Ejemplo n.º 1
0
function build($nopid = false)
{
    if (isset($GLOBALS["BUILD_EXECUTED"])) {
        progress_logs(20, "{continue}", "Already executed");
        return;
    }
    $GLOBALS["BUILD_EXECUTED"] = true;
    $unix = new unix();
    $sock = new sockets();
    $function = __FUNCTION__;
    $EnableKerbAuth = $sock->GET_INFO("EnableKerbAuth");
    if (!is_numeric($EnableKerbAuth)) {
        $EnableKerbAuth = 0;
    }
    if ($EnableKerbAuth == 0) {
        progress_logs(110, "{authentication_via_activedirectory_is_disabled}", "{authentication_via_activedirectory_is_disabled}");
        if (is_file("/etc/monit/conf.d/winbindd.monitrc")) {
            @unlink("/etc/monit/conf.d/winbindd.monitrc");
        }
        return;
    }
    if (!$nopid) {
        $timefile = "/etc/artica-postfix/pids/" . basename(__FILE__) . ".time";
        $pidfile = "/etc/artica-postfix/pids/" . basename(__FILE__) . ".pid";
        $pid = $unix->get_pid_from_file($pidfile);
        if ($unix->process_exists($pid, basename(__FILE__))) {
            $timeExec = intval($unix->PROCCESS_TIME_MIN($pid));
            if ($GLOBALS["OUTPUT"]) {
                progress_logs(20, "{join_activedirectory_domain}", "Process {$pid} already exists since {$timeExec}Mn");
            }
            writelogs("Process {$pid} already exists since {$timeExec}Mn", __FUNCTION__, __FILE__, __LINE__);
            if ($timeExec > 5) {
                $kill = $unix->find_program("kill");
                progress_logs(20, "{join_activedirectory_domain}", "killing old pid {$pid} (already exists since {$timeExec}Mn)");
                unix_system_kill_force($pid);
            } else {
                return;
            }
        }
        $time = $unix->file_time_min($timefile);
        if ($time < 2) {
            if ($GLOBALS["OUTPUT"]) {
                progress_logs(20, "{join_activedirectory_domain}", "2mn minimal to run this script currently ({$time}Mn)");
            }
            writelogs("2mn minimal to run this script currently ({$time}Mn)", __FUNCTION__, __FILE__, __LINE__);
            return;
        }
    }
    pinglic(true);
    $mypid = getmypid();
    @file_put_contents($pidfile, $mypid);
    progress_logs(20, "{join_activedirectory_domain} Running PID {$mypid}", "Running PID {$mypid}", __LINE__);
    writelogs("Running PID {$mypid}", __FUNCTION__, __FILE__, __LINE__);
    $wbinfo = $unix->find_program("wbinfo");
    $nohup = $unix->find_program("nohup");
    $tar = $unix->find_program("tar");
    $ntpdate = $unix->find_program("ntpdate");
    $php5 = $unix->LOCATE_PHP5_BIN();
    if (!is_file($wbinfo)) {
        shell_exec("{$php5} /usr/share/artica-postfix exec.apt-get.php --sources-list");
        shell_exec("{$nohup} /usr/share/artica-postfix/bin/setup-ubuntu --check-samba >/dev/null 2>&1 &");
        $wbinfo = $unix->find_program("wbinfo");
    }
    if (!is_file($wbinfo)) {
        progress_logs(20, "{join_activedirectory_domain}", "Auth Winbindd, samba is not installed");
        progress_logs(100, "{finish}", "Auth Winbindd, samba is not installed");
        return;
    }
    if (!checkParams()) {
        progress_logs(20, "{join_activedirectory_domain} {failed}", "Auth Winbindd, misconfiguration failed");
        progress_logs(100, "{finish}", "Auth Winbindd, misconfiguration failed");
        return;
    }
    $unix = new unix();
    $chmod = $unix->find_program("chmod");
    $msktutil = check_msktutil();
    $kdb5_util = $unix->find_program("kdb5_util");
    $kadmin_bin = $unix->find_program("kadmin");
    $netbin = $unix->LOCATE_NET_BIN_PATH();
    if (!is_file($msktutil)) {
        return;
    }
    @mkdir("/var/log/samba", 0755, true);
