xref: /illumos-gate/usr/src/cmd/smbsrv/smbadm/smbadm.c (revision ef4cfbfd)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
24  */
25 
26 /*
27  * This module contains smbadm CLI which offers smb configuration
28  * functionalities.
29  */
30 #include <errno.h>
31 #include <err.h>
32 #include <ctype.h>
33 #include <stdlib.h>
34 #include <unistd.h>
35 #include <stdio.h>
36 #include <syslog.h>
37 #include <strings.h>
38 #include <limits.h>
39 #include <getopt.h>
40 #include <libintl.h>
41 #include <zone.h>
42 #include <pwd.h>
43 #include <grp.h>
44 #include <libgen.h>
45 #include <netinet/in.h>
46 #include <auth_attr.h>
47 #include <locale.h>
48 #include <smbsrv/libsmb.h>
49 #include <smbsrv/libsmbns.h>
50 
51 #if !defined(TEXT_DOMAIN)
52 #define	TEXT_DOMAIN "SYS_TEST"
53 #endif
54 
55 typedef enum {
56 	HELP_ADD_MEMBER,
57 	HELP_CREATE,
58 	HELP_DELETE,
59 	HELP_DEL_MEMBER,
60 	HELP_GET,
61 	HELP_JOIN,
62 	HELP_LIST,
63 	HELP_LOOKUP,
64 	HELP_RENAME,
65 	HELP_SET,
66 	HELP_SHOW,
67 	HELP_USER_DISABLE,
68 	HELP_USER_ENABLE,
69 	HELP_USER_DELETE
70 } smbadm_help_t;
71 
72 #define	SMBADM_CMDF_NONE	0x00
73 #define	SMBADM_CMDF_USER	0x01
74 #define	SMBADM_CMDF_GROUP	0x02
75 #define	SMBADM_CMDF_TYPEMASK	0x0F
76 
77 typedef enum {
78 	SMBADM_GRP_ADDMEMBER = 0,
79 	SMBADM_GRP_DELMEMBER,
80 } smbadm_grp_action_t;
81 
82 #define	SMBADM_ANSBUFSIZ	64
83 
84 typedef struct smbadm_cmdinfo {
85 	char *name;
86 	int (*func)(int, char **);
87 	smbadm_help_t usage;
88 	uint32_t flags;
89 	char *auth;
90 } smbadm_cmdinfo_t;
91 
92 smbadm_cmdinfo_t *curcmd;
93 static char *progname;
94 
95 #define	SMBADM_ACTION_AUTH	"solaris.smf.manage.smb"
96 #define	SMBADM_VALUE_AUTH	"solaris.smf.value.smb"
97 #define	SMBADM_BASIC_AUTH	"solaris.network.hosts.read"
98 
99 static boolean_t smbadm_checkauth(const char *);
100 
101 static void smbadm_usage(boolean_t);
102 static int smbadm_join_workgroup(const char *, boolean_t);
103 static int smbadm_join_domain(const char *, const char *, boolean_t);
104 static void smbadm_extract_domain(char *, char **, char **);
105 
106 static int smbadm_join(int, char **);
107 static int smbadm_list(int, char **);
108 static int smbadm_lookup(int, char **);
109 static void smbadm_lookup_name(char *);
110 static void smbadm_lookup_sid(char *);
111 static int smbadm_group_create(int, char **);
112 static int smbadm_group_delete(int, char **);
113 static int smbadm_group_rename(int, char **);
114 static int smbadm_group_show(int, char **);
115 static void smbadm_group_show_name(const char *, const char *);
116 static int smbadm_group_getprop(int, char **);
117 static int smbadm_group_setprop(int, char **);
118 static int smbadm_group_addmember(int, char **);
119 static int smbadm_group_delmember(int, char **);
120 static int smbadm_group_add_del_member(char *, char *, smbadm_grp_action_t);
121 
122 static int smbadm_user_delete(int, char **);
123 static int smbadm_user_disable(int, char **);
124 static int smbadm_user_enable(int, char **);
125 
126 static smbadm_cmdinfo_t smbadm_cmdtable[] =
127 {
128 	{ "add-member",		smbadm_group_addmember,	HELP_ADD_MEMBER,
129 		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
130 	{ "create",		smbadm_group_create,	HELP_CREATE,
131 		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
132 	{ "delete",		smbadm_group_delete,	HELP_DELETE,
133 		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
134 	{ "delete-user",	smbadm_user_delete,	HELP_USER_DELETE,
135 		SMBADM_CMDF_USER,	SMBADM_ACTION_AUTH },
136 	{ "disable-user",	smbadm_user_disable,	HELP_USER_DISABLE,
137 		SMBADM_CMDF_USER,	SMBADM_ACTION_AUTH },
138 	{ "enable-user",	smbadm_user_enable,	HELP_USER_ENABLE,
139 		SMBADM_CMDF_USER,	SMBADM_ACTION_AUTH },
140 	{ "get",		smbadm_group_getprop,	HELP_GET,
141 		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
142 	{ "join",		smbadm_join,		HELP_JOIN,
143 		SMBADM_CMDF_NONE,	SMBADM_VALUE_AUTH },
144 	{ "list",		smbadm_list,		HELP_LIST,
145 		SMBADM_CMDF_NONE,	SMBADM_BASIC_AUTH },
146 	{ "lookup",		smbadm_lookup,		HELP_LOOKUP,
147 		SMBADM_CMDF_NONE,	SMBADM_BASIC_AUTH },
148 	{ "remove-member",	smbadm_group_delmember,	HELP_DEL_MEMBER,
149 		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
150 	{ "rename",		smbadm_group_rename,	HELP_RENAME,
151 		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
152 	{ "set",		smbadm_group_setprop,	HELP_SET,
153 		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
154 	{ "show",		smbadm_group_show,	HELP_SHOW,
155 		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
156 };
157 
158 #define	SMBADM_NCMD	(sizeof (smbadm_cmdtable) / sizeof (smbadm_cmdtable[0]))
159 
160 typedef struct smbadm_prop {
161 	char *p_name;
162 	char *p_value;
163 } smbadm_prop_t;
164 
165 typedef struct smbadm_prop_handle {
166 	char *p_name;
167 	char *p_dispvalue;
168 	int (*p_setfn)(char *, smbadm_prop_t *);
169 	int (*p_getfn)(char *, smbadm_prop_t *);
170 	boolean_t (*p_chkfn)(smbadm_prop_t *);
171 } smbadm_prop_handle_t;
172 
173 static boolean_t smbadm_prop_validate(smbadm_prop_t *prop, boolean_t chkval);
174 static int smbadm_prop_parse(char *arg, smbadm_prop_t *prop);
175 static smbadm_prop_handle_t *smbadm_prop_gethandle(char *pname);
176 
177 static boolean_t smbadm_chkprop_priv(smbadm_prop_t *prop);
178 static int smbadm_setprop_tkowner(char *gname, smbadm_prop_t *prop);
179 static int smbadm_getprop_tkowner(char *gname, smbadm_prop_t *prop);
180 static int smbadm_setprop_backup(char *gname, smbadm_prop_t *prop);
181 static int smbadm_getprop_backup(char *gname, smbadm_prop_t *prop);
182 static int smbadm_setprop_restore(char *gname, smbadm_prop_t *prop);
183 static int smbadm_getprop_restore(char *gname, smbadm_prop_t *prop);
184 static int smbadm_setprop_desc(char *gname, smbadm_prop_t *prop);
185 static int smbadm_getprop_desc(char *gname, smbadm_prop_t *prop);
186 
187 static smbadm_prop_handle_t smbadm_ptable[] = {
188 	{"backup",	"on | off",	smbadm_setprop_backup,
189 	smbadm_getprop_backup,	smbadm_chkprop_priv	},
190 	{"restore",	"on | off",	smbadm_setprop_restore,
191 	smbadm_getprop_restore,	smbadm_chkprop_priv	},
192 	{"take-ownership", "on | off",	smbadm_setprop_tkowner,
193 	smbadm_getprop_tkowner,	smbadm_chkprop_priv	},
194 	{"description",	"<string>",	smbadm_setprop_desc,
195 	smbadm_getprop_desc,	NULL			},
196 };
197 
198 static int smbadm_init(void);
199 static void smbadm_fini(void);
200 static const char *smbadm_pwd_strerror(int error);
201 
202 /*
203  * Number of supported properties
204  */
205 #define	SMBADM_NPROP	(sizeof (smbadm_ptable) / sizeof (smbadm_ptable[0]))
206 
207 static void
208 smbadm_cmdusage(FILE *fp, smbadm_cmdinfo_t *cmd)
