Файловый менеджер - Редактировать - /usr/lib64/python3.6/site-packages/samba/netcmd/__pycache__/gpo.cpython-36.opt-1.pyc
Ðазад
3 �I�d]� � @ s� d dl Z d dlZd dljZd dlZd dlZd dljj Z d dl Z d dl Z d dl mZ d dlmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlmZm Z d dlm Z d dl Zd dl Zd d l m Z m Z m!Z! d d l"m#Z# d d lm$Z$ d d l%m&Z' d d lm(Z( d dl)Z)d dl*m+Z+ d dlm,Z, d dl-m.Z. d dl/m0Z0m1Z1m2Z2 d dl3m4Z4 d dl5m6Z6m7Z7m8Z8m9Z9 d dl:m;Z; d dl<m=Z= d dl>m?Z? d dlm@Z@ d dl"mAZA d dlBmCZCmDZD d dlEmFZF d dlGmHZHmIZI d d lJmKZKmLZL d dlMZMd dlNZNd d lOmPZP d d lQmRZRmSZSmTZTmUZUmVZV d d lWmXZXmYZYmZZZ d d l[m\Z\ d d!l]m^Z^ d d"l_m`Z`maZambZb d#d$� Zcd%d&� Zdd'd(� Zed)d*� Zfd�d+d,�ZgdddejhejiB ejjB ejkB fd-d.�Zld/d0� Zmd1d2� Znd3d4� Zoejpfd5d6�Zqd7d8� Zre'jse'jtB e'juB e'jvB Zwd9d:� Zxd�d<d=�ZyG d>d?� d?e�ZzG d@dA� dAez�Z{G dBdC� dCez�Z|G dDdE� dEez�Z}G dFdG� dGez�Z~G dHdI� dIez�ZG dJdK� dKez�Z�G dLdM� dMez�Z�G dNdO� dOez�Z�G dPdQ� dQez�Z�G dRdS� dSez�Z�G dTdU� dUez�Z�G dVdW� dWez�Z�G dXdY� dYez�Z�G dZd[� d[ez�Z�G d\d]� d]e��Z�G d^d_� d_ez�Z�G d`da� daez�Z�G dbdc� dce�Z�G ddde� deez�Z�G dfdg� dge�Z�G dhdi� diez�Z�G djdk� dke�Z�G dldm� dmez�Z�G dndo� doe�Z�G dpdq� dqe�Z�G drds� dse�Z�G dtdu� duez�Z�G dvdw� dwe�Z�G dxdy� dye�Z�G dzd{� d{ez�Z�G d|d}� d}ez�Z�G d~d� de�Z�G d�d�� d�e�Z�G d�d�� d�ez�Z�G d�d�� d�ez�Z�G d�d�� d�e�Z�G d�d�� d�e�Z�G d�d�� d�ez�Z�G d�d�� d�e�Z�G d�d�� d�e�Z�G d�d�� d�ez�Z�G d�d�� d�ez�Z�G d�d�� d�e�Z�G d�d�� d�e�Z�G d�d�� d�e�Z�G d�d�� d�ez�Z�G d�d�� d�e�Z�G d�d�� d�e�Z�G d�d�� d�ez�Z�G d�d�� d�e�Z�G d�d�� d�e�Z�G d�d�� d�ez�Z�G d�d�� d�ez�Z�G d�d�� d�e�Z�G d�d�� d�e�Z�G d�d�� d�e�Z�G d�d�� d�e�Z�G d�d�� d�e�Z�G d�d�� d�e�Z�G d�d�� d�e�Z�dS )�� N)�system_session)�Command� CommandError�Option� SuperCommand)�SamDB)�dsdb)�security)� ndr_unpack�ndr_pack)�preg)� AUTH_SESSION_INFO_DEFAULT_GROUPS� AUTH_SESSION_INFO_AUTHENTICATED�#AUTH_SESSION_INFO_SIMPLE_PRIVILEGES)� netcmd_finddc)�policy)�libsmb_samba_internal)� NTSTATUSError)� dsacl2fsacl)�nbt)�Net)�GPParser�GPNoParserException�GPGeneralizeException)� GPPolParser)� GPIniParser� GPTIniParser�GPFDeploy1IniParser�GPScriptsIniParser)�GPAuditCsvParser)�GptTmplInfParser)� GPAasParser)�param)� attr_default)� get_bytes� get_string)� ConfigParser)�StringIO�BytesIO)� calc_mode�stat_from_mode)� str_regtype)� NT_STATUS_OBJECT_NAME_INVALID� NT_STATUS_OBJECT_NAME_NOT_FOUND� NT_STATUS_OBJECT_PATH_NOT_FOUND� NT_STATUS_OBJECT_NAME_COLLISION�NT_STATUS_ACCESS_DENIED)�create_directory_hier�smb_connection� get_gpo_dn)�RegistryGroupPolicies)� REG_MULTI_SZ)�register_gp_extension�list_gp_extensions�unregister_gp_extensionc C s" t j| �}|sd}n dj|�}|S )zreturn gpo flags string�NONE� )r Z get_gpo_flags�join)�value�flags�ret� r? �/usr/lib64/python3.6/gpo.py�gpo_flags_string[ s rA c C s" t j| �}|sd}n dj|�}|S )z return gplink options stringr9 r: )r Zget_gplink_optionsr; )r< �optionsr> r? r? r@ �gplink_options_stringe s rC c C s� g }| j � dkr|S | jd�}xh|D ]`}|s.q$|jd�}t|�dksT|d jd� r`td| ��|j|d dd � t|d �d �� q$W |S ) z.parse a gPLink into an array of dn and options� �]�;� r z[LDAP://zBadly formed gPLink '%s'� N� )�dnrB )�strip�split�len� startswith� RuntimeError�append�int)Zgplinkr> �a�g�dr? r? r@ � parse_gplinko s (rU c C s dj dd� | D ��}|S )z4Encode an array of dn and options into gPLink stringrD c s s" | ]}d |d |d f V qdS )z[LDAP://%s;%d]rJ rB Nr? )�.0rS r? r? r@ � <genexpr>� s z encode_gplink.<locals>.<genexpr>)r; )�gplistr> r? r? r@ � encode_gplink� s rY c C sX |dkrT|dkrLyt | |�}W n, tk rJ } ztd|��W Y dd}~X nX d| }|S )zjIf URL is not specified, return URL for writable DC. If dc is provided, use that to construct ldap URLNz Could not find a DC for domainzldap://)r � ExceptionrO )�lp�creds�url�dc�er? r? r@ �dc_url� s r` c C s� | j � }|jtj| d�� |}d}tj}|dk r>dtj|� }|dk rTdtj|� }|dk rf|}tj}y.| j|||dddd d d d d gd| gd�} W nB tk r� } z&|dk r�d| } nd} t | | ��W Y dd} ~ X nX | S )z0Get GPO information using gpo, displayname or dnzCN=Policies,CN=Systemz"(objectClass=groupPolicyContainer)Nz.(&(objectClass=groupPolicyContainer)(name=%s))z5(&(objectClass=groupPolicyContainer)(displayname=%s))�nTSecurityDescriptor� versionNumberr= �name� displayName�gPCFileSysPath�gPCMachineExtensionNames�gPCUserExtensionNamesz sd_flags:1:%d)�base�scope� expression�attrs�controlsz!Cannot get information for GPO %sz Cannot get information for GPOs) �get_default_basednZ add_child�ldb�DnZSCOPE_ONELEVEL� binary_encode� SCOPE_BASE�searchrZ r ) �samdb�gpo� displaynamerJ �sd_flagsZ policies_dnZbase_dn� search_exprZ search_scope�msgr_ Zmesgr? r? r@ � get_gpo_info� s< ry c C sR d| }y| j |dgd�}W n0 tk rL } ztd| |��W Y dd}~X nX |S )z lists dn of containers for a GPOz (&(objectClass=*)(gPLink=*%s*))�gPLink)rj rk z'Could not find container(s) with GPO %sN)rr rZ r )rs rt rw rx r_ r? r? r@ �get_gpo_containers� s r{ c C sX y | j |tjddgd�d }W n0 tk rN } ztd| |��W Y dd}~X nX d}tt| |��}d|kr�tt|d d ��}x:|D ](}|d j� |j� kr�|j |� d }P q�W ntd ��|s�td | ��tj � } || _ |r�t |�} tj | tjd�| d < n tj |d d tjd�| d < y| j| � W n. tk �rR } ztd|��W Y dd}~X nX dS )z!delete GPO link for the containerz(objectClass=*)rz )rh ri rj rk r z Container '%s' does not existNFrJ Tz"No GPO(s) linked to this containerz%GPO '%s' not linked to this containerZr0Zd0z!Error removing GPO from container)rr rn rq rZ r �strr3 rU �lower�remove�MessagerJ rY �MessageElement�FLAG_MOD_REPLACEZFLAG_MOD_DELETE�modify) rs � container_dnrt rx r_ �found�gpo_dnrX rS �m� gplink_strr? r? r@ � del_gpo_link� s8 r� c C s^ g }| j d�r$| dd� jdd�}n | j d�rB| dd� jdd�}t|�dkrZtd| ��|S ) z;Parse UNC string into a hostname, a service, and a filepathz\\rG N�\z//�/� zInvalid UNC string: %s)rN rL rM � ValueError)�uncZtmpr? r? r@ � parse_unc� s r� c C s� t jd| |d�rt� S t jd| |d�r,t� S t jd| |d�rBt� S t jd| |d�rXt� S t jd| |d�rnt� S t jd| |d�r�t� S t jd| |d�r�t� S t jd | |d�r�t� S t jd | |d�r�t � S t jd | |d�r�t � S t� S ) Nzfdeploy1\.ini$)r= z audit\.csv$z GptTmpl\.inf$z GPT\.INI$z scripts\.ini$zpsscripts\.ini$z GPE\.INI$z.*\.ini$z.*\.pol$z.*\.aas$) �re�matchr r r r r r r r r! )rc r= r? r? r@ � find_parser s* r� c C s d}t jj|�st j|� |g}|g}x�|�r|j� }|j� }| j|td�}|jdd� d� x�|D ]�} |d | d } t jj|| d �} | d t j @ r�|j | � |j | � t j| � qb| j | �} t | | d ��} | j| � W d Q R X t| d �}|j| � |j| d � qbW q(W d S ) Nz .SAMBABACKUP)�attribsc S s | d S )Nrc r? )�xr? r? r@ �<lambda>+ s z2backup_directory_remote_to_local.<locals>.<lambda>)�keyr� rc �attrib�wbz.xml)�os�path�isdir�mkdir�pop�list� attr_flags�sortr; �libsmb�FILE_ATTRIBUTE_DIRECTORYrP �loadfile�open�writer� �parseZ write_xml)�conn� remotedir�localdir�SUFFIX�r_dirs�l_dirs�r_dir�l_dir�dirlistr_ �r_name�l_name�data�f�parserr? r? r@ � backup_directory_remote_to_local s. r� c C s� t jj|�st j|� |g}|g}x�|r�|j� }|j� }| j|td�}|jdd� d� xv|D ]n}|d |d } t jj||d �} |d t j @ r�|j | � |j | � t j| � q\| j | �} t | d�j| � q\W q$W d S ) N)r� c S s | d S )Nrc r? )r� r? r? r@ r� N s z0copy_directory_remote_to_local.<locals>.<lambda>)r� r� rc r� r� )r� r� r� r� r� r� r� r� r; r� r� rP r� r� r� ) r� r� r� r� r� r� r� r� r_ r� r� r� r? r? r@ � copy_directory_remote_to_localD s$ r� Fc C s | j |�s| j|� |g}|g}x�|�r|j� }|j� }tj|�} | j� x�| D ]�} tjj|| �} |d | } tjj| �r�|j | � |j | � y| j| � W n t k r� |s�� Y nX qP|r�y| j | � wPW n t k r� Y nX t | d�j � } | j| | � qPW q"W d S )Nr� �rb)Zchkpathr� r� r� �listdirr� r� r; r� rP r r� r� �read�savefile)r� r� r� �ignore_existing_dir�keep_existing_filesr� r� r� r� r� r_ r� r� r� r? r? r@ � copy_directory_local_to_remote\ s8 r� c @ s e Zd Zdd� Zdd� ZdS )� GPOCommandc C s� |dkr"t j� }td| | jd� tjj|�s:td| ��tjj|d�}tjj|�s^tj |� tjj||�}tjj|�r�td| ��ytj |� W n0 t t fk r� } ztd|��W Y dd}~X nX ||fS )a� Ensure that the temporary directory structure used in fetch, backup, create, and restore is consistent. If --tmpdir is used the named directory must be present, which may contain a 'policy' subdirectory, but 'policy' must not itself have a subdirectory with the gpo name. The policy and gpo directories will be created. If --tmpdir is not used, a temporary directory is securely created. Nz5Using temporary directory %s (use --tmpdir to change))�filez'Temporary directory '%s' does not existr z8GPO directory '%s' already exists, refusing to overwritez%Error creating teporary GPO directory) �tempfileZmkdtemp�print�outfr� r� r� r r; r� �IOError�OSError)�self�tmpdirrt r� �gpodirr_ r? r? r@ �construct_tmpdir� s$ zGPOCommand.construct_tmpdirc C sV y t | jt� | j| jd�| _W n2 tk rP } ztd| j |��W Y dd}~X nX dS )z$make a ldap connection to the server)r] � session_info� credentialsr[ z LDAP connection to %s failed N)r r] r r\ r[ rs rZ r )r� r_ r? r? r@ � samdb_connect� s zGPOCommand.samdb_connectN)�__name__� __module__� __qualname__r� r� r? r? r? r@ r� � s #r� c @ sF e Zd ZdZdZejejejd�Z e ddde ddd �gZ d d d �Z d S )� cmd_listallzList all GPOs.z%prog [options])� sambaopts� versionopts�credoptsz-Hz--URLz%LDB URL for database or target server�URL�H)�help�type�metavar�destNc C s� |j � | _|j| jdd�| _t| j| j|�| _| j� t| jd �}x�|D ]�}| j j d|d d � | j j d|d d � | j j d|d d � | j j d |j � | j j d t |d d � � | j j dt tt |dd��� � | j j d� qHW d S )NT)�fallback_machinezGPO : %s rc r zdisplay name : %s rd zpath : %s re zdn : %s zversion : %s rb �0zflags : %s r= � )� get_loadparmr[ �get_credentialsr\ r` r] r� ry rs r� r� rJ r# rA rQ )r� r� r� r� r� rx r� r? r? r@ �run� s zcmd_listall.run)NNNN)r� r� r� �__doc__�synopsisrB � SambaOptions�VersionOptions�CredentialsOptions�takes_optiongroupsr r| � takes_optionsr� r? r? r? r@ r� � s r� c @ sL e Zd ZdZdZdgZejejej d�Z e ddde dd d �gZ dd d �Zd S )�cmd_listzList GPOs for an account.z&%prog <username|machinename> [options]� accountname)r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� Nc & C s� |j � | _|j| jdd�| _t| j| j|�| _| j� y0| jjdt j |�t j |�f d�}|d j }W n t k r� t d| ��Y nX y*| jj|t jdgd�d }d |d k}W n t k r� t d | ��Y nX ttB } | jd k r�| jjd �r�| tO } tjj| j| j|| d �} | j} g } d} t j| jt|��j� }�x| jj|t jd dgd�d }d |k�r�tt|d d ��}�x�|D �]z}| �r�|d tj @ �r��q||d tj @ �r��q|yZt j t j B t j!B }| jj|d t jddddgd| gd�}|d d d }t"t j#|�}W n. t k �r< | j$j%d|d � �w|Y nX y"tj j&|| t j't j(B t j)B � W n, t*k �r� | j$j%d|j � �w|Y nX t+t,|d dd��}|�r�|tj-@ �r��q|| �r�|tj.