JezK
Edit File: remove_dc.py
# Unix SMB/CIFS implementation. # Copyright Matthieu Patou <mat@matws.net> 2011 # Copyright Andrew Bartlett <abartlet@samba.org> 2008-2015 # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import uuid import ldb from ldb import LdbError from samba import werror from samba.ndr import ndr_unpack from samba.dcerpc import misc, dnsp from samba.dcerpc.dnsp import DNS_TYPE_NS, DNS_TYPE_A, DNS_TYPE_AAAA, \ DNS_TYPE_CNAME, DNS_TYPE_SRV, DNS_TYPE_PTR class DemoteException(Exception): """Base element for demote errors""" def __init__(self, value): self.value = value def __str__(self): return "DemoteException: " + self.value def remove_sysvol_references(samdb, logger, dc_name): # DNs under the Configuration DN: realm = samdb.domain_dns_name() for s in ("CN=Enterprise,CN=Microsoft System Volumes,CN=System", "CN=%s,CN=Microsoft System Volumes,CN=System" % realm): dn = ldb.Dn(samdb, s) # This is verbose, but it is the safe, escape-proof way # to add a base and add an arbitrary RDN. if dn.add_base(samdb.get_config_basedn()) == False: raise DemoteException("Failed constructing DN %s by adding base %s" % (dn, samdb.get_config_basedn())) if dn.add_child("CN=X") == False: raise DemoteException("Failed constructing DN %s by adding child CN=X" % (dn)) dn.set_component(0, "CN", dc_name) try: logger.info("Removing Sysvol reference: %s" % dn) samdb.delete(dn) except ldb.LdbError as e: (enum, estr) = e.args if enum == ldb.ERR_NO_SUCH_OBJECT: pass else: raise # DNs under the Domain DN: for s in ("CN=Domain System Volumes (SYSVOL share),CN=File Replication Service,CN=System", "CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System"): # This is verbose, but it is the safe, escape-proof way # to add a base and add an arbitrary RDN. dn = ldb.Dn(samdb, s) if dn.add_base(samdb.get_default_basedn()) == False: raise DemoteException("Failed constructing DN %s by adding base %s" % (dn, samdb.get_default_basedn())) if dn.add_child("CN=X") == False: raise DemoteException("Failed constructing DN %s by adding child " "CN=X (soon to be CN=%s)" % (dn, dc_name)) dn.set_component(0, "CN", dc_name) try: logger.info("Removing Sysvol reference: %s" % dn) samdb.delete(dn) except ldb.LdbError as e1: (enum, estr) = e1.args if enum == ldb.ERR_NO_SUCH_OBJECT: pass else: raise def remove_dns_references(samdb, logger, dnsHostName, ignore_no_name=False): # Check we are using in-database DNS zones = samdb.search(base="", scope=ldb.SCOPE_SUBTREE, expression="(&(objectClass=dnsZone)(!(dc=RootDNSServers)))", attrs=[], controls=["search_options:0:2"]) if len(zones) == 0: return dnsHostNameUpper = dnsHostName.upper() try: (dn, primary_recs) = samdb.dns_lookup(dnsHostName) except RuntimeError as e4: (enum, estr) = e4.args if (enum == werror.WERR_DNS_ERROR_NAME_DOES_NOT_EXIST or enum == werror.WERR_DNS_ERROR_RCODE_NAME_ERROR): if ignore_no_name: remove_hanging_dns_references(samdb, logger, dnsHostNameUpper, zones) return raise DemoteException("lookup of %s failed: %s" % (dnsHostName, estr)) samdb.dns_replace(dnsHostName, []) res = samdb.search("", scope=ldb.SCOPE_BASE, attrs=["namingContexts"]) assert len(res) == 1 ncs = res[0]["namingContexts"] # Work out the set of names we will likely have an A record on by # default. This is by default