What should we do with our user What should we do with our user - - PowerPoint PPT Presentation

▶
what should we do with our user what should we do with
SMART_READER_LITE
LIVE PREVIEW

What should we do with our user What should we do with our user - - PowerPoint PPT Presentation

Apr 21, 2023 16 likes •700 views

6/6/2019 What should we do with our UI? What should we do with our user What should we do with our user interface? interface? Douglas Bagnall <douglas.bagnall@catalyst.net.nz> 127.0.0.1:8000/?print-pdf#/ 1/68 6/6/2019 What should we

slide-1
SLIDE 1

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 1/68

What should we do with our user What should we do with our user interface? interface?

Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

slide-2
SLIDE 2

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 2/68

Samba’s command line UI Samba’s command line UI

kind of haphazard patchy abstractions untested as a user interface

slide-3
SLIDE 3

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 3/68

Nobody can fix it Nobody can fix it

experts are locked-in newbies are baffled

  • ld options can’t be

dropped

slide-4
SLIDE 4

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 4/68

“nerdview” — Geoff Pullum “nerdview” — Geoff Pullum

insiders’ wordview prevents communication leaks detail you don’t need to know in language you don’t need to know

slide-5
SLIDE 5

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 5/68

nerdview nerdview

slide-6
SLIDE 6

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 6/68

nerdview nerdview

slide-7
SLIDE 7

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 7/68

nerdview nerdview

slide-8
SLIDE 8

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 8/68

nerdview nerdview

slide-9
SLIDE 9

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 9/68

nerdview nerdview

slide-10
SLIDE 10

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 10/68

nerdview nerdview

slide-11
SLIDE 11

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 11/68

nerdview nerdview

slide-12
SLIDE 12

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 12/68

nerdview nerdview

slide-13
SLIDE 13

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 13/68

nerdview nerdview

$ ./bin/samba-tool drs kcc Could not find machine account in secrets database: Failed to fetch machine acc ERROR(): DRS connection to client.addom.samba.example.com failed - drsException File "bin/python/samba/netcmd/drs.py", line 54, in drsuapi_connect (ctx.drsuapi, ctx.drsuapi_handle, ctx.bind_supported_extensions) = drs_util File "bin/python/samba/drs_utils.py", line 63, in drsuapi_connect raise drsException("DRS connection to %s failed: %s" % (server, e))

slide-14
SLIDE 14

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 14/68

Samba nerdview Samba nerdview

hard to spot admin users are themselves specialists small intersection between users and developers

  • verlap in users’ and developers’ jargon
slide-15
SLIDE 15

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 15/68

Samba nerdview Samba nerdview

We need bug reports but Bugzilla presents deep nerdview

slide-16
SLIDE 16

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 16/68

Prior art in the field of command Prior art in the field of command line option rants line option rants

A very short literature review

slide-17
SLIDE 17

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 17/68

Steve French, two weeks ago: Steve French, two weeks ago:

... goes on to enumerate inconsistencies the username and/or password seems to be ignored in different (and possibly confusing to users) ways on various client tools (smbcacls and smbclient for example) when you specify -k (for Kerberos authentication)

slide-18
SLIDE 18

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 18/68

Rowland: Rowland:

You forgot 'samba-tool' and the ldb tools (ldbsearch etc) where it is '-k yes'

slide-19
SLIDE 19

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 19/68

Andreas: Andreas:

I will rewrite the code to offer a new

  • ption.
  • -use-kerberos=auto|yes|no

[...] -k will mostly be working as before to not break any scripts.

slide-20
SLIDE 20

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 20/68

Backwards compatibility Backwards compatibility dilemma dilemma

fixing consistency across tools worsens the complexity of each tool

slide-21
SLIDE 21

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 21/68

Alexander, last year Alexander, last year

... for the machines (he is right) Everything should have --json

slide-22
SLIDE 22

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 22/68

Testing the command line Testing the command line

Easy to test for friendly default output self-documentation (-- help)

slide-23
SLIDE 23

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 23/68

Testing the command line Testing the command line

Hard to test for nerdview inconsistencies between tools unknowable functionality

slide-24
SLIDE 24

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 24/68

Testing the command line Testing the command line

run every script without arguments and see what happens expecting something like

Usage: smbwhatever [options]

slide-25
SLIDE 25

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 25/68

Testing the command line Testing the command line

run every script end-user tool and see what happens

$ ./script/autobuild.py Traceback (most recent call last): *[...]* Exception: Unable to create /memdisk/douglas/b5766 : [Errno 13] Permission deni