    @mkdir("/var/run/samba", 0755, true);
    $uname = posix_uname();
    $mydomain = $uname["domainname"];
    $myFullHostname = $unix->hostname_g();
    $myNetBiosName = $unix->hostname_simple();
    $enctype = null;
    $sock = new sockets();
    $array = unserialize(base64_decode($sock->GET_INFO("KerbAuthInfos")));
    $hostname = strtolower(trim($array["WINDOWS_SERVER_NETBIOSNAME"])) . "." . strtolower(trim($array["WINDOWS_DNS_SUFFIX"]));
    $domainUp = strtoupper($array["WINDOWS_DNS_SUFFIX"]);
    $domaindow = strtolower($array["WINDOWS_DNS_SUFFIX"]);
    $kinitpassword = $array["WINDOWS_SERVER_PASS"];
    $kinitpassword = $unix->shellEscapeChars($kinitpassword);
    $ipaddr = trim($array["ADNETIPADDR"]);
    $UseADAsNameServer = $sock->GET_INFO("UseADAsNameServer");
    if (!is_numeric($UseADAsNameServer)) {
        $UseADAsNameServer = 0;
    }
    if ($UseADAsNameServer == 1) {
        if (preg_match("#[0-9\\.]+#", $ipaddr)) {
            progress_logs(8, "{apply_settings}", "Patching Resolv.conf");
            PatchResolvConf($ipaddr);
        }
    }
    if ($ipaddr != null) {
        $ipaddrZ = explode(".", $ipaddr);
        while (list($num, $a) = each($ipaddrZ)) {
            $ipaddrZ[$num] = intval($a);
        }
        $ipaddr = @implode(".", $ipaddrZ);
    }
    progress_logs(9, "{apply_settings} Synchronize time", "Synchronize time" . " in line " . __LINE__);
    sync_time();
    progress_logs(10, "{apply_settings} Check kerb5", "Check kerb5..in line " . __LINE__);
    if (!krb5conf(12)) {
        progress_logs(110, "{apply_settings} Check kerb5 {failed}", "Check kerb5..in line " . __LINE__);
        return;
    }
    progress_logs(15, "{apply_settings} Check mskt", "Check msktutils in line " . __LINE__);
    if (!run_msktutils()) {
        progress_logs(110, "{apply_settings} Check mskt {failed}", "Check mskt..in line " . __LINE__);
        return;
    }
    progress_logs(15, "{apply_settings} netbin", "netbin -> {$netbin} in line " . __LINE__);
    if (is_file($netbin)) {
        try {
            progress_logs(15, "{apply_settings} netbin", "netbin -> SAMBA_PROXY()  in line " . __LINE__);
            SAMBA_PROXY();
        } catch (Exception $e) {
            progress_logs(15, "{failed}", "Exception Error: Message: " . $e->getMessage());
        }
    }
    progress_logs(19, "{apply_settings} [kadmin_bin]", $kadmin_bin);
    progress_logs(19, "{apply_settings} [netbin]", $netbin);
    if (is_file("{$netbin}")) {
        progress_logs(20, "{join_activedirectory_domain}", "netbin -> JOIN_ACTIVEDIRECTORY() ");
        JOIN_ACTIVEDIRECTORY();
        // 29%
    }
    progress_logs(51, "{restarting_winbind} 1", "winbind_priv();");
    winbind_priv(false, 52);
    progress_logs(60, "{restarting_winbind} 2", "winbind_priv();");
    winbindd_monit();
    progress_logs(65, "{restarting_winbind} 3", "winbind_priv();");
    $php5 = $unix->LOCATE_PHP5_BIN();
    if (!is_file("/etc/init.d/winbind")) {
        shell_exec("{$php5} /usr/share/artica-postfix/exec.initslapd.php --winbind");
    }
    progress_logs(65, "{restarting_winbind}", "winbind_priv();");
    system("/etc/init.d/winbind restart --force");
    return true;
}
Ejemplo n.º 2
0
function build()
{
    $sock = new sockets();
    $EnableKerbAuth = $sock->GET_INFO("EnableKerbAuth");
    if (!is_numeric("{$EnableKerbAuth}")) {
        $EnableKerbAuth = 0;
    }
    if ($EnableKerbAuth == 0) {
        echo "Starting......: Kerberos, disabled\n";
        return;
    }
    if (!checkParams()) {
        echo "Starting......: Kerberos, misconfiguration failed\n";
        return;
    }
    $unix = new unix();