209 {
210 	switch (cmd->usage) {
211 	case HELP_ADD_MEMBER:
212 		(void) fprintf(fp,
213 		    gettext("\t%s -m member [[-m member] ...] group\n"),
214 		    cmd->name);
215 		return;
216 
217 	case HELP_CREATE:
218 		(void) fprintf(fp, gettext("\t%s [-d description] group\n"),
219 		    cmd->name);
220 		return;
221 
222 	case HELP_DELETE:
223 		(void) fprintf(fp, gettext("\t%s group\n"), cmd->name);
224 		return;
225 
226 	case HELP_USER_DELETE:
227 	case HELP_USER_DISABLE:
228 	case HELP_USER_ENABLE:
229 		(void) fprintf(fp, gettext("\t%s user\n"), cmd->name);
230 		return;
231 
232 	case HELP_GET:
233 		(void) fprintf(fp, gettext("\t%s [[-p property] ...] group\n"),
234 		    cmd->name);
235 		return;
236 
237 	case HELP_JOIN:
238 #if 0	/* Don't document "-p" yet, still needs work (NX 11960) */
239 		(void) fprintf(fp, gettext("\t%s [-y] -p domain\n"
240 		    "\t%s [-y] -u username domain\n\t%s [-y] -w workgroup\n"),
241 		    cmd->name, cmd->name, cmd->name);
242 #else
243 		(void) fprintf(fp, gettext("\t%s [-y] -u username domain\n"
244 		    "\t%s [-y] -w workgroup\n"), cmd->name, cmd->name);
245 #endif
246 		return;
247 
248 	case HELP_LIST:
249 		(void) fprintf(fp, gettext("\t%s\n"), cmd->name);
250 		(void) fprintf(fp,
251 		    gettext("\t\t[*] primary domain\n"));
252 		(void) fprintf(fp, gettext("\t\t[.] local domain\n"));
253 		(void) fprintf(fp, gettext("\t\t[-] other domains\n"));
254 		(void) fprintf(fp,
255 		    gettext("\t\t[+] selected domain controller\n"));
256 		return;
257 
258 	case HELP_LOOKUP:
259 		(void) fprintf(fp,
260 		    gettext("\t%s user-or-group-name\n"),
261 		    cmd->name);
262 		return;
263 
264 	case HELP_DEL_MEMBER:
265 		(void) fprintf(fp,
266 		    gettext("\t%s -m member [[-m member] ...] group\n"),
267 		    cmd->name);
268 		return;
269 
270 	case HELP_RENAME:
271 		(void) fprintf(fp, gettext("\t%s group new-group\n"),
272 		    cmd->name);
273 		return;
274 
275 	case HELP_SET:
276 		(void) fprintf(fp, gettext("\t%s -p property=value "
277 		    "[[-p property=value] ...] group\n"), cmd->name);
278 		return;
279 
280 	case HELP_SHOW:
281 		(void) fprintf(fp, gettext("\t%s [-m] [-p] [group]\n"),
282 		    cmd->name);
283 		return;
284 
285 	default:
286 		break;
287 	}
288 
289 	abort();
290 	/* NOTREACHED */
291 }
292 
293 static void
294 smbadm_usage(boolean_t requested)
295 {
296 	FILE *fp = requested ? stdout : stderr;
297 	boolean_t show_props = B_FALSE;
298 	int i;
299 
300 	if (curcmd == NULL) {
301 		(void) fprintf(fp,
302 		    gettext("usage: %s [-h | <command> [options]]\n"),
303 		    progname);
304 		(void) fprintf(fp,
305 		    gettext("where 'command' is one of the following:\n\n"));
306 
307 		for (i = 0; i < SMBADM_NCMD; i++)
308 			smbadm_cmdusage(fp, &smbadm_cmdtable[i]);
309 
310 		(void) fprintf(fp,
311 		    gettext("\nFor property list, run %s %s|%s\n"),
312 		    progname, "get", "set");
313 
314 		exit(requested ? 0 : 2);
315 	}
316 
317 	(void) fprintf(fp, gettext("usage:\n"));
318 	smbadm_cmdusage(fp, curcmd);
319 
320 	if (strcmp(curcmd->name, "get") == 0 ||
321 	    strcmp(curcmd->name, "set") == 0)
322 		show_props = B_TRUE;
323 
324 	if (show_props) {
325 		(void) fprintf(fp,
326 		    gettext("\nThe following properties are supported:\n"));
327 
328 		(void) fprintf(fp, "\n\t%-16s   %s\n\n",
329 		    "PROPERTY", "VALUES");
330 
331 		for (i = 0; i < SMBADM_NPROP; i++) {
332 			(void) fprintf(fp, "\t%-16s   %s\n",
333 			    smbadm_ptable[i].p_name,
334 			    smbadm_ptable[i].p_dispvalue);
335 		}
336 	}
337 
338 	exit(requested ? 0 : 2);
339 }
340 
341 /*
342  * smbadm_strcasecmplist
343  *
344  * Find a string 's' within a list of strings.
345  *
346  * Returns the index of the matching string or -1 if there is no match.
347  */
348 static int
349 smbadm_strcasecmplist(const char *s, ...)
350 {
351 	va_list ap;
352 	char *p;
353 	int ndx;
354 
355 	va_start(ap, s);
356 
357 	for (ndx = 0; ((p = va_arg(ap, char *)) != NULL); ++ndx) {
358 		if (strcasecmp(s, p) == 0) {
359 			va_end(ap);
360 			return (ndx);
361 		}
362 	}
363 
364 	va_end(ap);
365 	return (-1);
366 }
367 
368 /*
369  * smbadm_answer_prompt
370  *
371  * Prompt for the answer to a question.  A default response must be
372  * specified, which will be used if the user presses <enter> without
373  * answering the question.
374  */
375 static int
376 smbadm_answer_prompt(const char *prompt, char *answer, const char *dflt)
377 {
378 	char buf[SMBADM_ANSBUFSIZ];
379 	char *p;
380 
381 	(void) printf(gettext("%s [%s]: "), prompt, dflt);
382 
383 	if (fgets(buf, SMBADM_ANSBUFSIZ, stdin) == NULL)
384 		return (-1);
385 
386 	if ((p = strchr(buf, '\n')) != NULL)
387 		*p = '\0';
388 
389 	if (*buf == '\0')
390 		(void) strlcpy(answer, dflt, SMBADM_ANSBUFSIZ);
391 	else
392 		(void) strlcpy(answer, buf, SMBADM_ANSBUFSIZ);
393 
394 	return (0);
395 }
396 
397 /*
398  * smbadm_confirm
399  *
400  * Ask a question that requires a yes/no answer.
401  * A default response must be specified.
402  */
403 static boolean_t
404 smbadm_confirm(const char *prompt, const char *dflt)
405 {
406 	char buf[SMBADM_ANSBUFSIZ];
407 
408 	for (;;) {
409 		if (smbadm_answer_prompt(prompt, buf, dflt) < 0)
410 			return (B_FALSE);
411 
412 		if (smbadm_strcasecmplist(buf, "n", "no", 0) >= 0)
413 			return (B_FALSE);
414 
415 		if (smbadm_strcasecmplist(buf, "y", "yes", 0) >= 0)
416 			return (B_TRUE);
417 
418 		(void) printf(gettext("Please answer yes or no.\n"));
419 	}
420 }
421 
422 static boolean_t
423 smbadm_join_prompt(const char *domain)
424 {
425 	(void) printf(gettext("After joining %s the smb service will be "
426 	    "restarted automatically.\n"), domain);
427 
428 	return (smbadm_confirm("Would you like to continue?", "no"));
429 }
430 
431 static void
432 smbadm_restart_service(void)
433 {
434 	if (smb_smf_restart_service() != 0) {
435 		(void) fprintf(stderr,
436 		    gettext("Unable to restart smb service. "
437 		    "Run 'svcs -xv smb/server' for more information."));
438 	}
439 }
440 
441 /*
442  * smbadm_join
443  *
444  * Join a domain or workgroup.
445  *
446  * When joining a domain, we may receive the username, password and
447  * domain name in any of the following combinations.  Note that the
448  * password is optional on the command line: if it is not provided,
449  * we will prompt for it later.
450  *
451  *	username+password domain
452  *	domain\username+password
453  *	domain/username+password
454  *	username@domain
455  *
456  * We allow domain\name+password or domain/name+password but not
457  * name+password@domain because @ is a valid password character.
