1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright 2017 Nexenta Systems, Inc. All rights reserved. 24 */ 25 26 /* 27 * This module contains smbadm CLI which offers smb configuration 28 * functionalities. 29 */ 30 #include <errno.h> 31 #include <err.h> 32 #include <ctype.h> 33 #include <stdlib.h> 34 #include <unistd.h> 35 #include <stdio.h> 36 #include <syslog.h> 37 #include <strings.h> 38 #include <limits.h> 39 #include <getopt.h> 40 #include <libintl.h> 41 #include <zone.h> 42 #include <pwd.h> 43 #include <grp.h> 44 #include <libgen.h> 45 #include <netinet/in.h> 46 #include <auth_attr.h> 47 #include <locale.h> 48 #include <smbsrv/libsmb.h> 49 #include <smbsrv/libsmbns.h> 50 51 #if !defined(TEXT_DOMAIN) 52 #define TEXT_DOMAIN "SYS_TEST" 53 #endif 54 55 typedef enum { 56 HELP_ADD_MEMBER, 57 HELP_CREATE, 58 HELP_DELETE, 59 HELP_DEL_MEMBER, 60 HELP_GET, 61 HELP_JOIN, 62 HELP_LIST, 63 HELP_LOOKUP, 64 HELP_RENAME, 65 HELP_SET, 66 HELP_SHOW, 67 HELP_USER_DISABLE, 68 HELP_USER_ENABLE, 69 HELP_USER_DELETE 70 } smbadm_help_t; 71 72 #define SMBADM_CMDF_NONE 0x00 73 #define SMBADM_CMDF_USER 0x01 74 #define SMBADM_CMDF_GROUP 0x02 75 #define SMBADM_CMDF_TYPEMASK 0x0F 76 77 typedef enum { 78 SMBADM_GRP_ADDMEMBER = 0, 79 SMBADM_GRP_DELMEMBER, 80 } smbadm_grp_action_t; 81 82 #define SMBADM_ANSBUFSIZ 64 83 84 typedef struct smbadm_cmdinfo { 85 char *name; 86 int (*func)(int, char **); 87 smbadm_help_t usage; 88 uint32_t flags; 89 char *auth; 90 } smbadm_cmdinfo_t; 91 92 smbadm_cmdinfo_t *curcmd; 93 static char *progname; 94 95 #define SMBADM_ACTION_AUTH "solaris.smf.manage.smb" 96 #define SMBADM_VALUE_AUTH "solaris.smf.value.smb" 97 #define SMBADM_BASIC_AUTH "solaris.network.hosts.read" 98 99 static boolean_t smbadm_checkauth(const char *); 100 101 static void smbadm_usage(boolean_t); 102 static int smbadm_join_workgroup(const char *, boolean_t); 103 static int smbadm_join_domain(const char *, const char *, boolean_t); 104 static void smbadm_extract_domain(char *, char **, char **); 105 106 static int smbadm_join(int, char **); 107 static int smbadm_list(int, char **); 108 static int smbadm_lookup(int, char **); 109 static void smbadm_lookup_name(char *); 110 static void smbadm_lookup_sid(char *); 111 static int smbadm_group_create(int, char **); 112 static int smbadm_group_delete(int, char **); 113 static int smbadm_group_rename(int, char **); 114 static int smbadm_group_show(int, char **); 115 static void smbadm_group_show_name(const char *, const char *); 116 static int smbadm_group_getprop(int, char **); 117 static int smbadm_group_setprop(int, char **); 118 static int smbadm_group_addmember(int, char **); 119 static int smbadm_group_delmember(int, char **); 120 static int smbadm_group_add_del_member(char *, char *, smbadm_grp_action_t); 121 122 static int smbadm_user_delete(int, char **); 123 static int smbadm_user_disable(int, char **); 124 static int smbadm_user_enable(int, char **); 125 126 static smbadm_cmdinfo_t smbadm_cmdtable[] = 127 { 128 { "add-member", smbadm_group_addmember, HELP_ADD_MEMBER, 129 SMBADM_CMDF_GROUP, SMBADM_ACTION_AUTH }, 130 { "create", smbadm_group_create, HELP_CREATE, 131 SMBADM_CMDF_GROUP, SMBADM_ACTION_AUTH }, 132 { "delete", smbadm_group_delete, HELP_DELETE, 133 SMBADM_CMDF_GROUP, SMBADM_ACTION_AUTH }, 134 { "delete-user", smbadm_user_delete, HELP_USER_DELETE, 135 SMBADM_CMDF_USER, SMBADM_ACTION_AUTH }, 136 { "disable-user", smbadm_user_disable, HELP_USER_DISABLE, 137 SMBADM_CMDF_USER, SMBADM_ACTION_AUTH }, 138 { "enable-user", smbadm_user_enable, HELP_USER_ENABLE, 139 SMBADM_CMDF_USER, SMBADM_ACTION_AUTH }, 140 { "get", smbadm_group_getprop, HELP_GET, 141 SMBADM_CMDF_GROUP, SMBADM_ACTION_AUTH }, 142 { "join", smbadm_join, HELP_JOIN, 143 SMBADM_CMDF_NONE, SMBADM_VALUE_AUTH }, 144 { "list", smbadm_list, HELP_LIST, 145 SMBADM_CMDF_NONE, SMBADM_BASIC_AUTH }, 146 { "lookup", smbadm_lookup, HELP_LOOKUP, 147 SMBADM_CMDF_NONE, SMBADM_BASIC_AUTH }, 148 { "remove-member", smbadm_group_delmember, HELP_DEL_MEMBER, 149 SMBADM_CMDF_GROUP, SMBADM_ACTION_AUTH }, 150 { "rename", smbadm_group_rename, HELP_RENAME, 151 SMBADM_CMDF_GROUP, SMBADM_ACTION_AUTH }, 152 { "set", smbadm_group_setprop, HELP_SET, 153 SMBADM_CMDF_GROUP, SMBADM_ACTION_AUTH }, 154 { "show", smbadm_group_show, HELP_SHOW, 155 SMBADM_CMDF_GROUP, SMBADM_ACTION_AUTH }, 156 }; 157 158 #define SMBADM_NCMD (sizeof (smbadm_cmdtable) / sizeof (smbadm_cmdtable[0])) 159 160 typedef struct smbadm_prop { 161 char *p_name; 162 char *p_value; 163 } smbadm_prop_t; 164 165 typedef struct smbadm_prop_handle { 166 char *p_name; 167 char *p_dispvalue; 168 int (*p_setfn)(char *, smbadm_prop_t *); 169 int (*p_getfn)(char *, smbadm_prop_t *); 170 boolean_t (*p_chkfn)(smbadm_prop_t *); 171 } smbadm_prop_handle_t; 172 173 static boolean_t smbadm_prop_validate(smbadm_prop_t *prop, boolean_t chkval); 174 static int smbadm_prop_parse(char *arg, smbadm_prop_t *prop); 175 static smbadm_prop_handle_t *smbadm_prop_gethandle(char *pname); 176 177 static boolean_t smbadm_chkprop_priv(smbadm_prop_t *prop); 178 static int smbadm_setprop_tkowner(char *gname, smbadm_prop_t *prop); 179 static int smbadm_getprop_tkowner(char *gname, smbadm_prop_t *prop); 180 static int smbadm_setprop_backup(char *gname, smbadm_prop_t *prop); 181 static int smbadm_getprop_backup(char *gname, smbadm_prop_t *prop); 182 static int smbadm_setprop_restore(char *gname, smbadm_prop_t *prop); 183 static int smbadm_getprop_restore(char *gname, smbadm_prop_t *prop); 184 static int smbadm_setprop_desc(char *gname, smbadm_prop_t *prop); 185 static int smbadm_getprop_desc(char *gname, smbadm_prop_t *prop); 186 187 static smbadm_prop_handle_t smbadm_ptable[] = { 188 {"backup", "on | off", smbadm_setprop_backup, 189 smbadm_getprop_backup, smbadm_chkprop_priv }, 190 {"restore", "on | off", smbadm_setprop_restore, 191 smbadm_getprop_restore, smbadm_chkprop_priv }, 192 {"take-ownership", "on | off", smbadm_setprop_tkowner, 193 smbadm_getprop_tkowner, smbadm_chkprop_priv }, 194 {"description", "<string>", smbadm_setprop_desc, 195 smbadm_getprop_desc, NULL }, 