Samba-tool-external

This wiki page documents the current externals of the samba-tool command in the first table below and proposed externals to the samba-tool command in the second table below. The purpose of the proposed changes is to make the samba-tool command more consistent and easier to use. Additionally, help for command completion will be provided in a more consistent manner, again for usability.

Current commands listed in __init__.py in samba 4 Version 4.0.0alpha15-GIT-a8a6433

samba-tool current commands

samba-tool current commands
Subcommand Description Parameters Command specific options Net command
acl get or set acls on a file nt get <file> --as-sddl
--xattr\-backend=native|tdb
--eadb-file=<file>
nt set <file> --quiet=
--xattr-backend=native|tdb
--eadb-file=<file>
ds set <file> --host=
--car=...
--action=allow|deny
--objectdn=
--trusteedn=
--sddl=
--eadb-file=<file>
domainlevel Raises domain and forest function level show -H
--quiet
--forest=2003|2008|2008_R2
--domain=2003|2008|2008_R2
raise
drs various directory replication services bind <dc>
kcc <dc>
replicate <dest_dc> <source_dc> <nc> --add-ref
--sync-force
showrepl <dc>
enableaccount enable a user <username> --filter=
export Dumps kerberos keys of the domain into a keytab keytab <keytab> net export keytab <keytab>
fsmo Makes the target DC transfer or seize fsmo role (server connection needed)
transfer: request the role from current owner
seize: take the role by force, current master is dead
show --url
--force
--role=rid|pdc|infrastructure|schema|naming|all
transfer --url
--force
--role=rid|pdc|infrastructure|schema|naming|all
seize --url
--force
--role=rid|pdc|infrastructure|schema|naming|all
group Add or delete groups or add members to or remove members from a group add <groupname> -H
--groupou=
--group-type=Security|Distribution
--description=
--mail-address=
--notest=
delete <groupname> -H
addmembers <groupname> <listofmembers> -H
removemembers <groupname> <listofmembers> -H
gpo2 List group policies list <username> -H
listall
join Join a domain as either a member or a backup domain controller
(server connection required)
<dnsdomain> DC --server=
--site=
<dnsdomain> RODC
<dnsdomain> MEMBER
ldapcmp compare two ldap databases <url1> <url2> <context1?> <context2?> <context3?> --two
--quiet
--verbose
--sd
--sort-aces
--view
--base
--base2
--scope
machinepw get machine PW out of SAM <accountname> net machinepw <accountname>
newuser Create a new user <username> <password?> -H
--must-change-at_next-login
--user-username-as-cn<br.--userou
--surname
--given-name
--initials
--profile-path
--script-path
--home-drive
--home-directory
--job-title
--department
--company
--description
--mail-address
--internet-address
--telephone-number
--physical-delivery-office
pwsettings Sets password settings set -H
--quiet
--complexity=on|off|default
--store-plaintext=on|off|default
--history-length=
--min-pwd-length=
--min-pwd-age=
--max-pwd-age=
show
password set or change password, set <username> <password>
change
setexpiry Sets the expiration of a user account <username> -H
--filter
--days=
--noexpiry
setpassword set user password locally, need write access to ldb files <username?> -H
--filter
--newpassword
--must-change-at-next-login
time Retrieve the time on a remote server (server connection needed) <servername?> net time <servername>
user create or delete a user add <username> <password?>
delete <username>
vampire Join and synchronise a remote AD domain to the local server
(server connection needed)
domain

General options are options that can be used on all commands and are as follows:

  • Samba Options
    • list samba options here***
  • Version Options
    • -V
    • --version
  • Credential Options
    • list cred options***

Also possibly open for discussion is the formats of some of the global options. Improvements for improved usability should be considered.


samba-tool proposal for command syntax changes

The proposed format for all new / existing functions on the samba-tool command are as follows: Where is makes sense and is possible, the command syntax will follow the format: samba-tool <object> <action> <parameter(s)> <command specific options> <global options>

Also, help will be improved and made consistent.

  • When the samba-tool command is issued without a subcommand, it will return a list of valid subcommands (it does this today)
  • After each subcommand is entered, if more parameters are required a list of what comes next will be shown (sometimes does this today)
  • If the command syntax is completely incorrect, will give the format of the subcommand (sometimes does this today)
  • For each subcommand, help will be provided
  • Error handling will be improved, more errors will be caught with useable messages being issued where applicable
  • Would a --verbose option make sense on all the commands? consider when implementing (some commands have it today)
samba-tool command proposed syntax changes
Object Action Parameters Specific Options Global Options Comments and Equivalent net command (samba 3)
acl get nt <file> --as-sddl
--xattr-backend=native|tdb
--eadb-file=file
global options Could combine get and nt into one action getnt
Of leave as get <space> nt for historical purposes
set nt <file> --xattr-backend=native|tdb
--eadb-file=file
global options Could combine set and nt into one action setnt
set ds <file> --objectdn=objectdn
--car=control right
--action=deny|allow
--trusteedn=trustee-dn
global options Could combine set and ds into one action setds
domainlevel show global options
raise -H
--quiet
--forest
--domain
global options
drs bind <dc> global options
kcc <dc> global options
replicate <dest_dc> <source_dc> <nc> --add-ref
--sync-force
global options
showrepl <dc> global options
options <dc> --dsa-option=+|-IS_GC |
--dsa-option=+|-DISABLE_INBOUND_REPL
--dsa-option=+|-DISABLE_OUTBOUND_REPL
--dsa-option=+|-DISABLE_NTDSCONN_XLATE
global options
group add <groupname> -H
--groupou=
--group-type=Security|Distribution
--description=
--mail-address=
--notest=
global options
delete <groupname> -H global options
addmembers <groupname> <listofmembers> -H global options
removemembers <groupname> <listofmembers> -H global options
gpo list -H global options
listall -H global options
DC join <dnsdomain> --server=
--site=
--mode=R0|<none,default>
global options An alternative is to keep join <dnsdomain> DC|RODC|MEMBER
MEMBER --server=
--site=
fsmo show --url=
--force
--role=rid|pdc|infrastructure|schema|naming|all
global options
transfer
seize
keytab export <keytab> add options global options What is the object?
ldap compare <url1> <url2>
<context1?>
<context2?>
context3?>
--two
--quiet
--verbose
--sd
--sort-aces
--view
--base
--base2
--scope
global options Change to split into ldap compare.
pwsettings show global options
set -H
--quiet
--complexity=on|off|default
--store-plaintext=on|off|default
--history-length=
--min-pwd-length=
--min-pwd-age=
--max-pwd-age=
password set user
change user
time server-name Change format? add an optional action: show ?
user create username global options Changing add to create, can / should make an alias?
The help on this command already says add - create a new user
create makes more sense, add sounds like it already exists and adding it to a group, for instance
opposite of removemembers is addmembers
delete username global options
setexpiry username -H help global options this used to be setexpiry username command
--days=int
--filter=str
--noexpiry
enableaccount username -H help global options this used to be enableaccount username command
--filter=str
vampire domain global options Keep as vampire command for usability / historical purposes
Do not change to object action format