bddlmZddlmZmZmZmZddlZddl m Z m Z ddl m Z ddlmZddlmZddlmZmZmZmZmZmZmZmZmZmZmZmZmZddl m!Z!dd l"m#Z#m$Z$dd l%m&Z&m'Z'ddl(Z(ddl)Z)d d l*m+Z+e,eeeed Z-e,eeedZ.GddeZ/GddeZ0GddeZ1GddeZ2GddeZ3GddeZ4GddeZ5GddeZ6Gdd eZ7Gd!d"eZ8Gd#d$eZ9Gd%d&eZ:Gd'd(eZ;dS))N)Command SuperCommand CommandErrorOption)ndr_pack ndr_unpack)security)system_session)SamDB) ATYPE_SECURITY_GLOBAL_GROUPDS_GUID_USERS_CONTAINER"GTYPE_SECURITY_BUILTIN_LOCAL_GROUP!GTYPE_SECURITY_DOMAIN_LOCAL_GROUPGTYPE_SECURITY_GLOBAL_GROUPGTYPE_SECURITY_UNIVERSAL_GROUP%GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUPGTYPE_DISTRIBUTION_GLOBAL_GROUP"GTYPE_DISTRIBUTION_UNIVERSAL_GROUPSYSTEM_FLAG_DISALLOW_DELETE SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE"SYSTEM_FLAG_DOMAIN_DISALLOW_RENAMEUF_ACCOUNTDISABLE) defaultdict) check_callCalledProcessError) get_bytesnormalise_int32)common)BuiltinDomainGlobal Universalr!r"r#creZdZdZdZejejejdZ e ddde dd e d d e e d dgdde ddddgde dde e dde e dde e dde e dde e d d!d"d#$g Z d%gZ d(d'Zd&S)) cmd_group_addaCreates a new AD group. This command adds a new Active Directory group. The groupname specified on the command is a unique sAMAccountName. An Active Directory group may contain user and computer accounts as well as other groups. An administrator adds a new group and adds members to that group so they can be managed as a single entity. This helps to simplify security and system administration. Groups may also be used to establish email distribution lists, using --group-type=Distribution. Groups are located in domains in organizational units (OUs). The group's scope is a characteristic of the group that designates the extent to which the group is applied within the domain tree or forest. The group location (OU), type (security or distribution) and scope may all be specified on the samba-tool command when the group is created. The command may be run from the root userid or another authorized userid. The -H or --URL= option can be used to execute the command on a remote server. Example1: samba-tool group add Group1 -H ldap://samba.samdom.example.com --description='Simple group' Example1 adds a new group with the name Group1 added to the Users container on a remote LDAP server. The -U parameter is used to pass the userid and password of a user that exists on the remote server and is authorized to issue the command on that server. It defaults to the security type and global scope. Example2: sudo samba-tool group add Group2 --group-type=Distribution Example2 adds a new distribution group to the local server. The command is run under root using the sudo command. Example3: samba-tool group add Group3 --nis-domain=samdom --gid-number=12345 Example3 adds a new RFC2307 enabled group for NIS domain samdom and GID 12345 (both options are required to enable this feature). %prog [options] sambaopts versionoptscredopts-H--URL%LDB URL for database or target serverURLHhelptypemetavardestz --groupouzpAlternative location (without domainDN counterpart) to default CN=Users in which new user object will be createdr2r3z --group-scopechoicer$z)Group scope (Domain | Global | Universal))r3choicesr2z --group-typeSecurity Distributionz$Group type (Security | Distribution)z --descriptionzGroup's description--mail-addresszGroup's email addressz--noteszGroups's notesz --gid-numberzGroup's Unix/RFC2307 GID numberz --nis-domainzSFU30 NIS Domainz --specialzAdd a special predefined group store_trueF)r2actiondefault groupnameNc  |pddkr!t|t}n t|t}| | | | t d|}||d} t|t||}n&#t$r}t d|d|d}~wwxYw|rEd}|d}n|d }n| d }n| d }n| d }n | d }n| d}|t d|d| st dd dttjdfi}|| }|t d|d|\}}}} t|}|}|tkrKtj|d|}d}|s||t(}nr|t*krUtjd|}t,t.zt0z}|s$|dst5dnt5d||r(||st d|d|d|st d|d||d|| t7|dd }|||d!< ||d"g#|jd$|d%n#t>j $r}|j!\}}|t>j"kr |#d&|d'd(g)}n'#t>j $rt d|d|wxYwtI|d*krt d|d||d+d(d+,}|rd-|d} nd.} t d|d/| d0|d+j%d|t>j&kr |#|t>j'gd12}n[#t>j $rI |#d3|d'gd1)}n'#t>j $rt d|d|wxYwYnwxYwtI|d*krt d|d||d+d(d+,}!|!rd4|!d}"nd5}"|d+d6d+,(d7}#||#kr$t d|d8|"d0|d+j%d9|d+d:d+,}$|$$t d|d;|"d0|d+j%d<tStj|$}$|$|kr$t d|d=|"d0|d+j%d>t d|d;|"d0|d+j%d?t d|d|d}~wwxYwdS |*|||| | | | | @n%#t$r}t dA|z|d}~wwxYw|jdB|zdS)CNr9zcBoth --gid-number and --nis-domain have to be set for a RFC2307-enabled group. Operation cancelled.Tfallback_machineurl session_info credentialslpzFailed to add group ""z group-scopez group-type descriptionz mail-addressnotesz gid-numberz nis-domainzSuperfluous option --z specified with --specialz8Adding special groups is only permitted against the PDC!zProtected UserszaMembers of this group are afforded additional protections against authentication security threatszUnknown special group "z".-z S-1-5-32-z CN=Builtinz Error getting Builtin objects DNzUnknown group type zInvalid group OU "zCN=zInvalid group name "groupTRUE)dnsAMAccountName objectClass groupTyperI objectSidisCriticalSystemObject systemFlagszrelax:0)controlsz Added group  z (objectSid=)rO) expressionattrsrridxz with name "z " - Special group already existsz at ")rOrRrQ)basescoperYz(sAMAccountName=znamed "z with no namerQzutf-8z" - An object z" already exists, but it is not a security group. Rename or remove this existing object before attempting to add this special group.rRz" - A security group zx" already exists, but it lacks a SID. Rename or remove this existing object before attempting to add this special group.z" - The security group z" already exists.z" already exists, but it has the wrong SID, and will not function as expected. Rename or remove this existing object before attempting to add this special group.)groupou grouptyperI mailaddressrJ gidnumber nisdomainzFailed to add group "%s"zAdded group %s )+security_groupgetrdistribution_grouprr get_loadparmget_credentialsr r Exceptionam_pdclowerr DOMAIN_RID_PROTECTED_USERSrget_default_basedndom_sidget_domain_sidget_wellknown_dnr rrrr add_child RuntimeErrorraddoutfwriteldbLdbErrorargsERR_CONSTRAINT_VIOLATIONsearchlenrNERR_ENTRY_ALREADY_EXISTS SCOPE_BASEdecodernewgroup)%selfr?r+r)r*r0r_ group_scope group_typerI mail_addressrJ gid_number nis_domainspecialgtyperGcredssamdbeinvalid_optionspecial_groups special_groupridgroup_dn object_sid system_flagsmsgnumestrresname with_namegot_namenamedgot_group_typesids% 4/usr/lib/python3/dist-packages/samba/netcmd/group.pyrunzcmd_group_add.runvs  $* 3 3"&&{4OPPEE&**;8WXXE  :#9z?UZdZl EFF F  # # % %((d(CC Han.