Файловый менеджер - Редактировать - /usr/lib64/python3.6/site-packages/samba/netcmd/__pycache__/group.cpython-36.pyc
Ðазад
3 �I�d�� � @ s� d dl jZd dlmZmZmZmZ d dlZd dl m Z m Z d dl m Z d dlmZ d dlmZ d dlmZmZmZmZmZmZmZmZmZm Z m Z m Z m Z d dl m!Z! d d l"m#Z#m$Z$ d d l%m&Z&m'Z' d dl(Z(d dl)Z)d d l*m+Z+ e,eeeed ��Z-e,eeed��Z.G dd� de�Z/G dd� de�Z0G dd� de�Z1G dd� de�Z2G dd� de�Z3G dd� de�Z4G dd � d e�Z5G d d � d e�Z6G d d � d e�Z7G d!d"� d"e�Z8G d#d$� d$e�Z9G d%d&� d&e�Z:G d'd(� d(e�Z;dS ))� N)�Command� SuperCommand� CommandError�Option)�ndr_pack� ndr_unpack)�security)�system_session)�SamDB) �ATYPE_SECURITY_GLOBAL_GROUP�DS_GUID_USERS_CONTAINER�"GTYPE_SECURITY_BUILTIN_LOCAL_GROUP�!GTYPE_SECURITY_DOMAIN_LOCAL_GROUP�GTYPE_SECURITY_GLOBAL_GROUP� GTYPE_SECURITY_UNIVERSAL_GROUP�%GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP� GTYPE_DISTRIBUTION_GLOBAL_GROUP�"GTYPE_DISTRIBUTION_UNIVERSAL_GROUP�SYSTEM_FLAG_DISALLOW_DELETE� SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE�"SYSTEM_FLAG_DOMAIN_DISALLOW_RENAME�UF_ACCOUNTDISABLE)� defaultdict)� check_call�CalledProcessError)� get_bytes�normalise_int32� )�common)�Builtin�Domain�Global� Universal)r r! r" c @ s� e Zd ZdZdZejejejd�Z e ddde ddd �e d d e d �e d ddddgdd�e ddddgdd�e dde d �e dde d �e d d e d �e d d e d �e d d!e d �e d"d#d$d%d&�g Z d'gZd+d)d*�Zd(S ),� cmd_group_adda Creates a new AD group. This command adds a new Active Directory group. The groupname specified on the command is a unique sAMAccountName. An Active Directory group may contain user and computer accounts as well as other groups. An administrator adds a new group and adds members to that group so they can be managed as a single entity. This helps to simplify security and system administration. Groups may also be used to establish email distribution lists, using --group-type=Distribution. Groups are located in domains in organizational units (OUs). The group's scope is a characteristic of the group that designates the extent to which the group is applied within the domain tree or forest. The group location (OU), type (security or distribution) and scope may all be specified on the samba-tool command when the group is created. The command may be run from the root userid or another authorized userid. The -H or --URL= option can be used to execute the command on a remote server. Example1: samba-tool group add Group1 -H ldap://samba.samdom.example.com --description='Simple group' Example1 adds a new group with the name Group1 added to the Users container on a remote LDAP server. The -U parameter is used to pass the userid and password of a user that exists on the remote server and is authorized to issue the command on that server. It defaults to the security type and global scope. Example2: sudo samba-tool group add Group2 --group-type=Distribution Example2 adds a new distribution group to the local server. The command is run under root using the sudo command. Example3: samba-tool group add Group3 --nis-domain=samdom --gid-number=12345 Example3 adds a new RFC2307 enabled group for NIS domain samdom and GID 12345 (both options are required to enable this feature). z%prog <groupname> [options])� sambaopts� versionopts�credoptsz-Hz--URLz%LDB URL for database or target server�URL�H)�help�type�metavar�destz --groupouzpAlternative location (without domainDN counterpart) to default CN=Users in which new user object will be created)r) r* z --group-scopeZchoicer r! r" z)Group scope (Domain | Global | Universal))r* �choicesr) z --group-type�SecurityZ Distributionz$Group type (Security | Distribution)z --descriptionzGroup's descriptionz--mail-addresszGroup's email addressz--noteszGroups's notesz --gid-numberz Group's Unix/RFC2307 GID numberz --nis-domainzSFU30 NIS Domainz --specialz Add a special predefined group� store_trueF)r) �action�default� groupnameNc % Q C sJ |pddkrt j|t�}n tj|t�}| d kr6| d k sF| d k rN| d krNtd��|j� }|j|dd�}yt|t � ||d�}W n4 t k r� } ztd|� d�|��W Y d d }~X nX |�r�d }|d k r�d}nX|d k r�d }nJ| d k r�d }n<| d k r�d }n.