function build($nopid = false) { if (isset($GLOBALS["BUILD_EXECUTED"])) { progress_logs(20, "{continue}", "Already executed"); return; } $GLOBALS["BUILD_EXECUTED"] = true; $unix = new unix(); $sock = new sockets(); $function = __FUNCTION__; $EnableKerbAuth = $sock->GET_INFO("EnableKerbAuth"); if (!is_numeric($EnableKerbAuth)) { $EnableKerbAuth = 0; } if ($EnableKerbAuth == 0) { progress_logs(110, "{authentication_via_activedirectory_is_disabled}", "{authentication_via_activedirectory_is_disabled}"); if (is_file("/etc/monit/conf.d/winbindd.monitrc")) { @unlink("/etc/monit/conf.d/winbindd.monitrc"); } return; } if (!$nopid) { $timefile = "/etc/artica-postfix/pids/" . basename(__FILE__) . ".time"; $pidfile = "/etc/artica-postfix/pids/" . basename(__FILE__) . ".pid"; $pid = $unix->get_pid_from_file($pidfile); if ($unix->process_exists($pid, basename(__FILE__))) { $timeExec = intval($unix->PROCCESS_TIME_MIN($pid)); if ($GLOBALS["OUTPUT"]) { progress_logs(20, "{join_activedirectory_domain}", "Process {$pid} already exists since {$timeExec}Mn"); } writelogs("Process {$pid} already exists since {$timeExec}Mn", __FUNCTION__, __FILE__, __LINE__); if ($timeExec > 5) { $kill = $unix->find_program("kill"); progress_logs(20, "{join_activedirectory_domain}", "killing old pid {$pid} (already exists since {$timeExec}Mn)"); unix_system_kill_force($pid); } else { return; } } $time = $unix->file_time_min($timefile); if ($time < 2) { if ($GLOBALS["OUTPUT"]) { progress_logs(20, "{join_activedirectory_domain}", "2mn minimal to run this script currently ({$time}Mn)"); } writelogs("2mn minimal to run this script currently ({$time}Mn)", __FUNCTION__, __FILE__, __LINE__); return; } } pinglic(true); $mypid = getmypid(); @file_put_contents($pidfile, $mypid); progress_logs(20, "{join_activedirectory_domain} Running PID {$mypid}", "Running PID {$mypid}", __LINE__); writelogs("Running PID {$mypid}", __FUNCTION__, __FILE__, __LINE__); $wbinfo = $unix->find_program("wbinfo"); $nohup = $unix->find_program("nohup"); $tar = $unix->find_program("tar"); $ntpdate = $unix->find_program("ntpdate"); $php5 = $unix->LOCATE_PHP5_BIN(); if (!is_file($wbinfo)) { shell_exec("{$php5} /usr/share/artica-postfix exec.apt-get.php --sources-list"); shell_exec("{$nohup} /usr/share/artica-postfix/bin/setup-ubuntu --check-samba >/dev/null 2>&1 &"); $wbinfo = $unix->find_program("wbinfo"); } if (!is_file($wbinfo)) { progress_logs(20, "{join_activedirectory_domain}", "Auth Winbindd, samba is not installed"); progress_logs(100, "{finish}", "Auth Winbindd, samba is not installed"); return; } if (!checkParams()) { progress_logs(20, "{join_activedirectory_domain} {failed}", "Auth Winbindd, misconfiguration failed"); progress_logs(100, "{finish}", "Auth Winbindd, misconfiguration failed"); return; } $unix = new unix(); $chmod = $unix->find_program("chmod"); $msktutil = check_msktutil(); $kdb5_util = $unix->find_program("kdb5_util"); $kadmin_bin = $unix->find_program("kadmin"); $netbin = $unix->LOCATE_NET_BIN_PATH(); if (!is_file($msktutil)) { return; } @mkdir("/var/log/samba", 0755, true); @mkdir("/var/run/samba", 0755, true); $uname = posix_uname(); $mydomain = $uname["domainname"]; $myFullHostname = $unix->hostname_g(); $myNetBiosName = $unix->hostname_simple(); $enctype = null; $sock = new sockets(); $array = unserialize(base64_decode($sock->GET_INFO("KerbAuthInfos"))); $hostname = strtolower(trim($array["WINDOWS_SERVER_NETBIOSNAME"])) . "." . strtolower(trim($array["WINDOWS_DNS_SUFFIX"])); $domainUp = strtoupper($array["WINDOWS_DNS_SUFFIX"]); $domaindow = strtolower($array["WINDOWS_DNS_SUFFIX"]); $kinitpassword = $array["WINDOWS_SERVER_PASS"]; $kinitpassword = $unix->shellEscapeChars($kinitpassword); $ipaddr = trim($array["ADNETIPADDR"]); $UseADAsNameServer = $sock->GET_INFO("UseADAsNameServer"); if (!is_numeric($UseADAsNameServer)) { $UseADAsNameServer = 0; } if ($UseADAsNameServer == 1) { if (preg_match("#[0-9\\.]+#", $ipaddr)) { progress_logs(8, "{apply_settings}", "Patching Resolv.conf"); PatchResolvConf($ipaddr); } } if ($ipaddr != null) { $ipaddrZ = explode(".", $ipaddr); while (list($num, $a) = each($ipaddrZ)) { $ipaddrZ[$num] = intval($a); } $ipaddr = @implode(".", $ipaddrZ); } progress_logs(9, "{apply_settings} Synchronize time", "Synchronize time" . " in line " . __LINE__); sync_time(); progress_logs(10, "{apply_settings} Check kerb5", "Check kerb5..in line " . __LINE__); if (!krb5conf(12)) { progress_logs(110, "{apply_settings} Check kerb5 {failed}", "Check kerb5..in line " . __LINE__); return; } progress_logs(15, "{apply_settings} Check mskt", "Check msktutils in line " . __LINE__); if (!run_msktutils()) { progress_logs(110, "{apply_settings} Check mskt {failed}", "Check mskt..in line " . __LINE__); return; } progress_logs(15, "{apply_settings} netbin", "netbin -> {$netbin} in line " . __LINE__); if (is_file($netbin)) { try { progress_logs(15, "{apply_settings} netbin", "netbin -> SAMBA_PROXY() in line " . __LINE__); SAMBA_PROXY(); } catch (Exception $e) { progress_logs(15, "{failed}", "Exception Error: Message: " . $e->getMessage()); } } progress_logs(19, "{apply_settings} [kadmin_bin]", $kadmin_bin); progress_logs(19, "{apply_settings} [netbin]", $netbin); if (is_file("{$netbin}")) { progress_logs(20, "{join_activedirectory_domain}", "netbin -> JOIN_ACTIVEDIRECTORY() "); JOIN_ACTIVEDIRECTORY(); // 29% } progress_logs(51, "{restarting_winbind} 1", "winbind_priv();"); winbind_priv(false, 52); progress_logs(60, "{restarting_winbind} 2", "winbind_priv();"); winbindd_monit(); progress_logs(65, "{restarting_winbind} 3", "winbind_priv();"); $php5 = $unix->LOCATE_PHP5_BIN(); if (!is_file("/etc/init.d/winbind")) { shell_exec("{$php5} /usr/share/artica-postfix/exec.initslapd.php --winbind"); } progress_logs(65, "{restarting_winbind}", "winbind_priv();"); system("/etc/init.d/winbind restart --force"); return true; }
function build() { $sock = new sockets(); $EnableKerbAuth = $sock->GET_INFO("EnableKerbAuth"); if (!is_numeric("{$EnableKerbAuth}")) { $EnableKerbAuth = 0; } if ($EnableKerbAuth == 0) { echo "Starting......: Kerberos, disabled\n"; return; } if (!checkParams()) { echo "Starting......: Kerberos, misconfiguration failed\n"; return; } $unix = new unix(); $msktutil = $unix->find_program("msktutil"); $hostname_bin = $unix->find_program("hostname"); $kdb5_util = $unix->find_program("kdb5_util"); $kadmin_bin = $unix->find_program("kadmin"); $netbin = $unix->LOCATE_NET_BIN_PATH(); if (!is_file("{$msktutil}")) { echo "Starting......: Kerberos, msktutil no such binary\n"; return; } if (!is_file("{$hostname_bin}")) { echo "Starting......: Kerberos, hostname no such binary\n"; return; } exec("{$hostname_bin} -d 2>&1", $results); $mydomain = trim(@implode("", $results)); unset($results); exec("{$hostname_bin} -f 2>&1", $results); $myFullHostname = trim(@implode("", $results)); unset($results); exec("{$hostname_bin} -s 2>&1", $results); $myNetBiosName = trim(@implode("", $results)); $enctype = null; $sock = new sockets(); $array = unserialize(base64_decode($sock->GET_INFO("KerbAuthInfos"))); if ($array["WINDOWS_SERVER_TYPE"] == "WIN_2003") { $t[] = "# For Windows 2003:"; $t[] = " default_tgs_enctypes = rc4-hmac des-cbc-crc des-cbc-md5"; $t[] = " default_tkt_enctypes = rc4-hmac des-cbc-crc des-cbc-md5"; $t[] = " permitted_enctypes = rc4-hmac des-cbc-crc des-cbc-md5"; $t[] = ""; } if ($array["WINDOWS_SERVER_TYPE"] == "WIN_2008AES") { $t[] = "; for Windows 2008 with AES"; $t[] = " default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5"; $t[] = " default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5"; $t[] = " permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5"; $t[] = ""; $enctype = " --enctypes 28"; } $hostname = strtolower(trim($array["WINDOWS_SERVER_NETBIOSNAME"])) . "." . strtolower(trim($array["WINDOWS_DNS_SUFFIX"])); echo "Starting......: Kerberos, {$hostname}\n"; echo "Starting......: Kerberos, my domain: \"{$mydomain}\"\n"; echo "Starting......: Kerberos, my hostname: \"{$myFullHostname}\"\n"; echo "Starting......: Kerberos, my netbiosname: \"{$myNetBiosName}\"\n"; $domainUp = strtoupper($array["WINDOWS_DNS_SUFFIX"]); $domaindow = strtolower($array["WINDOWS_DNS_SUFFIX"]); $kinitpassword = $array["WINDOWS_SERVER_PASS"]; $kinitpassword = $unix->shellEscapeChars($kinitpassword); $f[] = " [logging]"; $f[] = " default = FILE:/var/log/krb5libs.log"; $f[] = " kdc = FILE:/var/log/krb5kdc.log"; $f[] = " admin_server = FILE:/var/log/kadmind.log"; $f[] = ""; $f[] = "[libdefaults]"; $f[] = " default_realm = {$domainUp}"; $f[] = " dns_lookup_realm = true"; $f[] = " dns_lookup_kdc = true"; $f[] = " ticket_lifetime = 24h"; $f[] = " forwardable = yes"; $f[] = ""; @implode("\n", $t); $f[] = "[realms]"; $f[] = " {$domainUp} = {"; $f[] = " kdc = {$hostname}"; $f[] = " admin_server = {$hostname}"; $f[] = " default_domain = {$domainUp}"; $f[] = " }"; $f[] = ""; $f[] = "[domain_realm]"; $f[] = " .{$domaindow} = {$domainUp}"; $f[] = " {$domaindow} = {$domainUp}"; $f[] = ""; $f[] = "[appdefaults]"; $f[] = " pam = {"; $f[] = " debug = false"; $f[] = " ticket_lifetime = 36000"; $f[] = " renew_lifetime = 36000"; $f[] = " forwardable = true"; $f[] = " krb4_convert = false"; $f[] = "}"; $f[] = ""; @file_put_contents("/etc/krb.conf", @implode("\n", $f)); echo "Starting......: Kerberos, /etc/krb.conf done\n"; @file_put_contents("/etc/krb5.conf", @implode("\n", $f)); echo "Starting......: Kerberos, /etc/krb5.conf done\n"; unset($f); $f[] = "lhs=.ns"; $f[] = "rhs=.