echo -n "${result:-$name}"

	echo -n "${result:-$name}"

}

}

# vim:set sw=4 ts=4 noet:

# vim:set sw=4 ts=4 noet:

	exec 3>>/var/log/univention/server_password_change.log

	exec 3>>/var/log/univention/server_password_change.log

fi

fi

FAIL () { # log error message to log file and std-err, then fail

FAIL () { # log error message to log file and std-err, then fail

	exit 1

	exit 1

}

}

try_ldap () { # try to connect LDAP server

try_ldap () { # try to connect LDAP server

# 2 -> empty

# 2 -> empty

is_ucr_true server/password/change

is_ucr_true server/password/change

if [ $? = 1 ]; then

if [ $? = 1 ]; then

	exit 0

	exit 0

fi

fi

[ -n "$server_role" ] ||

[ -n "$server_role" ] ||

[ -n "$ldap_hostdn" ] ||

[ -n "$ldap_hostdn" ] ||

[ -e "$MSECRET" ] ||

[ -e "$MSECRET" ] ||

[ -e "/var/lib/univention-directory-replication/failed.ldif" ] &&

[ -e "/var/lib/univention-directory-replication/failed.ldif" ] &&

# Allow password change only if it is scheduled.

# Allow password change only if it is scheduled.

epoch_last_change="$(stat --format %Y "$MSECRET")"

epoch_last_change="$(stat --format %Y "$MSECRET")"

seconds_last_change="$((epoch- epoch_last_change))"

seconds_last_change="$((epoch- epoch_last_change))"

days_last_change="$((seconds_last_change/60/60/24))"

days_last_change="$((seconds_last_change/60/60/24))"

if [ "$server_password_interval" -gt "$days_last_change" ]; then

if [ "$server_password_interval" -gt "$days_last_change" ]; then

	exit 0

	exit 0

fi

fi

# Try to use a trivial command just to check that LDAP server is reachable.

# Try to use a trivial command just to check that LDAP server is reachable.

univention-ldapsearch -D "$ldap_hostdn" -y "$MSECRET" -s base 1.1 >/dev/null 2>&3 ||

univention-ldapsearch -D "$ldap_hostdn" -y "$MSECRET" -s base 1.1 >/dev/null 2>&3 ||

old_pass="$(mktemp "$MSECRET.XXXXXXXX")"

old_pass="$(mktemp "$MSECRET.XXXXXXXX")"

new_pass="$(mktemp "$MSECRET.XXXXXXXX")"

new_pass="$(mktemp "$MSECRET.XXXXXXXX")"

# shellcheck disable=SC2015

# shellcheck disable=SC2015

create_machine_password >"$new_pass" &&

create_machine_password >"$new_pass" &&

	[ -s "$new_pass" ] ||

	[ -s "$new_pass" ] ||

if ! run_hooks prechange

if ! run_hooks prechange

then

then

	run_hooks nochange

	run_hooks nochange

fi

fi

# check if we are in sync with the Primary Directory Node, if not then rollback with "nochange".

# check if we are in sync with the Primary Directory Node, if not then rollback with "nochange".

			read -r lid </var/lib/univention-directory-listener/notifier_id

			read -r lid </var/lib/univention-directory-listener/notifier_id

			if [ -x "/usr/share/univention-directory-listener/get_notifier_id.py" ]; then

			if [ -x "/usr/share/univention-directory-listener/get_notifier_id.py" ]; then

				nid=$(/usr/share/univention-directory-listener/get_notifier_id.py 2>&3) ||

				nid=$(/usr/share/univention-directory-listener/get_notifier_id.py 2>&3) ||

			fi

			fi

			[ "${lid:-0}" = "${nid:-1}" ] &&

			[ "${lid:-0}" = "${nid:-1}" ] &&

					return 0

					return 0

		fi

		fi

		sleep 2

		sleep 2

	done

	done

	run_hooks nochange

	run_hooks nochange

}

}

check_in_sync

check_in_sync

# then rollback the previous run-parts operation. 

# then rollback the previous run-parts operation. 

then

then

	run_hooks nochange

	run_hooks nochange

fi

fi

# If the changed server password has really been set correctly, then we can already use it.

# If the changed server password has really been set correctly, then we can already use it.

		change_password "$new_pass" "$old_pass"

		change_password "$new_pass" "$old_pass"