| d k �rd }n | d k �rd }n| d k �r d}|d k �r:td|� d���|j � �sLtd��dj � dtt jdfi}|j|j � �}|d k�r�td|� d���|\}}}} t|�}|j� }|tk�r�t j|j� � d|� ��}d }|�sL|j|t�}nl|tk�r>t jd|� ��}ttB tB }|�sLy|jd� W n tjk �r: t d��Y nX nt d|� ���|�r�y|j|� W n( tjk �r� td|� d���Y nX y|jd |� �� W n( tjk �r� td |� d���Y nX ||d || t |�d d �}|d k �r�||d!< y|j |d"gd#� W �n� tjk �r� } �z�|j \} } | tj k�r�y |j!d$|� d%�d&gd'�} W n* tjk �r| td|� d�|��Y nX t"| �d(k�r�td|� d�|��| d) jd&d)d*�} | �r�d+| � d�} nd,} td|� d-| � d.| d) j#� d����n�| tj$k�r�y |j!|tj%d&d/d0gd1�} W nd tjk �rz y |j!d2|� d%�d&d/d0gd'�} W n* tjk �rt td|� d�|��Y nX Y nX t"| �d(k�r�td|� d�|��| d) jd&d)d*�}!|!�r�d3|!� d�}"nd4}"| d) jd0d)d*�j&d5�}#||#k�r td|� d6|"� d.| d) j#� d7���| d) jd/d)d*�}$|$d k�rJtd|� d8|"� d.| d) j#� d9���n\t't j|$�}$|$|k�r�td|� d:|"� d.| d) j#� d;���n"td|� d8|"� d.| d) j#� d<���ntd|� d�|��W Y d d }~X nX | j(j)d=|� d>�� d S y |j*|||| | | | | d?� W n2 t k �r4 } ztd@| |��W Y d d }~X nX | j(j)dA| � d S )BNr. zcBoth --gid-number and --nis-domain have to be set for a RFC2307-enabled group. Operation cancelled.T)�fallback_machine)�url� session_info� credentials�lpzFailed to add group "�"z group-scopez group-type� descriptionz mail-address�notesz gid-numberz nis-domainzSuperfluous option --z specified with --specialz8Adding special groups is only permitted against the PDC!zProtected UserszaMembers of this group are afforded additional protections against authentication security threatszUnknown special group "z".�-z S-1-5-32-z CN=Builtinz Error getting Builtin objects DNzUnknown group type zInvalid group OU "zCN=zInvalid group name "�groupZTRUE)�dn�sAMAccountNameZ objectClass� groupTyper9 � objectSidZisCriticalSystemObjectZ systemFlagszrelax:0)Zcontrolsz (objectSid=�)r> )� expression�attrsr r )�idxz with name "� z " - Special group already existsz at "r@ r? )�base�scoperC z(sAMAccountName=znamed "z with no namezutf-8z" - An object z�" already exists, but it is not a security group. Rename or remove this existing object before attempting to add this special group.z" - A security group zx" already exists, but it lacks a SID. Rename or remove this existing object before attempting to add this special group.z" - The security group z" already exists.z�" already exists, but it has the wrong SID, and will not function as expected. Rename or remove this existing object before attempting to add this special group.z Added group � )�groupou� grouptyper9 Z mailaddressr: � gidnumberZ nisdomainzFailed to add group "%s"zAdded group %s )+�security_group�getr �distribution_groupr r � get_loadparm�get_credentialsr r � ExceptionZam_pdc�lowerr ZDOMAIN_RID_PROTECTED_USERSr Zget_default_basedn�dom_sidZget_domain_sidZget_wellknown_dnr r r r r Z add_child�ldb�LdbError� RuntimeErrorr �add�argsZERR_CONSTRAINT_VIOLATION�search�lenr= ZERR_ENTRY_ALREADY_EXISTSZ SCOPE_BASE�decoder �outf�writeZnewgroup)%�selfr2 r& r$ r% r( rI Z group_scopeZ group_typer9 � mail_addressr: Z gid_numberZ nis_domainZspecialZgtyper7 �creds�samdb�eZinvalid_optionZspecial_groupsZ special_group�rid�group_dnZ object_sidZ system_flags�msgZnumZestr�res�nameZ with_nameZgot_nameZnamedZgot_group_typeZsid� rh � /usr/lib64/python3.6/group.py�runv s( $ $ " ""$ zcmd_group_add.run) NNNNNNNNNNNNF)�__name__� __module__� __qualname__�__doc__�synopsis�options� SambaOptions�VersionOptions�CredentialsOptions�takes_optiongroupsr �str�int� takes_options� takes_argsrj rh rh rh ri r# : s2 r# c @ sL e Zd ZdZdZejejejd�Z e ddde ddd �gZ d gZ dd d �Zd S )�cmd_group_deletea� Deletes an AD group. The command deletes an existing AD group from the Active Directory domain. The