1293 lines
39 KiB
Python
Executable File
1293 lines
39 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
|
|
import base64
|
|
import datetime as dt
|
|
import fcntl
|
|
import grp
|
|
import os
|
|
import pwd
|
|
import re
|
|
import sqlite3
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
import uuid
|
|
from dataclasses import dataclass, field
|
|
from typing import Callable, Dict, Iterable, List, Optional, Set, Tuple
|
|
|
|
|
|
DB_PATH = "/state/shares.db"
|
|
LOCK_PATH = "/state/reconcile.lock"
|
|
GROUP_ROOT = "/data/groups/data"
|
|
GROUP_ARCHIVE_ROOT = "/data/groups/archive"
|
|
PRIVATE_ROOT = "/data/private"
|
|
FSLOGIX_ROOT = "/data/fslogix"
|
|
|
|
LDAP_FILTER = "(&(objectClass=group)(sAMAccountName=FS_*))"
|
|
GROUP_PREFIXES = ("FS_",)
|
|
GROUP_TITLE_ATTRS = ("displayname", "name", "cn")
|
|
USER_STATUS_FILTER = "(&(objectClass=user)(!(objectClass=computer))(sAMAccountName=*))"
|
|
GROUP_SEARCH_ATTRS = [
|
|
"objectGUID",
|
|
"sAMAccountName",
|
|
"displayName",
|
|
"name",
|
|
"cn",
|
|
"distinguishedName",
|
|
"member",
|
|
"objectClass",
|
|
]
|
|
PRINCIPAL_SEARCH_ATTRS = [
|
|
"objectGUID",
|
|
"sAMAccountName",
|
|
"distinguishedName",
|
|
"member",
|
|
"objectClass",
|
|
]
|
|
LDAP_DN_LOOKUP_BATCH_SIZE = 25
|
|
SETFACL_ENTRY_CHUNK_SIZE = 40
|
|
|
|
REQUIRED_ENV = ["REALM", "WORKGROUP", "DOMAIN"]
|
|
ATTR_RE = re.compile(r"^([^:]+)(::?)\s*(.*)$")
|
|
GROUP_FOLDER_INVALID_RE = re.compile(r"[\\/:*?\"<>|]")
|
|
PRIVATE_SKIP_EXACT = {
|
|
"krbtgt",
|
|
"administrator",
|
|
"guest",
|
|
"gast",
|
|
"defaultaccount",
|
|
"wdagutilityaccount",
|
|
"fileshare_serviceacc",
|
|
"fileshare_serviceaccount",
|
|
}
|
|
PRIVATE_SKIP_PREFIXES = ("msol_", "fileshare_service", "aad_")
|
|
UAC_ACCOUNTDISABLE = 0x0002
|
|
UAC_LOCKOUT = 0x0010
|
|
AD_NEVER_EXPIRES_VALUES = {0, 9223372036854775807}
|
|
MAX_GROUP_FOLDER_NAME = 120
|
|
|
|
LdapValue = Tuple[str, bool]
|
|
LdapEntry = Dict[str, List[LdapValue]]
|
|
Principal = Dict[str, object]
|
|
PrincipalLookup = Callable[[List[str]], Dict[str, Principal]]
|
|
|
|
|
|
@dataclass
|
|
class MembershipExpansion:
|
|
group_sams: List[str] = field(default_factory=list)
|
|
terminal_user_count: int = 0
|
|
unresolved_dns: List[str] = field(default_factory=list)
|
|
ignored_dns: List[str] = field(default_factory=list)
|
|
cycle_paths: List[List[str]] = field(default_factory=list)
|
|
|
|
|
|
def now_utc() -> str:
|
|
return dt.datetime.now(dt.timezone.utc).isoformat(timespec="seconds")
|
|
|
|
|
|
def log(message: str) -> None:
|
|
print(f"[reconcile] {message}", flush=True)
|
|
|
|
|
|
def ensure_required_env() -> None:
|
|
missing = [key for key in REQUIRED_ENV if not os.getenv(key)]
|
|
if missing:
|
|
raise RuntimeError(f"Missing required env vars: {', '.join(missing)}")
|
|
|
|
|
|
def realm_to_base_dn(realm: str) -> str:
|
|
parts = [part for part in realm.split(".") if part]
|
|
if not parts:
|
|
raise RuntimeError("REALM is invalid and cannot be converted to base DN")
|
|
return ",".join(f"DC={part}" for part in parts)
|
|
|
|
|
|
def parse_guid(raw_value: str, is_b64: bool) -> str:
|
|
if is_b64:
|
|
raw = base64.b64decode(raw_value)
|
|
if len(raw) != 16:
|
|
raise ValueError("objectGUID has invalid binary length")
|
|
return str(uuid.UUID(bytes_le=raw))
|
|
|
|
candidate = raw_value.strip().strip("{}")
|
|
return str(uuid.UUID(candidate))
|
|
|
|
|
|
def run_command(command: List[str], check: bool = True) -> subprocess.CompletedProcess:
|
|
result = subprocess.run(command, capture_output=True, text=True)
|
|
if check and result.returncode != 0:
|
|
raise RuntimeError(
|
|
f"Command failed ({' '.join(command)}): {result.stderr.strip() or result.stdout.strip()}"
|
|
)
|
|
return result
|
|
|
|
|
|
def unfold_ldap_lines(output: str) -> List[str]:
|
|
lines: List[str] = []
|
|
for raw_line in output.splitlines():
|
|
if raw_line.startswith(" ") and lines:
|
|
lines[-1] += raw_line[1:]
|
|
continue
|
|
lines.append(raw_line)
|
|
return lines
|
|
|
|
|
|
def parse_ldap_entries(output: str) -> List[LdapEntry]:
|
|
entries: List[LdapEntry] = []
