samba - Feb 2007 - Autogenerating of operatingSystem and operatingSystemVersion attributes in AD

When Samba joins to AD, net creates 'Computer' object in target AD. 
Object 'Computer' has attributes operatingSystem and
operatingSystemVersion,
which automatically setup in properly value, when native Windows join to AD. 
I offer a patch to utils/net_ads.c to do similar way - set up operatingSystem 
to "Samba" and operatingSystemVersion to Samba version, when Samba
joins AD

--- net_ads.c start here ---
--- /tmp/net_ads.c	Tue Nov 14 20:42:14 2006
+++ net_ads.c	Wed Jan  3 19:44:05 2007
@@ -997,7 +997,6 @@
 	
 	ads_mod_str(ctx, &mods, "dNSHostName", my_fqdn);
 	ads_mod_strlist(ctx, &mods, "servicePrincipalName",
servicePrincipalName);
-
 	status = ads_gen_mod(ads_s, new_dn, mods);
 
 done:
@@ -1065,6 +1064,62 @@
 }
 
 /*******************************************************************
+ Set a machines operatingSystem and operatingSystemVersion attributes
+ ********************************************************************/
+
+static ADS_STATUS net_set_machine_opsystem(TALLOC_CTX *ctx, ADS_STRUCT 
*ads_s )
+{
+	ADS_STATUS status = ADS_ERROR(LDAP_SERVER_DOWN);
+	char *new_dn;
+	ADS_MODLIST mods;
+	char *psp;
+	LDAPMessage *res = NULL;
+	char *dn_string = NULL;
+	const char *machine_name = global_myname();
+	int count;
+
+	if ( !machine_name ) {
+		return ADS_ERROR(LDAP_NO_MEMORY);
+	}
+
+	/* Find our DN */
+
+	status = ads_find_machine_acct(ads_s, (void **)(void *)&res,
machine_name);
+	if (!ADS_ERR_OK(status))
+		return status;
+
+	if ( (count = ads_count_replies(ads_s, res)) != 1 ) {
+		DEBUG(1,("net_set_machine_opsystem: %d entries returned!\n",
count));
+		return ADS_ERROR(LDAP_NO_MEMORY);
+	}
+
+	if ( (dn_string = ads_get_dn(ads_s, res)) == NULL ) {
+		DEBUG(1, ("net_set_machine_opsystem: ads_get_dn returned NULL (malloc 
failure?)\n"));
+		goto done;
+	}
+
+	new_dn = talloc_strdup(ctx, dn_string);
+	ads_memfree(ads_s, dn_string);
+
+	if (!new_dn) {
+		return ADS_ERROR(LDAP_NO_MEMORY);
+	}
+
+	if (!(mods = ads_init_mods(ctx)))
+		goto done;
+
+	ads_mod_str(ctx, &mods, "operatingSystem", "Samba");
+	ads_mod_str(ctx, &mods, "operatingSystemVersion", 
SAMBA_VERSION_OFFICIAL_STRING);
+
+	status = ads_gen_mod(ads_s, new_dn, mods);
+
+done:
+	ads_msgfree(ads_s, res);
+
+	return status;
+}
+
+/*******************************************************************
   join a domain using ADS (LDAP mods)
  ********************************************************************/
 
@@ -1352,6 +1407,14 @@
 		DEBUG(1,("Error creating host keytab!\n"));
 	}
 
+	/* create the operatingSystem and operatingSystemVersion values */
+
+	status = net_set_machine_opsystem( ctx, ads );
+	if ( !ADS_ERR_OK(status) )  {
+        	d_fprintf(stderr,"Cannot set operatingSystem or 
operatingSystemVersion\n");
+                d_fprintf(stderr,"values, but you cat set it
manually\n");
+        }
+
 	d_printf("Joined '%s' to realm '%s'\n",
global_myname(), ads->config.realm);
 
 	SAFE_FREE(machine_account);
--- net_ads.c ends here ---
-- 
   With Best Regards.
   Rashid N. Achilov (RNA1-RIPE), Web: http://www.askd.ru/~shelton
   OOO "ACK" telecommunications administrator, e-mail: achilov-rn [at]
askd.ru
   PGP: 83 CD E2 A7 37 4A D5 81 D6 D6 52 BF C9 2F 85 AF 97 BE CB 0A

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Rashid,
> When Samba joins to AD, net creates 'Computer' object in 
> target AD.  Object 'Computer' has attributes operatingSystem
> and operatingSystemVersion,  which automatically setup
> in properly value, when native Windows join to AD.
> I offer a patch to utils/net_ads.c to do similar way - 
> set up operatingSystem to "Samba" and operatingSystemVersion
> to Samba version, when Samba joins AD
The problem with this patch and the reason we don't set
these attributes any more is that you cannot be guaranteed
to have permission unless you are a domain admin.
If you can find a way to do this via RPC, that would
probably be a better solution.




cheers,jerry
====================================================================Samba       
------- http://www.samba.org
Centeris                         -----------  http://www.centeris.com
"What man is a man who does not make the world better?"      --Balian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFF0GcCIR7qMdg1EfYRAhWPAJ9Xpv+dLSlbO+0fpVDzE0DvYBhQlACfagxF
SqDxyM00unpNDu5nWZECf1I=n3Fg
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Jim McDonough wrote:
> At some point in the past (probably 3 years now) I 
> found that even when we set these attributes, at some
> point, AD would decide to overwrite them.  I never got
> down to the root cause of the behavior, but it seemed
> at the time like anything it didnt' recognize would 
> eventually be reset.
Sounds plausible.  My tests show the DC filling them in on
behalf of Windows clients so there is something going on under
the covers.





cheers, jerry
====================================================================Samba       
------- http://www.samba.org
Centeris                         -----------  http://www.centeris.com
"What man is a man who does not make the world better?"      --Balian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFF0HVkIR7qMdg1EfYRApeEAKCZK6BDqXd4Dr2P7JF4DdYevFm0TACgrCo7
5muOjp/xBy7ZvhJvH63/7FE=NeQv
-----END PGP SIGNATURE-----

On Mon, 2007-02-12 at 09:03 -0500, Jim McDonough wrote:
> On 2/12/07, Gerald (Jerry) Carter <jerry@samba.org> wrote:
> I really have fought this type of behavior because it 
>         is inconsistent.  I'd rather find another way to set the
>         OS attributes.
> At some point in the past (probably 3 years now) I found that even
> when we set these attributes, at some point, AD would decide to
> overwrite them.  I never got down to the root cause of the behavior,
> but it seemed at the time like anything it didnt' recognize would
> eventually be reset. 
I am sure this is not the case, I've seen *different* clients do that
and the arbitrary change sticks.
I guess you have to do these mods after the account is settled down,
maybe you can even try to update these fields using the machine account
password? Never checked the permission on those attributes, but it might
be interesting.

Simo.

-- 
Simo Sorce
Samba Team GPL Compliance Officer
email: idra@samba.org
http://samba.org