slide-26
SLIDE 26

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 26/68

Testing the command line Testing the command line

run every end-user tool and some dev tools

$ $ ./selftest/filter-subunit 🕑 🕒 🕓 🕔 🕕 🕖 🕗 🕘 🕙 🕟 🕞 🕝 🕜 🕛 🕚 🕠 🕡 🕢 🕣 🕤 🕥 🕦 ⏰ ⏳ 🕨 🕧 ⏱ ⏲ ฀

slide-27
SLIDE 27

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 27/68

Example fix Example fix

  • -- a/source4/scripting/bin/samba_upgradeprovision

+++ b/source4/scripting/bin/samba_upgradeprovision @@ -1589,7 +1589,14 @@ if __name__ == '__main__': # This variable will hold the last provision USN once if it minUSN = 0 # 2)

  • ldbs = get_ldbs(paths, creds, session, lp)

+ try: + ldbs = get_ldbs(paths, creds, session, lp) + except ldb.LdbError as e: + if opts.debugall: + print(e) + parser.print_usage() + sys.exit(1) +

slide-28
SLIDE 28

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 28/68

testing --help testing --help

expecting something like and success as error code.

Usage: smbwhatever [options]

  • k, --kerberos use kerberos
  • v, --verbose print more
slide-29
SLIDE 29

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 29/68

testing --help testing --help

Not expecting: to create a file called ./-- help/etc/smb.conf. testenv access to /usr/local/samba/* a string containing “Traceback”

slide-30
SLIDE 30

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 30/68

Usage and --help tests Usage and --help tests

many tools already pass several easy fixes several knownfails a small blacklist

slide-31
SLIDE 31

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 31/68

  • -help consistency
  • -help consistency

ldb tools repeat options, only one works

ldbsearch --help | grep -we -s

  • s, --scope=SCOPE search scope
  • s, --configfile=CONFIGFILE Use alternative con
slide-32
SLIDE 32

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 32/68

  • -help consistency
  • -help consistency

ldbsearch --help | grep -e '-[siS],'

  • s, --scope=SCOPE search scope
  • i, --interactive input from stdin
  • S, --sorted sort attributes
  • s, --configfile=CONFIGFILE Use alternative configuration
  • S, --sign Sign connection to prevent
  • S, --signing=on|off|required Set the client signing state
  • i, --scope=SCOPE Use this Netbios scope
slide-33
SLIDE 33

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 33/68

  • -help consistency
  • -help consistency

ldbsearch --help | grep -e '-[siS],'

  • s, --scope=SCOPE search scope
  • i, --interactive input from stdin
  • S, --sorted sort attributes
  • s, --configfile=CONFIGFILE Use alternative configuration
  • S, --sign Sign connection to prevent
  • S, --signing=on|off|required Set the client signing state
  • i, --scope=SCOPE Use this Netbios scope
slide-34
SLIDE 34

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 34/68

  • -help consistency
  • -help consistency

ldbsearch --help | grep -e '-[siS],'

  • s, --scope=SCOPE search scope
  • i, --interactive input from stdin
  • S, --sorted sort attributes
  • s, --configfile=CONFIGFILE Use alternative configuration
  • S, --sign Sign connection to prevent
  • S, --signing=on|off|required Set the client signing state
  • i, --scope=SCOPE Use this Netbios scope
slide-35
SLIDE 35

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 35/68

  • -help consistency
  • -help consistency

ldbsearch --help | grep -e '-[siS],'

  • s, --scope=SCOPE search scope
  • i, --interactive input from stdin
  • S, --sorted sort attributes
  • s, --configfile=CONFIGFILE Use alternative configuration
  • S, --sign Sign connection to prevent
  • S, --signing=on|off|required Set the client signing state
  • i, --scope=SCOPE Use this Netbios scope
slide-36
SLIDE 36

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 36/68

  • -help consistency
  • -help consistency

No automated test now it is only ldb tools and is almost impossible to fix

slide-37
SLIDE 37

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 37/68

Cross-script consistency Cross-script consistency

the -k problem no automated test most options probably agree

slide-38
SLIDE 38

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 38/68

Cross-script --help consistency Cross-script --help consistency

Many probably agree

  • -update-list

3 × --update-list 3 × --update-list=UPDATE_LIST

  • U

63 × -U USERNAME, --username=USERNAME 6 × -U, --user=[DOMAIN/]USERNAME[%PASSWORD] Set the network username

slide-39
SLIDE 39

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 39/68

Cross-script --help consistency Cross-script --help consistency

  • v

6 × -v, --verbose increase verbosity 6 × -v, --verbose Verbose output 4 × -v, --verbose Verbose output 1 × -v, --verbose

