gLSSKrSSKrSSKrSSKrSSKrSSKrSSKJrJrJ r SSK r SSK J r SSKJrJr SSKJrJr SSKJr SSKJr SSKJrJr SS KJrJrJrJr "S S \5r g) N)PopenPIPESTDOUT)Ldbdsdb)miscsecurity) ndr_unpack) get_bytes) CommandErrorOption)GetPasswordCommand gpg_decryptdecrypt_samba_gpg_helpvirtual_attributes_helpc,\rSrSrSrSr\R\RS.r \ "SSSSS 9\ "S S \ S S S9\ "SSS\ SSS9\ "SS\ SSS9\ "S\ \ SSS9\ "S\ SSSS9\ "S S!\ S"S#S9\ "S$S%SSS&S9\ "S'\ S(S)S*S9\ "S+S,SSS-S9\ "S.S/SSS0S9/ rS4S2jrS3rg1)5cmd_user_syncpasswords.a$Sync the password of user accounts. This syncs logon passwords for user accounts. Note that this command should run on a single domain controller only (typically the PDC-emulator). However the "password hash gpg key ids" option should to be configured on all domain controllers. The command must be run from the root user id or another authorized user id. The '-H' or '--URL' option only supports ldapi:// and can be used to adjust the local path. By default, ldapi:// is used with the default path to the privileged ldapi socket. This command has three modes: "Cache Initialization", "Sync Loop Run" and "Sync Loop Terminate". Cache Initialization ==================== The first time, this command needs to be called with '--cache-ldb-initialize' in order to initialize its cache. The cache initialization requires '--attributes' and allows the following optional options: '--decrypt-samba-gpg', '--script', '--filter' or '-H/--URL'. The '--attributes' parameter takes a comma separated list of attributes, which will be printed or given to the script specified by '--script'. If a specified attribute is not available on an object it will be silently omitted. All attributes defined in the schema (e.g. the unicodePwd attribute holds the NTHASH) and the following virtual attributes are possible (see '--help' for supported virtual attributes in your environment): virtualClearTextUTF16: The raw cleartext as stored in the 'Primary:CLEARTEXT' (or 'Primary:SambaGPG' with '--decrypt-samba-gpg') buffer inside of the supplementalCredentials attribute. This typically contains valid UTF-16-LE, but may contain random bytes, e.g. for computer accounts. virtualClearTextUTF8: As virtualClearTextUTF16, but converted to UTF-8 (only from valid UTF-16-LE). virtualSSHA: As virtualClearTextUTF8, but a salted SHA-1 checksum, useful for OpenLDAP's '{SSHA}' algorithm. virtualCryptSHA256: As virtualClearTextUTF8, but a salted SHA256 checksum, useful for OpenLDAP's '{CRYPT}' algorithm, with a $5$... salt, see crypt(3) on modern systems. The number of rounds used to calculate the hash can also be specified. By appending ";rounds=x" to the attribute name i.e. virtualCryptSHA256;rounds=10000 will calculate a SHA256 hash with 10,000 rounds. Non numeric values for rounds are silently ignored. The value is calculated as follows: 1) If a value exists in 'Primary:userPassword' with the specified number of rounds it is returned. 