|
|
current: LdapEntry = {}
|
|
|
|
for line in unfold_ldap_lines(output):
|
|
stripped = line.strip()
|
|
if not stripped:
|
|
if current:
|
|
entries.append(current)
|
|
current = {}
|
|
continue
|
|
if stripped.startswith("#"):
|
|
continue
|
|
|
|
match = ATTR_RE.match(stripped)
|
|
if not match:
|
|
continue
|
|
|
|
key, delimiter, value = match.groups()
|
|
current.setdefault(key.lower(), []).append((value, delimiter == "::"))
|
|
|
|
if current:
|
|
entries.append(current)
|
|
|
|
return entries
|
|
|
|
|
|
def decode_ldap_text(value: str, is_b64: bool) -> str:
|
|
if not is_b64:
|
|
return value.strip()
|
|
try:
|
|
return base64.b64decode(value).decode("utf-8").strip()
|
|
except (ValueError, UnicodeDecodeError):
|
|
return value.strip()
|
|
|
|
|
|
def ldap_values(entry: LdapEntry, attr: str) -> List[str]:
|
|
attr_key = attr.lower()
|
|
values: List[str] = []
|
|
for entry_key, entry_values in entry.items():
|
|
if entry_key != attr_key and not entry_key.startswith(f"{attr_key};"):
|
|
continue
|
|
values.extend(
|
|
decode_ldap_text(value, is_b64) for value, is_b64 in entry_values
|
|
)
|
|
return values
|
|
|
|
|
|
def ldap_first(entry: LdapEntry, attr: str) -> Optional[str]:
|
|
values = ldap_values(entry, attr)
|
|
for value in values:
|
|
if value:
|
|
return value
|
|
return None
|
|
|
|
|
|
def ldap_first_raw(entry: LdapEntry, attr: str) -> Optional[LdapValue]:
|
|
values = entry.get(attr.lower(), [])
|
|
return values[0] if values else None
|
|
|
|
|
|
def derive_share_name(sam_account_name: str) -> Optional[str]:
|
|
for prefix in GROUP_PREFIXES:
|
|
if sam_account_name.startswith(prefix):
|
|
share_name = sam_account_name[len(prefix) :]
|
|
return share_name if share_name else None
|
|
return None
|
|
|
|
|
|
def derive_group_title(entry: LdapEntry) -> Optional[str]:
|
|
for attr in GROUP_TITLE_ATTRS:
|
|
value = ldap_first(entry, attr)
|
|
if value:
|
|
return value
|
|
return None
|
|
|
|
|
|
def entry_dn(entry: LdapEntry) -> str:
|
|
return ldap_first(entry, "distinguishedName") or ldap_first(entry, "dn") or ""
|
|
|
|
|
|
def parse_principal_from_entry(entry: LdapEntry) -> Optional[Principal]:
|
|
dn = entry_dn(entry)
|
|
if not dn:
|
|
return None
|
|
|
|
guid = ""
|
|
guid_raw = ldap_first_raw(entry, "objectGUID")
|
|
if guid_raw is not None:
|
|
try:
|
|
guid = parse_guid(guid_raw[0].strip(), guid_raw[1])
|
|
except ValueError:
|
|
guid = ""
|
|
|
|
object_classes = {value.lower() for value in ldap_values(entry, "objectClass")}
|
|
return {
|
|
"dn": dn,
|
|
"objectGUID": guid,
|
|
"samAccountName": ldap_first(entry, "sAMAccountName") or "",
|
|
"memberDns": ldap_values(entry, "member"),
|
|
"objectClasses": object_classes,
|
|
}
|
|
|
|
|
|
def parse_groups_from_ldap_entries(entries: List[LdapEntry]) -> List[Dict[str, object]]:
|
|
groups: List[Dict[str, object]] = []
|
|
for entry in entries:
|
|
guid_raw = ldap_first_raw(entry, "objectGUID")
|
|
sam = ldap_first(entry, "sAMAccountName")
|
|
if guid_raw is None or not sam:
|
|
continue
|
|
|
|
share_name = derive_group_title(entry) or derive_share_name(sam)
|
|
if not share_name:
|
|
continue
|
|
|
|
guid = parse_guid(guid_raw[0].strip(), guid_raw[1])
|
|
object_classes = {value.lower() for value in ldap_values(entry, "objectClass")}
|
|
if not object_classes:
|
|
object_classes = {"group"}
|
|
|
|
groups.append(
|
|
{
|
|
"objectGUID": guid,
|
|
"samAccountName": sam,
|
|
"shareName": share_name,
|
|
"distinguishedName": entry_dn(entry),
|
|
"memberDns": ldap_values(entry, "member"),
|
|
"objectClasses": object_classes,
|
|
}
|
|
)
|
|
|
|
deduped: Dict[str, Dict[str, object]] = {}
|
|
for group in groups:
|
|
deduped[str(group["objectGUID"])] = group
|
|
|
|
return list(deduped.values())
|
|
|
|
|
|
def parse_groups_from_ldap_output(output: str) -> List[Dict[str, object]]:
|
|
return parse_groups_from_ldap_entries(parse_ldap_entries(output))
|
|
|
|
|
|
def sanitize_group_folder_name(raw_name: str) -> str:
|
|
candidate = GROUP_FOLDER_INVALID_RE.sub("_", raw_name.strip())
|
|
candidate = candidate.strip().rstrip(".")