>.>&+444EE H H HCyCCCQGG G H r !N&!.'!-(!.)!/"!('!-'!-)"$?>$?$?$?@@@<<>> 7"$6777"''))%/7J ,K N+..y/@/@AAM$"#JY#J#J#JKKK1> .Iuc;(//J//11H333%-++--555577 # O$55h6M O OH<<<%-.?#.?.?@@ @ B!C ;!< Kx'9'9,'G'GK&'IJJJ"#@#@#@AAA Dx11':: D"#B#B#B#BCCC%%&7I&7&788 H"#F)#F#F#FGGG"+&'*%j11*0C'%1M"[ > # 444t  >D'$:4$:$:$: $& &G GG)2GG9A!fi!3!3!3#4#44 #/!I !I!I27!I!I>A!fi!I!I!I#J#JJ''Ky'K'K'KQOOOoW Pv F J NN9g'2 TY%/:  G G G G J J J9IEqII I J *Y677777s B-- C7C  C=L55XX M=<X=$N!!BX)$Q XR&Q<;R&<$R  R&#X%R&&E+XXX:: YYY) NNNNNNNNNNNNF)__name__ __module__ __qualname____doc__synopsisoptions SambaOptionsVersionOptionsCredentialsOptionstakes_optiongroupsrstrint takes_options takes_argsrrr&r&:s>-H)-. tW#JQT3 ( ( ({G    X7X7X7X? A A A~Hz>6R: < < <%:EEE&=CHHHy/c:::~$ECPPP~$6SAAA{!A,`efffM$J6:@DjnR8R8R8R8R8R8rr&creZdZdZdZejejejdZ e ddde dd gZ d gZ d d Zd S)cmd_group_deleteaDeletes an AD group. The command deletes an existing AD group from the Active Directory domain. The groupname specified on the command is the sAMAccountName. Deleting a group is a permanent operation. When a group is deleted, all permissions and rights that users in the group had inherited from the group account are deleted as well. The command may be run from the root userid or another authorized userid. The -H or --URL option can be used to execute the command on a remote server. Example1: samba-tool group delete Group1 -H ldap://samba.samdom.example.com -Uadministrator%passw0rd Example1 shows how to delete an AD group from a remote LDAP server. The -U parameter is used to pass the userid and password of a user that exists on the remote server and is authorized to issue the command on that server. Example2: sudo samba-tool group delete Group2 Example2 deletes group Group2 from the local server. The command is run under root using the sudo command. r'r(r,r-r.r/r0r1r?NcD|}||d}t|t||}dt j|z} ||tj| dg} | dj } n #t$rtd|zwxYw | | n%#t$r} td |z| d} ~ wwxYw|jd |zdS) NTrArC)(&(sAMAccountName=%s)(objectClass=group))rNr]r^rXrYrUnable to find group "%s"zFailed to remove group "%s"zDeleted group %s )rgrhr r rv binary_encoderz domain_dn SCOPE_SUBTREErN IndexErrorrdeleterirtru) rr?r+r)r*r0rGrrfilterrrrs rrzcmd_group_delete.runnsX  # # % %((d(CC!.*:*:"'B000>#I../ J,,EOO$5$5%(%6*0&*V--C1vyHH J J J:iHII I J M LL " " " " M M M (]|--member-dn=) [options]r(r,r-r.r/r0r1 --member-dnzRDN of the new group member to be added. The --object-types option will be ignored.appendr2r3r=--object-typesComma separated list of object types. The types are used to filter the search for the specified members. Valid values are: user, group, computer, serviceaccount, contact and all. Default: user,group,computeruser,group,computerr2r>r3--member-base-dn:Base DN for group member search. Default is the domain DN.r6r?listofmembers?Nc L|} || d} |%|#|td t |t | | } g} || |z } || |dz } | d}|| |}| || d||n*#t$r}td| d|d |d}~wwxYw|j d |zdS) NTrA6Either listofmembers or --member-dn must be specified.rC,add_members_operation member_typesmember_base_dnzFailed to add members z to group "z" - zAdded members to group %s rgrhusagerr r splitnormalize_dn_in_domainadd_remove_group_membersrirtrurr? listofmembersr+r)r*r0r member_dn object_typesrGrr groupmembersgroup_member_typesrs rrzcmd_group_add_members.runs # # % %((d(CC  !6 JJLLLHJJ J -an.