groupname specified on the command is the sAMAccountName. Deleting a group is a permanent operation. When a group is deleted, all permissions and rights that users in the group had inherited from the group account are deleted as well. The command may be run from the root userid or another authorized userid. The -H or --URL option can be used to execute the command on a remote server. Example1: samba-tool group delete Group1 -H ldap://samba.samdom.example.com -Uadministrator%passw0rd Example1 shows how to delete an AD group from a remote LDAP server. The -U parameter is used to pass the userid and password of a user that exists on the remote server and is authorized to issue the command on that server. Example2: sudo samba-tool group delete Group2 Example2 deletes group Group2 from the local server. The command is run under root using the sudo command. z%prog <groupname> [options])r$ r% r& z-Hz--URLz%LDB URL for database or target serverr' r( )r) r* r+ r, r2 Nc C s� |j � }|j|dd�}t|t� ||d�}dtj|� } y(|j|j� tj| dgd�} | d j } W n t k r~ t d| ��Y nX y|j | � W n0 t k r� } zt d | | ��W Y d d } ~ X nX | jjd | � d S ) NT)r3 )r4 r5 r6 r7 z)(&(sAMAccountName=%s)(objectClass=group))r= )rF rG rB rC r zUnable to find group "%s"zFailed to remove group "%s"zDeleted group %s )rO rP r r rT � binary_encoderY � domain_dn� SCOPE_SUBTREEr= � IndexErrorr �deleterQ r\ r] ) r^ r2 r& r$ r% r( r7 r` ra �filterrf rd rb rh rh ri rj v s& zcmd_group_delete.run)NNNN)rk rl rm rn ro rp rq rr rs rt r ru rw rx rj rh rh rh ri ry S s ry c @ sv e Zd ZdZdZejejejd�Z e ddde ddd �e d d e d d �e ddde d�e dde d�gZ ddgZ ddd�ZdS )�cmd_group_add_membersa� Add members to an AD group. This command adds one or more members to an existing Active Directory group. The command accepts one or more group member names separated by commas. A group member may be a user or computer account or another Active Directory group. When a member is added to a group the member may inherit permissions and rights from the group. Likewise, when permission or rights of a group are changed, the changes may reflect in the members through inheritance. The member names specified on the command must be the sAMaccountName. Example1: samba-tool group addmembers supergroup Group1,Group2,User1 -H ldap://samba.samdom.example.com -Uadministrator%passw0rd Example1 shows how to add two groups, Group1 and Group2 and one user account, User1, to the existing AD group named supergroup. The command will be run on a remote server specified with the -H. The -U parameter is used to pass the userid and password of a user authorized to issue the command on the remote server. Example2: sudo samba-tool group addmembers supergroup User2 Example2 shows how to add a single user account, User2, to the supergroup AD group. It uses the sudo command to run as root when issuing the command. zF%prog <groupname> (<listofmembers>]|--member-dn=<member-dn>) [options])r$ r% r& z-Hz--URLz%LDB URL for database or target serverr' r( )r) r* r+ r, z --member-dnzRDN of the new group member to be added. The --object-types option will be ignored.�append)r) r* r0 z--object-typesz�Comma separated list of object types. The types are used to filter the search for the specified members. Valid values are: user, group, computer, serviceaccount, contact and all. Default: user,group,computer�user,group,computer)r) r1 r* z--member-base-dnz:Base DN for group member search. Default is the domain DN.)r) r* r2 zlistofmembers?Nc C s� |j � } |j| dd�} |d kr6|d kr6| j� td��ypt|t� | | d�} g } |d k r^| |7 } |d k rt| |jd�7 } | jd�}|d k r�| j|�}| j|| d||d� W n4 t k r� } ztd| ||f ��W Y d d }~X nX | j j d| � d S ) NT)r3 z6Either listofmembers or --member-dn must be specified.)r4 r5 r6 r7 �,)�add_members_operation� member_types�member_base_dnz+Failed to add members %r to group "%s" - %szAdded