    $msktutil = $unix->find_program("msktutil");
    $hostname_bin = $unix->find_program("hostname");
    $kdb5_util = $unix->find_program("kdb5_util");
    $kadmin_bin = $unix->find_program("kadmin");
    $netbin = $unix->LOCATE_NET_BIN_PATH();
    if (!is_file("{$msktutil}")) {
        echo "Starting......: Kerberos, msktutil no such binary\n";
        return;
    }
    if (!is_file("{$hostname_bin}")) {
        echo "Starting......: Kerberos, hostname no such binary\n";
        return;
    }
    exec("{$hostname_bin} -d 2>&1", $results);
    $mydomain = trim(@implode("", $results));
    unset($results);
    exec("{$hostname_bin} -f 2>&1", $results);
    $myFullHostname = trim(@implode("", $results));
    unset($results);
    exec("{$hostname_bin} -s 2>&1", $results);
    $myNetBiosName = trim(@implode("", $results));
    $enctype = null;
    $sock = new sockets();
    $array = unserialize(base64_decode($sock->GET_INFO("KerbAuthInfos")));
    if ($array["WINDOWS_SERVER_TYPE"] == "WIN_2003") {
        $t[] = "# For Windows 2003:";
        $t[] = " default_tgs_enctypes = rc4-hmac des-cbc-crc des-cbc-md5";
        $t[] = " default_tkt_enctypes = rc4-hmac des-cbc-crc des-cbc-md5";
        $t[] = " permitted_enctypes = rc4-hmac des-cbc-crc des-cbc-md5";
        $t[] = "";
    }
    if ($array["WINDOWS_SERVER_TYPE"] == "WIN_2008AES") {
        $t[] = "; for Windows 2008 with AES";
        $t[] = " default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5";
        $t[] = " default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5";
        $t[] = " permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5";
        $t[] = "";
        $enctype = " --enctypes 28";
    }
    $hostname = strtolower(trim($array["WINDOWS_SERVER_NETBIOSNAME"])) . "." . strtolower(trim($array["WINDOWS_DNS_SUFFIX"]));
    echo "Starting......: Kerberos, {$hostname}\n";
    echo "Starting......: Kerberos, my domain: \"{$mydomain}\"\n";
    echo "Starting......: Kerberos, my hostname: \"{$myFullHostname}\"\n";
    echo "Starting......: Kerberos, my netbiosname: \"{$myNetBiosName}\"\n";
    $domainUp = strtoupper($array["WINDOWS_DNS_SUFFIX"]);
    $domaindow = strtolower($array["WINDOWS_DNS_SUFFIX"]);
    $kinitpassword = $array["WINDOWS_SERVER_PASS"];
    $kinitpassword = $unix->shellEscapeChars($kinitpassword);
    $f[] = " [logging]";
    $f[] = " default = FILE:/var/log/krb5libs.log";
    $f[] = " kdc = FILE:/var/log/krb5kdc.log";
    $f[] = " admin_server = FILE:/var/log/kadmind.log";
    $f[] = "";
    $f[] = "[libdefaults]";
    $f[] = " default_realm = {$domainUp}";
    $f[] = " dns_lookup_realm = true";
    $f[] = " dns_lookup_kdc = true";
    $f[] = " ticket_lifetime = 24h";
    $f[] = " forwardable = yes";
    $f[] = "";
    @implode("\n", $t);
    $f[] = "[realms]";
    $f[] = " {$domainUp} = {";
    $f[] = "  kdc = {$hostname}";
    $f[] = "  admin_server = {$hostname}";
    $f[] = "  default_domain = {$domainUp}";
    $f[] = " }";
    $f[] = "";
    $f[] = "[domain_realm]";
    $f[] = " .{$domaindow} = {$domainUp}";
    $f[] = " {$domaindow} = {$domainUp}";
    $f[] = "";
    $f[] = "[appdefaults]";
    $f[] = " pam = {";
    $f[] = "   debug = false";
    $f[] = "   ticket_lifetime = 36000";
    $f[] = "   renew_lifetime = 36000";
    $f[] = "   forwardable = true";
    $f[] = "   krb4_convert = false";
    $f[] = "}";
    $f[] = "";
    @file_put_contents("/etc/krb.conf", @implode("\n", $f));
    echo "Starting......: Kerberos, /etc/krb.conf done\n";
    @file_put_contents("/etc/krb5.conf", @implode("\n", $f));
    echo "Starting......: Kerberos, /etc/krb5.conf done\n";
    unset($f);
    $f[] = "lhs=.ns";
    $f[] = "rhs=.{$mydomain}";
