1#!/bin/ksh93 -p
2#
3# CDDL HEADER START
4#
5# The contents of this file are subject to the terms of the
6# Common Development and Distribution License (the "License").
7# You may not use this file except in compliance with the License.
8#
9# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10# or http://www.opensolaris.org/os/licensing.
11# See the License for the specific language governing permissions
12# and limitations under the License.
13#
14# When distributing Covered Code, include this CDDL HEADER in each
15# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16# If applicable, add the following below this CDDL HEADER, with the
17# fields enclosed by brackets "[]" replaced with your own identifying
18# information: Portions Copyright [yyyy] [name of copyright owner]
19#
20# CDDL HEADER END
21#
22# Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23# Use is subject to license terms.
24#
25# This script is used to setup the Kerberos client by
26# supplying information about the Kerberos realm and kdc.
27#
28# The kerberos configuration file (/etc/krb5/krb5.conf) would
29# be generated and local host's keytab file setup. The script
30# can also optionally setup the system to do kerberized nfs and
31# bringover a master krb5.conf copy from a specified location.
32
33function cleanup {
34
35	kdestroy -q > $TMP_FILE 2>&1
36	rm -r $TMPDIR > /dev/null 2>&1
37
38	exit $1
39}
40function exiting {
41
42        printf "\n$(gettext "Exiting setup, nothing changed").\n\n"
43
44	cleanup $1
45}
46
47function error_message {
48
49        printf -- "---------------------------------------------------\n" >&2
50        printf "$(gettext "Setup FAILED").\n\n" >&2
51
52        cleanup 1
53}
54
55function check_bin {
56
57	typeset bin=$1
58
59	if [[ ! -x $bin ]]; then
60		printf "$(gettext "Could not access/execute %s").\n" $bin >&2
61		error_message
62	fi
63}
64
65function cannot_create {
66	typeset filename="$1"
67	typeset stat="$2"
68
69	if [[ $stat -ne 0 ]]; then
70		printf "\n$(gettext "Can not create/edit %s, exiting").\n" $filename >&2
71		error_message
72	fi
73}
74
75function update_pam_conf {
76	typeset PAM TPAM service
77
78	PAM=/etc/pam.conf
79
80	TPAM=$(mktemp -q -t kclient-pamconf.XXXXXX)
81	if [[ -z $TPAM ]]; then
82		printf "\n$(gettext "Can not create temporary file, exiting").\n" >&2
83		error_message
84	fi
85
86	cp $PAM $TPAM >/dev/null 2>&1
87
88	printf "$(gettext "Configuring %s").\n\n" $PAM
89
90	for service in $SVCs; do
91		svc=${service%:*}
92		auth_type=${service#*:}
93		if egrep -s "^$svc[ 	][ 	]*auth.*pam_krb5*" $TPAM; then
94			printf "$(gettext "The %s service is already configured for pam_krb5, please merge this service in %s").\n\n" $svc $PAM >&2
95			continue
96		else
97			exec 3>>$TPAM
98			printf "\n$svc\tauth include\t\tpam_krb5_$auth_type\n" 1>&3
99		fi
100	done
101
102	cp $TPAM $PAM > /dev/null 2>&1
103
104	rm $TPAM > /dev/null 2>&1
105}
106
107function modify_nfssec_conf {
108	typeset NFSSEC_FILE="/etc/nfssec.conf"
109
110	if [[ -r $NFSSEC_FILE ]]; then
111		cat $NFSSEC_FILE > $NFSSEC_FILE.sav
112		cannot_create $NFSSEC_FILE.sav $?
113	fi
114
115	cat $NFSSEC_FILE > $TMP_FILE
116	cannot_create $TMP_FILE $?
117
118	if grep -s "#krb5" $NFSSEC_FILE > /dev/null 2>&1; then
119		sed "s%^#krb5%krb5%" $TMP_FILE >$NFSSEC_FILE
120		cannot_create $NFSSEC_FILE $?
121	fi
122}
123
124function call_kadmin {
125	typeset svc="$1"
126	typeset bool1 bool2 bool3 bool4
127	typeset service_princ getprincsubcommand anksubcommand ktaddsubcommand
128	typeset ktremsubcommand
129
130	for listentry in $fqdnlist; do
131
132	# Reset conditional vars to 1
133	bool1=1; bool2=1; bool3=1; bool4=1
134
135	service_princ=$(echo "${svc}/${listentry}")
136	getprincsubcommand="getprinc $service_princ"
137	anksubcommand="addprinc -randkey $service_princ"
138	ktaddsubcommand="ktadd $service_princ"
139	ktremsubcommand="ktrem $service_princ all"
140
141	kadmin -c $KRB5CCNAME -q "$getprincsubcommand" 1>$TMP_FILE 2>&1
142
143	egrep -s "$(gettext "get_principal: Principal does not exist")" $TMP_FILE
144	bool1=$?
145	egrep -s "$(gettext "get_principal: Operation requires ``get")" $TMP_FILE
146	bool2=$?
147
148	if [[ $bool1 -eq 0 || $bool2 -eq 0 ]]; then
149		kadmin -c $KRB5CCNAME -q "$anksubcommand" 1>$TMP_FILE 2>&1
150
151		egrep -s "$(gettext "add_principal: Principal or policy already exists while creating \"$service_princ@$realm\".")" $TMP_FILE
152		bool3=$?
153
154		egrep -s "$(gettext "Principal \"$service_princ@$realm\" created.")" $TMP_FILE
155		bool4=$?
156
157		if [[ $bool3 -eq 0 || $bool4 -eq 0 ]]; then
158			printf "$(gettext "%s entry ADDED to KDC database").\n" $service_princ
159		else
160			cat $TMP_FILE;
161			printf "\n$(gettext "kadmin: add_principal of %s failed, exiting").\n" $service_princ >&2
162			error_message
163		fi
164	else
165		printf "$(gettext "%s entry already exists in KDC database").\n" $service_princ >&2
166	fi
167
168	klist -k 1>$TMP_FILE 2>&1
169	egrep -s "$service_princ@$realm" $TMP_FILE
170	if [[ $? -eq 0 ]]; then
171		printf "$(gettext "%s entry already present in keytab").\n" $service_princ >&2
172		# Don't care is this succeeds or not, just need to replace old
173		# entries as it is assummed that the client is reinitialized
174		kadmin -c $KRB5CCNAME -q "$ktremsubcommand" 1>$TMP_FILE 2>&1
175	fi
176
177	kadmin -c $KRB5CCNAME -q "$ktaddsubcommand" 1>$TMP_FILE 2>&1
178	egrep -s "$(gettext "added to keytab WRFILE:$KRB5_KEYTAB_FILE.")" $TMP_FILE
179	if [[ $? -ne 0 ]]; then
180		cat $TMP_FILE;
181		printf "\n$(gettext "kadmin: ktadd of %s failed, exiting").\n" $service_princ >&2
182		error_message
183	else
184		printf "$(gettext "%s entry ADDED to keytab").\n" $service_princ
185	fi
186
187	done
188}
189
190function writeup_krb5_conf {
191	typeset dh
192
193	printf "\n$(gettext "Setting up %s").\n\n" $KRB5_CONFIG_FILE
194
195	exec 3>$KRB5_CONFIG
196	if [[ $? -ne 0 ]]; then
197		printf "\n$(gettext "Can not write to %s, exiting").\n" $KRB5_CONFIG >&2
198		error_message
199	fi
200
201	printf "[libdefaults]\n" 1>&3
202	if [[ $no_keytab == yes ]]; then
203		printf "\tverify_ap_req_nofail = false\n" 1>&3
204	fi
205	if [[ $dns_lookup == yes ]]; then
206	    printf "\t$dnsarg = on\n" 1>&3