@ �rАq|| j/|d d d |d d d f� �q|W t+t,|dd��}|tj0@ �r d} || jj1� k�r.P |j� }�q:W |�rHd }nd}| j$j%d||f � x*| D ]"}| j$j%d |d |d f � �qfW d S ) NT)r� z?(&(|(samAccountName=%s)(samAccountName=%s$))(objectClass=User)))rj r zFailed to find account %s� objectClass)rh ri rk Zcomputerz!Failed to find objectClass for %sZldap)Zlp_ctxrJ �session_info_flagsrz � gPOptionsrB rJ rc rd r= ra z sd_flags:1:%d)rh ri rk rl z8Failed to fetch gpo object with nTSecurityDescriptor %s zFailed access check on %s F�userzGPOs for %s %s z %s %s rI )2r� r[ r� r\ r` r] r� rs rr rn rp rJ rZ r rq r r rN r �sambaZauthZ user_sessionZsecurity_tokenro r| �parentrU r �GPLINK_OPT_ENFORCE�GPLINK_OPT_DISABLEr � SECINFO_OWNER� SECINFO_GROUP� SECINFO_DACLr � descriptorr� r� Z access_checkZSEC_STD_READ_CONTROLZ SEC_ADS_LISTZSEC_ADS_READ_PROPrO rQ r# ZGPO_FLAG_MACHINE_DISABLEZGPO_FLAG_USER_DISABLErP �GPO_BLOCK_INHERITANCErm )r� r� r� r� r� r� rx Zuser_dnZ is_computerr� Zsession�tokenZgpos�inheritrJ ZglistrS rv Zgmsg� secdesc_ndr�secdescr= Z gpoptionsZmsg_strr? r? r@ r� � s� , z cmd_list.run)NNNN)r� r� r� r� r� � takes_argsrB r� r� r� r� r r| r� r� r? r? r? r@ r� � s r� c @ sF e Zd ZdZdZejejejd�Z dgZ e dde d�gZ d d d �ZdS ) �cmd_showzShow information for a GPO.z%prog <gpo> [options])r� r� r� rt z-Hz%LDB URL for database or target server)r� r� Nc # C sh |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _| j� yt | j |�d }W n t k r� t d| ��Y nX y$|d d }t tj|�} | j� } W n t k r� d } Y nX | jjd |d d � | jjd |d d � | jjd|d d � d|k�rF| jjd|d d � d|k�rh| jjd|d d � | jjd|j � | jjdt|dd� � | jjdttt|dd��� � | jjd| � t|d| j| jd �} | jjd �} d j| j� d |d g�} g }�x:d0D �]0}yt tj | j | | ��}W nX t k �r| } z:|j d t t!t"gk�rR�w|j d t#k�rjt d#��� W Y d d }~X nX x�|j$D ]�}|j%d$k�r��q�i }|j&|d%< |j%|d&< ||d'< t'|j(�|d(< |j)|d)< t(|d) �t*k�r$|j(t+k�r|d) j,d*�}|j-d+�j.d+�|d)< nt/|d) �|d)< |j0|� �q�W �qW | jjd,� t1j2|| jd-d.� | jjd/� d S )1NT)r� zldap://� )r^ r zGPO '%s' does not existra z<hidden>zGPO : %s rc zdisplay name : %s rd zpath : %s re rf zMachine Exts : %s rg zUser Exts : %s zdn : %s zversion : %s rb r� zflags : %s r= zACL : %s �sysvol)r[ r\ �realmr� �Policiesz%s\Registry.pol�MACHINE�USERz:The authenticated user does not have sufficient privilegesz **delvals.�keyname� valuename�classr� r� z utf-16-le� zPolicies : � )�indentr� )r� r� )3r� r[ r� r\ rN r] r r` r� ry rs rZ r r r r� �as_sddlr� r� rJ r# rA rQ r2 �getr; r} r r� r� r �argsr, r- r. r0 �entriesr r r+ r� r� �bytesr5 �decode�rstriprL r� rP �json�dump)r� rt r� r� r� r� � dc_hostnamerx r� r� Z secdesc_sddlr� r� �pol_file� policy_defsZ policy_class�pol_datar_ �entryZdefsr� r? r? r@ r� Z s� z cmd_show.run)NNNN)r� r� r� r� r� rB r� r� r� r� r� r r| r� r� r? r? r? r@ r� I s r� c @ s� e Zd ZdZdZejejejd�Z dgZ e dde d�e dd e d�e d d d d gdd�e dd dd gdd�e ddddd�gZ ddd�ZdS ) �cmd_loada� Load policies onto a GPO. Reads json from standard input until EOF, unless a json formatted file is provided via --content. Example json_input: [ { "keyname": "Software\Policies\Mozilla\Firefox\Homepage", "valuename": "StartPage", "class": "USER", "type": "REG_SZ", "data": "homepage" }, { "keyname": "Software\Policies\Mozilla\Firefox\Homepage", "valuename": "URL", "class": "USER", "type": "REG_SZ", "data": "google.com" }, { "keyname": "Software\Microsoft\Internet Explorer\Toolbar", "valuename": "IEToolbar", "class": "USER", "type": "REG_BINARY", "data": [0] }, { "keyname": "Software\Policies\Microsoft\InputPersonalization", "valuename": "RestrictImplicitTextCollection", "class": "USER", "type": "REG_DWORD", "data": 1 } ] Valid class attributes: MACHINE|USER|BOTH Data arrays are interpreted as bytes. The --machine-ext-name and --user-ext-name options are multi-value inputs which respectively set the gPCMachineExtensionNames and gPCUserExtensionNames ldap attributes on the GPO. These attributes must be set to the correct GUID names for Windows Group Policy to work correctly. These GUIDs represent the client side extensions to apply on the machine. Linux Group Policy does not enforce this constraint. {35378EAC-683F-11D2-A89A-00C04FBBCFA2} is provided by default, which enables most Registry policies. z%prog <gpo> [options])r� r� r� rt z-Hz%LDB URL for database or target server)r� r� z --contentzJSON file of policy inputsz--machine-ext-namerP � machine_extsz&{35378EAC-683F-11D2-A89A-00C04FBBCFA2}z;A machine extension name to add to gPCMachineExtensionNames)�actionr� �defaultr� z--user-ext-name� user_extsz5A user extension name to add to gPCUserExtensionNamesz --replace� store_trueFz8Replace the existing Group Policies, rather than merging)r r r� Nc C sP |d krdg}|d kr dg}|d kr6t jtjj� �} n6tjj|�rdt|d��} t j | �} W d Q R X nt d��|j � | _ |j | j dd�| _t| j | j|�| _| j� t|| j | j| j|�} x|D ]} | j| d� q�W x|D ]} | j| d� q�W y |r�| j| � n | j| � W n@ tk �rJ } z"|jd tk�r8t d ��n� W Y d d }~X nX d S ) Nz&{35378EAC-683F-11D2-A89A-00C04FBBCFA2}r� z$The JSON content file does not existT)r� rf rg r z:The authenticated user does not have sufficient privileges)r �loads�sys�stdinr� r� r� �existsr� �loadr r� r[ r� r\ r` r] r� r4 rs Zregister_extension_nameZ replace_sZmerge_sr r r0 )r� rt r� �contentr r �replacer� r� r� r �r�reg�ext_namer_ r? r? r@ r� � s6 z cmd_load.run)NNNNFNNN)r� r� r� r� r� rB r� r� r� r� r� r r| r� r� r? r? r? r@ r � s, 1 r c @ sr e Zd ZdZdZejejejd�Z dgZ e dde d�e dd e d�e d d g d d d�e dd g ddd�gZ ddd�ZdS )� cmd_removeag Remove policies from a GPO. Reads json from standard input until EOF, unless a json formatted file is provided via --content. Example json_input: [ { "keyname": "Software\Policies\Mozilla\Firefox\Homepage", "valuename": "StartPage", "class": "USER", }, { "keyname": "Software\Policies\Mozilla\Firefox\Homepage", "valuename": "URL", "class": "USER", }, { "keyname": "Software\Microsoft\Internet Explorer\Toolbar", "valuename": "IEToolbar", "class": "USER" }, { "keyname": "Software\Policies\Microsoft\InputPersonalization", "valuename": "RestrictImplicitTextCollection", "class": "USER" } ] Valid class attributes: MACHINE|USER|BOTH z%prog <gpo> [options])r� r� r� rt z-Hz%LDB URL for database or target server)r� r� z --contentzJSON file of policy inputsz--machine-ext-namerP r z@A machine extension name to remove from gPCMachineExtensionNames)r r r� r� z--user-ext-namer z:A user extension name to remove from gPCUserExtensionNamesNc C s< |d kr g }|d krg }|d kr2t jtjj� �} n6tjj|�r`t|d��} t j | �} W d Q R X nt d��|j � | _ |j | j dd�| _t| j | j|�| _| j� t|| j | j| j|�} x|D ]} | j| d� q�W x|D ]} | j| d� q�W y| j| � W n@ tk �r6 } z"| jd tk�r$t d��n� W Y d d } ~ X nX d S ) Nr� z$The JSON content file does not existT)r� rf rg r z:The authenticated user does not have sufficient privileges)r r r r r� r� r� r r� r r r� r[ r� r\ r` r] r� r4 rs Zunregister_extension_nameZremove_sr r r0 )r� rt r� r r r r� r� r� r r! r" r# r_ r? r? r@ r� W s2 zcmd_remove.run)NNNNNNN)r� r� r� r� r� rB r� r� r� r� r� r r| r� r� r? r? r? r@ r$ ! s r$ c @ sF e Zd ZdZdZejejejd�Z dgZ e dde d�gZ d d d �ZdS ) � cmd_getlinkz List GPO Links for a container.z %prog <container_dn> [options])r� r� r� r� z-Hz%LDB URL for database or target server)r� r� Nc C s@ |j � | _|j| jdd�| _t| j| j|�| _| j� y | jj|t j ddgd�d }W n t k rv t d| ��Y nX d|ko�|d �r,| j jd| � tt|d d ��}x�|D ]r}t| j|d d �}| j jd |d d d � | j jd |d d d � | j jdt|d � � | j jd� q�W n| j jd| � d S )NT)r� z(objectClass=*)rz )rh ri rj rk r z Container '%s' does not existzGPO(s) linked to DN %s rJ )rJ z GPO : %s rc z Name : %s rd z Options : %s rB r� zNo GPO(s) linked to DN=%s )r� r[ r� r\ r` r] r� rs rr rn rq rZ r r� r� rU r| ry rC ) r� r� r� r� r� r� rx rX rS r? r? r@ r� � s( zcmd_getlink.run)NNNN)r� r� r� r� r� rB r� r� r� r� r� r r| r� r� r? r? r? r@ r% x s r% c @ sh e Zd ZdZdZejejejd�Z ddgZ e dde d�e d d d d d d�e ddd d dd�gZ ddd�ZdS )� cmd_setlinkz(Add or update a GPO link to a container.z$%prog <container_dn> <gpo> [options])r� r� r� r� rt z-Hz%LDB URL for database or target server)r� r� z --disable�disabledFr zDisable policy)r� r r r� z --enforce�enforcedzEnforce policyNc $ C s. |j � | _|j| jdd�| _t| j| j|�| _| j� d} |rH| tjO } |rV| tj O } yt | j |d�d W n t k r� t d| ��Y nX tt| j |��} y | j j|tjddgd�d } W n t k r� t d | ��Y nX d } d| k�rftt| d d ��} d} d }x2| D ]*}|d j� | j� k�r| |d < d}P �qW |�rRt d | ��n| jd| | d�� ng } | j| | d�� t| �}tj� }tj| j |�|_| �r�tj|tj d�|d< ntj|tj d�|d< y| j j |� W n. t k �r } zt d|��W Y d d }~X nX | j j d� t!