members to group %s ) rO rP �usager r r �split�normalize_dn_in_domain�add_remove_group_membersrQ r\ r] )r^ r2 � listofmembersr& r$ r% r( r� � member_dn� object_typesr7 r` ra � groupmembers�group_member_typesrb rh rh ri rj � s2 zcmd_group_add_members.run)NNNNNNNr� )rk rl rm rn ro rp rq rr rs rt r ru rw rx rj rh rh rh ri r� � s6 r� c @ sv e Zd ZdZdZejejejd�Z e ddde ddd �e d d e d d �e ddde d�e dde d�gZ ddgZ ddd�ZdS )�cmd_group_remove_membersa Remove members from an AD group. This command removes one or more members from an existing Active Directory group. The command accepts one or more group member names separated by commas. A group member may be a user or computer account or another Active Directory group that is a member of the group specified on the command. When a member is removed from a group, inherited permissions and rights will no longer apply to the member. Example1: samba-tool group removemembers supergroup Group1 -H ldap://samba.samdom.example.com -Uadministrator%passw0rd Example1 shows how to remove Group1 from supergroup. The command will run on the remote server specified on the -H parameter. The -U parameter is used to pass the userid and password of a user authorized to issue the command on the remote server. Example2: sudo samba-tool group removemembers supergroup User1 Example2 shows how to remove a single user account, User2, from the supergroup AD group. It uses the sudo command to run as root when issuing the command. zF%prog <groupname> (<listofmembers>]|--member-dn=<member-dn>) [options])r$ r% r& z-Hz--URLz%LDB URL for database or target serverr' r( )r) r* r+ r, z --member-dnzPDN of the group member to be removed. The --object-types option will be ignored.r� )r) r* r0 z--object-typesz�Comma separated list of object types. The types are used to filter the search for the specified members. Valid values are: user, group, computer, serviceaccount, contact and all. Default: user,group,computer�user,group,computer)r) r1 r* z--member-base-dnz:Base DN for group member search. Default is the domain DN.)r) r* r2 zlistofmembers?Nc C s� |j � } |j| dd�} |d kr6|d kr6| j� td��ypt|t� | | d�} g } |d k r^| |7 } |d k rt| |jd�7 } | jd�}|d k r�| j|�}| j|| d||d� W n4 t k r� } ztd||f |��W Y d d }~X nX | j j d | � d S ) NT)r3 z6Either listofmembers or --member-dn must be specified.)r4 r5 r6 r7 r� F)r� r� r� z+Failed to remove members %r from group "%s"z Removed members from group %s ) rO rP r� r r r r� r� r� rQ r\ r] )r^ r2 r� r& r$ r% r( r� r� r� r7 r` ra r� r� rb rh rh ri rj $ s2 $z cmd_group_remove_members.run)NNNNNNNr� )rk rl rm rn ro rp rq rr rs rt r ru rw rx rj rh rh rh ri r� � s6 r� c @ sr e Zd ZdZdZedddeddd�ed d d d d �eddded�edddd dd�gZej ej ej d�Z ddd�Z dS ) �cmd_group_listzList all groups.z%prog [options]z-Hz--URLz%LDB URL for database or target serverr' r( )r) r* r+ r, z-vz --verbosez3Verbose output, showing group type and group scope.r/ )r) r0 z-bz --base-dnzSpecify base DN to use.)r) r* z --full-dn�full_dnFz)Display DN instead of the sAMAccountName.)r, r1 r0 r) )r$ r& r% Nc C s` |j � }|j|dd�} t|t� | |d�} dg} |r>| ddg7 } | j� } |rT| j|�} | j| tjd| d�} t | �d krxd S |�r| j j d � | j j d � �x�| D �]l}| j j d |j dd d � � t td|d �d@ �}|t ttj d���kr�| j j d� n�|t ttj d���k�r | j j d� n�|t ttj d���k�rF| j j d� n�|t ttj d���k�rl| j j d� n~|t ttj d���k�r�| j j d� nX|t ttj d���k�r�| j j d� n2|t ttj d���k�r�| j j d� n | j j d� t |j dg d ��}| j j d | � q�W nJxH| D ]@}|�r<| j j d |j d � � �q| j j d |j dd d � � �qW d S ) NT)r3 )r4 r5 r6 r7 �samaccountnamerJ �memberz(objectClass=group))rG rB rC r zQGroup Name Group Type Group Scope Members zQ-------------------------------------------------------------------------------- z%-44s)rD z%sl �� r zSecurity Builtin r zSecurity Domain r! zSecurity Global r" zSecurity UniversalzDistribution Global