Noel Power [Mon, 29 Jan 2018 18:30:33 +0000 (18:30 +0000)]
s3:libads: Allow 'net ads keytab add' handle Windows SPN(s) part 1
This patch addresses how the windows SPN is converted into a kerberos
priniciple to be written to the keytab file. A followup patch will
deal with writing Window SPN(s) to the AD.
Before this change 'net ads keytab add' handled three scenarios
a) 'net ads keytab add param' is passed a fully qualified kerberos principal
(identified by the presence of '@' in param) In this scenario the keytab
file alone is updated with the principal contained in 'param'.
b) 'net ads keytab add param'; is passed a machine name (identified by
the paramater ending with '$'). In this case the machine name
is converted to a kerberos principal with according to the recipe
'param@realm' where realm is determined by lp_realm().
c) 'net ads keytab add param' is passed a service (e.g. nfs, http etc.)
In this scenario the param containing the service is first converted to
into 2 kerberos principals (long and short forms) according to the
following recipe
i) long form: 'param/fully_qualified_dns@realm'
ii) short form: 'param/netbios_name@realm'
where 'fully_qualified_dns is retrieved from 'dNSHostName' attribute of
'this' machines computer account on the AD.
The principals are written to the keytab file
Secondly 2 windows SPNs are generated from 'param' as follows
i) long form 'param/full_qualified_dns'
ii) short form 'param/netbios_name'
These SPNs are written to the AD computer account object
After this change a) & b) & c) will retain legacy behaviour except
in the case of c) where if the 'param' passed to c) is a Windows SPN
(e.g. conforming to format 'serviceclass/host:port'
i) 'param' will get converted to a kerberos principal (just a single one)
with the following recipe: 'serviceclass/host@realm' which will
be written to the keytab file. The SPN written to the AD is created
as before and the legacy behaviour is preserved.
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Noel Power [Wed, 24 Jan 2018 14:26:03 +0000 (14:26 +0000)]
s3:utils: add new 'net ads setspn list' subcommand
This patch adds basic functionality not unlike the setspn.exe
command that is provided by windows for adminsistering SPN on
the AD. (see https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731241(v=ws.11)
Only the basic list operation (that corresponds to the -l
switch for setspn.exe is implemented)
Usage:
net ads setspn list <computer>
Note: <computer> is optional, if not specified the computer account
associated with value returned by lp_netbios_name() is used instead.
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Previously the function 'ads_add_service_principal_name' created
the SPNs based on the machine_name and dns name passed to the function.
In order to prepare for a future patch that will also need to write
SPN(s) to the AD computer account, the function implementation will
need to be changed. Instead of the function creating the SPN(s) it
will now take the list SPN(s) to write to the AD 'machine_name' account
as an input param instead.
The name of the function has been changed to
'ads_add_service_principal_names' to reflect this. Additionally client
code now needs to construct the SPNs to be passed into the function.
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Noel Power [Fri, 12 Jan 2018 14:22:34 +0000 (14:22 +0000)]
s3:libads: Clean up code a little rename 'ads_get_samaccountname()'
Function 'ads_get_samaccountname()' basically returns the machine_name passed
as an input param (appended with '$') if it exists on the ad. The function
really is testing for the existence of the samaccountname and is not really
'getting' it. This is also the way it is used. Renaming this function to
'ads_has_samaccountname()' better reflects what it is actually doing and how
clients calling the code use it. It also makes the client code using calling
this function less confusing.
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Noel Power [Fri, 12 Jan 2018 12:22:45 +0000 (12:22 +0000)]
s3:libads: ads_get_dnshostname & ads_get_samaccountname don't use param
Both ads_get_dnshostname() & ads_get_samaccountname() are passed
a param machinename as a argument. Instead of using 'machinename' these
functions are erroneously using lp_netbiosname() instead.
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Christof Schmitt [Mon, 26 Feb 2018 22:58:20 +0000 (23:58 +0100)]
Fix autobuild for user names starting with c
This is similar to the fix from commit 0b1ba00: Now commit 475a7616 introduced
tests that create user names in the form DOMAIN\USER and pass them through
shell functions. There "echo" is used to print he username, resulting in
/bin/dash on sn-devel to interpret e.g. \c which skips any further output. The
result are test exceptions like:
failure: samba4.blackbox.trust_ntlm.Test01 rpcclient lookupnames with LOCALADMEMBER\cs(ad_member:local) [
Exception: Exception: LOCALADMEMBER
]
time: 2018-02-26 23:00:46.688800Z
Fix this by replacing the echo with printf %s. This surfaced for
test_rpcclient_grep, but apply the same change to all functions in
common_test_fns.inc for consistency.
Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Christof Schmitt <cs@samba.org>
Autobuild-Date(master): Fri Mar 2 10:49:09 CET 2018 on sn-devel-144
Ralph Boehme [Thu, 1 Mar 2018 10:43:39 +0000 (11:43 +0100)]
nsswitch: fix wbinfo -m --verbose trust type "Local"
Remove wrong "Local" strcmp(), there's another one, the correct one, a few lines
below. Since commit 95e3307917b5731ab883ee5fce530c5b559b4934
WBC_DOMINFO_TRUSTTYPE_NONE, which corresponded to the string "None" in the
winbindd response, is not used anymore.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Mar 2 05:49:18 CET 2018 on sn-devel-144
Amitay Isaacs [Thu, 1 Mar 2018 01:32:26 +0000 (12:32 +1100)]
ctdb-pmda: Use modified API in pcp library 4.0
Support backward compatibility by checking for __pmID_int type, which
was previously in <pcp/impl.h>. In the new version, this type is not
defined anymore and there is no need to include <pcp/impl.h>.
Signed-off-by: Amitay Isaacs <amitay@gmail.com> Reviewed-by: Martin Schwenke <martin@meltin.net>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Fri Mar 2 00:38:52 CET 2018 on sn-devel-144
Martin Schwenke [Tue, 3 Jan 2017 22:53:54 +0000 (09:53 +1100)]
ctdb-scripts: Avoid no-op "ctdb ptrans" call
This causes unnecessary g_lock activity and overhead.
This could be optimised in ctdb.c:control_ptrans(). However, that
makes the code more complex. Let's only do that if we get more
potentially no-op uses.
Note no optimisation is needed in the "notify" case because there is
already an early exit if there are no items.
Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Martin Schwenke [Tue, 13 Feb 2018 00:55:07 +0000 (11:55 +1100)]
ctdb-tests: Avoid creating files in /tmp.
Temporary test data should all go somewhere under TEST_VAR_DIR instead
of in the global /tmp. The existing mktemp could be changed so the
data goes into the test directory but mktemp is overkill in this case.
Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Martin Schwenke [Tue, 6 Feb 2018 05:41:36 +0000 (16:41 +1100)]
ctdb-tests: Clean up PATH setting for stubs/ subdirectory
Drop unnecessary PATH setting in rc.local. The functions file no
longer sets PATH so setting it here is unnecessary. Fix a comment
referencing this PATH setting.
Given EVENTSCRIPTS_PATH is no longer used, use a more obvious variable
name and fail on missing stubs/ subdirectory.
Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Martin Schwenke [Mon, 12 Feb 2018 00:34:57 +0000 (11:34 +1100)]
ctdb-tests: Use consistent NAT gateway nodes file
Using a different file each time causes the event script to believe
that the configuration has changed even though only the node states
have changed. Change this to stop the tests from doing something
unexpected.
Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Amitay Isaacs <amitay@gmail.com>
wafsamba: Build with -Wimplicit-fallthrough if supported
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Mar 1 19:38:12 CET 2018 on sn-devel-144
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Mar 1 14:48:19 CET 2018 on sn-devel-144
Volker Lendecke [Mon, 26 Feb 2018 14:12:14 +0000 (15:12 +0100)]
winbind: Fix a race between the sigchld and 0-sized socket read
Fix a bug when a child dies when a request is pending in the child. If the
signal handler fires before epoll finds out the other end of the parent-child
socket is closed, we close the socket on our side without taking care of the
pending request. This causes two problems: First, that one pending request
never is replied to properly, and secondly, we might end up with EPOLL_DEL on a
wrong file descriptor. This causes all sorts of trouble if we hit an active
one.
The fix for this problem is not to close the socket in winbind_child_died().
This however stops an idle child that dies hard from being properly cleaned up.
The fix for that is to add the child->monitor_fde that is set pending only when
no child request is active. This way we can remove the close(sock) in the
signal handler.
Volker Lendecke [Mon, 26 Feb 2018 12:45:01 +0000 (13:45 +0100)]
winbind: Use forall_children in reinit_after_fork()
This removes the special handling for idmap_child() after the "This is
a little tricky" comment. I believe this was not required at all, the
idmap_child is part of the winbindd_children list.
Volker Lendecke [Mon, 26 Feb 2018 12:14:21 +0000 (13:14 +0100)]
winbind: "internal" children never have a domain set
Look at setup_domain_child(): There we always set child->domain. The only other
two children are the idmap and locator children, which don't have a domain set.
Volker Lendecke [Mon, 26 Feb 2018 11:55:31 +0000 (12:55 +0100)]
winbind: Implement forall_children()
Step 0 in removing winbindd_children as a variable: We have access to
all children via our domain list and the two explicit children. There's
no need to separately maintain a list of winbind children. Maintaining
child->pid != 0 is sufficient to make sure we only walk active children.
Timur I. Bakeyev [Mon, 11 Dec 2017 01:47:21 +0000 (02:47 +0100)]
Remove some bashisms from the test scripts
Signed-off-by: Timur I. Bakeyev <timur@iXsystems.com> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
libsmb: Remove incorrect fall through comment in trusts_util.c
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Mar 1 09:52:37 CET 2018 on sn-devel-144
projects / thirdparty / samba.git / log
