| 1 | <?xml version="1.0" encoding="iso-8859-1"?>
|
|---|
| 2 | <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
|
|---|
| 3 | <chapter id="NT4Migration">
|
|---|
| 4 | <chapterinfo>
|
|---|
| 5 | &author.jht;
|
|---|
| 6 | <pubdate>April 3, 2003</pubdate>
|
|---|
| 7 | </chapterinfo>
|
|---|
| 8 |
|
|---|
| 9 | <title>Migration from NT4 PDC to Samba-3 PDC</title>
|
|---|
| 10 |
|
|---|
| 11 | <para>
|
|---|
| 12 | <indexterm><primary>migrate</primary></indexterm>
|
|---|
| 13 | <indexterm><primary>domain control</primary></indexterm>
|
|---|
| 14 | This is a rough guide to assist those wishing to migrate from NT4 domain control to
|
|---|
| 15 | Samba-3-based domain control.
|
|---|
| 16 | </para>
|
|---|
| 17 |
|
|---|
| 18 | <sect1>
|
|---|
| 19 | <title>Planning and Getting Started</title>
|
|---|
| 20 |
|
|---|
| 21 | <para>
|
|---|
| 22 | <indexterm><primary>show-stopper-type</primary></indexterm>
|
|---|
| 23 | In the IT world there is often a saying that all problems are encountered because of
|
|---|
| 24 | poor planning. The corollary to this saying is that not all problems can be anticipated
|
|---|
| 25 | and planned for. Then again, good planning will anticipate most show-stopper-type situations.
|
|---|
| 26 | </para>
|
|---|
| 27 |
|
|---|
| 28 | <para>
|
|---|
| 29 | <indexterm><primary>migration plan</primary></indexterm>
|
|---|
| 30 | Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control
|
|---|
| 31 | environment would do well to develop a detailed migration plan. So here are a few pointers to
|
|---|
| 32 | help migration get underway.
|
|---|
| 33 | </para>
|
|---|
| 34 |
|
|---|
| 35 | <sect2>
|
|---|
| 36 | <title>Objectives</title>
|
|---|
| 37 |
|
|---|
| 38 | <para>
|
|---|
| 39 | <indexterm><primary>migration process</primary></indexterm>
|
|---|
| 40 | The key objective for most organizations is to make the migration from MS Windows NT4
|
|---|
| 41 | to Samba-3 domain control as painless as possible. One of the challenges you may experience
|
|---|
| 42 | in your migration process may well be convincing management that the new environment
|
|---|
| 43 | should remain in place. Many who have introduced open source technologies have experienced
|
|---|
| 44 | pressure to return to a Microsoft-based platform solution at the first sign of trouble.
|
|---|
| 45 | </para>
|
|---|
| 46 |
|
|---|
| 47 | <para>
|
|---|
| 48 | <indexterm><primary>change motivations</primary></indexterm>
|
|---|
| 49 | Before attempting a migration to a Samba-3-controlled network, make every possible effort to
|
|---|
| 50 | gain all-round commitment to the change. Know precisely <emphasis>why</emphasis> the change
|
|---|
| 51 | is important for the organization. Possible motivations to make a change include:
|
|---|
| 52 | </para>
|
|---|
| 53 |
|
|---|
| 54 | <indexterm><primary>manageability</primary></indexterm>
|
|---|
| 55 | <indexterm><primary>functionality</primary></indexterm>
|
|---|
| 56 | <indexterm><primary>operating costs</primary></indexterm>
|
|---|
| 57 | <indexterm><primary>support exposure</primary></indexterm>
|
|---|
| 58 | <indexterm><primary>licensing</primary></indexterm>
|
|---|
| 59 |
|
|---|
| 60 | <itemizedlist>
|
|---|
| 61 | <listitem><para>Improve network manageability.</para></listitem>
|
|---|
| 62 | <listitem><para>Obtain better user-level functionality.</para></listitem>
|
|---|
| 63 | <listitem><para>Reduce network operating costs.</para></listitem>
|
|---|
| 64 | <listitem><para>Reduce exposure caused by Microsoft withdrawal of NT4 support.</para></listitem>
|
|---|
| 65 | <listitem><para>Avoid MS License 6 implications.</para></listitem>
|
|---|
| 66 | <listitem><para>Reduce organization's dependency on Microsoft.</para></listitem>
|
|---|
| 67 | </itemizedlist>
|
|---|
| 68 |
|
|---|
| 69 | <para>
|
|---|
| 70 | <indexterm><primary>alternative solution</primary></indexterm>
|
|---|
| 71 | <indexterm><primary>advantages</primary></indexterm>
|
|---|
| 72 | <indexterm><primary>core values</primary></indexterm>
|
|---|
| 73 | <indexterm><primary>migration</primary></indexterm>
|
|---|
| 74 | <indexterm><primary>ADS</primary></indexterm>
|
|---|
| 75 | <indexterm><primary>without ADS</primary></indexterm>
|
|---|
| 76 | Make sure everyone knows that Samba-3 is not MS Windows NT4. Samba-3 offers
|
|---|
| 77 | an alternative solution that is both different from MS Windows NT4 and offers
|
|---|
| 78 | advantages compared with it. Gain recognition that Samba-3 lacks many of the
|
|---|
| 79 | features that Microsoft has promoted as core values in migration from MS Windows NT4 to
|
|---|
| 80 | MS Windows 2000 and beyond (with or without Active Directory services).