|
|
candidate = re.sub(r"\s+", " ", candidate)
|
|
if not candidate:
|
|
return ""
|
|
return candidate[:MAX_GROUP_FOLDER_NAME]
|
|
|
|
|
|
def with_suffix_limited(base_name: str, suffix: str) -> str:
|
|
limit = MAX_GROUP_FOLDER_NAME - len(suffix)
|
|
if limit <= 0:
|
|
return suffix[-MAX_GROUP_FOLDER_NAME:]
|
|
trimmed = base_name[:limit].rstrip(" ._")
|
|
if not trimmed:
|
|
trimmed = "group"
|
|
return f"{trimmed}{suffix}"
|
|
|
|
|
|
def choose_group_folder_name(
|
|
preferred_name: str,
|
|
sam_account_name: str,
|
|
guid: str,
|
|
used_names: set,
|
|
existing_name: str = "",
|
|
) -> str:
|
|
base_name = sanitize_group_folder_name(preferred_name)
|
|
if not base_name:
|
|
base_name = sanitize_group_folder_name(
|
|
derive_share_name(sam_account_name) or ""
|
|
)
|
|
if not base_name:
|
|
base_name = sanitize_group_folder_name(sam_account_name)
|
|
if not base_name:
|
|
base_name = f"group_{guid[:8]}"
|
|
|
|
if existing_name:
|
|
existing_folded = existing_name.casefold()
|
|
if existing_folded not in used_names:
|
|
sanitized_existing = sanitize_group_folder_name(existing_name)
|
|
if sanitized_existing.casefold() == base_name.casefold():
|
|
used_names.add(existing_folded)
|
|
return existing_name
|
|
|
|
candidate = base_name
|
|
index = 0
|
|
while candidate.casefold() in used_names:
|
|
index += 1
|
|
suffix = f"_{guid[:8]}" if index == 1 else f"_{guid[:8]}_{index}"
|
|
candidate = with_suffix_limited(base_name, suffix)
|
|
|
|
used_names.add(candidate.casefold())
|
|
return candidate
|
|
|
|
|
|
def next_available_path(path: str) -> str:
|
|
if not os.path.exists(path):
|
|
return path
|
|
|
|
index = 1
|
|
while True:
|
|
candidate = f"{path}_{index}"
|
|
if not os.path.exists(candidate):
|
|
return candidate
|
|
index += 1
|
|
|
|
|
|
def chunked(values: List[str], size: int) -> Iterable[List[str]]:
|
|
for index in range(0, len(values), size):
|
|
yield values[index : index + size]
|
|
|
|
|
|
def escape_ldap_filter_value(value: str) -> str:
|
|
replacements = {
|
|
"\\": "\\5c",
|
|
"*": "\\2a",
|
|
"(": "\\28",
|
|
")": "\\29",
|
|
"\x00": "\\00",
|
|
}
|
|
return "".join(replacements.get(char, char) for char in value)
|
|
|
|
|
|
def build_distinguished_name_filter(dns: List[str]) -> str:
|
|
clauses = [f"(distinguishedName={escape_ldap_filter_value(dn)})" for dn in dns]
|
|
if len(clauses) == 1:
|
|
return clauses[0]
|
|
return f"(|{''.join(clauses)})"
|
|
|
|
|
|
def search_entries_via_net_ads(
|
|
filter_expr: str, attributes: List[str]
|
|
) -> List[LdapEntry]:
|
|
result = run_command(
|
|
["net", "ads", "search", "-P", filter_expr, *attributes],
|
|
check=False,
|
|
)
|
|
if result.returncode != 0:
|
|
raise RuntimeError(
|
|
result.stderr.strip() or result.stdout.strip() or "net ads search failed"
|
|
)
|
|
return parse_ldap_entries(result.stdout)
|
|
|
|
|
|
def search_entries_via_ldap_bind(
|
|
filter_expr: str, attributes: List[str]
|
|
) -> List[LdapEntry]:
|
|
realm = os.environ["REALM"]
|
|
join_user = os.getenv("JOIN_USER", "")
|
|
join_password = os.getenv("JOIN_PASSWORD", "")
|
|
if not join_user or not join_password:
|
|
raise RuntimeError(
|
|
"JOIN_USER/JOIN_PASSWORD are required for LDAP credential fallback"
|
|
)
|
|
|
|
bind_dn = f"{join_user}@{realm}"
|
|
ldap_uri = os.getenv("LDAP_URI", f"ldaps://{os.environ['DOMAIN']}")
|
|
base_dn = os.getenv("LDAP_BASE_DN", realm_to_base_dn(realm))
|
|
|
|
pw_file = None
|
|
try:
|
|
with tempfile.NamedTemporaryFile("w", encoding="utf-8", delete=False) as handle:
|
|
pw_file = handle.name
|
|
handle.write(join_password)
|
|
handle.write("\n")
|
|
os.chmod(pw_file, 0o600)
|
|
|
|
result = run_command(
|
|
[
|
|
"ldapsearch",
|
|
"-LLL",
|
|
"-x",
|
|
"-H",
|
|
ldap_uri,
|
|
"-D",
|
|
bind_dn,
|
|
"-y",
|
|
pw_file,
|
|
"-b",
|
|
base_dn,
|
|
filter_expr,
|
|
*attributes,
|
|
]
|
|
)
|
|
return parse_ldap_entries(result.stdout)
|
|
finally:
|
|
if pw_file and os.path.exists(pw_file):
|
|
os.remove(pw_file)
|
|
|
|
|
|
def search_directory_entries(filter_expr: str, attributes: List[str]) -> List[LdapEntry]:
|
|
try:
|
|
return search_entries_via_net_ads(filter_expr, attributes)
|
|
except Exception as net_exc: # pylint: disable=broad-except
|
|
log(f"net ads search failed, falling back to LDAP bind: {net_exc}")
|
|
return search_entries_via_ldap_bind(filter_expr, attributes)
|
|
|
|
|
|
def fetch_fileshare_groups() -> List[Dict[str, object]]:
|
|
entries = search_directory_entries(LDAP_FILTER, GROUP_SEARCH_ATTRS)
|
|
return parse_groups_from_ldap_entries(entries)
|
|
|
|
|
|
def normalize_dn(dn: str) -> str:
|
|
return dn.strip().casefold()
|
|
|
|
|
|
def group_to_principal(group: Dict[str, object]) -> Principal:
|
|
object_classes = group.get("objectClasses") or {"group"}
|
|
return {
|
|
"dn": str(group.get("distinguishedName") or ""),
|
|
"objectGUID": str(group.get("objectGUID") or ""),
|
|
"samAccountName": str(group.get("samAccountName") or ""),
|
|