zDistribution Domain zDistribution Universalz )r1 z %6u z%s r= )rO rP r r r{ r� rY rT r| rZ r\ r] rM �hexrv rL rN )r^ r$ r& r% r( �verboseZbase_dnr� r7 r` ra rC r{ rf re Zhgtype� num_membersrh rh ri rj i sV zcmd_group_list.run)NNNNFNF)rk rl rm rn ro r ru rw rp rq rs rr rt rj rh rh rh ri r� O s0 r� c @ sx e Zd ZdZdZedddeddd�ed d d d d �edd d dd�eddd d dd�gZej ej ej d�Z dgZ ddd�ZdS )�cmd_group_list_membersz�List all members of an AD group. This command lists members from an existing Active Directory group. The command accepts one group name. Example1: samba-tool group listmembers "Domain Users" -H ldap://samba.samdom.example.com -Uadministrator%passw0rd z%prog <groupname> [options]z-Hz--URLz%LDB URL for database or target serverr' r( )r) r* r+ r, z--hide-expiredz!Do not list expired group membersFr/ )r) r1 r0 z--hide-disabledz"Do not list disabled group members)r1 r0 r) z --full-dnr� z)Display DN instead of the sAMAccountName.)r, r1 r0 r) )r$ r& r% r2 Nc C s� |j � } |j| dd�} �ypt|t� | | d�} dtj|� } y0| j| j� tj| dgd�} | d j ddd�}W n t k r� t d | ��Y nX t t j|�}|j� \}}d | }d }|dkr�| j� }d | }d }|dkr�d tjtf }d||||f }| j| j� tj|ddgd�} t| �dk�r d S xd| D ]\}|�rJ| jjd|j d� � �q&|j ddd�}|d k�rp|j ddd�}| jjd| � �q&W W n4 tk �r� } zt d||f ��W Y d d }~X nX d S )NT)r3 )r4 r5 r6 r7 z)(&(objectClass=group)(sAMAccountName=%s))r@ )rG rB rC r )rD zUnable to find group "%s"z<SID=%s>rE z>(|(!(accountExpires=*))(accountExpires=0)(accountExpires>=%u))z (!(userAccountControl:%s:=%u))z*(&(|(primaryGroupID=%s)(memberOf=%s))%s%s)ZsamAccountName�cnz%s r= z)Failed to list members of "%s" group - %s)rO rP r r rT rz rY r{ r| rM r} r r r rS r� Z get_nttimeZOID_COMPARATOR_ANDr rZ r\ r] rQ )r^ r2 r& r$ r% r( Z hide_expiredZ hide_disabledr� r7 r` ra Z search_filterrf Zgroup_sid_binaryZ group_sidZ group_dom_sidrc Z group_sid_dnZfilter_expiresZcurrent_nttimeZfilter_disabledr re � member_namerb rh rh ri rj � sX zcmd_group_list_members.run)NNNNFFF)rk rl rm rn ro r ru rw rp rq rs rr rt rx rj rh rh rh ri r� � s6 r� c @ sN e Zd ZdZdZedddeddd�gZd d gZe j e j e j d �Z dd d�Zd S )�cmd_group_movea� Move a group to an organizational unit/container. This command moves a group object into the specified organizational unit or container. The groupname specified on the command is the sAMAccountName. The name of the organizational unit or container can be specified as a full DN or without the domainDN component. The command may be run from the root userid or another authorized userid. The -H or --URL= option can be used to execute the command against a remote server. Example1: samba-tool group move Group1 'OU=OrgUnit,DC=samdom.DC=example,DC=com' \ -H ldap://samba.samdom.example.com -U administrator Example1 shows how to move a group Group1 into the 'OrgUnit' organizational unit on a remote LDAP server. The -H parameter is used to specify the remote target server. Example2: samba-tool group move Group1 CN=Users Example2 shows how to move a group Group1 back into the CN=Users container on the local server. z+%prog <groupname> <new_parent_dn> [options]z-Hz--URLz%LDB URL for database or target serverr' r( )r) r* r+ r, r2 � new_parent_dn)r$ r& r% Nc ( C sT |j � }|j|dd�}t|t� ||d�} tj| | j� �} dtj|� } y | j| | tj d�} | d j } W n t k r� t d| ��Y nX y| j |�}W n4 tk r� } zt d||jf ��W Y d d }~X nX tj| t| ��}|jt| �d � |j|� y| j| |� W n2 tk �r: } zt d | |��W Y d d }~X nX | jjd ||f � d S ) NT)r3 )r4 r5 r6 r7 z)(&(sAMAccountName=%s)(objectClass=group)))rF rB rG r zUnable to find group "%s"z Invalid new_parent_dn "%s": %sr zFailed to move group "%s"zMoved group "%s" into "%s" )rO rP r r rT �Dnr{ rz rY r| r= r} r r� rQ �messageru Zremove_base_componentsrZ �add_base�renamer\ r] )r^ r2 r� r& r$ r% r( r7 r` ra r{ r rf rd Zfull_new_parent_dnrb Zfull_new_group_dnrh rh ri rj : s8 zcmd_group_move.run)NNNN)rk rl rm