Context Navigation

source: vendor/3.5.9/docs/htmldocs/Samba3-ByExample/ntmigration.html

Visit:

Last change on this file was 597, checked in by Herwig Bauernfeind, 14 years ago
Samba 3.5: Update vendor to version 3.5.9
File size: 83.2 KB

Line
1	<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 9. Migrating NT4 Domain to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="upgrades.html" title="Chapter 8. Updating Samba-3"><link rel="next" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 9. Migrating NT4 Domain to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrades.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="nw4migration.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 9. Migrating NT4 Domain to Samba-3"><div class="titlepage"><div><div><h2 class="title"><a name="ntmigration"></a>Chapter 9. Migrating NT4 Domain to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ntmigration.html#id368988">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369064">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id369115">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369276">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id369580">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id369600">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id372263">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id372297">Questions and Answers</a></span></dt></dl></div><p>
2	Ever since Microsoft announced that it was discontinuing support for Windows
3	NT4, Samba users started to ask for detailed instructions on how to migrate
4	from NT4 to Samba-3. This chapter provides background information that should
5	meet these needs.
6	</p><p>
7	One wonders how many NT4 systems will be left in service by the time you read this
8	book though.
9	</p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id368988"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id368994"></a>
10	Network administrators who want to migrate off a Windows NT4 environment know
11	one thing with certainty. They feel that NT4 has been abandoned, and they want
12	to update. The desire to get off NT4 and to not adopt Windows 200x and Active
13	Directory is driven by a mixture of concerns over complexity, cost, fear of
14	failure, and much more.
15	</p><p>
16	<a class="indexterm" name="id369009"></a>
17	<a class="indexterm" name="id369016"></a>
18	<a class="indexterm" name="id369025"></a>
19	<a class="indexterm" name="id369035"></a>
20	The migration from NT4 to Samba-3 can involve a number of factors, including
21	migration of data to another server, migration of network environment controls
22	such as group policies, and migration of the users, groups, and machine
23	accounts.
24	</p><p>
25	<a class="indexterm" name="id369049"></a>
26	It should be pointed out now that it is possible to migrate some systems from
27	a Windows NT4 domain environment to a Samba-3 domain environment. This is certainly
28	not possible in every case. It is possible to just migrate the domain accounts
29	to Samba-3 and then to switch machines, but as a hands-off transition, this is more
30	the exception than the rule. Most systems require some tweaking after
31	migration before an environment that is acceptable for immediate use
32	is obtained.
33	</p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id369064"></a>Assignment Tasks</h3></div></div></div><p>
34	<a class="indexterm" name="id369071"></a>
35	<a class="indexterm" name="id369078"></a>
36	<a class="indexterm" name="id369085"></a>
37	You are about to migrate an MS Windows NT4 domain accounts database to
38	a Samba-3 server. The Samba-3 server is using a
39	<em class="parameter"><code>passdb backend</code></em> based on LDAP. The
40	<code class="constant">ldapsam</code> is ideal because an LDAP backend can be distributed
41	for use with BDCs generally essential for larger networks.
42	</p><p>
43	Your objective is to document the process of migrating user and group accounts
44	from several NT4 domains into a single Samba-3 LDAP backend database.
45	</p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id369115"></a>Dissection and Discussion</h2></div></div></div><p>
46	<a class="indexterm" name="id369123"></a>
47	<a class="indexterm" name="id369129"></a>
48	<a class="indexterm" name="id369135"></a>
49	<a class="indexterm" name="id369147"></a>
50	<a class="indexterm" name="id369158"></a>
51	<a class="indexterm" name="id369165"></a>
52	The migration process takes a snapshot of information that is stored in the
53	Windows NT4 registry-based accounts database. That information resides in
54	the Security Account Manager (SAM) portion of the NT4 registry under keys called
55	<code class="constant">SAM</code> and <code class="constant">SECURITY</code>.
56	</p><div class="warning" title="Warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
57	<a class="indexterm" name="id369187"></a>
58	<a class="indexterm" name="id369194"></a>
59	The Windows NT4 registry keys called <code class="constant">SAM</code> and <code class="constant">SECURITY</code>
60	are protected so that you cannot view the contents. If you change the security setting
61	to reveal the contents under these hive keys, your Windows NT4 domain is crippled. Do not
62	do this unless you are willing to render your domain controller inoperative.