207	    if [[ $dnsarg == dns_lookup_kdc ]]; then
208		printf "\tdefault_realm = $realm\n" 1>&3
209		printf "\n[domain_realm]\n" 1>&3
210		if [[ -n $fkdc_list ]]; then
211			for kdc in $fkdc_list; do
212				printf "\t$kdc = $realm\n" 1>&3
213			done
214		fi
215		printf "\t$FKDC = $realm\n" 1>&3
216		printf "\t$client_machine = $realm\n" 1>&3
217		if [[ -z $short_fqdn ]]; then
218			printf "\t.$domain = $realm\n\n" 1>&3
219		else
220			printf "\t.$short_fqdn = $realm\n\n" 1>&3
221		fi
222		if [[ -n $domain_list ]]; then
223			for dh in $domain_list; do
224				printf "\t$dh = $realm\n" 1>&3
225			done
226		fi
227	    else
228		if [[ $dnsarg = dns_lookup_realm ]]; then
229		    printf "\tdefault_realm = $realm\n" 1>&3
230		    printf "\n[realms]\n" 1>&3
231		    printf "\t$realm = {\n" 1>&3
232		    if [[ -n $kdc_list ]]; then
233			for kdc in $kdc_list; do
234				printf "\t\tkdc = $kdc\n" 1>&3
235			done
236		    else
237		    	printf "\t\tkdc = $KDC\n" 1>&3
238		    fi
239		    printf "\t\tadmin_server = $KDC\n" 1>&3
240		    if [[ $non_solaris == yes ]]; then
241			printf "\n\t\tkpasswd_protocol = SET_CHANGE\n" 1>&3
242		    fi
243		    printf "\t}\n\n" 1>&3
244		else
245		    printf "\tdefault_realm = $realm\n\n" 1>&3
246		fi
247	    fi
248	else
249	    printf "\tdefault_realm = $realm\n\n" 1>&3
250
251	    printf "[realms]\n" 1>&3
252	    printf "\t$realm = {\n" 1>&3
253	    if [[ -n $kdc_list ]]; then
254		for kdc in $kdc_list; do
255			printf "\t\tkdc = $kdc\n" 1>&3
256		done
257	    else
258	    	printf "\t\tkdc = $KDC\n" 1>&3
259	    fi
260	    printf "\t\tadmin_server = $KDC\n" 1>&3
261	    if [[ $non_solaris == yes ]]; then
262	    	printf "\n\t\tkpasswd_protocol = SET_CHANGE\n" 1>&3
263	    fi
264	    printf "\t}\n\n" 1>&3
265
266	    printf "[domain_realm]\n" 1>&3
267	    if [[ -n $fkdc_list ]]; then
268		for kdc in $fkdc_list; do
269			printf "\t$kdc = $realm\n" 1>&3
270		done
271	    fi
272	    printf "\t$FKDC = $realm\n" 1>&3
273	    printf "\t$client_machine = $realm\n" 1>&3
274	    if [[ -z $short_fqdn ]]; then
275		printf "\t.$domain = $realm\n\n" 1>&3
276	    else
277		printf "\t.$short_fqdn = $realm\n\n" 1>&3
278	    fi
279	    if [[ -n $domain_list ]]; then
280		for dh in $domain_list; do
281			printf "\t$dh = $realm\n" 1>&3
282		done
283	    fi
284	fi
285
286	printf "[logging]\n" 1>&3
287	printf "\tdefault = FILE:/var/krb5/kdc.log\n" 1>&3
288	printf "\tkdc = FILE:/var/krb5/kdc.log\n" 1>&3
289	printf "\tkdc_rotate = {\n\t\tperiod = 1d\n\t\tversions = 10\n\t}\n\n" 1>&3
290
291	printf "[appdefaults]\n" 1>&3
292	printf "\tkinit = {\n\t\trenewable = true\n\t\tforwardable = true\n" 1>&3
293	if [[ $no_keytab == yes ]]; then
294		printf "\t\tno_addresses = true\n" 1>&3
295	fi
296	printf "\t}\n" 1>&3
297}
298
299function ask {
300	typeset question=$1
301	typeset default_answer=$2
302
303	if [[ -z $default_answer ]]; then
304		printf "$question :"
305	else
306		printf "$question [$default_answer]: "
307	fi
308	read answer
309	test -z "$answer" && answer="$default_answer"
310}
311
312function yesno {
313	typeset question="$1"
314
315	answer=
316	yn=`printf "$(gettext "y/n")"`
317	y=`printf "$(gettext "y")"`
318	n=`printf "$(gettext "n")"`
319	yes=`printf "$(gettext "yes")"`
320	no=`printf "$(gettext "no")"`
321
322	while [[ -z $answer ]]; do
323		ask "$question" $yn
324		case $answer in
325			$y|$yes)	answer=yes;;
326			$n|$no)		answer=no;;
327			*)		answer=;;
328		esac
329	done
330}
331
332function query {
333	yesno "$*"
334
335	if [[ $answer == no ]]; then
336		printf "\t$(gettext "No action performed").\n"
337	fi
338}
339
340
341function read_profile {
342	typeset param value
343	typeset file="$1"
344
345	if [[ ! -d $file && -r $file ]]; then
346		while read param value
347		do
348			case $param in
349			REALM)  if [[ -z $realm ]]; then
350					realm="$value"
351					checkval="REALM"; check_value $realm
352				fi
353				;;
354			KDC)    if [[ -z $KDC ]]; then
355					KDC="$value"
356					checkval="KDC"; check_value $KDC
357				fi
358				;;
359			ADMIN)  if [[ -z $ADMIN_PRINC ]]; then
360					ADMIN_PRINC="$value"
361					checkval="ADMIN_PRINC"
362    					check_value $ADMIN_PRINC
363				fi
364				;;
365			FILEPATH)  if [[ -z $filepath ]]; then
366					filepath="$value"
367				   fi
368				   ;;
369			NFS)    if [[ -z $add_nfs ]]; then
370				    if [[ $value == 1 ]]; then
371					    add_nfs=yes
372				    else
373					    add_nfs=no
374				    fi
375				fi
376				;;
377			NOKEY)    if [[ -z $no_keytab ]]; then
378				    if [[ $value == 1 ]]; then
379					    no_keytab=yes
380				    else
381					    no_keytab=no
382				    fi
383				fi
384				;;
385			NOSOL)  if [[ -z $non_solaris ]]; then
386				    if [[ $value == 1 ]]; then
387					    non_solaris=yes
388					    no_keytab=yes
389				    else
390					    non_solaris=no
391				    fi
392				fi
393				;;
394			LHN)    if [[ -z $logical_hn ]]; then
395					logical_hn="$value"
396					checkval="LOGICAL_HOSTNAME"
397    					check_value $logical_hn
398				fi
399				;;
400			DNSLOOKUP) if [[ -z $dnsarg ]]; then
401					dnsarg="$value"
402					checkval="DNS_OPTIONS"
403					check_value $dnsarg
404				   fi
405				   ;;
406			FQDN) if [[ -z $fqdnlist ]]; then
407					fqdnlist="$value"
408					checkval="FQDN"
409					check_value $fqdnlist
410					verify_fqdnlist "$fqdnlist"
411			      fi
412			      ;;
413			MSAD) if [[ -z $msad ]]; then
414				if [[ $value == 1 ]]; then
415					msad=yes
416					non_solaris=yes
417				else
418					msad=no
419				fi
420			      fi
421			      ;;
422			esac
423		done <$file
424	else
425		printf "\n$(gettext "The kclient profile \`%s' is not valid, exiting").\n" $file >&2
426		error_message
427	fi
428}
429
430function ping_check {
431	typeset machine="$1"
432	typeset string="$2"
433
434	if ping $machine 2 > /dev/null 2>&1; then
435		:
436	else
437		printf "\n$(gettext "%s %s is unreachable, exiting").\n" $string $machine >&2
438		error_message
439	fi
440
441	# Output timesync warning if not using a profile, i.e. in
442	# interactive mode.
443	if [[ -z $profile && $string == KDC ]]; then
444		# It's difficult to sync up time with KDC esp. if in a
445		# zone so just print a warning about KDC time sync.