all the partitions of type # domainDNS. By finding the canocial name of all the partitions, # we find the likely candidates. We only remove the record if it # maches the IP that was used by the dnsHostName. This avoids us # needing to look a the dns_update_list file from in the demote # script. def dns_name_from_dn(dn): # The canonical string of DC=example,DC=com is # example.com/ # # The canonical string of CN=Configuration,DC=example,DC=com # is example.com/Configuration return ldb.Dn(samdb, dn).canonical_str().split('/', 1)[0] # By using a set here, duplicates via (eg) example.com/Configuration # do not matter, they become just example.com a_names_to_remove_from \ = set(dns_name_from_dn(str(dn)) for dn in ncs) def a_rec_to_remove(dnsRecord): if dnsRecord.wType == DNS_TYPE_A or dnsRecord.wType == DNS_TYPE_AAAA: for rec in primary_recs: if rec.wType == dnsRecord.wType and rec.data == dnsRecord.data: return True return False for a_name in a_names_to_remove_from: try: logger.debug("checking for DNS records to remove on %s" % a_name) (a_rec_dn, a_recs) = samdb.dns_lookup(a_name) except RuntimeError as e2: (enum, estr) = e2.args if enum == werror.WERR_DNS_ERROR_NAME_DOES_NOT_EXIST: return raise DemoteException("lookup of %s failed: %s" % (a_name, estr)) orig_num_recs = len(a_recs) a_recs = [r for r in a_recs if not a_rec_to_remove(r)] if len(a_recs) != orig_num_recs: logger.info("updating %s keeping %d values, removing %s values" % (a_name, len(a_recs), orig_num_recs - len(a_recs))) samdb.dns_replace(a_name, a_recs) remove_hanging_dns_references(samdb, logger, dnsHostNameUpper, zones) def remove_hanging_dns_references(samdb, logger, dnsHostNameUpper, zones): # Find all the CNAME, NS, PTR and SRV records that point at the # name we are removing def to_remove(value): dnsRecord = ndr_unpack(dnsp.DnssrvRpcRecord, value) if dnsRecord.wType == DNS_TYPE_NS \ or dnsRecord.wType == DNS_TYPE_CNAME \ or dnsRecord.wType == DNS_TYPE_PTR: if dnsRecord.data.upper() == dnsHostNameUpper: return True elif dnsRecord.wType == DNS_TYPE_SRV: if dnsRecord.data.nameTarget.upper() == dnsHostNameUpper: return True return False for zone in zones: logger.debug("checking %s" % zone.dn) records = samdb.search(base=zone.dn, scope=ldb.SCOPE_SUBTREE, expression="(&(objectClass=dnsNode)" "(!(dNSTombstoned=TRUE)))", attrs=["dnsRecord"]) for record in records: try: orig_values = record["dnsRecord"] except KeyError: continue # Remove references to dnsHostName in A, AAAA, NS, CNAME and SRV values = [ndr_unpack(dnsp.DnssrvRpcRecord, v) for v in orig_values if not to_remove(v)] if len(values) != len(orig_values): logger.info("updating %s keeping %d values, removing %s values" % (record.dn, len(values), len(orig_values) - len(values))) # This requires the values to be unpacked, so this # has been done in the list comprehension above samdb.dns_replace_by_dn(record.dn, values) def offline_remove_server(samdb, logger, server_dn, remove_computer_obj=False, remove_server_obj=False, remove_sysvol_obj=False, remove_dns_names=False, remove_dns_account=False): res = samdb.search("", scope=ldb.SCOPE_BASE, attrs=["dsServiceName"]) assert len(res) == 1 my_serviceName = res[0]["dsServiceName"][0] # Confirm this is really a server object msgs = samdb.search(base=server_dn, attrs=["serverReference", "cn", "dnsHostName"], scope=ldb.SCOPE_BASE, expression="(objectClass=server)") msg = msgs[0] dc_name = str(msg["cn"][0]) try: computer_dn = ldb.Dn(samdb, msg["serverReference"][0].decode('utf8')) except KeyError: computer_dn = None try: dnsHostName = str(msg["dnsHostName"][0]) except KeyError: dnsHostName = None if remove_server_obj: # Remove the server DN (do a tree-delete as it could still have a # 'DNS Settings' child object if it's a Windows DC) samdb.delete(server_dn, ["tree_delete:0"]) if computer_dn is not None: computer_msgs = samdb.search(base=computer_dn, expression="objectclass=computer", attrs=["msDS-KrbTgtLink", "rIDSetReferences", "cn"], scope=ldb.SCOPE_BASE) if "rIDSetReferences" in computer_msgs[0]: rid_set_dn = str(computer_msgs[0]["rIDSetReferences"][0]) logger.info("Removing RID Set: %s" % rid_set_dn) samdb.delete(rid_set_dn) if "msDS-KrbTgtLink" in computer_msgs[0]: krbtgt_link_dn = str(computer_msgs[0]["msDS-KrbTgtLink"][0]) logger.info("Removing RODC KDC account: %s" % krbtgt_link_dn) samdb.delete(krbtgt_link_dn) if remove_computer_obj: # Delete the computer tree logger.info("Removing computer account: %s (and any child objects)" % computer_dn) samdb.delete(computer_dn, ["tree_delete:0"]) if "dnsHostName" in msg: dnsHostName = str(msg["dnsHostName"][0]) if remove_dns_account: res = samdb.search(expression="(&(objectclass=user)(cn=dns-%s)(servicePrincipalName=DNS/%s))" % (ldb.binary_encode(dc_name), dnsHostName), attrs=[], scope=ldb.SCOPE_SUBTREE, base=samdb.get_default_basedn()) if len(res) == 1: logger.info("Removing Samba-specific DNS service account: %s" % res[0].dn) samdb.delete(res[0].dn) if dnsHostName is not None and remove_dns_names: remove_dns_references(samdb, logger, dnsHostName) if remove_sysvol_obj: remove_sysvol_references(samdb, logger, dc_name) def offline_remove_ntds_dc(samdb, logger, ntds_dn, remove_computer_obj=False, remove_server_obj=False, remove_connection_obj=False, seize_stale_fsmo=False, remove_sysvol_obj=False, remove_dns_names=False, remove_dns_account=False): res = samdb.search("", scope=ldb.SCOPE_BASE, attrs=["dsServiceName"]) assert len(res) == 1 my_serviceName = ldb.Dn(samdb, res[0]["dsServiceName"][0].decode('utf8')) server_dn = ntds_dn.parent() if my_serviceName == ntds_dn: raise DemoteException("Refusing to demote our own DSA: %s " % my_serviceName) try: msgs = samdb.search(base=ntds_dn, expression="objectClass=ntdsDSA", attrs=["objectGUID"], scope=ldb.SCOPE_BASE) except LdbError as e5: (enum, estr) = e5.args if enum == ldb.ERR_NO_SUCH_OBJECT: raise DemoteException("Given DN %s doesn't exist" % ntds_dn) else: raise if (len(msgs) == 0): raise DemoteException("%s is not an ntdsda in %s" % (ntds_dn, samdb.domain_dns_name())) msg = msgs[0] if (msg.dn.get_rdn_name() != "CN" or msg.dn.get_rdn_value() != "NTDS Settings"): raise DemoteException("Given DN (%s) wasn't the NTDS Settings DN" % ntds_dn) ntds_guid = ndr_unpack(misc.GUID, msg["objectGUID"][0]) if remove_connection_obj: # Find any nTDSConnection objects with that DC as the fromServer. # We use the GUID to avoid issues with any () chars in a server # name. stale_connections = samdb.search(base=samdb.get_config_basedn(), expression="(&(objectclass=nTDSConnection)" "(fromServer=<GUID=%s>))" % ntds_guid) for