63	</p></div><p>
64	<a class="indexterm" name="id369214"></a>
65	<a class="indexterm" name="id369223"></a>
66	Before commencing an NT4 to Samba-3 migration, you should consider what your objectives are.
67	While in some cases it is possible simply to migrate an NT4 domain to a single Samba-3 server,
68	that may not be a good idea from an administration perspective. Since the process involves going
69	through a certain amount of disruptive activity anyhow, why not take this opportunity to
70	review the structure of the network, how Windows clients are controlled and how they
71	interact with the network environment.
72	</p><p>
73	<a class="indexterm" name="id369237"></a>
74	<a class="indexterm" name="id369246"></a>
75	<a class="indexterm" name="id369253"></a>
76	MS Windows NT4 was introduced some time around 1996. Many environments in which NT4 was deployed
77	have done little to keep the NT4 server environment up to date with more recent Windows releases,
78	particularly Windows XP Professional. The migration provides opportunity to revise and update
79	roaming profile deployment as well as folder redirection. Given that you must port the
80	greater network configuration of this from the old NT4 server to the new Samba-3 server.
81	Do not forget to validate the security descriptors in the profiles share as well as network logon
82	scripts. Feedback from sites that are migrating to Samba-3 suggests that many are using this
83	as a good time to update desktop systems also. In all, the extra effort should constitute no
84	real disruption to users, but rather, with due diligence and care, should make their network experience
85	a much happier one.
86	</p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id369276"></a>Technical Issues</h3></div></div></div><p>
87	<a class="indexterm" name="id369284"></a>
88	<a class="indexterm" name="id369291"></a>
89	Migration of an NT4 domain user and group database to Samba-3 involves a certain strategic
90	element. Many sites have asked for instructions regarding merging of multiple NT4
91	domains into one Samba-3 LDAP database. It seems that this is viewed as a significant
92	added value compared with the alternative of migration to Windows Server 200x and Active
93	Directory. The diagram in <a class="link" href="ntmigration.html#ch8-migration" title="Figure 9.1. Schematic Explaining the net rpc vampire Process">“Schematic Explaining the net rpc vampire Process”</a> illustrates the effect of migration
94	from a Windows NT4 domain to a Samba domain.
95	</p><div class="figure"><a name="ch8-migration"></a><p class="title"><b>Figure 9.1. Schematic Explaining the <code class="literal">net rpc vampire</code> Process</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch8-migration.png" width="297" alt="Schematic Explaining the net rpc vampire Process"></div></div></div><br class="figure-break"><p>
96	<a class="indexterm" name="id369358"></a>
97	<a class="indexterm" name="id369365"></a>
98	If you want to merge multiple NT4 domain account databases into one Samba domain,
99	you must now dump the contents of the first migration and edit it as appropriate. Now clean
100	out (remove) the tdbsam backend file (<code class="filename">passdb.tdb</code>) or the LDAP database
101	files. You must start each migration with a new database into which you merge your NT4
102	domains.
103	</p><p><a class="indexterm" name="id369383"></a>
104	At this point, you are ready to perform the second migration, following the same steps as
105	for the first. In other words, dump the database, edit it, and then you may merge the
106	dump for the first and second migrations.
107	</p><p><a class="indexterm" name="id369396"></a><a class="indexterm" name="id369404"></a><a class="indexterm" name="id369412"></a>
108	You must be careful. If you choose to migrate to an LDAP backend, your dump file
109	now contains the full account information, including the domain SID. The domain SID for each
110	of the two NT4 domains will be different. You must choose one and change the domain
111	portion of the account SIDs so that all are the same.
112	</p><p>
113	<a class="indexterm" name="id369427"></a>
114	<a class="indexterm" name="id369433"></a>
115	<a class="indexterm" name="id369440"></a>
116	<a class="indexterm" name="id369447"></a>
117	<a class="indexterm" name="id369454"></a>
118	<a class="indexterm" name="id369461"></a>
119	<a class="indexterm" name="id369467"></a>
120	<a class="indexterm" name="id369474"></a>
121	<a class="indexterm" name="id369481"></a>
122	<a class="indexterm" name="id369488"></a>
123	<a class="indexterm" name="id369495"></a>
124	<a class="indexterm" name="id369501"></a>
125	If you choose to use a tdbsam (<code class="filename">passdb.tdb</code>) backend file, your best choice
126	is to use <code class="literal">pdbedit</code> to export the contents of the tdbsam file into an
127	smbpasswd data file. This automatically strips out all domain-specific information,
128	such as logon hours, logon machines, logon script, profile path, as well as the domain SID.