446		printf "\n$(gettext "Note, this system and the KDC's time must be within 5 minutes of each other for Kerberos to function").\n" >&2
447		printf "$(gettext "Both systems should run some form of time synchronization system like Network Time Protocol (NTP)").\n" >&2
448break
449	fi
450}
451
452function check_value {
453	typeset arg="$1"
454
455	if [[ -z $arg ]]; then
456		printf "\n$(gettext "No input obtained for %s, exiting").\n" $checkval >&2
457		error_message
458	else
459		echo "$arg" > $TMP_FILE
460		if egrep -s '[*$^#!]+' $TMP_FILE; then
461			printf "\n$(gettext "Invalid input obtained for %s, exiting").\n" $checkval >&2
462			error_message
463		fi
464	fi
465}
466
467function set_dns_value {
468	typeset -l arg="$1"
469
470	if [[ $arg == dns_lookup_kdc  ||  $arg == dns_lookup_realm  || $arg == dns_fallback ]]; then
471		dns_lookup=yes
472	else
473		if [[ $arg == none ]]; then
474			dns_lookup=no
475		else
476			printf "\n$(gettext "Invalid DNS lookup option, exiting").\n" >&2
477			error_message
478		fi
479	fi
480}
481
482function verify_kdcs {
483	typeset k_list="$1"
484	typeset -l kdc
485	typeset list fqhn f_list
486
487	kdc_list=$(echo "$k_list" | sed 's/,/ /g')
488
489	if [[ -z $k_list ]]; then
490		printf "\n$(gettext "At least one KDC should be listed").\n\n" >&2
491		usage
492	fi
493
494	for kdc in $k_list; do
495		if [[ $kdc != $KDC ]]; then
496			list="$list $kdc"
497			fkdc=`$KLOOKUP $kdc`
498			if ping $fkdc 2 > /dev/null; then
499				:
500			else
501				printf "\n$(gettext "%s %s is unreachable, no action performed").\n" "KDC" $fkdc >&2
502			fi
503			f_list="$f_list $fkdc"
504		fi
505	done
506
507	fkdc_list="$f_list"
508	kdc_list="$list"
509}
510
511function parse_service {
512	typeset service_list=$1
513
514	service_list=${service_list//,/ }
515	for service in $service_list; do
516		svc=${service%:}
517		auth_type=${service#:}
518		[[ -z $svc || -z $auth_type ]] && return
519		print -- $svc $auth_type
520	done
521}
522
523function verify_fqdnlist {
524	typeset list="$1"
525	typeset -l hostname
526	typeset -i count=1
527	typeset fqdnlist eachfqdn tmpvar fullhost
528
529	list=$(echo "$list" | tr -d " " | tr -d "\t")
530	hostname=$(uname -n | cut -d"." -f1)
531	fqdnlist=$client_machine
532
533	eachfqdn=$(echo "$list" | cut -d"," -f$count)
534	if [[ -z $eachfqdn ]]; then
535		printf "\n$(gettext "If the -f option is used, at least one FQDN should be listed").\n\n" >&2
536		usage
537	else
538		while [[ ! -z $eachfqdn ]]; do
539			tmpvar=$(echo "$eachfqdn" | cut -d"." -f1)
540			if [[ -z $tmpvar ]]; then
541				fullhost="$hostname$eachfqdn"
542			else
543				fullhost="$hostname.$eachfqdn"
544			fi
545
546			ping_check $fullhost $(gettext "System")
547			if [[ $fullhost == $client_machine ]]; then
548				:
549			else
550				fqdnlist="$fqdnlist $fullhost"
551			fi
552
553			if [[ $list == *,* ]]; then
554				((count = count + 1))
555				eachfqdn=$(echo "$list" | cut -d"," -f$count)
556			else
557				break
558			fi
559		done
560	fi
561}
562
563function setup_keytab {
564	typeset cname ask_fqdns current_release
565
566	#
567	# 1. kinit with ADMIN_PRINC
568	#
569
570	if [[ -z $ADMIN_PRINC ]]; then
571		printf "\n$(gettext "Enter the krb5 administrative principal to be used"): "
572		read ADMIN_PRINC
573		checkval="ADMIN_PRINC"; check_value $ADMIN_PRINC
574	fi
575
576	echo "$ADMIN_PRINC">$TMP_FILE
577
578	[[ -n $msad ]] && return
579	if egrep -s '\/admin' $TMP_FILE; then
580		# Already in "/admin" format, do nothing
581		:
582	else
583		if egrep -s '\/' $TMP_FILE; then
584			printf "\n$(gettext "Improper entry for krb5 admin principal, exiting").\n" >&2
585			error_message
586		else
587			ADMIN_PRINC=$(echo "$ADMIN_PRINC/admin")
588		fi
589	fi
590
591	printf "$(gettext "Obtaining TGT for %s") ...\n" $ADMIN_PRINC
592
593	cname=$(canon_resolve $KDC)
594	if [[ -n $cname ]]; then
595		kinit -S kadmin/$cname $ADMIN_PRINC
596	else
597		kinit -S kadmin/$FKDC $ADMIN_PRINC
598	fi
599	klist 1>$TMP_FILE 2>&1
600	if egrep -s "$(gettext "Valid starting")" $TMP_FILE && egrep -s "kadmin/$FKDC@$realm" $TMP_FILE; then
601    		:
602	else
603		printf "\n$(gettext "kinit of %s failed, exiting").\n" $ADMIN_PRINC >&2
604		error_message
605	fi
606
607	#
608	# 2. Do we want to create and/or add service principal(s) for fqdn's
609	#    other than the one listed in resolv.conf(4) ?
610	#
611	if [[ -z $options ]]; then
612		query "$(gettext "Do you have multiple DNS domains spanning the Kerberos realm") $realm ?"
613		ask_fqdns=$answer
614		if [[ $ask_fqdns == yes ]]; then
615			printf "$(gettext "Enter a comma-separated list of DNS domain names"): "
616			read fqdnlist
617			verify_fqdnlist "$fqdnlist"
618		else
619			fqdnlist=$client_machine
620		fi
621	else
622		if [[ -z $fqdnlist ]]; then
623			fqdnlist=$client_machine
624		fi
625	fi
626
627	if [[ $add_nfs == yes ]]; then
628		echo; call_kadmin nfs
629	fi
630
631	# Add the host entry to the keytab
632	echo; call_kadmin host
633
634}
635
636function setup_lhn {
637	typeset -l logical_hn
638
639	echo "$logical_hn" > $TMP_FILE
640	if egrep -s '[^.]\.[^.]+$' $TMP_FILE; then
641		# do nothing, logical_hn is in fqdn format
642		:
643	else
644		if egrep -s '\.+' $TMP_FILE; then
645			printf "\n$(gettext "Improper format of logical hostname, exiting").\n" >&2
646			error_message
647		else
648			# Attach fqdn to logical_hn, to get the Fully Qualified
649			# Host Name of the client requested
650			logical_hn=$(echo "$logical_hn.$fqdn")
651		fi
652	fi
653
654	client_machine=$logical_hn
655
656	ping_check $client_machine $(gettext "System")
657}
658
659function usage {
660	printf "\n$(gettext "Usage: kclient [ options ]")\n" >&2
661	printf "\t$(gettext "where options are any of the following")\n\n" >&2
662	printf "\t$(gettext "[ -D domain_list ]  configure a client that has mul
663tiple mappings of doamin and/or hosts to the default realm")\n" >&2
664	printf "\t$(gettext "[ -K ]  configure a client that does not have host/service keys")\n" >&2
665	printf "\t$(gettext "[ -R realm ]  specifies the realm to use")\n" >&2
666	printf "\t$(gettext "[ -T kdc_vendor ]  specifies which KDC vendor is the server")\n" >&2
667	printf "\t$(gettext "[ -a adminuser ]  specifies the Kerberos administrator")\n" >&2
668	printf "\t$(gettext "[ -c filepath ]  specifies the krb5.conf path used to configure this client")\n" >&2
669	printf "\t$(gettext "[ -d dnsarg ]  specifies which information should be looked up in DNS (dns_lookup_kdc, dns_lookup_realm, and dns_fallback)")\n" >&2
670	printf "\t$(gettext "[ -f fqdn_list ]  specifies which domains to configure host keys for this client")\n" >&2
671	printf "\t$(gettext "[ -h logicalhostname ]  configure the logical host name for a client that is in a cluster")\n" >&2
672	printf "\t$(gettext "[ -k kdc_list ]  specify multiple KDCs, if -m is not used the first KDC in the list is assumed to be the master.  KDC host names are used verbatim.")\n" >&2
673	printf "\t$(gettext "[ -m master ]  master KDC server host name")\n" >&2
674	printf "\t$(gettext "[ -n ]  configure client to be an NFS client")\n" >&2
675	printf "\t$(gettext "[ -p profile ]  specifies which profile file to use to configure this client")\n" >&2
676	printf "\t$(gettext "[ -s pam_list ]  update the service for Kerberos authentication")\n" >&2
677	error_message
678}
679
680function discover_domain {
681	typeset dom DOMs
682
683	if [[ -z $realm ]]; then
684		set -A DOMs -- `$KLOOKUP _ldap._tcp.dc._msdcs S`
685	else
686		set -A DOMs -- `$KLOOKUP _ldap._tcp.dc._msdcs.$realm S`
687	fi
688
689	[[ -z ${DOMs[0]} ]] && return 1
690
691	dom=${DOMs[0]}
692
693	dom=${dom#*.}
694	dom=${dom% *}
695
696	domain=$dom
697
698	return 0
699}
700
701function check_nss_hosts_or_ipnodes_config {
702	typeset backend
703
704	for backend in $1
705	do
706		[[ $backend == dns ]] && return 0
707	done
708	return 1
709}
710
711function check_nss_conf {
712	typeset i j hosts_config
713
714	for i in hosts ipnodes
715	do
716		grep "^${i}:" /etc/nsswitch.conf|read j hosts_config
717		check_nss_hosts_or_ipnodes_config "$hosts_config" || return 1
718	done
719
720	return 0
721}
722
723function canon_resolve {
724	typeset name ip
725
726	name=`$KLOOKUP $1 C`
727	[[ -z $name ]] && name=`$KLOOKUP $1 A`
728	[[ -z $name ]] && return
729
730	ip=`$KLOOKUP $name I`
731	[[ -z $ip ]] && return
732	for i in $ip
733	do
734		if ping $i 2 > /dev/null 2>&1; then
735			break
736		else
737			i=
738		fi
739	done
740
741	cname=`$KLOOKUP $ip P`
742	[[ -z $cname ]] && return
743
744	print -- "$cname"
745}
746
747function rev_resolve {
748	typeset name ip
749
750	ip=`$KLOOKUP $1 I`
751
752	[[ -z $ip ]] && return
753	name=`$KLOOKUP $ip P`
754	[[ -z $name ]] && return
755
756	print -- $name
757}
758
759# Convert an AD-style domain DN to a DNS domainname
760function dn2dns {
761	typeset OIFS dname dn comp components
762
763	dn=$1
764	dname=
765
766	OIFS="$IFS"
767	IFS=,
768	set -A components -- $1
769	IFS="$OIFS"
770
771	for comp in "${components[@]}"
772	do
773		[[ "$comp" == [dD][cC]=* ]] || continue
774		dname="$dname.${comp#??=}"
775	done
776
777	print ${dname#.}
778}
779
780# Form a base DN from a DNS domainname and container
781function getBaseDN {
782	if [[ -n "$2" ]]
783	then
784		baseDN="CN=$1,$(dns2dn $2)"
785	else
786		baseDN="$(dns2dn $2)"
787	fi
788}
789
790# Convert a DNS domainname to an AD-style DN for that domain
791function dns2dn {
792	typeset OIFS dn labels
793
794	OIFS="$IFS"
795	IFS=.
796	set -A labels -- $1
797	IFS="$OIFS"
798
799	dn=
800	for label in "${labels[@]}"
801	do
802		dn="${dn},DC=$label"
803	done
804
805	print -- "${dn#,}"
806}
807
808function getSRVs {
809	typeset srv port
810
811	$KLOOKUP $1 S | while read srv port
812	do
813		if ping $srv 2 > /dev/null 2>&1; then
814			print -- $srv $port
815		fi
816	done
817}
818
819function getKDC {
820	typeset j
821
822	set -A KPWs -- $(getSRVs _kpasswd._tcp.$dom.)