458  *
459  * If the username and domain name are passed as separate command
460  * line arguments, we process them directly.  Otherwise we separate
461  * them and continue as if they were separate command line arguments.
462  */
463 static int
464 smbadm_join(int argc, char **argv)
465 {
466 	char buf[MAXHOSTNAMELEN * 2];
467 	char *domain = NULL;
468 	char *username = NULL;
469 	uint32_t mode = 0;
470 	boolean_t do_prompt = B_TRUE;
471 	char option;
472 
473 	while ((option = getopt(argc, argv, "pu:wy")) != -1) {
474 		if (mode != 0) {
475 			(void) fprintf(stderr, gettext(
476 			    "join options are mutually exclusive\n"));
477 			smbadm_usage(B_FALSE);
478 		}
479 		switch (option) {
480 		case 'p':
481 			mode = SMB_SECMODE_DOMAIN;
482 			/* leave username = NULL */
483 			break;
484 
485 		case 'u':
486 			mode = SMB_SECMODE_DOMAIN;
487 			username = optarg;
488 			break;
489 
490 		case 'w':
491 			mode = SMB_SECMODE_WORKGRP;
492 			break;
493 
494 		case 'y':
495 			do_prompt = B_FALSE;
496 			break;
497 
498 		default:
499 			smbadm_usage(B_FALSE);
500 			break;
501 		}
502 	}
503 
504 	if (optind < argc)
505 		domain = argv[optind];
506 
507 	if (username != NULL && domain == NULL) {
508 		/*
509 		 * The domain was not specified as a separate
510 		 * argument, check for the combination forms.
511 		 */
512 		(void) strlcpy(buf, username, sizeof (buf));
513 		smbadm_extract_domain(buf, &username, &domain);
514 	}
515 
516 	if ((domain == NULL) || (*domain == '\0')) {
517 		(void) fprintf(stderr, gettext("missing %s name\n"),
518 		    (mode == SMB_SECMODE_WORKGRP) ? "workgroup" : "domain");
519 		smbadm_usage(B_FALSE);
520 	}
521 
522 	if (mode == SMB_SECMODE_WORKGRP) {
523 		return (smbadm_join_workgroup(domain, do_prompt));
524 	}
525 	return (smbadm_join_domain(domain, username, do_prompt));
526 }
527 
528 /*
529  * Workgroups comprise a collection of standalone, independently administered
530  * computers that use a common workgroup name.  This is a peer-to-peer model
531  * with no formal membership mechanism.
532  */
533 static int
534 smbadm_join_workgroup(const char *workgroup, boolean_t prompt)
535 {
536 	smb_joininfo_t jdi;
537 	smb_joinres_t jdres;
538 	uint32_t status;
539 
540 	bzero(&jdres, sizeof (jdres));
541 	bzero(&jdi, sizeof (jdi));
542 	jdi.mode = SMB_SECMODE_WORKGRP;
543 	(void) strlcpy(jdi.domain_name, workgroup, sizeof (jdi.domain_name));
544 	(void) strtrim(jdi.domain_name, " \t\n");
545 
546 	if (smb_name_validate_workgroup(jdi.domain_name) != ERROR_SUCCESS) {
547 		(void) fprintf(stderr, gettext("workgroup name is invalid\n"));
548 		smbadm_usage(B_FALSE);
549 	}
550 
551 	if (prompt && !smbadm_join_prompt(jdi.domain_name))
552 		return (0);
553 
554 	if ((status = smb_join(&jdi, &jdres)) != NT_STATUS_SUCCESS) {
555 		(void) fprintf(stderr, gettext("failed to join %s: %s\n"),
556 		    jdi.domain_name, xlate_nt_status(status));
557 		return (1);
558 	}
559 
560 	(void) printf(gettext("Successfully joined %s\n"), jdi.domain_name);
561 	smbadm_restart_service();
562 	return (0);
563 }
564 
565 /*
566  * Domains comprise a centrally administered group of computers and accounts
567  * that share a common security and administration policy and database.
568  * Computers must join a domain and become domain members, which requires
569  * an administrator level account name.
570  *
571  * The '+' character is invalid within a username.  We allow the password
572  * to be appended to the username using '+' as a scripting convenience.
573  */
574 static int
575 smbadm_join_domain(const char *domain, const char *username, boolean_t prompt)
576 {
577 	smb_joininfo_t jdi;
578 	smb_joinres_t jdres;
579 	char *passwd_prompt;
580 	char *p;
581 	int len, rc;
582 
583 	bzero(&jdres, sizeof (jdres));
584 	bzero(&jdi, sizeof (jdi));
585 	jdi.mode = SMB_SECMODE_DOMAIN;
586 	(void) strlcpy(jdi.domain_name, domain, sizeof (jdi.domain_name));
587 	(void) strtrim(jdi.domain_name, " \t\n");
588 
589 	if (smb_name_validate_domain(jdi.domain_name) != ERROR_SUCCESS) {
590 		(void) fprintf(stderr, gettext("domain name is invalid\n"));
591 		smbadm_usage(B_FALSE);
592 	}
593 
594 	if (prompt && !smbadm_join_prompt(jdi.domain_name))
595 		return (0);
596 
597 	/*
598 	 * Note: username is null for "unsecure join"
599 	 * (join using a pre-created computer account)
600 	 * No password either.
601 	 */
602 	if (username != NULL) {
603 		if ((p = strchr(username, '+')) != NULL) {
604 			++p;
605 
606 			len = (int)(p - username);
607 			if (len > sizeof (jdi.domain_name))
608 				len = sizeof (jdi.domain_name);
609 
610 			(void) strlcpy(jdi.domain_username, username, len);
611 			(void) strlcpy(jdi.domain_passwd, p,
612 			    sizeof (jdi.domain_passwd));
613 		} else {
614 			(void) strlcpy(jdi.domain_username, username,
615 			    sizeof (jdi.domain_username));
616 		}
617 
618 		if (smb_name_validate_account(jdi.domain_username)
619 		    != ERROR_SUCCESS) {
620 			(void) fprintf(stderr,
621 			    gettext("username contains invalid characters\n"));
622 			smbadm_usage(B_FALSE);
623 		}
624 
625 		if (*jdi.domain_passwd == '\0') {
626 			passwd_prompt = gettext("Enter domain password: ");
627 
628 			if ((p = getpassphrase(passwd_prompt)) == NULL) {
629 				(void) fprintf(stderr, gettext(
630 				    "missing password\n"));
631 				smbadm_usage(B_FALSE);
632 			}
633 
634 			(void) strlcpy(jdi.domain_passwd, p,
635 			    sizeof (jdi.domain_passwd));
636 		}
637 	}
638 
639 	(void) printf(gettext("Joining %s ... this may take a minute ...\n"),
640 	    jdi.domain_name);
641 
642 	rc = smb_join(&jdi, &jdres);
643 	if (rc != 0) {
644 		(void) printf(gettext("Cannot call the SMB service. "
645 		    " (error %d: %s) "
646 		    "Please check the service status "
647 		    "(svcs -vx network/smb/server)\n"),
648 		    rc, strerror(rc));
649 		bzero(&jdi, sizeof (jdi));
650 		return (1);
651 	}
652 
653 	switch (jdres.status) {
654 	case NT_STATUS_SUCCESS:
655 		(void) printf(gettext(
656 		    "Successfully joined domain %s using AD server %s\n"),
657 		    jdi.domain_name, jdres.dc_name);
658 		bzero(&jdi, sizeof (jdi));
659 		smbadm_restart_service();
660 		return (0);
661 
662 	case NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND:
663 		/* See: smb_ads_lookup_msdcs */
664 		(void) fprintf(stderr, gettext(
665 		    "failed to find any AD servers for domain: %s\n"),
666 		    jdi.domain_name);
667 		goto common;
668 
669 	case NT_STATUS_BAD_NETWORK_PATH:
670 		/* See: smbrdr_ctx_new / smb_ctx_resolve */
671 		(void) fprintf(stderr, gettext(
672 		    "failed to resolve address of AD server: %s\n"),
673 		    jdres.dc_name);
674 		goto common;
675 
676 	case NT_STATUS_NETWORK_ACCESS_DENIED:
677 		/* See: smbrdr_ctx_new / smb_ctx_get_ssn */
678 		(void) fprintf(stderr, gettext(
679 		    "failed to authenticate with AD server: %s\n"),
680 		    jdres.dc_name);
681 		goto common;
682 
683 	case NT_STATUS_BAD_NETWORK_NAME:
684 		/*
685 		 * See: smbrdr_ctx_new / smb_ctx_get_tree
686 		 * and: ndr_rpc_bind / smb_fh_open
687 		 */
688 		(void) fprintf(stderr, gettext(
689 		    "failed connecting to services on AD server: %s\n"),
690 		    jdres.dc_name);
691 		goto common;
692 
693 	default:
694 		(void) fprintf(stderr, gettext(
695 		    "failed to join domain %s\n"),
696 		    jdi.domain_name);
697 		if (jdres.dc_name[0] != '\0') {
698 			(void) fprintf(stderr, gettext(
699 			    "using AD server: %s\n"),
700 			    jdres.dc_name);
701 		}
702 		/* FALLTHROUGH */
703 	common:
704 		if (jdres.join_err != 0) {
705 			(void) fprintf(stderr, "%s\n",
706 			    smb_ads_strerror(jdres.join_err));
707 		} else if (jdres.status != 0) {
708 			(void) fprintf(stderr, "(%s)\n",
709 			    xlate_nt_status(jdres.status));
710 		}
711 		(void) fprintf(stderr, gettext("Please refer to the "
712 		    "service log for more information.\n"));
713 		bzero(&jdi, sizeof (jdi));
714 		return (1);
715 	}
716 }
717 
718 /*
719  * We want to process the user and domain names as separate strings.
