Attachment #9989 for bug #49193

Lines 178-187 echo -n "$new_password" >/etc/machine.secret Link Here

(-)a/base/univention-server/server_password_change (-14 / +9 lines)
178	chmod 600 /etc/machine.secret	178	chmod 600 /etc/machine.secret
179	[ -e /etc/init.d/univention-directory-listener ] && invoke-rc.d univention-directory-listener restart >&3	179	[ -e /etc/init.d/univention-directory-listener ] && invoke-rc.d univention-directory-listener restart >&3
180		180
181	# change samba password locally	181	revert_password_change() {
182	run-parts --verbose --arg localchange --regex '^univention-samba4' -- /usr/lib/univention-server/server_password_change.d >&3 2>&3
183	# if samba-tool user setpassword fails, reset the old password.
184	if [ $? != 0 ]; then
185	# Reset to the old password with UDM	182	# Reset to the old password with UDM
186	/usr/sbin/univention-directory-manager "computers/$server_role" modify --binddn "$ldap_hostdn" --bindpwd "$new_password" --dn "$ldap_hostdn" --set password="$old_password" >&3 2>&3	183	/usr/sbin/univention-directory-manager "computers/$server_role" modify --binddn "$ldap_hostdn" --bindpwd "$new_password" --dn "$ldap_hostdn" --set password="$old_password" >&3 2>&3
187		184
Lines 192-198 if [ $? != 0 ]; then Link Here
192		189
193	# run hook scripts for "nochange" (which are named '^[A-Za-z0-9_-]+$')	190	# run hook scripts for "nochange" (which are named '^[A-Za-z0-9_-]+$')
194	run-parts --verbose --arg nochange -- /usr/lib/univention-server/server_password_change.d >&3 2>&3	191	run-parts --verbose --arg nochange -- /usr/lib/univention-server/server_password_change.d >&3 2>&3
		192	}
		193
		194	# change samba password locally
		195	run-parts --verbose --arg localchange --regex '^univention-samba4' -- /usr/lib/univention-server/server_password_change.d >&3 2>&3
		196	# if samba-tool user setpassword fails, reset the old password.
		197	if [ $? != 0 ]; then
195	FAIL "resetting old server password for $ldap_hostdn, because samba could not set the new password locally."	198	FAIL "resetting old server password for $ldap_hostdn, because samba could not set the new password locally."
		199	revert_password_change
196	fi	200	fi
197		201
198	# The password is changed on the master now, but it is not clear if	202	# The password is changed on the master now, but it is not clear if
Lines 213-229 do Link Here
213	# been set with UDM but LDAP does't work with it. Do not continue with	217	# been set with UDM but LDAP does't work with it. Do not continue with
214	# changes that would only worsen the situation. Instead, try to rollback.	218	# changes that would only worsen the situation. Instead, try to rollback.
215	# Reset the old password with UDM and give up.	219	# Reset the old password with UDM and give up.
216
217	/usr/sbin/univention-directory-manager "computers/$server_role" modify --binddn "$ldap_hostdn" --bindpwd "$new_password" --dn "$ldap_hostdn" --set password="$old_password" >&3 2>&3
218
219	# Rollback /etc/machine.secret and restart listener
220	awk '{pwd=$2}; END {printf("%s", pwd)}' /etc/machine.secret.old > /etc/machine.secret
221	chmod 600 /etc/machine.secret
222	[ -e /etc/init.d/univention-directory-listener ] && invoke-rc.d univention-directory-listener restart >&3
223
224	# run hook scripts for "nochange" (which are named '^[A-Za-z0-9_-]+$')
225	run-parts --verbose --arg nochange -- /usr/lib/univention-server/server_password_change.d >&3 2>&3
226	FAIL "resetting old server password for $ldap_hostdn, because access to local LDAP did not work with the new password"	220	FAIL "resetting old server password for $ldap_hostdn, because access to local LDAP did not work with the new password"
		221	revert_password_change
227	fi	222	fi
228	trial_counter=$(( trial_counter - 1))	223	trial_counter=$(( trial_counter - 1))
229	done	224	done