196 }; 197 198 static int smbadm_init(void); 199 static void smbadm_fini(void); 200 static const char *smbadm_pwd_strerror(int error); 201 202 /* 203 * Number of supported properties 204 */ 205 #define SMBADM_NPROP (sizeof (smbadm_ptable) / sizeof (smbadm_ptable[0])) 206 207 static void 208 smbadm_cmdusage(FILE *fp, smbadm_cmdinfo_t *cmd) 209 { 210 switch (cmd->usage) { 211 case HELP_ADD_MEMBER: 212 (void) fprintf(fp, 213 gettext("\t%s -m member [[-m member] ...] group\n"), 214 cmd->name); 215 return; 216 217 case HELP_CREATE: 218 (void) fprintf(fp, gettext("\t%s [-d description] group\n"), 219 cmd->name); 220 return; 221 222 case HELP_DELETE: 223 (void) fprintf(fp, gettext("\t%s group\n"), cmd->name); 224 return; 225 226 case HELP_USER_DELETE: 227 case HELP_USER_DISABLE: 228 case HELP_USER_ENABLE: 229 (void) fprintf(fp, gettext("\t%s user\n"), cmd->name); 230 return; 231 232 case HELP_GET: 233 (void) fprintf(fp, gettext("\t%s [[-p property] ...] group\n"), 234 cmd->name); 235 return; 236 237 case HELP_JOIN: 238 #if 0 /* Don't document "-p" yet, still needs work (NX 11960) */ 239 (void) fprintf(fp, gettext("\t%s [-y] -p domain\n" 240 "\t%s [-y] -u username domain\n\t%s [-y] -w workgroup\n"), 241 cmd->name, cmd->name, cmd->name); 242 #else 243 (void) fprintf(fp, gettext("\t%s [-y] -u username domain\n" 244 "\t%s [-y] -w workgroup\n"), cmd->name, cmd->name); 245 #endif 246 return; 247 248 case HELP_LIST: 249 (void) fprintf(fp, gettext("\t%s\n"), cmd->name); 250 (void) fprintf(fp, 251 gettext("\t\t[*] primary domain\n")); 252 (void) fprintf(fp, gettext("\t\t[.] local domain\n")); 253 (void) fprintf(fp, gettext("\t\t[-] other domains\n")); 254 (void) fprintf(fp, 255 gettext("\t\t[+] selected domain controller\n")); 256 return; 257 258 case HELP_LOOKUP: 259 (void) fprintf(fp, 260 gettext("\t%s user-or-group-name\n"), 261 cmd->name); 262 return; 263 264 case HELP_DEL_MEMBER: 265 (void) fprintf(fp, 266 gettext("\t%s -m member [[-m member] ...] group\n"), 267 cmd->name); 268 return; 269 270 case HELP_RENAME: 271 (void) fprintf(fp, gettext("\t%s group new-group\n"), 272 cmd->name); 273 return; 274 275 case HELP_SET: 276 (void) fprintf(fp, gettext("\t%s -p property=value " 277 "[[-p property=value] ...] group\n"), cmd->name); 278 return; 279 280 case HELP_SHOW: 281 (void) fprintf(fp, gettext("\t%s [-m] [-p] [group]\n"), 282 cmd->name); 283 return; 284 285 default: 286 break; 287 } 288 289 abort(); 290 /* NOTREACHED */ 291 } 292 293 static void 294 smbadm_usage(boolean_t requested) 295 { 296 FILE *fp = requested ? stdout : stderr; 297 boolean_t show_props = B_FALSE; 298 int i; 299 300 if (curcmd == NULL) { 301 (void) fprintf(fp, 302 gettext("usage: %s [-h | <command> [options]]\n"), 303 progname); 304 (void) fprintf(fp, 305 gettext("where 'command' is one of the following:\n\n")); 306 307 for (i = 0; i < SMBADM_NCMD; i++) 308 smbadm_cmdusage(fp, &smbadm_cmdtable[i]); 309 310 (void) fprintf(fp, 311 gettext("\nFor property list, run %s %s|%s\n"), 312 progname, "get", "set"); 313 314 exit(requested ? 0 : 2); 315 } 316 317 (void) fprintf(fp, gettext("usage:\n")); 318 smbadm_cmdusage(fp, curcmd); 319 320 if (strcmp(curcmd->name, "get") == 0 || 321 strcmp(curcmd->name, "set") == 0) 322 show_props = B_TRUE; 323 324 if (show_props) { 325 (void) fprintf(fp, 326 gettext("\nThe following properties are supported:\n")); 327 328 (void) fprintf(fp, "\n\t%-16s %s\n\n", 329 "PROPERTY", "VALUES"); 330 331 for (i = 0; i < SMBADM_NPROP; i++) { 332 (void) fprintf(fp, "\t%-16s %s\n", 333 smbadm_ptable[i].p_name, 334 smbadm_ptable[i].p_dispvalue); 335 } 336 } 337 338 exit(requested ? 0 : 2); 339 } 340 341 /* 342 * smbadm_strcasecmplist 343 * 344 * Find a string 's' within a list of strings. 345 * 346 * Returns the index of the matching string or -1 if there is no match. 347 */ 348 static int 349 smbadm_strcasecmplist(const char *s, ...) 350 { 351 va_list ap; 352 char *p; 353 int ndx; 354 355 va_start(ap, s); 356 357 for (ndx = 0; ((p = va_arg(ap, char *)) != NULL); ++ndx) { 358 if (strcasecmp(s, p) == 0) { 359 va_end(ap); 360 return (ndx); 361 } 362 } 363 364 va_end(ap); 365 return (-1); 366 } 367 368 /* 369 * smbadm_answer_prompt 370 * 371 * Prompt for the answer to a question. A default response must be 372 * specified, which will be used if the user presses <enter> without 373 * answering the question. 374 */ 375 static int 376 smbadm_answer_prompt(const char *prompt, char *answer, const char *dflt) 377 { 378 char buf[SMBADM_ANSBUFSIZ]; 379 char *p; 380 381 (void) printf(gettext("%s [%s]: "), prompt, dflt); 382 383 if (fgets(buf, SMBADM_ANSBUFSIZ, stdin) == NULL) 384 return (-1); 385 386 if ((p = strchr(buf, '\n')) != NULL) 387 *p = '\0'; 388 389 if (*buf == '\0') 390 (void) strlcpy(answer, dflt, SMBADM_ANSBUFSIZ); 391 else 392 (void) strlcpy(answer, buf, SMBADM_ANSBUFSIZ); 393 394 return (0); 395 } 396 397 /* 398 * smbadm_confirm 399 * 400 * Ask a question that requires a yes/no answer. 401 * A default response must be specified. 402 */ 403 static boolean_t 404 smbadm_confirm(const char *prompt, const char *dflt) 405 { 406 char buf[SMBADM_ANSBUFSIZ]; 407 408 for (;;) { 409 if (smbadm_answer_prompt(prompt, buf, dflt) < 0) 410 return (B_FALSE); 411 412 if (smbadm_strcasecmplist(buf, "n", "no", 0) >= 0) 413 return (B_FALSE); 414 415 if (smbadm_strcasecmplist(buf, "y", "yes", 0) >= 0) 416 return (B_TRUE); 417 418 (void) printf(gettext("Please answer yes or no.\n")); 419 } 420 } 421 422 static boolean_t 423 smbadm_join_prompt(const char *domain) 424 { 425 (void) printf(gettext("After joining %s the smb service will be " 426 "restarted automatically.\n"), domain); 427 428 return (smbadm_confirm("Would you like to continue?", "no")); 429 } 430 431 static void 432 smbadm_restart_service(void) 433 { 434 if (smb_smf_restart_service() != 0) { 435 (void) fprintf(stderr, 436 gettext("Unable to restart smb service. " 437 "Run 'svcs -xv smb/server' for more information.")); 438 } 439 } 440 441 /* 442 * smbadm_join 443 * 444 * Join a domain or workgroup. 