| 1 | <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 35. Upgrading from Samba-2.x to Samba-3.0.23</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="The Official Samba-3 HOWTO and Reference Guide"><link rel="up" href="migration.html" title="Part IV. Migration and Updating"><link rel="prev" href="migration.html" title="Part IV. Migration and Updating"><link rel="next" href="NT4Migration.html" title="Chapter 36. Migration from NT4 PDC to Samba-3 PDC"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 35. Upgrading from Samba-2.x to Samba-3.0.23</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="migration.html">Prev</a> </td><th width="60%" align="center">Part IV. Migration and Updating</th><td width="20%" align="right"> <a accesskey="n" href="NT4Migration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="upgrading-to-3.0"></a>Chapter 35. Upgrading from Samba-2.x to Samba-3.0.23</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><code class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a href="mailto:jerry@samba.org">jerry@samba.org</a>></code></p></div></div></div></div><div><p class="pubdate">June 30, 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="upgrading-to-3.0.html#id432254">Quick Migration Guide</a></span></dt><dt><span class="sect1"><a href="upgrading-to-3.0.html#id432380">New Features in Samba-3</a></span></dt><dt><span class="sect1"><a href="upgrading-to-3.0.html#id432649">Configuration Parameter Changes</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrading-to-3.0.html#id432688">Removed Parameters</a></span></dt><dt><span class="sect2"><a href="upgrading-to-3.0.html#id432854">New Parameters</a></span></dt><dt><span class="sect2"><a href="upgrading-to-3.0.html#id433402">Modified Parameters (Changes in Behavior)</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrading-to-3.0.html#id433530">New Functionality</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrading-to-3.0.html#id433554">TDB Data Files</a></span></dt><dt><span class="sect2"><a href="upgrading-to-3.0.html#id433892">Changes in Behavior</a></span></dt><dt><span class="sect2"><a href="upgrading-to-3.0.html#id433980">Passdb Backends and Authentication</a></span></dt><dt><span class="sect2"><a href="upgrading-to-3.0.html#id434143">LDAP</a></span></dt></dl></dd></dl></div><p>
|
|---|
| 2 | <a class="indexterm" name="id432231"></a>
|
|---|
| 3 | <a class="indexterm" name="id432238"></a>
|
|---|
| 4 | <a class="indexterm" name="id432244"></a>
|
|---|
| 5 | This chapter deals exclusively with the differences between Samba-3.0.23 and Samba-2.2.8a.
|
|---|
| 6 | It points out where configuration parameters have changed, and provides a simple guide for
|
|---|
| 7 | the move from 2.2.x to 3.0.23.
|
|---|
| 8 | </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id432254"></a>Quick Migration Guide</h2></div></div></div><p>
|
|---|
| 9 | Samba-3.0.23 default behavior should be approximately the same as Samba-2.2.x.
|
|---|
| 10 | The default behavior when the new parameter <a class="indexterm" name="id432263"></a>passdb backend
|
|---|
| 11 | is not defined in the <code class="filename">smb.conf</code> file provides the same default behavior as Samba-2.2.x
|
|---|
| 12 | with <a class="indexterm" name="id432277"></a>encrypt passwords = Yes and
|
|---|
| 13 | will use the <code class="filename">smbpasswd</code> database.
|
|---|
| 14 | </p><p>
|
|---|
| 15 | <a class="indexterm" name="id432293"></a>
|
|---|
| 16 | <a class="indexterm" name="id432300"></a>
|
|---|
| 17 | So why say that <span class="emphasis"><em>behavior should be approximately the same as Samba-2.2.x</em></span>? Because
|
|---|
| 18 | Samba-3.0.23 can negotiate new protocols, such as support for native Unicode, that may result in
|
|---|
| 19 | differing protocol code paths being taken. The new behavior under such circumstances is not
|
|---|
| 20 | exactly the same as the old one. The good news is that the domain and machine SIDs will be
|
|---|
| 21 | preserved across the upgrade.
|
|---|
| 22 | </p><p>
|
|---|
| 23 | <a class="indexterm" name="id432317"></a>
|
|---|
| 24 | <a class="indexterm" name="id432324"></a>
|
|---|
| 25 | <a class="indexterm" name="id432331"></a>
|
|---|
| 26 | <a class="indexterm" name="id432337"></a>
|
|---|
| 27 | If the Samba-2.2.x system is using an LDAP backend, and there is no time to update the LDAP
|
|---|
| 28 | database, then make sure that <a class="indexterm" name="id432346"></a>passdb backend = ldapsam_compat
|
|---|
| 29 | is specified in the <code class="filename">smb.conf</code> file. For the rest, behavior should remain more or less the same.