		run_hooks nochange

		run_hooks nochange

fi

fi

# Now that we are sure the new password already works with Primary Directory Node LDAP,

# Now that we are sure the new password already works with Primary Directory Node LDAP,

# if samba-tool user setpassword fails, reset the old password.

# if samba-tool user setpassword fails, reset the old password.

then

then

	revert_password_change

	revert_password_change

fi

fi

# The password is changed on the Primary Directory Node now, but it is not clear if

# The password is changed on the Primary Directory Node now, but it is not clear if

		# changes that would only worsen the situation. Instead, try to rollback.

		# changes that would only worsen the situation. Instead, try to rollback.

		# Reset the old password with UDM and give up.

		# Reset the old password with UDM and give up.

		revert_password_change

		revert_password_change

fi

fi

# At this point the server password has been changed.

# At this point the server password has been changed.

run_hooks postchange

run_hooks postchange

exec 3<&-

exec 3<&-

exit 0

exit 0

fix: 14.0.1-3A~5.0.0.202110081518

fix: 14.0.1-3A~5.0.0.202110081518

desc: |

desc: |

 This update addresses the following issue:

 This update addresses the following issue:

bug: [53182]

bug: [53182]

fix: 15.0.4-5A~5.0.0.202110081514

fix: 15.0.4-5A~5.0.0.202110081514

desc: |

desc: |

 This update addresses the following issue:

 This update addresses the following issue:

bug: [53182]

bug: [53182]

eval "$(univention-config-registry shell)"

eval "$(univention-config-registry shell)"

if [ "$1" = "prechange" ] ; then

if [ "$1" = "prechange" ] ; then

	if /etc/init.d/postfix status | grep -q "is running" ; then

	if /etc/init.d/postfix status | grep -q "is running" ; then

		univention-config-registry set mail/postfix/stoppedbyserverpasswordchange=yes

		univention-config-registry set mail/postfix/stoppedbyserverpasswordchange=yes

		/etc/init.d/postfix stop

		/etc/init.d/postfix stop

	fi

	fi

fi

fi

	univention-config-registry commit /etc/postfix/ldap.*

	univention-config-registry commit /etc/postfix/ldap.*

	# start postfix only if it has been stopped by this script

	# start postfix only if it has been stopped by this script

	if [ "$mail_postfix_stoppedbyserverpasswordchange" = "yes" ] ; then

	if [ "$mail_postfix_stoppedbyserverpasswordchange" = "yes" ] ; then

		/etc/init.d/postfix start

		/etc/init.d/postfix start

		univention-config-registry unset mail/postfix/stoppedbyserverpasswordchange

		univention-config-registry unset mail/postfix/stoppedbyserverpasswordchange

	fi

	fi

eval "$(univention-config-registry shell)"

eval "$(univention-config-registry shell)"

set_machine_secret() {

set_machine_secret() {

	## 1. store password locally in secrets.ldb

	## 1. store password locally in secrets.ldb

	old_kvno=$(ldbsearch -H /var/lib/samba/private/sam.ldb samAccountName="${hostname}\$" msDS-KeyVersionNumber | sed -n 's/msDS-KeyVersionNumber: \(.*\)/\1/p')

	old_kvno=$(ldbsearch -H /var/lib/samba/private/sam.ldb samAccountName="${hostname}\$" msDS-KeyVersionNumber | sed -n 's/msDS-KeyVersionNumber: \(.*\)/\1/p')

	-

	-

	%EOF

	%EOF

	if [ "$?" -ne "0" ]; then

	if [ "$?" -ne "0" ]; then

		install -m 0600 /etc/krb5.keytab.SAVE /etc/krb5.keytab

		install -m 0600 /etc/krb5.keytab.SAVE /etc/krb5.keytab

		exit 1

		exit 1

	fi

	fi

	## if samba-tool user setpassword fails, revert changes to secrets.ldb and krb5.keytab

	## if samba-tool user setpassword fails, revert changes to secrets.ldb and krb5.keytab

	if [ "$?" -ne "0" ]; then

	if [ "$?" -ne "0" ]; then

		old_password=$(tail -n 1 /etc/machine.secret.old | sed -n 's/^[0-9]*: //p')

		old_password=$(tail -n 1 /etc/machine.secret.old | sed -n 's/^[0-9]*: //p')

		ldbmodify -H /var/lib/samba/private/secrets.ldb <<-%EOF

		ldbmodify -H /var/lib/samba/private/secrets.ldb <<-%EOF

		dn: flatname=${windows_domain},cn=Primary Domains

		dn: flatname=${windows_domain},cn=Primary Domains