823	kpasswd=${KPWs[0]}
824
825	if [[ -n $siteName ]]
826	then
827		set -A KDCs -- $(getSRVs _kerberos._tcp.$siteName._sites.$dom.)
828		kdc=${KDCs[0]}
829		[[ -n $kdc ]] && return
830	fi
831
832	# No site name
833	set -A KDCs -- $(getSRVs _kerberos._tcp.$dom.)
834	kdc=${KDCs[0]}
835	[[ -n $kdc ]] && return
836
837	# Default
838	set -A KDCs -- $DomainDnsZones 88
839	kdc=$ForestDnsZones
840}
841
842function getDC {
843	typeset j
844
845	if [[ -n $siteName ]]
846	then
847		set -A DCs -- $(getSRVs _ldap._tcp.$siteName._sites.dc._msdcs.$dom.)
848		dc=${DCs[0]}
849		[[ -n $dc ]] && return
850	fi
851
852	# No site name
853	set -A DCs -- $(getSRVs _ldap._tcp.dc._msdcs.$dom.)
854	dc=${DCs[0]}
855	[[ -n $dc ]] && return
856
857	# Default
858	set -A DCs -- $DomainDnsZones 389
859	dc=$DomainDnsZones
860}
861
862function write_ads_krb5conf {
863	printf "\n$(gettext "Setting up %s").\n\n" $KRB5_CONFIG_FILE
864
865	exec 3>$KRB5_CONFIG
866	if [[ $? -ne 0 ]]; then
867		printf "\n$(gettext "Can not write to %s, exiting").\n" $KRB5_CONFIG >&2
868		error_message
869	fi
870
871	printf "[libdefaults]\n" 1>&3
872	printf "\tdefault_realm = $realm\n" 1>&3
873	printf "\n[realms]\n" 1>&3
874	printf "\t$realm = {\n" 1>&3
875	for i in ${KDCs[@]}
876	do
877		[[ $i == +([0-9]) ]] && continue
878		printf "\t\tkdc = $i\n" 1>&3
879	done
880	# Defining the same as admin_server.  This would cause auth failures
881	# if this was different.
882	printf "\n\t\tkpasswd_server = $KDC\n" 1>&3
883	printf "\n\t\tadmin_server = $KDC\n" 1>&3
884	printf "\t\tkpasswd_protocol = SET_CHANGE\n\t}\n" 1>&3
885	printf "\n[domain_realm]\n" 1>&3
886	printf "\t.$dom = $realm\n\n" 1>&3
887	printf "[logging]\n" 1>&3
888	printf "\tdefault = FILE:/var/krb5/kdc.log\n" 1>&3
889	printf "\tkdc = FILE:/var/krb5/kdc.log\n" 1>&3
890	printf "\tkdc_rotate = {\n\t\tperiod = 1d\n\t\tversions = 10\n\t}\n\n" 1>&3
891	printf "[appdefaults]\n" 1>&3
892	printf "\tkinit = {\n\t\trenewable = true\n\t\tforwardable = true\n\t}\n" 1>&3
893}
894
895function getForestName {
896	ldapsearch -R -T -h $dc $ldap_args \
897	    -b "" -s base "" schemaNamingContext| \
898		grep ^schemaNamingContext|read j schemaNamingContext
899
900	if [[ $? -ne 0 ]]; then
901		printf "$(gettext "Can't find forest").\n" >&2
902		error_message
903	fi
904	schemaNamingContext=${schemaNamingContext#CN=Schema,CN=Configuration,}
905
906	[[ -z $schemaNamingContext ]] && return 1
907
908	forest=
909	while [[ -n $schemaNamingContext ]]
910	do
911		schemaNamingContext=${schemaNamingContext#DC=}
912		forest=${forest}.${schemaNamingContext%%,*}
913		[[ "$schemaNamingContext" = *,* ]] || break
914		schemaNamingContext=${schemaNamingContext#*,}
915	done
916	forest=${forest#.}
917}
918
919function getGC {
920	typeset j
921
922	[[ -n $gc ]] && return 0
923
924	if [[ -n $siteName ]]
925	then
926		set -A GCs -- $(getSRVs _ldap._tcp.$siteName._sites.gc._msdcs.$forest.)
927		gc=${GCs[0]}
928		[[ -n $gc ]] && return
929	fi
930
931	# No site name
932	set -A GCs -- $(getSRVs _ldap._tcp.gc._msdcs.$forest.)
933	gc=${GCs[0]}
934	[[ -n $gc ]] && return
935
936	# Default
937	set -A GCs -- $ForestDnsZones 3268
938	gc=$ForestDnsZones
939}
940
941#
942# The local variables used to calculate the IP address are of type unsigned
943# integer (-ui), as this is required to restrict the integer to 32b.
944# Starting in ksh88, Solaris has incorrectly assummed that -i represents 64b.
945#
946function ipAddr2num {
947	typeset OIFS
948	typeset -ui16 num
949
950	if [[ "$1" != +([0-9]).+([0-9]).+([0-9]).+([0-9]) ]]
951	then
952		print 0
953		return 0
954	fi
955
956	OIFS="$IFS"
957	IFS=.
958	set -- $1
959	IFS="$OIFS"
960
961	num=$((${1}<<24 | ${2}<<16 | ${3}<<8 | ${4}))
962
963	print -- $num
964}
965
966#
967# The local variables used to calculate the IP address are of type unsigned
968# integer (-ui), as this is required to restrict the integer to 32b.
969# Starting in ksh88, Solaris has incorrectly assummed that -i represents 64b.
970#
971function num2ipAddr {
972	typeset -ui16 num
973	typeset -ui10 a b c d
974
975	num=$1
976	a=$((num>>24        ))
977	b=$((num>>16 & 16#ff))
978	c=$((num>>8  & 16#ff))
979	d=$((num     & 16#ff))
980	print -- $a.$b.$c.$d
981}
982
983#
984# The local variables used to calculate the IP address are of type unsigned
985# integer (-ui), as this is required to restrict the integer to 32b.
986# Starting in ksh88, Solaris has incorrectly assummed that -i represents 64b.
987#
988function netmask2length {
989	typeset -ui16 netmask
990	typeset -i len
991
992	netmask=$1
993	len=32
994	while [[ $((netmask % 2)) -eq 0 ]]
995	do
996		netmask=$((netmask>>1))
997		len=$((len - 1))
998	done
999	print $len
1000}
1001
1002#
1003# The local variables used to calculate the IP address are of type unsigned
1004# integer (-ui), as this is required to restrict the integer to 32b.
1005# Starting in ksh88, Solaris has incorrectly assummed that -i represents 64b.