|
|---|
| 30 | At a later date, when there is time to implement a new Samba-3-compatible LDAP backend, it is possible
|
|---|
| 31 | to migrate the old LDAP database to the new one through use of the <code class="literal">pdbedit</code>.
|
|---|
| 32 | See <a href="passdb.html#pdbeditthing" title="The pdbedit Tool">The <span class="emphasis"><em>pdbedit</em></span> Command</a>.
|
|---|
| 33 | </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id432380"></a>New Features in Samba-3</h2></div></div></div><p>
|
|---|
| 34 | The major new features are:
|
|---|
| 35 | </p><div class="orderedlist"><ol type="1"><li><p>
|
|---|
| 36 | <a class="indexterm" name="id432401"></a>
|
|---|
| 37 | <a class="indexterm" name="id432408"></a>
|
|---|
| 38 | Active Directory support. This release is able to join an ADS realm
|
|---|
| 39 | as a member server and authenticate users using LDAP/Kerberos.
|
|---|
| 40 | </p></li><li><p>
|
|---|
| 41 | <a class="indexterm" name="id432420"></a>
|
|---|
| 42 | <a class="indexterm" name="id432427"></a>
|
|---|
| 43 | Unicode support. Samba will now negotiate Unicode on the wire, and
|
|---|
| 44 | internally there is a much better infrastructure for multibyte
|
|---|
| 45 | and Unicode character sets.
|
|---|
| 46 | </p></li><li><p>
|
|---|
| 47 | <a class="indexterm" name="id432439"></a>
|
|---|
| 48 | New authentication system. The internal authentication system has
|
|---|
| 49 | been almost completely rewritten. Most of the changes are internal,
|
|---|
| 50 | but the new authoring system is also very configurable.
|
|---|
| 51 | </p></li><li><p>
|
|---|
| 52 | <a class="indexterm" name="id432452"></a>
|
|---|
| 53 | New filename mangling system. The filename mangling system has been
|
|---|
| 54 | completely rewritten. An internal database now stores mangling maps
|
|---|
| 55 | persistently.
|
|---|
| 56 | </p></li><li><p>
|
|---|
| 57 | <a class="indexterm" name="id432465"></a>
|
|---|
| 58 | New “<span class="quote">net</span>” command. A new “<span class="quote">net</span>” command has been added. It is
|
|---|
| 59 | somewhat similar to the “<span class="quote">net</span>” command in Windows. Eventually, we
|
|---|
| 60 | plan to replace a bunch of other utilities (such as smbpasswd)
|
|---|
| 61 | with subcommands in “<span class="quote">net</span>”.
|
|---|
| 62 | </p></li><li><p>
|
|---|
| 63 | <a class="indexterm" name="id432491"></a>
|
|---|
| 64 | Samba now negotiates NT-style status32 codes on the wire. This
|
|---|
| 65 | considerably improves error handling.
|
|---|
| 66 | </p></li><li><p>
|
|---|
| 67 | <a class="indexterm" name="id432503"></a>
|
|---|
| 68 | Better Windows 200x/XP printing support, including publishing
|
|---|
| 69 | printer attributes in Active Directory.
|
|---|
| 70 | </p></li><li><p>
|
|---|
| 71 | <a class="indexterm" name="id432515"></a>
|
|---|
| 72 | <a class="indexterm" name="id432522"></a>
|
|---|
| 73 | <a class="indexterm" name="id432529"></a>
|
|---|
| 74 | New loadable RPC modules for passdb backends and character sets.
|
|---|
| 75 | </p></li><li><p>
|
|---|
| 76 | <a class="indexterm" name="id432541"></a>
|
|---|
| 77 | New default dual-daemon winbindd support for better performance.
|
|---|
| 78 | </p></li><li><p>
|
|---|
| 79 | <a class="indexterm" name="id432552"></a>
|
|---|
| 80 | <a class="indexterm" name="id432559"></a>
|
|---|
| 81 | <a class="indexterm" name="id432566"></a>
|
|---|
| 82 | Support for migrating from a Windows NT 4.0 domain to a Samba
|
|---|
| 83 | domain and maintaining user, group, and domain SIDs.
|
|---|
| 84 | </p></li><li><p>
|
|---|
| 85 | <a class="indexterm" name="id432578"></a>
|
|---|
| 86 | <a class="indexterm" name="id432585"></a>
|
|---|
| 87 | Support for establishing trust relationships with Windows NT 4.0
|
|---|
| 88 | domain controllers.
|
|---|
| 89 | </p></li><li><p>
|
|---|
| 90 | <a class="indexterm" name="id432597"></a>
|
|---|
| 91 | <a class="indexterm" name="id432604"></a>
|
|---|
| 92 | <a class="indexterm" name="id432610"></a>
|
|---|
| 93 | Initial support for a distributed Winbind architecture using
|
|---|
| 94 | an LDAP directory for storing SID to UID/GID mappings.