    $f[] = "classes=IN,HS";
    @file_put_contents("/etc/hesiod.conf", @implode("\n", $f));
    echo "Starting......: Kerberos, /etc/hesiod.conf done\n";
    unset($f);
    $f[] = "[libdefaults]";
    $f[] = "\t\tdebug = true";
    $f[] = "[kdcdefaults]";
    //$f[]="\tv4_mode = nopreauth";
    $f[] = "\tkdc_ports = 88,750";
    //$f[]="\tkdc_tcp_ports = 88";
    $f[] = "[realms]";
    $f[] = "\t{$domainUp} = {";
    $f[] = "\t\tdatabase_name = /etc/krb5kdc/principal";
    $f[] = "\t\tacl_file = /etc/kadm.acl";
    $f[] = "\t\tdict_file = /usr/share/dict/words";
    $f[] = "\t\tadmin_keytab = FILE:/etc/krb5.keytab";
    $f[] = "\t\tkey_stash_file = /etc/krb5kdc/.k5.{$domainUp}";
    $f[] = "\t\tmaster_key_type = des3-hmac-sha1";
    $f[] = "\t\tsupported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm des:onlyrealm des:afs3";
    $f[] = "\t\tdefault_principal_flags = +preauth";
    $f[] = "\t}";
    $f[] = "";
    if (!is_dir("/usr/share/krb5-kdc")) {
        @mkdir("/usr/share/krb5-kdc", 644, true);
    }
    @file_put_contents("/usr/share/krb5-kdc/kdc.conf", @implode("\n", $f));
    @file_put_contents("/etc/kdc.conf", @implode("\n", $f));
    echo "Starting......: Kerberos, /usr/share/krb5-kdc/kdc.conf done\n";
    echo "Starting......: Kerberos, /etc/kdc.conf done\n";
    unset($f);
    $config = "*/admin *\n";
    @file_put_contents("/etc/kadm.acl", " ");
    @file_put_contents("/usr/share/krb5-kdc/kadm.acl", " ");
    @file_put_contents("/etc/krb5kdc/kadm5.acl", " ");
    echo "Starting......: Kerberos, /etc/kadm.acl done\n";
    RunKinit($array["WINDOWS_SERVER_ADMIN"], $array["WINDOWS_SERVER_PASS"]);
    unset($results);
    if ($GLOBALS["VERBOSE"]) {
        $mskutilverb = " --verbose";
    }
    $cmd = "{$msktutil} -c -b \"CN=COMPUTERS\" -s HTTP/{$myFullHostname} -h {$myFullHostname} --keytab /etc/krb5.keytab";
    $cmd = $cmd . " --computer-name {$myNetBiosName} --upn HTTP/{$myFullHostname} --server {$hostname}{$enctype}{$mskutilverb} 2>&1";
    echo "Starting......: msktutil, {$cmd}\n";
    exec($cmd, $results);
    while (list($num, $a) = each($results)) {
        echo "Starting......: msktutil, {$a}\n";
    }
    if (is_file("{$kdb5_util}")) {
        $cmd = "{$kdb5_util} create -r {$domainUp} -s -P {$kinitpassword}";
        if ($GLOBALS["VERBOSE"]) {
            echo "Starting......:  {$cmd}\n";
        }
        unset($results);
        exec($cmd, $results);
        while (list($num, $a) = each($results)) {
            echo "Starting......: kdb5_util, {$a}\n";
        }
    }
    if (is_file("{$kadmin_bin}")) {
    }
    //kadmin -p Administrateur "addprinc -randkey cifs/bdc.touzeau.com" -w DavidTouzeau180872
    if (is_file("{$netbin}")) {
        JOIN_ACTIVEDIRECTORY();
    }
}
Ejemplo n.º 3
0
    die;
}
if ($argv[1] == '--check-privs') {
    recycles_privileges($argv[2], $argv[3]);
    die;
}
if ($argv[1] == '--smbstatus') {
    smbstatus_injector();
    die;
}
if ($argv[1] == '--smbpasswd') {
    smbpasswd();
    die;
}
if ($argv[1] == '--join') {
    JOIN_ACTIVEDIRECTORY();
    die;
}
if ($argv[1] == '--help') {
    help_output();
    die;
}
function help_output()
{
    echo "--users....................: Save users number in cache\n";
    echo "--fix-etc-hosts............: Fix hostname in /etc/hosts\n";
    echo "--ads-destroy..............: Destroy Active directory connection\n";
    echo "--ads......................: Create Active directory connection\n";
    echo "--ping-ads.................: refresh Active Directory connection\n";
    echo "--logon-scripts............: Perform logon scripts installation\n";
    echo "--administrator............: update administrator informations\n";