>.>&+444EL$ ) ( 3 3C 8 88 !-!3!3C!8!8 )!&!=!=n!M!M  * *9lAE8J:H + J J J J - - -, iii ,-- - - 5 ABBBBBsBC D'C??DNNNNNNNrrrrrrrs&XH)-. tW#JQT3 ( ( (}B    4 -    !1   #M./0J.(C(C(C(C(C(CrrceZdZdZdZejejejdZ e ddde dd e d d e d e ddde e dde gZ ddgZ ddZdS)cmd_group_remove_membersaRemove members from an AD group. This command removes one or more members from an existing Active Directory group. The command accepts one or more group member names separated by commas. A group member may be a user or computer account or another Active Directory group that is a member of the group specified on the command. When a member is removed from a group, inherited permissions and rights will no longer apply to the member. Example1: samba-tool group removemembers supergroup Group1 -H ldap://samba.samdom.example.com -Uadministrator%passw0rd Example1 shows how to remove Group1 from supergroup. The command will run on the remote server specified on the -H parameter. The -U parameter is used to pass the userid and password of a user authorized to issue the command on the remote server. Example2: sudo samba-tool group removemembers supergroup User1 Example2 shows how to remove a single user account, User2, from the supergroup AD group. It uses the sudo command to run as root when issuing the command. rr(r,r-r.r/r0r1rzPDN of the group member to be removed. The --object-types option will be ignored.rrrrrrrrr6r?rNc J|} || d} |%|#|td t |t | | } g} || |z } || |dz } | d}|| |}| || d||n)#t$r}td|d |d |d}~wwxYw|j d |zdS) NTrArrCrFrzFailed to remove members z from group "rHzRemoved members from group %s rrs rrzcmd_group_remove_members.runs # # % %((d(CC  !6 JJLLLHJJ J nan.>.>&+444EL$ ) ( 3 3C 8 88 !-!3!3C!8!8 )!&!=!=n!M!M  * *9+7AF8J:H + J J J J  n n n,P]P]P]_h_h_hiklmm m n 9IEFFFFFsBC D'C>>Drrrrrrrs"XH)-. tW#JQT3 ( ( (}B    4 -    !1   #M./0J.(G(G(G(G(G(Grrc eZdZdZdZedddedded d d d edddeedddd dgZej ej ej dZ ddZ dS)cmd_group_listzList all groups.%prog [options]r,r-r.r/r0r1z-vz --verbosez3Verbose output, showing group type and group scope.r<r2r=z-bz --base-dnzSpecify base DN to use.r6 --full-dnfull_dnF)Display DN instead of the sAMAccountName.r5r>r=r2r)r+r*Nc |}||d} t|t| |} dg} |r| ddgz } | } |r| |} | | tjd| } t| d krdS|r;|j d |j d | D]}|j d | dd zttd|dzdz}|ttt dkr|j dn|ttt dkr|j dn|ttt dkr|j dng|ttt dkr|j dn|ttt dkr|j dn|ttt dkr|j dnm|ttt dkr|j dn|j dt| dg}|j d|zdS| D]g}|r1|j d| dz5|j d| dd zhdS) NTrArCsamaccountnamer`member(objectClass=group)r^rXrYrzQGroup Name Group Type Group Scope Members zQ-------------------------------------------------------------------------------- z%-44srZz%slr zSecurity Builtin r!zSecurity Domain r"zSecurity Global r#zSecurity UniversalzDistribution Global zDistribution Domain zDistribution Universalz r>z %6u %s rN)rgrhr r rrrzrvrr{rtrurehexrrdrf)rr)r+r*r0verbosebase_dnrrGrrrYrrrhgtype num_memberss rrzcmd_group_list.runas # # % %((d(CC!.