Lines 36-41 set_machine_secret() { Link Here

(-)a/services/univention-samba4/server_password_change.d/univention-samba4 (-4 / +13 lines)
36	old_kvno=$(ldbsearch -H /var/lib/samba/private/sam.ldb samAccountName="${hostname}\$" msDS-KeyVersionNumber \| sed -n 's/msDS-KeyVersionNumber: $.*$/\1/p')	36	old_kvno=$(ldbsearch -H /var/lib/samba/private/sam.ldb samAccountName="${hostname}\$" msDS-KeyVersionNumber \| sed -n 's/msDS-KeyVersionNumber: $.*$/\1/p')
37	new_kvno=$(($old_kvno + 1))	37	new_kvno=$(($old_kvno + 1))
38		38
		39	## Backup /etc/krb5.keytab to avoid key duplication in case a revert is necessary
		40	install -m 0600 /etc/krb5.keytab /etc/krb5.keytab.SAVE
		41
39	ldbmodify -H /var/lib/samba/private/secrets.ldb <<-%EOF	42	ldbmodify -H /var/lib/samba/private/secrets.ldb <<-%EOF
40	dn: flatname=${windows_domain},cn=Primary Domains	43	dn: flatname=${windows_domain},cn=Primary Domains
41	changetype: modify	44	changetype: modify
Lines 46-51 set_machine_secret() { Link Here
46	msDS-KeyVersionNumber: $new_kvno	49	msDS-KeyVersionNumber: $new_kvno
47	-	50	-
48	%EOF	51	%EOF
		52	if [ "$?" -ne "0" ]; then
		53	install -m 0600 /etc/krb5.keytab.SAVE /etc/krb5.keytab
		54	exit 1
		55	fi
49		56
50	## 2. replace random machine secret in SAM with /etc/machine.secret	57	## 2. replace random machine secret in SAM with /etc/machine.secret
51	samba-tool user setpassword "${hostname}\$" --newpassword="$(cat /etc/machine.secret)"	58	samba-tool user setpassword "${hostname}\$" --newpassword="$(cat /etc/machine.secret)"
Lines 54-75 set_machine_secret() { Link Here
54	if [ "$1" = "localchange" ]; then	61	if [ "$1" = "localchange" ]; then
55	set_machine_secret	62	set_machine_secret
56		63
57	## if samba-tool user setpassword fails, revert changes to secrets.ldb	64	## if samba-tool user setpassword fails, revert changes to secrets.ldb and krb5.keytab
58	if [ "$?" -ne "0" ]; then	65	if [ "$?" -ne "0" ]; then
		66	old_password=$(tail -n 1 /etc/machine.secret.old \| sed -n 's/^[0-9]*: //p')
59	ldbmodify -H /var/lib/samba/private/secrets.ldb <<-%EOF	67	ldbmodify -H /var/lib/samba/private/secrets.ldb <<-%EOF
60	dn: flatname=${windows_domain},cn=Primary Domains	68	dn: flatname=${windows_domain},cn=Primary Domains
61	changetype: modify	69	changetype: modify
62	replace: secret	70	replace: secret
63	secret: $(cat /etc/machine.secret.old \| tail -n 1 \| sed 's/[0-9]*: //g')	71	secret: $old_password
64	-	72	-
65	replace: msDS-KeyVersionNumber	73	replace: msDS-KeyVersionNumber
66	msDS-KeyVersionNumber: $old_kvno	74	msDS-KeyVersionNumber: $old_kvno
67	-	75	-
68	%EOF	76	%EOF
69	test -x /etc/init.d/samba && /etc/init.d/samba restart	77
		78	install -m 0600 /etc/krb5.keytab.SAVE /etc/krb5.keytab
		79
70	exit 1	80	exit 1
71	fi	81	fi
72		82
73	test -x /etc/init.d/samba && /etc/init.d/samba restart	83	test -x /etc/init.d/samba && /etc/init.d/samba restart
74	fi	84	fi
75

Return to bug 49193