samba-check-db-repl.sh

#!/bin/bash
##
## Version      : 1.0.5
## release d.d. : 24-03-2015
## Author       : L. van Belle
## E-mail       : louis@van-belle.nl
## Copyright    : Free as free can be, copy it, change it if needed.
## Sidenote     : if you change things, please inform me
## ChangeLog    : first release d.d. 23-03-2015
## 24-03-2015   : 1.0.2 few small changes, thanks Rowland for the suggestions.
## 22-04-2015   : 1.0.3 moved mailx part within check if an e-mail adres is used.
## 24-04-2015   : 1.0.4 added extra check, so if no is if found, you get an error message and not a python error.
## 21-11-2016   : 1.0.5 extra filter options. ( samba 4.5.x needs adjusting )
# ( removed the . in the hostname resolving for the DCS, this was no error, but its more clear what people want to see )

## Samba database checker. ( ! TESTED ON DEBIAN JESSIE samba 4.1.x-4.5.x )
## This script wil check for error in the samba databases with samba-tool
## If needed adjust it to your os needs.

## !! Warning, samba 4.5.0 - 4.5.1 errors about cn CN ou OU differences.
## This is a samba bug : https://bugzilla.samba.org/show_bug.cgi?id=12399
# you may need to adjust the filter options below. (SAMBA_LDAPCMD_FILTER)

## NOTICE !! This script does only work with samba DC's
## A samba DC + Windows DC wont work and is not tested, if you get that to work,
## please share the code ;-)

## Howto use it:
## Put it on any samba4 DC and run it.
## if you put it in a cron job,
## set the mail report adres and put in the password for Administrator
## and set the relayhost.
## Test it, by remove-ing the email adres at EMAIL_REPORT_ADRES
## and you get a console output of the checks.
## Thats it, enjoy..
## All other settings are optional..

## Only tested with user "Administrator".. best is not to change this.
SAMBA_NT_ADMIN_USER="Administrator"
## if empty the script wil ask for the pass..
## for running this with cron this is a must !
SAMBA_NT_ADMIN_PASS=""

## perform 2 checkes by default for the database replication
## keep both set to yes, thats the best.
SAMBA_CHECKDB_WITH_DRS="yes"
SAMBA_CHECKDB_WITH_LDAPCMD="yes"
## Change the filter to avoid mismatching, some items can be ignored.
## Some examples. : whenChanged,usnChanged,usnCreated,msDS-NcType,serverState
## add them with "," seperated.
SAMBA_LDAPCMD_FILTER="whenChanged"

## The email adress to report to.
## If you put an e-mail adres here the script wil also check for mail tools.. etc
## Email are only send when errors are found and no console output !
## if you want console put, dont put any email address here..
EMAIL_REPORT_ADDRESS=""

## Normaly only e-mail are send when errors are found, or set yes for always email
EMAIL_REPORT_ALWAYS="no"

## I use postfix as relay host. ( set to run on localhost only)
## Put here your mail relay host
## hostname or hostname-fqdn or ip or ip:port are ok.
## This is only used when NO sendmail program if found.
POSTFIX_RELAY_HOST=""

## postfix wil be automatily setup for your.
## If you did already setup any mail server on the server or you are able to mail
## from this server with "mail" command, then this script does not install postfix.

## cleanup the log in /tmp
## can be handy if you want to review manualy.
SETREMOVELOG="yes"

## So you reached the end for the configure..
## Set this one to yes.. and your good to go.
CONFIGURED="no"


#######################################################################
## DONT CHANGE BELOW Please, if you make changes, please share them.  #
#######################################################################

## hostname in single word, but you dont need to change this
SETHOSTNAME=`hostname -s`
## domainname.tld, but if you installed correct, you dont need to change this
SETDNSDOMAIN=`hostname -d`
## hostname.domainname.tld, but if you installed correct, you dont need to change this
SETFQDN=`hostname -f`