2) If 'Primary:CLEARTEXT', or 'Primary:SambaGPG' with '--decrypt-samba-gpg'. Calculate a hash with the specified number of rounds 3) Return the first CryptSHA256 value in 'Primary:userPassword'. virtualCryptSHA512: As virtualClearTextUTF8, but a salted SHA512 checksum, useful for OpenLDAP's '{CRYPT}' algorithm, with a $6$... salt, see crypt(3) on modern systems. The number of rounds used to calculate the hash can also be specified. By appending ";rounds=x" to the attribute name i.e. virtualCryptSHA512;rounds=10000 will calculate a SHA512 hash with 10,000 rounds. Non numeric values for rounds are silently ignored. The value is calculated as follows: 1) If a value exists in 'Primary:userPassword' with the specified number of rounds it is returned. 2) If 'Primary:CLEARTEXT', or 'Primary:SambaGPG' with '--decrypt-samba-gpg'. Calculate a hash with the specified number of rounds. 3) Return the first CryptSHA512 value in 'Primary:userPassword'. virtualWDigestNN: The individual hash values stored in 'Primary:WDigest' where NN is the hash number in the range 01 to 29. NOTE: As at 22-05-2017 the documentation: 3.1.1.8.11.3.1 WDIGEST_CREDENTIALS Construction https://msdn.microsoft.com/en-us/library/cc245680.aspx is incorrect. virtualKerberosSalt: This results the salt string that is used to compute Kerberos keys from a UTF-8 cleartext password. virtualSambaGPG: The raw cleartext as stored in the 'Primary:SambaGPG' buffer inside of the supplementalCredentials attribute. See the 'password hash gpg key ids' option in smb.conf. The '--decrypt-samba-gpg' option triggers decryption of the Primary:SambaGPG buffer. Check with '--help' if this feature is available in your environment or not (the python-gpgme package is required). Please note that you might need to set the GNUPGHOME environment variable. If the decryption key has a passphrase you have to make sure that the GPG_AGENT_INFO environment variable has been set correctly and the passphrase is already known by the gpg-agent. The '--script' option specifies a custom script that is called whenever any of the dirsyncAttributes (see below) was changed. The script is called without any arguments. It gets the LDIF for exactly one object on STDIN. If the script processed the object successfully it has to respond with a single line starting with 'DONE-EXIT: ' followed by an optional message. Note that the script might be called without any password change, e.g. if the account was disabled (a userAccountControl change) or the