*:*:"'B000   - k8, ,EOO%%  >44W==Ill9C,='(>x(H(H$I$I J JJJIOO$@AAAAC(:(>(>x(H(H$I$I J JJJIOO$@AAAAC(:(>(>{(K(K$L$L M MMMIOO$@AAAAIOO$@AAA!#''(B'"?"?@@   k 9::::) ; ;, K KIOOFSWWT]]$:;;; 1Aq)I)I IJJJJ  K Kr)NNNNFNF)rrrrrrrrrrrrrrrrrrrGs H tW#JQT3 ( ( (t[I" $ $ $ t[-    {"? A A A M ).-9K9K9K9K9K9Krrc eZdZdZdZedddedded d d d edd d deddd d dgZej ej ej dZ dgZ ddZdS)cmd_group_list_memberszList all members of an AD group. This command lists members from an existing Active Directory group. The command accepts one group name. Example1: samba-tool group listmembers "Domain Users" -H ldap://samba.samdom.example.com -Uadministrator%passw0rd r'r,r-r.r/r0r1z--hide-expiredz!Do not list expired group membersFr<)r2r>r=z--hide-disabledz"Do not list disabled group members)r>r=r2rrrrrr?Nc |} || d} t|t| | } dt j|z} | | tj| dg} | d dd}n #t$rtd |zwxYwttj|}|\}}d |z}d }|dur| }d |z}d }|durd tjt$fz}d|d|d||d}| | tj|ddg} t'| dkrdS| D]}|r1|jd| dz5| dd}|| dd}|jd|zdS#t,$r}td|d|d}~wwxYw)NTrArCz)(&(objectClass=group)(sAMAccountName=%s))rRrrrZrzr\z>(|(!(accountExpires=*))(accountExpires=0)(accountExpires>=%u))z(!(userAccountControl:%s:=%u))z(&(|(primaryGroupID=z )(memberOf=z))rWsamAccountNamecnrrNzFailed to list members of "z " group - )rgrhr r rvrrzrrrerrrr rnr get_nttimeOID_COMPARATOR_ANDrr{rtruri)rr?r+r)r*r0 hide_expired hide_disabledrrGrr search_filterrgroup_sid_binary group_sid group_dom_sidr group_sid_dnfilter_expirescurrent_nttimefilter_disabledrr member_namers rrzcmd_group_list_members.runs # # % %((d(CC6 /an.>.>&+444EI .y99:M Nll5??#4#4C)#LMMM N#8#35EFFI#,??#4#4 ]C%3LNt##!&!1!1!3!3#&*8 #9 !O$$"B*,=F?#?\\\??NNNDF,,u008I*0&6%=??CCA  6 6IOOFSWWT]]$:;;;!gg&6Ag>> &"%''$A'"6"6K  45555 6 6 / / /, ) 11 .// / /s86H*$AB87H*8CC H*#BH** I4I  I)NNNNFFF)rrrrrrrrrrrrrrrrrrrrs-H tW#JQT3 ( ( (7" $ $ $  "8 : : : {"? A A AM$).- JB/B/B/B/B/B/rrcxeZdZdZdZedddeddgZd d gZe j e j e j d Z dd Zd S)cmd_group_moveaMove a group to an organizational unit/container. This command moves a group object into the specified organizational unit or container. The groupname specified on the command is the sAMAccountName. The name of the organizational unit or container can be specified as a full DN or without the domainDN component. The command may be run from the root userid or another authorized userid. The -H or --URL= option can be used to execute the command against a remote server. Example1: samba-tool group move Group1 'OU=OrgUnit,DC=samdom.DC=example,DC=com' \ -H ldap://samba.samdom.example.com -U administrator Example1 shows how to move a group Group1 into the 'OrgUnit' organizational unit on a remote LDAP server. The -H parameter is used to specify the remote target server. Example2: samba-tool group move Group1 CN=Users Example2 shows how to move a group Group1 back into the CN=Users container on the local server. z+%prog [options]r,r-r.r/r0r1r? new_parent_dnrNc|}||d}t|t||} t j| | } dt j|z} | | | tj } | dj } n #t$rtd|zwxYw | |}n,#t$r}td|d |jd}~wwxYwt j| t!| }|t%| d z || | | |n%#t$r}td |z|d}~wwxYw|jd |d |ddS)NTrArCrr]rXr^rrzInvalid new_parent_dn "z": rzFailed to move group "%s"z Moved group "z" into "z" )rgrhr r rvDnrrrzrrNrrrrimessagerremove_base_componentsr{add_baserenamertru)rr?rr+r)r*r0rGrrrrrrfull_new_parent_dnrfull_new_group_dns rrzcmd_group_move.run2s+  # # % %((d(CC!.