"memberDns": [str(dn) for dn in group.get("memberDns", []) if str(dn).strip()],
|
|
"objectClasses": {str(value).lower() for value in object_classes},
|
|
}
|
|
|
|
|
|
def principal_display_name(principal: Principal) -> str:
|
|
sam = str(principal.get("samAccountName") or "").strip()
|
|
if sam:
|
|
return sam
|
|
return str(principal.get("dn") or "<unknown>")
|
|
|
|
|
|
def is_group_principal(principal: Principal) -> bool:
|
|
return "group" in principal.get("objectClasses", set())
|
|
|
|
|
|
def is_computer_principal(principal: Principal) -> bool:
|
|
return "computer" in principal.get("objectClasses", set())
|
|
|
|
|
|
def is_user_principal(principal: Principal) -> bool:
|
|
return "user" in principal.get("objectClasses", set()) and not is_computer_principal(
|
|
principal
|
|
)
|
|
|
|
|
|
def lookup_principals_by_dns(dns: List[str]) -> Dict[str, Principal]:
|
|
unique_dns: List[str] = []
|
|
seen_dns: Set[str] = set()
|
|
for dn in dns:
|
|
key = normalize_dn(dn)
|
|
if not key or key in seen_dns:
|
|
continue
|
|
seen_dns.add(key)
|
|
unique_dns.append(dn)
|
|
|
|
principals: Dict[str, Principal] = {}
|
|
for dn_chunk in chunked(unique_dns, LDAP_DN_LOOKUP_BATCH_SIZE):
|
|
entries = search_directory_entries(
|
|
build_distinguished_name_filter(dn_chunk), PRINCIPAL_SEARCH_ATTRS
|
|
)
|
|
for entry in entries:
|
|
principal = parse_principal_from_entry(entry)
|
|
if principal is None:
|
|
continue
|
|
key = normalize_dn(str(principal.get("dn") or ""))
|
|
if key:
|
|
principals[key] = principal
|
|
|
|
return principals
|
|
|
|
|
|
def load_principals_for_dns(
|
|
dns: List[str], cache: Dict[str, Principal], lookup_func: PrincipalLookup
|
|
) -> None:
|
|
missing_dns: List[str] = []
|
|
seen_dns: Set[str] = set()
|
|
for dn in dns:
|
|
key = normalize_dn(dn)
|
|
if not key or key in cache or key in seen_dns:
|
|
continue
|
|
seen_dns.add(key)
|
|
missing_dns.append(dn)
|
|
|
|
if not missing_dns:
|
|
return
|
|
|
|
for lookup_key, principal in lookup_func(missing_dns).items():
|
|
principal_key = normalize_dn(str(principal.get("dn") or lookup_key))
|
|
if principal_key:
|
|
cache[principal_key] = principal
|
|
|
|
|
|
def expand_group_membership(
|
|
root_group: Dict[str, object],
|
|
principal_cache: Optional[Dict[str, Principal]] = None,
|
|
lookup_func: PrincipalLookup = lookup_principals_by_dns,
|
|
) -> MembershipExpansion:
|
|
cache = principal_cache if principal_cache is not None else {}
|
|
root_principal = group_to_principal(root_group)
|
|
root_key = normalize_dn(str(root_principal.get("dn") or ""))
|
|
if root_key:
|
|
cache[root_key] = root_principal
|
|
|
|
expansion = MembershipExpansion()
|
|
group_sams_seen: Set[str] = set()
|
|
unresolved_seen: Set[str] = set()
|
|
ignored_seen: Set[str] = set()
|
|
user_dns_seen: Set[str] = set()
|
|
cycle_paths_seen: Set[str] = set()
|
|
visiting: Set[str] = set()
|
|
visited: Set[str] = set()
|
|
|
|
def add_unresolved(dn: str) -> None:
|
|
key = normalize_dn(dn)
|
|
if key and key not in unresolved_seen:
|
|
unresolved_seen.add(key)
|
|
expansion.unresolved_dns.append(dn)
|
|
|
|
def add_ignored(dn: str) -> None:
|
|
key = normalize_dn(dn)
|
|
if key and key not in ignored_seen:
|
|
ignored_seen.add(key)
|
|
expansion.ignored_dns.append(dn)
|
|
|
|
def add_cycle(path: List[str]) -> None:
|
|
key = " -> ".join(path).casefold()
|
|
if key not in cycle_paths_seen:
|
|
cycle_paths_seen.add(key)
|
|
expansion.cycle_paths.append(path)
|
|
|
|
def visit_group(principal: Principal, path: List[str]) -> None:
|
|
current_key = normalize_dn(str(principal.get("dn") or ""))
|
|
if current_key:
|
|
visiting.add(current_key)
|
|
|
|
member_dns = [
|
|
str(dn) for dn in principal.get("memberDns", []) if str(dn).strip()
|
|
]
|
|
load_principals_for_dns(member_dns, cache, lookup_func)
|
|
|
|
for member_dn in member_dns:
|
|
member_key = normalize_dn(member_dn)
|
|
if not member_key:
|
|
continue
|
|
|
|
member = cache.get(member_key)
|
|
if member is None:
|
|
add_unresolved(member_dn)
|
|
continue
|
|
|
|
member_label = principal_display_name(member)
|
|
if member_key in visiting:
|
|
add_cycle(path + [member_label])
|
|
continue
|
|
|
|
if is_group_principal(member):
|
|
member_sam = str(member.get("samAccountName") or "").strip()
|
|
if not member_sam:
|
|
add_unresolved(str(member.get("dn") or member_dn))
|
|
else:
|
|
sam_key = member_sam.casefold()
|
|
if sam_key not in group_sams_seen:
|
|
group_sams_seen.add(sam_key)
|
|
expansion.group_sams.append(member_sam)
|
|
|
|
if member_key not in visited:
|
|
visit_group(member, path + [member_label])
|
|
continue
|
|
|
|
if is_computer_principal(member):
|
|
add_ignored(str(member.get("dn") or member_dn))
|
|
continue
|
|
|
|
if is_user_principal(member):
|
|
if member_key not in user_dns_seen:
|
|
user_dns_seen.add(member_key)
|
|
expansion.terminal_user_count += 1
|
|
continue
|
|
|
|
add_ignored(str(member.get("dn") or member_dn))
|
|
|
|
if current_key:
|
|
visiting.discard(current_key)
|
|
visited.add(current_key)
|
|
|
|
visit_group(root_principal, [principal_display_name(root_principal)])
|
|
return expansion
|
|
|
|
|
|
def windows_filetime_now() -> int:
|
|
unix_epoch_seconds = int(dt.datetime.now(dt.timezone.utc).timestamp())
|
|
return (unix_epoch_seconds + 11644473600) * 10000000
|
|
|
|
|
|
def parse_int(value: str, default: int = 0) -> int:
|
|
try:
|
|
return int(value.strip())
|
|
except (ValueError, AttributeError):
|
|
return default
|
|
|
|
|
|
def fetch_non_login_users() -> set:
|
|
command = [
|
|
"net",
|
|
"ads",
|
|
"search",
|
|
"-P",
|
|
USER_STATUS_FILTER,
|
|
"sAMAccountName",
|
|
"userAccountControl",
|
|
"accountExpires",
|
|
"lockoutTime",
|
|
]
|
|
result = run_command(command, check=False)
|
|
if result.returncode != 0:
|
|
log(
|
|
"net ads search for account status failed; private folder filtering will use static skip rules only"
|
|
)
|
|
return set()
|
|
|
|
blocked = set()
|
|
now_filetime = windows_filetime_now()
|
|
|
|
for entry in parse_ldap_entries(result.stdout):
|
|
username = (ldap_first(entry, "sAMAccountName") or "").lower()
|
|
if not username:
|
|
continue
|
|
|
|
uac = parse_int(ldap_first(entry, "userAccountControl") or "0", 0)
|
|
account_expires = parse_int(ldap_first(entry, "accountExpires") or "0", 0)
|
|
lockout_time = parse_int(ldap_first(entry, "lockoutTime") or "0", 0)
|
|
|
|
is_disabled = bool(uac & UAC_ACCOUNTDISABLE)
|
|
is_locked = bool(uac & UAC_LOCKOUT) or lockout_time > 0
|
|
is_expired = (
|
|
account_expires not in AD_NEVER_EXPIRES_VALUES
|
|
and account_expires <= now_filetime
|
|
)
|
|
|
|
if is_disabled or is_locked or is_expired:
|
|
blocked.add(username)
|
|
|
|
return blocked
|
|
|
|
|
|
def open_db() -> sqlite3.Connection:
|
|
os.makedirs(os.path.dirname(DB_PATH), exist_ok=True)
|
|
conn = sqlite3.connect(DB_PATH)
|
|
conn.row_factory = sqlite3.Row
|
|
conn.execute(
|
|
"""
|
|
CREATE TABLE IF NOT EXISTS shares (
|
|
objectGUID TEXT PRIMARY KEY,
|
|
samAccountName TEXT NOT NULL,
|
|
shareName TEXT NOT NULL,
|
|
path TEXT NOT NULL,
|
|
createdAt TIMESTAMP NOT NULL,
|
|
lastSeenAt TIMESTAMP NOT NULL,
|
|
isActive INTEGER NOT NULL
|
|
)
|
|
"""
|
|
)
|
|
conn.commit()
|
|
return conn
|
|
|
|
|
|
def ensure_group_path(path: str) -> None:
|
|
os.makedirs(path, exist_ok=True)
|
|
os.chmod(path, 0o2770)
|
|
|
|
|
|
def reconcile_db(conn: sqlite3.Connection, ad_groups: List[Dict[str, object]]) -> None:
|
|
timestamp = now_utc()
|
|
seen = set()
|
|
|
|
os.makedirs(GROUP_ROOT, exist_ok=True)
|
|
os.makedirs(GROUP_ARCHIVE_ROOT, exist_ok=True)
|
|
|
|
rows = conn.execute(
|
|
"SELECT objectGUID, samAccountName, shareName, path, isActive FROM shares"
|
|
).fetchall()
|
|
existing_by_guid = {row["objectGUID"]: row for row in rows}
|
|
used_names = set()
|
|
|
|
for group in ad_groups:
|
|
guid = group["objectGUID"]
|
|
sam = group["samAccountName"]
|
|
row = existing_by_guid.get(guid)
|
|
existing_name = ""
|
|
if (
|
|
row is not None
|
|
and row["isActive"]
|
|
and row["path"].startswith(f"{GROUP_ROOT}/")
|
|
):
|
|
existing_name = os.path.basename(row["path"])
|
|
|
|
folder_name = choose_group_folder_name(
|
|
group["shareName"], sam, guid, used_names, existing_name
|
|
)
|
|
path = os.path.join(GROUP_ROOT, folder_name)
|
|
seen.add(guid)
|
|
|
|
if row is None:
|
|
ensure_group_path(path)
|
|
conn.execute(
|
|
"""
|
|
INSERT INTO shares (objectGUID, samAccountName, shareName, path, createdAt, lastSeenAt, isActive)
|
|
VALUES (?, ?, ?, ?, ?, ?, 1)
|
|
""",
|
|
(guid, sam, folder_name, path, timestamp, timestamp),
|
|
)
|
|
log(f"Discovered new data folder group {sam} ({guid})")
|
|
continue
|
|
|
|
existing_path = row["path"]
|
|
if existing_path != path:
|
|
if os.path.exists(existing_path):
|
|
final_path = next_available_path(path)
|
|
os.rename(existing_path, final_path)
|
|
path = final_path
|
|
else:
|
|
ensure_group_path(path)
|
|
|
|
ensure_group_path(path)
|
|
conn.execute(
|
|
"""
|
|
UPDATE shares
|
|
SET samAccountName = ?,
|
|
shareName = ?,
|
|
path = ?,
|
|
lastSeenAt = ?,
|
|
isActive = 1
|
|
WHERE objectGUID = ?
|
|
""",
|
|
(sam, folder_name, path, timestamp, guid),
|
|
)
|
|
|
|
active_rows = conn.execute(
|
|
"SELECT objectGUID, samAccountName, shareName, path FROM shares WHERE isActive = 1"
|
|
).fetchall()
|
|
for row in active_rows:
|
|
guid = row["objectGUID"]
|
|
if guid in seen:
|
|
continue
|
|
|
|
old_path = row["path"]
|
|
archive_name = choose_group_folder_name(
|
|
row["shareName"],
|
|
row["samAccountName"],
|
|
guid,
|
|
set(),
|
|
)
|
|
archive_path = os.path.join(GROUP_ARCHIVE_ROOT, archive_name)
|
|
if os.path.exists(old_path):
|
|
final_archive_path = next_available_path(archive_path)
|
|
os.rename(old_path, final_archive_path)
|
|
archive_path = final_archive_path
|
|
|
|
conn.execute(
|
|
"""
|
|
UPDATE shares
|
|
SET isActive = 0,
|
|
path = ?,
|
|
lastSeenAt = ?
|
|
WHERE objectGUID = ?