sAMAccountName was changed. The objectGUID,isDeleted,isRecycled attributes are always returned as unique identifier of the account. It might be useful to also ask for non-password attributes like: objectSid, sAMAccountName, userPrincipalName, userAccountControl, pwdLastSet and msDS-KeyVersionNumber. Depending on the object, some attributes may not be present/available, but you always get the current state (and not a diff). If no '--script' option is specified, the LDIF will be printed on STDOUT or into the logfile. The default filter for the LDAP_SERVER_DIRSYNC_OID search is: (&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=512)\ (!(sAMAccountName=krbtgt*))) This means only normal (non-krbtgt) user accounts are monitored. The '--filter' can modify that, e.g. if it's required to also sync computer accounts. Sync Loop Run ============= This (default) mode runs in an endless loop waiting for password related changes in the active directory database. It makes use of the LDAP_SERVER_DIRSYNC_OID and LDAP_SERVER_NOTIFICATION_OID controls in order get changes in a reliable fashion. Objects are monitored for changes of the following dirsyncAttributes: unicodePwd, dBCSPwd, supplementalCredentials, pwdLastSet, sAMAccountName, userPrincipalName and userAccountControl. It recovers from LDAP disconnects and updates the cache in conservative way (in single steps after each successfully processed change). An error from the script (specified by '--script') will result in fatal error and this command will exit. But the cache state should be still valid and can be resumed in the next "Sync Loop Run". The '--logfile' option specifies an optional (required if '--daemon' is specified) logfile that takes all output of the command. The logfile is automatically reopened if fstat returns st_nlink == 0. The optional '--daemon' option will put the command into the background. You can stop the command without the '--daemon' option, also by hitting strg+c. If you specify the '--no-wait' option the command skips the LDAP_SERVER_NOTIFICATION_OID 'waiting' step and exit once all LDAP_SERVER_DIRSYNC_OID changes are consumed. Sync Loop Terminate =================== In order to terminate an already running command (likely as daemon) the '--terminate' option can be used. This also requires the '--logfile' option to be specified. Example1: samba-tool user syncpasswords --cache-ldb-initialize \ --attributes=virtualClearTextUTF8 samba-tool user syncpasswords Example2: samba-tool user syncpasswords --cache-ldb-initialize \ --attributes=objectGUID,objectSID,sAMAccountName,\ userPrincipalName,userAccountControl,pwdLastSet,\ msDS-KeyVersionNumber,virtualCryptSHA512 \ --script=/path/to/my-custom-syncpasswords-script.py samba-tool user syncpasswords --daemon \ --logfile=/var/log/samba/user-syncpasswords.log samba-tool user syncpasswords --terminate \ --logfile=/var/log/samba/user-syncpasswords.log z(%prog [--cache-ldb-initialize] [options]) sambaopts versionoptsz--cache-ldb-initializez'Initialize the cache for the first timecache_ldb_initialize store_true)helpdestactionz --cache-ldbz-optional LDB URL user-syncpasswords-cache.ldbzCACHE-LDB-PATH cache_ldb)rtypemetavarrz-Hz--URLz)optional LDB URL for a local ldapi serverURLHz--filterz'optional LDAP filter to set password onzLDAP-SEARCH-FILTERfilterz --attributes ATTRIBUTELIST attributes)rrrrz--decrypt-samba-gpgFdecrypt_samba_gpg)rrdefaultrz--scriptz.Script that is called for each password changez/path/to/syncpasswords.scriptscriptz --no-waitzDon't block waiting for changesnowaitz --logfilez/The logfile to use (required in --daemon mode).z/path/to/syncpasswords.loglogfilez--daemonzdaemonize after initial setupdaemonz --terminatez5Send a SIGTERM to an already running (daemon) process terminateNc F^^^^^^"^#^$^%^&^'^(^)^*^+^,^-^.U R5TlSTlSTlSTlSTlT(dKUb [ S5eT(a [ S5eUb [ S5eUb [ S5eTb [ S5eO>USLa [ S5eU b [ S5eU SLa [ S 5eU SLa [ S 5eUS La U S La [ S 5eU SLa [ S 5eU S LaU S La [ S5eU S LaU c [ S5eU S LaU c [ S5eUbU[RRU5(d[ SU-5eS[RRU5-m,OSm,Um$T$c,SS[R[R4--S-S-m$/SQm&T&/SQ-m#Sm*T(aTc;S[RRTRRS55-mT(a[ (d[ ["5eTR%U5m*T*Vs/sHoR'5PM nnSHnUR'5U;dMT*U/- m*M! TbTR'5R)S5(a [ S5eTR'5R)S5(a [ S5eTR'5R)S 5(a [ S!5eTR'5R)S"5(aO[[RRT5(dTRRT5mOTRRS#5mS$T-TlU)U4S%jm)UUUUU#U$U)U*UU,4 S&jm(U)U4S'jm+U&U)U+U4S(jm'U)U4S)jnU)U4S*jnU4S+jm-U4S,jm"U4S-jm.U"U'U)UU-U.4S.jm%U%U)U4S/jnU(U)U4S0jnT(a.TTlTR-TRS S19TlT("5 gU Gb9S2SKnUR1UR25S3nUUR4:XaS4n[R6"U [R8[R:-[R<-S55nTR>RAS6U -5 [CS2U5H"nUU:XaM [RD"U5 M$ [RH"US25 [RH"US35 [RH"US75 [RD"U5 T)"S8U -5 U TlT("5 U"U 5nU (aTRJc T)"S95 gU(dT)"S:TRJ-5 U"S5 gT)"S;TRJ-5 [RL"TRJ[NRP5 gU(a-[ S<[RR"5TRJ4-5eU S LaU"5 U"[RR"55 S nUS LaS3nS=nUS LaSnS2nOUnTRcwUS2:wa!T)"S>U-5 [TRV"U5 US7-nUU:aUnT)"S?TR-5 TR-TRS@9TlTRcMwU"U5 US LaMU"S5 gs snf![Fa GMKf=f![Xa"nSTlT)"SAU-5 US LaeSnANfSnAff=f![RZa-nUR\un n!STlT)"SBU U!4-5 SnANSnAff=f)CNzA--attributes is only allowed together with --cache-ldb-initializezH--decrypt-samba-gpg is only allowed together with --cache-ldb-initializez=--script is only allowed together with --cache-ldb-initializez=--filter is only allowed together with --cache-ldb-initializez=-H/--URL is only allowed together with --cache-ldb-initializeFz=--no-wait is not allowed together with --cache-ldb-initializez=--logfile is not allowed together with --cache-ldb-initializez<--daemon is not allowed together with --cache-ldb-initializez?