*:*:"'B000F5%//"3"344 =#I../ J,,I*0%(%688C1vyHH J J J:iHII I J ;!&!=!=m!L!L   ; ; ;, - qyy :;; ; ; F5#h--8800X1BCCC""#5666 K LL#4 5 5 5 5 K K K:YFJJ J K "$6$6$68 9 9 9 9 9s< /B::CC11 D;DD:F F3F..F3rrrrrrrrrrrrrrrrrrrrrs:=H tW#JS 2 2 2M /J).- FJ $!9!9!9!9!9!9rrceZdZdZdZedddedded d ed gZd gZe j e j e j dZ ddZdS)cmd_group_showaDisplay a group AD object. This command displays a group object and it's attributes in the Active Directory domain. The group name specified on the command is the sAMAccountName of the group. The command may be run from the root userid or another authorized userid. The -H or --URL= option can be used to execute the command against a remote server. Example1: samba-tool group show Group1 -H ldap://samba.samdom.example.com \ -U administrator --password=passw1rd Example1 shows how to display a group's attributes in the domain against a remote LDAP server. The -H parameter is used to specify the remote target server. Example2: samba-tool group show Group2 Example2 shows how to display a group's attributes in the domain against a local LDAP server. Example3: samba-tool group show Group3 --attributes=member,objectGUID Example3 shows how to display a groups objectGUID and member attributes. z%prog [options]r,r-r.r/r0r1z --attributesz:Comma separated list of attributes, which will be printed. group_attrs)r2r3r5r?rNc.|}||d}t|t||} d} |r|d} dt j|z} | } | | | t j | } | dj }n #t$rtd|zwxYw| D]1}tj| |}|j|2dS) NTrArCrz,(&(objectCategory=group)(sAMAccountName=%s)))r]rXr^rYrr)rgrhr r rrvrrrzrrNrrrget_ldif_for_editorrtru)rr?r+r)r*r0rrGrrrYrdomaindnruser_dnr group_ldifs rrzcmd_group_show.runsK # # % %((d(CC!.*:*:"'B000  +%%c**E@$Y//0??$$ J,,H%(%6eEEC!fiGG J J J:iHII I J ( (C3E3??J IOOJ ' ' ' ' ( (s 0CCNNNNNrrrrrrVs>.H tW#JS 2 2 2~.m - - -MJ).- IM $((((((rrcreZdZdZdZedddeddgZej ej ej d Z d Z d d Zd S)cmd_group_statsz+Summary statistics about group memberships.rr,r-r.r/r0r1rc`d}|D]\}}||kr ||kr||z }|S)Nr)items)r range_min range_max group_freqs total_countmemberscounts r num_in_rangezcmd_group_stats.num_in_rangesL )//11 % %NGUG##9(<(<u$ rNc|}||d}t|t||}|}||t jdddg} i} d} | D]R} t| d} t| dg }|| | <| |z } S| j }|j d |j d |j d ||j d | | t|z }|j d|zt!| }t!| }|t)|}||}|j d|||||dz}||}|dzdkr|||dz zdz }|j d|t-t.}| D]\}}||xxdz cc<dddddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-|fg}|j d.|j d |D]l}|d}|d}||krnS||||}|dkr5d/||}|j d0||fzm|j d1dS)2NTrArCrrrrrrzGroup membership statistics* z2------------------------------------------------- zTotal groups: {0} zTotal memberships: {0} z Average members per group: %.2f zMax members: {0} ({1}) rzMedian members per group: {0} )rr)r() ) ))))')(1)2;)<E)FO)PY)Zc)d)))i+)i,i)ii)ii)ii)ii )i i)ii)ii'i'z Members Number of Groups z{0}-{1}z %13s %u z7 * Note this does not include nested group memberships )rgrhr r rrzrvrrrer{r%rtruformatfloatlistkeysvaluesindexmaxsortrrrr&)rr)r+r*r0rGrrrrgroup_assignmentstotal_membershipsrrr num_groupsaverage group_names group_membersr[ max_membersmidpointmedianr"rLbandsband band_startband_endband_strs rrzcmd_group_stats.runs  # # % %((d(CC!.