Re: SambaEdu3

Mon post va etre un peu long...

La procédure est en trois parties. Un partage sous Samba ayant le nom de gpo. Un script .bat a executer une fois sur les postes clients. Un script perl sur le serveur samba qui génère a chaud les stratégie de sécurité.

Je ne sais pas pourquoi on ne peux pas faire la même chose en ne changeant que des clefs de registre ou des fichiers. Manifestement, il n'est possible de faire certaines actions qu'avec l'outil secedit. Il est clair que ce fichier de configuration n'est pas des plus clair au premier abord. Il suffit de faire quelques essais et d'améliorer petit à petit les choses. Je suis pas sur que la configuration ci-dessous soit optimale. Elle marche sous 2000 et XP cependant.

J'ai modifié les noms des machines... et j'ai supprimé des pans de mon script car celui-ci me permet aussi d'installer des logiciels sans intervention humaine. Je n'ai pas essaye de l'executer mais il ne doit pas y avoir trop d'erreur de syntaxe.

Attention, il faut faire attention à ne pas modifier après coup les premières lignes du fichier gpo.bat crée par le script perl car sur le poste client, ce fichier est mis à jour à chaud !

Peut être devrait je mettre ça sur une page web plus propre ?

Le partage sous samba

[gpo]
comment = Strategies de groupe
available = yes
path = /var/samba/gpo/
root preexec = /etc/samba/script/createGPO --win_user=%U --win_group=%G --ip=%I --os_type=%a --win_host=%m --share=/var/samba/gpo
writable = no
browseable = no
valid users = computeradmin
invalid users = root


Le script .bat a executer sur chaque client pour lui installer les GPO journalieres

mkdir %windir%\security\gpo
net use T: \\CONTROLLER\gpo 31aJHHUIHBuijkh768798jkhjk52d0 /user:computeradmin
COPY /Y /A T:\%computername%.reg %windir%\security\gpo\gpo.reg
COPY /Y /A T:\%computername%.inf %windir%\security\gpo\gpo.inf
COPY /Y /A T:\%computername%.bat %windir%\security\gpo\gpo.bat
net use T: /delete /yes
at 1 /delete /yes
at 12:00 /every:L,Ma,Me,J,V %windir%\security\gpo\gpo.bat


Le script createGPO en perl

GetOptions(\%option,
'help',
'man',
'verbose',
'user=s',
'group=s',
'host=s',
'win_user=s',
'win_group=s',
'win_host=s',
'ip=s',
'os_type=s',
'share=s',
'etc=s',
) or pod2usage(-verbose => 1, -message => "0ドル: Bad arguments given.\n");

pod2usage(-verbose => 1) if $option{help};
pod2usage(-verbose => 2) if $option{man};
pod2usage(-verbose => 1, -message => "0ドル: Too many commands given.\n") if (@ARGV > 1);

my $User = lc($option{user} || $option{win_user});
my $Group = lc($option{group} || $option{win_group});
my $Host = lc($option{host} || $option{win_host});
my $Ip = $option{ip};
my $OsType = $option{os_type} || 'WinNT';
$OsType = 'WinNT' if ($OsType eq 'Win2K');
my $PathShare = $option{share} || '/var/samba/gpo';


my $computer = uc $Host;
my $wingpo = '%WINDIR%\security\gpo';

my @gecos = getpwnam "$computer\$";
my $cgroup = getgrgid $gecos[3]; # computer group

my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);


open BAT, ">$PathShare/$computer.bat";
print BAT "\r\n";
print BAT ":: Mise a l'heure\r\n";
print BAT "NET TIME /SETSNTP:ntp.mydomain.org\r\n";
print BAT "\r\n";
print BAT ":: Preparation\r\n";
print BAT "MKDIR $wingpo\r\n";
print BAT "NET USE T: /DELETE /YES\r\n";
print BAT "\r\n";
print BAT ":: Mise a jour des fichiers\r\n";
print BAT "NET USE T: \\\\CONTROLLER\\gpo 31aJHHUIHBuijkh768798jkhjk52d0 /USER:MYDOMAIN\\computeradmin\r\n";
print BAT "IF EXIST T:\\\%computername\%.bat COPY /A /Y T:\\\%computername\%.bat $wingpo\\gpo.bat\r\n";
print BAT "IF EXIST T:\\\%computername\%.inf COPY /A /Y T:\\\%computername\%.inf $wingpo\\gpo.inf\r\n";
print BAT "IF EXIST T:\\\%computername\%.reg COPY /A /Y T:\\\%computername\%.reg $wingpo\\gpo.reg\r\n";
print BAT "NET USE T: /DELETE /YES\r\n";
print BAT "\r\n";
print BAT ":: Configuration du poste\r\n";
print BAT "REGEDIT /S $wingpo\\gpo.reg\r\n";
print BAT "SECEDIT /CONFIGURE /DB $wingpo\\gpo.sdb /CFG $wingpo\\gpo.inf /VERBOSE /LOG $wingpo\\gpo.log\r\n";
print BAT "GOTO insVERSION\r\n";
print BAT "\r\n";
close BAT;