� j"|||||� d S )NT)r� r )rt zGPO '%s' does not existz(objectClass=*)rz )rh ri rj rk z Container '%s' does not existFrJ rB z)GPO '%s' already linked to this container)rJ rB � new_valuezError adding GPO LinkzAdded/Updated GPO link )#r� r[ r� r\ r` r] r� r r� r� ry rs rZ r r| r3 rr rn rq rU r} �insertrP rY r ro rJ r� r� � FLAG_MOD_ADDr� r� r� r% r� )r� r� rt r� r' r( r� r� r� Zgplink_optionsr� rx Zexisting_gplinkrX r� rS r� r� r_ r? r? r@ r� � s^ zcmd_setlink.run)NFFNNN)r� r� r� r� r� rB r� r� r� r� r� r r| r� r� r? r? r? r@ r& � s r& c @ sH e Zd ZdZdZejejejd�Z ddgZ e dde d�gZ d d d �Zd S ) � cmd_dellinkz!Delete GPO link from a container.z$%prog <container_dn> <gpo> [options])r� r� r� � containerrt z-Hz%LDB URL for database or target server)r� r� Nc C s� |j � | _|j| jdd�| _t| j| j|�| _| j� yt| j|d�d W n t k rl t d| ��Y nX t j | j|�}t | j||� | jjd� t� j|||||� d S )NT)r� )rt r zGPO '%s' does not existzDeleted GPO link. )r� r[ r� r\ r` r] r� ry rs rZ r rn ro r� r� r� r% r� )r� r- rt r� r� r� r� r� r? r? r@ r� s zcmd_dellink.run)NNNN)r� r� r� r� r� rB r� r� r� r� r� r r| r� r� r? r? r? r@ r, s r, c @ sF e Zd ZdZdZejejejd�Z dgZ e dde d�gZ d d d �ZdS ) �cmd_listcontainersz%List all linked containers for a GPO.z%prog <gpo> [options])r� r� r� rt z-Hz%LDB URL for database or target server)r� r� Nc C s� |j � | _|j| jdd�| _t| j| j|�| _| j� t| j|�}t |�r~| j j d| � x2|D ]}| j j d|d � q`W n| j j d| � d S )NT)r� zContainer(s) using GPO %s z DN: %s rJ zNo Containers using GPO %s ) r� r[ r� r\ r` r] r� r{ rs rM r� r� )r� rt r� r� r� r� rx r� r? r? r@ r� 9 s zcmd_listcontainers.run)NNNN)r� r� r� r� r� rB r� r� r� r� r� r r| r� r� r? r? r? r@ r. ( s r. c @ sF e Zd ZdZdZejejejd�Z dgZ e dde d�gZ d d d �ZdS ) �cmd_getinheritancez%Get inheritance flag for a container.z %prog <container_dn> [options])r� r� r� r� z-Hz%LDB URL for database or target server)r� r� Nc C s� |j � | _|j| jdd�| _t| j| j|�| _| j� y | jj|t j ddgd�d }W n t k rv t d| ��Y nX d}d|kr�t |d d �}|tjkr�| jjd� n | jjd � d S ) NT)r� z(objectClass=*)r� )rh ri rj rk r z Container '%s' does not existz$Container has GPO_BLOCK_INHERITANCE zContainer has GPO_INHERIT )r� r[ r� r\ r` r] r� rs rr rn rq rZ r rQ r r� r� r� )r� r� r� r� r� r� rx � inheritancer? r? r@ r� ] s zcmd_getinheritance.run)NNNN)r� r� r� r� r� rB r� r� r� r� r� r r| r� r� r? r? r? r@ r/ L s r/ c @ sH e Zd ZdZdZejejejd�Z ddgZ e dde d�gZ d d d �Zd S ) �cmd_setinheritancez$Set inheritance flag on a container.z.%prog <container_dn> <block|inherit> [options])r� r� r� r� � inherit_statez-Hz%LDB URL for database or target server)r� r� Nc C sF |j � dkrtj}n |j � dkr(tj}n td| ��|j� | _|j| jdd�| _t | j| j|�| _ | j � y | j j |tjddgd�d }W n tk r� td | ��Y nX tj� } tj| j |�| _d|kr�tjt|�tjd�| d < ntjt|�tjd�| d < y| j j| � W n2 tk �r@ } ztd | | ��W Y d d } ~ X nX d S ) N�blockr� z Unknown inheritance state (%s)T)r� z(objectClass=*)r� )rh ri rj rk r z Container '%s' does not existr) z"Error setting inheritance state %s)r} r r� Z GPO_INHERITr r� r[ r� r\ r` r] r� rs rr rn rq rZ r ro rJ r� r| r� r+ r� ) r� r� r2 r� r� r� r� r0 rx r� r_ r? r? r@ r� � s0 zcmd_setinheritance.run)NNNN)r� r� r� r� r� rB r� r� r� r� r� r r| r� r� r? r? r? r@ r1 x s r1 c @ sR e Zd ZdZdZejejejd�Z dgZ e dde d�e dd e d�gZ d d d �Zd S )� cmd_fetchzDownload a GPO.z%prog <gpo> [options])r� r� r� rt z-Hz%LDB URL for database or target server)r� r� z--tmpdirz,Temporary directory for copying policy filesNc ! C sZ |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _| j� yt | j |�d }W n t k r� t d| ��Y nX t |d d �} yt| �\} } } W n tk r� t d | ��Y nX t|| | j| jd �} | j||�\}}yt| | |� W n. t k �rD } zt d |��W Y d d }~X nX | jjd | � d S ) NT)r� zldap://r� )r^ r zGPO '%s' does not existre zInvalid GPO path (%s))r[ r\ zError copying GPO from DCzGPO copied to %s )r� r[ r� r\ rN r] r r` r� ry rs rZ r r| r� r� r2 r� r� r� r� )r� rt r� r� r� r� r� r rx r� �dom_name�service� sharepathr� r� r_ r? r? r@ r� � s2 z cmd_fetch.run)NNNNN)r� r� r� r� r� rB r� r� r� r� r� r r| r� r� r? r? r? r@ r4 � s r4 c @ sz e Zd ZdZdZejejejd�Z dgZ e dde d�e dd e d�e d d d d d�e ddde d�gZ ddd�Zedd� �ZdS )� cmd_backupz Backup a GPO.z%prog <gpo> [options])r� r� r� rt z-Hz%LDB URL for database or target server)r� r� z--tmpdirz,Temporary directory for copying policy filesz --generalizez"Generalize XML entities to restoreFr )r� r r z --entitiesz4File to export defining XML entities for the restore�ent_file)r� r� r� Nc 0 C sJ |j � | _|j| jdd�| _|r>|jd�r>|dd � } || _n"t| j| j�} t| j| j| d�| _| j� yt | j |�d } W n t k r� t d| ��Y nX t | d d �} yt| �\} } }W n tk r� t d | ��Y nX t| | | j| jd �}| j||�\}}yt|||� W n. t k �rD } zt d |��W Y d d }~X nX | jjd | � |�r�| jjd � tj| j||�}dd l}djdd� t|j� |jd�d�D ��}|�r�t |d��}|j|� W d Q R X | jjd| � n| jjd� | jj|� xNdD ]F}|| k�r�t t j j||d �d��}|j| | d � W d Q R X �q�W d S )NT)r� zldap://r� )r^ r zGPO '%s' does not existre zInvalid GPO path (%s))r[ r\ zError copying GPO from DCzGPO copied to %s z( Attempting to generalize XML entities: rD c s s( | ] }d j |d jd�|d �V qdS )z<!ENTITY {} "{} ">rI z&;r N)�formatrK )rV Zentr? r? r@ rW . s z!cmd_backup.run.<locals>.<genexpr>rI )r� �wz$Entities successfully written to %s z Entities: rf rg z .SAMBAEXTr� )rf rg ) r� r[ r� r\ rN r] r r` r� ry rs rZ r r| r� r� r2 r� r� r� r� r8 �generalize_xml_entities�operatorr; �sorted�items� itemgetterr� r� r� )r� rt r� r� Z generalizer� r� r� r9 r rx r� r5 r6 r7 r� r� r_ �entitiesr= Zentsr� �extr? r? r@ r� � sV zcmd_backup.runc C sd i }t jj|�st j|� |g}|g}�x6|�r^|j� }|j� }t j|�}|j� �x|D � ]�} t jj|| �} t jj|| �} t jj| �r�|j | � |j | � t jj| �s�t j| � qZ| j d��r>t jj | �d d� } t | �} y:t | d��}|j� }W d Q R X tj|�}| j|| |�}W n$ tk �r: | jd| � Y nX qZt jj| | �sZtj| | � qZW q*W |S )Nz.xmlr r! z%SKIPPING: Generalizing failed for %s ���)r� r� r r� r� r� r� r; r� rP �endswith�basenamer� r� r� �ET� fromstringZgeneralize_xmlr r� �samefile�shutil�copy2)r� � sourcedir� targetdirrA r� r� r� r� r� r_ r� r� �to_parser� �ltempr� Z concrete_xmlZfound_entitiesr? r? r@ r< @ s> z"cmd_backup.generalize_xml_entities)NNFNNNN)r� r� r� r� r� rB r� r� r� r� r� r r| r� r� � staticmethodr< r? r? r? r@ r8 � s @r8 c @ sR e Zd ZdZdZejejejd�Z dgZ e dde d�e dd e d�gZ d d d �Zd S )� cmd_createzCreate an empty GPO.z %prog <displayname> [options])r� r� r� ru z-Hz%LDB URL for database or target server)r� r� z--tmpdirz,Temporary directory for copying policy filesNc ! C s" |j � | _|j| jdd�| _t| j| jd�}|rn|jd�rn|dd � }|| _tjtj B tj B } |j || d�} nBtjtj B tj B } |j | jj d�| d�} | j }t| j| j|d �| _| j� t| j|d �} | jd kr�td | ��ttj� �} d | j� } | | _| j}d||| f }| j|| �\| _}|| _ yJt j t j j |d�� t j t j j |d�� d}t!t j j |d�d�j"|� W n. t#k �r� } ztd|��W Y d d }~X nX t$|�\}}}|| _%t&||| j| jd�}|| _'| jj(� �y�t)| j| �}t*j+� }||_,t*j-dt*j.d�|d< | jj/|� t*j+� }t*j0| jdt|� �|_,t*j-dt*j.d�|d< | jj/|� t*j+� }t*j0| jdt|� �|_,t*j-dt*j.d�|d< | jj/|� t1j2t1j3B t1j4B }t| j| |d �d } | d d }t5t1j6|�j7� }t1j8| jj9� �} t:|| �} t1j6j;| | �} t<||� t1j2t1j3B t1j4B t1j=B } |j>|| | � t?|||� t*j+� }||_,t*j-|t*j@d �|d < t*j-|t*j@d �|d!< t*j-d"t*j@d#�|d$< t*j-d%t*j@d&�|d'< t*j-d"t*j@d(�|d)< d*g} | jjA|| d+� W n" t#k �r� | jjB� � Y n X | jjC� |d k�r tDjE| j� | jFj"d,|| f � d S )-NT)r� )r\ r[ zldap://r� )Zaddressr= r� )�domainr= )r^ )ru r z%A GPO already existing with name '%s'z{%s}z\\%s\sysvol\%s\Policies\%sZMachineZUserz[General] Version=0 zGPT.INIr; zError Creating GPO files)r[ r\ ZgroupPolicyContainerr� Za01z CN=User,%sr- z CN=Machine,%s)rt rv ra rd Za02re Za03r� rb Za05�2ZgpcFunctionalityVersionZa07r= Za04zpermissive_modify:0)rl zGPO '%s' created as %s )Gr� r[ r� r\ r rN r] r ZNBT_SERVER_LDAPZ NBT_SERVER_DSZNBT_SERVER_WRITABLEZfinddcr Z pdc_dns_namer` r� ry rs �countr r| �uuid�uuid4�upper�gpo_nameZ dns_domainr� r� r� r� r� r� r; r� r� rZ r� r7 r2 r� �transaction_startr3 rn r rJ r� r+ �addro r r� r� r� r r� r �dom_sid�get_domain_sidr Z from_sddlr1 ZSECINFO_PROTECTED_DACLZset_aclr� r� r� �transaction_cancel�transaction_commitrI Zrmtreer� )!r� ru r� r� r� r� r� Znetr r= Z cldap_retrx �guidrt r� �unc_pathr� Z gpt_contentsr_ r5 r6 r7 r� r� r� Z ds_sd_flags� ds_sd_ndr�ds_sd� domain_sidZsddl�fs_sdZsiorl r? r? r@ r� � s� zcmd_create.run)NNNNN)r� r� r� r� r� rB r� r� r� r� r� r r| r� r� r? r? r? r@ rP u s rP c s� e Zd ZdZdZejejejd�Z ddgZ e dde d�e d d e d�e d d e d�e d dddd�gZ ddd�Zd� fdd� Z� ZS )� cmd_restorez!Restore a GPO to a new container.z/%prog <displayname> <backup location> [options])r� r� r� ru �backupz-Hz%LDB URL for database or target server)r� r� z--tmpdirz,Temporary directory for copying policy filesz --entitiesz8File defining XML entities to insert into DOCTYPE headerz--restore-metadataz7Keep the old GPT.INI file and associated version numberFr )r� r r rD c C s d}t jj|�st j|� |g}|g}�x�|�r|j� }|j� }t j|�} | j� �x�| D �]�} t jj|| �} t jj|| �} t jj| �r�|j | � |j | � t jj| �s�t j| � qZ| j d�rZt jj | �d d � } t | �}y�t | d��n}|j� }d}|j|��r*|t|�d � }|jtj|| | �� n|jtj|| �� |j| d d � � W d Q R X W qZ tk �r� | d d � | }tj|| d d � � | jjd| � | jjd� Y qZ dd l}|j� | d d� | }tj|| d d� � | jjd | � | jjd� Y qZX qZW q*W d S )Nz .SAMBABACKUPz.xmlr r! z&<?xml version="1.0" encoding="utf-8"?>z WARNING: No such parser for %s z.WARNING: Falling back to simple copy-restore. r z%WARNING: Error during parsing for %s rC rC rC rC rC rC ) r� r� r r� r� r� r� r; r� rP rD rE r� r� r� rN rM Zload_xmlrF rG Z write_binaryr rI rJ r� r� � traceback� print_exc)r� rK rL � dtd_headerr� r� r� r� r� r� r_ r� r� rM r� rN r� Zxml_headZ original_filerf r? r? r@ � restore_from_backup_to_local_dir sT z,cmd_restore.restore_from_backup_to_local_dirNc s� d} t jj|�s td| ��|d k r�d} t jj|�s@td| ��t|d��8} | j� } tjd| tjd�d krrtd��| | j � 7 } W d Q R X | d 7 } t t | �j ||||||� y�| j || j| � | } t| j| j| jd | d � t| j| j�}xvdD ]n}t jj||d �}t jj|�r�t|d��}|j� }W d Q R X tj� }||_tj|tj|�||< | jj|� q�W W nz t k �r� } z\dd l }|j � | j j t!