rn ro r ru rw rx rp rq rs rr rt rj rh rh rh ri r� s r� c @ sZ e Zd ZdZdZedddeddd�ed d ed d �gZd gZe j e j e j d�Z ddd�ZdS )�cmd_group_showa� Display a group AD object. This command displays a group object and it's attributes in the Active Directory domain. The group name specified on the command is the sAMAccountName of the group. The command may be run from the root userid or another authorized userid. The -H or --URL= option can be used to execute the command against a remote server. Example1: samba-tool group show Group1 -H ldap://samba.samdom.example.com \ -U administrator --password=passw1rd Example1 shows how to display a group's attributes in the domain against a remote LDAP server. The -H parameter is used to specify the remote target server. Example2: samba-tool group show Group2 Example2 shows how to display a group's attributes in the domain against a local LDAP server. Example3: samba-tool group show Group3 --attributes=member,objectGUID Example3 shows how to display a groups objectGUID and member attributes. z %prog <group name> [options]z-Hz--URLz%LDB URL for database or target serverr' r( )r) r* r+ r, z --attributesz:Comma separated list of attributes, which will be printed.� group_attrs)r) r* r, r2 )r$ r& r% Nc C s� |j � }|j|dd�}t|t� ||d�} d } |r:|jd�} dtj|� } | j� } y"| j| | tj | d�} | d j }W n t k r� t d| ��Y nX x$| D ] }t j| |�}| jj|� q�W d S ) NT)r3 )r4 r5 r6 r7 r� z,(&(objectCategory=group)(sAMAccountName=%s)))rF rB rG rC r zUnable to find group "%s")rO rP r r r� rT rz r{ rY r| r= r} r r �get_ldif_for_editorr\ r] )r^ r2 r& r$ r% r( r� r7 r` ra rC r �domaindnrf Zuser_dnre Z group_ldifrh rh ri rj � s& zcmd_group_show.run)NNNNN)rk rl rm rn ro r ru rw rx rp rq rs rr rt rj rh rh rh ri r� ^ s r� c @ sN e Zd ZdZdZedddeddd�gZej ej ej d �Z d d � Z dd d�Zd S )�cmd_group_statsz+Summary statistics about group memberships.z%prog [options]z-Hz--URLz%LDB URL for database or target serverr' r( )r) r* r+ r, )r$ r& r% c C s6 d}x,|j � D ] \}}||kr||kr||7 }qW |S )Nr )�items)r^ Z range_minZ range_max� group_freqsZ total_count�members�countrh rh ri � num_in_range� s z cmd_group_stats.num_in_rangeNc C sx |j � }|j|dd�}t|t� ||d�}|j� }|j|tjdddgd�} i } d} x<| D ]4} t| j d��} t | j dg d ��}|| | < | |7 } qVW | j }| j j d � | j j d � | j j d j|�� | j j d j| �� | t|� }| j j d| � t| j� �}t| j� �}|jt|��}|| }| j j dj||| �� |j� |d }|| }|d dk�rl|||d d }| j j dj|�� tt�}x&| j� D ]\}}|| d7 < �q�W dIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdD|fg}| j j dE� | j j d � xb|D ]Z}|d }|d } ||k�r*P | j|| |�}|dk�r dFj|| �} | j j dG| |f � �q W | j j dH� d S )cNT)r3 )r4 r5 r6 r7 z(objectClass=group)r� r� )rG rB rC r )r1 z Group membership statistics* z2------------------------------------------------- zTotal groups: {0} zTotal memberships: {0} z Average members per group: %.2f zMax members: {0} ({1}) � r z Median members per group: {0} � � � � � � � � � � � � �' �( �1 �2 �; �< �E �F �O �P �Y �Z �c �d � � �� �� � � �+ �, � � �� �� �� �� �� �� � � � � � � �' i' z Members Number of Groups z{0}-{1}z %13s %u z7 * Note this does not include nested group memberships )r r )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )r� r� )rO rP r r r{ rY rT r| ru rM rZ r� r\ r] �format�float�list�keys�values�index�max�sortr rv r� r� ) r^ r$ r& r% r( r7 r` ra r{ rf Zgroup_assignmentsZtotal_membershipsre rg r� Z num_groupsZaverageZ group_namesZ group_membersrD Z max_membersZmidpointZmedianr� r< ZbandsZbandZ band_startZband_endZband_strrh rh ri rj � sn zcmd_group_stats.run)NNNN)rk rl rm rn ro r ru rw rp rq rs rr rt r� rj rh rh rh ri r� � s r� c @ sX e Zd ZdZdZedddeddd�ed d ed �gZd gZe j e j e j d �Z ddd�ZdS )�cmd_group_edita Modify Group AD object. This command will allow editing of a group account in the Active Directory domain. You will then be able to add or change attributes