SETTPUT=`which tput`
if [ -z ${SETTPUT} ]; then
    echo "program tput not found, installing it now.. please wait"
    apt-get update > /dev/null
    apt-get install -y --no-install-recommends ncurses-bin > /dev/null
fi

RED=$(${SETTPUT} setaf 1)
NORMAL=$(${SETTPUT} sgr0)
GREEN=$(${SETTPUT} setaf 2)
YELLOW=$(${SETTPUT} setaf 3)
UNDERLINE=$(${SETTPUT} smul)
WHITE=$(${SETTPUT} setaf 7)
BOLD=$(${SETTPUT} bold)

message() {
  printf "%40s\n" "${WHITE}${BOLD}$@${NORMAL}"
}
good() {
  printf "%40s\n" "${GREEN}$@${NORMAL}"
}
error() {
  printf "%40s\n" "${RED}$@${NORMAL}"
}
warning() {
  printf "%40s\n" "${YELLOW}$@${NORMAL}"
}
warning_underline() {
  printf "%40s\n" "${YELLOW}${UNDERLINE}$@${NORMAL}"
}

check_run_as_sudo_root() {
  if ! [[ $EUID -eq 0 ]]; then
    error "This script should be run using sudo or by root."
    exit 1
  fi
}
configured_script() {
    if [ "${CONFIGURED}" = "no" ]; then
        error "####################################################"
        error "You need to configure this script first to run it. "
        echo " "
        error "exiting script now... "
        exit 0
    fi
}

configured_script
check_run_as_sudo_root

if [ $SAMBA_CHECKDB_WITH_DRS = "no" ] && [ ${SAMBA_CHECKDB_WITH_LDAPCMD} = "no" ] ; then
    error "When you set both SAMBA_CHECKBD... to NO.. then there is no point of running this script"
    error "Please set at least 1 of these checks to yes"
    error "exiting script now... "
    exit 0
fi

SET_SAMBATOOL=`which samba-tool`
if [ -z $SET_SAMBATOOL ]; then
    error "No samba-tool tool found, this script wil exit now.. this.. I cant fix."
    exit 0
fi

SET_TR=`which tr`
if [ -z $SET_TR ]; then
    warning "No tr tool found, running apt-get update and install coreutils, please wait.."
    apt-get update > /dev/null
    apt-get install -y --no-install-recommends coreutils > /dev/null
    sleep 0.5
    SET_TR=`which tr`
fi

## get DC info
DCS=$(host -t SRV _kerberos._udp.${SETDNSDOMAIN} | awk '{print $NF}'| sed 's/.$//')
if [ -z "${DCS}" ]; then
    error "No Samba DCS found, host -t SRV _kerberos.udp.${SETDNSDOMAIN} returned nothing"
    error "exitting now..."
    exit 0
fi

SAMBA_DC_FSMO=`echo $(${SET_SAMBATOOL} fsmo show | cut -d"," -f2 | head -n1 | cut -c4-100) | ${SET_TR} '[:upper:]' '[:lower:]'`
SAMBA_DC1=${SAMBA_DC_FSMO}.${SETDNSDOMAIN}
if [ -z "${SAMBA_DC1}" ]; then
    error "No Samba DC Found with FSMO Roles, you might have dns problems"
    error "exitting now..."
    exit 0
fi

SAMBA_DCS=$(echo "$DCS" | grep -v ${SAMBA_DC_FSMO})
if [ -z "${SAMBA_DCS}" ]; then
    error "No Samba DC's Found with, you might have dns problems"
    error "exitting now..."
    exit 0
fi