129	The resulting file can be easily merged with other migration attempts (each of which must start
130	with a clean file). It should also be noted that all users who end up in the merged smbpasswd
131	file must have an account in <code class="filename">/etc/passwd</code>. The resulting smbpasswd file
132	may be exported or imported into either a tdbsam (<code class="filename">passdb.tdb</code>) or
133	an LDAP backend.
134	</p><div class="figure"><a name="NT4DUM"></a><p class="title"><b>Figure 9.2. View of Accounts in NT4 Domain User Manager</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UserMgrNT4.png" width="270" alt="View of Accounts in NT4 Domain User Manager"></div></div></div><br class="figure-break"></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id369580"></a>Political Issues</h3></div></div></div><p>
135	The merging of multiple Windows NT4-style domains into a single LDAP-backend-based Samba-3
136	domain may be seen by those who had power over them as a loss of prestige or a loss of
137	power. The imposition of a single domain may even be seen as a threat. So in migrating and
138	merging account databases, be consciously aware of the political fall-out in which you
139	may find yourself entangled when key staff feel a loss of prestige.
140	</p><p>
141	The best advice that can be given to those who set out to merge NT4 domains into a single
142	Samba-3 domain is to promote (sell) the action as one that reduces costs and delivers
143	greater network interoperability and manageability.
144	</p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id369600"></a>Implementation</h2></div></div></div><p>
145	From feedback on the Samba mailing lists, it seems that most Windows NT4 migrations
146	to Samba-3 are being performed using a new server or a new installation of a Linux or UNIX
147	server. If you contemplate doing this, please note that the steps that follow in this
148	chapter assume familiarity with the information that has been previously covered in this
149	book. You are particularly encouraged to be familiar with <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a>,
150	<a class="link" href="Big500users.html" title="Chapter 4. The 500-User Office">“The 500-User Office”</a> and <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>.
151	</p><p>
152	We present here the steps and example output for two NT4 to Samba-3 domain migrations. The
153	first uses an LDAP-based backend, and the second uses a tdbsam backend. In each case the
154	scripts you specify in the <code class="filename">smb.conf</code> file for the <em class="parameter"><code>add user script</code></em>
155	collection of parameters are used to effect the addition of accounts into the passdb backend.
156	</p><p>
157	Before proceeding to NT4 migration using either a tdbsam or ldapsam, it is most strongly recommended to
158	review <a class="link" href="Big500users.html#ch5-dnshcp-setup" title="Installation of DHCP, DNS, and Samba Control Files">“Installation of DHCP, DNS, and Samba Control Files”</a> for DNS and DHCP configuration. The importance of correctly
159	functioning name resolution must be recognized. This applies equally for both hostname and NetBIOS names
160	(machine names, computer names, domain names, workgroup names ALL names!).
161	</p><p>
162	The migration process involves the following steps:
163	</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
164	Prepare the target Samba-3 server. This involves configuring Samba-3 for
165	migration to either a tdbsam or an ldapsam backend.
166	</p></li><li class="listitem"><p>
167	<a class="indexterm" name="id369676"></a>
168	<a class="indexterm" name="id369682"></a>
169	<a class="indexterm" name="id369688"></a>
170	Clean up the source NT4 PDC. Delete all accounts that need not be migrated.
171	Delete all files that should not be migrated. Where possible, change NT group
172	names so there are no spaces or uppercase characters. This is important if
173	the target UNIX host insists on POSIX-compliant all lowercase user and group
174	names.
175	</p></li><li class="listitem"><p>
176	Step through the migration process.
177	</p></li><li class="listitem"><p><a class="indexterm" name="id369706"></a>
178	Remove the NT4 PDC from the network.
179	</p></li><li class="listitem"><p>
180	Upgrade the Samba-3 server from a BDC to a PDC, and validate all account
181	information.
182	</p></li></ul></div><p>
183	It may help to use the above outline as a pre-migration checklist.
184	</p><div class="sect2" title="NT4 Migration Using LDAP Backend"><div class="titlepage"><div><div><h3 class="title"><a name="id369724"></a>NT4 Migration Using LDAP Backend</h3></div></div></div><p>
185	In this example, the migration is of an NT4 PDC to a Samba-3 PDC with an LDAP backend. The accounts about
186	to be migrated are shown in <a class="link" href="ntmigration.html#NT4DUM" title="Figure 9.2. View of Accounts in NT4 Domain User Manager">“View of Accounts in NT4 Domain User Manager”</a>. In this example use is made of the
187	smbldap-tools scripts to add the accounts that are migrated into the ldapsam passdb backend.
