smeserver-samba/sme9/smeserver-samba-0.1.0-provision_password.patch

diff -urN smeserver-samba-0.1.0/createlinks smeserver-samba-0.1.0.provision-update/createlinks
--- smeserver-samba-0.1.0/createlinks   2014-11-23 00:07:36.000000000 -0800
+++ smeserver-samba-0.1.0.provision-update/createlinks  2016-06-18 21:54:07.781770465 -0700
@@ -25,9 +25,7 @@
 event_link("adjust-samba-down", $event, "01");
 event_link("initialize-default-databases", $event, "01");
 event_link("provision-domain-controller", $event, "01");
-event_link("samba-disable-password-policy", $event, "02");
 event_link("samba-reset-defaults", $event, "02");
-event_link("samba-create-ad-LDAP-access", $event, "03");
 event_link("samba-create-domain-admins", $event,"03");
 event_link("adjust-samba-up", $event, "50");
 
@@ -39,9 +37,7 @@
 ##Links for bootstrap-intialize-samba event
 $event = "bootstrap-initialize-samba";
 event_link("provision-domain-controller", $event, "02");
-event_link("samba-disable-password-policy", $event, "02");
 event_link("samba-reset-defaults", $event, "02");
-event_link("samba-create-ad-LDAP-access", $event, "03");
 event_link("samba-create-domain-admins", $event,"03");
 
 
diff -urN smeserver-samba-0.1.0/root/etc/e-smith/events/actions/provision-domain-controller smeserver-samba-0.1.0.provision-update/root/etc/e-smith/events/actions/provision-domain-controller
--- smeserver-samba-0.1.0/root/etc/e-smith/events/actions/provision-domain-controller   2014-11-20 21:54:06.000000000 -0800
+++ smeserver-samba-0.1.0.provision-update/root/etc/e-smith/events/actions/provision-domain-controller  2016-06-18 16:53:12.000000000 -0700
@@ -13,6 +13,7 @@
 use strict;
 use warnings;
 use esmith::ConfigDB;
+use esmith::AD;
 
 ##Pull arguments
 my $event = $ARGV [0];
@@ -38,19 +39,59 @@
 ##Remove existing smb.conf file or the provision will error out
 unlink ('/etc/samba/smb.conf') if (-e '/etc/samba/smb.conf');
 
+##Generate complex password for SME Server runtime transactions with AD
+##Encrypt and stash the password locally
+my @set = ('0'..'9','A'..'Z','a'..'z');
+my $set = '';
+my $provisionPass = join '' => map $set[rand @set], 1..20;
+
+warn "Creating and stashing complex password for AD transactions.\n";
+
+my $encrypted_pass = MIME::Base64::encode($provisionPass);
+unlink '/etc/samba/AD.pw';
+unless ( open( WR, ">/etc/samba/AD.pw" ) ) {
+    die "Samba provisioning error: Unable to create Active Directory LDAP password\n";
+    return undef;
+}
+print WR "$encrypted_pass\n";
+close WR;
+chmod 0600, '/etc/samba/AD.pw';
+
+
 ##Initialize Samba Domain
+warn "Samba domain: Provisining Active Directory.";
 my $provision = "/usr/bin/samba-tool domain provision --server-role=dc " .
                 "--domain=$WorkGroup " .
                 "--realm=$DomainName " .
-                "--adminpass=$AdminPass " .
+                "--adminpass=$provisionPass " .
                 "--dns-backend=SAMBA_INTERNAL " . 
                 "--use-rfc2307 " .
                 "--use-xattrs=yes";
 
 system ($provision);
-
 die "Unable to provision Samba in $event" if ($? == -1);
 