|
|---|
| 95 | </p></li><li><p>
|
|---|
| 96 | Major updates to the Samba documentation tree.
|
|---|
| 97 | </p></li><li><p>
|
|---|
| 98 | <a class="indexterm" name="id432627"></a>
|
|---|
| 99 | <a class="indexterm" name="id432634"></a>
|
|---|
| 100 | Full support for client and server SMB signing to ensure
|
|---|
| 101 | compatibility with default Windows 2003 security settings.
|
|---|
| 102 | </p></li></ol></div><p>
|
|---|
| 103 | Plus lots of other improvements!
|
|---|
| 104 | </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id432649"></a>Configuration Parameter Changes</h2></div></div></div><p>
|
|---|
| 105 | This section contains a brief listing of changes to <code class="filename">smb.conf</code> options since the Samba-2.2.x series up to and
|
|---|
| 106 | including Samba-3.0.23.
|
|---|
| 107 | </p><p>
|
|---|
| 108 | Please refer to the smb.conf(5) man page for complete descriptions of new or modified
|
|---|
| 109 | parameters.
|
|---|
| 110 | </p><p>
|
|---|
| 111 | Whenever a Samba update or upgrade is performed it is highly recommended to read the file called
|
|---|
| 112 | <span class="emphasis"><em>WHATSNEW.txt</em></span> that is part of the Samba distribution tarball. This file may also
|
|---|
| 113 | be obtain on-line from the Samba <a href="http://www.samba.org/samba/" target="_top">web site</a>, in
|
|---|
| 114 | the right column, under Current Stable Release, by clicking on <span class="emphasis"><em>Release Notes</em></span>.
|
|---|
| 115 | </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id432688"></a>Removed Parameters</h3></div></div></div><a class="indexterm" name="id432693"></a><p>
|
|---|
| 116 | In alphabetical order, these are the parameters eliminated from Samba-2.2.x through 3.0.23.
|
|---|
| 117 | </p><div class="itemizedlist"><ul type="disc"><li><p>admin log</p></li><li><p>alternate permissions</p></li><li><p>character set</p></li><li><p>client codepage</p></li><li><p>code page directory</p></li><li><p>coding system</p></li><li><p>domain admin group</p></li><li><p>domain guest group</p></li><li><p>enable rid algorithm</p></li><li><p>enable svcctl</p></li><li><p>force unknown acl user</p></li><li><p>hosts equiv</p></li><li><p>ldap filter</p></li><li><p>min password length</p></li><li><p>nt smb support</p></li><li><p>post script</p></li><li><p>printer admin</p></li><li><p>printer driver</p></li><li><p>printer driver file</p></li><li><p>printer driver location</p></li><li><p>read size</p></li><li><p>source environment</p></li><li><p>status </p></li><li><p>strip dot </p></li><li><p>total print jobs</p></li><li><p>unicode</p></li><li><p>use rhosts</p></li><li><p>valid chars</p></li><li><p>vfs options</p></li><li><p>winbind enable local accounts</p></li><li><p>winbind max idle children</p></li><li><p>wins partners</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id432854"></a>New Parameters</h3></div></div></div><p>The following new parameters have been released up to and including Samba 3.0.23 (grouped by function:)</p><p>Remote Management</p><a class="indexterm" name="id432867"></a><div class="itemizedlist"><ul type="disc"><li><p>abort shutdown script</p></li><li><p>shutdown script</p></li></ul></div><p>User and Group Account Management</p><div class="itemizedlist"><ul type="disc"><li><p>add group script</p></li><li><p>add machine script</p></li><li><p>add user to group script</p></li><li><p>algorithmic rid base</p></li><li><p>delete group script</p></li><li><p>delete user from group script</p></li><li><p>passdb backend</p></li><li><p>rename user script</p></li><li><p>set primary group script</p></li><li><p>username map script</p></li></ul></div><p>Authentication</p><div class="itemizedlist"><ul type="disc"><li><p>auth methods</p></li><li><p>ldap password sync</p></li><li><p>passdb expand explicit</p></li><li><p>realm</p></li></ul></div><p>Protocol Options</p><div class="itemizedlist"><ul type="disc"><li><p>add port command</p></li><li><p>afs token lifetime</p></li><li><p>client lanman auth</p></li><li><p>client NTLMv2 auth</p></li><li><p>client schannel</p></li><li><p>client signing</p></li><li><p>client use spnego</p></li><li><p>defer sharing violations</p></li><li><p>disable netbios</p></li><li><p>dmapi support</p></li><li><p>enable privileges</p></li><li><p>use kerberos keytab</p></li><li><p>log nt token command</p></li><li><p>ntlm auth</p></li><li><p>paranoid server security </p></li><li><p>sendfile</p></li><li><p>server schannel</p></li><li><p>server signing</p></li><li><p>smb ports</p></li><li><p>svcctl list</p></li><li><p>use spnego</p></li></ul></div><p>File Service</p><div class="itemizedlist"><ul type="disc"><li><p>allocation roundup size</p></li><li><p>acl check permissions</p></li><li><p>acl group control</p></li><li><p>acl map full control</p></li><li><p>aio read size</p></li><li><p>aio write size</p></li><li><p>dfree cache time</p></li><li><p>dfree command</p></li><li><p>ea support</p></li><li><p>enable asu support</p></li><li><p>fam change notify</p></li><li><p>force unknown acl user</p></li><li><p>get quota command</p></li><li><p>hide special files</p></li><li><p>hide unwriteable files</p></li><li><p>inherit owner</p></li><li><p>hostname lookups</p></li><li><p>kernel change notify</p></li><li><p>mangle prefix</p></li><li><p>map acl inherit</p></li><li><p>map read only</p></li><li><p>max stat cache size</p></li><li><p>msdfs proxy</p></li><li><p>open files database hash size</p></li><li><p>set quota command</p></li><li><p>store dos attributes</p></li><li><p>use sendfile</p></li><li><p>usershare allow guests</p></li><li><p>usershare max shares</p></li><li><p>usershare owner only</p></li><li><p>usershare path</p></li><li><p>usershare prefix allow list</p></li><li><p>usershare prefix deny list</p></li><li><p>usershare template share</p></li><li><p>vfs objects</p></li></ul></div><p>Printing</p><div class="itemizedlist"><ul type="disc"><li><p>cups options</p></li><li><p>cups server</p></li><li><p>force printername</p></li><li><p>iprint server</p></li><li><p>max reported print jobs</p></li><li><p>printcap cache time</p></li></ul></div><p>Unicode and Character Sets</p><div class="itemizedlist"><ul type="disc"><li><p>display charset</p></li><li><p>dos charset</p></li><li><p>UNIX charset</p></li></ul></div><p>SID to UID/GID Mappings</p><div class="itemizedlist"><ul type="disc"><li><p>idmap backend</p></li><li><p>idmap gid</p></li><li><p>idmap uid</p></li><li><p>username map script</p></li><li><p>winbind nss info</p></li><li><p>winbind offline logon</p></li><li><p>winbind refresh tickets</p></li><li><p>winbind trusted domains only</p></li><li><p>template primary group</p></li></ul></div><p>LDAP</p><div class="itemizedlist"><ul type="disc"><li><p>ldap delete dn</p></li><li><p>ldap group suffix</p></li><li><p>ldap idmap suffix</p></li><li><p>ldap machine suffix</p></li><li><p>ldap passwd sync</p></li><li><p>ldap replication sleep</p></li><li><p>ldap timeout</p></li><li><p>ldap user suffix</p></li></ul></div><p>General Configuration</p><div class="itemizedlist"><ul type="disc"><li><p>eventlog list</p></li><li><p>preload modules</p></li><li><p>reset on zero vc</p></li><li><p>privatedir</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id433402"></a>Modified Parameters (Changes in Behavior)</h3></div></div></div><div class="itemizedlist"><ul type="disc"><li><p>acl group control (new default is No, deprecated parameter)</p></li><li><p>change notify timeout (scope changed)</p></li><li><p>dos filemode (disabled by default)</p></li><li><p>dos filetimes (enabled by default)</p></li><li><p>enable asu support (disabled by default)</p></li><li><p>enable privileges (enabled by default)</p></li><li><p>encrypt passwords (enabled by default) </p></li><li><p>host msdfs (enabled by default)</p></li><li><p>mangling method (set to hash2 by default) </p></li><li><p>map to guest</p></li><li><p>only user (deprecated)</p></li><li><p>passwd chat</p></li><li><p>passwd program</p></li><li><p>password server</p></li><li><p>restrict anonymous (integer value)</p></li><li><p>security (new ads value)</p></li><li><p>strict locking (auto by default)</p></li><li><p>winbind cache time (increased to 5 minutes)</p></li><li><p>winbind enum groups (disabled by default)</p></li><li><p>winbind enum users (disabled by default)</p></li><li><p>winbind nested groups (enabled by default)</p></li><li><p>winbind uid (deprecated in favor of idmap uid)</p></li><li><p>winbind gid (deprecated in favor of idmap gid)</p></li><li><p>winbindd nss info</p></li><li><p>write cache (deprecated)</p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id433530"></a>New Functionality</h2></div></div></div><p>
|
|---|
| 118 | <a class="indexterm" name="id433538"></a>
|
|---|
| 119 | The major changes in behavior since that Samba-2.2.x series are documented in this section.