1006#
1007function getSubnets {
1008	typeset -ui16 addr netmask
1009	typeset -ui16 classa=16\#ff000000
1010
1011	ifconfig -a|while read line
1012	do
1013		addr=0
1014		netmask=0
1015		set -- $line
1016		[[ $1 == inet ]] || continue
1017		while [[ $# -gt 0 ]]
1018		do
1019			case "$1" in
1020				inet) addr=$(ipAddr2num $2); shift;;
1021				netmask) eval netmask=16\#$2; shift;;
1022				*) :;
1023			esac
1024			shift
1025		done
1026
1027		[[ $addr -eq 0 || $netmask -eq 0 ]] && continue
1028		[[ $((addr & classa)) -eq 16\#7f000000 ]] && continue
1029
1030		print $(num2ipAddr $((addr & netmask)))/$(netmask2length $netmask)
1031	done
1032}
1033
1034function getSite {
1035	typeset subnet siteDN j ldapsrv subnet_dom
1036
1037	eval "[[ -n \"\$siteName\" ]]" && return
1038	for subnet in $(getSubnets)
1039	do
1040		ldapsearch -R -T -h $dc $ldap_args \
1041		    -p 3268 -b "" -s sub cn=$subnet dn |grep ^dn|read j subnetDN
1042
1043		[[ -z $subnetDN ]] && continue
1044		subnet_dom=$(dn2dns $subnetDN)
1045		ldapsrv=$(canon_resolve DomainDnsZones.$subnet_dom)
1046		[[ -z $ldapsrv ]] && continue
1047		ldapsearch -R -T -h $ldapsrv $ldap_args \
1048		    -b "$subnetDN" -s base "" siteObject \
1049		    |grep ^siteObject|read j siteDN
1050
1051		[[ -z $siteDN ]] && continue
1052
1053		eval siteName=${siteDN%%,*}
1054		eval siteName=\${siteName#CN=}
1055		return
1056	done
1057}
1058
1059function doKRB5config {
1060	[[ -f $KRB5_CONFIG_FILE ]] && \
1061		cp $KRB5_CONFIG_FILE ${KRB5_CONFIG_FILE}-pre-kclient
1062
1063	[[ -f $KRB5_KEYTAB_FILE ]] && \
1064		cp $KRB5_KEYTAB_FILE ${KRB5_KEYTAB_FILE}-pre-kclient
1065
1066	[[ -s $KRB5_CONFIG ]] && cp $KRB5_CONFIG $KRB5_CONFIG_FILE
1067	[[ -s $KRB5_CONFIG_FILE ]] && chmod 0644 $KRB5_CONFIG_FILE
1068	[[ -s $new_keytab ]] && cp $new_keytab $KRB5_KEYTAB_FILE
1069	[[ -s $KRB5_KEYTAB_FILE ]] && chmod 0600 $KRB5_KEYTAB_FILE
1070}
1071
1072function addDNSRR {
1073	smbFMRI=svc:/network/smb/server:default
1074	ddnsProp=smbd/ddns_enable
1075	enProp=general/enabled
1076
1077	enabled=`svcprop -p $enProp $smbFMRI`
1078	ddns_enable=`svcprop -p $ddnsProp $smbFMRI`
1079
1080	if [[ $enabled == true && $ddns_enable != true ]]; then
1081		printf "$(gettext "Warning: won't create DNS records for client").\n"
1082		printf "$(gettext "%s property not set to 'true' for the %s FMRI").\n" $ddnsProp $smbFMRI
1083		return
1084	fi
1085
1086	# Destroy any existing ccache as GSS_C_NO_CREDENTIAL will pick up any
1087	# residual default credential in the cache.
1088	kdestroy > /dev/null 2>&1
1089
1090	$KDYNDNS -d $1 > /dev/null 2>&1
1091	if [[ $? -ne 0 ]]; then
1092		#
1093		# Non-fatal, we should carry-on as clients may resolve to
1094		# different servers and the client could already exist there.
1095		#
1096		printf "$(gettext "Warning: unable to create DNS records for client").\n"
1097		printf "$(gettext "This could mean that '%s' is not included as a 'nameserver' in the /etc/resolv.conf file or some other type of error").\n" $dc
1098	fi
1099}
1100
1101function setSMB {
1102	typeset domain=$1
1103	typeset server=$2
1104	smbFMRI=svc:/network/smb/server
1105
1106	printf "%s" $newpw | $KSMB -d $domain -s $server
1107	if [[ $? -ne 0 ]]; then
1108		printf "$(gettext "Warning: unable to set %s domain, server and password information").\n" $smbFMRI
1109		return
1110	fi
1111
1112	svcadm restart $smbFMRI > /dev/null 2>&1
1113	if [[ $? -ne 0 ]]; then
1114		printf "$(gettext "Warning: unable to restart %s").\n" $smbFMRI
1115	fi
1116}
1117
1118function compareDomains {
1119	typeset oldDom hspn newDom=$1
1120
1121	# If the client has been previously configured in a different
1122	# realm/domain then we need to prompt the user to see if they wish to
1123	# switch domains.
1124	klist -k 2>&1 | grep @ | read j hspn
1125	[[ -z $hspn ]] && return
1126
1127	oldDom=${hspn#*@}
1128	if [[ $oldDom != $newDom ]]; then
1129		printf "$(gettext "The client is currently configured in a different domain").\n"
1130		printf "$(gettext "Currently in the '%s' domain, trying to join the '%s' domain").\n" $oldDom $newDom
1131		query "$(gettext "Do you want the client to join a new domain") ?"
1132		printf "\n"
1133		if [[ $answer != yes ]]; then
1134			printf "$(gettext "Client will not be joined to the new domain").\n" >&2
1135			error_message
1136		fi
1137	fi
1138}
1139
1140function getKDCDC {
1141
1142	getKDC
1143	if [[ -n $kdc ]]; then
1144		KDC=$kdc
1145		dc=$kdc
1146	else
1147		getDC
1148		if [[ -n $dc ]]; then
1149			KDC=$dc
1150		else
1151			printf "$(gettext "Could not find domain controller server for '%s'.  Exiting").\n" $realm >&2
1152			error_message
1153		fi
1154	fi
1155}
1156
1157function join_domain {
1158	typeset -u upcase_nodename
1159	typeset netbios_nodename fqdn
1160
1161	container=Computers
1162	ldap_args="-o authzid= -o mech=gssapi"
1163	userAccountControlBASE=4096
1164
1165	if [[ -z $ADMIN_PRINC ]]; then
1166		cprinc=Administrator
1167	else
1168		cprinc=$ADMIN_PRINC
1169	fi
1170
1171	if ! discover_domain; then
1172		printf "$(gettext "Can not find realm") '%s'.\n" $realm >&2
1173		error_message
1174	fi
1175
1176	dom=$domain
1177	realm=$domain
1178	upcase_nodename=$hostname
1179	netbios_nodename="${upcase_nodename}\$"
1180	fqdn=$hostname.$domain
1181	upn=host/${fqdn}@${realm}
1182
1183	grep=/usr/xpg4/bin/grep
1184
1185	object=$(mktemp -q -t kclient-computer-object.XXXXXX)
1186	if [[ -z $object ]]; then
1187		printf "\n$(gettext "Can not create temporary file, exiting").\n
1188" >&2
1189		error_message
1190        fi
1191
1192	grep=/usr/xpg4/bin/grep
1193
1194	modify_existing=false
1195	recreate=false
1196
1197	DomainDnsZones=$(rev_resolve DomainDnsZones.$dom.)
1198	ForestDnsZones=$(rev_resolve ForestDnsZones.$dom.)
1199
1200	getBaseDN "$container" "$dom"
1201
1202	if [[ -n $KDC ]]; then
1203		dc=$KDC
1204	else
1205		getKDCDC
1206	fi
1207
1208	write_ads_krb5conf
1209
1210	printf "$(gettext "Attempting to join '%s' to the '%s' domain").\n\n" $upcase_nodename $realm
1211
1212	kinit $cprinc@$realm
1213	if [[ $? -ne 0 ]]; then
1214		printf "$(gettext "Could not authenticate %s.  Exiting").\n" $cprinc@$realm >&2
1215		error_message
1216	fi
1217
1218	if getForestName
1219	then
1220		printf "\n$(gettext "Forest name found: %s")\n\n" $forest
1221	else
1222		printf "\n$(gettext "Forest name not found, assuming forest is the domain name").\n"
1223	fi
1224
1225	getGC
1226	getSite
1227
1228	if [[ -z $siteName ]]
1229	then
1230    		printf "$(gettext "Site name not found.  Local DCs/GCs will not be discovered").\n\n"
1231	else
1232    		printf "$(gettext "Looking for _local_ KDCs, DCs and global catalog servers (SRV RRs)").\n"
1233		getKDCDC
1234		getGC
1235
1236		write_ads_krb5conf
1237	fi
1238
1239	if [[ ${#GCs} -eq 0 ]]; then
1240		printf "$(gettext "Could not find global catalogs.  Exiting").\n" >&2
1241		error_message
1242	fi
1243
1244	# Check to see if the client is transitioning between domains.
1245	compareDomains $realm
1246
1247	# Here we check domainFunctionality to see which release:
1248	# 0, 1, 2: Windows 2000, 2003 Interim, 2003 respecitively
1249	# 3: Windows 2008
1250	level=0
1251	ldapsearch -R -T -h "$dc" $ldap_args -b "" -s base "" \
1252	 domainControllerFunctionality| grep ^domainControllerFunctionality| \
1253	 read j level
1254	if [[ $? -ne 0 ]]; then
1255		printf "$(gettext "Search for domain functionality failed, exiting").\n" >&2
1256		error_message
1257	fi
1258
1259	if ldapsearch -R -T -h "$dc" $ldap_args -b "$baseDN" \
1260	    -s sub sAMAccountName="$netbios_nodename" dn > /dev/null 2>&1
1261	then
1262		:
1263	else
1264		printf "$(gettext "Search for node failed, exiting").\n" >&2
1265		error_message
1266	fi
1267	ldapsearch -R -T -h "$dc" $ldap_args -b "$baseDN" -s sub \
1268	    sAMAccountName="$netbios_nodename" dn|grep "^dn:"|read j dn
1269
1270	if [[ -z $dn ]]; then
1271		: # modify_existing is already false, which is what we want.
1272	else
1273		printf "$(gettext "Computer account '%s' already exists in the '%s' domain").\n" $upcase_nodename $realm
1274		query "$(gettext "Do you wish to recreate this computer account") ?"
1275		printf "\n"
1276		if [[ $answer == yes ]]; then
1277			recreate=true
1278		else
1279			modify_existing=true
1280		fi
1281	fi
1282
1283	if [[ $modify_existing == false && -n $dn ]]; then
1284		query "$(gettext "Would you like to delete any sub-object found for this computer account") ?"
