cۖiSSKJr SSKrSSKJr SSKJrJrJ r J r SSK J r J r SSKJr SSKJrJrJr SrSrS rSSjr\ "SSSS/SS9\ "SSSS/SS9\ "SS\S9\ "SS\S9\ "SS\S9\ "SS \S9\ "S!\S"S#9\ "S$\S%S#9\ "S&S'\S9/ rS(r"S)S*\5r "S+S,\5r!"S-S.\5r"S/r#"S0S1\5r$"S2S3\5r%"S4S5\5r&"S6S7\5r'"S8S9\5r("S:S;\ 5r)g)?N)SamDB)Command CommandErrorOption SuperCommand)DOMAIN_PASSWORD_COMPLEXDOMAIN_PASSWORD_STORE_CLEARTEXT)system_session)NEVER_TIMESTAMPtimestamp_to_minstimestamp_to_daysc(SUR5-$)Nz+CN=Password Settings Container,CN=System,%s) domain_dn)samdbs 2/usr/lib/python3/dist-packages/samba/netcmd/pso.py pso_containerrs 85??;L LLc6[SU-5*n[U5$)z4Converts a value in minutes to -100 nanosecond unitsgA)intstr)mins timestamps rmins_to_timestampr"sZ$&''I y>rc:[US-S-5n[U5$)z1Converts a value in days to -100 nanosecond units<)rr)daysrs rdays_to_timestampr(s!$)b.1I y>rcSSS.n/SQnURU[RUS9nUSnURSUS-5 URS 5 URS US -5 [ US 5nURS XH-5 [ US5nURSXH-5 URSUS-5 URSUS-5 URS[ USS5-5 URS[ USS5-5 URS[ USS5-5 URSUS-5 URS[ USS5-5 U(aYSU;aAURS[US5-5 USHnURS U-5 M g"URS!5 g"g")#z8Displays the password settings for a PSO specified by DNonoff)TRUEFALSE) namemsDS-PasswordSettingsPrecedence(msDS-PasswordReversibleEncryptionEnabledmsDS-PasswordHistoryLengthmsDS-MinimumPasswordLengthmsDS-PasswordComplexityEnabledmsDS-MinimumPasswordAgemsDS-MaximumPasswordAgemsDS-LockoutObservationWindowmsDS-LockoutThresholdmsDS-LockoutDurationmsDS-PSOAppliesToscopeattrsrz"Password information for PSO '%s' r$ z Precedence (lowest is best): %s r%r)zPassword complexity: %s r&zStore plaintext passwords: %s zPassword history length: %s r'zMinimum password length: %s r(z Minimum password age (days): %d r*z Maximum password age (days): %d r+z$Account lockout duration (mins): %d r.z)Account lockout threshold (attempts): %s r-z'Reset account lockout after (mins): %d r,r/z* PSO applies directly to %d groups/users: z %s z2 Note: PSO does not apply to any users or groups. N)searchldb SCOPE_BASEwriterr r len) outfrdnshow_applies_to on_off_str pso_attrsrespso_resbool_strs rshow_pso_by_dnrA.s/J&I ,,ry, AC!fGJJ4wvFGJJtJJ289:;7;<=HJJ*Z-AAB7EFGHJJ0:3GGHJJ.3456JJ.3456JJ2 )B!CA!FGHIJJ2 )B!CA!FGHIJJ6 )?!@!CDEFJJ;./01JJ9 )H!I!!LMNO ' ) JJE7#6789 :12 8b=)3 JJM NrcURU[RS/S9nSUS;a [ S5eg![Ra5nURS[R :Xa[ SU-5eeSnAff=f)z=Gracefully bail out if we can't view/modify the PSO specifiedr%r0rzUnable to find PSO '%s'Nz/You may not have permission to view/modify PSOs)r4r5r6LdbErrorargsERR_NO_SUCH_OBJECTr)rpso_dnr$r>es rcheck_pso_validrH`sll6"C!DF)A6LMM7 << 66!9.. .84?