720  * Check for names of the forms below and separate the components as
721  * required.
722  *
723  *	name@domain
724  *	domain\name
725  *	domain/name
726  *
727  * If we encounter any of the forms above in arg, the @, / or \
728  * separator is replaced by \0 and the username and domain pointers
729  * are changed to point to the appropriate components (in arg).
730  *
731  * If none of the separators are encountered, the username and domain
732  * pointers remain unchanged.
733  */
734 static void
735 smbadm_extract_domain(char *arg, char **username, char **domain)
736 {
737 	char *p;
738 
739 	if ((p = strpbrk(arg, "/\\@")) != NULL) {
740 		if (*p == '@') {
741 			*p = '\0';
742 			++p;
743 
744 			if (strchr(arg, '+') != NULL)
745 				return;
746 
747 			*domain = p;
748 			*username = arg;
749 		} else {
750 			*p = '\0';
751 			++p;
752 			*username = p;
753 			*domain = arg;
754 		}
755 	}
756 }
757 
758 /*
759  * smbadm_list
760  *
761  * Displays current security mode and domain/workgroup name.
762  */
763 /*ARGSUSED*/
764 static int
765 smbadm_list(int argc, char **argv)
766 {
767 	char domain[MAXHOSTNAMELEN];
768 	char fqdn[MAXHOSTNAMELEN];
769 	char srvname[MAXHOSTNAMELEN];
770 	char modename[16];
771 	int rc;
772 	smb_inaddr_t srvipaddr;
773 	char ipstr[INET6_ADDRSTRLEN];
774 
775 	rc = smb_config_getstr(SMB_CI_SECURITY, modename, sizeof (modename));
776 	if (rc != SMBD_SMF_OK) {
777 		(void) fprintf(stderr,
778 		    gettext("cannot determine the operational mode\n"));
779 		return (1);
780 	}
781 
782 	if (smb_getdomainname(domain, sizeof (domain)) != 0) {
783 		(void) fprintf(stderr, gettext("failed to get the %s name\n"),
784 		    modename);
785 		return (1);
786 	}
787 
788 	if (strcmp(modename, "workgroup") == 0) {
789 		(void) printf(gettext("[*] [%s]\n"), domain);
790 		return (0);
791 	}
792 
793 	(void) printf(gettext("[*] [%s]\n"), domain);
794 	if ((smb_getfqdomainname(fqdn, sizeof (fqdn)) == 0) && (*fqdn != '\0'))
795 		(void) printf(gettext("[*] [%s]\n"), fqdn);
796 
797 	if ((smb_get_dcinfo(srvname, MAXHOSTNAMELEN, &srvipaddr)
798 	    == NT_STATUS_SUCCESS) && (*srvname != '\0') &&
799 	    (!smb_inet_iszero(&srvipaddr))) {
800 		(void) smb_inet_ntop(&srvipaddr, ipstr,
801 		    SMB_IPSTRLEN(srvipaddr.a_family));
802 		(void) printf(gettext("\t[+%s] [%s]\n"),
803 		    srvname, ipstr);
804 	}
805 
806 	/* Print the local and domain SID. */
807 	smb_domain_show();
808 	return (0);
809 }
810 
811 /*
812  * smbadm_lookup
813  *
814  * Lookup the SID for a given account (user or group)
815  */
816 static int
817 smbadm_lookup(int argc, char **argv)
818 {
819 	int i;
820 
821 	if (argc < 2) {
822 		(void) fprintf(stderr, gettext("missing account name\n"));
823 		smbadm_usage(B_FALSE);
824 	}
825 
826 	for (i = 1; i < argc; i++) {
827 		if (strncmp(argv[i], "S-1-", 4) == 0)
828 			smbadm_lookup_sid(argv[i]);
829 		else
830 			smbadm_lookup_name(argv[i]);
831 	}
832 	return (0);
833 }
834 
835 static void
836 smbadm_lookup_name(char *name)
837 {
838 	lsa_account_t	acct;
839 	int rc;
840 
841 	if ((rc = smb_lookup_name(name, SidTypeUnknown, &acct)) != 0) {
842 		(void) fprintf(stderr, gettext(
843 		    "\t\t%s: lookup name failed, rc=%d\n"),
844 		    name, rc);
845 		return;
846 	}
847 	if (acct.a_status != NT_STATUS_SUCCESS) {
848 		(void) fprintf(stderr, gettext("\t\t%s [%s]\n"),
849 		    name, xlate_nt_status(acct.a_status));
850 		return;
851 	}
852 	(void) printf("\t%s\n", acct.a_sid);
853 }
854 
855 static void
856 smbadm_lookup_sid(char *sidstr)
857 {
858 	lsa_account_t	acct;
859 	int rc;
860 
861 	if ((rc = smb_lookup_sid(sidstr, &acct)) != 0) {
862 		(void) fprintf(stderr, gettext(
863 		    "\t\t%s: lookup SID failed, rc=%d\n"),
864 		    sidstr, rc);
865 		return;
866 	}
867 	if (acct.a_status != NT_STATUS_SUCCESS) {
868 		(void) fprintf(stderr, gettext("\t\t%s [%s]\n"),
869 		    sidstr, xlate_nt_status(acct.a_status));
870 		return;
871 	}
872 	(void) printf("\t%s\\%s\n", acct.a_domain, acct.a_name);
873 }
874 
875 /*
876  * smbadm_group_create
877  *
878  * Creates a local SMB group
879  */
880 static int
881 smbadm_group_create(int argc, char **argv)
882 {
883 	char *gname = NULL;
884 	char *desc = NULL;
885 	char option;
886 	int status;
887 
888 	while ((option = getopt(argc, argv, "d:")) != -1) {
889 		switch (option) {
890 		case 'd':
891 			desc = optarg;
892 			break;
893 
894 		default:
895 			smbadm_usage(B_FALSE);
896 		}
897 	}
898 
899 	gname = argv[optind];
900 	if (optind >= argc || gname == NULL || *gname == '\0') {
901 		(void) fprintf(stderr, gettext("missing group name\n"));
902 		smbadm_usage(B_FALSE);
903 	}
904 
905 	status = smb_lgrp_add(gname, desc);
906 	if (status != SMB_LGRP_SUCCESS) {
907 		(void) fprintf(stderr,
908 		    gettext("failed to create %s (%s)\n"), gname,
909 		    smb_lgrp_strerror(status));
910 	} else {
911 		(void) printf(gettext("%s created\n"), gname);
912 	}
913 
914 	return (status);
915 }
916 
917 /*
918  * smbadm_group_dump_members
919  *
920  * Dump group members details.