+##Disable default Samba password policy so we can control it in the SME UI
+warn "Samba domain:  Disabling default Samba password policy.\n";
+
+my $policy_reset = "/usr/bin/samba-tool domain passwordsettings set " .
+                   "--complexity=off "  .
+                   "--min-pwd-length=0 " .
+                   "--min-pwd-age=0 " .
+                   "--max-pwd-age=365 " .
+                   "-U Administrator\%$provisionPass";
+system ($policy_reset);
+die "Samba domain error: Unable to disable default password policy.\n" if ($? == -1);
+
+##Change administrator password from the stashed password to the admin password 
+warn "Samba domain: Setting Admin Password\n";
+my $set_admin_pass = "/usr/bin/samba-tool user setpassword Administrator " .
+                     "--newpassword=" . $AdminPass . " " .
+                     "-U Administrator\%" . $provisionPass;
+
+system ($set_admin_pass);
+die "Samba domain error: Unable to SME Server admin password.\n" if ($? == -1);
+
 ##Set samba key to initialized in bootstrap-console so it doesn't initialize again
 if ($event eq 'bootstrap-initialize-samba') {
 
diff -urN smeserver-samba-0.1.0/root/etc/e-smith/events/actions/samba-create-ad-LDAP-access smeserver-samba-0.1.0.provision-update/root/etc/e-smith/events/actions/samba-create-ad-LDAP-access
--- smeserver-samba-0.1.0/root/etc/e-smith/events/actions/samba-create-ad-LDAP-access   2014-11-22 23:59:18.000000000 -0800
+++ smeserver-samba-0.1.0.provision-update/root/etc/e-smith/events/actions/samba-create-ad-LDAP-access  1969-12-31 16:00:00.000000000 -0800
@@ -1,64 +0,0 @@
-#!/usr/bin/perl
-#------------------------------------------------------------
-#This action generates a special Active Directory user
-#to be used for SME Server access to the Active Directory.
-#The password for this user will be stored encrypted to
-#/etc/samba/AD.pw
-#
-#Copyright 2014 Koozali Foundation, Inc.
-#11/15/2014: G.Zartman <gzartman@koozali.org>
-#
-#The code contained herein can be distributed under the same
-#license as Perl
-#
-#TO DO:
-#
-#------------------------------------------------------------
-package esmith::thisaction;
-
-use strict;
-use warnings;
-use esmith::ConfigDB;
-use MIME::Base64();
-
-##Pull arguments
-my $event = $ARGV [0];
-my $AdminPass = $ARGV [1];
-
-die 'Active Directory access error: Missing admin password' unless ($AdminPass);
-
-##Generate an ad_admin password, encrypt it, then write it to /etc/samba/AD.pw
-my @set = ('0'..'9','A'..'Z','a'..'z');
-my $set = '';
-my $pass = join '' => map $set[rand @set], 1..20;
-
-warn "Creating stashed password for ad_admin\n";
-
-my $encrypted_pass = MIME::Base64::encode($pass);
-unlink '/etc/samba/AD.pw';
-unless ( open( WR, ">/etc/samba/AD.pw" ) ) {
-    die "Samba provisioning error: Unable to create Active Directory LDAP password\n";
-    return undef;
-}
-print WR "$encrypted_pass\n";
-close WR;
-chmod 0600, '/etc/samba/AD.pw';
-
-warn "ad_admin: $pass\n";
-
-##Set ad_admin account to active directory as a domain admin
-my $add_admin = "/usr/bin/samba-tool user create " .
-                "ad_admin $pass " .
-                "-U Administrator\%$AdminPass";
-system ($add_admin);
-die "Samba provisioning error: Unable to create ad_admin user in Active Directory.\n" if ($? == -1);
-
-my $add_members = "/usr/bin/samba-tool group addmembers " .
-                  "\'Domain Admins\' ".
-                  "ad_admin " .
-                  "-U Administrator\%$AdminPass";
-system ($add_members);
-die "Samba provisioning error: Unable to add ad_admin user to the Domain Admins group.\n" if ($? == -1);
-
-1;
-
diff -urN smeserver-samba-0.1.0/root/etc/e-smith/events/actions/samba-create-domain-admins smeserver-samba-0.1.0.provision-update/root/etc/e-smith/events/actions/samba-create-domain-admins
--- smeserver-samba-0.1.0/root/etc/e-smith/events/actions/samba-create-domain-admins    2014-11-20 21:54:57.000000000 -0800
+++ smeserver-samba-0.1.0.provision-update/root/etc/e-smith/events/actions/samba-create-domain-admins   2016-06-18 21:20:11.000000000 -0700
@@ -14,6 +14,7 @@
 use strict;
 use warnings;
 use esmith::ConfigDB;
+use esmith::AD;
 