|
|---|
| 81 | </para>
|
|---|
| 82 |
|
|---|
| 83 | <para>
|
|---|
| 84 | What are the features that Samba-3 cannot provide?
|
|---|
| 85 | </para>
|
|---|
| 86 |
|
|---|
| 87 | <indexterm><primary>Active Directory Server</primary></indexterm>
|
|---|
| 88 | <indexterm><primary>Group Policy Objects</primary></indexterm>
|
|---|
| 89 | <indexterm><primary>Machine Policy Objects</primary></indexterm>
|
|---|
| 90 | <indexterm><primary>Logon Scripts</primary></indexterm>
|
|---|
| 91 | <indexterm><primary>Access Controls</primary></indexterm>
|
|---|
| 92 |
|
|---|
| 93 | <itemizedlist>
|
|---|
| 94 | <listitem><para>Active Directory Server.</para></listitem>
|
|---|
| 95 | <listitem><para>Group Policy Objects (in Active Directory).</para></listitem>
|
|---|
| 96 | <listitem><para>Machine Policy Objects.</para></listitem>
|
|---|
| 97 | <listitem><para>Logon Scripts in Active Directory.</para></listitem>
|
|---|
| 98 | <listitem><para>Software Application and Access Controls in Active Directory.</para></listitem>
|
|---|
| 99 | </itemizedlist>
|
|---|
| 100 |
|
|---|
| 101 | <para>
|
|---|
| 102 | The features that Samba-3 does provide and that may be of compelling interest to your site
|
|---|
| 103 | include:
|
|---|
| 104 | </para>
|
|---|
| 105 |
|
|---|
| 106 | <indexterm><primary>ownership cost</primary></indexterm>
|
|---|
| 107 | <indexterm><primary>Global support</primary></indexterm>
|
|---|
| 108 | <indexterm><primary>Dynamic SMB servers</primary></indexterm>
|
|---|
| 109 | <indexterm><primary>on-the-fly logon scripts</primary></indexterm>
|
|---|
| 110 | <indexterm><primary>on-the-fly policy files</primary></indexterm>
|
|---|
| 111 | <indexterm><primary>stability</primary></indexterm>
|
|---|
| 112 | <indexterm><primary>reliability</primary></indexterm>
|
|---|
| 113 | <indexterm><primary>performance</primary></indexterm>
|
|---|
| 114 | <indexterm><primary>availability</primary></indexterm>
|
|---|
| 115 | <indexterm><primary>Manageability</primary></indexterm>
|
|---|
| 116 | <indexterm><primary>backend authentication</primary></indexterm>
|
|---|
| 117 | <indexterm><primary>tdbsam</primary></indexterm>
|
|---|
| 118 | <indexterm><primary>ldapsam</primary></indexterm>
|
|---|
| 119 | <indexterm><primary>single-sign-on</primary></indexterm>
|
|---|
| 120 | <indexterm><primary>distribute authentication systems</primary></indexterm>
|
|---|
| 121 |
|
|---|
| 122 | <itemizedlist>
|
|---|
| 123 | <listitem><para>Lower cost of ownership.</para></listitem>
|
|---|
| 124 | <listitem><para>Global availability of support with no strings attached.</para></listitem>
|
|---|
| 125 | <listitem><para>Dynamic SMB servers (can run more than one SMB/CIFS server per UNIX/Linux system).</para></listitem>
|
|---|
| 126 | <listitem><para>Creation of on-the-fly logon scripts.</para></listitem>
|
|---|
| 127 | <listitem><para>Creation of on-the-fly policy files.</para></listitem>
|
|---|
| 128 | <listitem><para>Greater stability, reliability, performance, and availability.</para></listitem>
|
|---|
| 129 | <listitem><para>Manageability via an SSH connection.</para></listitem>
|
|---|
| 130 | <listitem><para>Flexible choices of backend authentication technologies (tdbsam, ldapsam).</para></listitem>
|
|---|
| 131 | <listitem><para>Ability to implement a full single-sign-on architecture.</para></listitem>
|
|---|
| 132 | <listitem><para>Ability to distribute authentication systems for absolute minimum wide-area network bandwidth demand.</para></listitem>
|
|---|
| 133 | </itemizedlist>
|
|---|
| 134 |
|
|---|
| 135 | <para>
|
|---|
| 136 | <indexterm><primary>successful migration</primary></indexterm>
|
|---|
| 137 | Before migrating a network from MS Windows NT4 to Samba-3, consider all necessary factors. Users
|
|---|
| 138 | should be educated about changes they may experience so the change will be a welcome one
|
|---|
| 139 | and not become an obstacle to the work they need to do. The following sections explain factors that will
|
|---|
| 140 | help ensure a successful migration.