921  */
922 static void
923 smbadm_group_dump_members(smb_gsid_t *members, int num)
924 {
925 	char		sidstr[SMB_SID_STRSZ];
926 	lsa_account_t	acct;
927 	int		i;
928 
929 	if (num == 0) {
930 		(void) printf(gettext("\tNo members\n"));
931 		return;
932 	}
933 
934 	(void) printf(gettext("\tMembers:\n"));
935 	for (i = 0; i < num; i++) {
936 		smb_sid_tostr(members[i].gs_sid, sidstr);
937 
938 		if (smb_lookup_sid(sidstr, &acct) == 0) {
939 			if (acct.a_status == NT_STATUS_SUCCESS)
940 				smbadm_group_show_name(acct.a_domain,
941 				    acct.a_name);
942 			else
943 				(void) printf(gettext("\t\t%s [%s]\n"),
944 				    sidstr, xlate_nt_status(acct.a_status));
945 		} else {
946 			(void) printf(gettext("\t\t%s\n"), sidstr);
947 		}
948 	}
949 }
950 
951 static void
952 smbadm_group_show_name(const char *domain, const char *name)
953 {
954 	if (strchr(domain, '.') != NULL)
955 		(void) printf("\t\t%s@%s\n", name, domain);
956 	else
957 		(void) printf("\t\t%s\\%s\n", domain, name);
958 }
959 
960 /*
961  * smbadm_group_dump_privs
962  *
963  * Dump group privilege details.
964  */
965 static void
966 smbadm_group_dump_privs(smb_privset_t *privs)
967 {
968 	smb_privinfo_t *pinfo;
969 	char *pstatus;
970 	int i;
971 
972 	(void) printf(gettext("\tPrivileges: \n"));
973 
974 	for (i = 0; i < privs->priv_cnt; i++) {
975 		pinfo = smb_priv_getbyvalue(privs->priv[i].luid.lo_part);
976 		if ((pinfo == NULL) || (pinfo->flags & PF_PRESENTABLE) == 0)
977 			continue;
978 
979 		switch (privs->priv[i].attrs) {
980 		case SE_PRIVILEGE_ENABLED:
981 			pstatus = "On";
982 			break;
983 		case SE_PRIVILEGE_DISABLED:
984 			pstatus = "Off";
985 			break;
986 		default:
987 			pstatus = "Unknown";
988 			break;
989 		}
990 		(void) printf(gettext("\t\t%s: %s\n"), pinfo->name, pstatus);
991 	}
992 
993 	if (privs->priv_cnt == 0)
994 		(void) printf(gettext("\t\tNo privileges\n"));
995 }
996 
997 /*
998  * smbadm_group_dump
999  *
1000  * Dump group details.
1001  */
1002 static void
1003 smbadm_group_dump(smb_group_t *grp, boolean_t show_mem, boolean_t show_privs)
1004 {
1005 	char sidstr[SMB_SID_STRSZ];
1006 
1007 	(void) printf(gettext("%s (%s)\n"), grp->sg_name, grp->sg_cmnt);
1008 
1009 	smb_sid_tostr(grp->sg_id.gs_sid, sidstr);
1010 	(void) printf(gettext("\tSID: %s\n"), sidstr);
1011 
1012 	if (show_privs)
1013 		smbadm_group_dump_privs(grp->sg_privs);
1014 
1015 	if (show_mem)
1016 		smbadm_group_dump_members(grp->sg_members, grp->sg_nmembers);
1017 }
1018 
1019 /*
1020  * smbadm_group_show
1021  *
1022  */
1023 static int
1024 smbadm_group_show(int argc, char **argv)
1025 {
1026 	char *gname = NULL;
1027 	boolean_t show_privs;
1028 	boolean_t show_members;
1029 	char option;
1030 	int status;
1031 	smb_group_t grp;
1032 	smb_giter_t gi;
1033 
1034 	show_privs = show_members = B_FALSE;
1035 
1036 	while ((option = getopt(argc, argv, "mp")) != -1) {
1037 		switch (option) {
1038 		case 'm':
1039 			show_members = B_TRUE;
1040 			break;
1041 		case 'p':
1042 			show_privs = B_TRUE;
1043 			break;
1044 
1045 		default:
1046 			smbadm_usage(B_FALSE);
1047 		}
1048 	}
1049 
1050 	gname = argv[optind];
1051 	if (optind >= argc || gname == NULL || *gname == '\0')
1052 		gname = "*";
1053 
1054 	if (strcmp(gname, "*")) {
1055 		status = smb_lgrp_getbyname(gname, &grp);
1056 		if (status == SMB_LGRP_SUCCESS) {
1057 			smbadm_group_dump(&grp, show_members, show_privs);
1058 			smb_lgrp_free(&grp);
1059 		} else {
1060 			(void) fprintf(stderr,
1061 			    gettext("failed to find %s (%s)\n"),
1062 			    gname, smb_lgrp_strerror(status));
1063 		}
1064 		return (status);
1065 	}
1066 
1067 	if ((status = smb_lgrp_iteropen(&gi)) != SMB_LGRP_SUCCESS) {
1068 		(void) fprintf(stderr, gettext("failed to list groups (%s)\n"),
1069 		    smb_lgrp_strerror(status));
1070 		return (status);
1071 	}
1072 
1073 	while ((status = smb_lgrp_iterate(&gi, &grp)) == SMB_LGRP_SUCCESS) {
1074 		smbadm_group_dump(&grp, show_members, show_privs);
1075 		smb_lgrp_free(&grp);
1076 	}
1077 
1078 	smb_lgrp_iterclose(&gi);
1079 
1080 	if ((status != SMB_LGRP_NO_MORE) || smb_lgrp_itererror(&gi)) {
1081 		if (status != SMB_LGRP_NO_MORE)
1082 			smb_syslog(LOG_ERR, "smb_lgrp_iterate: %s",
1083 			    smb_lgrp_strerror(status));
1084 
1085 		(void) fprintf(stderr,
1086 		    gettext("\nAn error occurred while retrieving group data.\n"
1087 		    "Check the system log for more information.\n"));
1088 		return (status);
1089 	}
1090 
1091 	return (0);
1092 }
1093 
1094 /*
1095  * smbadm_group_delete
1096  */
1097 static int
1098 smbadm_group_delete(int argc, char **argv)
1099 {
1100 	char *gname = NULL;
1101 	int status;
1102 
1103 	gname = argv[optind];
1104 	if (optind >= argc || gname == NULL || *gname == '\0') {
1105 		(void) fprintf(stderr, gettext("missing group name\n"));
1106 		smbadm_usage(B_FALSE);
1107 	}
1108 
1109 	status = smb_lgrp_delete(gname);
1110 	if (status != SMB_LGRP_SUCCESS) {
1111 		(void) fprintf(stderr,
1112 		    gettext("failed to delete %s (%s)\n"), gname,
1113 		    smb_lgrp_strerror(status));
1114 	} else {
1115 		(void) printf(gettext("%s deleted\n"), gname);
1116 	}
1117 
1118 	return (status);
1119 }
1120 
1121 /*
1122  * smbadm_group_rename
1123  */
1124 static int
1125 smbadm_group_rename(int argc, char **argv)
1126 {
1127 	char *gname = NULL;
1128 	char *ngname = NULL;
1129 	int status;
1130 
1131 	gname = argv[optind];
1132 	if (optind++ >= argc || gname == NULL || *gname == '\0') {
1133 		(void) fprintf(stderr, gettext("missing group name\n"));
1134 		smbadm_usage(B_FALSE);
1135 	}
1136 
1137 	ngname = argv[optind];
1138 	if (optind >= argc || ngname == NULL || *ngname == '\0') {
1139 		(void) fprintf(stderr, gettext("missing new group name\n"));
1140 		smbadm_usage(B_FALSE);
1141 	}
1142 
1143 	status = smb_lgrp_rename(gname, ngname);
1144 	if (status != SMB_LGRP_SUCCESS) {
1145 		if (status == SMB_LGRP_EXISTS)
1146 			(void) fprintf(stderr,
1147 			    gettext("failed to rename '%s' (%s already "
1148 			    "exists)\n"), gname, ngname);
1149 		else
1150 			(void) fprintf(stderr,
1151 			    gettext("failed to rename '%s' (%s)\n"), gname,
1152 			    smb_lgrp_strerror(status));
1153 	} else {
1154 		(void) printf(gettext("'%s' renamed to '%s'\n"), gname, ngname);
1155 	}
1156 
1157 	return (status);
1158 }
1159 
1160 /*
1161  * smbadm_group_setprop
1162  *
1163  * Set the group properties.