open REG, ">$PathShare/$computer.reg";
# Base de registre Windows 2000
print REG 'Windows Registry Editor Version 5.00'."\r\n";
print REG "\r\n";
# Suppression des profils locaux et page de garde
print REG '[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]'."\r\n";
print REG '"DeleteRoamingCache"=dword:00000001'."\r\n";
print REG "\"LogonPrompt\"=\"L'ordinateur sur lequel vous allez commencer une session appartient au laboratoire MYDOMAIN. Cet ordinateur ne doit servir qu'a des fins de recherche et l'usage du réseau est soumis a la charte RENATER\"\r\n";
print REG '"Welcome"="-- Laboratoire MYDOMAIN"'."\r\n";
print REG ''."\r\n";
print REG ''."\r\n";
print REG '[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]'."\r\n";
print REG '"WUServer"="http://virus.mydomain.org"'."\r\n";
print REG '"WUStatusServer"="http://virus.mydomain.org"'."\r\n";
print REG ''."\r\n";
print REG ''."\r\n";
print REG '[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]'."\r\n";
print REG '"NoAutoUpdate"=dword:00000000'."\r\n";
print REG '"AUOptions"=dword:00000004'."\r\n";
print REG '"ScheduledInstallDay"=dword:00000000'."\r\n";
print REG '"ScheduledInstallTime"=dword:00000005'."\r\n";
print REG '"UseWUServer"=dword:00000001'."\r\n";
print REG '"NoAutoRebootWithLoggedOnUsers"=dword:00000001'."\r\n";
print REG '"RescheduleWaitTime"=dword:0000000a'."\r\n";
print REG '"ScheduleInstallDay"=-'."\r\n";
print REG '"ScheduleInstallTime"=-'."\r\n";
print REG ''."\r\n";
close REG;

my $SERVICE = 4; # stop et de-active
$SERVICE = 2 if $cgroup =~ m/t\w+/; # en marche pour les ordinateurs des groupes commencant par t

open INF, ">$PathShare/$computer.inf";
print INF ''."\r\n";
print INF '[Version]'."\r\n";
print INF 'signature="$CHICAGO$"'."\r\n";
print INF 'Revision=1'."\r\n";
print INF '[System Access]'."\r\n";
print INF 'MinimumPasswordAge = 0'."\r\n";
print INF 'MaximumPasswordAge = 42'."\r\n";
print INF 'MinimumPasswordLength = 7'."\r\n";
print INF 'PasswordComplexity = 1'."\r\n";
print INF 'PasswordHistorySize = 0'."\r\n";
print INF 'LockoutBadCount = 5'."\r\n";
print INF 'ResetLockoutCount = 10'."\r\n";
print INF 'LockoutDuration = 10'."\r\n";
print INF 'RequireLogonToChangePassword = 0'."\r\n";

print INF 'NewAdministratorName = "unnomvraimenttordu"'."\r\n";
print INF 'NewGuestName = "cecomptenesertvraimentarien"'."\r\n";