|�d � | j j d� t"� }|j | j||||� td| ��W Y d d }~X nX d S )NrD z"Backup directory does not exist %sz<!DOCTYPE foobar [ z Entities file does not exist %sr! z*(\s*<!ENTITY\s*[a-zA-Z0-9_]+\s*.*?>)+\s*\Z)r= zPEntities file does not appear to conform to format e.g. <!ENTITY entity "value">z ]> T)r� r� rf rg z .SAMBAEXTr� r r� z%Failed to restore GPO -- deleting... zFailed to restore: %s)rf rg )#r� r� r r r� r� r� r� � MULTILINErK �superrd r� ri r� r� r� r7 r3 rs rW r; rn r rJ r� r� r� rZ rf rg r� r� r| �cmd_del)r� ru re r� r� rA r� r� r� Zrestore_metadatarh Z entities_fileZentities_contentZkeep_new_filesr� rB Zext_filer� r� r� r_ rf �cmd)� __class__r? r@ r� a sX zcmd_restore.run)rD )NNNNNNN)r� r� r� r� r� rB r� r� r� r� r� r r| r� ri r� � __classcell__r? r? )rn r@ rd s D rd c @ sF e Zd ZdZdZejejejd�Z dgZ e dde d�gZ d d d �ZdS ) rl z Delete a GPO.z%prog <gpo> [options])r� r� r� rt z-Hz%LDB URL for database or target server)r� r� Nc C s� |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _| j� y&t | j |d�d }t |d d �}W n t k r� t d | ��Y nX t|�\} } } t|| | j| jd �} | j j� y�t| j |�}t|��r:| jjd | � x4|D ],} t| j | d |� | jjd | d � �q W t| j |�}| j jtj| j dt |� �� | j jtj| j dt |� �� | j j|� | j| � W n" t k �r� | j j� � Y n X | j j � | jjd| � d S )NT)r� zldap://r� )r^ )rt r re zGPO '%s' does not exist)r[ r\ z GPO %s is linked to containers rJ z Removed link from %s. z CN=User,%sz CN=Machine,%szGPO %s deleted. ) r� r[ r� r\ rN r] r r` r� ry rs r| rZ r r� r2 rX r{ rM r� r� r� r3 �deletern ro Zdeltreer\ r] )r� rt r� r� r� r� r rx r_ r5 r6 r7 r� r� r� r? r? r@ r� � sD z cmd_del.run)NNNN)r� r� r� r� r� rB r� r� r� r� r� r r| r� r� r? r? r? r@ rl � s rl c @ sF e Zd ZdZdZejejejd�Z e ddde ddd �gZ d d d �Z d S )� cmd_aclcheckz.Check all GPOs have matching LDAP and DS ACLs.z%prog [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� Nc C s| |j � | _|j| jdd�| _t| j| j|�| _|rP|jd�rP|dd � }|| _n"t| j| j�}t| j| j|d�| _| j� t | j d �}x�|D ]�}t |d d �}yt |�\} } } W n t k r� td| ��Y nX t|| | j| jd �} | j| tjtjB tjB tj�} d |k�rtd ��|d d }ttj|�j� }tj| j j� �}t||�}| j|�|kr�td | j|�| |f ��q�W d S ) NT)r� zldap://r� )r^ re r zInvalid GPO path (%s))r[ r\ ra zKCould not read nTSecurityDescriptor. This requires an Administrator accountz-Invalid GPO ACL %s on path (%s), should be %s) r� r[ r� r\ r` r] rN r r� ry rs r| r� r� r r2 Zget_aclr r� r� r� ZSEC_FLAG_MAXIMUM_ALLOWEDr r� r rZ r[ r )r� r� r� r� r� r rx r� r� r5 r6 r7 r� rc r` ra rb Zexpected_fs_sddlr? r? r@ r� s6 zcmd_aclcheck.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r? r? r? r@ rq � s rq c @ sb e Zd ZdZdZejejejd�Z e ddde ddd �e d d e e j jej� d �d �gZddd�ZdS )� cmd_admxloadz Loads samba admx files to sysvolz%prog [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� z --admx-dirz)Directory where admx templates are storedz samba/admx)r� r� r Nc 5 C s2 |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�}dj | jj d �j � d d g�}y|j |� W nJ t k r� } z.| jd tkr�td ��n| jd tkr W Y d d } ~ X nX �x4tj|�D �]$\} } } �x| D �] } | j|d�}tjj | | �}dj ||g�jdd�}dj || g�}yt||� W nP t k �r� } z2| jd tk�r�td ��n| jd tk�r�� W Y d d } ~ X nX t|d��X}y|j||j� � W n< t k �r } z | jd tk�r�td ��W Y d d } ~ X nX W d Q R X �q W q�W | jjd� d S )NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� ZPolicyDefinitionsr z:The authenticated user does not have sufficient privilegesrD r� r� a Installing ADMX templates to the Central Store prevents Windows from displaying its own templates in the Group Policy Management Console. You will need to install these templates from https://www.microsoft.com/en-us/download/102157 to continue using Windows Administrative Templates. ) r� r[ r� r\ rN r] r r` r2 r; r r} r� r r r0 r r/ r� �walkr r� r1 r� r� r� r� r� )r� r� r� r� r� Zadmx_dirr r� Zsmb_dirr_ �dirname�dirs�filesZfnameZ path_in_admx� full_pathZsub_dirZsmb_pathr� r? r? r@ r� F sP .zcmd_admxload.run)NNNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r; r" Zdata_dirr� r� r? r? r? r@ rr 4 s rr c @ sb e Zd ZdZdZejejejd�Z e ddde ddd �e d d d d d�gZ dddddgZ ddd�ZdS )�cmd_add_sudoersa� Adds a Samba Sudoers Group Policy to the sysvol This command adds a sudo rule to the sysvol for applying to winbind clients. The command argument indicates the final field in the sudo rule. The user argument indicates the user specified in the parentheses. The users and groups arguments are comma separated lists, which are combined to form the first field in the sudo rule. The --passwd argument specifies whether the sudo entry will require a password be specified. The default is False, meaning the NOPASSWD field will be specified in the sudo entry. Example: samba-tool gpo manage sudoers add {31B2F340-016D-11D2-945F-00C04FB984F9} ALL ALL fakeu fakeg The example command will generate the following sudoers entry: fakeu,fakeg% ALL=(ALL) NOPASSWD: ALL z7%prog <gpo> <command> <user> <users> [groups] [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� z--passwdr Fz;Specify to indicate that sudo entry must provide a password)r r r� rt �commandr� �userszgroups?Nc " C s |j � | _| j| jdd�| _|r>|jd�r>|dd � } || _n"t| j| j�} t| j| j| d�| _t| d| j| jd�} | j � t || j| j| j |�} | jj d�}d j |j� d |d d g�}d j |d g�}y2tjtj| j|���}|j� jd�}|jd�}W n� tk �r� } z�|jd tttgk�r�tjtjd��}tj|j� d�}tj|d�}d|_ tj|d�}d|_ tj|d�}d|_ tj|d�}d|_ tj|d�}tj|d�}d|_ n |jd t k�r�t d ��n� W Y d d }~X nX tj|d �}|�r�tj|d � tj|d �}||_ tj|d �} || _ tj|d!�} x0|j d"�D ]"} tj| d#�} | | _ d | j d$< �q0W |d k �r�x.|j � D ]"} tj| d#�} | | _ d%| j d$< �qjW t!� }!|j"|!d&dd'� |!j#d� y*t$| |� | j%||!j&� � | j'dd(� W n> tk �r } z |jd t k�rt d ��� W Y d d }~X nX d S ))NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� zMACHINE\VGP\VTLA\Sudo�SudoersConfigurationz manifest.xml� policysettingr� r � vgppolicy�version�1rc z Sudo Policy� descriptionz!Sudoers File Configuration Policy� apply_mode�merge� load_plugin�truez:The authenticated user does not have sufficient privileges� sudoers_entry�passwordry r� � listelement�,� principalr� �groupzUTF-8)�encoding�xml_declaration)�machine_changed)(r� r[ r� r\ rN r] r r` r2 r� r4 rs r r; r} rF � ElementTreerG r� �getroot�findr r r, r- r. �Element� SubElement�textr0 r rL r� r( r� �seekr1 r� r� �increment_gpt_ini)"r� rt ry r� rz �groupsZpasswdr� r� r� r� r r� r" r� �vgp_dir�vgp_xml�xml_datar| r� r_ �pvrc r� r� r� r� Z command_elm�user_elmr� �ur� rS �outr? r? r@ r� � s� zcmd_add_sudoers.run)NNNNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ rx � s rx c @ sL e Zd ZdZdZejejejd�Z e ddde ddd �gZ d gZ dd d �Zd S )�cmd_list_sudoersz�List Samba Sudoers Group Policy from the sysvol This command lists sudo rules from the sysvol that will be applied to winbind clients. Example: samba-tool gpo manage sudoers list {31B2F340-016D-11D2-945F-00C04FB984F9} z%prog <gpo> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt Nc C s� |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�}| jj d�}d j |j � d |d d g�} yt j |j| ��} W nX tk �r } z:| jd tttgkr�d } n| jd tkr�td��n� W Y d d } ~ X nX | d k �r�| jd�} | jd�} x�| jd�D ]�}|jd�j}|jd�j}|jd�}g }x |D ]}|j|jd�� �q`W t|�d k�r�dj dd� |D ��}nd}|jd�d k}|�r�dnd }d ||||f }| jj d | � �q0W d j |j � d |d g�}yt t j |j|��}W nX tk �rh } z:| jd tttgk�r>d S | jd tk�rVtd��� W Y d d } ~ X nX d }xB|j D ]8}t!|j"�|k�rvt#|j$�j%� �rv| jj d |j$ � �qvW d S )!NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� zMACHINE\VGP\VTLA\Sudoz!SudoersConfiguration\manifest.xmlr z:The authenticated user does not have sufficient privilegesr| r� r� ry r� r� r� r� c S s* g | ]"}|j d dkr |jnd|j �qS )r� r� z%s%%)r� r� )rV r� r? r? r@ � <listcomp>C s z(cmd_list_sudoers.run.<locals>.<listcomp>�ALLr� z NOPASSWD:rD z%s ALL=(%s)%s %sz%s zMACHINE\Registry.pols1 Software\Policies\Samba\Unix Settings\Sudo Rights)&r� r[ r� r\ rN r] r r` r2 r r; r} rF rG r� r r r, r- r. r0 r r� �findallr� �extendrM r� r� r r r� r r$ r r% r� rK )r� rt r� r� r� r� r r� r� r� r� r_ r r� r ry r� � listelements� principalsr� �uname� nopassword�np_entry�pr r r r? r? r@ r� sx zcmd_list_sudoers.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� � s r� c @ sN e Zd ZdZdZejejejd�Z e ddde ddd �gZ d d gZ dd d�Zd S )�cmd_remove_sudoersa Removes a Samba Sudoers Group Policy from the sysvol This command removes a sudo rule from the sysvol from applying to winbind clients. Example: samba-tool gpo manage sudoers remove {31B2F340-016D-11D2-945F-00C04FB984F9} 'fakeu ALL=(ALL) NOPASSWD: ALL' z %prog <gpo> <entry> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt r Nc , s |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�}| j � t || j| j| j |�} | jj d�} d j | j� d |d d g�} d j | d g�} y2tjtj|j| ���} | j� jd�}|jd�}W n\ tk �rR } z>|jd tttgk�r&d }n |jd tk�r@td��n� W Y d d }~X nX d j | j� d |dg�}yt t j |j|��}W n\ tk �r� } z>|jd tttgk�r�d }n |jd tk�r�td��n� W Y d d }~X nX i }x�|�r�|j d�ng D ]�}|jd�j }|jd�j }|j d�}g }x |D ]}|j!|j d�� �q(W t"|�dk�rfdj dd� |D ��}nd}|jd �d k}|�r�d nd }d ||||f } ||| < �q�W � |j#� k�rL|j$|� � t%� } | j&| d dd!� | j'd� y*t(|| � |j)| | j*� � | j+dd"� W n> tk �rH } z |jd tk�r6td��� W Y d d }~X nX n�� |�rdd#d� |j,D �ng k�r� fd$d�|j,D �}t"|�|_-||_,y |j)|t.