1164  */
1165 static int
1166 smbadm_group_setprop(int argc, char **argv)
1167 {
1168 	char *gname = NULL;
1169 	smbadm_prop_t props[SMBADM_NPROP];
1170 	smbadm_prop_handle_t *phandle;
1171 	char option;
1172 	int pcnt = 0;
1173 	int ret;
1174 	int p;
1175 
1176 	bzero(props, SMBADM_NPROP * sizeof (smbadm_prop_t));
1177 
1178 	while ((option = getopt(argc, argv, "p:")) != -1) {
1179 		switch (option) {
1180 		case 'p':
1181 			if (pcnt >= SMBADM_NPROP) {
1182 				(void) fprintf(stderr,
1183 				    gettext("exceeded number of supported"
1184 				    " properties\n"));
1185 				smbadm_usage(B_FALSE);
1186 			}
1187 
1188 			if (smbadm_prop_parse(optarg, &props[pcnt++]) != 0)
1189 				smbadm_usage(B_FALSE);
1190 			break;
1191 
1192 		default:
1193 			smbadm_usage(B_FALSE);
1194 		}
1195 	}
1196 
1197 	if (pcnt == 0) {
1198 		(void) fprintf(stderr,
1199 		    gettext("missing property=value argument\n"));
1200 		smbadm_usage(B_FALSE);
1201 	}
1202 
1203 	gname = argv[optind];
1204 	if (optind >= argc || gname == NULL || *gname == '\0') {
1205 		(void) fprintf(stderr, gettext("missing group name\n"));
1206 		smbadm_usage(B_FALSE);
1207 	}
1208 
1209 	for (p = 0; p < pcnt; p++) {
1210 		phandle = smbadm_prop_gethandle(props[p].p_name);
1211 		if (phandle) {
1212 			if (phandle->p_setfn(gname, &props[p]) != 0)
1213 				ret = 1;
1214 		}
1215 	}
1216 
1217 	return (ret);
1218 }
1219 
1220 /*
1221  * smbadm_group_getprop
1222  *
1223  * Get the group properties.
1224  */
1225 static int
1226 smbadm_group_getprop(int argc, char **argv)
1227 {
1228 	char *gname = NULL;
1229 	smbadm_prop_t props[SMBADM_NPROP];
1230 	smbadm_prop_handle_t *phandle;
1231 	char option;
1232 	int pcnt = 0;
1233 	int ret;
1234 	int p;
1235 
1236 	bzero(props, SMBADM_NPROP * sizeof (smbadm_prop_t));
1237 
1238 	while ((option = getopt(argc, argv, "p:")) != -1) {
1239 		switch (option) {
1240 		case 'p':
1241 			if (pcnt >= SMBADM_NPROP) {
1242 				(void) fprintf(stderr,
1243 				    gettext("exceeded number of supported"
1244 				    " properties\n"));
1245 				smbadm_usage(B_FALSE);
1246 			}
1247 
1248 			if (smbadm_prop_parse(optarg, &props[pcnt++]) != 0)
1249 				smbadm_usage(B_FALSE);
1250 			break;
1251 
1252 		default:
1253 			smbadm_usage(B_FALSE);
1254 		}
1255 	}
1256 
1257 	gname = argv[optind];
1258 	if (optind >= argc || gname == NULL || *gname == '\0') {
1259 		(void) fprintf(stderr, gettext("missing group name\n"));
1260 		smbadm_usage(B_FALSE);
1261 	}
1262 
1263 	if (pcnt == 0) {
1264 		/*
1265 		 * If no property has be specified then get
1266 		 * all the properties.
1267 		 */
1268 		pcnt = SMBADM_NPROP;
1269 		for (p = 0; p < pcnt; p++)
1270 			props[p].p_name = smbadm_ptable[p].p_name;
1271 	}
1272 
1273 	for (p = 0; p < pcnt; p++) {
1274 		phandle = smbadm_prop_gethandle(props[p].p_name);
1275 		if (phandle) {
1276 			if (phandle->p_getfn(gname, &props[p]) != 0)
1277 				ret = 1;
1278 		}
1279 	}
1280 
1281 	return (ret);
1282 }
1283 
1284 /*
1285  * smbadm_group_addmember
1286  *
1287  */
1288 static int
1289 smbadm_group_addmember(int argc, char **argv)
1290 {
1291 	char *gname = NULL;
1292 	char **mname;
1293 	char option;
1294 	int mcnt = 0;
1295 	int ret = 0;
1296 	int i;
1297 
1298 
1299 	mname = (char **)malloc(argc * sizeof (char *));
1300 	if (mname == NULL) {
1301 		warn(gettext("failed to add group member"));
1302 		return (1);
1303 	}
1304 	bzero(mname, argc * sizeof (char *));
1305 
1306 	while ((option = getopt(argc, argv, "m:")) != -1) {
1307 		switch (option) {
1308 		case 'm':
1309 			mname[mcnt++] = optarg;
1310 			break;
1311 
1312 		default:
1313 			free(mname);
1314 			smbadm_usage(B_FALSE);
1315 		}
1316 	}
1317 
1318 	if (mcnt == 0) {
1319 		(void) fprintf(stderr, gettext("missing member name\n"));
1320 		free(mname);
1321 		smbadm_usage(B_FALSE);
1322 	}
1323 
1324 	gname = argv[optind];
1325 	if (optind >= argc || gname == NULL || *gname == 0) {
1326 		(void) fprintf(stderr, gettext("missing group name\n"));
1327 		free(mname);
1328 		smbadm_usage(B_FALSE);
1329 	}
1330 
1331 	for (i = 0; i < mcnt; i++) {
1332 		if (mname[i] == NULL)
1333 			continue;
1334 		ret |= smbadm_group_add_del_member(
1335 		    gname, mname[i], SMBADM_GRP_ADDMEMBER);
1336 	}
1337 
1338 	free(mname);
1339 	return (ret);
1340 }
1341 
1342 /*
1343  * smbadm_group_delmember
1344  */
1345 static int
1346 smbadm_group_delmember(int argc, char **argv)
1347 {
1348 	char *gname = NULL;
1349 	char **mname;
1350 	char option;
1351 	int mcnt = 0;
1352 	int ret = 0;
1353 	int i;
1354 
1355 	mname = (char **)malloc(argc * sizeof (char *));
1356 	if (mname == NULL) {
1357 		warn(gettext("failed to delete group member"));
1358 		return (1);
1359 	}
1360 	bzero(mname, argc * sizeof (char *));
1361 
1362 	while ((option = getopt(argc, argv, "m:")) != -1) {
1363 		switch (option) {
1364 		case 'm':
1365 			mname[mcnt++] = optarg;
1366 			break;
1367 
1368 		default:
1369 			free(mname);
1370 			smbadm_usage(B_FALSE);
1371 		}
1372 	}
1373 
1374 	if (mcnt == 0) {
1375 		(void) fprintf(stderr, gettext("missing member name\n"));
1376 		free(mname);
1377 		smbadm_usage(B_FALSE);
1378 	}
1379 
1380 	gname = argv[optind];
1381 	if (optind >= argc || gname == NULL || *gname == 0) {
1382 		(void) fprintf(stderr, gettext("missing group name\n"));
1383 		free(mname);
1384 		smbadm_usage(B_FALSE);
1385 	}
1386 
1387 
1388 	for (i = 0; i < mcnt; i++) {
1389 		ret = 0;
1390 		if (mname[i] == NULL)
1391 			continue;
1392 		ret |= smbadm_group_add_del_member(
1393 		    gname, mname[i], SMBADM_GRP_DELMEMBER);
1394 	}
1395 
1396 	free(mname);
1397 	return (ret);
1398 }
1399 
1400 static int
1401 smbadm_group_add_del_member(char *gname, char *mname,
1402     smbadm_grp_action_t act)
1403 {
1404 	lsa_account_t	acct;
1405 	smb_gsid_t msid;
1406 	char *sidstr;
1407 	char *act_str;
1408 	int rc;
1409 
1410 	if (strncmp(mname, "S-1-", 4) == 0) {
1411 		/*
1412 		 * We are given a SID.  Just use it.
1413 		 *
1414 		 * We'd like the real account type if we can get it,
1415 		 * but don't want to error out if we can't get it.
1416 		 * Lacking other info, assume it's a group.