|
|---|
| 120 | Please refer to the <code class="filename">WHATSNEW.txt</code> file that ships with every release of
|
|---|
| 121 | Samba to obtain detailed information regarding the changes that have been made during the
|
|---|
| 122 | life of the current Samba release.
|
|---|
| 123 | </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id433554"></a>TDB Data Files</h3></div></div></div><a class="indexterm" name="id433560"></a><p>
|
|---|
| 124 | Refer to <a href="install.html" title="Chapter 1. How to Install and Test SAMBA">Installation, Chapter 1</a>, <a href="install.html#tdbdocs" title="TDB Database File Information">Chapter 1</a>
|
|---|
| 125 | for information pertaining to the Samba-3 data files, their location and the information that must be
|
|---|
| 126 | preserved across server migrations, updates and upgrades.
|
|---|
| 127 | </p><p>
|
|---|
| 128 | <a class="indexterm" name="id433588"></a>
|
|---|
| 129 | Please remember to back up your existing ${lock directory}/*tdb before upgrading to Samba-3. If necessary, Samba will
|
|---|
| 130 | upgrade databases as they are opened. Downgrading from Samba-3 to 2.2, or reversion to an earlier version
|
|---|
| 131 | of Samba-3 from a later release, is an unsupported path.
|
|---|
| 132 | </p><p>
|
|---|
| 133 | <a class="indexterm" name="id433600"></a>
|
|---|
| 134 | The old Samba-2.2.x tdb files are described in <a href="upgrading-to-3.0.html#oldtdbfiledesc" title="Table 35.1. Samba-2.2.x TDB File Descriptions">the next table</a>.
|
|---|
| 135 | </p><div class="table"><a name="oldtdbfiledesc"></a><p class="title"><b>Table 35.1. Samba-2.2.x TDB File Descriptions</b></p><div class="table-contents"><table summary="Samba-2.2.x TDB File Descriptions" border="1"><colgroup><col align="left"><col align="justify"><col align="left"></colgroup><thead><tr><th align="left">Name</th><th align="justify">Description</th><th align="center">Backup?</th></tr></thead><tbody><tr><td align="left">account_policy</td><td align="justify">User policy settings</td><td align="left">yes</td></tr><tr><td align="left">brlock</td><td align="justify">Byte-range file locking information.</td><td align="left">no</td></tr><tr><td align="left">connections</td><td align="justify"><p>Client connection information</p></td><td align="left">no</td></tr><tr><td align="left">locking</td><td align="justify">Temporary file locking data.</td><td align="left">no</td></tr><tr><td align="left">messages</td><td align="justify"><p>Temporary storage of messages being processed by smbd.</p></td><td align="left">no</td></tr><tr><td align="left">ntdrivers</td><td align="justify"><p>Stores per-printer driver information.</p></td><td align="left">yes</td></tr><tr><td align="left">ntforms</td><td align="justify"><p>Stores per-printer forms information.</p></td><td align="left">yes</td></tr><tr><td align="left">ntprinters</td><td align="justify"><p>Stores the per-printer devmode configuration settings.</p></td><td align="left">yes</td></tr><tr><td align="left">printing/*.tdb</td><td align="justify"><p>Cached output from lpq command created on a per-print-service basis.</p></td><td align="left">no</td></tr><tr><td align="left">registry</td><td align="justify"><p>Read-only Samba registry skeleton that provides support for
|
|---|
| 136 | exporting various database tables via the winreg RPCs.</p></td><td align="left">no</td></tr><tr><td align="left">sessionid</td><td align="justify"><p>Temporary cache for miscellaneous session information.</p></td><td align="left">no</td></tr><tr><td align="left">share_info</td><td align="justify">Share ACL settings.</td><td align="left">yes</td></tr><tr><td align="left">unexpected</td><td align="justify"><p>Packets received for which no process was listening.</p></td><td align="left">no</td></tr><tr><td align="left">winbindd_cache</td><td align="justify"><p>Cache of identity information received from an NT4 or an ADS domain.</p></td><td align="left">yes</td></tr><tr><td align="left">winbindd_idmap</td><td align="justify"><p>New ID map table from SIDS to UNIX UIDs/GIDs.</p></td><td align="left">yes</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id433892"></a>Changes in Behavior</h3></div></div></div><p>
|
|---|
| 137 | The following issues are known changes in behavior between Samba-2.2 and
|
|---|
| 138 | Samba-3 that may affect certain installations of Samba.