188	Four scripts are essential to the migration process. Other scripts will be required
189	for daily management, but these are not critical to migration. The critical scripts are dependant
190	on which passdb backend is being used. Refer to <a class="link" href="ntmigration.html#ch8-vampire" title="Table 9.1. Samba smb.conf Scripts Essential to Samba Operation">“Samba smb.conf Scripts Essential to Samba Operation”</a> to see which scripts
191	must be provided so that the migration process can complete.
192	</p><p>
193	Verify that you have correctly specified in the <code class="filename">smb.conf</code> file the scripts and arguments
194	that should be passed to them before attempting to perform the account migration. Note also
195	that the deletion scripts must be commented out during migration. These should be uncommented
196	following successful migration of the NT4 Domain accounts.
197	</p><div class="warning" title="Warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
198	Under absolutely no circumstances should the Samba daemons be started until instructed to do so.
199	Delete the <code class="filename">/etc/samba/secrets.tdb</code> file and all Samba control tdb files
200	before commencing the following configuration steps.
201	</p></div><div class="table"><a name="ch8-vampire"></a><p class="title"><b>Table 9.1. Samba <code class="filename">smb.conf</code> Scripts Essential to Samba Operation</b></p><div class="table-contents"><table summary="Samba smb.conf Scripts Essential to Samba Operation" border="1"><colgroup><col align="left"><col align="center"><col align="center"></colgroup><thead><tr><th align="left">Entity</th><th align="center">ldapsam Script</th><th align="center">tdbsam Script</th></tr></thead><tbody><tr><td align="left">Add User Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr><tr><td align="left">Delete User Accounts</td><td align="center">smbldap-userdel</td><td align="center">userdel</td></tr><tr><td align="left">Add Group Accounts</td><td align="center">smbldap-groupadd</td><td align="center">groupadd</td></tr><tr><td align="left">Delete Group Accounts</td><td align="center">smbldap-groupdel</td><td align="center">groupdel</td></tr><tr><td align="left">Add User to Group</td><td align="center">smbldap-groupmod</td><td align="center">usermod (See Note)</td></tr><tr><td align="left">Add Machine Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr></tbody></table></div></div><br class="table-break"><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
202	<a class="indexterm" name="id369914"></a>
203	<a class="indexterm" name="id369921"></a>
204	<a class="indexterm" name="id369928"></a>
205	The UNIX/Linux <code class="literal">usermod</code> utility does not permit simple user addition to (or deletion
206	of users from) groups. This is a feature provided by the smbldap-tools scripts. If you want this
207	capability, you must create your own tool to do this. Alternately, you can search the Web
208	to locate a utility called <code class="literal">groupmem</code> (by George Kraft) that provides this functionality.
209	The <code class="literal">groupmem</code> utility was contributed to the shadow package but has not surfaced
210	in the formal commands provided by Linux distributions (March 2004).
211	</p></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
212	<a class="indexterm" name="id369961"></a>
213	The <code class="literal">tdbdump</code> utility is a utility that you can build from the Samba source-code tree. Not all Linux binary distributions include this tool. If it is missing from your
214	Linux distribution, you will need to build this yourself or else forgo its use.
215	</p></div><p>
216	<a class="indexterm" name="id369979"></a>
217	Before starting the migration, all dead accounts were removed from the NT4 domain using the User Manager for Domains.