{$mydomain}"; $f[] = "classes=IN,HS"; @file_put_contents("/etc/hesiod.conf", @implode("\n", $f)); echo "Starting......: Kerberos, /etc/hesiod.conf done\n"; unset($f); $f[] = "[libdefaults]"; $f[] = "\t\tdebug = true"; $f[] = "[kdcdefaults]"; //$f[]="\tv4_mode = nopreauth"; $f[] = "\tkdc_ports = 88,750"; //$f[]="\tkdc_tcp_ports = 88"; $f[] = "[realms]"; $f[] = "\t{$domainUp} = {"; $f[] = "\t\tdatabase_name = /etc/krb5kdc/principal"; $f[] = "\t\tacl_file = /etc/kadm.acl"; $f[] = "\t\tdict_file = /usr/share/dict/words"; $f[] = "\t\tadmin_keytab = FILE:/etc/krb5.keytab"; $f[] = "\t\tkey_stash_file = /etc/krb5kdc/.k5.{$domainUp}"; $f[] = "\t\tmaster_key_type = des3-hmac-sha1"; $f[] = "\t\tsupported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm des:onlyrealm des:afs3"; $f[] = "\t\tdefault_principal_flags = +preauth"; $f[] = "\t}"; $f[] = ""; if (!is_dir("/usr/share/krb5-kdc")) { @mkdir("/usr/share/krb5-kdc", 644, true); } @file_put_contents("/usr/share/krb5-kdc/kdc.conf", @implode("\n", $f)); @file_put_contents("/etc/kdc.conf", @implode("\n", $f)); echo "Starting......: Kerberos, /usr/share/krb5-kdc/kdc.conf done\n"; echo "Starting......: Kerberos, /etc/kdc.conf done\n"; unset($f); $config = "*/admin *\n"; @file_put_contents("/etc/kadm.acl", " "); @file_put_contents("/usr/share/krb5-kdc/kadm.acl", " "); @file_put_contents("/etc/krb5kdc/kadm5.acl", " "); echo "Starting......: Kerberos, /etc/kadm.acl done\n"; RunKinit($array["WINDOWS_SERVER_ADMIN"], $array["WINDOWS_SERVER_PASS"]); unset($results); if ($GLOBALS["VERBOSE"]) { $mskutilverb = " --verbose"; } $cmd = "{$msktutil} -c -b \"CN=COMPUTERS\" -s HTTP/{$myFullHostname} -h {$myFullHostname} --keytab /etc/krb5.keytab"; $cmd = $cmd . " --computer-name {$myNetBiosName} --upn HTTP/{$myFullHostname} --server {$hostname}{$enctype}{$mskutilverb} 2>&1"; echo "Starting......: msktutil, {$cmd}\n"; exec($cmd, $results); while (list($num, $a) = each($results)) { echo "Starting......: msktutil, {$a}\n"; } if (is_file("{$kdb5_util}")) { $cmd = "{$kdb5_util} create -r {$domainUp} -s -P {$kinitpassword}"; if ($GLOBALS["VERBOSE"]) { echo "Starting......: {$cmd}\n"; } unset($results); exec($cmd, $results); while (list($num, $a) = each($results)) { echo "Starting......: kdb5_util, {$a}\n"; } } if (is_file("{$kadmin_bin}")) { } //kadmin -p Administrateur "addprinc -randkey cifs/bdc.touzeau.com" -w DavidTouzeau180872 if (is_file("{$netbin}")) { JOIN_ACTIVEDIRECTORY(); } }
die; } if ($argv[1] == '--check-privs') { recycles_privileges($argv[2], $argv[3]); die; } if ($argv[1] == '--smbstatus') { smbstatus_injector(); die; } if ($argv[1] == '--smbpasswd') { smbpasswd(); die; } if ($argv[1] == '--join') { JOIN_ACTIVEDIRECTORY(); die; } if ($argv[1] == '--help') { help_output(); die; } function help_output() { echo "--users....................: Save users number in cache\n"; echo "--fix-etc-hosts............: Fix hostname in /etc/hosts\n"; echo "--ads-destroy..............: Destroy Active directory connection\n"; echo "--ads......................: Create Active directory connection\n"; echo "--ping-ads.................: refresh Active Directory connection\n"; echo "--logon-scripts............: Perform logon scripts installation\n"; echo "--administrator............: update administrator informations\n";