|
|---|
| 141 | </para>
|
|---|
| 142 |
|
|---|
| 143 | <sect3>
|
|---|
| 144 | <title>Domain Layout</title>
|
|---|
| 145 |
|
|---|
| 146 | <para>
|
|---|
| 147 | <indexterm><primary>domain controller</primary></indexterm>
|
|---|
| 148 | <indexterm><primary>backup domain controller</primary></indexterm>
|
|---|
| 149 | <indexterm><primary>secondary controller</primary></indexterm>
|
|---|
| 150 | <indexterm><primary>domain member</primary></indexterm>
|
|---|
| 151 | <indexterm><primary>standalone server</primary></indexterm>
|
|---|
| 152 | <indexterm><primary>network security</primary></indexterm>
|
|---|
| 153 | <indexterm><primary>domain context</primary></indexterm>
|
|---|
| 154 | <indexterm><primary>PDC</primary></indexterm>
|
|---|
| 155 | <indexterm><primary>BDCs</primary></indexterm>
|
|---|
| 156 | <indexterm><primary>LDAP</primary></indexterm>
|
|---|
| 157 | <indexterm><primary>authentication backend</primary></indexterm>
|
|---|
| 158 | <indexterm><primary>complex organization</primary></indexterm>
|
|---|
| 159 | <indexterm><primary>LDAP database</primary></indexterm>
|
|---|
| 160 | <indexterm><primary>master server</primary></indexterm>
|
|---|
| 161 | <indexterm><primary>slave servers</primary></indexterm>
|
|---|
| 162 | <indexterm><primary>multiple domains</primary></indexterm>
|
|---|
| 163 | Samba-3 can be configured as a domain controller, a backup domain controller (probably best called
|
|---|
| 164 | a secondary controller), a domain member, or a standalone server. The Windows network security
|
|---|
| 165 | domain context should be sized and scoped before implementation. Particular attention needs to be
|
|---|
| 166 | paid to the location of the Primary Domain Controller (PDC) as well as backup controllers (BDCs).
|
|---|
| 167 | One way in which Samba-3 differs from Microsoft technology is that if one chooses to use an LDAP
|
|---|
| 168 | authentication backend, then the same database can be used by several different domains. In a
|
|---|
| 169 | complex organization, there can be a single LDAP database, which itself can be distributed (have
|
|---|
| 170 | a master server and multiple slave servers) that can simultaneously serve multiple domains.
|
|---|
| 171 | </para>
|
|---|
| 172 |
|
|---|
| 173 | <para>
|
|---|
| 174 | <indexterm><primary>network bandwidth</primary></indexterm>
|
|---|
| 175 | From a design perspective, the number of users per server as well as the number of servers per
|
|---|
| 176 | domain should be scaled taking into consideration server capacity and network bandwidth.
|
|---|
| 177 | </para>
|
|---|
| 178 |
|
|---|
| 179 | <para>
|
|---|
| 180 | <indexterm><primary>network segment</primary></indexterm>
|
|---|
| 181 | <indexterm><primary>multiple network segments</primary></indexterm>
|
|---|
| 182 | <indexterm><primary>domain controller</primary></indexterm>
|
|---|
| 183 | <indexterm><primary>ping</primary></indexterm>
|
|---|
| 184 | <indexterm><primary>BDC</primary></indexterm>
|
|---|
| 185 | <indexterm><primary>remote segment</primary></indexterm>
|
|---|
| 186 | A physical network segment may house several domains. Each may span multiple network segments.
|
|---|
| 187 | Where domains span routed network segments, consider and test the performance implications of
|
|---|
| 188 | the design and layout of a network. A centrally located domain controller that is designed to
|
|---|
| 189 | serve multiple routed network segments may result in severe performance problems. Check the
|
|---|
| 190 | response time (ping timing) between the remote segment and the PDC. If it's long (more than 100 ms),
|
|---|
| 191 | locate a BDC on the remote segment to serve as the local authentication and access control server.
|
|---|
| 192 | </para>
|
|---|
| 193 | </sect3>
|
|---|
| 194 |
|
|---|
| 195 | <sect3>
|
|---|
| 196 | <title>Server Share and Directory Layout</title>
|
|---|
| 197 |
|
|---|
| 198 | <para>
|
|---|
| 199 | <indexterm><primary>Simplicity is king</primary></indexterm>
|
|---|
| 200 | <indexterm><primary>well-controlled network</primary></indexterm>
|
|---|
| 201 | There are cardinal rules to effective network design that cannot be broken with impunity.
|
|---|
| 202 | The most important rule: Simplicity is king in every well-controlled network. Every part of
|
|---|
| 203 | the infrastructure must be managed; the more complex it is, the greater will be the demand
|
|---|
| 204 | of keeping systems secure and functional.
|
|---|
| 205 | </para>
|
|---|
| 206 |
|
|---|
| 207 | <para>
|
|---|
| 208 | <indexterm><primary>disk space</primary></indexterm>
|
|---|
| 209 | <indexterm><primary>backed up</primary></indexterm>
|
|---|
| 210 | <indexterm><primary>tape</primary></indexterm>
|
|---|
| 211 | <indexterm><primary>backup</primary></indexterm>
|
|---|
| 212 | <indexterm><primary>validate every backup</primary></indexterm>
|
|---|
| 213 | <indexterm><primary>disaster recovery</primary></indexterm>
|
|---|
| 214 | Keep in mind the nature of how data must be shared. Physical disk space layout should be considered
|
|---|
| 215 | carefully. Some data must be backed up. The simpler the disk layout, the easier it will be to
|
|---|
| 216 | keep track of backup needs. Identify what backup media will meet your needs; consider backup to tape,
|
|---|
| 217 | CD-ROM or DVD-ROM, or other offline storage medium. Plan and implement for minimum
|
|---|
| 218 | maintenance. Leave nothing to chance in your design; above all, do not leave backups to chance:
|
|---|
| 219 | backup, test, and validate every backup; create a disaster recovery plan and prove that it works.