1417 		 */
1418 		sidstr = mname;
1419 		rc = smb_lookup_sid(sidstr, &acct);
1420 		if ((rc != 0) || (acct.a_status != NT_STATUS_SUCCESS))
1421 			acct.a_sidtype = SidTypeGroup;
1422 	} else {
1423 		rc = smb_lookup_name(mname, SidTypeUnknown, &acct);
1424 		if ((rc != 0) || (acct.a_status != NT_STATUS_SUCCESS)) {
1425 			(void) fprintf(stderr,
1426 			    gettext("%s: name lookup failed\n"), mname);
1427 			return (1);
1428 		}
1429 		sidstr = acct.a_sid;
1430 	}
1431 
1432 	msid.gs_type = acct.a_sidtype;
1433 	if ((msid.gs_sid = smb_sid_fromstr(sidstr)) == NULL) {
1434 		(void) fprintf(stderr,
1435 		    gettext("%s: no memory for SID\n"), sidstr);
1436 		return (1);
1437 	}
1438 
1439 	switch (act) {
1440 	case SMBADM_GRP_ADDMEMBER:
1441 		act_str = gettext("add");
1442 		rc = smb_lgrp_add_member(gname,
1443 		    msid.gs_sid, msid.gs_type);
1444 		break;
1445 	case SMBADM_GRP_DELMEMBER:
1446 		act_str = gettext("remove");
1447 		rc = smb_lgrp_del_member(gname,
1448 		    msid.gs_sid, msid.gs_type);
1449 		break;
1450 	default:
1451 		rc = SMB_LGRP_INTERNAL_ERROR;
1452 		break;
1453 	}
1454 
1455 	smb_sid_free(msid.gs_sid);
1456 
1457 	if (rc != SMB_LGRP_SUCCESS) {
1458 		(void) fprintf(stderr,
1459 		    gettext("failed to %s %s (%s)\n"),
1460 		    act_str, mname, smb_lgrp_strerror(rc));
1461 		return (1);
1462 	}
1463 	return (0);
1464 }
1465 
1466 static int
1467 smbadm_user_delete(int argc, char **argv)
1468 {
1469 	int error;
1470 	char *user = NULL;
1471 
1472 	user = argv[optind];
1473 	if (optind >= argc || user == NULL || *user == '\0') {
1474 		(void) fprintf(stderr, gettext("missing user name\n"));
1475 		smbadm_usage(B_FALSE);
1476 	}
1477 
1478 	error = smb_pwd_setcntl(user, SMB_PWC_DELETE);
1479 	if (error == SMB_PWE_SUCCESS)
1480 		(void) printf(gettext("%s has been deleted.\n"), user);
1481 	else
1482 		(void) fprintf(stderr, "%s\n", smbadm_pwd_strerror(error));
1483 
1484 	return (error);
1485 }
1486 
1487 static int
1488 smbadm_user_disable(int argc, char **argv)
1489 {
1490 	int error;
1491 	char *user = NULL;
1492 
1493 	user = argv[optind];
1494 	if (optind >= argc || user == NULL || *user == '\0') {
1495 		(void) fprintf(stderr, gettext("missing user name\n"));
1496 		smbadm_usage(B_FALSE);
1497 	}
1498 
1499 	error = smb_pwd_setcntl(user, SMB_PWC_DISABLE);
1500 	if (error == SMB_PWE_SUCCESS)
1501 		(void) printf(gettext("%s is disabled.\n"), user);
1502 	else
1503 		(void) fprintf(stderr, "%s\n", smbadm_pwd_strerror(error));
1504 
1505 	return (error);
1506 }
1507 
1508 static int
1509 smbadm_user_enable(int argc, char **argv)
1510 {
1511 	int error;
1512 	char *user = NULL;
1513 
1514 	user = argv[optind];
1515 	if (optind >= argc || user == NULL || *user == '\0') {
1516 		(void) fprintf(stderr, gettext("missing user name\n"));
1517 		smbadm_usage(B_FALSE);
1518 	}
1519 
1520 	error = smb_pwd_setcntl(user, SMB_PWC_ENABLE);
1521 	if (error == SMB_PWE_SUCCESS)
1522 		(void) printf(gettext("%s is enabled.\n"), user);
1523 	else
1524 		(void) fprintf(stderr, "%s\n", smbadm_pwd_strerror(error));
1525 
1526 	return (error);
1527 }
1528 
1529 
1530 int
1531 main(int argc, char **argv)
1532 {
1533 	int ret;
1534 	int i;
1535 
1536 	(void) setlocale(LC_ALL, "");
1537 	(void) textdomain(TEXT_DOMAIN);
1538 
1539 	(void) malloc(0);	/* satisfy libumem dependency */
1540 
1541 	progname = basename(argv[0]);
1542 
1543 	if (is_system_labeled()) {
1544 		(void) fprintf(stderr,
1545 		    gettext("Trusted Extensions not supported\n"));
1546 		return (1);
1547 	}
1548 
1549 	if (argc < 2) {
1550 		(void) fprintf(stderr, gettext("missing command\n"));
1551 		smbadm_usage(B_FALSE);
1552 	}
1553 
1554 	/*
1555 	 * Special case "cmd --help/-?"
1556 	 */
1557 	if (strcmp(argv[1], "-?") == 0 ||
1558 	    strcmp(argv[1], "--help") == 0 ||
1559 	    strcmp(argv[1], "-h") == 0)
1560 		smbadm_usage(B_TRUE);
1561 
1562 	for (i = 0; i < SMBADM_NCMD; ++i) {
1563 		curcmd = &smbadm_cmdtable[i];
1564 		if (strcasecmp(argv[1], curcmd->name) == 0) {
1565 			if (argc > 2) {
1566 				/* cmd subcmd --help/-? */
1567 				if (strcmp(argv[2], "-?") == 0 ||
1568 				    strcmp(argv[2], "--help") == 0 ||
1569 				    strcmp(argv[2], "-h") == 0)
1570 					smbadm_usage(B_TRUE);
1571 			}
1572 
1573 			if (!smbadm_checkauth(curcmd->auth)) {
1574 				(void) fprintf(stderr,
1575 				    gettext("%s: %s: authorization denied\n"),
1576 				    progname, curcmd->name);
1577 				return (1);
1578 			}
1579 
1580 			if ((ret = smbadm_init()) != 0)
1581 				return (ret);
1582 
1583 			ret = curcmd->func(argc - 1, &argv[1]);
1584 
1585 			smbadm_fini();
1586 			return (ret);
1587 		}
1588 	}
1589 
1590 	curcmd = NULL;
1591 	(void) fprintf(stderr, gettext("unknown subcommand (%s)\n"), argv[1]);
1592 	smbadm_usage(B_FALSE);
1593 	return (2);
1594 }
1595 
1596 static int
1597 smbadm_init(void)
1598 {
1599 	int rc;
1600 
1601 	switch (curcmd->flags & SMBADM_CMDF_TYPEMASK) {
1602 	case SMBADM_CMDF_GROUP:
1603 		if ((rc = smb_lgrp_start()) != SMB_LGRP_SUCCESS) {
1604 			(void) fprintf(stderr,
1605 			    gettext("failed to initialize (%s)\n"),
1606 			    smb_lgrp_strerror(rc));
1607 			return (1);
1608 		}
1609 		break;
1610 
1611 	case SMBADM_CMDF_USER:
1612 		smb_pwd_init(B_FALSE);
1613 		break;
1614 
1615 	default:
1616 		break;
1617 	}
1618 
1619 	return (0);
1620 }
1621 
1622 static void
1623 smbadm_fini(void)
1624 {
1625 	switch (curcmd->flags & SMBADM_CMDF_TYPEMASK) {
1626 	case SMBADM_CMDF_GROUP:
1627 		smb_lgrp_stop();
1628 		break;
1629 
1630 	case SMBADM_CMDF_USER:
1631 		smb_pwd_fini();
1632 		break;
1633 
1634 	default:
1635 		break;
1636 	}
1637 }
1638 
1639 static boolean_t
1640 smbadm_checkauth(const char *auth)
1641 {
1642 	struct passwd *pw;
1643 
1644 	if ((pw = getpwuid(getuid())) == NULL)
1645 		return (B_FALSE);
1646 
1647 	if (chkauthattr(auth, pw->pw_name) == 0)
1648 		return (B_FALSE);
1649 
1650 	return (B_TRUE);
1651 }
1652 
1653 static boolean_t
1654 smbadm_prop_validate(smbadm_prop_t *prop, boolean_t chkval)
1655 {
1656 	smbadm_prop_handle_t *pinfo;
1657 	int i;
1658 
1659 	for (i = 0; i < SMBADM_NPROP; i++) {
1660 		pinfo = &smbadm_ptable[i];
1661 		if (strcmp(pinfo->p_name, prop->p_name) == 0) {
1662 			if (pinfo->p_chkfn && chkval)
1663 				return (pinfo->p_chkfn(prop));
1664 
1665 			return (B_TRUE);
1666 		}
1667 	}
1668 