|�� | j+dd"� W n> tk �r� } z |jd tk�r�td��� W Y d d }~X nX n td%� ��d S )&NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� zMACHINE\VGP\VTLA\Sudor{ z manifest.xmlr| r� r z:The authenticated user does not have sufficient privilegeszMACHINE\Registry.polr� ry r� r� r� r� c S s* g | ]"}|j d dkr |jnd|j �qS )r� r� z%s%%)r� r� )rV r� r? r? r@ r� � s z*cmd_remove_sudoers.run.<locals>.<listcomp>r� r� z NOPASSWD:rD z%s ALL=(%s)%s %szUTF-8)r� r� )r� c S s g | ] }|j �qS r? )r� )rV r_ r? r? r@ r� � s c s g | ]}|j � kr|�qS r? )r� )rV r_ )r r? r@ r� � s z,Cannot remove '%s' because it does not exist)/r� r[ r� r\ rN r] r r` r2 r� r4 rs r r; r} rF r� rG r� r� r� r r r, r- r. r0 r r r r� r� r� r� rM �keysr~ r( r� r� r1 r� r� r� r � num_entriesr ) r� rt r r� r� r� r� r r� r" r� r� r� r� r| r� r_ r r r ry r� r� r� r� r� r� r� r� r� r? )r r@ r� y s� zcmd_remove_sudoers.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� a s r� c @ s2 e Zd ZdZi Ze� ed< e� ed< e� ed< dS )� cmd_sudoersz#Manage Sudoers Group Policy ObjectsrY r� r~ N)r� r� r� r� � subcommandsrx r� r� r? r? r? r@ r� � s r� c @ sP e Zd ZdZdZejejejd�Z e ddde ddd �gZ d d d gZ ddd�Zd S )�cmd_set_securitya Set Samba Security Group Policy to the sysvol This command sets a security setting to the sysvol for applying to winbind clients. Not providing a value will unset the policy. These settings only apply to the ADDC. Example: samba-tool gpo manage security set {31B2F340-016D-11D2-945F-00C04FB984F9} MaxTicketAge 10 Possible policies: MaxTicketAge Maximum lifetime for user ticket Defined in hours MaxServiceAge Maximum lifetime for service ticket Defined in minutes MaxRenewAge Maximum lifetime for user ticket renewal Defined in minutes MinimumPasswordAge Minimum password age Defined in days MaximumPasswordAge Maximum password age Defined in days MinimumPasswordLength Minimum password length Defined in characters PasswordComplexity Password must meet complexity requirements 1 is Enabled, 0 is Disabled z%prog <gpo> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt r zvalue?Nc C sr |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�} | j � t || j| j| j |�} | jj d�} d j | j� d |d g�} d j | d g�} y`td d �}t|_| j| �}y|jt|j� �� W n* tk �r |jt|jd��� Y nX W nT tk �rv } z6|jd tk�rNtd��|jd tt t gk�rf� W Y d d }~X nX dddddddd�}|| }|j |��s�|j |� |d k �r�|j |||� n*|j!||� t"|j#|��dk�r�|j$|� t� }|j%|� y.t&| | � | j'| t(|j)� �� | j*dd� W n@ tk �rl } z"|jd tk�rZtd��n� W Y d d }~X nX d S )NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� z$MACHINE\Microsoft\Windows NT\SecEditz GptTmpl.inf)� interpolationzutf-16r z:The authenticated user does not have sufficient privilegeszKerberos Policyz System Access)Z MaxTicketAgeZ MaxServiceAgeZ MaxRenewAgeZMinimumPasswordAgeZMaximumPasswordAgeZMinimumPasswordLengthZPasswordComplexity)r� )+r� r[ r� r\ rN r] r r` r2 r� r4 rs r r; r} r& r| � optionxformr� �readfpr' r �UnicodeDecodeErrorr r r0 r r, r- r. Z has_sectionZ add_section�setZ remove_optionrM rB Zremove_sectionr� r1 r� r$ �getvaluer� )r� rt r r< r� r� r� r� r r� r" r� Zinf_dir�inf_file�inf_data�rawr_ Z section_map�sectionr� r? r? r@ r� sr zcmd_set_security.run)NNNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� � s r� c @ sL e Zd ZdZdZejejejd�Z e ddde ddd �gZ d gZ dd d �Zd S )�cmd_list_securitya List Samba Security Group Policy from the sysvol This command lists security settings from the sysvol that will be applied to winbind clients. These settings only apply to the ADDC. Example: samba-tool gpo manage security list {31B2F340-016D-11D2-945F-00C04FB984F9} z%prog <gpo> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt Nc C s� |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�}| jj d�}d j |j � d |d g�} y^t d d �} t | _|j| �} y| jt| j� �� W n( tk r� | jt| jd ��� Y nX W nX tk �rL } z:| jd tttgk�r"d S | jd tk�r:td��� W Y d d } ~ X nX xN| j� D ]B} | dk�rj�qXx,| j | �D ] \}}| j j d||f � �qvW �qXW d S )NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� z0MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf)r� zutf-16r z:The authenticated user does not have sufficient privileges�Kerberos Policy� System Accessz%s = %s )r� r� ) r� r[ r� r\ rN r] r r` r2 r r; r} r& r| r� r� r� r' r r� r r r, r- r. r0 r Zsectionsr? r� r� )r� rt r� r� r� r� r r� r� r� r� r� r_ r� r� r< r? r? r@ r� ~ sF zcmd_list_security.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� e s r� c @ s( e Zd ZdZi Ze� ed< e� ed< dS )� cmd_securityz$Manage Security Group Policy Objectsr� r� N)r� r� r� r� r� r� r� r? r? r? r@ r� � s r� c @ sL e Zd ZdZdZejejejd�Z e ddde ddd �gZ d gZ dd d �Zd S )�cmd_list_smb_confz�List Samba smb.conf Group Policy from the sysvol This command lists smb.conf settings from the sysvol that will be applied to winbind clients. Example: samba-tool gpo manage smb_conf list {31B2F340-016D-11D2-945F-00C04FB984F9} z%prog <gpo> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt Nc C sh |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�}| jj d�}d j |j � d |d g�} yt t j|j| ��} W nR tk r� } z6| jd tttgkr�d S | jd tkr�td ��� W Y d d } ~ X nX d} tj� } xV| jD ]L}t|j�| k�r| j |j t |j �� | j |j �}| j j!d|j |f � �qW d S )NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� zMACHINE\Registry.polr z:The authenticated user does not have sufficient privilegess Software\Policies\Samba\smb_confz%s = %s )"r� r[ r� r\ rN r] r r` r2 r r; r} r r r� r� r r r, r- r. r0 r r" ZLoadParmr r$ r r� r r| r� r� r� )r� rt r� r� r� r� r r� r� r r r_ r r[ r �valr? r? r@ r� � s> zcmd_list_smb_conf.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� � s r� c @ sP e Zd ZdZdZejejejd�Z e ddde ddd �gZ d d d gZ ddd�Zd S )�cmd_set_smb_confa% Sets a Samba smb.conf Group Policy to the sysvol This command sets an smb.conf setting to the sysvol for applying to winbind clients. Not providing a value will unset the policy. Example: samba-tool gpo manage smb_conf set {31B2F340-016D-11D2-945F-00C04FB984F9} 'apply gpo policies' yes z %prog <gpo> <entry> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt �settingzvalue?Nc s� |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�} | j � t || j| j| j |�} | jj d�} d j | j� d |d g�} d j | d g�} yttj| j| ��}W n` tk �r8 } zB|jd tttgk�r tj� }n |jd tk�r&td��n� W Y d d }~X nX |d k�r�� dd� |jD �k�rftd� ��� fdd�|jD �}||_t|�|_ n�t |�j� d k�r�d}d}nHt |�j� d k�r�d}d }n,t |�j � �r�d}t t |��}n d}t |�}tj!� }d|_"t � �|_#||_$||_%t&|j�}|j'|� ||_t|�|_ y*t(| | � | j)| t*|�� | j+dd � W n> tk �r� } z |jd tk�r�td��� W Y d d }~X nX d S ) NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� r� z Registry.polr z:The authenticated user does not have sufficient privilegesc S s g | ] }|j �qS r? )r )rV r_ r? r? r@ r� 2 s z(cmd_set_smb_conf.run.<locals>.<listcomp>z,Cannot remove '%s' because it does not existc s g | ]}|j � kr|�qS r? )r )rV r_ )r� r? r@ r� 5 s �yesr� r r rI �no�falser� s Software\Policies\Samba\smb_conf)r� )r� r� r )r� r� r� ),r� r[ r� r\ rN r] r r` r2 r� r4 rs r r; r} r r r� r� r r r, r- r. r0 r r rM r� r% � isnumericrQ r$ r r r r� r� r� rP r1 r� r r� )r� rt r� r< r� r� r� r� r r� r" r� Zpol_dirr r r_ r �etyper� r? )r� r@ r� sz zcmd_set_smb_conf.run)NNNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� � s r� c @ s( e Zd ZdZi Ze� ed< e� ed< dS )� cmd_smb_confz$Manage smb.conf Group Policy Objectsr� r� N)r� r� r� r� r� r� r� r? r? r? r@ r� Z s r� c @ sL e Zd ZdZdZejejejd�Z e ddde ddd �gZ d gZ dd d �Zd S )�cmd_list_symlinkz�List VGP Symbolic Link Group Policy from the sysvol This command lists symlink settings from the sysvol that will be applied to winbind clients. Example: samba-tool gpo manage symlink list {31B2F340-016D-11D2-945F-00C04FB984F9} z%prog <gpo> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt Nc C sZ |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�}| jj d�}d j |j � d |d d g�} yt j |j| ��} W nR tk r� } z6| jd tttgkr�d S | jd tkr�td��� W Y d d } ~ X nX | jd�} | jd�} x@| jd�D ]2}|jd�}|jd�}| jjd|j|jf � �q W d S )NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� zMACHINE\VGP\VTLA\UnixzSymlink\manifest.xmlr z:The authenticated user does not have sufficient privilegesr| r� �file_properties�source�targetz ln -s %s %s )r� r[ r� r\ rN r] r r` r2 r r; r} rF rG r� r r r, r- r. r0 r r� r� r� r� r� )r� rt r� r� r� r� r r� r� r� r� r_ r r� r� r� r� r? r? r@ r� x s> zcmd_list_symlink.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� ` s r� c @ sP e Zd ZdZdZejejejd�Z e ddde ddd �gZ d d d gZ ddd�Zd S )�cmd_add_symlinkz�Adds a VGP Symbolic Link Group Policy to the sysvol This command adds a symlink setting to the sysvol that will be applied to winbind clients. Example: samba-tool gpo manage symlink add {31B2F340-016D-11D2-945F-00C04FB984F9} /tmp/source /tmp/target z'%prog <gpo> <source> <target> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt r� r� Nc C sn |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�} | j � t || j| j| j |�} | jj d�} d j | j� d |d g�} d j | d g�} y2tjtj| j| ���}|j� jd �}|jd�}W n� tk �r� } z�|jd tttgk�r�tjtjd��}tj|j� d �}tj|d�}d|_ tj|d�}d|_ tj|d�}d|_ tj|d�}n |jd t k�r�t d��n� W Y d d }~X nX tj|d�}tj|d�}||_ tj|d�}||_ t � }|j |ddd � |j!d� y*t"| | � | j#| |j$� � | j%dd � W n> tk �rh } z |jd t k�rVt d��� W Y d d }~X nX d S ) NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� z MACHINE\VGP\VTLA\Unix\Symlinkz manifest.xmlr| r� r r} r~ r rc zSymlink Policyr� z Specifies symbolic link dataz:The authenticated user does not have sufficient privilegesr� r� r� zUTF-8)r� r� )r� )&r� r[ r� r\ rN r] r r` r2 r� r4 rs r r; r} rF r� rG r� r� r� r r r, r- r. r� r� r� r0 r r( r� r� r1 r� r� r� )r� rt r� r� r� r� r� r� r r� r" r� r� r� r� r r� r_ r| r� rc r� r� � source_elm� target_elmr� r? r? r@ r� � sl zcmd_add_symlink.