|
|---|
| 220 | </para>
|
|---|
| 221 |
|
|---|
| 222 | <para>
|
|---|
| 223 | <indexterm><primary>access control needs</primary></indexterm>
|
|---|
| 224 | <indexterm><primary>group permissions</primary></indexterm>
|
|---|
| 225 | <indexterm><primary>sticky bit</primary></indexterm>
|
|---|
| 226 | Users should be grouped according to data access control needs. File and directory access
|
|---|
| 227 | is best controlled via group permissions, and the use of the <quote>sticky bit</quote> on group-controlled
|
|---|
| 228 | directories may substantially avoid file access complaints from Samba share users.
|
|---|
| 229 | </para>
|
|---|
| 230 |
|
|---|
| 231 | <para>
|
|---|
| 232 | <indexterm><primary>network administrators</primary></indexterm>
|
|---|
| 233 | <indexterm><primary>document design</primary></indexterm>
|
|---|
| 234 | <indexterm><primary>simple access controls</primary></indexterm>
|
|---|
| 235 | <indexterm><primary>obtuse complexity</primary></indexterm>
|
|---|
| 236 | <indexterm><primary>document design</primary></indexterm>
|
|---|
| 237 | Inexperienced network administrators often attempt elaborate techniques to set access
|
|---|
| 238 | controls on files, directories, shares, as well as in share definitions.
|
|---|
| 239 | Keep your design and implementation simple and document your design extensively. Have others
|
|---|
| 240 | audit your documentation. Do not create a complex mess that your successor will not understand.
|
|---|
| 241 | Remember, job security through complex design and implementation may cause loss of operations
|
|---|
| 242 | and downtime to users as the new administrator learns to untangle your knots. Keep access
|
|---|
| 243 | controls simple and effective, and make sure that users will never be interrupted by obtuse
|
|---|
| 244 | complexity.
|
|---|
| 245 | </para>
|
|---|
| 246 | </sect3>
|
|---|
| 247 |
|
|---|
| 248 | <sect3>
|
|---|
| 249 | <title>Logon Scripts</title>
|
|---|
| 250 |
|
|---|
| 251 | <para>
|
|---|
| 252 | <indexterm><primary>Logon scripts</primary></indexterm>
|
|---|
| 253 | Logon scripts can help to ensure that all users gain the share and printer connections they need.
|
|---|
| 254 | </para>
|
|---|
| 255 |
|
|---|
| 256 | <para>
|
|---|
| 257 | Logon scripts can be created on the fly so all commands executed are specific to the
|
|---|
| 258 | rights and privileges granted to the user. The preferred controls should be effected through
|
|---|
| 259 | group membership so group information can be used to create a custom logon script using
|
|---|
| 260 | the <smbconfoption name="root preexec"/> parameters to the <smbconfsection name="NETLOGON"/> share.
|
|---|
| 261 | </para>
|
|---|
| 262 |
|
|---|
| 263 | <para>
|
|---|
| 264 | <indexterm><primary>kixstart</primary></indexterm>
|
|---|
| 265 | Some sites prefer to use a tool such as <command>kixstart</command> to establish a controlled
|
|---|
| 266 | user environment. In any case, you may wish to do a Google search for logon script process controls.
|
|---|
| 267 | In particular, you may wish to explore the use of the Microsoft Knowledge Base article KB189105 that
|
|---|
| 268 | deals with how to add printers without user intervention via the logon script process.
|
|---|
| 269 | </para>
|
|---|
| 270 | </sect3>
|
|---|
| 271 |
|
|---|
| 272 | <sect3>
|
|---|
| 273 | <title>Profile Migration/Creation</title>
|
|---|
| 274 |
|
|---|
| 275 | <para>
|
|---|
| 276 | User and group profiles may be migrated using the tools described in the section titled Desktop Profile
|
|---|
| 277 | Management.
|
|---|
| 278 | </para>
|
|---|
| 279 |
|
|---|
| 280 |
|
|---|
| 281 | <para>
|
|---|
| 282 | <indexterm><primary>SID</primary></indexterm>
|
|---|
| 283 | <indexterm><primary>NTuser.DAT</primary></indexterm>
|
|---|
| 284 | Profiles may also be managed using the Samba-3 tool <command>profiles</command>. This tool allows the MS
|
|---|
| 285 | Windows NT-style security identifiers (SIDs) that are stored inside the profile
|
|---|
| 286 | <filename>NTuser.DAT</filename> file to be changed to the SID of the Samba-3 domain.
|
|---|
| 287 | </para>
|
|---|
| 288 | </sect3>
|
|---|
| 289 |
|
|---|
| 290 | <sect3>
|
|---|
| 291 | <title>User and Group Accounts</title>
|
|---|
| 292 |
|
|---|
| 293 | <para>
|
|---|
| 294 | <indexterm><primary>migrate account settings</primary></indexterm>
|
|---|
| 295 | <indexterm><primary>migrate user</primary></indexterm>
|
|---|
| 296 | <indexterm><primary>migrate group</primary></indexterm>
|
|---|
| 297 | <indexterm><primary>map</primary></indexterm>
|
|---|
| 298 | It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before
|
|---|
| 299 | attempting to migrate user and group accounts, you are STRONGLY advised to create in Samba-3 the
|
|---|
| 300 | groups that are present on the MS Windows NT4 domain <emphasis>AND</emphasis> to map them to
|
|---|
| 301 | suitable UNIX/Linux groups. By following this simple advice, all user and group attributes
|
|---|
| 302 | should migrate painlessly.