--terminate is not allowed together with --cache-ldb-initializeTz/--daemon is not allowed together with --no-waitz2--terminate is not allowed together with --no-waitz1--terminate is not allowed together with --daemonz0--daemon is only allowed together with --logfilez3--terminate is only allowed together with --logfilezscript[%s] does not exist!%sz(&(objectClass=user)z(userAccountControl:%s:=%u)z(!(sAMAccountName=krbtgt*)))) unicodePwddBCSPwdsupplementalCredentials) pwdLastSetsAMAccountNameuserPrincipalNameuserAccountControl isDeleted isRecycledz ldapi://%szldap_priv/ldapi) objectGUIDr6r7zldapi://z%--cache_ldb ldapi:// is not supportedzldap://z$--cache_ldb ldap:// is not supportedzldaps://z%--cache_ldb ldaps:// is not supportedztdb://zuser-syncpasswords-cache.ldbz%s.pidc>TRb[R"S5nURS:XaTRnSTlT"SU-5 [R"U[R [R -[R-S5n[R"US5 [R"US5 [R"US5 [R"U5 T"SU-5 UTlS[R"5[R"5U4-nTRRU5 g)Nrz$Closing logfile[%s] (st_nlink == 0) rzReopened logfile[%s] z%s: pid[%d]: %s)r)osfstatst_nlinkopenO_WRONLYO_APPENDO_CREATdup2closetimectimegetpidoutfwrite)msginfor)logfdlog_msgselfs O/usr/lib/python3/dist-packages/samba/netcmd/user/readpasswords/syncpasswords.pyrM+cmd_user_syncpasswords.run..log_msgs||'xx{==A%"llG#'DLCwOPGGGR[[2;;-F-SUZ[EGGE1%GGE1%GGE1%HHUO4@A#*DL#JJLIIK'C IIOOC c > /SQn[T 5Tl[R"TRS5TlTRR TR[R US9n[U5S:Xa[USSS5Tl OSTl TRcT (d[ST -5eTRbT (a[ST -5eTRGc:T Tl TTl TTl S S /TlTTlT TlTTlS TR-S -S [$R&"[)TR55R+S5--S[$R&"[)TR55R+S5--SR-STR55-STRS--SR-STR55-nTR (aUS- nOUS- nTR"bUSTR"-- nUS[R."[1[2R2"555-- nTRR5U5 STlTR8R;ST -5 TRR=U5n[?U5upVTRRAU[RB5nTR8R;SU-5 g[USSS5Tl /Tl USSH'nTRRE[U55 M) [USSS5S /Tl/TlUSSH'nTRRE[U55 M) [USSS5n U S;deU S :XaS!TlOS"TlS#US;a[USS#S5TlOSTlS$US;a[1USS$S5TlOSTlT"S%T -5 g![anSTl SnAGNSnAff=f)&N)samdbUrl dirsyncFilterdirsyncAttributedirsyncControlpasswordAttributedecryptSambaGPG syncCommand currentPidzKEY=USERSYNCPASSWORDS)basescopeattrsrrrSzHcache_ldb[%s] not initialized, use --cache-ldb-initialize the first timezEcache_ldb[%s] already initialized, --cache-ldb-initialize not allowedz dirsync:1:0:0extended_dn:1:0dn: %s zobjectClass: userSyncPasswords zsamdbUrl:: %s utf8zdirsyncFilter:: %s c3# UH6nS[R"[U55RS5-v M8 g7f)zdirsyncAttribute:: %s r`Nbase64 b64encoder decode.0as rO Acmd_user_syncpasswords.run..load_cache..sB#JwIqr#AdirsyncControl: %s c3# UH6nS[R"[U55RS5-v M8 g7f)zpasswordAttribute:: %s r`Nrcrgs rOrjrksB#LxKrs#=@P@PQZ[\Q]@^@e@efl@m#mxKrlzdecryptSambaGPG: TRUE zdecryptSambaGPG: FALSE syncCommand: %s currentTime: %s zInitialized cache_ldb[%s] r-rTrUrVrWrX)TRUEFALSErqTFrYrZzUsing cache_ldb[%s] )#rcacheldbDncache_dnsearch SCOPE_BASElenstr samdb_urlKeyErrorr dirsync_filter dirsync_attrsdirsync_controlspassword_attrsr% sync_commandrdrer rfjoin timestringintrEadd_ldif current_pidrHrI parse_ldifnext write_ldifCHANGETYPE_NONEappend) cache_attrsresermsgs changetyperJldifridecrypt_stringr!rrr%r~r}rMrrNrs rO load_cache.cmd_user_syncpasswords.run..load_cachesl KYDJFF4::/FGDM**##cnn*5$7C3x1}*%(Q );A)>%?DN"&~~%.B"#m#,$.