 ##Pull arguments
 my $event = $ARGV [0];
@@ -22,22 +23,20 @@
 die 'Samba provisioning error: Missing admin password' unless ($AdminPass);
 
 ##Bail if called by bootstrap-initialize-samba and it has already been run
-##
 my $cdb = esmith::ConfigDB->open;
 if ($event eq 'bootstrap-initialize-samba' && 
     $cdb->get_prop('bootstrap-console','Samba') eq 'initialized') {
     exit();
 }
 
-##Set admin samba accounts and add to Domain Admin
+
+##Create admin and root accounts in AD and add to Domain Admin
 my $add_admin = "/usr/bin/samba-tool user create " .
                 "admin $AdminPass " .
                 "-U Administrator\%$AdminPass";
 system ($add_admin);
-
 warn "Unable create admin Samba user\n" if ($? == -1);
 
-
 my $add_root = "/usr/bin/samba-tool user create " .
                "root $AdminPass " .
                "-U Administrator\%$AdminPass"; 
@@ -51,4 +50,19 @@
 system ($add_members);
 warn "Unable to add admin and root users to Domain Admins group\n" if ($? == -1);
 
+
+##Create ad_admin account and add it to domain admins for runtime access to acive directory
+my $add_ad_admin = "/usr/bin/samba-tool user create " .
+                   "ad_admin " . esmith::AD::getADPass() . " " .
+                   "-U Administrator\%$AdminPass";
+system ($add_ad_admin);
+die "Samba provisioning error: Unable to create ad_admin user in Active Directory.\n" if ($? == -1);
+
+$add_members = "/usr/bin/samba-tool group addmembers " .
+               "\'Domain Admins\' ".
+               "ad_admin " .
+               "-U Administrator\%$AdminPass";
+#system ($add_members);
+die "Samba provisioning error: Unable to add ad_admin user to the Domain Admins group.\n" if ($? == -1);
+
 1;
diff -urN smeserver-samba-0.1.0/root/etc/e-smith/events/actions/samba-disable-password-policy smeserver-samba-0.1.0.provision-update/root/etc/e-smith/events/actions/samba-disable-password-policy
--- smeserver-samba-0.1.0/root/etc/e-smith/events/actions/samba-disable-password-policy 2014-11-22 23:59:18.000000000 -0800
+++ smeserver-samba-0.1.0.provision-update/root/etc/e-smith/events/actions/samba-disable-password-policy        1969-12-31 16:00:00.000000000 -0800
@@ -1,41 +0,0 @@
-#!/usr/bin/perl
-#------------------------------------------------------------
-#This action disables the build-in Samba password policy.
-#If we leave the default policy in place, creating a user
-#may fail and it may be difficult to capture this failure.
-#Instead, we will use SME's password strength checking.
-#
-#Copyright 2014 Koozali Foundation, Inc.
-#11/22/2014: G.Zartman <gzartman@koozali.org>
-#
-#The code contained herein can be distributed under the same
-#license as Perl
-#
-#TO DO:
-#
-#------------------------------------------------------------
-package esmith::thisaction;
-
-use strict;
-use warnings;
-
-##Pull arguments
-my $event = $ARGV [0];
-my $AdminPass = $ARGV [1];
-
-die 'Active Directory access error: Missing admin password' unless ($AdminPass);
-
-##Disable the Samba password policy using samba-tool
-warn "Samba domain:  Disabling default Samba password policy\n";
-
-my $samba_tool = "/usr/bin/samba-tool domain passwordsettings set " .
-                 "--complexity=off "  .
-                 "--min-pwd-length=0 " .
-                 "--min-pwd-age=0 " .
-                 "--max-pwd-age=365 " . 
-                  "-U Administrator\%$AdminPass";
-system ($samba_tool);
-die "Samba domain error: Unable to disable default password policy.\n" if ($? == -1);
-
-1;
-
1	gzartman	1.1	diff -urN smeserver-samba-0.1.0/createlinks smeserver-samba-0.1.0.provision-update/createlinks
2			--- smeserver-samba-0.1.0/createlinks 2014-11-23 00:07:36.000000000 -0800
3			+++ smeserver-samba-0.1.0.provision-update/createlinks 2016-06-18 21:54:07.781770465 -0700
