixes up the "systemFlags" on the "Subnet" entry.
* s4:group policies - the default group policy objects are all system-criticalMatthias Dieter Wallnöfer2009-09-121-0/+6
|
* s4:group policies - add the domain controller group policyMatthias Dieter Wallnöfer2009-09-113-3/+32
| | | | | | | | | This patches fixes the last difference between s4 and Windows Server regarding group policy objects: we hadn't the domain controller policy. - Adds the domain controller policy as it is found in the "original" AD - Adds also the right version number in the GPT.INI file for the domain group policy (was missing)
* s4-provision: revert _gc_tcp priorityAndrew Tridgell2009-09-111-1/+1
| | | | | thanks to id10ts for spotting this. I was a victim of emacs zone mode, which increaed it with each edit.
* s4-provision: use DNS name, not domain nameAndrew Tridgell2009-09-111-2/+2
| | | | The SPNs end in the DNS domain name
* s4/provision: add the nTDSDSA GUID based DNS entries and SPNsAndrew Tridgell2009-09-112-3/+8
| | | | | | The DNS entries and SPNs are needed for samba<->samba DRS replication. This patch adds them for a standalone DC configure. A separate patch will add them for the vampire configure
* s4:setup Updated Display Specifiers from Microsoft (with #s)Andrew Bartlett2009-09-115-91/+30
| | | | | | | | This fixes the issue with the original files that they didn't have a leading # in front of the comments, which caused our parsing scripts much pain. The files are now exactly as delivered. Andrew Bartlett
* s4:pwsettings: Added blackbox tests.Andrew Kroeger2009-09-101-0/+2
| | | | | | The added tests include basic validation that the script runs and accepts all custom arguments. The tests also verify changes to the password complexity, minimum password length, and minimum password length settings.
* s4:pwsettings: Show default values in help messages.Andrew Kroeger2009-09-101-4/+4
|
* s4:pwsettings: Add 'default' option for password complexity.Andrew Kroeger2009-09-101-2/+2
|
* s4:pwsettings: Added validation.Andrew Kroeger2009-09-101-4/+26
| | | | | | | | | | Validate that each field is within its allowed range. Also validate that the maximum password age is greater than the minimum password length (if the maximum password age is set). I could not find these values documented anywhere in the WSPP docs. I used the values shown in the W2K8 GPMC, as it appears that the GPMC actuaally performs the validation of values.
* s4:pwsettings: Don't assume a value for pwdProperties.Andrew Kroeger2009-09-101-2/+2
| | | | | | | If we cannot retrieve the value, do not assume a particular value. The fact that we could not retrieve the value indicates a larger problem that we don't want to make worse bypossibly clearing bit fields in the pwdProperties attribute.
* s4:pwsettings: Run all updates as a single modify() operation.Andrew Kroeger2009-09-101-31/+19
| | | | | | This ensures that all changes are made, or none are made. It also makes it possible to do validation as we go and abort in case of an error, while always leaving things in a consistent state.
* s4:pwsettings: Added --quiet option.Andrew Kroeger2009-09-101-16/+17
| | | | | Also changed all non-error status output to use the message() function, which respects the --quiet option.
* s4: Use SASL authentication against Fedora DS.Endi Sukma Dewata2009-09-105-18/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | 1. During instance creation the provisioning script will import the SASL mapping for samba-admin. It's done here due to missing config schema preventing adding the mapping via ldapi. 2. After that it will use ldif2db to import the cn=samba-admin user as the target of SASL mapping. 3. Then it will start FDS and continue to do provisioning using the Directory Manager with simple bind. 4. The SASL credentials will be stored in secrets.ldb, so when Samba server runs later it will use the SASL credentials. 5. After the provisioning is done (just before stopping the slapd) it will use the DM over direct ldapi to delete the default SASL mappings included automatically by FDS, leaving just the new samba-admin mapping. 6. Also before stopping slapd it will use the DM over direct ldapi to set the ACL on the root entries of the user, configuration, and schema partitions. The ACL will give samba-admin the full access to these partitions. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* s4:pwsettings: Correct off by factor of 10 for ticks.Andrew Kroeger2009-09-071-4/+4
| | | | | | The tick conversion math was off by a factor of 10 due to the incorrect usage of the "e" notation. The expression "XeY" means "X * (10^Y)", so the correct expression is 1e7 to get the correct adjustment for ticks.
generated by cgit (git 2.34.1) at 2025-09-26 04:32:24 +0000