*:*:"'B000OO%% ll9C,='<"2H!=??  - -Csww/0011Dcgghg;;<Q  }X\::a?F ;BB6JJKKK"#&& "3"9"9";"; * * E;  $ $ $ ) $ $ $ $8X8Xx88ZZZZ|\<% ' ;<<< MNNN G GDaJAwHK''**:xMMJQ$++JAA  */E EFFF STTTTTrr)rrrrrrrrrrrrrr&rrrrrrs55 H tW#JQT3 ( ( (M ).- KUKUKUKUKUKUrrceZdZdZdZedddedded d e gZd gZe j e j e j d Z ddZdS)cmd_group_editaModify Group AD object. This command will allow editing of a group account in the Active Directory domain. You will then be able to add or change attributes and their values. The groupname specified on the command is the sAMAccountName. The command may be run from the root userid or another authorized userid. The -H or --URL= option can be used to execute the command against a remote server. Example1: samba-tool group edit Group1 -H ldap://samba.samdom.example.com \ -U administrator --password=passw1rd Example1 shows how to edit a groups attributes in the domain against a remote LDAP server. The -H parameter is used to specify the remote target server. Example2: samba-tool group edit Group2 Example2 shows how to edit a groups attributes in the domain against a local server. Example3: samba-tool group edit Group3 --editor=nano Example3 shows how to edit a groups attributes in the domain against a local server using the 'nano' editor. r'r,r-r.r/r0r1z--editorzQEditor to use instead of the system default, or 'vi' if no system default is set.r6r?rNc|}||d}t|t||} dt j|z} | } | | | tj} | dj } n #t$rtd|zwxYwt| dkr!td |t| fz| d}tj| |}|#tjd }|d }t%jd 5}|t+|| t/||jgn"#t2$r}t3d|d}~wwxYwt5|j5}|}dddn #1swxYwYdddn #1swxYwY| |}t;|d}| ||}t|dkr|jddS | |n%#tB$r}td|z|d}~wwxYw|jd|zdS)NTrArCrr rrrz'Invalid number of results: for "%s": %dEDITORviz.tmp)suffixzERROR: zNothing to do zFailed to modify group '%s': z!Modified group '%s' successfully )"rgrhr r rvrrrzrrNrrr{rrosenvironretempfileNamedTemporaryFilerurflushrrropenread parse_ldifnextmsg_diffrtmodifyri)rr?r+r)r*r0editorrGrrrrrrr result_ldift_filer edited_fileedited_message msgs_edited msg_edited res_msg_diffs rrzcmd_group_edit.run=s  # # % %((d(CC!.*:*:"'B000>#I../??$$ J,,H*0%(%688C1vyHH J J J:iHII I J s88q==H!*SXX6 788 8!f0<< >Z^^H--F~  ( 7 7 7 46 LL;// 0 0 0 LLNNN 7FFK01111% 7 7 7(A666 7fk"" 4k!,!1!1!3!3 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4&&~66 +&&q) ~~c:66 |   ! ! IOO- . . . F O LL & & & & O O O>JANN N O  [options]r,r-r.r/r0r1r?rbrNc|}||}t|t||} | } dt j|} | | t j | } t| dkr"td|| dj } d| dvr"td|d|} | | t j | } t| dkr"td || d s|jd d | |} | |n:#t j$r(}td ||d}~wwxYw|jd|dS)NrCz(samaccountname={}))r^rXrzUnable to find group '{}' gidNumberzGroup {} is a Unix group.z$(&(objectClass=group)(gidNumber={}))zgidNumber {} already used.zidmap_ldb:use rfc2307zYou are setting a Unix/RFC2307 GID. You may want to set 'idmap_ldb:use rfc2307 = Yes' in smb.conf to use the attributes for XID/SID-mapping. z: dn: {0} changetype: modify add: gidNumber gidNumber: {1} z!Failed to modify group '{0}': {1}z!Modified Group '{}' successfully )rgrhr r rrIrvrrzrr{rrNrertru modify_ldifrw)rr?rbr+r)r*r0rGrrrrrr group_modrs rrzcmd_group_add_unix_attrs.runsC # # % %((,,!.