445 * 446 * When joining a domain, we may receive the username, password and 447 * domain name in any of the following combinations. Note that the 448 * password is optional on the command line: if it is not provided, 449 * we will prompt for it later. 450 * 451 * username+password domain 452 * domain\username+password 453 * domain/username+password 454 * username@domain 455 * 456 * We allow domain\name+password or domain/name+password but not 457 * name+password@domain because @ is a valid password character. 458 * 459 * If the username and domain name are passed as separate command 460 * line arguments, we process them directly. Otherwise we separate 461 * them and continue as if they were separate command line arguments. 462 */ 463 static int 464 smbadm_join(int argc, char **argv) 465 { 466 char buf[MAXHOSTNAMELEN * 2]; 467 char *domain = NULL; 468 char *username = NULL; 469 uint32_t mode = 0; 470 boolean_t do_prompt = B_TRUE; 471 char option; 472 473 while ((option = getopt(argc, argv, "pu:wy")) != -1) { 474 if (mode != 0) { 475 (void) fprintf(stderr, gettext( 476 "join options are mutually exclusive\n")); 477 smbadm_usage(B_FALSE); 478 } 479 switch (option) { 480 case 'p': 481 mode = SMB_SECMODE_DOMAIN; 482 /* leave username = NULL */ 483 break; 484 485 case 'u': 486 mode = SMB_SECMODE_DOMAIN; 487 username = optarg; 488 break; 489 490 case 'w': 491 mode = SMB_SECMODE_WORKGRP; 492 break; 493 494 case 'y': 495 do_prompt = B_FALSE; 496 break; 497 498 default: 499 smbadm_usage(B_FALSE); 500 break; 501 } 502 } 503 504 if (optind < argc) 505 domain = argv[optind]; 506 507 if (username != NULL && domain == NULL) { 508 /* 509 * The domain was not specified as a separate 510 * argument, check for the combination forms. 511 */ 512 (void) strlcpy(buf, username, sizeof (buf)); 513 smbadm_extract_domain(buf, &username, &domain); 514 } 515 516 if ((domain == NULL) || (*domain == '\0')) { 517 (void) fprintf(stderr, gettext("missing %s name\n"), 518 (mode == SMB_SECMODE_WORKGRP) ? "workgroup" : "domain"); 519 smbadm_usage(B_FALSE); 520 } 521 522 if (mode == SMB_SECMODE_WORKGRP) { 523 return (smbadm_join_workgroup(domain, do_prompt)); 524 } 525 return (smbadm_join_domain(domain, username, do_prompt)); 526 } 527 528 /* 529 * Workgroups comprise a collection of standalone, independently administered 530 * computers that use a common workgroup name. This is a peer-to-peer model 531 * with no formal membership mechanism. 532 */ 533 static int 534 smbadm_join_workgroup(const char *workgroup, boolean_t prompt) 535 { 536 smb_joininfo_t jdi; 537 smb_joinres_t jdres; 538 uint32_t status; 539 540 bzero(&jdres, sizeof (jdres)); 541 bzero(&jdi, sizeof (jdi)); 542 jdi.mode = SMB_SECMODE_WORKGRP; 543 (void) strlcpy(jdi.domain_name, workgroup, sizeof (jdi.domain_name)); 544 (void) strtrim(jdi.domain_name, " \t\n"); 545 546 if (smb_name_validate_workgroup(jdi.domain_name) != ERROR_SUCCESS) { 547 (void) fprintf(stderr, gettext("workgroup name is invalid\n")); 548 smbadm_usage(B_FALSE); 549 } 550 551 if (prompt && !smbadm_join_prompt(jdi.domain_name)) 552 return (0); 553 554 if ((status = smb_join(&jdi, &jdres)) != NT_STATUS_SUCCESS) { 555 (void) fprintf(stderr, gettext("failed to join %s: %s\n"), 556 jdi.domain_name, xlate_nt_status(status)); 557 return (1); 558 } 559 560 (void) printf(gettext("Successfully joined %s\n"), jdi.domain_name); 561 smbadm_restart_service(); 562 return (0); 563 } 564 565 /* 566 * Domains comprise a centrally administered group of computers and accounts 567 * that share a common security and administration policy and database. 568 * Computers must join a domain and become domain members, which requires 569 * an administrator level account name. 570 * 571 * The '+' character is invalid within a username. We allow the password 572 * to be appended to the username using '+' as a scripting convenience. 573 */ 574 static int 575 smbadm_join_domain(const char *domain, const char *username, boolean_t prompt) 576 { 577 smb_joininfo_t jdi; 578 smb_joinres_t jdres; 579 char *passwd_prompt; 580 char *p; 581 int len, rc; 582 583 bzero(&jdres, sizeof (jdres)); 584 bzero(&jdi, sizeof (jdi)); 585 jdi.mode = SMB_SECMODE_DOMAIN; 586 (void) strlcpy(jdi.domain_name, domain, sizeof (jdi.domain_name)); 587 (void) strtrim(jdi.domain_name, " \t\n"); 588 589 if (smb_name_validate_domain(jdi.domain_name) != ERROR_SUCCESS) { 590 (void) fprintf(stderr, gettext("domain name is invalid\n")); 591 smbadm_usage(B_FALSE); 592 } 593 594 if (prompt && !smbadm_join_prompt(jdi.domain_name)) 595 return (0); 596 597 /* 598 * Note: username is null for "unsecure join" 599 * (join using a pre-created computer account) 600 * No password either. 601 */ 602 if (username != NULL) { 603 if ((p = strchr(username, '+')) != NULL) { 604 ++p; 605 606 len = (int)(p - username); 607 if (len > sizeof (jdi.domain_name)) 608 len = sizeof (jdi.domain_name); 609 610 (void) strlcpy(jdi.domain_username, username, len); 611 (void) strlcpy(jdi.domain_passwd, p, 612 sizeof (jdi.domain_passwd)); 613 } else { 614 (void) strlcpy(jdi.domain_username, username, 615 sizeof (jdi.domain_username)); 616 } 617 618 if (smb_name_validate_account(jdi.domain_username) 619 != ERROR_SUCCESS) { 620 (void) fprintf(stderr, 621 gettext("username contains invalid characters\n")); 622 smbadm_usage(B_FALSE); 623 } 624 625 if (*jdi.domain_passwd == '\0') { 626 passwd_prompt = gettext("Enter domain password: "); 627 628 if ((p = getpassphrase(passwd_prompt)) == NULL) { 629 (void) fprintf(stderr, gettext( 630 "missing password\n")); 631 smbadm_usage(B_FALSE); 632 } 633 634 (void) strlcpy(jdi.domain_passwd, p, 635 sizeof (jdi.domain_passwd)); 636 } 637 } 638 639 (void) printf(gettext("Joining %s ... this may take a minute ...