218	</p><div class="procedure" title="Procedure 9.1. User Migration Steps"><a name="id369988"></a><p class="title"><b>Procedure 9.1. User Migration Steps</b></p><div class="example"><a name="sbent4smb"></a><p class="title"><b>Example 9.1. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id370046"></a><em class="parameter"><code>workgroup = DAMNATION</code></em></td></tr><tr><td><a class="indexterm" name="id370057"></a><em class="parameter"><code>netbios name = MERLIN</code></em></td></tr><tr><td><a class="indexterm" name="id370068"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id370080"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id370092"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id370103"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id370115"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id370126"></a><em class="parameter"><code>smb ports = 139 445</code></em></td></tr><tr><td><a class="indexterm" name="id370138"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id370149"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id370161"></a><em class="parameter"><code>#delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id370173"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id370185"></a><em class="parameter"><code>#delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id370197"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/ smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id370209"></a><em class="parameter"><code>#delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id370221"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id370233"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id370245"></a><em class="parameter"><code>logon script = scripts\logon.cmd</code></em></td></tr><tr><td><a class="indexterm" name="id370257"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id370268"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id370280"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id370291"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370303"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id370314"></a><em class="parameter"><code>#wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370326"></a><em class="parameter"><code>wins server = 192.168.123.124</code></em></td></tr><tr><td><a class="indexterm" name="id370337"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id370349"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id370360"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id370372"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id370384"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370395"></a><em class="parameter"><code>ldap suffix = dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id370407"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id370418"></a><em class="parameter"><code>ldap timeout = 20</code></em></td></tr><tr><td><a class="indexterm" name="id370430"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id370441"></a><em class="parameter"><code>idmap backend = ldap:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id370453"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id370464"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id370476"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370487"></a><em class="parameter"><code>ea support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370499"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbent4smb2"></a><p class="title"><b>Example 9.2. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id370543"></a><em class="parameter"><code>comment = Application Data</code></em></td></tr><tr><td><a class="indexterm" name="id370555"></a><em class="parameter"><code>path = /data/home/apps</code></em></td></tr><tr><td><a class="indexterm" name="id370566"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id370587"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id370598"></a><em class="parameter"><code>path = /home/users/%U/Documents</code></em></td></tr><tr><td><a class="indexterm" name="id370610"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id370622"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id370633"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id370653"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id370665"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id370676"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370688"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370699"></a><em class="parameter"><code>use client driver = No</code></em></td></tr><tr><td><a class="indexterm" name="id370711"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id370731"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id370743"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id370754"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370766"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id370786"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id370798"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id370809"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id370821"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id370841"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id370853"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id370864"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id370876"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id370896"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id370908"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbentslapd"></a><p class="title"><b>Example 9.3. NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</b></p><div class="example-contents"><pre class="screen">
219	include /etc/openldap/schema/core.schema
220	include /etc/openldap/schema/cosine.schema
221	include /etc/openldap/schema/inetorgperson.schema
222	include /etc/openldap/schema/nis.schema
223	include /etc/openldap/schema/samba3.schema
224
225	pidfile /var/run/slapd/slapd.pid
226	argsfile /var/run/slapd/slapd.args
227
228	access to dn.base=""
229	by self write
230	by * auth
231
232	access to attr=userPassword
233	by self write
234	by * auth
235
236	access to attr=shadowLastChange
237	by self write
238	by * read
239
240	access to *
241	by * read
242	by anonymous auth
243	</pre></div></div><br class="example-break"><div class="example"><a name="sbentslapd2"></a><p class="title"><b>Example 9.4. NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part B</b></p><div class="example-contents"><pre class="screen">
244	#loglevel 256
245
246	#schemacheck on
247	idletimeout 30
248	#backend bdb
249	database bdb
250	checkpoint 1024 5
251	cachesize 10000
252
253	suffix "dc=terpstra-world,dc=org"
254	rootdn "cn=Manager,dc=terpstra-world,dc=org"
255
256	# rootpw = not24get
257	rootpw {SSHA}86kTavd9Dw3FAz6qzWTrCOKX/c0Qe+UV
258
259	directory /var/lib/ldap
260
261	# Indices to maintain
262	index objectClass eq
263	index cn pres,sub,eq
264	index sn pres,sub,eq
265	index uid pres,sub,eq
266	index displayName pres,sub,eq
267	index uidNumber eq
268	index gidNumber eq
269	index memberUID eq
270	index sambaSID eq
271	index sambaPrimaryGroupSID eq
272	index sambaDomainName eq
273	index default sub
274	</pre></div></div><br class="example-break"><div class="example"><a name="sbrntldapconf"></a><p class="title"><b>Example 9.5. NT4 Migration NSS LDAP File: <code class="filename">/etc/ldap.conf</code></b></p><div class="example-contents"><pre class="screen">
275	host 127.0.0.1
276
277	base dc=terpstra-world,dc=org
278
279	ldap_version 3
280
281	binddn cn=Manager,dc=terpstra-world,dc=org
282	bindpw not24get
283
284	pam_password exop
285
286	nss_base_passwd ou=People,dc=terpstra-world,dc=org?one
287	nss_base_shadow ou=People,dc=terpstra-world,dc=org?one
288	nss_base_group ou=Groups,dc=terpstra-world,dc=org?one
289
290	ssl off
291	</pre></div></div><br class="example-break"><div class="example"><a name="sbentnss"></a><p class="title"><b>Example 9.6. NT4 Migration NSS Control File: <code class="filename">/etc/nsswitch.conf</code> (Stage:1)</b></p><div class="example-contents"><pre class="screen">
292	passwd: files #ldap
293	shadow: files #ldap
294	group: files #ldap
295
296	hosts: files dns wins
297	networks: files dns
298
299	services: files
300	protocols: files
301	rpc: files
302	ethers: files
303	netmasks: files
304	netgroup: files
305	publickey: files
306
307	bootparams: files
308	automount: files nis
309	aliases: files
310	#passwd_compat: ldap #Not needed.