|
|---|
| 139 | </p><div class="orderedlist"><ol type="1"><li><p>
|
|---|
| 140 | <a class="indexterm" name="id433911"></a>
|
|---|
| 141 | <a class="indexterm" name="id433918"></a>
|
|---|
| 142 | <a class="indexterm" name="id433925"></a>
|
|---|
| 143 | When operating as a member of a Windows domain, Samba-2.2 would map any users authenticated by the remote DC
|
|---|
| 144 | to the “<span class="quote">guest account</span>” if a UID could not be obtained via the getpwnam() call. Samba-3 rejects
|
|---|
| 145 | the connection with the error message “<span class="quote">NT_STATUS_LOGON_FAILURE.</span>” There is no current workaround
|
|---|
| 146 | to re-establish the Samba-2.2 behavior.
|
|---|
| 147 | </p></li><li><p>
|
|---|
| 148 | <a class="indexterm" name="id433946"></a>
|
|---|
| 149 | <a class="indexterm" name="id433953"></a>
|
|---|
| 150 | When adding machines to a Samba-2.2 controlled domain, the
|
|---|
| 151 | “<span class="quote">add user script</span>” was used to create the UNIX identity of the
|
|---|
| 152 | machine trust account. Samba-3 introduces a new “<span class="quote">add machine
|
|---|
| 153 | script</span>” that must be specified for this purpose. Samba-3 will
|
|---|
| 154 | not fall back to using the “<span class="quote">add user script</span>” in the absence of
|
|---|
| 155 | an “<span class="quote">add machine script</span>”.
|
|---|
| 156 | </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id433980"></a>Passdb Backends and Authentication</h3></div></div></div><p>
|
|---|
| 157 | There have been a few new changes that Samba administrators should be
|
|---|
| 158 | aware of when moving to Samba-3.
|
|---|
| 159 | </p><div class="orderedlist"><ol type="1"><li><p>
|
|---|
| 160 | <a class="indexterm" name="id434000"></a>
|
|---|
| 161 | Encrypted passwords have been enabled by default in order to
|
|---|
| 162 | interoperate better with out-of-the-box Windows client
|
|---|
| 163 | installations. This does mean that either (a) a Samba account
|
|---|
| 164 | must be created for each user, or (b) “<span class="quote">encrypt passwords = no</span>”
|
|---|
| 165 | must be explicitly defined in <code class="filename">smb.conf</code>.
|
|---|
| 166 | </p></li><li><p>
|
|---|
| 167 | <a class="indexterm" name="id434023"></a>
|
|---|
| 168 | <a class="indexterm" name="id434029"></a>
|
|---|
| 169 | <a class="indexterm" name="id434036"></a>
|
|---|
| 170 | Inclusion of new <a class="indexterm" name="id434043"></a>security = ads option for integration
|
|---|
| 171 | with an Active Directory domain using the native Windows Kerberos 5 and LDAP protocols.
|
|---|
| 172 | </p></li></ol></div><p>
|
|---|
| 173 | <a class="indexterm" name="id434055"></a>
|
|---|
| 174 | Samba-3 also includes the possibility of setting up chains of authentication methods (<a class="indexterm" name="id434063"></a>auth methods) and account storage backends (<a class="indexterm" name="id434071"></a>passdb backend). Please refer to
|
|---|
| 175 | the <code class="filename">smb.conf</code> man page and <a href="passdb.html" title="Chapter 11. Account Information Databases">Account Information Databases</a>, for
|
|---|
| 176 | details. While both parameters assume sane default values, it is likely that you will need to understand what
|
|---|
| 177 | the values actually mean in order to ensure Samba operates correctly.
|
|---|
| 178 | </p><p>
|
|---|
| 179 | <a class="indexterm" name="id434096"></a>
|
|---|
| 180 | <a class="indexterm" name="id434102"></a>
|
|---|
| 181 | <a class="indexterm" name="id434109"></a>
|
|---|
| 182 | Certain functions of the <code class="literal">smbpasswd</code> tool have been split between the
|
|---|
| 183 | new <code class="literal">smbpasswd</code> utility, the <code class="literal">net</code> tool, and the new <code class="literal">pdbedit</code>
|
|---|
| 184 | utility. See the respective man pages for details.
|
|---|
| 185 | </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id434143"></a>LDAP</h3></div></div></div><p>
|
|---|
| 186 | This section outlines the new features effecting Samba/LDAP integration.