|
|---|
| 303 | </para>
|
|---|
| 304 | </sect3>
|
|---|
| 305 |
|
|---|
| 306 | </sect2>
|
|---|
| 307 |
|
|---|
| 308 | <sect2>
|
|---|
| 309 | <title>Steps in Migration Process</title>
|
|---|
| 310 |
|
|---|
| 311 | <para>
|
|---|
| 312 | The approximate migration process is described below.
|
|---|
| 313 | </para>
|
|---|
| 314 |
|
|---|
| 315 | <itemizedlist>
|
|---|
| 316 | <listitem><para>
|
|---|
| 317 | You have an NT4 PDC that has the users, groups, policies, and profiles to be migrated.
|
|---|
| 318 | </para></listitem>
|
|---|
| 319 |
|
|---|
| 320 | <listitem><para>
|
|---|
| 321 | <indexterm><primary>domain controller</primary></indexterm>
|
|---|
| 322 | <indexterm><primary>netlogon share</primary></indexterm>
|
|---|
| 323 | <indexterm><primary>BDC</primary></indexterm>
|
|---|
| 324 | Samba-3 is set up as a domain controller with netlogon share, profile share, and so on. Configure the &smb.conf; file
|
|---|
| 325 | to function as a BDC: <parameter>domain master = No</parameter>.
|
|---|
| 326 | </para></listitem>
|
|---|
| 327 | </itemizedlist>
|
|---|
| 328 |
|
|---|
| 329 | <procedure>
|
|---|
| 330 | <title>The Account Migration Process</title>
|
|---|
| 331 |
|
|---|
| 332 | <step><para>
|
|---|
| 333 | <indexterm><primary>pdbedit</primary></indexterm>
|
|---|
| 334 | Create a BDC account in the old NT4 domain for the Samba server using NT Server Manager.
|
|---|
| 335 | <emphasis>Samba must not be running.</emphasis>
|
|---|
| 336 | </para></step>
|
|---|
| 337 |
|
|---|
| 338 | <step><para>
|
|---|
| 339 | <indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>join</tertiary></indexterm>
|
|---|
| 340 | <userinput>net rpc join -S <replaceable>NT4PDC</replaceable> -w <replaceable>DOMNAME</replaceable> -U
|
|---|
| 341 | Administrator%<replaceable>passwd</replaceable></userinput>
|
|---|
| 342 | </para></step>
|
|---|
| 343 |
|
|---|
| 344 | <step><para>
|
|---|
| 345 | <indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>vampire</tertiary></indexterm>
|
|---|
| 346 | <userinput>net rpc vampire -S <replaceable>NT4PDC</replaceable> -U
|
|---|
| 347 | administrator%<replaceable>passwd</replaceable></userinput>
|
|---|
| 348 | </para></step>
|
|---|
| 349 |
|
|---|
| 350 | <indexterm><primary>pdbedit</primary></indexterm>
|
|---|
| 351 | <step><para><userinput>pdbedit -L</userinput></para>
|
|---|
| 352 | <para>Note: Did the users migrate?</para>
|
|---|
| 353 | </step>
|
|---|
| 354 |
|
|---|
| 355 | <step><para>
|
|---|
| 356 | <indexterm><primary>net</primary><secondary>groupmap</secondary></indexterm>
|
|---|
| 357 | <indexterm><primary>initGroups.sh</primary></indexterm>
|
|---|
| 358 | Now assign each of the UNIX groups to NT groups:
|
|---|
| 359 | (It may be useful to copy this text to a script called <filename>initGroups.sh</filename>)
|
|---|
| 360 | <programlisting>
|
|---|
| 361 | #!/bin/bash
|
|---|
| 362 | #### Keep this as a shell script for future re-use
|
|---|
| 363 |
|
|---|
| 364 | # First assign well known domain global groups
|
|---|
| 365 | net groupmap add ntgroup="Domain Admins" unixgroup=root rid=512 type=d
|
|---|
| 366 | net groupmap add ntgroup="Domain Users" unixgroup=users rid=513 type=d
|
|---|
| 367 | net groupmap add ntgroup="Domain Guests" unixgroup=nobody rid=514 type=d
|
|---|
| 368 |
|
|---|
| 369 | # Now for our added domain global groups
|
|---|
| 370 | net groupmap add ntgroup="Designers" unixgroup=designers type=d
|
|---|
| 371 | net groupmap add ntgroup="Engineers" unixgroup=engineers type=d
|
|---|
| 372 | net groupmap add ntgroup="QA Team" unixgroup=qateam type=d
|
|---|
| 373 | </programlisting>
|
|---|
| 374 | </para></step>
|
|---|
| 375 |
|
|---|
| 376 | <step><para><userinput>net groupmap list</userinput></para>
|
|---|
| 377 | <para>Check that all groups are recognized.
|
|---|
| 378 | </para></step>
|
|---|
| 379 | </procedure>
|
|---|
| 380 |
|
|---|
| 381 | <para>
|
|---|
| 382 | Migrate all the profiles, then migrate all policy files.