\n"), 640 jdi.domain_name); 641 642 rc = smb_join(&jdi, &jdres); 643 if (rc != 0) { 644 (void) printf(gettext("Cannot call the SMB service. " 645 " (error %d: %s) " 646 "Please check the service status " 647 "(svcs -vx network/smb/server)\n"), 648 rc, strerror(rc)); 649 bzero(&jdi, sizeof (jdi)); 650 return (1); 651 } 652 653 switch (jdres.status) { 654 case NT_STATUS_SUCCESS: 655 (void) printf(gettext( 656 "Successfully joined domain %s using AD server %s\n"), 657 jdi.domain_name, jdres.dc_name); 658 bzero(&jdi, sizeof (jdi)); 659 smbadm_restart_service(); 660 return (0); 661 662 case NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND: 663 /* See: smb_ads_lookup_msdcs */ 664 (void) fprintf(stderr, gettext( 665 "failed to find any AD servers for domain: %s\n"), 666 jdi.domain_name); 667 goto common; 668 669 case NT_STATUS_BAD_NETWORK_PATH: 670 /* See: smbrdr_ctx_new / smb_ctx_resolve */ 671 (void) fprintf(stderr, gettext( 672 "failed to resolve address of AD server: %s\n"), 673 jdres.dc_name); 674 goto common; 675 676 case NT_STATUS_NETWORK_ACCESS_DENIED: 677 /* See: smbrdr_ctx_new / smb_ctx_get_ssn */ 678 (void) fprintf(stderr, gettext( 679 "failed to authenticate with AD server: %s\n"), 680 jdres.dc_name); 681 goto common; 682 683 case NT_STATUS_BAD_NETWORK_NAME: 684 /* 685 * See: smbrdr_ctx_new / smb_ctx_get_tree 686 * and: ndr_rpc_bind / smb_fh_open 687 */ 688 (void) fprintf(stderr, gettext( 689 "failed connecting to services on AD server: %s\n"), 690 jdres.dc_name); 691 goto common; 692 693 default: 694 (void) fprintf(stderr, gettext( 695 "failed to join domain %s\n"), 696 jdi.domain_name); 697 if (jdres.dc_name[0] != '\0') { 698 (void) fprintf(stderr, gettext( 699 "using AD server: %s\n"), 700 jdres.dc_name); 701 } 702 /* FALLTHROUGH */ 703 common: 704 if (jdres.join_err != 0) { 705 (void) fprintf(stderr, "%s\n", 706 smb_ads_strerror(jdres.join_err)); 707 } else if (jdres.status != 0) { 708 (void) fprintf(stderr, "(%s)\n", 709 xlate_nt_status(jdres.status)); 710 } 711 (void) fprintf(stderr, gettext("Please refer to the " 712 "service log for more information.\n")); 713 bzero(&jdi, sizeof (jdi)); 714 return (1); 715 } 716 } 717 718 /* 719 * We want to process the user and domain names as separate strings. 720 * Check for names of the forms below and separate the components as 721 * required. 722 * 723 * name@domain 724 * domain\name 725 * domain/name 726 * 727 * If we encounter any of the forms above in arg, the @, / or \ 728 * separator is replaced by \0 and the username and domain pointers 729 * are changed to point to the appropriate components (in arg). 730 * 731 * If none of the separators are encountered, the username and domain 732 * pointers remain unchanged. 733 */ 734 static void 735 smbadm_extract_domain(char *arg, char **username, char **domain) 736 { 737 char *p; 738 739 if ((p = strpbrk(arg, "/\\@")) != NULL) { 740 if (*p == '@') { 741 *p = '\0'; 742 ++p; 743 744 if (strchr(arg, '+') != NULL) 745 return; 746 747 *domain = p; 748 *username = arg; 749 } else { 750 *p = '\0'; 751 ++p; 752 *username = p; 753 *domain = arg; 754 } 755 } 756 } 757 758 /* 759 * smbadm_list 760 * 761 * Displays current security mode and domain/workgroup name. 762 */ 763 /*ARGSUSED*/ 764 static int 765 smbadm_list(int argc, char **argv) 766 { 767 char domain[MAXHOSTNAMELEN]; 768 char fqdn[MAXHOSTNAMELEN]; 769 char srvname[MAXHOSTNAMELEN]; 770 char modename[16]; 771 int rc; 772 smb_inaddr_t srvipaddr; 773 char ipstr[INET6_ADDRSTRLEN]; 774 775 rc = smb_config_getstr(SMB_CI_SECURITY, modename, sizeof (modename)); 776 if (rc != SMBD_SMF_OK) { 777 (void) fprintf(stderr, 778 gettext("cannot determine the operational mode\n")); 779 return (1); 780 } 781 782 if (smb_getdomainname(domain, sizeof (domain)) != 0) { 783 (void) fprintf(stderr, gettext("failed to get the %s name\n"), 784 modename); 785 return (1); 786 } 787 788 if (strcmp(modename, "workgroup") == 0) { 789 (void) printf(gettext("[*] [%s]\n"), domain); 790 return (0); 791 } 792 793 (void) printf(gettext("[*] [%s]\n"), domain); 794 if ((smb_getfqdomainname(fqdn, sizeof (fqdn)) == 0) && (*fqdn != '\0')) 795 (void) printf(gettext("[*] [%s]\n"), fqdn); 796 797 if ((smb_get_dcinfo(srvname, MAXHOSTNAMELEN, &srvipaddr) 798 == NT_STATUS_SUCCESS) && (*srvname != '\0') && 799 (!smb_inet_iszero(&srvipaddr))) { 800 (void) smb_inet_ntop(&srvipaddr, ipstr, 801 SMB_IPSTRLEN(srvipaddr.a_family)); 802 (void) printf(gettext("\t[+%s] [%s]\n"), 803 srvname, ipstr); 804 } 805 806 /* Print the local and domain SID. */ 807 smb_domain_show(); 808 return (0); 809 } 810 811 /* 812 * smbadm_lookup 813 * 814 * Lookup the SID for a given account (user or group) 815 */ 816 static int 817 smbadm_lookup(int argc, char **argv) 818 { 819 int i; 820 821 if (argc < 2) { 822 (void) fprintf(stderr, gettext("missing account name\n")); 823 smbadm_usage(B_FALSE); 824 } 825 826 for (i = 1; i < argc; i++) { 827 if (strncmp(argv[i], "S-1-", 4) == 0) 828 smbadm_lookup_sid(argv[i]); 829 else 830 smbadm_lookup_name(argv[i]); 831 } 832 return (0); 833 } 834 835 static void 836 smbadm_lookup_name(char *name) 837 { 838 lsa_account_t acct; 839 int rc; 840 841 if ((rc = smb_lookup_name(name, SidTypeUnknown, &acct)) != 0) { 842 (void) fprintf(stderr, gettext( 843 "\t\t%s: lookup name failed, rc=%d\n"), 844 name, rc); 845 return; 846 } 847 if (acct.a_status != NT_STATUS_SUCCESS) { 848 (void) fprintf(stderr, gettext("\t\t%s [%s]\n"), 849 name, xlate_nt_status(acct.a_status)); 850 return; 851 } 852 (void) printf("\t%s\n", acct.a_sid); 853 } 854 855 static void 856 smbadm_lookup_sid(char *sidstr) 857 { 858 lsa_account_t acct; 859 int rc; 860 861 if ((rc = smb_lookup_sid(sidstr, &acct)) != 0) { 862 (void) fprintf(stderr, gettext( 863 "\t\t%s: lookup SID failed, rc=%d\n"), 864 sidstr, rc); 865 return; 866 } 867 if (acct.a_status != NT_STATUS_SUCCESS) { 868 (void) fprintf(stderr, gettext("\t\t%s [%s]\n"), 869 sidstr, xlate_nt_status(acct.a_status)); 870 return; 871 } 872 (void) printf("\t%s\\%s\n", acct.a_domain, acct.a_name); 873 } 874 875 /* 876 * smbadm_group_create 877 * 878 * Creates a local SMB group 879 */ 880 static int 881 smbadm_group_create(int argc, char **argv) 882 { 883 char *gname = NULL; 884 char *desc = NULL; 885 char option; 886 int status; 887 888 while ((option = getopt(argc, argv, "d:")) != -1) { 889 switch (option) { 890 case 'd': 891 desc = optarg; 892 break; 893 894 default: 895 smbadm_usage(B_FALSE); 896 } 897 } 898 899 gname = argv[optind]; 900 if (optind >= argc || gname == NULL || *gname == '\0') { 901 (void) fprintf(stderr, gettext("missing group name\n")); 902 smbadm_usage(B_FALSE); 903 } 904 905 status = smb_lgrp_add(gname, desc); 906 if (status != SMB_LGRP_SUCCESS) { 907 (void) fprintf(stderr, 908 gettext("failed to create %s (%s)\n"), gname, 909 smb_lgrp_strerror(status)); 910 } else { 911 (void) printf(gettext("%s created\n"), gname); 912 } 913 914 return (status); 915 } 916 917 /* 918 * smbadm_group_dump_members 919 * 920 * Dump group members details. 