1285		if [[ $answer == yes ]]; then
1286			printf "$(gettext "Looking to see if the machine account contains other objects")...\n"
1287			ldapsearch -R -T -h "$dc" $ldap_args -b "$dn" -s sub "" dn | while read j sub_dn
1288			do
1289				[[ $j != dn: || -z $sub_dn || $dn == $sub_dn ]] && continue
1290				if $recreate; then
1291					printf "$(gettext "Deleting the following object: %s")\n" ${sub_dn#$dn}
1292					ldapdelete -h "$dc" $ldap_args "$sub_dn" > /dev/null 2>&1
1293					if [[ $? -ne 0 ]]; then
1294						printf "$(gettext "Error in deleting object: %s").\n" ${sub_dn#$dn}
1295					fi
1296				else
1297					printf "$(gettext "The following object will not be deleted"): %s\n" ${sub_dn#$dn}
1298				fi
1299			done
1300		fi
1301
1302		if $recreate; then
1303			ldapdelete -h "$dc" $ldap_args "$dn" > /dev/null 2>&1
1304			if [[ $? -ne 0 ]]; then
1305				printf "$(gettext "Error in deleting object: %s").\n" ${sub_dn#$dn} >&2
1306				error_message
1307			fi
1308		elif $modify_existing; then
1309			: # Nothing to delete
1310		else
1311			printf "$(gettext "A machine account already exists").\n" >&2
1312			error_message
1313		fi
1314	fi
1315
1316	if $modify_existing; then
1317		cat > "$object" <<EOF
1318dn: CN=$upcase_nodename,$baseDN
1319changetype: modify
1320replace: userPrincipalName
1321userPrincipalName: $upn
1322-
1323replace: servicePrincipalName
1324servicePrincipalName: host/${fqdn}
1325-
1326replace: userAccountControl
1327userAccountControl: $((userAccountControlBASE + 32 + 2))
1328-
1329replace: dNSHostname
1330dNSHostname: ${fqdn}
1331EOF
1332
1333		printf "$(gettext "A machine account already exists; updating it").\n"
1334		ldapadd -h "$dc" $ldap_args -f "$object" > /dev/null 2>&1
1335		if [[ $? -ne 0 ]]; then
1336			printf "$(gettext "Failed to create the AD object via LDAP").\n" >&2
1337			error_message
1338		fi
1339	else
1340		cat > "$object" <<EOF
1341dn: CN=$upcase_nodename,$baseDN
1342objectClass: computer
1343cn: $upcase_nodename
1344sAMAccountName: ${netbios_nodename}
1345userPrincipalName: $upn
1346servicePrincipalName: host/${fqdn}
1347userAccountControl: $((userAccountControlBASE + 32 + 2))
1348dNSHostname: ${fqdn}
1349EOF
1350
1351		printf "$(gettext "Creating the machine account in AD via LDAP").\n\n"
1352
1353		ldapadd -h "$dc" $ldap_args -f "$object" > /dev/null 2>&1
1354		if [[ $? -ne 0 ]]; then
1355			printf "$(gettext "Failed to create the AD object via LDAP").\n" >&2
1356			error_message
1357		fi
1358	fi
1359
1360	# Generate a new password for the new account
1361	MAX_PASS=32
1362        i=0
1363
1364	while :
1365	do
1366		while ((MAX_PASS > i))
1367		do
1368			# 94 elements in the printable character set starting
1369			# at decimal 33, contiguous.
1370			dig=$((RANDOM%94+33))
1371			c=$(printf "\\`printf %o $dig`\n")
1372			p=$p$c
1373			((i+=1))
1374		done
1375
1376		# Ensure that we have four character classes.
1377		d=${p%[[:digit:]]*}
1378		a=${p%[[:lower:]]*}
1379		A=${p%[[:upper:]]*}
1380		x=${p%[[:punct:]]*}
1381
1382		# Just compare the number of characters from what was previously
1383		# matched.  If there is a difference then we found a match.
1384		n=${#p}
1385		[[ ${#d} -ne $n && ${#a} -ne $n && \
1386		   ${#A} -ne $n && ${#x} -ne $n ]] && break
1387		i=0
1388		p=
1389	done
1390	newpw=$p
1391
1392	# Set the new password
1393	printf "%s" $newpw | $KSETPW ${netbios_nodename}@${realm} > /dev/null 2>&1
1394	if [[ $? -ne 0 ]]
1395	then
1396		printf "$(gettext "Failed to set account password").\n" >&2
1397		error_message
1398	fi
1399
1400	# Lookup the new principal's kvno:
1401	ldapsearch -R -T -h "$dc" $ldap_args -b "$baseDN" \
1402		 -s sub cn=$upcase_nodename msDS-KeyVersionNumber| \
1403		grep "^msDS-KeyVersionNumber"|read j kvno
1404	[[ -z $kvno ]] && kvno=1
1405
1406	# Set supported enctypes.  This only works for Longhorn/Vista, so we
1407	# ignore errors here.
1408	userAccountControl=$((userAccountControlBASE + 524288 + 65536))
1409	set -A enctypes --
1410
1411	# Do we have local support for AES?
1412	encrypt -l|grep ^aes|read j minkeysize maxkeysize
1413	val=
1414	if [[ $maxkeysize -eq 256 ]]; then
1415		val=16
1416		enctypes[${#enctypes[@]}]=aes256-cts-hmac-sha1-96
1417	fi
1418	if [[ $minkeysize -eq 128 ]]; then
1419		((val=val+8))
1420		enctypes[${#enctypes[@]}]=aes128-cts-hmac-sha1-96
1421	fi
1422
1423	# RC4 comes next (whether it's better than 1DES or not -- AD prefers it)
1424	if encrypt -l|$grep -q ^arcfour
1425	then
1426		((val=val+4))
1427		enctypes[${#enctypes[@]}]=arcfour-hmac-md5
1428	else
1429		# Use 1DES ONLY if we don't have arcfour
1430		userAccountControl=$((userAccountControl + 2097152))
1431	fi
1432	if encrypt -l | $grep -q ^des
1433	then
1434		((val=val+2))
1435		enctypes[${#enctypes[@]}]=des-cbc-md5
1436	fi
1437
1438	if [[ ${#enctypes[@]} -eq 0 ]]
1439	then
1440		printf "$(gettext "No enctypes are supported").\n"
1441		printf "$(gettext "Please enable arcfour or 1DES, then re-join; see cryptoadm(1M)").\n" >&2
1442		error_message
1443	fi
1444
1445	# If domain crontroller is Longhorn or above then set new supported
1446	# encryption type attributes.
1447	if [[ $level -gt 2 ]]; then
1448		cat > "$object" <<EOF
1449dn: CN=$upcase_nodename,$baseDN
1450changetype: modify
1451replace: msDS-SupportedEncryptionTypes
1452msDS-SupportedEncryptionTypes: $val
1453EOF
1454		ldapmodify -h "$dc" $ldap_args -f "$object" >/dev/null 2>&1
1455		if [[ $? -ne 0 ]]; then
1456			printf "$(gettext "Warning: Could not set the supported encryption type for computer account").\n"
1457		fi
1458	fi
1459
1460	# We should probably check whether arcfour is available, and if not,
1461	# then set the 1DES only flag, but whatever, it's not likely NOT to be
1462	# available on S10/Nevada!
1463
1464	# Reset userAccountControl
1465	#
1466	#  NORMAL_ACCOUNT (512) | DONT_EXPIRE_PASSWORD (65536) |
1467	#  TRUSTED_FOR_DELEGATION (524288)
1468	#
1469	# and possibly UseDesOnly (2097152) (see above)
1470	#
1471	cat > "$object" <<EOF
1472dn: CN=$upcase_nodename,$baseDN
1473changetype: modify
1474replace: userAccountControl
1475userAccountControl: $userAccountControl
1476EOF
1477	ldapmodify -h "$dc" $ldap_args -f "$object" >/dev/null 2>&1
1478	if [[ $? -ne 0 ]]; then
1479		printf "$(gettext "ldapmodify failed to modify account attribute").\n" >&2
1480		error_message
1481	fi
1482
1483	# Setup a keytab file
1484	set -A args --
1485	for enctype in "${enctypes[@]}"
1486	do
1487		args[${#args[@]}]=-e
1488		args[${#args[@]}]=$enctype
1489	done
1490
1491	rm $new_keytab > /dev/null 2>&1
1492
1493	cat > "$object" <<EOF
1494dn: CN=$upcase_nodename,$baseDN
1495changetype: modify
1496add: servicePrincipalName
1497servicePrincipalName: nfs/${fqdn}
1498servicePrincipalName: HTTP/${fqdn}
1499servicePrincipalName: root/${fqdn}
1500servicePrincipalName: cifs/${fqdn}
1501EOF
1502	ldapmodify -h "$dc" $ldap_args -f "$object" >/dev/null 2>&1
1503	if [[ $? -ne 0 ]]; then
1504		printf "$(gettext "ldapmodify failed to modify account attribute").\n" >&2
1505		error_message
1506	fi
1507
1508	#
1509	# In Windows, unlike MIT based implementations we salt the keys with
1510	# the UPN, which is based on the host/fqdn@realm elements, not with the
1511	# individual SPN strings.