//~~).B"#j#,$.//~~%!"&4#%2")8:K(L%&4#):&$0!% 5=>,v/?/? $..@Y/Z/a/abh/iij2F4D4DYtObObEc4d4k4klr4sst77#JvzwIwI#JJ J 2D4I4I!4LL M 77#Lw{xKxK#LL L)) 99H ::H$$0 3d6G6G GGH/#..TYY[AQ2RRR ##H-#'   = KLzz,,X6"&t* zz,,S#2E2EF t ,4 1'*#a&*A!*D&E#%'"Q 23A&&--c!f54),SV4D-Ea-H)IK\(]%&(#Q 34A''..s1v65!$SV,=%>q%A!B%)::;:!V+-1D*-2D* CF*(+CF=,A!,D(ED%(,D%3q6)'*3q6,+?+B'CD$'+D$/9=> A *%)DNN*s?Q%% R/Q<<Rc>T"STR<SU<S35 [TR[[[S9nUR 5nUbeSU-nUR UR S55SRS5nT"SU-5 UR 5nUcUR5 UR5nURS 5(agT"S U-5 [S U<S U<S35e) Nz Call Popen[z] for  )stdinstdoutstderrr-zutf-8rz%s z DONE-EXIT: z RESULT: %s zERROR: z - ) rrrrpoll communicateencoderfr+wait startswith Exception)dnrsync_command_prinputreplyrMrNs rOrun_sync_command4cmd_user_syncpasswords.run..run_sync_commands 1B1BBG H"4#4#4)-*.*02N !%%'C; ;DME".. W%''(**0&/  Fe$ % %%'C{((* %%'C .. Nc* +#u=> >rQc @>URRS5n[[RU5nURRS5n[[ R U5nUR5upgU[ R:Xa T"SU-5 g[UR55H;nT H2n UR5U R5:XdM'X S/USU-'M4 M= TRRU[R5n T"SXXZ4-5 TR!TRSU-SU-S [R"TR$TR&S 9n TRRU [R5n T"S XU4-5 TR(cTR*R-SU -5 gTR*R-S [/U R55-5 T"U RU 5 g) NGUIDSIDz'# Dirsync[%d] SKIP: DOMAIN_RID_KRBTGT zREDACTED SECRET ATTRIBUTEz# %s::z# Dirsync[%d] %s %s %sr-z z(objectClass=user))usernamebasednr"r\r]decryptz# Passwords[%d] %s %s z # attrs=%s )rget_extended_componentr rrr dom_sidsplitDOMAIN_RID_KRBTGTlistkeyslowersamdbrrtrget_account_attributesrxrr%rrHrIsorted)idx dirsync_obj binary_guidguid binary_sidsid domain_sidridrih dirsync_ldifobjrdirsync_secret_attrsrMrrNs rO handle_object1cmd_user_syncpasswords.run..handle_objects%..??GKdii5D$>>uEJX--z:C!iikOJh000CsKL+**,--AwwyAGGI-'N5P4Q HqL1..  ::00c>Q>QRL -C0NN O--djj7;cz5@45G5I47NN484G4G6:6L6L .NC::((c.A.ABD -C0@@ A  (  . IIOONfSXXZ.@A B SVVT *rQct>[RnU(dU[R-n[R"T RUS5T lSn[R"T R [R[R-5 SnU(dG[R "T R S5nST l[%U5T lT R"bgU(aQU(aJ[R("T R S5 [R*"T R 5 S T lg[R"T R [R,5 g![ aKnURup4U[R:Xa U(aSnAgT "ST RXC4-5 eSnAff=f![ aYnURup4U[R:wa,U[R:waT "ST RXC4-5 eSnAGNSnAff=f![&a nSnAGNeSnAff=f![ a+n U Rup4T "ST RXC4-5 eSn A ff=f![ a/n U Rup4T "S T RXC4-5 Sn A gSn A ff=f) Nr:Fz8check_current_pid_conflict: failed to open[%s] - %s (%d)TzFcheck_current_pid_conflict: failed to get exclusive lock[%s] - %s (%d)@rz=check_current_pid_conflict: failed to truncate [%s] - %s (%d)zCcheck_current_pid_conflict: failed to get shared lock[%s] - %s (%d))r<O_RDWRrBr?lockfilelockfdIOErrorargserrnoENOENTfcntllockfLOCK_EXLOCK_NBEACCESEAGAINreadrr ValueError ftruncaterDLOCK_SH) r+flagse4errrJ got_exclusivee5bufre2e6rMrNs rOcheck_current_pid_conflict>cmd_user_syncpasswords.run..check_current_pid_conflict$s8IIE#  ggdmmUEB "M  DKK)FG $ !ggdkk2.