|
|---|
| 187 | </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id434152"></a>New Schema</h4></div></div></div><p>
|
|---|
| 188 | <a class="indexterm" name="id434160"></a>
|
|---|
| 189 | <a class="indexterm" name="id434167"></a>
|
|---|
| 190 | <a class="indexterm" name="id434174"></a>
|
|---|
| 191 | <a class="indexterm" name="id434180"></a>
|
|---|
| 192 | A new object class (sambaSamAccount) has been introduced to replace
|
|---|
| 193 | the old sambaAccount. This change aids in the renaming of attributes
|
|---|
| 194 | to prevent clashes with attributes from other vendors. There is a
|
|---|
| 195 | conversion script (examples/LDAP/convertSambaAccount) to modify an LDIF
|
|---|
| 196 | file to the new schema.
|
|---|
| 197 | </p><p>
|
|---|
| 198 | Example:
|
|---|
| 199 | <a class="indexterm" name="id434193"></a>
|
|---|
| 200 | </p><pre class="screen">
|
|---|
| 201 | <code class="prompt">$ </code>ldapsearch .... -LLL -b "ou=people,dc=..." > old.ldif
|
|---|
| 202 | <code class="prompt">$ </code>convertSambaAccount --sid <DOM SID> --input old.ldif --output new.ldif
|
|---|
| 203 | </pre><p>
|
|---|
| 204 | <a class="indexterm" name="id434224"></a>
|
|---|
| 205 | The <DOM SID> can be obtained by running
|
|---|
| 206 | </p><pre class="screen">
|
|---|
| 207 | <code class="prompt">$ </code><strong class="userinput"><code>net getlocalsid <DOMAINNAME></code></strong>
|
|---|
| 208 | </pre><p>
|
|---|
| 209 | <a class="indexterm" name="id434249"></a>
|
|---|
| 210 | on the Samba PDC as root.
|
|---|
| 211 | </p><p>
|
|---|
| 212 | Under Samba-2.x the domain SID can be obtained by executing:
|
|---|
| 213 | <a class="indexterm" name="id434260"></a>
|
|---|
| 214 | </p><pre class="screen">
|
|---|
| 215 | <code class="prompt">$ </code><strong class="userinput"><code>smbpasswd -S <DOMAINNAME></code></strong>
|
|---|
| 216 | </pre><p>
|
|---|
| 217 | </p><p>
|
|---|
| 218 | <a class="indexterm" name="id434286"></a>
|
|---|
| 219 | <a class="indexterm" name="id434292"></a>
|
|---|
| 220 | <a class="indexterm" name="id434299"></a>
|
|---|
| 221 | <a class="indexterm" name="id434306"></a>
|
|---|
| 222 | The old <code class="literal">sambaAccount</code> schema may still be used by specifying the
|
|---|
| 223 | <em class="parameter"><code>ldapsam_compat</code></em> passdb backend. However, the sambaAccount and
|
|---|
| 224 | associated attributes have been moved to the historical section of
|
|---|
| 225 | the schema file and must be uncommented before use if needed.
|
|---|
| 226 | The Samba-2.2 object class declaration for a <code class="literal">sambaAccount</code> has not changed
|
|---|
| 227 | in the Samba-3 <code class="filename">samba.schema</code> file.
|
|---|
| 228 | </p><p>
|
|---|
| 229 | Other new object classes and their uses include:
|
|---|
| 230 | </p><div class="itemizedlist"><ul type="disc"><li><p>
|
|---|
| 231 | <a class="indexterm" name="id434350"></a>
|
|---|
| 232 | <a class="indexterm" name="id434356"></a>
|
|---|
| 233 | <a class="indexterm" name="id434363"></a>
|
|---|
| 234 | <a class="indexterm" name="id434370"></a>
|
|---|
| 235 | <a class="indexterm" name="id434376"></a>
|
|---|
| 236 | <a class="indexterm" name="id434383"></a>
|
|---|
| 237 | <code class="literal">sambaDomain</code> domain information used to allocate RIDs
|
|---|
| 238 | for users and groups as necessary. The attributes are added
|
|---|
| 239 | in “<span class="quote">ldap suffix</span>” directory entry automatically if
|
|---|
| 240 | an idmap UID/GID range has been set and the “<span class="quote">ldapsam</span>”
|
|---|
| 241 | passdb backend has been selected.
|
|---|
| 242 | </p></li><li><p>
|
|---|
| 243 | <a class="indexterm" name="id434412"></a>
|
|---|
| 244 | <a class="indexterm" name="id434419"></a>
|
|---|
| 245 | <a class="indexterm" name="id434426"></a>
|
|---|
| 246 | sambaGroupMapping an object representing the
|
|---|
| 247 | relationship between a posixGroup and a Windows
|
|---|
| 248 | group/SID. These entries are stored in the “<span class="quote">ldap
|
|---|
| 249 | group suffix</span>” and managed by the “<span class="quote">net groupmap</span>” command.