|
|
""",
|
|
(archive_path, timestamp, guid),
|
|
)
|
|
|
|
conn.commit()
|
|
|
|
|
|
def reload_samba() -> None:
|
|
result = run_command(["smbcontrol", "all", "reload-config"], check=False)
|
|
if result.returncode != 0:
|
|
log("smbcontrol reload-config failed; will retry on next run")
|
|
|
|
|
|
def refresh_winbind_cache() -> None:
|
|
result = run_command(["net", "cache", "flush"], check=False)
|
|
if result.returncode != 0:
|
|
log("net cache flush failed; group membership updates may be delayed")
|
|
|
|
|
|
def resolve_user_uid(qualified_user: str) -> Optional[int]:
|
|
try:
|
|
return pwd.getpwnam(qualified_user).pw_uid
|
|
except KeyError:
|
|
return None
|
|
|
|
|
|
def resolve_group_gid(qualified_group: str) -> Optional[int]:
|
|
try:
|
|
return grp.getgrnam(qualified_group).gr_gid
|
|
except KeyError:
|
|
return None
|
|
|
|
|
|
def resolve_user_uid_flexible(workgroup: str, username: str) -> Optional[int]:
|
|
candidates: List[str] = []
|
|
if "\\" in username:
|
|
candidates.append(username)
|
|
candidates.append(username.split("\\", 1)[1])
|
|
else:
|
|
candidates.append(f"{workgroup}\\{username}")
|
|
candidates.append(username)
|
|
|
|
for candidate in candidates:
|
|
uid = resolve_user_uid(candidate)
|
|
if uid is not None:
|
|
return uid
|
|
return None
|
|
|
|
|
|
def resolve_group_gid_flexible(workgroup: str, group_name: str) -> Optional[int]:
|
|
candidates: List[str] = []
|
|
if "\\" in group_name:
|
|
candidates.append(group_name)
|
|
candidates.append(group_name.split("\\", 1)[1])
|
|
else:
|
|
candidates.append(f"{workgroup}\\{group_name}")
|
|
candidates.append(group_name)
|
|
|
|
for candidate in candidates:
|
|
gid = resolve_group_gid(candidate)
|
|
if gid is not None:
|
|
return gid
|
|
return None
|
|
|
|
|
|
def resolve_gid_from_sid(sid: str) -> Optional[int]:
|
|
if not sid:
|
|
return None
|
|
result = run_command(["wbinfo", "--sid-to-gid", sid], check=False)
|
|
if result.returncode != 0:
|
|
return None
|
|
try:
|
|
return int(result.stdout.strip())
|
|
except ValueError:
|
|
return None
|
|
|
|
|
|
def resolve_group_gids_for_acl(
|
|
workgroup: str,
|
|
group_names: List[str],
|
|
resolver: Callable[[str, str], Optional[int]] = resolve_group_gid_flexible,
|
|
) -> Tuple[List[int], List[str]]:
|
|
gids: List[int] = []
|
|
unresolved: List[str] = []
|
|
seen_gids: Set[int] = set()
|
|
seen_names: Set[str] = set()
|
|
|
|
for group_name in group_names:
|
|
name = group_name.strip()
|
|
name_key = name.casefold()
|
|
if not name or name_key in seen_names:
|
|
continue
|
|
seen_names.add(name_key)
|
|
|
|
gid = resolver(workgroup, name)
|
|
if gid is None:
|
|
unresolved.append(name)
|
|
continue
|
|
if gid not in seen_gids:
|
|
seen_gids.add(gid)
|
|
gids.append(gid)
|
|
|
|
return gids, unresolved
|
|
|
|
|
|
def apply_setfacl_entries(path: str, acl_entries: List[str]) -> None:
|
|
for acl_chunk in chunked(acl_entries, SETFACL_ENTRY_CHUNK_SIZE):
|
|
result = run_command(["setfacl", "-m", ",".join(acl_chunk), path], check=False)
|
|
if result.returncode != 0:
|
|
log(
|
|
f"setfacl failed for {path}: "
|
|
f"{result.stderr.strip() or result.stdout.strip()}"
|
|
)
|
|
return
|
|
|
|
|
|
def apply_group_permissions(
|
|
path: str,
|
|
owner_group_gid: int,
|
|
acl_group_gids: List[int],
|
|
admin_gid: Optional[int],
|
|
is_dir: bool,
|
|
) -> None:
|
|
if os.path.islink(path):
|
|
return
|
|
|
|
mode = 0o2770 if is_dir else 0o660
|
|
group_perms = "rwx" if is_dir else "rw-"
|
|
acl_gids: List[int] = []
|
|
seen_gids: Set[int] = set()
|
|
for gid in [owner_group_gid, *acl_group_gids]:
|
|
if gid not in seen_gids:
|
|
seen_gids.add(gid)
|
|
acl_gids.append(gid)
|
|
if admin_gid is not None and admin_gid not in seen_gids:
|
|
acl_gids.append(admin_gid)
|
|
|
|
os.chown(path, 0, owner_group_gid)
|
|
os.chmod(path, mode)
|
|
run_command(["setfacl", "-b", path], check=False)
|
|
|
|
acl_entries = [f"g:{gid}:{group_perms}" for gid in acl_gids]
|
|
acl_entries.append(f"m:{group_perms}")
|
|
|
|
if is_dir:
|
|
acl_entries.extend(f"d:g:{gid}:rwx" for gid in acl_gids)
|
|
acl_entries.append("d:m:rwx")
|
|
|
|
apply_setfacl_entries(path, acl_entries)
|
|
|
|
|
|
def apply_private_permissions(
|
|
path: str, user_uid: int, user_gid: int, admin_gid: Optional[int], is_dir: bool
|
|
) -> None:
|
|
if os.path.islink(path):
|
|
return
|
|
|
|
mode = 0o700 if is_dir else 0o600
|
|
user_perms = "rwx" if is_dir else "rw-"
|
|
|
|
os.chown(path, user_uid, user_gid)
|
|
os.chmod(path, mode)
|
|
run_command(["setfacl", "-b", path], check=False)
|
|
|
|
acl_entries = [f"u:{user_uid}:{user_perms}"]
|
|
if admin_gid is not None:
|
|
acl_entries.append(f"g:{admin_gid}:{user_perms}")
|
|
|
|
if is_dir:
|
|
acl_entries.append(f"d:u:{user_uid}:rwx")
|
|
if admin_gid is not None:
|
|
acl_entries.append(f"d:g:{admin_gid}:rwx")
|
|
|
|