*:*:"'B000??$$'--c.? .J.JKKll8!$!2&,.. HHMM:AA)LLMM Mq69 #a& :AA)LLMM M8>>yIIll8!$!2&,.. HHMM;BB9MMNN Nvv-.. 2 IOO1 2 2 2   F8Y  6   i ( ( ( (| 6 6 6B &y! 4 466 6 6 <CCINNOOOOOsGH+#HHrrrrrryryws29H tW#JS 2 2 2M {+J).-   BF $3P3P3P3P3P3Prryc eZdZdZdZedddedded d e ed d dedde edde gZdgZe j e j e j dZ ddZdS)cmd_group_renameaRename a group and related attributes. This command allows to set the group's name related attributes. The group's CN will be renamed automatically. The group's CN will be the sAMAccountName. Use the --force-new-cn option to specify the new CN manually and the --reset-cn to reset this change. Use an empty attribute value to remove the specified attribute. The groupname specified on the command is the sAMAccountName. The command may be run locally from the root userid or another authorized userid. The -H or --URL= option can be used to execute the command against a remote server. Example1: samba-tool group rename employees --samaccountname=staff Example1 shows how to change the samaccountname of a group 'employees' to 'staff'. The CN of the group employees will also be changed to 'staff', if the previous CN was the previous sAMAccountName. Example2: samba-tool group rename employees --mail-address='staff@company.com' \ -H ldap://samba.samdom.example.com -U administrator Example2 shows how to rename the mail address of a group 'employees' to 'staff@company.com'. The -H parameter is used to specify the remote target server. r'r,r-r.r/r0r1z--force-new-cnz;Specify a new CN (RND) instead of using the sAMAccountName.r6z --reset-cnzqSet the CN (RDN) to the sAMAccountName. Use this option to reset the changes made with the --force-new-cn option.r<rr;zNew mail addressz--samaccountnamez,New account name (sAMAccountName/logon name)r?rNc |r| rtd|dkrtd|dkrtd|} || d} t|t | | } t j| | } dt j|z} | | t j |gd  }|d }|j }n #t$rtd |zwxYw| }|d d }||}n ||}n|d}|d}t|t|ko0t|t|kp| pt|}t j| d|z}||t j}||_ | ||d|| ||d|t'|d k}|  |r| ||r| ||n9#t.$r,}| td|z|d}~wwxYw| |r$|jd|d|d|d|rk|jd|z|D];}|dkr |j|d||r||ndd:dSdS)NzEIt is not allowed to specify --force-new-cn together with --reset-cn.r\z8Failed to rename group - delete protected attribute 'CN'zDFailed to rename group - delete protected attribute 'sAMAccountName'TrArCz)(&(objectClass=group)(samaccountname=%s)))rOrmailrrrrrOzCN=%srzFailed to rename group "%s"zRenamed CN of group "z" from "z" to "z" successfully zCFollowing attributes of group "%s" have been changed successfully: rNz: z [removed]rV)rrgrhr r rvr rrrzrrNrparentrboolrMessageprepare_attr_replacer{transaction_startrorritransaction_canceltransaction_commitrtrurL)rr?r+r)r*r0rr force_new_cnreset_cnrGrrrrr old_grouprgroup_parent_dnold_cnnew_cn expected_cnmust_change_cn new_group_dnrgroup_attributes_changedrattrs rrzcmd_group_rename.runsT  rs&DDDDDDDDDDDD ********!!!!!!%%%%%%$#####5555555533333333 "D!B!<$BDDEET%J%D(JLLMM N8N8N8N8N8GN8N8N8b;:;:;:;:;:w;:;:;:|]C]C]C]C]CG]C]C]C@[G[G[G[G[Gw[G[G[G|SKSKSKSKSKWSKSKSKlf/f/f/f/f/Wf/f/f/RM9M9M9M9M9WM9M9M9`L(L(L(L(L(WL(L(L(^cUcUcUcUcUgcUcUcULiJiJiJiJiJWiJiJiJX\P\P\P\P\Pw\P\P\P~XDXDXDXDXDwXDXDXDt///// /////r