#' '*3xD$##/LLa0 %   3 DKK7e WW %,,& $R123  WW %,,&3%,,+>d!]]C567  "!#JS[!]]C567  3WW ]1233  3sy'E0AG H.6!I/I>0 G:)G(GG H+AH&&H+. I>I I;&I66I;> J7%J22J7c >T RS:wGaSn[SS5Hen[R"T R[R[R -5 SnU(a O[R"S5 Mg U(d9T "SU<S T R<S 35 [SU<S T R<S 35eUbS U-nOSn[R "T RS5 Ub*[R""T R[%U55 UT lT R&bT "ST R&-5 ST R(-S-S-nT R&bUST R&-- nUSS[*R,"[/[R"555--- nT R0R3U5 g![ aZnURupEU[R:wa-U[R:waT "SUT RXT4-5 eSnAGNSnAff=f![ a+nURupET "S T RXT4-5 eSnAff=f)NrFrTz:update_pid(%r): failed to get exclusive lock[%s] - %s (%d)rz update_pid(z ): failed to get exclusive lock[]z] after 5 secondsz%d zAcheck_current_pid_conflict: failed to write pid to [%s] - %s (%d)zcurrentPid: %d r_changetype: modify zreplace: currentPid replace: currentTime rp)rrangerrrrrrrrrrrEsleepr r<rrIr rrvrtrrrs modify_ldif) pidrirrrJre3rrMrNs rO update_pid.cmd_user_syncpasswords.run..update_pid_s"{{b % q!A" DKK1NO(, %JJqM%% $--12&(+T]](<==? 3,CCLLa0in= #D +*T-=-==>$ 60112K+1T5E5EFF 3.DIIK@P1QQR RK JJ " "; / S#"%&VV %,,.3%,,3F#$`%($--$B%CD! "0!#JS_!]]C567 s2AGAH? H<"AH77H<? I4 &I//I4c>[U5S:deUSRS:XdeSUSl[US5S/TlSTR -S-S-STRS--S -S [ R"[[R"555--nTRRU5 g) Nr1.2.840.113556.1.4.841Tr^r_rzreplace: dirsyncControl rmrrp) ryoidcriticalrzrrvrtrrrErsr) res_controlsrrNs rO update_cache0cmd_user_syncpasswords.run..update_caches|$q( ((?&&*BB BB'+LO $%(a%9;L$MD !% 601561D4I4I!4LMN3 3 .s499;?O0PP QK JJ " "; / rQc>[U5S:deUSRS:XdeURRS5n[ [ R U5nSU-n[US5nTRRU[RS[R"U5-/S9n[U5S:Xagg ) NrrrKEY=%sz(lastCookie=%s)r[r\ expressionr]rTF) ryrrrr r rrzrsrwrtrx binary_encode)rrrrr lastCookierrNs rO check_object0cmd_user_syncpasswords.run..check_objects|$q( ((?&&*BB BB$>>uEJX--z:CCB\!_-J**##3>>/@(+(9(9*(E0G*,$.C3x1}rQc>[U5S:deUSRS:XdeURRS5n[ [ R U5nSU-n[US5nT RR5 T RRU[RSS/S9n[U5S:Xa`SU-S -S U--S [R"[[R"555--nT RR!U5 OeSU-S -S -S U--S-S [R"[[R"555--nT RR#U5 T RR%5 g![&a$n T RR)5 Sn A gSn A ff=f)Nrrrrz(objectClass=*)rrr_zobjectClass: userCookie zlastCookie: %s rprzreplace: lastCookie r)ryrrrr r rrzrstransaction_startrwrtrxrrrErrtransaction_commitrtransaction_cancel) rrrrrrrrrrrNs rO update_object1cmd_user_syncpasswords.run..update_objects|$q( ((?&&*BB BB$>>uEJX--z:CCB\!_-J JJ ( ( * 0jj''Rs~~3D/;n(>s8q=)R0: ;1Z@ A 3S^^C DT5UU VHJJ''1","3"8#9"9#:#5 "C#D#; #; #6s499;GW8X"X #YK JJ**;7 --/  0 --//  0s DF%% G/GGc>TRR[TR5[R TR TRS9nT"S[U5-5 SnUH;nT"X R5nU(dT"X5 T "X R5 US- nM= T"UR5 [U5S:XagM)N)rr\r]controlszdirsync_loop(): results %d rr) rrwrzr}rt SCOPE_SUBTREEr~rryr) rrirdonerrrMrNrrs rO dirsync_loop0cmd_user_syncpasswords.run..dirsync_loopsjj''3t7J7J3K.1.?.?.2.@.