921 */ 922 static void 923 smbadm_group_dump_members(smb_gsid_t *members, int num) 924 { 925 char sidstr[SMB_SID_STRSZ]; 926 lsa_account_t acct; 927 int i; 928 929 if (num == 0) { 930 (void) printf(gettext("\tNo members\n")); 931 return; 932 } 933 934 (void) printf(gettext("\tMembers:\n")); 935 for (i = 0; i < num; i++) { 936 smb_sid_tostr(members[i].gs_sid, sidstr); 937 938 if (smb_lookup_sid(sidstr, &acct) == 0) { 939 if (acct.a_status == NT_STATUS_SUCCESS) 940 smbadm_group_show_name(acct.a_domain, 941 acct.a_name); 942 else 943 (void) printf(gettext("\t\t%s [%s]\n"), 944 sidstr, xlate_nt_status(acct.a_status)); 945 } else { 946 (void) printf(gettext("\t\t%s\n"), sidstr); 947 } 948 } 949 } 950 951 static void 952 smbadm_group_show_name(const char *domain, const char *name) 953 { 954 if (strchr(domain, '.') != NULL) 955 (void) printf("\t\t%s@%s\n", name, domain); 956 else 957 (void) printf("\t\t%s\\%s\n", domain, name); 958 } 959 960 /* 961 * smbadm_group_dump_privs 962 * 963 * Dump group privilege details. 964 */ 965 static void 966 smbadm_group_dump_privs(smb_privset_t *privs) 967 { 968 smb_privinfo_t *pinfo; 969 char *pstatus; 970 int i; 971 972 (void) printf(gettext("\tPrivileges: \n")); 973 974 for (i = 0; i < privs->priv_cnt; i++) { 975 pinfo = smb_priv_getbyvalue(privs->priv[i].luid.lo_part); 976 if ((pinfo == NULL) || (pinfo->flags & PF_PRESENTABLE) == 0) 977 continue; 978 979 switch (privs->priv[i].attrs) { 980 case SE_PRIVILEGE_ENABLED: 981 pstatus = "On"; 982 break; 983 case SE_PRIVILEGE_DISABLED: 984 pstatus = "Off"; 985 break; 986 default: 987 pstatus = "Unknown"; 988 break; 989 } 990 (void) printf(gettext("\t\t%s: %s\n"), pinfo->name, pstatus); 991 } 992 993 if (privs->priv_cnt == 0) 994 (void) printf(gettext("\t\tNo privileges\n")); 995 } 996 997 /* 998 * smbadm_group_dump 999 * 1000 * Dump group details. 1001 */ 1002 static void 1003 smbadm_group_dump(smb_group_t *grp, boolean_t show_mem, boolean_t show_privs) 1004 { 1005 char sidstr[SMB_SID_STRSZ]; 1006 1007 (void) printf(gettext("%s (%s)\n"), grp->sg_name, grp->sg_cmnt); 1008 1009 smb_sid_tostr(grp->sg_id.gs_sid, sidstr); 1010 (void) printf(gettext("\tSID: %s\n"), sidstr); 1011 1012 if (show_privs) 1013 smbadm_group_dump_privs(grp->sg_privs); 1014 1015 if (show_mem) 1016 smbadm_group_dump_members(grp->sg_members, grp->sg_nmembers); 1017 } 1018 1019 /* 1020 * smbadm_group_show 1021 * 1022 */ 1023 static int 1024 smbadm_group_show(int argc, char **argv) 1025 { 1026 char *gname = NULL; 1027 boolean_t show_privs; 1028 boolean_t show_members; 1029 char option; 1030 int status; 1031 smb_group_t grp; 1032 smb_giter_t gi; 1033 1034 show_privs = show_members = B_FALSE; 1035 1036 while ((option = getopt(argc, argv, "mp")) != -1) { 1037 switch (option) { 1038 case 'm': 1039 show_members = B_TRUE; 1040 break; 1041 case 'p': 1042 show_privs = B_TRUE; 1043 break; 1044 1045 default: 1046 smbadm_usage(B_FALSE); 1047 } 1048 } 1049 1050 gname = argv[optind]; 1051 if (optind >= argc || gname == NULL || *gname == '\0') 1052 gname = "*"; 1053 1054 if (strcmp(gname, "*")) { 1055 status = smb_lgrp_getbyname(gname, &grp); 1056 if (status == SMB_LGRP_SUCCESS) { 1057 smbadm_group_dump(&grp, show_members, show_privs); 1058 smb_lgrp_free(&grp); 1059 } else { 1060 (void) fprintf(stderr, 1061 gettext("failed to find %s (%s)\n"), 1062 gname, smb_lgrp_strerror(status)); 1063 } 1064 return (status); 1065 } 1066 1067 if ((status = smb_lgrp_iteropen(&gi)) != SMB_LGRP_SUCCESS) { 1068 (void) fprintf(stderr, gettext("failed to list groups (%s)\n"), 1069 smb_lgrp_strerror(status)); 1070 return (status); 1071 } 1072 1073 while ((status = smb_lgrp_iterate(&gi, &grp)) == SMB_LGRP_SUCCESS) { 1074 smbadm_group_dump(&grp, show_members, show_privs); 1075 smb_lgrp_free(&grp); 1076 } 1077 1078 smb_lgrp_iterclose(&gi); 1079 1080 if ((status != SMB_LGRP_NO_MORE) || smb_lgrp_itererror(&gi)) { 1081 if (status != SMB_LGRP_NO_MORE) 1082 smb_syslog(LOG_ERR, "smb_lgrp_iterate: %s", 1083 smb_lgrp_strerror(status)); 1084 1085 (void) fprintf(stderr, 1086 gettext("\nAn error occurred while retrieving group data.\n" 1087 "Check the system log for more information.\n")); 1088 return (status); 1089 } 1090 1091 return (0); 1092 } 1093 1094 /* 1095 * smbadm_group_delete 1096 */ 1097 static int 1098 smbadm_group_delete(int argc, char **argv) 1099 { 1100 char *gname = NULL; 1101 int status; 1102 1103 gname = argv[optind]; 1104 if (optind >= argc || gname == NULL || *gname == '\0') { 1105 (void) fprintf(stderr, gettext("missing group name\n")); 1106 smbadm_usage(B_FALSE); 1107 } 1108 1109 status = smb_lgrp_delete(gname); 1110 if (status != SMB_LGRP_SUCCESS) { 1111 (void) fprintf(stderr, 1112 gettext("failed to delete %s (%s)\n"), gname, 1113 smb_lgrp_strerror(status)); 1114 } else { 1115 (void) printf(gettext("%s deleted\n"), gname); 1116 } 1117 1118 return (status); 1119 } 1120 1121 /* 1122 * smbadm_group_rename 1123 */ 1124 static int 1125 smbadm_group_rename(int argc, char **argv) 1126 { 1127 char *gname = NULL; 1128 char *ngname = NULL; 1129 int status; 1130 1131 gname = argv[optind]; 1132 if (optind++ >= argc || gname == NULL || *gname == '\0') { 1133 (void) fprintf(stderr, gettext("missing group name\n")); 1134 smbadm_usage(B_FALSE); 1135 } 1136 1137 ngname = argv[optind]; 1138 if (optind >= argc || ngname == NULL || *ngname == '\0') { 1139 (void) fprintf(stderr, gettext("missing new group name\n")); 1140 smbadm_usage(B_FALSE); 1141 } 1142 1143 status = smb_lgrp_rename(gname, ngname); 1144 if (status != SMB_LGRP_SUCCESS) { 1145 if (status == SMB_LGRP_EXISTS) 1146 (void) fprintf(stderr, 1147 gettext("failed to rename '%s' (%s already " 1148 "exists)\n"), gname, ngname); 1149 else 1150 (void) fprintf(stderr, 1151 gettext("failed to rename '%s' (%s)\n"), gname, 1152 smb_lgrp_strerror(status)); 1153 } else { 1154 (void) printf(gettext("'%s' renamed to '%s'\n"), gname, ngname); 1155 } 1156 1157 return (status); 1158 } 1159 1160 /* 1161 * smbadm_group_setprop 1162 * 1163 * Set the group properties. 