@ @ s 7B 0A;;BcSU-nURUR5[RUSS/S9n[ U5S:XaUR SU-5 gSUS;a&UR SU-5 UR S5 g[ XSSSS 5 UR S U-5 [XUSSSS S 9 SUS;aUR S 5 gUR S5 g)z2Displays the password settings for a specific userz((&(sAMAccountName=%s)(objectClass=user))zmsDS-ResultantPSOzmsDS-PSOApplied)r1 expressionr2rzUser '%s' not found. z@No PSO applies to user '%s'. The default domain settings apply. z4Refer to 'samba-tool domain passwordsettings show'. z???z0The following PSO settings apply to user '%s'. Fr;zD Note: PSO applies directly to user (any group PSOs are overridden) z+ PSO applies to user via group membership. N)r4rr5 SCOPE_SUBTREEr8r7rHrA)r9rusername search_filterr>s rshow_pso_for_userrOqs?IM ,,u(0A0A"/13DE  GC 3x1} +h67 CF * :$?$B', . A & JJ; < JJF Grc6[R"X#U5X'g)N)r5MessageElement)msg attr_namevalueldb_opers r msg_add_attrrVs''CCNrc0[R"5n[R"X5UlU(a,[Rn[R "SUS5US'O[R nUb[US[U5U5 UbUS:XaSOSn[USUU5 UbUS:XaSOSn[US UU5 Ub[US [U5U5 U b[US [U 5U5 U b[U 5n[US UU5 U b/U S :Xa[[5nO [U 5n[USUU5 U b[U 5n[USUU5 Ub[US[U5U5 U b[US[U 5U5 U$)z0Packs the given PSO settings into an LDB messagezmsDS-PasswordSettings objectClasszmsDS-objectClassr%r r"r#r)r&r'r(r*rr+r.r-r,) r5MessageDnr: FLAG_MOD_ADDrQFLAG_MOD_REPLACErVrrr r)r9rrFcreatelockout_threshold complexity precedencestore_plaintexthistory_lengthmin_pwd_length min_pwd_age max_pwd_agelockout_durationreset_lockout_aftermrUr@min_pwd_age_ticksmax_pwd_age_tickslockout_duration_tickss rmake_pso_ldb_msgrls A 66% AD ## # 2 23J3;]!L ''Q93z? '4/6WQ8(HM",46'QBx )!Q4c.6I !Q4c.6I -k:Q13D  !  #O 4  1+ > Q13DhO#!23C!DQ.0F $Q/5F1G &Q7&':;X G HrcUbUS:a [S5eUbUS:a [S5eUbUbX#:aUS:wa [S5egggg)z,Checks PSO settings fall within valid rangesNiz5Bad password history length: valid range is 0 to 1024z4Bad minimum password length: valid range is 0 to 255rz2Minimum password age must be less than maximum age)r)rcrbrdres rcheck_pso_constraintsros !nt&;67 7!ns&:56 6;#:  %+*: -. .+; %$;rz --complexitychoicer r!z#The password complexity (on | off).)typechoiceshelpz--store-plaintextziStore plaintext passwords where account have 'store passwords with reversible encryption' set (on | off).z--history-lengthz(The password history length ().)rsrqz--min-pwd-lengthz(The minimum password length ().z --min-pwd-agezHThe minimum password age (). Default is domain setting.z --max-pwd-agezHThe maximum password age (). Default is domain setting.z--account-lockout-durationzThe length of time an account is locked out after exceeding the limit on bad password attempts (). Default is domain settingrqrsz--account-lockout-thresholdzrThe