and their values. The groupname specified on the command is the sAMAccountName. The command may be run from the root userid or another authorized userid. The -H or --URL= option can be used to execute the command against a remote server. Example1: samba-tool group edit Group1 -H ldap://samba.samdom.example.com \ -U administrator --password=passw1rd Example1 shows how to edit a groups attributes in the domain against a remote LDAP server. The -H parameter is used to specify the remote target server. Example2: samba-tool group edit Group2 Example2 shows how to edit a groups attributes in the domain against a local server. Example3: samba-tool group edit Group3 --editor=nano Example3 shows how to edit a groups attributes in the domain against a local server using the 'nano' editor. z%prog <groupname> [options]z-Hz--URLz%LDB URL for database or target serverr' r( )r) r* r+ r, z--editorzQEditor to use instead of the system default, or 'vi' if no system default is set.)r) r* r2 )r$ r& r% Nc 5 C s� |j � }|j|dd�}t|t� ||d�} dtj|� } | j� } y | j| | tjd�} | d j } W n t k r~ t d| ��Y nX t | �dkr�t d |t | �f ��| d }t j| |�}|d kr�tjjd �}|d kr�d }tjd d ��|}|jt|�� |j� yt||jg� W n. tk �r8 } ztd|��W Y d d }~X nX t|j��}|j� }W d Q R X W d Q R X | j |�}t |�d }| j ||�}t |�dk�r�| j jd� d S y| j |� W n2 t!k �r� } zt d| |��W Y d d }~X nX | j jd| � d S )NT)r3 )r4 r5 r6 r7 z)(&(sAMAccountName=%s)(objectClass=group)))rF rB rG r zUnable to find group "%s"r z'Invalid number of results: for "%s": %dZEDITORZviz.tmp)�suffixzERROR: zNothing to do z Failed to modify group '%s': z!Modified group '%s' successfully )"rO rP r r rT rz r{ rY r| r= r} r rZ r r� �os�environrM �tempfileZNamedTemporaryFiler] r �flushr rg r �open�readZ parse_ldif�nextZmsg_diffr\ �modifyrQ )r^ r2 r& r$ r% r( Zeditorr7 r` ra r r� rf rd re Z result_ldifZt_filerb Z edited_fileZedited_messageZ msgs_editedZ msg_editedZ res_msg_diffrh rh ri rj E sV zcmd_group_edit.run)NNNNN)rk rl rm rn ro r ru rw rx rp rq rs rr rt rj rh rh rh ri r� s ! r� c @ sN e Zd ZdZdZedddeddd�gZd d gZe j e j e j d �Z dd d�Zd S )�cmd_group_add_unix_attrsa� Add RFC2307 attributes to a group. This command adds Unix attributes to a group account in the Active Directory domain. The groupname specified on the command is the sAMaccountName. Unix (RFC2307) attributes will be added to the group account. Add 'idmap_ldb:use rfc2307 = Yes' to smb.conf to use these attributes for UID/GID mapping. The command may be run from the root userid or another authorized userid. The -H or --URL= option can be used to execute the command against a remote server. Example1: samba-tool group addunixattrs Group1 10000 Example1 shows how to add RFC2307 attributes to a domain enabled group account. The groups Unix ID will be set to '10000', provided this ID isn't already in use. z'%prog <groupname> <gidnumber> [options]z-Hz--URLz%LDB URL for database or target serverr' r( )r) r* r+ r, r2 rK )r$ r& r% Nc C s@ |j � }|j|�}t|t� ||d�} | j� } djtj|��} | j| tj | d�} t | �dkrht dj|���| d j } d| d kr�t dj|���dj|�} | j| tj | d�} t | �dkr�t d j|���|j d �s�| jjd � d j| |�}y| j|� W n6 tjk �r( } zt d j||���W Y d d }~X nX | jjdj|�� d S )N)r4 r5 r6 r7 z(samaccountname={}))rG rB r zUnable to find group '{}'Z gidNumberzGroup {} is a Unix group.z$(&(objectClass=group)(gidNumber={}))zgidNumber {} already used.zidmap_ldb:use rfc2307z�You are setting a Unix/RFC2307 GID. You may want to set 'idmap_ldb:use rfc2307 = Yes' in smb.conf to use the attributes for XID/SID-mapping. z: dn: {0} changetype: modify add: gidNumber gidNumber: {1} z!Failed to modify group '{0}': {1}z!Modified Group '{}' successfully )rO rP r r r{ r� rT rz rY r| rZ r r= rM r\ r] Z modify_ldifrU )r^ r2 rK r& r$ r% r( r7 r` ra r� r rf rd Z group_modrb rh rh ri rj � s: z cmd_group_add_unix_attrs.run)NNNN)rk rl rm rn ro r ru