1512	#
1513	salt=host/${fqdn}@${realm}
1514
1515	printf "%s" $newpw | $KSETPW -n -s $salt -v $kvno -k "$new_keytab" "${args[@]}" host/${fqdn}@${realm} > /dev/null 2>&1
1516	if [[ $? -ne 0 ]]
1517	then
1518		printf "$(gettext "Failed to set account password").\n" >&2
1519		error_message
1520	fi
1521
1522	printf "%s" $newpw | $KSETPW -n -s $salt -v $kvno -k "$new_keytab" "${args[@]}" HOST/${fqdn}@${realm} > /dev/null 2>&1
1523	if [[ $? -ne 0 ]]
1524	then
1525		printf "$(gettext "Failed to set account password").\n" >&2
1526		error_message
1527	fi
1528
1529	# Could be setting ${netbios_nodename}@${realm}, but for now no one
1530	# is requesting this.
1531
1532	printf "%s" $newpw | $KSETPW -n -s $salt -v $kvno -k "$new_keytab" "${args[@]}" nfs/${fqdn}@${realm} > /dev/null 2>&1
1533	if [[ $? -ne 0 ]]
1534	then
1535		printf "$(gettext "Failed to set account password").\n" >&2
1536		error_message
1537	fi
1538
1539	printf "%s" $newpw | $KSETPW -n -s $salt -v $kvno -k "$new_keytab" "${args[@]}" HTTP/${fqdn}@${realm} > /dev/null 2>&1
1540	if [[ $? -ne 0 ]]
1541	then
1542		printf "$(gettext "Failed to set account password").\n" >&2
1543		error_message
1544	fi
1545
1546	printf "%s" $newpw | $KSETPW -n -s $salt -v $kvno -k "$new_keytab" "${args[@]}" root/${fqdn}@${realm} > /dev/null 2>&1
1547	if [[ $? -ne 0 ]]
1548	then
1549		printf "$(gettext "Failed to set account password").\n" >&2
1550		error_message
1551	fi
1552
1553	printf "%s" $newpw | $KSETPW -n -s $salt -v $kvno -k "$new_keytab" "${args[@]}" cifs/${fqdn}@${realm} > /dev/null 2>&1
1554	if [[ $? -ne 0 ]]
1555	then
1556		printf "$(gettext "Failed to set account password").\n" >&2
1557		error_message
1558	fi
1559
1560	doKRB5config
1561
1562	addDNSRR $dom
1563
1564	setSMB $dom $dc
1565
1566	printf -- "\n---------------------------------------------------\n"
1567	printf "$(gettext "Setup COMPLETE").\n\n"
1568
1569	kdestroy -q 1>$TMP_FILE 2>&1
1570	rm -f $TMP_FILE
1571	rm -rf $TMPDIR > /dev/null 2>&1
1572
1573	exit 0
1574}
1575
1576###########################
1577#	Main section	  #
1578###########################
1579#
1580# Set the Kerberos config file and some default strings/files
1581#
1582KRB5_CONFIG_FILE=/etc/krb5/krb5.conf
1583KRB5_KEYTAB_FILE=/etc/krb5/krb5.keytab
1584RESOLV_CONF_FILE=/etc/resolv.conf
1585
1586KLOOKUP=/usr/lib/krb5/klookup;	check_bin $KLOOKUP
1587KSETPW=/usr/lib/krb5/ksetpw;	check_bin $KSETPW
1588KSMB=/usr/lib/krb5/ksmb;	check_bin $KSMB
1589KDYNDNS=/usr/lib/krb5/kdyndns;	check_bin $KDYNDNS
1590
1591dns_lookup=no
1592ask_fqdns=no
1593adddns=no
1594no_keytab=no
1595checkval=""
1596profile=""
1597typeset -u realm
1598typeset -l hostname KDC
1599
1600export TMPDIR="/var/run/kclient"
1601
1602mkdir $TMPDIR > /dev/null 2>&1
1603if [[ $? -ne 0 ]]; then
1604	printf "\n$(gettext "Can not create directory: %s")\n\n" $TMPDIR >&2
1605	exit 1
1606fi
1607
1608TMP_FILE=$(mktemp -q -t kclient-tmpfile.XXXXXX)
1609export KRB5_CONFIG=$(mktemp -q -t kclient-krb5conf.XXXXXX)
1610export KRB5CCNAME=$(mktemp -q -t kclient-krb5ccache.XXXXXX)
1611new_keytab=$(mktemp -q -t kclient-krb5keytab.XXXXXX)
1612if [[ -z $TMP_FILE || -z $KRB5_CONFIG || -z $KRB5CCNAME || -z $new_keytab ]]
1613then
1614	printf "\n$(gettext "Can not create temporary files, exiting").\n\n" >&2
1615	exit 1
1616fi
1617
1618#
1619# If we are interrupted, cleanup after ourselves
1620#
1621trap "exiting 1" HUP INT QUIT TERM
1622
1623if [[ -d /usr/bin ]]; then
1624	if [[ -d /usr/sbin ]]; then
1625		PATH=/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:$PATH
1626		export PATH
1627	else
1628		printf "\n$(gettext "Directory /usr/sbin not found, exiting").\n" >&2
1629		exit 1
1630	fi
1631else
1632	printf "\n$(gettext "Directory /usr/bin not found, exiting").\n" >&2
1633	exit 1
1634fi
1635
1636printf "\n$(gettext "Starting client setup")\n\n"
1637printf -- "---------------------------------------------------\n"
1638
1639#
1640# Check for uid 0, disallow otherwise
1641#
1642id 1>$TMP_FILE 2>&1
1643if [[ $? -eq 0 ]]; then
1644	if egrep -s "uid=0\(root\)" $TMP_FILE; then
1645		# uid is 0, go ahead ...
1646		:
1647	else
1648		printf "\n$(gettext "Administrative privileges are required to run this script, exiting").\n" >&2
1649		error_message
1650	fi
1651else
1652	cat $TMP_FILE;
1653	printf "\n$(gettext "uid check failed, exiting").\n" >&2
1654	error_message
1655fi
1656
1657uname=$(uname -n)
1658hostname=${uname%%.*}
1659
1660#
1661# Process the command-line arguments (if any)
1662#
1663OPTIND=1
1664while getopts nD:Kp:R:k:a:c:d:f:h:m:s:T: OPTIONS
1665do
1666	case $OPTIONS in
1667	    D) options="$options -D"
1668	       domain_list="$OPTARG"
1669	       ;;
1670	    K) options="$options -K"
1671	       no_keytab=yes
1672	       ;;
1673	    R) options="$options -R"
1674	       realm="$OPTARG"
1675	       checkval="REALM"; check_value $realm
1676	       ;;
1677	    T) options="$options -T"
1678	       type="$OPTARG"
1679	       if [[ $type == ms_ad ]]; then
1680		msad=yes
1681		adddns=yes
1682	       else
1683		non_solaris=yes
1684		no_keytab=yes
1685	       fi
1686	       ;;
1687	    a) options="$options -a"
1688	       ADMIN_PRINC="$OPTARG"
1689	       checkval="ADMIN_PRINC"; check_value $ADMIN_PRINC
1690	       ;;
1691	    c) options="$options -c"
1692	       filepath="$OPTARG"
1693	       ;;
1694	    d) options="$options -d"
1695	       dnsarg="$OPTARG"
1696	       checkval="DNS_OPTIONS"; check_value $dnsarg
1697	       ;;
1698	    f) options="$options -f"
1699	       fqdnlist="$OPTARG"
1700 	       ;;
1701	    h) options="$options -h"
1702	       logical_hn="$OPTARG"
1703	       checkval="LOGICAL_HOSTNAME"; check_value $logical_hn
1704	       ;;
1705	    k) options="$options -k"
1706	       kdc_list="$OPTARG"
1707	       ;;
1708	    m) options="$options -m"
1709	       KDC="$OPTARG"
1710	       checkval="KDC"; check_value $KDC
1711	       ;;
1712	    n) options="$options -n"
1713	       add_nfs=yes
1714	       ;;
1715	    p) options="$options -p"
1716	       profile="$OPTARG"
1717	       read_profile $profile
1718	       ;;
1719	    s) options="$options -s"
1720	       svc_list="$OPTARG"
1721	       SVCs=${svc_list//,/ }
1722 	       ;;
1723	    \?) usage
1724	       ;;
1725	    *) usage
1726	       ;;
1727	esac
1728done
1729
1730#correct argument count after options
1731shift `expr $OPTIND - 1`
1732
1733if [[ -z $options ]]; then
1734	:
1735else
1736	if [[ $# -ne 0 ]]; then
1737		usage
1738	fi
1739fi
1740
1741#
1742# Check to see if we will be a client of a MIT, Heimdal, Shishi, etc.
1743#
1744if [[ -z $options ]]; then
1745	query "$(gettext "Is this a client of a non-Solaris KDC") ?"