4			@@ -25,9 +25,7 @@
5			event_link("adjust-samba-down", $event, "01");
6			event_link("initialize-default-databases", $event, "01");
7			event_link("provision-domain-controller", $event, "01");
8			-event_link("samba-disable-password-policy", $event, "02");
9			event_link("samba-reset-defaults", $event, "02");
10			-event_link("samba-create-ad-LDAP-access", $event, "03");
11			event_link("samba-create-domain-admins", $event,"03");
12			event_link("adjust-samba-up", $event, "50");
13
14			@@ -39,9 +37,7 @@
15			##Links for bootstrap-intialize-samba event
16			$event = "bootstrap-initialize-samba";
17			event_link("provision-domain-controller", $event, "02");
18			-event_link("samba-disable-password-policy", $event, "02");
19			event_link("samba-reset-defaults", $event, "02");
20			-event_link("samba-create-ad-LDAP-access", $event, "03");
21			event_link("samba-create-domain-admins", $event,"03");
22
23
24			diff -urN smeserver-samba-0.1.0/root/etc/e-smith/events/actions/provision-domain-controller smeserver-samba-0.1.0.provision-update/root/etc/e-smith/events/actions/provision-domain-controller
25			--- smeserver-samba-0.1.0/root/etc/e-smith/events/actions/provision-domain-controller 2014-11-20 21:54:06.000000000 -0800
26			+++ smeserver-samba-0.1.0.provision-update/root/etc/e-smith/events/actions/provision-domain-controller 2016-06-18 16:53:12.000000000 -0700
27			@@ -13,6 +13,7 @@
28			use strict;
29			use warnings;
30			use esmith::ConfigDB;
31			+use esmith::AD;
32
33			##Pull arguments
34			my $event = $ARGV [0];
35			@@ -38,19 +39,59 @@
36			##Remove existing smb.conf file or the provision will error out
37			unlink ('/etc/samba/smb.conf') if (-e '/etc/samba/smb.conf');
38
39			+##Generate complex password for SME Server runtime transactions with AD
40			+##Encrypt and stash the password locally
41			+my @set = ('0'..'9','A'..'Z','a'..'z');
42			+my $set = '';
43			+my $provisionPass = join '' => map $set[rand @set], 1..20;
44			+
45			+warn "Creating and stashing complex password for AD transactions.\n";
46			+
47			+my $encrypted_pass = MIME::Base64::encode($provisionPass);
48			+unlink '/etc/samba/AD.pw';
49			+unless ( open( WR, ">/etc/samba/AD.pw" ) ) {
50			+ die "Samba provisioning error: Unable to create Active Directory LDAP password\n";
51			+ return undef;
52			+}
53			+print WR "$encrypted_pass\n";
54			+close WR;
55			+chmod 0600, '/etc/samba/AD.pw';
56			+
57			+
58			##Initialize Samba Domain
59			+warn "Samba domain: Provisining Active Directory.";
60			my $provision = "/usr/bin/samba-tool domain provision --server-role=dc " .
61			"--domain=$WorkGroup " .
62			"--realm=$DomainName " .
63			- "--adminpass=$AdminPass " .
64			+ "--adminpass=$provisionPass " .
65			"--dns-backend=SAMBA_INTERNAL " .
66			"--use-rfc2307 " .
67			"--use-xattrs=yes";
68
69			system ($provision);
70			-
71			die "Unable to provision Samba in $event" if ($? == -1);
72
73			+##Disable default Samba password policy so we can control it in the SME UI
74			+warn "Samba domain: Disabling default Samba password policy.\n";
75			+
76			+my $policy_reset = "/usr/bin/samba-tool domain passwordsettings set " .
77			+ "--complexity=off " .
78			+ "--min-pwd-length=0 " .
79			+ "--min-pwd-age=0 " .
80			+ "--max-pwd-age=365 " .
81			+ "-U Administrator\%$provisionPass";
82			+system ($policy_reset);
83			+die "Samba domain error: Unable to disable default password policy.\n" if ($? == -1);
84			+
85			+##Change administrator password from the stashed password to the admin password
86			+warn "Samba domain: Setting Admin Password\n";
87			+my $set_admin_pass = "/usr/bin/samba-tool user setpassword Administrator " .
88			+ "--newpassword=" . $AdminPass . " " .