result = run_command(["setfacl", "-m", ",".join(acl_entries), path], check=False)
|
|
if result.returncode != 0:
|
|
log(
|
|
f"setfacl failed for {path}: {result.stderr.strip() or result.stdout.strip()}"
|
|
)
|
|
|
|
|
|
def enforce_group_tree_permissions(
|
|
root_path: str,
|
|
owner_group_gid: int,
|
|
acl_group_gids: List[int],
|
|
admin_gid: Optional[int],
|
|
) -> None:
|
|
apply_group_permissions(
|
|
root_path, owner_group_gid, acl_group_gids, admin_gid, is_dir=True
|
|
)
|
|
for current_root, dirnames, filenames in os.walk(root_path):
|
|
for dirname in dirnames:
|
|
apply_group_permissions(
|
|
os.path.join(current_root, dirname),
|
|
owner_group_gid,
|
|
acl_group_gids,
|
|
admin_gid,
|
|
is_dir=True,
|
|
)
|
|
for filename in filenames:
|
|
apply_group_permissions(
|
|
os.path.join(current_root, filename),
|
|
owner_group_gid,
|
|
acl_group_gids,
|
|
admin_gid,
|
|
is_dir=False,
|
|
)
|
|
|
|
|
|
def resolve_user_primary_gid(uid: int) -> Optional[int]:
|
|
try:
|
|
return pwd.getpwuid(uid).pw_gid
|
|
except KeyError:
|
|
return None
|
|
|
|
|
|
def enforce_private_tree_permissions(
|
|
root_path: str, user_uid: int, user_gid: int, admin_gid: Optional[int]
|
|
) -> None:
|
|
apply_private_permissions(root_path, user_uid, user_gid, admin_gid, is_dir=True)
|
|
for current_root, dirnames, filenames in os.walk(root_path):
|
|
for dirname in dirnames:
|
|
apply_private_permissions(
|
|
os.path.join(current_root, dirname),
|
|
user_uid,
|
|
user_gid,
|
|
admin_gid,
|
|
is_dir=True,
|
|
)
|
|
for filename in filenames:
|
|
apply_private_permissions(
|
|
os.path.join(current_root, filename),
|
|
user_uid,
|
|
user_gid,
|
|
admin_gid,
|
|
is_dir=False,
|
|
)
|
|
|
|
|
|
def list_domain_users(non_login_users: set) -> List[str]:
|
|
result = run_command(["wbinfo", "-u"], check=False)
|
|
if result.returncode != 0:
|
|
log("wbinfo -u failed; skipping private directory sync")
|
|
return []
|
|
|
|
users = []
|
|
for line in result.stdout.splitlines():
|
|
candidate = line.strip()
|
|
if not candidate:
|
|
continue
|
|
if "\\" in candidate:
|
|
candidate = candidate.split("\\", 1)[1]
|
|
if not candidate or candidate.endswith("$"):
|
|
continue
|
|
if should_skip_private_user(candidate):
|
|
continue
|
|
if candidate.lower() in non_login_users:
|
|
continue
|
|
users.append(candidate)
|
|
return sorted(set(users))
|
|
|
|
|
|
def should_skip_private_user(username: str) -> bool:
|
|
normalized = username.strip().lower()
|
|
if not normalized:
|
|
return True
|
|
if normalized in PRIVATE_SKIP_EXACT:
|
|
return True
|
|
if any(normalized.startswith(prefix) for prefix in PRIVATE_SKIP_PREFIXES):
|
|
return True
|
|
|
|
extra_skip_users = {
|
|
value.strip().lower()
|
|
for value in os.getenv("PRIVATE_SKIP_USERS", "").split(",")
|
|
if value.strip()
|
|
}
|
|
if normalized in extra_skip_users:
|
|
return True
|
|
|
|
extra_skip_prefixes = [
|
|
value.strip().lower()
|
|
for value in os.getenv("PRIVATE_SKIP_PREFIXES", "").split(",")
|
|
if value.strip()
|
|
]
|
|
if any(normalized.startswith(prefix) for prefix in extra_skip_prefixes):
|
|
return True
|
|
|
|
return False
|
|
|
|
|
|
def sync_fslogix_directory() -> None:
|
|
workgroup = os.environ["WORKGROUP"]
|
|
fslogix_group = os.getenv("FSLOGIX_GROUP", "")
|
|
fslogix_group_sid = os.getenv("FSLOGIX_GROUP_SID", "")
|
|
qualified_group = fslogix_group
|
|
|
|
os.makedirs(FSLOGIX_ROOT, exist_ok=True)
|
|
|
|
gid = None
|
|
if qualified_group:
|
|
gid = resolve_group_gid_flexible(workgroup, qualified_group)
|
|
if gid is None and fslogix_group_sid:
|
|
gid = resolve_gid_from_sid(fslogix_group_sid)
|
|
|
|
if gid is None:
|
|
group_display = qualified_group or fslogix_group_sid or "<unset>"
|
|
log(f"Unable to resolve GID for {group_display}; fslogix ACLs unchanged")
|
|
return
|
|
|
|
admin_group = os.getenv("DOMAIN_ADMINS_GROUP", "")
|
|
admin_gid = None
|
|
if admin_group:
|
|
admin_gid = resolve_group_gid_flexible(workgroup, admin_group)
|
|
if admin_gid is None:
|
|
admin_gid = resolve_gid_from_sid(os.getenv("DOMAIN_ADMINS_SID", ""))
|
|
|
|
os.chown(FSLOGIX_ROOT, 0, gid)
|
|
os.chmod(FSLOGIX_ROOT, 0o3770)
|
|
run_command(["setfacl", "-b", FSLOGIX_ROOT], check=False)
|
|
|
|
acl_entries = [f"g:{gid}:rwx", f"d:g:{gid}:rwx"]
|
|
if admin_gid is not None and admin_gid != gid:
|
|
acl_entries.append(f"g:{admin_gid}:rwx")
|
|
acl_entries.append(f"d:g:{admin_gid}:rwx")
|
|
|
|
result = run_command(
|
|
["setfacl", "-m", ",".join(acl_entries), FSLOGIX_ROOT], check=False
|
|
)
|
|
if result.returncode != 0:
|
|
log(
|
|
"setfacl failed for fslogix root: "
|
|
f"{result.stderr.strip() or result.stdout.strip()}"
|
|
)
|
|
|
|
|
|
def sync_private_directories() -> None:
|
|
workgroup = os.environ["WORKGROUP"]
|
|
admin_group = os.getenv("DOMAIN_ADMINS_GROUP", "")
|
|
admin_gid = None
|
|
if admin_group:
|
|