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� � s r� c @ sP e Zd ZdZdZejejejd�Z e ddde ddd �gZ d d d gZ ddd�Zd S )�cmd_remove_symlinka Removes a VGP Symbolic Link Group Policy from the sysvol This command removes a symlink setting from the sysvol from applying to winbind clients. Example: samba-tool gpo manage symlink remove {31B2F340-016D-11D2-945F-00C04FB984F9} /tmp/source /tmp/target z'%prog <gpo> <source> <target> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt r� r� Nc C sF |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�} | j � t || j| j| j |�} | jj d�} d j | j� d |d g�} d j | d g�} y2tjtj| j| ���}|j� jd �}|jd�}W nf tk �rZ } zH|jd tttgk�r.td| |��n |jd tk�rHtd��n� W Y d d }~X nX xZ|j d�D ]>}|jd�}|jd�}|j |k�rh|j |k�rh|j |� P �qhW td| |��t � }|j |ddd� |j!d� y*t"| | � | j#| |j$� � | j%dd� W n> tk �r@ } z |jd tk�r.td��� W Y d d }~X nX d S )NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� z MACHINE\VGP\VTLA\Unix\Symlinkz manifest.xmlr| r� r z>Cannot remove link from '%s' to '%s' because it does not existz:The authenticated user does not have sufficient privilegesr� r� r� zUTF-8)r� r� )r� )&r� r[ r� r\ rN r] r r` r2 r� r4 rs r r; r} rF r� rG r� r� r� r r r, r- r. r r0 r� r� r~ r( r� r� r1 r� r� r� )r� rt r� r� r� r� r� r� r r� r" r� r� r� r� r r� r_ r� r� r� r� r? r? r@ r� sb zcmd_remove_symlink.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� � s r� c @ s2 e Zd ZdZi Ze� ed< e� ed< e� ed< dS )� cmd_symlinkz#Manage symlink Group Policy Objectsr� rY r~ N)r� r� r� r� r� r� r� r� r? r? r? r@ r� Z s r� c @ sL e Zd ZdZdZejejejd�Z e ddde ddd �gZ d gZ dd d �Zd S )�cmd_list_filesz�List VGP Files Group Policy from the sysvol This command lists files which will be copied from the sysvol and applied to winbind clients. Example: samba-tool gpo manage files list {31B2F340-016D-11D2-945F-00C04FB984F9} z%prog <gpo> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt Nc C s� |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�}| jj d�}d j |j � d |d d g�} yt j |j| ��} W nR tk r� } z6| jd tttgkr�d S | jd tkr�td��� W Y d d } ~ X nX | jd�} | jd�} xr| jd�D ]d}|jd�j}|jd�j}|jd�j}|jd�j}t|�}dt|�||||f }| jj d| � �q W d S )NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� zMACHINE\VGP\VTLA\UnixzFiles\manifest.xmlr z:The authenticated user does not have sufficient privilegesr| r� r� r� r� r� r� z%s %s %s %s -> %sz%s ) r� r[ r� r\ rN r] r r` r2 r r; r} rF rG r� r r r, r- r. r0 r r� r� r� r) r* r� r� )r� rt r� r� r� r� r r� r� r� r� r_ r r� r r� r� r� r� �moder� r? r? r@ r� y sH zcmd_list_files.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� a s r� c @ sV e Zd ZdZdZejejejd�Z e ddde ddd �gZ d d d d ddgZ ddd�ZdS )� cmd_add_filesa Add VGP Files Group Policy to the sysvol This command adds files which will be copied from the sysvol and applied to winbind clients. Example: samba-tool gpo manage files add {31B2F340-016D-11D2-945F-00C04FB984F9} ./source.txt /usr/share/doc/target.txt root root 600 z=%prog <gpo> <source> <target> <user> <group> <mode> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt r� r� r� r� r� Nc $ C sn |j � | _| j| jdd�| _tjj|�s4td| ��|rV|jd�rV|dd � } || _ n"t | j| j�} t | j| j| d�| _ t | d| j| jd�} | j � t|| j| j| j|�} | jjd �}d j|j� d |d g�}d j|d g�}y2tjtj| j|���}|j� jd�}|jd�}W n� tk �r� } z�|jd tt t gk�r�tjtj d��}tj |j� d�}tj |d�}d|_ tj |d�}d|_ tj |d�}d|_ tj |d�}n |jd t!k�r�td��n� W Y d d }~X nX tj |d�}tj |d�}tjj"|�|_ tj |d�}||_ tj |d �} || _ tj |d �} || _ x�d1D ]�\} } tj |d!�} | j#d"| � t$|d#�d$| > @ �rjtj | d%� t$|d#�d&| > @ �r�tj | d'� t$|d#�d(| > @ �r*tj | d)� �q*W t%� }!|j&|!d*dd+� |!j'd� t(|d,�j)� }"d j|tjj"|�g�}#y6t*| |� | j+||!j)� � | j+|#|"� | j,dd-� W n> tk �rh } z |jd t!k�rVtd��� W Y d d }~X nX d S )2NT)r� zSource '%s' does not existzldap://r� )r^ r� )r[ r\ r� r� r� zMACHINE\VGP\VTLA\Unix\Filesz manifest.xmlr| r� r r} r~ r rc ZFilesr� z+Represents file data to set/copy on clientsz:The authenticated user does not have sufficient privilegesr� r� r� r� r� � r� �other� permissionsr� rH r r� rG r� rI ZexecutezUTF-8)r� r� r� )r� �r� r� �r� r� �r� r )r� r� r� )-r� r[ r� r\ r� r� r r rN r] r r` r2 r� r4 rs r r; r} rF r� rG r� r� r� r r r, r- r. r� r� r� r0 rE r� rQ r( r� r� r� r� r1 r� r� )$r� rt r� r� r� r� r� r� r� r� r� r r� r" r� r� r� r� r r� r_ r| r� rc r� r� r� r� r� Z group_elmZptypeZshiftr� r� Z source_dataZ sysvol_sourcer? r? r@ r� � s� zcmd_add_files.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� � s r� c @ sN e Zd ZdZdZejejejd�Z e ddde ddd �gZ d d gZ dd d�Zd S )�cmd_remove_filesa Remove VGP Files Group Policy from the sysvol This command removes files which would be copied from the sysvol and applied to winbind clients. Example: samba-tool gpo manage files remove {31B2F340-016D-11D2-945F-00C04FB984F9} /usr/share/doc/target.txt z %prog <gpo> <target> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt r� Nc C sP |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�}| j � t || j| j| j |�} | jj d�} d j | j� d |d g�} d j | d g�} y2tjtj|j| ���} | j� jd �}|jd�}W nd tk �rX } zF|jd tttgk�r,td| ��n |jd tk�rFtd��n� W Y d d }~X nX xf|j d�D ]L}|jd�}|jd�}|j |k�rfd j | |j g�}|j |� |j |� P �qfW td| ��t � }| j!|ddd� |j"d� y*t#|| � |j$| |j%� � | j&dd� W n> tk �rJ } z |jd tk�r8td��� W Y d d }~X nX d S )NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� zMACHINE\VGP\VTLA\Unix\Filesz manifest.xmlr| r� r z1Cannot remove file '%s' because it does not existz:The authenticated user does not have sufficient privilegesr� r� r� zUTF-8)r� r� )r� )'r� r[ r� r\ rN r] r r` r2 r� r4 rs r r; r} rF r� rG r� r� r� r r r, r- r. r r0 r� r� �unlinkr~ r( r� r� r1 r� r� r� )r� rt r� r� r� r� r� r r� r" r� r� r� r� r r� r_ r� r� r� r� r� r? r? r@ r� 0 sf zcmd_remove_files.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� s r� c @ s2 e Zd ZdZi Ze� ed< e� ed< e� ed< dS )� cmd_filesz!Manage Files Group Policy Objectsr� rY r~ N)r� r� r� r� r� r� r� r� r? r? r? r@ r� t s r� c @ sL e Zd ZdZdZejejejd�Z e ddde ddd �gZ d gZ dd d �Zd S )�cmd_list_opensshz�List VGP OpenSSH Group Policy from the sysvol This command lists openssh options from the sysvol that will be applied to winbind clients. Example: samba-tool gpo manage openssh list {31B2F340-016D-11D2-945F-00C04FB984F9} z%prog <gpo> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt Nc C s� |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�}| jj d�}d j |j � d |d d g�} yt j |j| ��} W nR tk r� } z6| jd tttgkr�d S | jd tkr�td��� W Y d d } ~ X nX | jd�} | jd�} | jd�}x`|jd�D ]R}|jd�j�r@�q*x8|jd�D ]*}| jjd|jd�j|jd�jf � �qLW �q*W d S )NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� zMACHINE\VGP\VTLA\SshCfgzSshD\manifest.xmlr z:The authenticated user does not have sufficient privilegesr| r� � configfile� configsection� sectionname� keyvaluepairz%s %s r� r< )r� r[ r� r\ rN r] r r` r2 r r; r} rF rG r� r r r, r- r. r0 r r� r� r� r� r� )r� rt r� r� r� r� r r� r� r� r� r_ r r� r� r� �kvr? r? r@ r� � sD zcmd_list_openssh.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� { s r� c @ sP e Zd ZdZdZejejejd�Z e ddde ddd �gZ d d d gZ ddd�Zd S )�cmd_set_openssha" Sets a VGP OpenSSH Group Policy to the sysvol This command sets an openssh setting to the sysvol for applying to winbind clients. Not providing a value will unset the policy. Example: samba-tool gpo manage openssh set {31B2F340-016D-11D2-945F-00C04FB984F9} KerberosAuthentication Yes z'%prog <gpo> <setting> [value] [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt r� zvalue?Nc C s� |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�} | j � t || j| j| j |�} | jj d�} d j | j� d |d g�} d j | d g�} y<tjtj| j| ���}|j� jd �}|jd�}|jd�}W n� tk �r� } z�|jd tttgk�r�tjtjd��}tj|j� d �}tj|d�}d|_ tj|d�}d|_ tj|d�}d|_ tj|d�}d|_ tj|d�}tj|d�}tj|d�}tj|d� n |jd t k�r�t d ��n� W Y d d }~X nX |d k �r�x�|j d�D ]�}|jd�j �r �qi }x"|j d �D ]}|||jd �< �q,W ||j � k�r^||| _ n0tj|d �}tj|d �} || _ tj|d �} || _ �qW n|xz|j d�D ]l}|jd�j �r��q�i }x$|j d �D ]}|||jd �j < �q�W ||j � k�r |j!|| � n t d | ���q�W t"� } |j#| d!dd"� | j$d� y*t%| | � | j&| | j'� � | j(dd#� W n> tk �r� } z |jd t k�r�t d ��� W Y d d }~X nX d S )$NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� z MACHINE\VGP\VTLA\SshCfg\SshDz manifest.xmlr| r� r� r r} r~ r rc zConfiguration Filer� z+Represents Unix configuration file settingsr� r� r� r� z:The authenticated user does not have sufficient privilegesr� r� r< z,Cannot remove '%s' because it does not existzUTF-8)r� r� )r� ))r� r[ r� r\ rN r] r r` r2 r� r4 rs r r; r} rF r� rG r� r� r� r r r, r- r. r� r� r� r0 r r� r� r~ r( r� r� r1 r� r� r� ) r� rt r� r< r� r� r� r� r r� r" r� r� r� r� r r� r� r_ r| r� rc r� r� r� Zsettingsr� r� r� Zdvaluer� r? r? r@ r� � s� zcmd_set_openssh.run)NNNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� � s r� c @ s( e Zd ZdZi Ze� ed< e� ed< dS )� cmd_opensshz#Manage OpenSSH Group Policy Objectsr� r� N)r� r� r� r� r� r� r� r? r? r? r@ r� : s r� c @ sL e Zd ZdZdZejejejd�Z e ddde ddd �gZ d gZ dd d �Zd S )�cmd_list_startupz�List VGP Startup Script Group Policy from the sysvol This command lists the startup script policies currently set on the sysvol. Example: samba-tool gpo manage scripts startup list {31B2F340-016D-11D2-945F-00C04FB984F9} z%prog <gpo> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt Nc C s� |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�}| jj d�}d j |j � d |d d g�} yt j |j| ��} W nR tk r� } z6| jd tttgkr�d S | jd tkr�td��� W Y d d } ~ X nX | jd�} | jd�} x�| jd�D ]�}|jd�}d j d |j � d |dd|jg�}|jd�}|jd�}|d k �rr|j}nd}|d k �r�|j}nd}| jjd|||f � �q W d S )NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� zMACHINE\VGP\VTLA\Unixz Scripts\Startup\manifest.xmlr z:The authenticated user does not have sufficient privilegesr| r� r� �scriptz MACHINE\VGP\VTLA\Unix\ScriptsZStartup� parameters�run_as�rootrD z@reboot %s %s %s )r� r[ r� r\ rN r] r r` r2 r r; r} rF rG r� r r r, r- r. r0 r r� r� r� r� r� )r� rt r� r� r� r� r r� r� r� r� r_ r r� r� r� Z script_pathr� r� r? r? r@ r� X sT zcmd_list_startup.