SAMBA_NT_DOMAINNAME=$($SET_SAMBATOOL domain info ${SAMBA_DC1} | grep Netbios | cut -d":" -f2 | cut -c2-100)
if [ -z "${SAMBA_NT_DOMAINNAME}" ]; then
    error "No Samba NT DOMAIN Name found"
    error "exitting now..."
    exit 0
fi

if [ -z "${SAMBA_NT_ADMIN_PASS}" ]; then
    while [ "${SAMBA_NT_ADMIN_PASS}" = "" ]; do
        message "No password for user ${SAMBA_NT_DOMAINNAME}\\${SAMBA_NT_ADMIN_USER} was set in this script!"
        warning_underline "Please enter the password for ${SAMBA_NT_DOMAINNAME}\\${SAMBA_NT_ADMIN_USER} : "
        read -s -e SAMBA_NT_ADMIN_PASS
    done
fi

echo ${SAMBA_NT_ADMIN_PASS} | kinit ${SAMBA_NT_ADMIN_USER} 2&> /dev/null


SET_DEBCONF_SETSELECT=`which debconf-set-selections`
if [ -z ${SET_DEBCONF_SETSELECT} ]; then
    warning "No debconf-set-selections tool found, running apt-get update and install debconf , please wait.."
    apt-get update > /dev/null
    apt-get install -y --no-install-recommends debconf  > /dev/null
    sleep 0.5
    SET_DEBCONF_SETSELECT=`which debconf-set-selections`
fi

if [ ! -z ${EMAIL_REPORT_ADDRESS} ]; then
    SET_SENDMAIL=`which sendmail`
    if [ -z ${SET_SENDMAIL} ]; then
        warning "No mailserver found, running apt-get update and installing postfix as smarthost, please wait.."
        ## these are the debian defaults for a "smarthost setup"
        echo "postfix postfix/main_mailer_type        select  Satellite system" | ${SET_DEBCONF_SETSELECT}
        echo "postfix postfix/mailname        string ${SETFQDN}" | ${SET_DEBCONF_SETSELECT}
        echo "postfix postfix/relayhost       string  ${POSTFIX_RELAY_HOST}" | ${SET_DEBCONF_SETSELECT}
        apt-get update > /dev/null
        apt-get install -y --no-install-recommends postfix  > /dev/null
        sleep 0.5
        SET_SENDMAIL=`which sendmail`
        postconf -e "mydestination = ${SETFQDN}, localhost, localhost.localdomain"
        postconf -e "inet_interfaces = 127.0.0.1"
        postconf -e "inet_protocols = ipv4"
        sleep 0.2
        service postfix restart
    fi
    SET_MAILTOOL=`which mail`
    if [ -z $SET_MAILTOOL ]; then
        warning "No mail tool found, running apt-get update and install heirloom-mailx, please wait.."
        apt-get update > /dev/null
        apt-get install -y --no-install-recommends heirloom-mailx > /dev/null
        sleep 0.5
        SET_MAILTOOL=`which mail`
        cat /etc/hosts | ${SET_MAILTOOL} -s "Test mail from script : check db"  $EMAIL_REPORT_ADDRESS
    fi
fi


## always remove the log before running the script again.
if [ "${SETREMOVELOG}" = "yes" ] || [ "${SETREMOVELOG}" = "no" ] ; then
    if [ -f /tmp/samba_ldapcmp_checkdb ]; then
        rm /tmp/samba_ldapcmp_checkdb
    fi
    if [ -f /tmp/samba_drs_showrepl ]; then
        rm /tmp/samba_drs_showrepl
    fi
fi

## used for samba-tool drs showrepl
## expected success is depending on total of DC's.
expected_success=0
## expected failure is always 0
expected_failure=0
for x in ${SAMBA_DCS}; do
    expected_success=$((expected_success +=10 ))
done