number of bad password attempts allowed before locking out the account (). Default is domain setting.z--reset-account-lockout-afterz~After this time is elapsed, the recorded number of attempts restarts from zero (). Default is domain setting.cZSnUH"nUHn[U5U;dMUS- nM M$ U$)z Returns the number of options specified that are present in the args. (There can be other args besides just the ones we're interested in, which is why argc on its own is not enough) r)r)optionsrDnum_optsoptargs rnum_options_in_argsr{ s8 HC3x3A  Orc \rSrSrSrSr\R\R\RS.r \ \ "SSSSS \ S 9/-rS S /rSSjrSrg )!cmd_domain_pwdsettings_pso_createiaCreates a new Password Settings Object (PSO). PSOs are a way to tailor different password settings (lockout policy, minimum password length, etc) for specific users or groups. The psoname is a unique name for the new Password Settings Object. When multiple PSOs apply to a user, the precedence determines which PSO will take effect. The PSO with the lowest precedence will take effect. For most arguments, the default value (if unspecified) is the current domain passwordsettings value. To see these values, enter the command 'samba-tool domain passwordsettings show'. To apply the new PSO to user(s) or group(s), enter the command 'samba-tool domain passwordsettings pso apply'. z&%prog [options] sambaopts versionoptscredopts-H--URL%LDB URL for database or target serverURLHrsmetavardestrqpsonamer`NcHUR5nU RU5n[U[5UUS9n[ U5nSU<S[U5<3nURU[RS9n[ SU-5e![ a [ S5ef=f![Ra,nURS[R:XaSnAO eSnAff=f[[UR 5nUS:Xa [ S5eU[#[5:a"UR%S 5 UR%S 5 URUR'5[R/S QS 9n[#U5S :Xde[ USSS5nUc[(nUU-(aSOSnUc[*nUU-(aSOSnUc[ USSS5nU c[ USSS5n Uc[-USSS5nUc[-USSS5nU c[/USSS5n U c[ USSS5n U c[/USSS5n [1XTUU S9 [3UR4UUSXbUUU XEU U U S9nUR7U5 UR%SU-5 [9UR4UUSS9 g![RaFnURunnU[R::Xa [ S5e[ SU<S U<35eSnAff=f)!Nurl session_info credentialslpzrG num_pwd_args pwd_props prop_flagrhnumrRs rrun%cmd_domain_pwdsettings_pso_create.run:s  # # %((,!.*:"'B0 @ZJ ' e(<= D,,vS^^,?N  ! Q!7!:;N  +CF;,?,BCK  +CF;,?,BCK # +!#a&):";A">? % % ,(+CF3E,Fq,I(J % & .!#a&)C"DQ"GH ( +-;-; = TYYvd(2-<,:,:)4.F/H1L N L IIaL LL7&@ A 499eVU K|| LJS#c888"$677#fFI$KLL  LsB BBBC/!CCC ;KL!ALL!) NNNNNNNNNNNNN)__name__ __module__ __qualname____firstlineno____doc__synopsisrw SambaOptionsVersionOptionsCredentialsOptionstakes_optiongroupsrrr takes_options takes_argsr__static_attributes__rrrr}r}s"8H))--.. )tW#J3S 2,M\*J;??C04EIGK rLrr}c \rSrSrSrSr\R\R\RS.r \ \ "S\ SS9\ "SS S \S S S 9/-rS/rSSjrSrg)cmd_domain_pwdsettings_pso_setiz*Modifies a Password Settings Object (PSO).