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� @ s r� c @ sb e Zd ZdZdZejejejd�Z e ddde ddd �e d d d d dd�gZ ddddgZ ddd�ZdS )�cmd_add_startupz�Adds VGP Startup Script Group Policy to the sysvol This command adds a startup script policy to the sysvol. Example: samba-tool gpo manage scripts startup add {31B2F340-016D-11D2-945F-00C04FB984F9} test_script.sh '\-n \-p all' z.%prog <gpo> <script> [args] [run_as] [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� z --run-once�run_onceFr z#Whether to run the script only once)r� r r r� rt r� zargs?zrun_as?Nc C s* |j � | _|j| jdd�| _tjj|�s4td| ��|rV|jd�rV|dd � } || _ n"t | j| j�} t | j| j| d�| _ t | d| j| jd�} | j � t|| j| j| j|�} | jjd �} d j| j� d |d g�}d j|d g�}y2tjtj| j|���}|j� jd�}|jd�}W n� tk �r� } z�|jd tt t gk�r�tjtj d��}tj |j� d�}tj |d�}d|_ tj |d�}d|_ tj |d�}d|_ tj |d�}n |jd t!k�r�td��n� W Y d d }~X nX t"|d�j#� }tj |d�}tj |d�}tjj$|�|_ tj |d �}t%j&|�j'� j(� |_ |d k �rLtj |d �} |j)d �j)d �j*d d!�| _ |d k �rhtj |d"�} || _ |�rztj |d#� t+� } |j,| d$dd%� | j-d� d j|tjj$|�g�} y6t.| |� | j/|| j#� � | j/| |� | j0dd&� W n> tk �r$ } z |jd t!k�rtd��� W Y d d }~X nX d S )'NT)r� zScript '%s' does not existzldap://r� )r^ r� )r[ r\ r� r� r� z%MACHINE\VGP\VTLA\Unix\Scripts\Startupz manifest.xmlr| r� r r} r~ r rc z Unix Scriptsr� z6Represents Unix scripts to run on Group Policy clientsz:The authenticated user does not have sufficient privilegesr� r� r� �hashr� �"�'z\-�-r� r� zUTF-8)r� r� )r� )1r� r[ r� r\ r� r� r r rN r] r r` r2 r� r4 rs r r; r} rF r� rG r� r� r� r r r, r- r. r� r� r� r0 r� r� rE �hashlibZmd5Z hexdigestrV rK r r( r� r� r1 r� r� ) r� rt r� r r� r� r� r� r� r� r r� r" r� r� r� r� r r� r_ r| r� rc r� Z script_datar� � script_elmr� r� Z run_as_elmr� Z sysvol_scriptr? r? r@ r� � s� zcmd_add_startup.run)NNNNNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� � s r� c @ sN e Zd ZdZdZejejejd�Z e ddde ddd �gZ d d gZ dd d�Zd S )�cmd_remove_startupz�Removes VGP Startup Script Group Policy from the sysvol This command removes a startup script policy from the sysvol. Example: samba-tool gpo manage scripts startup remove {31B2F340-016D-11D2-945F-00C04FB984F9} test_script.sh z %prog <gpo> <script> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt r� Nc C s< |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�}| j � t || j| j| j |�} | jj d�} d j | j� d |d g�} d j | d g�} y2tjtj|j| ���} | j� jd �}|jd�}W nd tk �rX } zF|jd tttgk�r,td| ��n |jd tk�rFtd��n� W Y d d }~X nX xR|j d�D ]8}|jd�}|j t j j |j!d d��k�rf|j"|� P �qfW td| ��t#� }| j$|ddd� |j%d� y*t&|| � |j'| |j(� � | j)dd� W n> tk �r6 } z |jd tk�r$td��� W Y d d }~X nX d S )NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� z%MACHINE\VGP\VTLA\Unix\Scripts\Startupz manifest.xmlr| r� r z3Cannot remove script '%s' because it does not existz:The authenticated user does not have sufficient privilegesr� r� r� zUTF-8)r� r� )r� )*r� r[ r� r\ rN r] r r` r2 r� r4 rs r r; r} rF r� rG r� r� r� r r r, r- r. r r0 r� r� r� r� rE r r~ r( r� r� r1 r� r� r� )r� rt r� r� r� r� r� r r� r" r� r� r� r� r r� r_ r� r� r� r? r? r@ r� s` zcmd_remove_startup.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� � s r� c @ s2 e Zd ZdZi Ze� ed< e� ed< e� ed< dS )� cmd_startupz+Manage Startup Scripts Group Policy Objectsr� rY r~ N)r� r� r� r� r� r� r� r� r? r? r? r@ r� U s r� c @ s e Zd ZdZi Ze� ed< dS )� cmd_scriptsz#Manage Scripts Group Policy ObjectsZstartupN)r� r� r� r� r� r� r? r? r? r@ r� \ s r� c @ sL e Zd ZdZdZejejejd�Z e ddde ddd �gZ d gZ dd d �Zd S )� cmd_list_motdz�List VGP MOTD Group Policy from the sysvol This command lists the Message of the Day from the sysvol that will be applied to winbind clients. Example: samba-tool gpo manage motd list {31B2F340-016D-11D2-945F-00C04FB984F9} z%prog <gpo> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt Nc C s0 |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�}| jj d�}d j |j � d |d d g�} yt j |j| ��} W nR tk r� } z6| jd tttgkr�d S | jd tkr�td��� W Y d d } ~ X nX | jd�} | jd�} | jd�}| jj|j� d S )NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� zMACHINE\VGP\VTLA\UnixzMOTD\manifest.xmlr z:The authenticated user does not have sufficient privilegesr| r� r� )r� r[ r� r\ rN r] r r` r2 r r; r} rF rG r� r r r, r- r. r0 r r� r� r� r� )r� rt r� r� r� r� r r� r� r� r� r_ r r� r� r? r? r@ r� z s: zcmd_list_motd.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� a s r� c @ sN e Zd ZdZdZejejejd�Z e ddde ddd �gZ d d gZ dd d�Zd S )� cmd_set_motda Sets a VGP MOTD Group Policy to the sysvol This command sets the Message of the Day to the sysvol for applying to winbind clients. Not providing a value will unset the policy. Example: samba-tool gpo manage motd set {31B2F340-016D-11D2-945F-00C04FB984F9} "Message for today" z %prog <gpo> [value] [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt zvalue?Nc C sx |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�}| j � t || j| j| j |�} | jj d�} d j | j� d |d g�} d j | d g�} |d kr�|j| � | jdd � d S ytj|j| ��} W n� tk �r� } z�|jd tttgk�r�tjtjd��} tj| j � d�}tj|d�}d|_ tj|d�}d|_ tj|d�}d|_ tj|d�}d|_ tj|d�}tj|d�}d|_ n |jd t k�r�t d ��n� W Y d d }~X nX tj|d �}||_ t � }| j!|d dd � |j"d� y*t#|| � |j$| |j%� � | jdd � W n> tk �rr } z |jd t k�r`t d ��� W Y d d }~X nX d S ) NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� zMACHINE\VGP\VTLA\Unix\MOTDz manifest.xml)r� r r} r| r~ r rc z Text Filer� z Represents a Generic Text Filer� r r� �filename�motdz:The authenticated user does not have sufficient privilegesr� zUTF-8)r� r� )&r� r[ r� r\ rN r] r r` r2 r� r4 rs r r; r} r� r� rF rG r� r r r, r- r. r� r� r� r� r� r0 r r( r� r� r1 r� r� )r� rt r< r� r� r� r� r r� r" r� r� r� r� r_ r| r� rc r� r� r� r� r� r� r? r? r@ r� � sr zcmd_set_motd.run)NNNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� � s r� c @ s( e Zd ZdZi Ze� ed< e� ed< dS )�cmd_motdz.Manage Message of the Day Group Policy Objectsr� r� N)r� r� r� r� r� r� r� r? r? r? r@ r� s r� c @ sL e Zd ZdZdZejejejd�Z e ddde ddd �gZ d gZ dd d �Zd S )�cmd_list_issuez�List VGP Issue Group Policy from the sysvol This command lists the Prelogin Message from the sysvol that will be applied to winbind clients. Example: samba-tool gpo manage issue list {31B2F340-016D-11D2-945F-00C04FB984F9} z%prog <gpo> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt Nc C s0 |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�}| jj d�}d j |j � d |d d g�} yt j |j| ��} W nR tk r� } z6| jd tttgkr�d S | jd tkr�td��� W Y d d } ~ X nX | jd�} | jd�} | jd�}| jj|j� d S )NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� zMACHINE\VGP\VTLA\UnixzIssue\manifest.xmlr z:The authenticated user does not have sufficient privilegesr| r� r� )r� r[ r� r\ rN r] r r` r2 r r; r} rF rG r� r r r, r- r. r0 r r� r� r� r� )r� rt r� r� r� r� r r� r� r� r� r_ r r� r� r? r? r@ r� $ s: zcmd_list_issue.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� s r� c @ sN e Zd ZdZdZejejejd�Z e ddde ddd �gZ d d gZ dd d�Zd S )� cmd_set_issuea Sets a VGP Issue Group Policy to the sysvol This command sets the Prelogin Message to the sysvol for applying to winbind clients. Not providing a value will unset the policy. Example: samba-tool gpo manage issue set {31B2F340-016D-11D2-945F-00C04FB984F9} "Welcome to Samba!" z %prog <gpo> [value] [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt zvalue?Nc C sx |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�}| j � t || j| j| j |�} | jj d�} d j | j� d |d g�} d j | d g�} |d kr�|j| � | jdd � d S ytj|j| ��} W n� tk �r� } z�|jd tttgk�r�tjtjd��} tj| j � d�}tj|d�}d|_ tj|d�}d|_ tj|d�}d|_ tj|d�}d|_ tj|d�}tj|d�}d|_ n |jd t k�r�t d ��n� W Y d d }~X nX tj|d �}||_ t � }| j!|d dd � |j"d� y*t#|| � |j$| |j%� � | jdd � W n> tk �rr } z |jd t k�r`t d ��� W Y d d }~X nX d S ) NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� zMACHINE\VGP\VTLA\Unix\Issuez manifest.xml)r� r r} r| r~ r rc z Text Filer� z Represents a Generic Text Filer� r r� r� �issuez:The authenticated user does not have sufficient privilegesr� zUTF-8)r� r� )&r� r[ r� r\ rN r] r r` r2 r� r4 rs r r; r} r� r� rF rG r� r r r, r- r. r� r� r� r� r� r0 r r( r� r� r1 r� r� )r� rt r< r� r� r� r� r r� r" r� r� r� r� r_ r| r� rc r� r� r� r� r� r� r? r? r@ r� d sr zcmd_set_issue.run)NNNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� K s r� c @ s( e Zd ZdZi Ze� ed< e� ed< dS )� cmd_issuez!Manage Issue Group Policy Objectsr� r� N)r� r� r� r� r� r� r� r? r? r? r@ r� � s r� c @ sL e Zd ZdZdZejejejd�Z e ddde ddd �gZ d gZ dd d �Zd S )�cmd_list_accessz�List VGP Host Access Group Policy from the sysvol This command lists host access rules from the sysvol that will be applied to winbind clients. Example: samba-tool gpo manage access list {31B2F340-016D-11D2-945F-00C04FB984F9} z%prog <gpo> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt Nc ! C sh |j � | _|j| jdd�| _|r>|jd�r>|dd � }|| _n"t| j| j�}t| j| j|d�| _t|d| j| jd�}| jj d�}d j |j � d |d d g�} yt j |j| ��} W nX tk �r } z:| jd tttgkr�d } n| jd tkr�td��n� W Y d d } ~ X nX | d k �rp| jd�} | jd�} xJ| jd�D ]<}|jd�}|jd�}|jd�}| jjd|j|jf � �q0W d j |j � d |d dg�} yt j |j| ��}W n\ tk �r� } z>| jd tttgk�r�d }n | jd tk�r�td��n� W Y d d } ~ X nX |d k �rd|jd�} | jd�} xJ| jd�D ]<}|jd�}|jd�}|jd�}| jjd|j|jf � �q$W d S )NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� zMACHINE\VGP\VTLA\VASz$HostAccessControl\Allow\manifest.xmlr z:The authenticated user does not have sufficient privilegesr| r� r� �adobjectrc rQ z +:%s\%s:ALL z#HostAccessControl\Deny\manifest.xmlz -:%s\%s:ALL )r� r[ r� r\ rN r] r r` r2 r r; r} rF rG r� r r r, r- r. r0 r r� r� r� r� r� )r� rt r� r� r� r� r r� r� r� �allowr_ r r� r� r� rc rQ �denyr? r? r@ r� � sl zcmd_list_access.