1164 */ 1165 static int 1166 smbadm_group_setprop(int argc, char **argv) 1167 { 1168 char *gname = NULL; 1169 smbadm_prop_t props[SMBADM_NPROP]; 1170 smbadm_prop_handle_t *phandle; 1171 char option; 1172 int pcnt = 0; 1173 int ret; 1174 int p; 1175 1176 bzero(props, SMBADM_NPROP * sizeof (smbadm_prop_t)); 1177 1178 while ((option = getopt(argc, argv, "p:")) != -1) { 1179 switch (option) { 1180 case 'p': 1181 if (pcnt >= SMBADM_NPROP) { 1182 (void) fprintf(stderr, 1183 gettext("exceeded number of supported" 1184 " properties\n")); 1185 smbadm_usage(B_FALSE); 1186 } 1187 1188 if (smbadm_prop_parse(optarg, &props[pcnt++]) != 0) 1189 smbadm_usage(B_FALSE); 1190 break; 1191 1192 default: 1193 smbadm_usage(B_FALSE); 1194 } 1195 } 1196 1197 if (pcnt == 0) { 1198 (void) fprintf(stderr, 1199 gettext("missing property=value argument\n")); 1200 smbadm_usage(B_FALSE); 1201 } 1202 1203 gname = argv[optind]; 1204 if (optind >= argc || gname == NULL || *gname == '\0') { 1205 (void) fprintf(stderr, gettext("missing group name\n")); 1206 smbadm_usage(B_FALSE); 1207 } 1208 1209 for (p = 0; p < pcnt; p++) { 1210 phandle = smbadm_prop_gethandle(props[p].p_name); 1211 if (phandle) { 1212 if (phandle->p_setfn(gname, &props[p]) != 0) 1213 ret = 1; 1214 } 1215 } 1216 1217 return (ret); 1218 } 1219 1220 /* 1221 * smbadm_group_getprop 1222 * 1223 * Get the group properties. 1224 */ 1225 static int 1226 smbadm_group_getprop(int argc, char **argv) 1227 { 1228 char *gname = NULL; 1229 smbadm_prop_t props[SMBADM_NPROP]; 1230 smbadm_prop_handle_t *phandle; 1231 char option; 1232 int pcnt = 0; 1233 int ret; 1234 int p; 1235 1236 bzero(props, SMBADM_NPROP * sizeof (smbadm_prop_t)); 1237 1238 while ((option = getopt(argc, argv, "p:")) != -1) { 1239 switch (option) { 1240 case 'p': 1241 if (pcnt >= SMBADM_NPROP) { 1242 (void) fprintf(stderr, 1243 gettext("exceeded number of supported" 1244 " properties\n")); 1245 smbadm_usage(B_FALSE); 1246 } 1247 1248 if (smbadm_prop_parse(optarg, &props[pcnt++]) != 0) 1249 smbadm_usage(B_FALSE); 1250 break; 1251 1252 default: 1253 smbadm_usage(B_FALSE); 1254 } 1255 } 1256 1257 gname = argv[optind]; 1258 if (optind >= argc || gname == NULL || *gname == '\0') { 1259 (void) fprintf(stderr, gettext("missing group name\n")); 1260 smbadm_usage(B_FALSE); 1261 } 1262 1263 if (pcnt == 0) { 1264 /* 1265 * If no property has be specified then get 1266 * all the properties. 1267 */ 1268 pcnt = SMBADM_NPROP; 1269 for (p = 0; p < pcnt; p++) 1270 props[p].p_name = smbadm_ptable[p].p_name; 1271 } 1272 1273 for (p = 0; p < pcnt; p++) { 1274 phandle = smbadm_prop_gethandle(props[p].p_name); 1275 if (phandle) { 1276 if (phandle->p_getfn(gname, &props[p]) != 0) 1277 ret = 1; 1278 } 1279 } 1280 1281 return (ret); 1282 } 1283 1284 /* 1285 * smbadm_group_addmember 1286 * 1287 */ 1288 static int 1289 smbadm_group_addmember(int argc, char **argv) 1290 { 1291 char *gname = NULL; 1292 char **mname; 1293 char option; 1294 int mcnt = 0; 1295 int ret = 0; 1296 int i; 1297 1298 1299 mname = (char **)malloc(argc * sizeof (char *)); 1300 if (mname == NULL) { 1301 warn(gettext("failed to add group member")); 1302 return (1); 1303 } 1304 bzero(mname, argc * sizeof (char *)); 1305 1306 while ((option = getopt(argc, argv, "m:")) != -1) { 1307 switch (option) { 1308 case 'm': 1309 mname[mcnt++] = optarg; 1310 break; 1311 1312 default: 1313 free(mname); 1314 smbadm_usage(B_FALSE); 1315 } 1316 } 1317 1318 if (mcnt == 0) { 1319 (void) fprintf(stderr, gettext("missing member name\n")); 1320 free(mname); 1321 smbadm_usage(B_FALSE); 1322 } 1323 1324 gname = argv[optind]; 1325 if (optind >= argc || gname == NULL || *gname == 0) { 1326 (void) fprintf(stderr, gettext("missing group name\n")); 1327 free(mname); 1328 smbadm_usage(B_FALSE); 1329 } 1330 1331 for (i = 0; i < mcnt; i++) { 1332 if (mname[i] == NULL) 1333 continue; 1334 ret |= smbadm_group_add_del_member( 1335 gname, mname[i], SMBADM_GRP_ADDMEMBER); 1336 } 1337 1338 free(mname); 1339 return (ret); 1340 } 1341 1342 /* 1343 * smbadm_group_delmember 1344 */ 1345 static int 1346 smbadm_group_delmember(int argc, char **argv) 1347 { 1348 char *gname = NULL; 1349 char **mname; 1350 char option; 1351 int mcnt = 0; 1352 int ret = 0; 1353 int i; 1354 1355 mname = (char **)malloc(argc * sizeof (char *)); 1356 if (mname == NULL) { 1357 warn(gettext("failed to delete group member")); 1358 return (1); 1359 } 1360 bzero(mname, argc * sizeof (char *)); 1361 1362 while ((option = getopt(argc, argv, "m:")) != -1) { 1363 switch (option) { 1364 case 'm': 1365 mname[mcnt++] = optarg; 1366 break; 1367 1368 default: 1369 free(mname); 1370 smbadm_usage(B_FALSE); 1371 } 1372 } 1373 1374 if (mcnt == 0) { 1375 (void) fprintf(stderr, gettext("missing member name\n")); 1376 free(mname); 1377 smbadm_usage(B_FALSE); 1378 } 1379 1380 gname = argv[optind]; 1381 if (optind >= argc || gname == NULL || *gname == 0) { 1382 (void) fprintf(stderr, gettext("missing group name\n")); 1383 free(mname); 1384 smbadm_usage(B_FALSE); 1385 } 1386 1387 1388 for (i = 0; i < mcnt; i++) { 1389 ret = 0; 1390 if (mname[i] == NULL) 1391 continue; 1392 ret |= smbadm_group_add_del_member( 1393 gname, mname[i], SMBADM_GRP_DELMEMBER); 1394 } 1395 1396 free(mname); 1397 return (ret); 1398 } 1399 1400 static int 1401 smbadm_group_add_del_member(char *gname, char *mname, 1402 smbadm_grp_action_t act) 1403 { 1404 lsa_account_t acct; 1405 smb_gsid_t msid; 1406 char *sidstr; 1407 char *act_str; 1408 int rc; 1409 1410 if (strncmp(mname, "S-1-", 4) == 0) { 1411 /* 1412 * We are given a SID. Just use it. 1413 * 1414 * We'd like the real account type if we can get it, 1415 * but don't want to error out if we can't get it. 1416 * Lacking other info, assume it's a group. 