  • -host

2 × --host=HOST target host name or IP address 2 × --host=HOST Ip of the remote host used for comparison 2 × --host=HOST Ip of the host

slide-40
SLIDE 40

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 40/68

Cross-script --help consistency Cross-script --help consistency

  • t

2 × -t directory Top level directory of project (default to 1 × -t TOP, --top=TOP 1 × -t TIMING_DATA, --timing-data=TIMING_DATA

  • r

6 × -r, --recursive recursive delete 2 × -r, --render Render templates (default: False) 1 × -r REPLAY_RATE, --replay-rate=REPLAY_RATE

slide-41
SLIDE 41

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 41/68

Cross-script --help consistency Cross-script --help consistency

  • e

6 × -e, --editor=PROGRAM external editor 6 × -e, --encrypt Encrypt connection for privacy 2 × -e emergency dump, for corrupt databases

  • 6 × -o=OPTION ldb_connect option

2 × -o OUT, --out OUT write model here 1 × -o OUT, --out=OUT

slide-42
SLIDE 42

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 42/68

Cross-script --help consistency Cross-script --help consistency

  • c

6 × -c, --catch Catch Ctrl-C and display results so far 2 × -c, --catch Catch control-C and display results 2 × -c validate contents of the records 1 × -c, --clean-up Clean up the generated groups and user accounts 1 × -c COLORS, --color=COLORS

slide-43
SLIDE 43

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 43/68

Cross-script --help consistency Cross-script --help consistency

  • C

6 × -c, --catch Catch Ctrl-C and display results so far 2 × -c, --catch Catch control-C and display results 1 × -C enable configure cacheing

slide-44
SLIDE 44

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 44/68

Cross-script --help consistency Cross-script --help consistency

  • f

6 × -f, --failfast Stop on first fail or error 1 × -f, --force

  • b

6 × -b, --buffer Buffer stdout and stderr during tests 6 × -b, --basedn=DN base DN 4 × -b, --buffer Buffer stdout and stderr during test runs 2 × -b BASE set base DN for the search

slide-45
SLIDE 45

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 45/68

samba-tool consistency samba-tool consistency

  • v

2 × -v, --verbose Be verbose 1 × -v, --verbose Print more details of checking 1 × -v, --verbose Print all DN pairs that have been compared 1 × -v, --verbose Show default options too

  • q

2 × -q, --quiet Be quiet 1 × -q, --quiet Do not print anything but relay on just exit code 1 × -q, --quiet don't print details of checking

slide-46
SLIDE 46

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 46/68

samba-tool consistency samba-tool consistency

Surprisingly good

  • -cache

1 × --cache List cached zones 1 × --cache Search cached records

slide-47
SLIDE 47

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 47/68

net consistency net consistency

Work in progress

$ ./bin/net --help Can't load /usr/local/samba/etc/smb.conf - run testparm to debug it

slide-48
SLIDE 48

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 48/68

$ ./bin/net -s st/client/client.conf --help Usage: Use 'net help rpc' to get more extensive information about 'net rpc' commands. Use 'net help rap' to get more extensive information about 'net rap' commands. Use 'net help ads' to get more extensive information about 'net ads' commands. [...] Use 'net help help' to list usage information for 'net' commands.

slide-49
SLIDE 49

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 49/68

$ ./bin/net -s st/client/client.conf Invalid command: net Usage: net rpc Run functions using RPC transport net rap Run functions using RAP transport net ads Run functions using ADS transport [...] net help Print usage information

slide-50
SLIDE 50

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 50/68

$ ./bin/net -s st/client/client.conf help Usage: net rpc Run functions using RPC transport net rap Run functions using RAP transport net ads Run functions using ADS transport [...]

  • e or --encrypt Encrypt SMB transport (UNIX extended servers only)
  • k or --kerberos Use kerberos (active directory) authentication
slide-51
SLIDE 51

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 51/68

$ # 'net help --help' is the same $ ./bin/net -s st/client/client.conf help help Usage: net rpc usage: Use 'net help rpc' to get more extensive information about 'net rpc' commands. net rap usage: Use 'net help rap' to get more extensive information about 'net rap' commands. [...]