1746	non_solaris=$answer
1747	if [[ $non_solaris == yes ]]; then
1748		printf "$(gettext "Which type of KDC is the server"):\n"
1749		printf "\t$(gettext "ms_ad: Microsoft Active Directory")\n"
1750		printf "\t$(gettext "mit: MIT KDC server")\n"
1751		printf "\t$(gettext "heimdal: Heimdal KDC server")\n"
1752		printf "\t$(gettext "shishi: Shishi KDC server")\n"
1753		printf "$(gettext "Enter required KDC type"): "
1754		read kdctype
1755		if [[ $kdctype == ms_ad ]]; then
1756			msad=yes
1757		elif [[ $kdctype == mit || $kdctype == heimdal || \
1758		    $kdctype == shishi ]]; then
1759			no_keytab=yes
1760		else
1761			printf "\n$(gettext "Invalid KDC type option, valid types are ms_ad, mit, heimdal, or shishi, exiting").\n" >&2
1762			error_message
1763		fi
1764	fi
1765fi
1766
1767[[ $msad == yes ]] && join_domain
1768
1769#
1770# Check for /etc/resolv.conf
1771#
1772if [[ -r $RESOLV_CONF_FILE ]]; then
1773	client_machine=`$KLOOKUP`
1774
1775	if [[ $? -ne 0 ]]; then
1776		if [[ $adddns == no ]]; then
1777			printf "\n$(gettext "%s does not have a DNS record and is required for Kerberos setup")\n" $hostname >&2
1778			error_message
1779		fi
1780
1781	else
1782		#
1783		# If client entry already exists then do not recreate it
1784		#
1785		adddns=no
1786
1787		hostname=${client_machine%%.*}
1788		domain=${client_machine#*.}
1789	fi
1790
1791	short_fqdn=${domain#*.*}
1792	short_fqdn=$(echo $short_fqdn | grep "\.")
1793else
1794	#
1795	# /etc/resolv.conf not present, exit ...
1796	#
1797	printf "\n$(gettext "%s does not exist and is required for Kerberos setup")\n" $RESOLV_CONF_FILE >&2
1798	printf "$(gettext "Refer to resolv.conf(4), exiting").\n" >&2
1799	error_message
1800fi
1801
1802check_nss_conf || printf "$(gettext "/etc/nsswitch.conf does not make use of DNS for hosts and/or ipnodes").\n"
1803
1804[[ -n $fqdnlist ]] && verify_fqdnlist "$fqdnlist"
1805
1806if [[ -z $dnsarg && (-z $options || -z $filepath) ]]; then
1807	query "$(gettext "Do you want to use DNS for kerberos lookups") ?"
1808	if [[ $answer == yes ]]; then
1809		printf "\n$(gettext "Valid DNS lookup options are dns_lookup_kdc, dns_lookup_realm,\nand dns_fallback. Refer krb5.conf(4) for further details").\n"
1810		printf "\n$(gettext "Enter required DNS option"): "
1811		read dnsarg
1812		checkval="DNS_OPTIONS"; check_value $dnsarg
1813		set_dns_value $dnsarg
1814	fi
1815else
1816	[[ -z $dnsarg ]] && dnsarg=none
1817	set_dns_value $dnsarg
1818fi
1819
1820if [[ -n $kdc_list ]]; then
1821	if [[ -z $KDC ]]; then
1822		for kdc in $kdc_list; do
1823			break
1824		done
1825		KDC="$kdc"
1826	fi
1827fi
1828
1829if [[ -z $realm ]]; then
1830	printf "$(gettext "Enter the Kerberos realm"): "
1831	read realm
1832	checkval="REALM"; check_value $realm
1833fi
1834if [[ -z $KDC ]]; then
1835	printf "$(gettext "Specify the master KDC hostname for the above realm"): "
1836	read KDC
1837	checkval="KDC"; check_value $KDC
1838fi
1839
1840FKDC=`$KLOOKUP $KDC`
1841
1842#
1843# Ping to see if the kdc is alive !
1844#
1845ping_check $FKDC "KDC"
1846
1847if [[ -z $kdc_list && (-z $options || -z $filepath) ]]; then
1848	query "$(gettext "Do you have any slave KDC(s)") ?"
1849	if [[ $answer == yes ]]; then
1850		printf "$(gettext "Enter a comma-separated list of slave KDC host names"): "
1851		read kdc_list
1852	fi
1853fi
1854
1855[[ -n $kdc_list ]] && verify_kdcs "$kdc_list"
1856
1857#
1858# Check to see if we will have a dynamic presence in the realm
1859#
1860if [[ -z $options ]]; then
1861	query "$(gettext "Will this client need service keys") ?"
1862	if [[ $answer == no ]]; then
1863		no_keytab=yes
1864	fi
1865fi
1866
1867#
1868# Check to see if we are configuring the client to use a logical host name
1869# of a cluster environment
1870#
1871if [[ -z $options ]]; then
1872	query "$(gettext "Is this client a member of a cluster that uses a logical host name") ?"
1873	if [[ $answer == yes ]]; then
1874		printf "$(gettext "Specify the logical hostname of the cluster"): "
1875		read logical_hn
1876		checkval="LOGICAL_HOSTNAME"; check_value $logical_hn
1877		setup_lhn
1878	fi
1879fi
1880
1881if [[ -n $domain_list && (-z $options || -z $filepath) ]]; then
1882	query "$(gettext "Do you have multiple domains/hosts to map to realm %s"
1883) ?" $realm
1884	if [[ $answer == yes ]]; then
1885		printf "$(gettext "Enter a comma-separated list of domain/hosts
1886to map to the default realm"): "
1887		read domain_list
1888	fi
1889fi
1890[[ -n domain_list ]] && domain_list=${domain_list//,/ }
1891
1892#
1893# Start writing up the krb5.conf file, save the existing one
1894# if already present
1895#
1896writeup_krb5_conf
1897
1898#
1899# Is this client going to use krb-nfs?  If so then we need to at least
1900# uncomment the krb5* sec flavors in nfssec.conf.
1901#
1902if [[ -z $options ]]; then
1903	query "$(gettext "Do you plan on doing Kerberized nfs") ?"
1904	add_nfs=$answer
1905fi
1906
1907if [[ $add_nfs == yes ]]; then
1908	modify_nfssec_conf
1909
1910	#
1911	# We also want to enable gss as we now live in a SBD world
1912	#
1913	svcadm enable svc:/network/rpc/gss:default
1914	[[ $? -ne 0 ]] && printf "$(gettext "Warning: could not enable gss service").\n"
1915fi
1916
1917if [[ -z $options ]]; then
1918	query "$(gettext "Do you want to update /etc/pam.conf") ?"
1919	if [[ $answer == yes ]]; then
1920		printf "$(gettext "Enter a list of PAM service names in the following format: service:{first|only|optional}[,..]"): "
1921		read svc_list
1922		SVCs=${svc_list//,/ }
1923	fi
1924fi
1925[[ -n $svc_list ]] && update_pam_conf
1926
1927#
1928# Copy over krb5.conf master copy from filepath
1929#
1930if [[ -z $options || -z $filepath ]]; then
1931	query "$(gettext "Do you want to copy over the master krb5.conf file") ?"
1932	if [[ $answer == yes ]]; then
1933		printf "$(gettext "Enter the pathname of the file to be copied"): "
1934		read filepath
1935	fi
1936fi
1937
1938if [[ -n $filepath && -r $filepath ]]; then
1939	cp $filepath $KRB5_CONFIG
1940	if [[ $? -eq 0 ]]; then
1941		printf "$(gettext "Copied %s to %s").\n" $filepath $KRB5_CONFIG
1942	else
1943		printf "$(gettext "Copy of %s failed, exiting").\n" $filepath >&2
1944		error_message
1945	fi
1946elif [[ -n $filepath ]]; then
1947	printf "\n$(gettext "%s not found, exiting").\n" $filepath >&2
1948	error_message
1949fi
1950
1951doKRB5config
1952
1953#
1954# Populate any service keys needed for the client in the keytab file
1955#
1956if [[ $no_keytab != yes ]]; then
1957	setup_keytab
1958else
1959	printf "\n$(gettext "Note: %s file not created, please refer to verify_ap_req_nofail in krb5.conf(4) for the implications").\n" $KRB5_KEYTAB_FILE
1960	printf "$(gettext "Client will also not be able to host services that use Kerberos").\n"
1961fi
1962
1963printf -- "\n---------------------------------------------------\n"
1964printf "$(gettext "Setup COMPLETE").\n\n"
1965
1966#
1967# If we have configured the client in a cluster we need to remind the user
1968# to propagate the keytab and configuration files to the other members.
1969#
1970if [[ -n $logical_hn ]]; then
1971	printf "\n$(gettext "Note, you will need to securely transfer the /etc/krb5/krb5.keytab and /etc/krb5/krb5.conf files to all the other members of your cluster").\n"
1972fi
1973
1974#
1975# Cleanup.
1976#
1977kdestroy -q 1>$TMP_FILE 2>&1
1978rm -f $TMP_FILE
1979rm -rf $TMPDIR > /dev/null 2>&1
1980exit 0
1981