89			+ "-U Administrator\%" . $provisionPass;
90			+
91			+system ($set_admin_pass);
92			+die "Samba domain error: Unable to SME Server admin password.\n" if ($? == -1);
93			+
94			##Set samba key to initialized in bootstrap-console so it doesn't initialize again
95			if ($event eq 'bootstrap-initialize-samba') {
96
97			diff -urN smeserver-samba-0.1.0/root/etc/e-smith/events/actions/samba-create-ad-LDAP-access smeserver-samba-0.1.0.provision-update/root/etc/e-smith/events/actions/samba-create-ad-LDAP-access
98			--- smeserver-samba-0.1.0/root/etc/e-smith/events/actions/samba-create-ad-LDAP-access 2014-11-22 23:59:18.000000000 -0800
99			+++ smeserver-samba-0.1.0.provision-update/root/etc/e-smith/events/actions/samba-create-ad-LDAP-access 1969-12-31 16:00:00.000000000 -0800
100			@@ -1,64 +0,0 @@
101			-#!/usr/bin/perl
102			-#------------------------------------------------------------
103			-#This action generates a special Active Directory user
104			-#to be used for SME Server access to the Active Directory.
105			-#The password for this user will be stored encrypted to
106			-#/etc/samba/AD.pw
107			-#
108			-#Copyright 2014 Koozali Foundation, Inc.
109			-#11/15/2014: G.Zartman <gzartman@koozali.org>
110			-#
111			-#The code contained herein can be distributed under the same
112			-#license as Perl
113			-#
114			-#TO DO:
115			-#
116			-#------------------------------------------------------------
117			-package esmith::thisaction;
118			-
119			-use strict;
120			-use warnings;
121			-use esmith::ConfigDB;
122			-use MIME::Base64();
123			-
124			-##Pull arguments
125			-my $event = $ARGV [0];
126			-my $AdminPass = $ARGV [1];
127			-
128			-die 'Active Directory access error: Missing admin password' unless ($AdminPass);
129			-
130			-##Generate an ad_admin password, encrypt it, then write it to /etc/samba/AD.pw
131			-my @set = ('0'..'9','A'..'Z','a'..'z');
132			-my $set = '';
133			-my $pass = join '' => map $set[rand @set], 1..20;
134			-
135			-warn "Creating stashed password for ad_admin\n";
136			-
137			-my $encrypted_pass = MIME::Base64::encode($pass);
138			-unlink '/etc/samba/AD.pw';
139			-unless ( open( WR, ">/etc/samba/AD.pw" ) ) {
140			- die "Samba provisioning error: Unable to create Active Directory LDAP password\n";
141			- return undef;
142			-}
143			-print WR "$encrypted_pass\n";
144			-close WR;
145			-chmod 0600, '/etc/samba/AD.pw';
146			-
147			-warn "ad_admin: $pass\n";
148			-
149			-##Set ad_admin account to active directory as a domain admin
150			-my $add_admin = "/usr/bin/samba-tool user create " .
151			- "ad_admin $pass " .
152			- "-U Administrator\%$AdminPass";
153			-system ($add_admin);
154			-die "Samba provisioning error: Unable to create ad_admin user in Active Directory.\n" if ($? == -1);
155			-
156			-my $add_members = "/usr/bin/samba-tool group addmembers " .
157			- "\'Domain Admins\' ".
158			- "ad_admin " .
159			- "-U Administrator\%$AdminPass";
160			-system ($add_members);
161			-die "Samba provisioning error: Unable to add ad_admin user to the Domain Admins group.\n" if ($? == -1);
162			-
163			-1;
164			-
165			diff -urN smeserver-samba-0.1.0/root/etc/e-smith/events/actions/samba-create-domain-admins smeserver-samba-0.1.0.provision-update/root/etc/e-smith/events/actions/samba-create-domain-admins
166			--- smeserver-samba-0.1.0/root/etc/e-smith/events/actions/samba-create-domain-admins 2014-11-20 21:54:57.000000000 -0800
167			+++ smeserver-samba-0.1.0.provision-update/root/etc/e-smith/events/actions/samba-create-domain-admins 2016-06-18 21:20:11.000000000 -0700
168			@@ -14,6 +14,7 @@
169			use strict;
170			use warnings;
171			use esmith::ConfigDB;
172			+use esmith::AD;
173
174			##Pull arguments