%prog [options]r~z --precedencezUThis PSO's precedence relative to other PSOs. Lower precedence is better ().rtrrrrr)rsrqrrrNcUR5nU RU5n[U[5UUS9nSU<S[ U5<3n[ UUU5 [ [UR5nUS:XaUc [S5eUcUbSURU[RSS/S9nUcUSSSn[U5nUcUSSSn[U5n[XTUU S 9 [UR UUS XcUUU XEU U U S 9nUR#U5 UR%S U-5 ['UR UUS S 9 g![R(a'nUR*unn[SU<SU<35eSnAff=f)Nrrrrrr*r+r0rFrzSuccessfully updated PSO: %srKFailed to update PSO 'r)rrrr rrHr{rrrr4r5r6r rorlr9modifyrrArCrD)rrrr`rdrer_rarbrcrrrrrrrrrrFrr> min_pwd_ticks max_pwd_ticksrhrGrrRs rr"cmd_domain_pwdsettings_pso_set.runs  # # %((,!.*:"'B0 ' e(<=vw/++?O 1 !3 56 6  "k&=,,vS^^&?&?&ABC" #A'@ A! D / > " #A'@ A! D / > +-;-; = TYYve(2-<,:,:)4.F/H1L N P LLO LL7&@ A 499eVU K|| PJS#&#NO O Ps;EE>"E99E>r)NNNNNNNNNNNNNN)rrrrrrrwrrrrrrrrrrrrrrrrrs4*H))--.. )~C? A tW#JS 2 ,MJ@D?C04EIGK <Prrc \rSrSrSrSr\R\R\RS.r \ "SSSSS \ S 9/r S /rSS jrSrg )!cmd_domain_pwdsettings_pso_deleteiz)Deletes a Password Settings Object (PSO).rr~rrrrrrrNcUR5nURU5n[U[5XvS9nSU<S[ U5<3n [ XU5 UR U 5 URSU-5 g)NrrrzDeleted PSO %s)rrrr rrHdeleter rrrrrrrrrrFs rr%cmd_domain_pwdsettings_pso_delete.runsm  # # %((,!.*:"'0 ' e(<=w/ V %/0rrNNNNrrrrrrrwrrrrrrrrrrrrrrrsb3*H))--.. tW#J3S 2MJ<@ 1rrc([USS5nU$)Nr%r)r)a a_precedences rpso_keyr#sq:;A>?L rc \rSrSrSrSr\R\R\RS.r \ "SSSSS \ S 9/r SS jrS rg )cmd_domain_pwdsettings_pso_listi(z+Lists all Password Settings Objects (PSOs).z%prog [options]r~rrrrrrNcUR5nURU5n[U[5XeS9nUR [ U5[ RSS/SS9n[U5S:Xd SUS;aURRS5 g[U[S9n URRS 5 URRS 5 U H/n U Sn URRU <S S U S<S 35 M1 g)Nrr$r%z#(objectClass=msDS-PasswordSettings))r1r2rJrz@No PSOs are present, or you don't have permission to view them. )keyzPrecedence | PSO name z3-------------------------------------------------- 10z | r3) rrrr r4rr5rLr8r9r7sortedr) rrrrrrrrr>pso_listpsor`s rr#cmd_domain_pwdsettings_pso_list.run8s  # # %((,!.*:"'0ll=/s7H7H"(*K!L&KM s8q==SVK IIOO/ 0 #7+ 12 NOC>?J IIOOj#f+F Grrr)rrrrrrrwrrrrrrrrrrrrrr(sT5 H))--.. tW#J3S 2M Hrrc \rSrSrSrSr\R\R\RS.r \ "SSSSS \ S 9/r S /rSS jrSrg )cmd_domain_pwdsettings_pso_showiUz-Display a Password Settings Object's details.rr~rrrrrrrNcUR5nURU5n[U[5XvS9nSU<S[ U5<3n [ XU5 [ URX5 g)Nrrr)rrrr rrHrAr9rs rr#cmd_domain_pwdsettings_pso_show.runfs]  # # %((,!.*:"'0 ' e(<=w/tyy%0rrrrrrrrrUsb7*H))--.. tW#J3S 2MJ<@ 1rrc \rSrSrSrSr\R\R\RS.r \ "SSSSS \ S 9/r S /rSS jrSrg )$cmd_domain_pwdsettings_pso_show_userisz4Displays the Password Settings that apply to a user.z%prog [options]r~rrrrrrrMNcUR5nURU5n[U[5XvS9n[ UR X5 g)Nr)rrrr rOr9) rrMrrrrrrrs rr(cmd_domain_pwdsettings_pso_show_user.runsD  # # %((,!.