print INF 'ClearTextPassword = 0'."\r\n";
print INF '[System Log]'."\r\n";
print INF 'MaximumLogSize = 512'."\r\n";
print INF 'AuditLogRetentionPeriod = 1'."\r\n";
print INF 'RetentionDays = 7'."\r\n";
print INF 'RestrictGuestAccess = 1'."\r\n";
print INF '[Security Log]'."\r\n";
print INF 'MaximumLogSize = 5120'."\r\n";
print INF 'AuditLogRetentionPeriod = 1'."\r\n";
print INF 'RetentionDays = 7'."\r\n";
print INF 'RestrictGuestAccess = 1'."\r\n";
print INF '[Application Log]'."\r\n";
print INF 'MaximumLogSize = 512'."\r\n";
print INF 'AuditLogRetentionPeriod = 1'."\r\n";
print INF 'RetentionDays = 7'."\r\n";
print INF 'RestrictGuestAccess = 1'."\r\n";
print INF '[Event Audit]'."\r\n";
print INF 'AuditSystemEvents = 0'."\r\n";
print INF 'AuditLogonEvents = 2'."\r\n";
print INF 'AuditObjectAccess = 0'."\r\n";
print INF 'AuditPrivilegeUse = 2'."\r\n";
print INF 'AuditPolicyChange = 3'."\r\n";
print INF 'AuditAccountManage = 2'."\r\n";
print INF 'AuditProcessTracking = 0'."\r\n";
print INF 'AuditAccountLogon = 2'."\r\n";
print INF 'CrashOnAuditFull = 0'."\r\n";
print INF '[Profile Description]'."\r\n";
print INF 'Description=Suppose que les fichiers et registres des ACL sont ceux de la première installation NTFS. Sécurise les zones restantes. Vide le groupe des utilisateurs avec pouvoir.'."\r\n";
print INF '[Registry Values]'."\r\n";
print INF 'machine\system\currentcontrolset\services\netlogon\parameters\signsecurechannel=4,1'."\r\n";
print INF 'machine\system\currentcontrolset\services\netlogon\parameters\sealsecurechannel=4,1'."\r\n";
print INF 'machine\system\currentcontrolset\services\netlogon\parameters\requirestrongkey=4,0'."\r\n";
print INF 'machine\system\currentcontrolset\services\netlogon\parameters\requiresignorseal=4,0'."\r\n";
print INF 'machine\system\currentcontrolset\services\netlogon\parameters\disablepasswordchange=4,0'."\r\n";
print INF 'machine\system\currentcontrolset\services\lanmanworkstation\parameters\requiresecuritysignature=4,0'."\r\n";
print INF 'machine\system\currentcontrolset\services\lanmanworkstation\parameters\enablesecuritysignature=4,1'."\r\n";
print INF 'machine\system\currentcontrolset\services\lanmanworkstation\parameters\enableplaintextpassword=4,0'."\r\n";
print INF 'machine\system\currentcontrolset\services\lanmanserver\parameters\requiresecuritysignature=4,0'."\r\n";
print INF 'machine\system\currentcontrolset\services\lanmanserver\parameters\enablesecuritysignature=4,0'."\r\n";
print INF 'machine\system\currentcontrolset\services\lanmanserver\parameters\enableforcedlogoff=4,1'."\r\n";
print INF 'machine\system\currentcontrolset\services\lanmanserver\parameters\autodisconnect=4,15'."\r\n";
print INF 'machine\system\currentcontrolset\control\session manager\protectionmode=4,1'."\r\n";
print INF 'machine\system\currentcontrolset\control\session manager\memory management\clearpagefileatshutdown=4,0'."\r\n";
print INF 'machine\system\currentcontrolset\control\print\providers\lanman print services\servers\addprinterdrivers=4,0'."\r\n";
print INF 'machine\system\currentcontrolset\control\lsa\restrictanonymous=4,1'."\r\n";
print INF 'machine\system\currentcontrolset\control\lsa\lmcompatibilitylevel=4,0'."\r\n";
print INF 'machine\system\currentcontrolset\control\lsa\fullprivilegeauditing=3,0'."\r\n";
print INF 'machine\system\currentcontrolset\control\lsa\crashonauditfail=4,0'."\r\n";
print INF 'machine\system\currentcontrolset\control\lsa\auditbaseobjects=4,0'."\r\n";
print INF 'machine\software\microsoft\windows\currentversion\policies\system\shutdownwithoutlogon=4,1'."\r\n";
print INF 'machine\software\microsoft\windows\currentversion\policies\system\legalnoticetext=1,'."\r\n";
print INF 'machine\software\microsoft\windows\currentversion\policies\system\legalnoticecaption=1,'."\r\n";
print INF 'machine\software\microsoft\windows\currentversion\policies\system\dontdisplaylastusername=4,1'."\r\n";
print INF 'machine\software\microsoft\windows nt\currentversion\winlogon\passwordexpirywarning=4,14'."\r\n";
print INF 'machine\software\microsoft\windows nt\currentversion\winlogon\cachedlogonscount=1,10'."\r\n";
print INF 'machine\software\microsoft\windows nt\currentversion\winlogon\allocatefloppies=1,0'."\r\n";
print INF 'machine\software\microsoft\windows nt\currentversion\winlogon\allocatedasd=1,0'."\r\n";
print INF 'machine\software\microsoft\windows nt\currentversion\winlogon\allocatecdroms=1,0'."\r\n";
print INF 'machine\software\microsoft\windows nt\currentversion\setup\recoveryconsole\setcommand=4,0'."\r\n";
print INF 'machine\software\microsoft\windows nt\currentversion\setup\recoveryconsole\securitylevel=4,0'."\r\n";
print INF '[Group Membership]'."\r\n";
print INF '*S-1-5-32-547__Memberof ='."\r\n";
print INF '*S-1-5-32-547__Members ='."\r\n" unless $Host eq 'cepcla';
print INF '*S-1-5-32-547__Members = machin'."\r\n" if $Host eq 'cepcla';
print INF '[Privilege Rights]'."\r\n";
print INF 'sesystemtimeprivilege = *S-1-5-32-544,*S-1-5-32-545,*S-1-5-32-547'."\r\n";
print INF '[Service General Setting]'."\r\n";
print INF "1=\"dhcp\", $SERVICE, \"D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPLOCRRC;;;PU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)\"\r\n";
print INF '2="messenger", 2, "D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPLOCRRC;;;PU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"'."\r\n";
print INF '3="remoteregistry", 4, "D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPLOCRRC;;;PU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"'."\r\n";
print INF '4="schedule", 2, "D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPLOCRRC;;;PU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"'."\r\n";
print INF "\r\n";
close INF;