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r� � s r� c @ sR e Zd ZdZdZejejejd�Z e ddde ddd �gZ d d d d gZ ddd�ZdS )�cmd_add_accessaS Adds a VGP Host Access Group Policy to the sysvol This command adds a host access setting to the sysvol for applying to winbind clients. Any time an allow entry is detected by the client, an implicit deny ALL will be assumed. Example: samba-tool gpo manage access add {31B2F340-016D-11D2-945F-00C04FB984F9} allow goodguy example.com z0%prog <gpo> <allow/deny> <cn> <domain> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt r� �cnrQ Nc " C s� |j � | _|j| jdd�| _|r>|jd�r>|dd � } || _n"t| j| j�} t| j| j| d�| _t| d| j| jd�} | j � t || j| j| j |�} | jj d�} |d kr�d j | j� d |d d g�} n.|dkr�d j | j� d |d dg�} n td| ��d j | dg�}y2tjtj| j|���}|j� jd�}|jd�}W n� tk �r� } z�|jd tttgk�r�tjtjd��}tj |j� d�}tj |d�}d|_ tj |d�}d|_ tj |d�}d|_ tj |d �}d |_ tj |d�}n |jd t k�r�td ��n� W Y d d }~X nX t| j| j|d�}t |t � | j| jd �}|j!|j"� t#j$d | d!d"d#gd$�}t%|�dk�r`td%| ��t&|d d# d5 �}|d6k�r�td)| ��tj |d*�} tj | d+�}|j'� |_ tj | d,�} d-|j(� t&|d d" d7 �f | _ |d(k�r�tj |d.�} d/| _ tj | d0�} tj | d�}t&|d d" d8 �|_ tj | d1�} || _ tj | d+�}||_ t)� }!|j*|!d2dd3� |!j+d� y*t,| | � | j-||!j.� � | j/dd4� W n> tk �r� } z |jd t k�r�td ��� W Y d d }~X nX d S )9NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� r� zMACHINE\VGP\VTLA\VASzHostAccessControl\Allowr zHostAccessControl\DenyzBThe entry type must be either 'allow' or 'deny'. Unknown type '%s'z manifest.xmlr| r� r r} r~ r rc zHost Access Controlr� z0Represents host access control data (pam_access)r� r� z:The authenticated user does not have sufficient privileges)r] r� r� r[ z(cn=%s)ZuserPrincipalNameZsamaccountnamer� )rh ri rj rk z!Unable to find user or group "%s"rI r� r� z%s is not a user or groupr� r� r z%s\%s� groupattrZsamAccountNamer� rQ zUTF-8)r� r� )r� ���)r� r� r r )0r� r[ r� r\ rN r] r r` r2 r� r4 rs r r; r} r rF r� rG r� r� r� r r r, r- r. r� r� r� r0 r r rr Z domain_dnrn Z SCOPE_SUBTREErM r% rV Zdomain_netbios_namer( r� r� r1 r� r� r� )"r� rt r� r rQ r� r� r� r� r r� r" r� r� r� r� r r� r_ r| r� rc r� r� r] rs �resZ objectclassr� r r r� � domain_elmr� r? r? r@ r� , s� zcmd_add_access.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r s r c @ sR e Zd ZdZdZejejejd�Z e ddde ddd �gZ d d d d gZ ddd�ZdS )�cmd_remove_accessa Remove a VGP Host Access Group Policy from the sysvol This command removes a host access setting from the sysvol for applying to winbind clients. Example: samba-tool gpo manage access remove {31B2F340-016D-11D2-945F-00C04FB984F9} allow goodguy example.com z2%prog <gpo> <allow/deny> <name> <domain> [options])r� r� r� z-Hz--URLz%LDB URL for database or target serverr� r� )r� r� r� r� rt r� rc rQ Nc C s� |j � | _|j| jdd�| _|r>|jd�r>|dd � } || _n"t| j| j�} t| j| j| d�| _t| d| j| jd�} | j � t || j| j| j |�} | jj d�} |d kr�d j | j� d |d d g�} n.|dkr�d j | j� d |d dg�} n td| ��d j | dg�}y2tjtj| j|���}|j� jd�}|jd�}W nd tk �r� } zF|jd tttgk�rftd| ��n |jd tk�r�td��n� W Y d d }~X nX xv|j d�D ]\}|jd�}|jd�}|jd�}|d k �r�|j |k�r�|d k �r�|j |k�r�|j |� P �q�W td| ��t � }|j |ddd � |j!d� y*t"| | � | j#||j$� � | j%dd � W n> tk �r� } z |jd tk�r�td��� W Y d d }~X nX d S ) NT)r� zldap://r� )r^ r� )r[ r\ r� r� r� r� zMACHINE\VGP\VTLA\VASzHostAccessControl\Allowr zHostAccessControl\DenyzBThe entry type must be either 'allow' or 'deny'. Unknown type '%s'z manifest.xmlr| r� r z0Cannot remove %s entry because it does not existz:The authenticated user does not have sufficient privilegesr� r� rc rQ zUTF-8)r� r� )r� )&r� r[ r� r\ rN r] r r` r2 r� r4 rs r r; r} r rF r� rG r� r� r� r r r, r- r. r0 r� r� r~ r( r� r� r1 r� r� r� )r� rt r� rc rQ r� r� r� r� r r� r" r� r� r� r� r r� r_ r� r� Zname_elmr r� r? r? r@ r� � sv zcmd_remove_access.run)NNNN)r� r� r� r� r� rB r� r� r� r� r r| r� r� r� r? r? r? r@ r � s r c @ sT e Zd ZdZdZejejd�Ze ddddd�e d ddd d�gZ d d gZ ddd�Z d S )�cmd_cse_registera� Register a Client Side Extension (CSE) on the current host This command takes a CSE filename as an argument, and registers it for applying policy on the current host. This is not necessary for CSEs which are distributed with the current version of Samba, but is useful for installing experimental CSEs or custom built CSEs. The <cse_file> argument MUST be a permanent location for the CSE. The register command does not copy the file to some other directory. The samba-gpupdate command will execute the CSE from the exact location specified from this command. Example: samba-tool gpo cse register ./gp_chromium_ext.py gp_chromium_ext --machine z%%prog <cse_file> <cse_name> [options])r� r� z --machineFr z-Whether to register the CSE as Machine policy)r r r� z--userz*Whether to register the CSE as User policy�cse_file�cse_nameNc C sj |j � | _|dkr"|dkr"td��dttj� � }tjj|�}t |||| jj ||d�} | sftd| ��d S )NFz+Either --machine or --user must be selectedz{%s})�smb_conf�machiner� zFailed to register CSE "%s") r� r[ r r| rT rU r� r� �realpathr6 r� ) r� r r r r� r� r� Zext_guidZext_pathr> r? r? r@ r� s zcmd_cse_register.run)FFNN) r� r� r� r� r� rB r� r� r� r r� r� r� r? r? r? r@ r � s r c @ s, e Zd ZdZdZejejd�Zddd�Z dS )� cmd_cse_listz�List the registered Client Side Extensions (CSEs) on the current host This command lists the currently registered CSEs on the host. Example: samba-tool gpo cse list z%prog [options])r� r� Nc C s� |j � | _t| jj�}x||j� D ]p\}}| jjd| � | jjd|d � | jjd|d � | jjdt|d � � | jjdt|d � � q W d S ) NzUniqueGUID : %s zFileName : %s ZDllNamezProcessGroupPolicy : %s ZProcessGroupPolicyzMachinePolicy : %s Z MachinePolicyzUserPolicy : %s Z UserPolicy)r� r[ r7 r� r? r� r� r| )r� r� r� Zcsesr^ Zgp_extr? r? r@ r� = s zcmd_cse_list.run)NN) r� r� r� r� r� rB r� r� r� r� r? r? r? r@ r - s r c @ s2 e Zd ZdZdZejejd�ZdgZ ddd�Z dS ) �cmd_cse_unregisteraq Unregister a Client Side Extension (CSE) from the current host This command takes a unique GUID as an argument (representing a registered CSE), and unregisters it for applying policy on the current host. Use the `samba-tool gpo cse list` command to determine the unique GUIDs of CSEs. Example: samba-tool gpo cse unregister {3F60F344-92BF-11ED-A1EB-0242AC120002} z%prog <guid> [options])r� r� r^ Nc C s, |j � | _t|| jj�}|s(td| ��d S )Nz Failed to unregister CSE "%s")r� r[ r8 r� r )r� r^ r� r� r> r? r? r@ r� _ s zcmd_cse_unregister.run)NN) r� r� r� r� r� rB r� r� r� r� r� r? r? r? r@ r K s r c @ s2 e Zd ZdZi Ze� ed< e� ed< e� ed< dS )�cmd_csez Manage Client Side Extensions�registerr� Z unregisterN)r� r� r� r� r� r r r r? r? r? r@ r f s r c @ s2 e Zd ZdZi Ze� ed< e� ed< e� ed< dS )� cmd_accessz'Manage Host Access Group Policy Objectsr� rY r~ N)r� r� r� r� r� r� r r r? r? r? r@ r m s r c @ sx e Zd ZdZi Ze� ed< e� ed< e� ed< e� ed< e � ed< e � ed< e � ed< e � ed < e � ed < e� ed < d S ) � cmd_managezManage Group Policy ObjectsZsudoersr r �symlinkrv Zopenssh�scriptsr� r� �accessN)r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r? r? r? r@ r t s r c @ s� e Zd ZdZi Ze� ed< e� ed< e� ed< e� ed< e � ed< e � ed< e � ed< e � ed < e � ed < e� ed < e� ed < e� ed < e� ed< e� ed< e� ed< e� ed< e� ed< e� ed< e� ed< e� ed< dS )�cmd_gpoz%Group Policy Object (GPO) management.Zlistallr� Zshowr r~ ZgetlinkZsetlinkZdellinkZlistcontainersZgetinheritanceZsetinheritanceZfetchZcreate�delZaclcheckre ZrestoreZadmxloadZmanageZcseN)r� r� r� r� r� r� r� r� r r$ r% r& r, r. r/ r1 r4 rP rl rq r8 rd rr r r r? r? r? r@ r � s, r )NN)FF)�r� r Z samba.getoptZgetoptrB rn r� Zxml.etree.ElementTreeZetreer� rF rI r� Z samba.authr Z samba.netcmdr r r r Z samba.samdbr r� r Z samba.dcerpcr Z samba.ndrr r r Zsamba.securityr r r Zsamba.netcmd.commonr r Z samba.samba3r r� r rT Z samba.ntaclsr r Z samba.netr Zsamba.gp_parser r r Zsamba.gp_parse.gp_polr Zsamba.gp_parse.gp_inir r r r Zsamba.gp_parse.gp_csvr Zsamba.gp_parse.gp_infr Zsamba.gp_parse.gp_aasr! r" r# Z samba.commonr$ r% Z configparserr& �ior' r( Zsamba.gp.vgp_files_extr) r* r� r Zsamba.registryr+ Zsamba.ntstatusr, r- r. r/ r0 Zsamba.netcmd.gpcommonr1 r2 r3 Zsamba.policiesr4 Zsamba.dcerpc.miscr5 Zsamba.gp.gpclassr6 r7 r8 rA rC rU rY r` r� r� r� Z SECINFO_SACLry r{ r� r� � IGNORECASEr� r� �FILE_ATTRIBUTE_SYSTEMr� �FILE_ATTRIBUTE_ARCHIVE�FILE_ATTRIBUTE_HIDDENr� r� r� r� r� r� r� r r$ r% r& r, r. r/ r1 r4 r8 rP rd rl rq rr rx r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r r r r r? r? r? r@ �<module> s * & #.%ufrW/Z'$,6; $J?L|e {FAhA^[Fq\D{NoX@d@d] e/
| ver. 1.1 | |
.
| PHP 8.3.30 | Ð“ÐµÐ½ÐµÑ€Ð°Ñ†Ð¸Ñ Ñтраницы: 0 |
proxy
|
phpinfo
|
ÐаÑтройка