admin_gid = resolve_group_gid_flexible(workgroup, admin_group)
|
|
if admin_gid is None:
|
|
admin_gid = resolve_gid_from_sid(os.getenv("DOMAIN_ADMINS_SID", ""))
|
|
|
|
os.makedirs(PRIVATE_ROOT, exist_ok=True)
|
|
os.chown(PRIVATE_ROOT, 0, 0)
|
|
run_command(["setfacl", "-b", PRIVATE_ROOT], check=False)
|
|
os.chmod(PRIVATE_ROOT, 0o555)
|
|
|
|
non_login_users = fetch_non_login_users()
|
|
users = list_domain_users(non_login_users)
|
|
for username in users:
|
|
uid = resolve_user_uid_flexible(workgroup, username)
|
|
if uid is None:
|
|
log(f"Unable to resolve UID for {username}, skipping private folder")
|
|
continue
|
|
|
|
user_gid = resolve_user_primary_gid(uid)
|
|
if user_gid is None:
|
|
log(
|
|
f"Unable to resolve primary GID for {username}, skipping private folder"
|
|
)
|
|
continue
|
|
|
|
user_path = os.path.join(PRIVATE_ROOT, username)
|
|
os.makedirs(user_path, exist_ok=True)
|
|
enforce_private_tree_permissions(user_path, uid, user_gid, admin_gid)
|
|
|
|
|
|
def format_dn_list(dns: List[str], limit: int = 3) -> str:
|
|
shown = dns[:limit]
|
|
suffix = "" if len(dns) <= limit else f", ... +{len(dns) - limit} more"
|
|
return ", ".join(shown) + suffix
|
|
|
|
|
|
def sync_dynamic_directory_permissions(
|
|
conn: sqlite3.Connection, ad_groups: List[Dict[str, object]]
|
|
) -> None:
|
|
workgroup = os.environ["WORKGROUP"]
|
|
admin_group = os.getenv("DOMAIN_ADMINS_GROUP", "")
|
|
admin_gid = None
|
|
if admin_group:
|
|
admin_gid = resolve_group_gid_flexible(workgroup, admin_group)
|
|
if admin_gid is None:
|
|
admin_gid = resolve_gid_from_sid(os.getenv("DOMAIN_ADMINS_SID", ""))
|
|
|
|
ad_groups_by_guid = {str(group["objectGUID"]): group for group in ad_groups}
|
|
principal_cache: Dict[str, Principal] = {}
|
|
|
|
rows = conn.execute(
|
|
"SELECT objectGUID, samAccountName, path FROM shares WHERE isActive = 1"
|
|
).fetchall()
|
|
for row in rows:
|
|
guid = row["objectGUID"]
|
|
sam = row["samAccountName"]
|
|
path = row["path"]
|
|
ad_group = ad_groups_by_guid.get(guid)
|
|
if ad_group is None:
|
|
log(f"No AD data available for {sam}; leaving existing ACLs")
|
|
continue
|
|
|
|
try:
|
|
expansion = expand_group_membership(ad_group, principal_cache)
|
|
except Exception as exc: # pylint: disable=broad-except
|
|
log(
|
|
f"Unable to expand nested members for {sam}: "
|
|
f"{exc}; leaving existing ACLs"
|
|
)
|
|
continue
|
|
|
|
for cycle_path in expansion.cycle_paths:
|
|
log(f"Detected nested group cycle for {sam}: {' -> '.join(cycle_path)}")
|
|
|
|
if expansion.ignored_dns:
|
|
log(
|
|
f"Ignoring computer/unsupported nested member(s) for {sam}: "
|
|
f"{format_dn_list(expansion.ignored_dns)}"
|
|
)
|
|
|
|
if expansion.unresolved_dns:
|
|
log(
|
|
f"Unable to resolve nested member(s) for {sam}: "
|
|
f"{format_dn_list(expansion.unresolved_dns)}; leaving existing ACLs"
|
|
)
|
|
continue
|
|
|
|
acl_group_names = [sam, *expansion.group_sams]
|
|
acl_group_gids, unresolved_groups = resolve_group_gids_for_acl(
|
|
workgroup, acl_group_names
|
|
)
|
|
if unresolved_groups:
|
|
log(
|
|
f"Unable to resolve GID(s) for {sam}: "
|
|
f"{', '.join(unresolved_groups)}; leaving existing ACLs"
|
|
)
|
|
continue
|
|
|
|
owner_group_gid = acl_group_gids[0]
|
|
if expansion.group_sams or expansion.cycle_paths:
|
|
log(
|
|
f"Expanded {sam}: {len(expansion.group_sams)} nested group(s), "
|
|
f"{expansion.terminal_user_count} terminal user(s)"
|
|
)
|
|
|
|
os.makedirs(path, exist_ok=True)
|
|
enforce_group_tree_permissions(path, owner_group_gid, acl_group_gids, admin_gid)
|
|
|
|
os.makedirs(GROUP_ROOT, exist_ok=True)
|
|
os.chown(GROUP_ROOT, 0, 0)
|
|
run_command(["setfacl", "-b", GROUP_ROOT], check=False)
|
|
os.chmod(GROUP_ROOT, 0o555)
|
|
|
|
|
|
def with_lock() -> bool:
|
|
os.makedirs(os.path.dirname(LOCK_PATH), exist_ok=True)
|
|
lock_file = open(LOCK_PATH, "w", encoding="utf-8")
|
|
try:
|
|
fcntl.flock(lock_file, fcntl.LOCK_EX | fcntl.LOCK_NB)
|
|
except BlockingIOError:
|
|
log("Another reconciliation instance is running; skipping this cycle")
|
|
lock_file.close()
|
|
return False
|
|
|
|
try:
|
|
ensure_required_env()
|
|
os.makedirs(GROUP_ROOT, exist_ok=True)
|
|
os.makedirs(GROUP_ARCHIVE_ROOT, exist_ok=True)
|
|
|
|
conn = open_db()
|
|
try:
|
|
groups = fetch_fileshare_groups()
|
|
log(f"Discovered {len(groups)} data folder group(s) from AD")
|
|
reconcile_db(conn, groups)
|
|
sync_dynamic_directory_permissions(conn, groups)
|
|
finally:
|
|
conn.close()
|
|
|
|
sync_fslogix_directory()
|
|
sync_private_directories()
|
|
reload_samba()
|
|
log("Reconciliation completed")
|
|
return True
|
|
finally:
|
|
lock_file.close()
|
|
|
|
|
|
def main() -> int:
|
|
try:
|
|
ok = with_lock()
|
|
return 0 if ok else 0
|
|
except Exception as exc: # pylint: disable=broad-except
|
|
log(f"ERROR: {exc}")
|
|
return 1
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|