|
|---|
| 383 | </para>
|
|---|
| 384 |
|
|---|
| 385 | </sect2>
|
|---|
| 386 | </sect1>
|
|---|
| 387 |
|
|---|
| 388 | <sect1>
|
|---|
| 389 | <title>Migration Options</title>
|
|---|
| 390 |
|
|---|
| 391 | <para>
|
|---|
| 392 | Sites that wish to migrate from MS Windows NT4 domain control to a Samba-based solution
|
|---|
| 393 | generally fit into three basic categories. <link linkend="majtypes">Following table</link> shows the possibilities.
|
|---|
| 394 | </para>
|
|---|
| 395 |
|
|---|
| 396 | <table frame="all" id="majtypes"><title>The Three Major Site Types</title>
|
|---|
| 397 | <tgroup cols="2">
|
|---|
| 398 | <colspec align="left"/>
|
|---|
| 399 | <colspec align="justify"/>
|
|---|
| 400 | <thead>
|
|---|
| 401 | <row><entry>Number of Users</entry><entry>Description</entry></row>
|
|---|
| 402 | </thead>
|
|---|
| 403 | <tbody>
|
|---|
| 404 | <row><entry>< 50</entry><entry><para>Want simple conversion with no pain.</para></entry></row>
|
|---|
| 405 | <row><entry>50 - 250</entry><entry><para>Want new features; can manage some inhouse complexity.</para></entry></row>
|
|---|
| 406 | <row><entry>> 250</entry><entry><para>Solution/implementation must scale well; complex needs.
|
|---|
| 407 | Cross-departmental decision process. Local expertise in most areas.</para></entry></row>
|
|---|
| 408 | </tbody>
|
|---|
| 409 | </tgroup>
|
|---|
| 410 | </table>
|
|---|
| 411 |
|
|---|
| 412 | <sect2>
|
|---|
| 413 | <title>Planning for Success</title>
|
|---|
| 414 |
|
|---|
| 415 | <para>
|
|---|
| 416 | There are three basic choices for sites that intend to migrate from MS Windows NT4
|
|---|
| 417 | to Samba-3:
|
|---|
| 418 | </para>
|
|---|
| 419 |
|
|---|
| 420 | <itemizedlist>
|
|---|
| 421 | <listitem><para>
|
|---|
| 422 | Simple conversion (total replacement).
|
|---|
| 423 | </para></listitem>
|
|---|
| 424 |
|
|---|
| 425 | <listitem><para>
|
|---|
| 426 | Upgraded conversion (could be one of integration).
|
|---|
| 427 | </para></listitem>
|
|---|
| 428 |
|
|---|
| 429 | <listitem><para>
|
|---|
| 430 | Complete redesign (completely new solution).
|
|---|
| 431 | </para></listitem>
|
|---|
| 432 | </itemizedlist>
|
|---|
| 433 |
|
|---|
| 434 | <para>
|
|---|
| 435 | Minimize downstream problems by:
|
|---|
| 436 | </para>
|
|---|
| 437 |
|
|---|
| 438 | <itemizedlist>
|
|---|
| 439 | <listitem><para>
|
|---|
| 440 | Taking sufficient time.
|
|---|
| 441 | </para></listitem>
|
|---|
| 442 |
|
|---|
| 443 | <listitem><para>
|
|---|
| 444 | Avoiding panic.
|
|---|
| 445 | </para></listitem>
|
|---|
| 446 |
|
|---|
| 447 | <listitem><para>
|
|---|
| 448 | Testing all assumptions.
|
|---|
| 449 | </para></listitem>
|
|---|
| 450 |
|
|---|
| 451 | <listitem><para>
|
|---|
| 452 | Testing the full roll-out program, including workstation deployment.
|
|---|
| 453 | </para></listitem>
|
|---|
| 454 | </itemizedlist>
|
|---|
| 455 |
|
|---|
| 456 | <para><link linkend="natconchoices">Following table</link> lists the conversion choices given the type of migration
|
|---|
| 457 | being contemplated.