  • e or --encrypt Encrypt SMB transport (UNIX extended servers only)
  • k or --kerberos Use kerberos (active directory) authentication
slide-52
SLIDE 52

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 52/68

net consistency net consistency

$ ./bin/net -s st/client/client.conf ads --help long list of sub-subcommands, no --options

slide-53
SLIDE 53

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 53/68

net consistency net consistency

$ ./bin/net -s st/client/client.conf changesecretpw --help Machine account password change only supported on a DOMAIN_MEMBER. Do NOT use this function unless you know what it does! This function will change the ADS Domain member machine account password in the secre

slide-54
SLIDE 54

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 54/68

net consistency net consistency

less specific --help offers more info:

$ ./bin/net -s st/client/client.conf --help [...] net [options] changesecretpw Change the ADS domain member machine account password in secrets.tdb. Do NOT use this function unless you know what it does. Requires the -f flag to work.

slide-55
SLIDE 55

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 55/68

net consistency net consistency

all differ (pending patch aligns the last two)

net help --help man net actual net options

slide-56
SLIDE 56

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 56/68

net consistency net consistency

net help --help # 14 long options man net # 54 long options

slide-57
SLIDE 57

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 57/68

net consistency net consistency

$ ./bin/net -s st/client/client.conf IDMAP CHECK --help Usage: net idmap check [-v] [-r] [-a] [-T] [-f] [-l] [[--db=]<TDB>] Check an idmap database.

  • -verbose,-v verbose
  • -repair,-r repair
  • -auto,-a noninteractive mode
  • -test,-T dry run
  • -fore,-f force
  • -lock,-l lock db while doing the check

TDB idmap database

slide-58
SLIDE 58

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 58/68

net consistency net consistency

$ ./bin/net -s st/client/client.conf help notify Usage: net notify listen net notify trigger

slide-59
SLIDE 59

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 59/68

net consistency net consistency

$ ./bin/net -s st/client/client.conf notify Invalid command: net notify Usage: net notify listen Register for a path and listen for changes net notify trigger Simulate a trigger action

slide-60
SLIDE 60

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 60/68

net consistency net consistency

notify not in man page

$ ./bin/net -s st/client/client.conf help | grep notify net notify notifyd client code

slide-61
SLIDE 61

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 61/68

net consistency net consistency

$ ./bin/net -s st/client/client.conf help usersidlist Could not get the user/sid list $ ./bin/net -s st/client/client.conf usersidlist --help Could not get the user/sid list $ ./bin/net -s st/client/client.conf usersidlist Could not get the user/sid list

slide-62
SLIDE 62

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 62/68

net consistency net consistency

$ ./bin/net -s st/client/client.conf usersidlist AFEWFEFDSFAEFESF net usersidlist prints out a list of all users the running winbind knows about, together with all their SIDs. This is used as input to the 'net rpc share allowedusers' command. Valid targets: choose one (none defaults to localhost)

  • S or --server= server name
  • I or --ipaddress= address of target server
  • w or --workgroup= target workgroup or domain

Valid miscellaneous options are:

  • p or --port= connection port on target
  • W or --myworkgroup= client workgroup
  • d or --debuglevel= debug level (0-10)
  • n or --myname= client name
  • U or --user= user name
  • s or --configfile= pathname of smb.conf file
  • l or --long Display full information
  • V or --version Print samba version information
  • P or --machine-pass Authenticate as machine account
  • e or --encrypt Encrypt SMB transport (UNIX extended servers only)
  • k or --kerberos Use kerberos (active directory) authentication
slide-63
SLIDE 63

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 63/68

Command-line style guide? Command-line style guide?

... we would ignore it?

slide-64
SLIDE 64

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 64/68

bash completion bash completion

samba_spnupdate -k<tab><tab> yes no auto

slide-65
SLIDE 65

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 65/68

bash completion bash completion

existing completions for smbclient, smbget

  • ption parsing logic should know everything

necessary it should be able to introspect and generate completion code GCC 9 adds --completion completion helper

slide-66
SLIDE 66

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 66/68

tab completion tab completion

$ samba-tool --generate-bash-completions >\ ~/.local/etc/bash_completion.d/samba-tool $ samba-tool <tab><tab> computer dbcheck delegation dns domain drs dsacl forest fsmo gpo group ldapcmp ntacl ou processes rodc schema sites spn testparm time user visualize

slide-67
SLIDE 67

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 67/68

Do we want this? Do we want this?

usage/--help tests tab completion style guide

  • -json

nerdview reduction

slide-68
SLIDE 68

6/6/2019 What should we do with our UI? 127.0.0.1:8000/?print-pdf#/ 68/68

Questions? Questions?

douglas.bagnall@catalyst.net.nz