1669 	(void) fprintf(stderr, gettext("unrecognized property '%s'\n"),
1670 	    prop->p_name);
1671 
1672 	return (B_FALSE);
1673 }
1674 
1675 static int
1676 smbadm_prop_parse(char *arg, smbadm_prop_t *prop)
1677 {
1678 	boolean_t parse_value;
1679 	char *equal;
1680 
1681 	if (arg == NULL)
1682 		return (2);
1683 
1684 	prop->p_name = prop->p_value = NULL;
1685 
1686 	if (strcmp(curcmd->name, "set") == 0)
1687 		parse_value = B_TRUE;
1688 	else
1689 		parse_value = B_FALSE;
1690 
1691 	prop->p_name = arg;
1692 
1693 	if (parse_value) {
1694 		equal = strchr(arg, '=');
1695 		if (equal == NULL)
1696 			return (2);
1697 
1698 		*equal++ = '\0';
1699 		prop->p_value = equal;
1700 	}
1701 
1702 	if (smbadm_prop_validate(prop, parse_value) == B_FALSE)
1703 		return (2);
1704 
1705 	return (0);
1706 }
1707 
1708 static smbadm_prop_handle_t *
1709 smbadm_prop_gethandle(char *pname)
1710 {
1711 	int i;
1712 
1713 	for (i = 0; i < SMBADM_NPROP; i++)
1714 		if (strcmp(pname, smbadm_ptable[i].p_name) == 0)
1715 			return (&smbadm_ptable[i]);
1716 
1717 	return (NULL);
1718 }
1719 
1720 static int
1721 smbadm_setprop_desc(char *gname, smbadm_prop_t *prop)
1722 {
1723 	int status;
1724 
1725 	status = smb_lgrp_setcmnt(gname, prop->p_value);
1726 	if (status != SMB_LGRP_SUCCESS) {
1727 		(void) fprintf(stderr,
1728 		    gettext("failed to modify the group description (%s)\n"),
1729 		    smb_lgrp_strerror(status));
1730 		return (1);
1731 	}
1732 
1733 	(void) printf(gettext("%s: description modified\n"), gname);
1734 	return (0);
1735 }
1736 
1737 static int
1738 smbadm_getprop_desc(char *gname, smbadm_prop_t *prop)
1739 {
1740 	char *cmnt = NULL;
1741 	int status;
1742 
1743 	status = smb_lgrp_getcmnt(gname, &cmnt);
1744 	if (status != SMB_LGRP_SUCCESS) {
1745 		(void) fprintf(stderr,
1746 		    gettext("failed to get the group description (%s)\n"),
1747 		    smb_lgrp_strerror(status));
1748 		return (1);
1749 	}
1750 
1751 	(void) printf(gettext("\t%s: %s\n"), prop->p_name, cmnt);
1752 	free(cmnt);
1753 	return (0);
1754 }
1755 
1756 static int
1757 smbadm_group_setpriv(char *gname, uint8_t priv_id, smbadm_prop_t *prop)
1758 {
1759 	boolean_t enable;
1760 	int status;
1761 	int ret;
1762 
1763 	if (strcasecmp(prop->p_value, "on") == 0) {
1764 		(void) printf(gettext("Enabling %s privilege "), prop->p_name);
1765 		enable = B_TRUE;
1766 	} else {
1767 		(void) printf(gettext("Disabling %s privilege "), prop->p_name);
1768 		enable = B_FALSE;
1769 	}
1770 
1771 	status = smb_lgrp_setpriv(gname, priv_id, enable);
1772 	if (status == SMB_LGRP_SUCCESS) {
1773 		(void) printf(gettext("succeeded\n"));
1774 		ret = 0;
1775 	} else {
1776 		(void) printf(gettext("failed: %s\n"),
1777 		    smb_lgrp_strerror(status));
1778 		ret = 1;
1779 	}
1780 
1781 	return (ret);
1782 }
1783 
1784 static int
1785 smbadm_group_getpriv(char *gname, uint8_t priv_id, smbadm_prop_t *prop)
1786 {
1787 	boolean_t enable;
1788 	int status;
1789 
1790 	status = smb_lgrp_getpriv(gname, priv_id, &enable);
1791 	if (status != SMB_LGRP_SUCCESS) {
1792 		(void) fprintf(stderr, gettext("failed to get %s (%s)\n"),
1793 		    prop->p_name, smb_lgrp_strerror(status));
1794 		return (1);
1795 	}
1796 
1797 	(void) printf(gettext("\t%s: %s\n"), prop->p_name,
1798 	    (enable) ? "On" : "Off");
1799 
1800 	return (0);
1801 }
1802 
1803 static int
1804 smbadm_setprop_tkowner(char *gname, smbadm_prop_t *prop)
1805 {
1806 	return (smbadm_group_setpriv(gname, SE_TAKE_OWNERSHIP_LUID, prop));
1807 }
1808 
1809 static int
1810 smbadm_getprop_tkowner(char *gname, smbadm_prop_t *prop)
1811 {
1812 	return (smbadm_group_getpriv(gname, SE_TAKE_OWNERSHIP_LUID, prop));
1813 }
1814 
1815 static int
1816 smbadm_setprop_backup(char *gname, smbadm_prop_t *prop)
1817 {
1818 	return (smbadm_group_setpriv(gname, SE_BACKUP_LUID, prop));
1819 }
1820 
1821 static int
1822 smbadm_getprop_backup(char *gname, smbadm_prop_t *prop)
1823 {
1824 	return (smbadm_group_getpriv(gname, SE_BACKUP_LUID, prop));
1825 }
1826 
1827 static int
1828 smbadm_setprop_restore(char *gname, smbadm_prop_t *prop)
1829 {
1830 	return (smbadm_group_setpriv(gname, SE_RESTORE_LUID, prop));
1831 }
1832 
1833 static int
1834 smbadm_getprop_restore(char *gname, smbadm_prop_t *prop)
1835 {
1836 	return (smbadm_group_getpriv(gname, SE_RESTORE_LUID, prop));
1837 }
1838 
1839 static boolean_t
1840 smbadm_chkprop_priv(smbadm_prop_t *prop)
1841 {
1842 	if (prop->p_value == NULL || *prop->p_value == '\0') {
1843 		(void) fprintf(stderr,
1844 		    gettext("missing value for '%s'\n"), prop->p_name);
1845 		return (B_FALSE);
1846 	}
1847 
1848 	if (strcasecmp(prop->p_value, "on") == 0)
1849 		return (B_TRUE);
1850 
1851 	if (strcasecmp(prop->p_value, "off") == 0)
1852 		return (B_TRUE);
1853 
1854 	(void) fprintf(stderr,
1855 	    gettext("%s: unrecognized value for '%s' property\n"),
1856 	    prop->p_value, prop->p_name);
1857 
1858 	return (B_FALSE);
1859 }
1860 
1861 static const char *
1862 smbadm_pwd_strerror(int error)
1863 {
1864 	switch (error) {
1865 	case SMB_PWE_SUCCESS:
1866 		return (gettext("Success."));
1867 
1868 	case SMB_PWE_USER_UNKNOWN:
1869 		return (gettext("User does not exist."));
1870 
1871 	case SMB_PWE_USER_DISABLE:
1872 		return (gettext("User is disabled."));
1873 
1874 	case SMB_PWE_CLOSE_FAILED:
1875 	case SMB_PWE_OPEN_FAILED:
1876 	case SMB_PWE_WRITE_FAILED:
1877 	case SMB_PWE_UPDATE_FAILED:
1878 		return (gettext("Unexpected failure. "
1879 		    "SMB password database unchanged."));
1880 
1881 	case SMB_PWE_STAT_FAILED:
1882 		return (gettext("stat of SMB password file failed."));
1883 
1884 	case SMB_PWE_BUSY:
1885 		return (gettext("SMB password database busy. "
1886 		    "Try again later."));
1887 
1888 	case SMB_PWE_DENIED:
1889 		return (gettext("Operation not permitted."));
1890 
1891 	case SMB_PWE_SYSTEM_ERROR:
1892 		return (gettext("System error."));
1893 
1894 	default:
1895 		break;
1896 	}
1897 
1898 	return (gettext("Unknown error code."));
1899 }
1900 
1901 /*
1902  * Enable libumem debugging by default on DEBUG builds.
1903  */
1904 #ifdef DEBUG
1905 const char *
1906 _umem_debug_init(void)
1907 {
1908 	return ("default,verbose"); /* $UMEM_DEBUG setting */
1909 }
1910 
1911 const char *
1912 _umem_logging_init(void)
1913 {
1914 	return ("fail,contents"); /* $UMEM_LOGGING setting */
1915 }
1916 #endif
1917