rw rx rp rq rs rr rt rj rh rh rh ri r� s r� c @ s| e Zd ZdZdZedddeddd�ed d ed �ed d dd�edded �edded �gZdgZe j e j e j d�Z ddd�ZdS )�cmd_group_renamea� Rename a group and related attributes. This command allows to set the group's name related attributes. The group's CN will be renamed automatically. The group's CN will be the sAMAccountName. Use the --force-new-cn option to specify the new CN manually and the --reset-cn to reset this change. Use an empty attribute value to remove the specified attribute. The groupname specified on the command is the sAMAccountName. The command may be run locally from the root userid or another authorized userid. The -H or --URL= option can be used to execute the command against a remote server. Example1: samba-tool group rename employees --samaccountname=staff Example1 shows how to change the samaccountname of a group 'employees' to 'staff'. The CN of the group employees will also be changed to 'staff', if the previous CN was the previous sAMAccountName. Example2: samba-tool group rename employees --mail-address='staff@company.com' \ -H ldap://samba.samdom.example.com -U administrator Example2 shows how to rename the mail address of a group 'employees' to 'staff@company.com'. The -H parameter is used to specify the remote target server. z%prog <groupname> [options]z-Hz--URLz%LDB URL for database or target serverr' r( )r) r* r+ r, z--force-new-cnz;Specify a new CN (RND) instead of using the sAMAccountName.)r) r* z --reset-cnzqSet the CN (RDN) to the sAMAccountName. Use this option to reset the changes made with the --force-new-cn option.r/ )r) r0 z--mail-addresszNew mail addressz--samaccountnamez,New account name (sAMAccountName/logon name)r2 )r$ r& r% Nc C sz |r| rt d��|dkr t d��|dkr0t d��|j� } |j| dd�} t|t� | | d�} tj| | j� �} dtj|� }y,| j | tj |d d d gd �}|d }|j }W n t k r� t d| ��Y nX |j � }|d d }|d k r�|}n|d k r�|}n|d }|d }t|�t|�k�o4t|�t|�k�p4| �p4t|�}tj| d| �}|j|� tj� }||_ | j||d |� | j||d |� t|�d k}| j� y&|�r�| j|� |�r�| j||� W n: tk �r� } z | j� t d| |��W Y d d }~X nX | j� |�r| jjd|||f � |�rv| jjd| � xF|j � D ]:}|dk�rJ�q8| jjd||| �rf|| ndf � �q8W d S )NzEIt is not allowed to specify --force-new-cn together with --reset-cn.rE z8Failed to rename group - delete protected attribute 'CN'zDFailed to rename group - delete protected attribute 'sAMAccountName'T)r3 )r4 r5 r6 r7 z)(&(objectClass=group)(samaccountname=%s))r> r� Zmail)rF rG rB rC r zUnable to find group "%s"zCN=%szFailed to rename group "%s"z8Renamed CN of group "%s" from "%s" to "%s" successfully zCFollowing attributes of group "%s" have been changed successfully: r= z%s: %s z [removed]) r rO rP r r rT r� r{ rz rY r| r= r} �parentru �boolr� ZMessageZprepare_attr_replacerZ Ztransaction_startr� r� rQ Ztransaction_cancelZtransaction_commitr\ r] r� ) r^ r2 r& r$ r% r( r_ r� Z force_new_cnZreset_cnr7 r` ra r{ r rf Z old_grouprd Zgroup_parent_dnZold_cnZnew_cnZ expected_cnZmust_change_cnZ new_group_dnr� Zgroup_attributes_changedrb �attrrh rh ri rj s� zcmd_group_rename.run)NNNNNNNN)rk rl rm rn ro r ru rw rx rp rq rs rr rt rj rh rh rh ri r� � s0 " r� c @ s� e Zd ZdZi Ze� ed< e� ed< e� ed< e� ed< e� ed< e � ed< e � ed< e � ed < e � ed < e � ed < e� ed < e� ed < e� ed< dS )� cmd_groupzGroup management.rW Zcreater~ ZeditZ addmembersZ removemembersr� Z listmembersZmoveZshowZstatsZ addunixattrsr� N)rk rl rm rn Z subcommandsr# ry r� r� r� r� r� r� r� r� r� r� rh rh rh ri r� x s r� )<Z samba.getoptZgetoptrp Z samba.netcmdr r r r rT Z samba.ndrr r Z samba.dcerpcr Z samba.authr Z samba.samdbr Z samba.dsdbr r r r r r r r r r r r r � collectionsr � subprocessr r Z samba.commonr r r� r� rE r �dictrL rN r# ry r� r� r� r� r� r� r� r� r� r� r� rh rh rh ri �<module> sH < >`^ViPOfl_
| ver. 1.1 | |
.
| PHP 8.3.30 | Ð“ÐµÐ½ÐµÑ€Ð°Ñ†Ð¸Ñ Ñтраницы: 0 |
proxy
|
phpinfo
|
ÐаÑтройка