*:"'0 $))U5rrrrrrrrrssb>+H))--.. tW#J3S 2MJ=A6rrc \rSrSrSrSr\R\R\RS.r \ "SSSSS \ S 9/r S S /rSSjrSrg ) cmd_domain_pwdsettings_pso_applyiaApplies a PSO's password policy to a user or group. When a PSO is applied to a group, it will apply to all users (and groups) that are members of that group. If a PSO applies directly to a user, it will override any group membership PSOs for that user. When multiple PSOs apply to a user, either directly or through group membership, the PSO with the lowest precedence will take effect. .%prog [options]r~rrrrrrr user_or_groupNcNUR5nURU5n[U[5XS9n SU<S[ U 5<3n [ XU5 SU-n U R U R5[RU S9n [U 5S:Xa[SU-5e[U SR5n [R"5n[R"X5Ul [R "U [R"S5US'U R%U5 UR-S U<SU<S 35 g![R&aOnUR(unnU[R*:Xa[S U<S U<S 35e[S U<S U<35eSnAff=f)Nrrr(sAMAccountName=%s)r1rJr.The specified user or group '%s' was not foundr/PSO 'z' already applies to ''rrz' applied to ')rrrr rrHr4rr5rLr8rrr:rYrZrQr[rrCrDERR_ATTRIBUTE_OR_VALUE_EXISTSrrrrrrrrrrrrFrNr> target_dnrhrGrrRs rr$cmd_domain_pwdsettings_pso_apply.runs  # # %((,!.*:"'0 ' e(<=w/. = ll5??,C4E4E&35 s8q=O!. /0 0A N KKMvve$!$!3!3I474D4D4G"I  L LLO 7MJK|| LJS#c777"&-}$>??#gFI$KLL LEF$A FF$rrrrrrrrsk@H))--.. tW#J3S 2M_-J;?(,(Lrrc \rSrSrSrSr\R\R\RS.r \ "SSSSS \ S 9/r S S /rSSjrSrg )"cmd_domain_pwdsettings_pso_unapplyiz4Updates a PSO to no longer apply to a user or group.rr~rrrrrrrrNcNUR5nURU5n[U[5XS9n SU<S[ U 5<3n [ XU5 SU-n U R U R5[RU S9n [U 5S:Xa[SU-5e[U SR5n [R"5n[R"X5Ul [R "U [R"S5US'U R%U5 UR-S U<SU<S 35 g![R&aOnUR(unnU[R*:Xa[S U<S U<S 35e[S U<S U<35eSnAff=f)Nrrrrrrrr/rz' doesn't apply to 'rrrz' no longer applies to ')rrrr rrHr4rr5rLr8rrr:rYrZrQFLAG_MOD_DELETErrCrDERR_NO_SUCH_ATTRIBUTErrs rr&cmd_domain_pwdsettings_pso_unapply.runs  # # %((,!.*:"'0 ' e(<=w/. = ll5??,C4E4E&35 s8q=O!. /0 0A N KKMvve$!$!3!3I474G4G4G"I  L LLO W=JL M|| LJS#c///"&-}$>??#gFI$KLL Lrrrrrrrrrsf>?H))--.. tW#J3S 2M_-J;?(,(Mrrc\rSrSrSr0r\"5\S'\"5\S'\"5\S'\ "5\S'\ "5\S'\ "5\S'\ "5\S '\ "5\S 'S rg ) cmd_domain_passwordsettings_psoiz5Manage fine-grained Password Settings Objects (PSOs).applyr]rlistsetshowz show-userunapplyrN)rrrrr subcommandsrr}rrrrrrrrrrrrsr?K;=K=?K=?K9;K79K9;KCEK ?AK rr)T) NNNNNNNNNNr)* samba.getoptgetoptrwr5 samba.samdbr samba.netcmdrrrrsamba.dcerpc.samrrr samba.authr samba.netcmd.commonr r r rrrrArHrOrVrlrorrr{r}rrrrrrrrrrrrr s$ FF@%44 M  /OdN"H@DEIGK9=JN)- A H?C8<., >4-57 Xe}JK :F :F ?.58: ?.58: 'c-/ (sKM *.58:/;: RLRLjPPWPPf11B *Hg*HZ1g1<6768ALwALH9M9Mx Bl Br