1417 */ 1418 sidstr = mname; 1419 rc = smb_lookup_sid(sidstr, &acct); 1420 if ((rc != 0) || (acct.a_status != NT_STATUS_SUCCESS)) 1421 acct.a_sidtype = SidTypeGroup; 1422 } else { 1423 rc = smb_lookup_name(mname, SidTypeUnknown, &acct); 1424 if ((rc != 0) || (acct.a_status != NT_STATUS_SUCCESS)) { 1425 (void) fprintf(stderr, 1426 gettext("%s: name lookup failed\n"), mname); 1427 return (1); 1428 } 1429 sidstr = acct.a_sid; 1430 } 1431 1432 msid.gs_type = acct.a_sidtype; 1433 if ((msid.gs_sid = smb_sid_fromstr(sidstr)) == NULL) { 1434 (void) fprintf(stderr, 1435 gettext("%s: no memory for SID\n"), sidstr); 1436 return (1); 1437 } 1438 1439 switch (act) { 1440 case SMBADM_GRP_ADDMEMBER: 1441 act_str = gettext("add"); 1442 rc = smb_lgrp_add_member(gname, 1443 msid.gs_sid, msid.gs_type); 1444 break; 1445 case SMBADM_GRP_DELMEMBER: 1446 act_str = gettext("remove"); 1447 rc = smb_lgrp_del_member(gname, 1448 msid.gs_sid, msid.gs_type); 1449 break; 1450 default: 1451 rc = SMB_LGRP_INTERNAL_ERROR; 1452 break; 1453 } 1454 1455 smb_sid_free(msid.gs_sid); 1456 1457 if (rc != SMB_LGRP_SUCCESS) { 1458 (void) fprintf(stderr, 1459 gettext("failed to %s %s (%s)\n"), 1460 act_str, mname, smb_lgrp_strerror(rc)); 1461 return (1); 1462 } 1463 return (0); 1464 } 1465 1466 static int 1467 smbadm_user_delete(int argc, char **argv) 1468 { 1469 int error; 1470 char *user = NULL; 1471 1472 user = argv[optind]; 1473 if (optind >= argc || user == NULL || *user == '\0') { 1474 (void) fprintf(stderr, gettext("missing user name\n")); 1475 smbadm_usage(B_FALSE); 1476 } 1477 1478 error = smb_pwd_setcntl(user, SMB_PWC_DELETE); 1479 if (error == SMB_PWE_SUCCESS) 1480 (void) printf(gettext("%s has been deleted.\n"), user); 1481 else 1482 (void) fprintf(stderr, "%s\n", smbadm_pwd_strerror(error)); 1483 1484 return (error); 1485 } 1486 1487 static int 1488 smbadm_user_disable(int argc, char **argv) 1489 { 1490 int error; 1491 char *user = NULL; 1492 1493 user = argv[optind]; 1494 if (optind >= argc || user == NULL || *user == '\0') { 1495 (void) fprintf(stderr, gettext("missing user name\n")); 1496 smbadm_usage(B_FALSE); 1497 } 1498 1499 error = smb_pwd_setcntl(user, SMB_PWC_DISABLE); 1500 if (error == SMB_PWE_SUCCESS) 1501 (void) printf(gettext("%s is disabled.\n"), user); 1502 else 1503 (void) fprintf(stderr, "%s\n", smbadm_pwd_strerror(error)); 1504 1505 return (error); 1506 } 1507 1508 static int 1509 smbadm_user_enable(int argc, char **argv) 1510 { 1511 int error; 1512 char *user = NULL; 1513 1514 user = argv[optind]; 1515 if (optind >= argc || user == NULL || *user == '\0') { 1516 (void) fprintf(stderr, gettext("missing user name\n")); 1517 smbadm_usage(B_FALSE); 1518 } 1519 1520 error = smb_pwd_setcntl(user, SMB_PWC_ENABLE); 1521 if (error == SMB_PWE_SUCCESS) 1522 (void) printf(gettext("%s is enabled.\n"), user); 1523 else 1524 (void) fprintf(stderr, "%s\n", smbadm_pwd_strerror(error)); 1525 1526 return (error); 1527 } 1528 1529 1530 int 1531 main(int argc, char **argv) 1532 { 1533 int ret; 1534 int i; 1535 1536 (void) setlocale(LC_ALL, ""); 1537 (void) textdomain(TEXT_DOMAIN); 1538 1539 (void) malloc(0); /* satisfy libumem dependency */ 1540 1541 progname = basename(argv[0]); 1542 1543 if (is_system_labeled()) { 1544 (void) fprintf(stderr, 1545 gettext("Trusted Extensions not supported\n")); 1546 return (1); 1547 } 1548 1549 if (argc < 2) { 1550 (void) fprintf(stderr, gettext("missing command\n")); 1551 smbadm_usage(B_FALSE); 1552 } 1553 1554 /* 1555 * Special case "cmd --help/-?" 1556 */ 1557 if (strcmp(argv[1], "-?") == 0 || 1558 strcmp(argv[1], "--help") == 0 || 1559 strcmp(argv[1], "-h") == 0) 1560 smbadm_usage(B_TRUE); 1561 1562 for (i = 0; i < SMBADM_NCMD; ++i) { 1563 curcmd = &smbadm_cmdtable[i]; 1564 if (strcasecmp(argv[1], curcmd->name) == 0) { 1565 if (argc > 2) { 1566 /* cmd subcmd --help/-? */ 1567 if (strcmp(argv[2], "-?") == 0 || 1568 strcmp(argv[2], "--help") == 0 || 1569 strcmp(argv[2], "-h") == 0) 1570 smbadm_usage(B_TRUE); 1571 } 1572 1573 if (!smbadm_checkauth(curcmd->auth)) { 1574 (void) fprintf(stderr, 1575 gettext("%s: %s: authorization denied\n"), 1576 progname, curcmd->name); 1577 return (1); 1578 } 1579 1580 if ((ret = smbadm_init()) != 0) 1581 return (ret); 1582 1583 ret = curcmd->func(argc - 1, &argv[1]); 1584 1585 smbadm_fini(); 1586 return (ret); 1587 } 1588 } 1589 1590 curcmd = NULL; 1591 (void) fprintf(stderr, gettext("unknown subcommand (%s)\n"), argv[1]); 1592 smbadm_usage(B_FALSE); 1593 return (2); 1594 } 1595 1596 static int 1597 smbadm_init(void) 1598 { 1599 int rc; 1600 1601 switch (curcmd->flags & SMBADM_CMDF_TYPEMASK) { 1602 case SMBADM_CMDF_GROUP: 1603 if ((rc = smb_lgrp_start()) != SMB_LGRP_SUCCESS) { 1604 (void) fprintf(stderr, 1605 gettext("failed to initialize (%s)\n"), 1606 smb_lgrp_strerror(rc)); 1607 return (1); 1608 } 1609 break; 1610 1611 case SMBADM_CMDF_USER: 1612 smb_pwd_init(B_FALSE); 1613 break; 1614 1615 default: 1616 break; 1617 } 1618 1619 return (0); 1620 } 1621 1622 static void 1623 smbadm_fini(void) 1624 { 1625 switch (curcmd->flags & SMBADM_CMDF_TYPEMASK) { 1626 case SMBADM_CMDF_GROUP: 1627 smb_lgrp_stop(); 1628 break; 1629 1630 case SMBADM_CMDF_USER: 1631 smb_pwd_fini(); 1632 break; 1633 1634 default: 1635 break; 1636 } 1637 } 1638 1639 static boolean_t 1640 smbadm_checkauth(const char *auth) 1641 { 1642 struct passwd *pw; 1643 1644 if ((pw = getpwuid(getuid())) == NULL) 1645 return (B_FALSE); 1646 1647 if (chkauthattr(auth, pw->pw_name) == 0) 1648 return (B_FALSE); 1649 1650 return (B_TRUE); 1651 } 1652 1653 static boolean_t 1654 smbadm_prop_validate(smbadm_prop_t *prop, boolean_t chkval) 1655 { 1656 smbadm_prop_handle_t *pinfo; 1657 int i; 1658 1659 for (i = 0; i < SMBADM_NPROP; i++) { 1660 pinfo = &smbadm_ptable[i]; 1661 if (strcmp(pinfo->p_name, prop->p_name) == 0) { 1662 if (pinfo->p_chkfn && chkval) 1663 return (pinfo->p_chkfn(prop)); 1664 1665 return (B_TRUE); 1666 } 1667 } 1668 1669 (void) fprintf(stderr, gettext("unrecognized property '%s'\n"), 1670 prop->p_name); 1671 1672 return (B_FALSE); 1673 } 1674 1675 static int 1676 smbadm_prop_parse(char *arg, smbadm_prop_t *prop) 1677 { 1678 boolean_t parse_value; 1679 char *equal; 1680 1681 if (arg == NULL) 1682 return (2); 1683 1684 prop->p_name = prop->p_value = NULL; 1685 1686 if (strcmp(curcmd->name, "set") == 0) 1687 parse_value = B_TRUE; 1688 else 1689 parse_value = B_FALSE; 1690 1691 prop->p_name = arg; 1692 1693 if (parse_value) { 1694 equal = strchr(arg, '='); 1695 if (equal == NULL) 1696 return (2); 1697 1698 *equal++ = '\0'; 1699 prop->p_value = equal; 1700 } 1701 1702 if (smbadm_prop_validate(prop, parse_value) == B_FALSE) 1703 return (2); 1704 1705 return (0); 1706 } 1707 1708 static smbadm_prop_handle_t * 1709 smbadm_prop_gethandle(char *pname) 1710 { 1711 int i; 1712 1713 for (i = 0; i < SMBADM_NPROP; i++) 1714 if (strcmp(pname, smbadm_ptable[i].p_name) == 0) 1715 return (&smbadm_ptable[i]); 1716 1717 return (NULL); 1718 } 1719 1720 static int 1721 smbadm_setprop_desc(char *gname, smbadm_prop_t *prop) 1722 { 1723 int status; 1724 1725 status = smb_lgrp_setcmnt(gname, prop->p_value); 1726 if (status != SMB_LGRP_SUCCESS) { 1727 (void) fprintf(stderr, 1728 gettext("failed to modify the group description (%s)\n"), 1729 smb_lgrp_strerror(status)); 1730 return (1); 1731 } 1732 1733 (void) printf(gettext("%s: description modified\n"), gname); 1734 return (0); 1735 } 1736 1737 static int 1738 smbadm_getprop_desc(char *gname, smbadm_prop_t *prop) 1739 { 1740 char *cmnt = NULL; 1741 int status; 1742 1743 status = smb_lgrp_getcmnt(gname, &cmnt); 1744 if (status != SMB_LGRP_SUCCESS) { 1745 (void) fprintf(stderr, 1746 gettext("failed to get the group description (%s)\n"), 1747 smb_lgrp_strerror(status)); 1748 return (1); 1749 } 1750 1751 (void) printf(gettext("\t%s: %s\n"), prop->p_name, cmnt); 1752 free(cmnt); 1753 return (0); 1754 } 1755 1756 static int 1757 smbadm_group_setpriv(char *gname, uint8_t priv_id, smbadm_prop_t *prop) 1758 { 1759 boolean_t enable; 1760 int status; 1761 int ret; 1762 1763 if (strcasecmp(prop->p_value, "on") == 0) { 1764 (void) printf(gettext("Enabling %s privilege "), prop->p_name); 1765 enable = B_TRUE; 1766 } else { 1767 (void) printf(gettext("Disabling %s privilege "), prop->p_name); 1768 enable = B_FALSE; 1769 } 1770 1771 status = smb_lgrp_setpriv(gname, priv_id, enable); 1772 if (status == SMB_LGRP_SUCCESS) { 1773 (void) printf(gettext("succeeded\n")); 1774 ret = 0; 1775 } else { 1776 (void) printf(gettext("failed: %s\n"), 1777 smb_lgrp_strerror(status)); 1778 ret = 1; 1779 } 1780 1781 return (ret); 1782 } 1783 1784 static int 1785 smbadm_group_getpriv(char *gname, uint8_t priv_id, smbadm_prop_t *prop) 1786 { 1787 boolean_t enable; 1788 int status; 1789 1790 status = smb_lgrp_getpriv(gname, priv_id, &enable); 1791 if (status != SMB_LGRP_SUCCESS) { 1792 (void) fprintf(stderr, gettext("failed to get %s (%s)\n"), 1793 prop->p_name, smb_lgrp_strerror(status)); 1794 return (1); 1795 } 1796 1797 (void) printf(gettext("\t%s: %s\n"), prop->p_name, 1798 (enable) ? "On" : "Off"); 1799 1800 return (0); 1801 } 1802 1803 static int 1804 smbadm_setprop_tkowner(char *gname, smbadm_prop_t *prop) 1805 { 1806 return (smbadm_group_setpriv(gname, SE_TAKE_OWNERSHIP_LUID, prop)); 1807 } 1808 1809 static int 1810 smbadm_getprop_tkowner(char *gname, smbadm_prop_t *prop) 1811 { 1812 return (smbadm_group_getpriv(gname, SE_TAKE_OWNERSHIP_LUID, prop)); 1813 } 1814 1815 static int 1816 smbadm_setprop_backup(char *gname, smbadm_prop_t *prop) 1817 { 1818 return (smbadm_group_setpriv(gname, SE_BACKUP_LUID, prop)); 1819 } 1820 1821 static int 1822 smbadm_getprop_backup(char *gname, smbadm_prop_t *prop) 1823 { 1824 return (smbadm_group_getpriv(gname, SE_BACKUP_LUID, prop)); 1825 } 1826 1827 static int 1828 smbadm_setprop_restore(char *gname, smbadm_prop_t *prop) 1829 { 1830 return (smbadm_group_setpriv(gname, SE_RESTORE_LUID, prop)); 1831 } 1832 1833 static int 1834 smbadm_getprop_restore(char *gname, smbadm_prop_t *prop) 1835 { 1836 return (smbadm_group_getpriv(gname, SE_RESTORE_LUID, prop)); 1837 } 1838 1839 static boolean_t 1840 smbadm_chkprop_priv(smbadm_prop_t *prop) 1841 { 1842 if (prop->p_value == NULL || *prop->p_value == '\0') { 1843 (void) fprintf(stderr, 1844 gettext("missing value for '%s'\n"), prop->p_name); 1845 return (B_FALSE); 1846 } 1847 1848 if (strcasecmp(prop->p_value, "on") == 0) 1849 return (B_TRUE); 1850 1851 if (strcasecmp(prop->p_value, "off") == 0) 1852 return (B_TRUE); 1853 1854 (void) fprintf(stderr, 1855 gettext("%s: unrecognized value for '%s' property\n"), 1856 prop->p_value, prop->p_name); 1857 1858 return (B_FALSE); 1859 } 1860 1861 static const char * 1862 smbadm_pwd_strerror(int error) 1863 { 1864 switch (error) { 1865 case SMB_PWE_SUCCESS: 1866 return (gettext("Success.")); 1867 1868 case SMB_PWE_USER_UNKNOWN: 1869 return (gettext("User does not exist.")); 1870 1871 case SMB_PWE_USER_DISABLE: 1872 return (gettext("User is disabled.")); 1873 1874 case SMB_PWE_CLOSE_FAILED: 1875 case SMB_PWE_OPEN_FAILED: 1876 case SMB_PWE_WRITE_FAILED: 1877 case SMB_PWE_UPDATE_FAILED: 1878 return (gettext("Unexpected failure. " 1879 "SMB password database unchanged.")); 1880 1881 case SMB_PWE_STAT_FAILED: 1882 return (gettext("stat of SMB password file failed.")); 1883 1884 case SMB_PWE_BUSY: 1885 return (gettext("SMB password database busy. " 1886 "Try again later.")); 1887 1888 case SMB_PWE_DENIED: 1889 return (gettext("Operation not permitted.")); 1890 1891 case SMB_PWE_SYSTEM_ERROR: 1892 return (gettext("System error.")); 1893 1894 default: 1895 break; 1896 } 1897 1898 return (gettext("Unknown error code.")); 1899 } 1900 1901 /* 1902 * Enable libumem debugging by default on DEBUG builds. 1903 */ 1904 #ifdef DEBUG 1905 const char * 1906 _umem_debug_init(void) 1907 { 1908 return ("default,verbose"); /* $UMEM_DEBUG setting */ 1909 } 1910 1911 const char * 1912 _umem_logging_init(void) 1913 { 1914 return ("fail,contents"); /* $UMEM_LOGGING setting */ 1915 } 1916 #endif 1917