|
|---|
| 250 | </p></li><li><p>
|
|---|
| 251 | <a class="indexterm" name="id434448"></a>
|
|---|
| 252 | <a class="indexterm" name="id434455"></a>
|
|---|
| 253 | <a class="indexterm" name="id434462"></a>
|
|---|
| 254 | <a class="indexterm" name="id434468"></a>
|
|---|
| 255 | <code class="literal">sambaUNIXIdPool</code> created in the “<span class="quote">ldap idmap suffix</span>” entry
|
|---|
| 256 | automatically and contains the next available “<span class="quote">idmap UID</span>” and
|
|---|
| 257 | “<span class="quote">idmap GID</span>”.
|
|---|
| 258 | </p></li><li><p>
|
|---|
| 259 | <a class="indexterm" name="id434500"></a>
|
|---|
| 260 | <a class="indexterm" name="id434506"></a>
|
|---|
| 261 | <code class="literal">sambaIdmapEntry</code> object storing a mapping between a
|
|---|
| 262 | SID and a UNIX UID/GID. These objects are created by the
|
|---|
| 263 | idmap_ldap module as needed.
|
|---|
| 264 | </p></li></ul></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id434527"></a>New Suffix for Searching</h4></div></div></div><p>
|
|---|
| 265 | <a class="indexterm" name="id434534"></a>
|
|---|
| 266 | <a class="indexterm" name="id434540"></a>
|
|---|
| 267 | <a class="indexterm" name="id434547"></a>
|
|---|
| 268 | <a class="indexterm" name="id434554"></a>
|
|---|
| 269 | <a class="indexterm" name="id434561"></a>
|
|---|
| 270 | <a class="indexterm" name="id434568"></a>
|
|---|
| 271 | <a class="indexterm" name="id434574"></a>
|
|---|
| 272 | The following new <code class="filename">smb.conf</code> parameters have been added to aid in directing
|
|---|
| 273 | certain LDAP queries when <em class="parameter"><code>passdb backend = ldapsam://...</code></em> has been
|
|---|
| 274 | specified.
|
|---|
| 275 | </p><div class="itemizedlist"><ul type="disc"><li><p>ldap suffix used to search for user and computer accounts.</p></li><li><p>ldap user suffix used to store user accounts.</p></li><li><p>ldap machine suffix used to store machine trust accounts.</p></li><li><p>ldap group suffix location of posixGroup/sambaGroupMapping entries.</p></li><li><p>ldap idmap suffix location of sambaIdmapEntry objects.</p></li></ul></div><p>
|
|---|
| 276 | <a class="indexterm" name="id434638"></a>
|
|---|
| 277 | <a class="indexterm" name="id434645"></a>
|
|---|
| 278 | If an <em class="parameter"><code>ldap suffix</code></em> is defined, it will be appended to all of the
|
|---|
| 279 | remaining subsuffix parameters. In this case, the order of the suffix
|
|---|
| 280 | listings in <code class="filename">smb.conf</code> is important. Always place the <em class="parameter"><code>ldap suffix</code></em> first
|
|---|
| 281 | in the list.
|
|---|
| 282 | </p><p>
|
|---|
| 283 | Due to a limitation in Samba's <code class="filename">smb.conf</code> parsing, you should not surround
|
|---|
| 284 | the domain names with quotation marks.
|
|---|
| 285 | </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id434683"></a>IdMap LDAP Support</h4></div></div></div><p>
|
|---|
| 286 | <a class="indexterm" name="id434691"></a>
|
|---|
| 287 | Samba-3 supports an LDAP backend for the idmap subsystem. The
|
|---|
| 288 | following options inform Samba that the idmap table should be
|
|---|
| 289 | stored on the directory server <span class="emphasis"><em>onterose</em></span> in the ou=Idmap,dc=quenya,dc=org partition.
|
|---|
| 290 | </p><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td>...</td></tr><tr><td><a class="indexterm" name="id434722"></a><em class="parameter"><code>idmap backend = ldap:ldap://onterose/</code></em></td></tr><tr><td><a class="indexterm" name="id434735"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id434747"></a><em class="parameter"><code>idmap uid = 40000-50000</code></em></td></tr><tr><td><a class="indexterm" name="id434760"></a><em class="parameter"><code>idmap gid = 40000-50000</code></em></td></tr></table><p>
|
|---|
| 291 | <a class="indexterm" name="id434774"></a>
|
|---|
| 292 | This configuration allows Winbind installations on multiple servers to
|
|---|
| 293 | share a UID/GID number space, thus avoiding the interoperability problems
|
|---|
| 294 | with NFS that were present in Samba-2.2.
|
|---|
| 295 | </p></div></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="migration.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="migration.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="NT4Migration.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Part IV. Migration and Updating </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 36. Migration from NT4 PDC to Samba-3 PDC</td></tr></table></div></body></html>
|
|---|