|
|---|
| 458 | </para>
|
|---|
| 459 |
|
|---|
| 460 | <table frame="all" id="natconchoices"><title>Nature of the Conversion Choices</title>
|
|---|
| 461 | <tgroup cols="3">
|
|---|
| 462 | <colspec align="justify" colwidth="1*"/>
|
|---|
| 463 | <colspec align="justify" colwidth="1*"/>
|
|---|
| 464 | <colspec align="justify" colwidth="1*"/>
|
|---|
| 465 | <thead>
|
|---|
| 466 | <row><entry>Simple Install</entry><entry>Upgrade Decisions</entry><entry>Redesign Decisions</entry></row>
|
|---|
| 467 | </thead>
|
|---|
| 468 | <tbody>
|
|---|
| 469 | <row>
|
|---|
| 470 | <entry><para>Make use of minimal OS-specific features</para></entry>
|
|---|
| 471 | <entry><para>Translate NT4 features to new host OS features</para></entry>
|
|---|
| 472 | <entry><para>Improve on NT4 functionality, enhance management capabilities</para></entry>
|
|---|
| 473 | </row>
|
|---|
| 474 | <row>
|
|---|
| 475 | <entry><para>Move all accounts from NT4 into Samba-3</para></entry>
|
|---|
| 476 | <entry><para>Copy and improve</para></entry>
|
|---|
| 477 | <entry><para>Authentication regime (database location and access)</para></entry>
|
|---|
| 478 | </row>
|
|---|
| 479 | <row>
|
|---|
| 480 | <entry><para>Make least number of operational changes</para></entry>
|
|---|
| 481 | <entry><para>Make progressive improvements</para></entry>
|
|---|
| 482 | <entry><para>Desktop management methods</para></entry>
|
|---|
| 483 | </row>
|
|---|
| 484 | <row>
|
|---|
| 485 | <entry><para>Take least amount of time to migrate</para></entry>
|
|---|
| 486 | <entry><para>Minimize user impact</para></entry>
|
|---|
| 487 | <entry><para>Better control of Desktops/Users</para></entry>
|
|---|
| 488 | </row>
|
|---|
| 489 | <row>
|
|---|
| 490 | <entry><para>Live versus isolated conversion</para></entry>
|
|---|
| 491 | <entry><para>Maximize functionality</para></entry>
|
|---|
| 492 | <entry><para>Identify Needs for: <emphasis>Manageability, Scalability, Security, Availability</emphasis></para></entry>
|
|---|
| 493 | </row>
|
|---|
| 494 | <row>
|
|---|
| 495 | <entry><para>Integrate Samba-3, then migrate while users are active, then change of control (swap out)</para></entry>
|
|---|
| 496 | <entry><para>Take advantage of lower maintenance opportunity</para></entry>
|
|---|
| 497 | <entry><para></para></entry>
|
|---|
| 498 | </row>
|
|---|
| 499 | </tbody>
|
|---|
| 500 | </tgroup>
|
|---|
| 501 | </table>
|
|---|
| 502 | </sect2>
|
|---|
| 503 |
|
|---|
| 504 | <sect2>
|
|---|
| 505 | <title>Samba-3 Implementation Choices</title>
|
|---|
| 506 |
|
|---|
| 507 | <variablelist>
|
|---|
| 508 | <varlistentry><term>Authentication Database/Backend</term><listitem>
|
|---|
| 509 | <para>
|
|---|
| 510 | Samba-3 can use an external authentication backend:
|
|---|
| 511 | </para>
|
|---|
| 512 |
|
|---|
| 513 | <para>
|
|---|
| 514 | <itemizedlist>
|
|---|
| 515 | <listitem><para>Winbind (external Samba or NT4/200x server).</para></listitem>
|
|---|
| 516 | <listitem><para>External server could use Active Directory or NT4 domain.</para></listitem>
|
|---|
| 517 | <listitem><para>Can use pam_mkhomedir.so to autocreate home directories.</para></listitem>
|
|---|
| 518 | <listitem><para> Samba-3 can use a local authentication backend: <parameter>smbpasswd</parameter>,
|
|---|
| 519 | <parameter>tdbsam</parameter>, <parameter>ldapsam</parameter>
|
|---|
| 520 | </para></listitem>
|
|---|
| 521 | </itemizedlist></para></listitem>
|
|---|
| 522 | </varlistentry>
|
|---|
| 523 |
|
|---|
| 524 | <varlistentry><term>Access Control Points</term><listitem>
|
|---|
| 525 | <para>
|
|---|
| 526 | Samba permits Access Control points to be set:
|
|---|
| 527 | </para>
|
|---|
| 528 |
|
|---|
| 529 | <indexterm><primary>share ACLs</primary></indexterm>
|
|---|
| 530 | <indexterm><primary>UNIX permissions</primary></indexterm>
|
|---|
| 531 | <indexterm><primary>POSIX ACLS</primary></indexterm>
|
|---|
| 532 | <indexterm><primary>share stanza controls</primary></indexterm>
|
|---|
| 533 |
|
|---|
| 534 | <itemizedlist>
|
|---|
| 535 | <listitem><para>On the share itself &smbmdash; using share ACLs.</para></listitem>
|
|---|
| 536 | <listitem><para>On the file system &smbmdash; using UNIX permissions on files and directories.</para>
|
|---|
| 537 | <para>Note: Can enable Posix ACLs in file system also.</para></listitem>
|
|---|
| 538 | <listitem><para>Through Samba share parameters &smbmdash; not recommended except as last resort.</para></listitem>
|
|---|
| 539 | </itemizedlist></listitem>
|
|---|
| 540 | </varlistentry>
|
|---|
| 541 |
|
|---|
| 542 | <varlistentry><term>Policies (migrate or create new ones)</term><listitem>
|
|---|
| 543 | <para>
|
|---|
| 544 | <indexterm><primary>policies</primary></indexterm>
|
|---|
| 545 | <indexterm><primary>NTConfig.POL</primary></indexterm>
|
|---|
| 546 | Exercise great caution when making registry changes; use the right tool and be aware
|
|---|
| 547 | that changes made through NT4-style <filename>NTConfig.POL</filename> files can leave
|
|---|
| 548 | permanent changes.