175			my $event = $ARGV [0];
176			@@ -22,22 +23,20 @@
177			die 'Samba provisioning error: Missing admin password' unless ($AdminPass);
178
179			##Bail if called by bootstrap-initialize-samba and it has already been run
180			-##
181			my $cdb = esmith::ConfigDB->open;
182			if ($event eq 'bootstrap-initialize-samba' &&
183			$cdb->get_prop('bootstrap-console','Samba') eq 'initialized') {
184			exit();
185			}
186
187			-##Set admin samba accounts and add to Domain Admin
188			+
189			+##Create admin and root accounts in AD and add to Domain Admin
190			my $add_admin = "/usr/bin/samba-tool user create " .
191			"admin $AdminPass " .
192			"-U Administrator\%$AdminPass";
193			system ($add_admin);
194			-
195			warn "Unable create admin Samba user\n" if ($? == -1);
196
197			-
198			my $add_root = "/usr/bin/samba-tool user create " .
199			"root $AdminPass " .
200			"-U Administrator\%$AdminPass";
201			@@ -51,4 +50,19 @@
202			system ($add_members);
203			warn "Unable to add admin and root users to Domain Admins group\n" if ($? == -1);
204
205			+
206			+##Create ad_admin account and add it to domain admins for runtime access to acive directory
207			+my $add_ad_admin = "/usr/bin/samba-tool user create " .
208			+ "ad_admin " . esmith::AD::getADPass() . " " .
209			+ "-U Administrator\%$AdminPass";
210			+system ($add_ad_admin);
211			+die "Samba provisioning error: Unable to create ad_admin user in Active Directory.\n" if ($? == -1);
212			+
213			+$add_members = "/usr/bin/samba-tool group addmembers " .
214			+ "\'Domain Admins\' ".
215			+ "ad_admin " .
216			+ "-U Administrator\%$AdminPass";
217			+#system ($add_members);
218			+die "Samba provisioning error: Unable to add ad_admin user to the Domain Admins group.\n" if ($? == -1);
219			+
220			1;
221			diff -urN smeserver-samba-0.1.0/root/etc/e-smith/events/actions/samba-disable-password-policy smeserver-samba-0.1.0.provision-update/root/etc/e-smith/events/actions/samba-disable-password-policy
222			--- smeserver-samba-0.1.0/root/etc/e-smith/events/actions/samba-disable-password-policy 2014-11-22 23:59:18.000000000 -0800
223			+++ smeserver-samba-0.1.0.provision-update/root/etc/e-smith/events/actions/samba-disable-password-policy 1969-12-31 16:00:00.000000000 -0800
224			@@ -1,41 +0,0 @@
225			-#!/usr/bin/perl
226			-#------------------------------------------------------------
227			-#This action disables the build-in Samba password policy.
228			-#If we leave the default policy in place, creating a user
229			-#may fail and it may be difficult to capture this failure.
230			-#Instead, we will use SME's password strength checking.
231			-#
232			-#Copyright 2014 Koozali Foundation, Inc.
233			-#11/22/2014: G.Zartman <gzartman@koozali.org>
234			-#
235			-#The code contained herein can be distributed under the same
236			-#license as Perl
237			-#
238			-#TO DO:
239			-#
240			-#------------------------------------------------------------
241			-package esmith::thisaction;
242			-
243			-use strict;
244			-use warnings;
245			-
246			-##Pull arguments
247			-my $event = $ARGV [0];
248			-my $AdminPass = $ARGV [1];
249			-
250			-die 'Active Directory access error: Missing admin password' unless ($AdminPass);
251			-
252			-##Disable the Samba password policy using samba-tool
253			-warn "Samba domain: Disabling default Samba password policy\n";
254			-
255			-my $samba_tool = "/usr/bin/samba-tool domain passwordsettings set " .
256			- "--complexity=off " .
257			- "--min-pwd-length=0 " .
258			- "--min-pwd-age=0 " .
259			- "--max-pwd-age=365 " .
260			- "-U Administrator\%$AdminPass";
261			-system ($samba_tool);
262			-die "Samba domain error: Unable to disable default password policy.\n" if ($? == -1);
263			-
264			-1;
265			-