@151F1F(H6SABA'<<8D%b,%a6!GB  S\\*s8q=rQc >/SQnSS/nT RRS[RUUSS9nUSLa T "S5 OT "S 5 T RR S T R -5 T RR S T R-5 T RR S T R-5 T"5 USLagUHn[U[R5(d T RR S U-5 MBURS5SnURS5SnT "SUR<SU<SU<S35 T"5 M UR5ng)N)name uSNCreated uSNChanged objectClassznotification:1zshow_recycled:1z objectClass=*r)rr\r]rtimeoutTzResuming monitoring zGetting changes zdirsyncFilter: %s zdirsyncControls: %r roz referral: %s rrrz # Notify z uSNCreated[z ] uSNChanged[z] )rsearch_iteratorrtrrHrIr}rr isinstanceMessagegetrresult) r notify_attrsnotify_controls notify_handlerJcreatedchangedrr rMrNs rO sync_loop-cmd_user_syncpasswords.run..sync_loopsINL/1BCO JJ66/=@=N=N=I@O?A 7CM t|/0+, IIOO1D4G4GG H IIOO3d6K6KK L IIOO/$2C2CC D N4$!#s{{33IIOO$4s$:;'',/2'',/2'34% &&(CrQc`>STlSTl[R"5n[R"5nUS:XaY[R "5 [R"5nUS:Xa)[R"5nT"SX4-5 T"5 g[R "S5 g)NrzDaemonized as pid %d (from %d) )rrsr<rGforksetsid_exit)orig_pidrrrMrNs rO daemonize-cmd_user_syncpasswords.run..daemonize swDJDJyy{H'')Cax ggi!8))+C>#PQL HHQKrQ)urlverboserrir:zUsing logfile[%s] r;zAttached to logfile[%s] zNo process running. z#Process %d is not running anymore. zSending SIGTERM to process %d. z4Exiting pid %d, command is already running as pid %diXz Wait before connect - sleep(%d) zConnecting to '%s' )r%z#Connect to samdb Exception => (%s) zldb.LdbError(%d) => (%s) )/ get_loadparmlpr)r{rrsr r<pathexistsabspathrtOID_COMPARATOR_ANDrUF_NORMAL_ACCOUNT private_pathrrparse_attributesrrrconnect_for_passwordsresource getrlimit RLIMIT_NOFILE RLIM_INFINITYr?r@rArBrHrIrrDOSErrorrCrkillsignalSIGTERMrGrErrLdbErrorr)/rNrrr!r"r$r%r'r(r)r*r+rrx lower_attrsrirrrr#r1maxfdrLfdconflictrretry_sleep_minretry_sleep_max retry_sleeprJe7enumestrrr~r}r rrrrMrrrrrs/```` ` @@@@@@@@@@@@@rOruncmd_user_syncpasswords.runs ((*   #%"#fgg "#mnn!"#bcc!"#bcc}"#bccU""#bcc""#bccU""#abb%"#dee T>~"#TUU%"#WXX  4RS S T>goQR R  TU U  77>>&))"#?&#HII"''//&"99LL  !4<# #94;Q;Q@S SS = = ! !N  -0   y 277??4773G3GHY3Z#[[ "#9::!22:>N.<=n779nK=>779K/"qc)N?   ++J77"#JKK"--i88"#IJJ"--j99"#JKK"--h77ww~~i00 $ 4 4Y ?I,,-KLI 9,  *S S j ?2 + +>9 v1 f " " D  $ )D  DN33<@4BDJ L    &&x'='=>qAE...GGGR[[2;;%>%KUSE IIOO1G; <Auo;HHRL & GGE1  GGE1  GGE1  HHUO /7; <"DL -i8 '/0>((*+4  6$$& ' GGD$$fnn 5  U!yy{D,<,<Y> >? ? T> K299;dlO!O~ - **$!#?+MNJJ{+)Ao /1"1K.?@!%!;!;!;!ODJ**$  E$5dl@ 4G>Bh!!%DJBSHI4'(<< E!ww t! 4d|CDD EsH\-\\0] \-,\-0 ]:]]^ 3#^^ )rsrvrr%r~rr}rrr)r(rrr{r) FNNNNNNNNNNNN)__name__ __module__ __qualname____firstlineno____doc__synopsisoptions SambaOptionsVersionOptionstakes_optiongroupsr rzrr takes_optionsrE__static_attributes__rQrOrr.s>{z:H))-- '=*< A }#RY\'k ;tW#NUX3 (z IPS+( <~C+&\ ; $*"E8K M z PWZ6X G{!B"E B{E3) E z ?"E B}K"E  E3M<9=/3KO(, ] rQr)!rdrrr<r7rE subprocessrrrrt samba.getoptgetoptrMsambarr samba.dcerpcrr samba.ndrr samba.commonr samba.netcmdr r commonrrrrrrSrQrOr]sM, ** ' "-@ /@ rQ