conn in stale_connections: logger.info("Removing nTDSConnection: %s" % conn.dn) samdb.delete(conn.dn) if seize_stale_fsmo: stale_fsmo_roles = samdb.search(base="", scope=ldb.SCOPE_SUBTREE, expression="(fsmoRoleOwner=<GUID=%s>))" % ntds_guid, controls=["search_options:0:2"]) # Find any FSMO roles they have, give them to this server for role in stale_fsmo_roles: val = str(my_serviceName) m = ldb.Message() m.dn = role.dn m['value'] = ldb.MessageElement(val, ldb.FLAG_MOD_REPLACE, 'fsmoRoleOwner') logger.warning("Seizing FSMO role on: %s (now owned by %s)" % (role.dn, my_serviceName)) samdb.modify(m) # Remove the NTDS setting tree try: logger.info("Removing nTDSDSA: %s (and any children)" % ntds_dn) samdb.delete(ntds_dn, ["tree_delete:0"]) except LdbError as e6: (enum, estr) = e6.args raise DemoteException("Failed to remove the DCs NTDS DSA object: %s" % estr) offline_remove_server(samdb, logger, server_dn, remove_computer_obj=remove_computer_obj, remove_server_obj=remove_server_obj, remove_sysvol_obj=remove_sysvol_obj, remove_dns_names=remove_dns_names, remove_dns_account=remove_dns_account) def remove_dc(samdb, logger, dc_name): # TODO: Check if this is the last server (covered mostly by # refusing to remove our own name) samdb.transaction_start() server_dn = None # Allow the name to be a the nTDS-DSA GUID try: ntds_guid = uuid.UUID(hex=dc_name) ntds_dn = "<GUID=%s>" % ntds_guid except ValueError: try: server_msgs = samdb.search(base=samdb.get_config_basedn(), attrs=[], expression="(&(objectClass=server)" "(cn=%s))" % ldb.binary_encode(dc_name)) except LdbError as e3: (enum, estr) = e3.args raise DemoteException("Failure checking if %s is an server " "object in %s: %s" % (dc_name, samdb.domain_dns_name(), estr)) if (len(server_msgs) == 0): samdb.transaction_cancel() raise DemoteException("%s is not an AD DC in %s" % (dc_name, samdb.domain_dns_name())) server_dn = server_msgs[0].dn ntds_dn = ldb.Dn(samdb, "CN=NTDS Settings") ntds_dn.add_base(server_dn) # Confirm this is really an ntdsDSA object try: ntds_msgs = samdb.search(base=ntds_dn, attrs=[], scope=ldb.SCOPE_BASE, expression="(objectClass=ntdsdsa)") except LdbError as e7: (enum, estr) = e7.args if enum == ldb.ERR_NO_SUCH_OBJECT: ntds_msgs = [] else: samdb.transaction_cancel() raise DemoteException( "Failure checking if %s is an NTDS DSA in %s: %s" % (ntds_dn, samdb.domain_dns_name(), estr)) # If the NTDS Settings child DN wasn't found or wasnt an ntdsDSA # object, just remove the server object located above if (len(ntds_msgs) == 0): if server_dn is None: samdb.transaction_cancel() raise DemoteException("%s is not an AD DC in %s" % (dc_name, samdb.domain_dns_name())) offline_remove_server(samdb, logger, server_dn, remove_computer_obj=True, remove_server_obj=True, remove_sysvol_obj=True, remove_dns_names=True, remove_dns_account=True) else: offline_remove_ntds_dc(samdb, logger, ntds_msgs[0].dn, remove_computer_obj=True, remove_server_obj=True, remove_connection_obj=True, seize_stale_fsmo=True, remove_sysvol_obj=True, remove_dns_names=True, remove_dns_account=True) samdb.transaction_commit() def offline_remove_dc_RemoveDsServer(samdb, ntds_dn): samdb.start_transaction() offline_remove_ntds_dc(samdb, ntds_dn, None) samdb.commit_transaction()