if [ ! -z ${EMAIL_REPORT_ADDRESS} ]; then
    if [ "${SAMBA_CHECKDB_WITH_LDAPCMD}" = "yes" ]; then
        for x in ${SAMBA_DCS}; do
            $SET_SAMBATOOL ldapcmp --filter="$(LDAPCMD_FILTER)" ldap://$SAMBA_DC1 ldap://$x  -d0 2>&1 >> /tmp/samba_ldapcmp_checkdb
            if grep -q FAILURE /tmp/samba_ldapcmp_checkdb; then
                cat /tmp/samba_ldapcmp_checkdb | ${SET_MAILTOOL} -s "FAILURE ldapcmp between $SETDCFSMO and $x" $EMAIL_REPORT_ADDRESS
            fi
        done
    fi
    if [ "${SAMBA_CHECKDB_WITH_DRS}" = "yes" ]; then
        ${SET_SAMBATOOL} drs showrepl -d0 2>&1 > /tmp/samba_drs_showrepl
        failure=$(grep -c "failed" /tmp/samba_drs_showrepl)
        success=$(grep -c "successful" /tmp/samba_drs_showrepl)
        for x in ${SAMBA_DCS} ; do
            if [ $failure -ne $expected_failure ]; then
                cat /tmp/samba_drs_showrepl | ${SET_MAILTOOL} -s "FAILURE: unexpected showrepl result between $SETDCFSMO and $x" $EMAIL_REPORT_ADDRESS
            fi
            if [ $success -ne $expected_success ]; then
                cat /tmp/samba_drs_showrepl | ${SET_MAILTOOL} -s "FAILURE: unexpected showrepl result between $SETDCFSMO and $x" $EMAIL_REPORT_ADDRESS
            fi
        done
    fi
else
    message "Running with with console output"
    if [ "${SAMBA_CHECKDB_WITH_LDAPCMD}" = "yes" ]; then
        echo "Checking the DC_With_FSMO (${SAMBA_DC_FSMO}) with SAMBA DC: ${SAMBA_DCS}"
        for x in ${SAMBA_DCS}; do
            message "Running : ${SET_SAMBATOOL} ldapcmp --filter='whenChanged' ldap://$SAMBA_DC1 ldap://$x "
            message "Please wait.. this can take a while.."
            ${SET_SAMBATOOL} ldapcmp --filter="whenChanged" ldap://$SAMBA_DC1 ldap://$x  -d0 2>&1 >> /tmp/samba_ldapcmp_checkdb
            if grep -q FAILURE /tmp/samba_ldapcmp_checkdb; then
                warning "`cat /tmp/samba_ldapcmp_checkdb`"
            else
                good "`cat /tmp/samba_ldapcmp_checkdb`"
            fi
        done
    fi
    echo ".. Next check.. "
    if [ "${SAMBA_CHECKDB_WITH_DRS}" = "yes" ]; then
        message "Running : samba-tool drs showrepl"
        ${SET_SAMBATOOL} drs showrepl -d0 2>&1 > /tmp/samba_drs_showrepl
        failure=$(grep -c "failed" /tmp/samba_drs_showrepl)
        success=$(grep -c "successful" /tmp/samba_drs_showrepl)
        for x in ${SAMBA_DCS} ; do
            if [ ${failure} -ne ${expected_failure} ]; then
                error "failures don't match"
            fi
            if [ ${success} -ne ${expected_success} ]; then
                error "successes don't match"
            fi
            if [ ${failure} -eq ${expected_failure} ] && [ ${success} -eq ${expected_success} ]; then
                good "No errors found"
            fi
        done
    fi
fi

if [ "${EMAIL_REPORT_ALWAYS}" = "yes" ] && [ -n "${EMAIL_REPORT_ADDRESS}" ]; then
    cat /tmp/samba_drs_showrepl | ${SET_MAILTOOL} -s "SAMBA CHECK DB : showrepl results" $EMAIL_REPORT_ADDRESS
    cat /tmp/samba_ldapcmp_checkdb | ${SET_MAILTOOL} -s "SAMBA CHECK DB : ldapcmp results" $EMAIL_REPORT_ADDRESS
fi

if [ "${SETREMOVELOG}" = "yes" ]; then
    if [ -f /tmp/samba_ldapcmp_checkdb ]; then
        rm /tmp/samba_ldapcmp_checkdb
    fi
    if [ -f /tmp/samba_drs_showrepl ]; then
        rm /tmp/samba_drs_showrepl
    fi
fi