|
|---|
| 549 | <indexterm><primary>Group Policy Editor</primary></indexterm>
|
|---|
| 550 | <indexterm><primary>tattoo effect</primary></indexterm>
|
|---|
| 551 | <indexterm><primary>permanent changes</primary></indexterm>
|
|---|
| 552 | </para>
|
|---|
| 553 | <itemizedlist>
|
|---|
| 554 | <listitem><para>Using Group Policy Editor (NT4).</para></listitem>
|
|---|
| 555 | <listitem><para>Watch out for tattoo effect.</para></listitem>
|
|---|
| 556 | </itemizedlist>
|
|---|
| 557 | </listitem>
|
|---|
| 558 | </varlistentry>
|
|---|
| 559 |
|
|---|
| 560 | <varlistentry><term>User and Group Profiles</term><listitem>
|
|---|
| 561 | <para>
|
|---|
| 562 | <indexterm><primary>NTUser.DAT</primary></indexterm>
|
|---|
| 563 | <indexterm><primary>SIDs</primary></indexterm>
|
|---|
| 564 | Platform-specific, so use platform tool to change from a local to a roaming profile.
|
|---|
| 565 | Can use new profiles tool to change SIDs (<filename>NTUser.DAT</filename>).
|
|---|
| 566 | </para>
|
|---|
| 567 | </listitem>
|
|---|
| 568 | </varlistentry>
|
|---|
| 569 |
|
|---|
| 570 | <varlistentry><term>Logon Scripts</term><listitem>
|
|---|
| 571 | <para>
|
|---|
| 572 | Know how they work.
|
|---|
| 573 | </para>
|
|---|
| 574 | </listitem>
|
|---|
| 575 | </varlistentry>
|
|---|
| 576 |
|
|---|
| 577 |
|
|---|
| 578 | <varlistentry><term>User and Group Mapping to UNIX/Linux</term><listitem>
|
|---|
| 579 | <para>
|
|---|
| 580 | <indexterm><primary>pdbedit</primary></indexterm>
|
|---|
| 581 | User and group mapping code is new. Many problems have been experienced as network administrators
|
|---|
| 582 | who are familiar with Samba-2.2.x migrate to Samba-3. Carefully study the chapters that document
|
|---|
| 583 | the new password backend behavior and the new group mapping functionality.
|
|---|
| 584 | </para>
|
|---|
| 585 | <itemizedlist>
|
|---|
| 586 | <listitem><para>The <parameter>username map</parameter> facility may be needed.</para></listitem>
|
|---|
| 587 | <listitem><para>Use <command>net groupmap</command> to connect NT4 groups to UNIX groups.</para></listitem>
|
|---|
| 588 | <listitem><para>
|
|---|
| 589 | Use <command>pdbedit</command> to set/change user configuration.
|
|---|
| 590 | </para>
|
|---|
| 591 |
|
|---|
| 592 | <para>
|
|---|
| 593 | When migrating to LDAP backend, it may be easier to dump the initial
|
|---|
| 594 | LDAP database to LDIF, edit, then reload into LDAP.
|
|---|
| 595 | </para></listitem>
|
|---|
| 596 | </itemizedlist></listitem>
|
|---|
| 597 | </varlistentry>
|
|---|
| 598 |
|
|---|
| 599 | <varlistentry><term>OS-Specific Scripts/Programs May be Needed</term><listitem>
|
|---|
| 600 | <para>
|
|---|
| 601 | Every operating system has its peculiarities. These are the result of engineering decisions
|
|---|
| 602 | that were based on the experience of the designer and may have side effects that were not
|
|---|
| 603 | anticipated. Limitations that may bite the Windows network administrator include:
|
|---|
| 604 | </para>
|
|---|
| 605 | <itemizedlist>
|
|---|
| 606 | <listitem><para>Add/Delete Users: Note OS limits on size of name
|
|---|
| 607 | (Linux 8 chars, NT4 up to 254 chars).</para></listitem>
|
|---|
| 608 | <listitem><para>Add/Delete Machines: Applied only to domain members
|
|---|
| 609 | (Note: machine names may be limited to 16 characters).</para></listitem>
|
|---|
| 610 | <listitem><para>Use <command>net groupmap</command> to connect NT4 groups to UNIX groups.</para></listitem>
|
|---|
| 611 | <listitem><para>Add/Delete Groups: Note OS limits on size and nature.
|
|---|
| 612 | Linux limit is 16 char, no spaces, and no uppercase chars (<command>groupadd</command>).</para></listitem>
|
|---|
| 613 | </itemizedlist></listitem>
|
|---|
| 614 | </varlistentry>
|
|---|
| 615 |
|
|---|
| 616 | <varlistentry><term>Migration Tools</term><listitem>
|
|---|
| 617 | <para>
|
|---|
| 618 | <indexterm><primary>pdbedit</primary></indexterm>
|
|---|
| 619 | Domain Control (NT4-Style) Profiles, Policies, Access Controls, Security
|
|---|
| 620 | <itemizedlist>
|
|---|
| 621 | <listitem><para>Samba: <command>net, rpcclient, smbpasswd, pdbedit, profiles</command></para></listitem>
|
|---|
| 622 | <listitem><para>Windows: <command>NT4 Domain User Manager, Server Manager (NEXUS)</command></para></listitem>
|
|---|
| 623 | </itemizedlist></para></listitem>
|
|---|
| 624 | </varlistentry>
|
|---|
| 625 | </variablelist>
|
|---|
| 626 |
|
|---|
| 627 | </sect2>
|
|---|
| 628 |
|
|---|
| 629 | </sect1>
|
|---|
| 630 |
|
|---|
| 631 | </chapter>
|
|---|