311	#group_compat: ldap #Not needed.
312	</pre></div></div><br class="example-break"><div class="example"><a name="sbentnss2"></a><p class="title"><b>Example 9.7. NT4 Migration NSS Control File: <code class="filename">/etc/nsswitch.conf</code> (Stage:2)</b></p><div class="example-contents"><pre class="screen">
313	passwd: files ldap
314	shadow: files ldap
315	group: files ldap
316
317	hosts: files dns wins
318	networks: files dns
319
320	services: files
321	protocols: files
322	rpc: files
323	ethers: files
324	netmasks: files
325	netgroup: files
326	publickey: files
327
328	bootparams: files
329	automount: files nis
330	aliases: files
331	#passwd_compat: ldap #Not needed.
332	#group_compat: ldap #Not needed.
333	</pre></div></div><br class="example-break"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
334	Configure the Samba <code class="filename">smb.conf</code> file to create a BDC. An example configuration is
335	given in <a class="link" href="ntmigration.html#sbent4smb" title="Example 9.1. NT4 Migration Samba-3 Server smb.conf Part: A">“NT4 Migration Samba-3 Server smb.conf Part: A”</a>.
336	The delete scripts are commented out so that during the process of migration
337	no account information can be deleted.
338	</p></li><li class="step" title="Step 2"><p>
339	<a class="indexterm" name="id370926"></a>
340	Configure OpenLDAP in preparation for the migration. An example
341	<code class="filename">sladp.conf</code> file is shown in <a class="link" href="ntmigration.html#sbentslapd" title="Example 9.3. NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A">“NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A”</a>.
342	The <code class="constant">rootpw</code> value is an encrypted password string that can
343	be obtained by executing the <code class="literal">slappasswd</code> command.
344	</p></li><li class="step" title="Step 3"><p>
345	<a class="indexterm" name="id371025"></a>
346	<a class="indexterm" name="id371032"></a>
347	Install the PADL <code class="literal">nss_ldap</code> tool set, then configure the <code class="filename">/etc/ldap.conf</code>
348	as shown in <a class="link" href="ntmigration.html#sbrntldapconf" title="Example 9.5. NT4 Migration NSS LDAP File: /etc/ldap.conf">“NT4 Migration NSS LDAP File: /etc/ldap.conf”</a>.
349	</p></li><li class="step" title="Step 4"><p>
350	<a class="indexterm" name="id371087"></a>
351	Edit the <code class="filename">/etc/nsswitch.conf</code> file so it has the entries shown
352	in <a class="link" href="ntmigration.html#sbentnss" title="Example 9.6. NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)">“NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)”</a>. Note that the LDAP entries have been commented out.
353	This is deliberate. If these entries are active (not commented out), and the
354	<code class="filename">/etc/ldap.conf</code> file has been configured, when the LDAP server
355	is started, the process of starting the LDAP server will cause LDAP lookups. This
356	causes the LDAP server <code class="literal">slapd</code> to hang because it finds port 389
357	open and therefore cannot gain exclusive control of it. By commenting these entries
358	out, it is possible to avoid this gridlock situation and thus the overall
359	installation and configuration will progress more smoothly.
360	</p></li><li class="step" title="Step 5"><p>
361	Validate the the target NT4 PDC name is being correctly resolved to its IP address by
362	executing the following:
363	</p><pre class="screen">
364	<code class="prompt">root# </code> ping transgression
365	PING transgression.terpstra-world.org (192.168.1.5) 56(84) bytes of data.
366	64 bytes from (192.168.1.5): icmp_seq=1 ttl=128 time=0.159 ms
367	64 bytes from (192.168.1.5): icmp_seq=2 ttl=128 time=0.192 ms
368	64 bytes from (192.168.1.5): icmp_seq=3 ttl=128 time=0.141 ms
369
370	--- transgression.terpstra-world.org ping statistics ---
371	3 packets transmitted, 3 received, 0% packet loss, time 2000ms
372	rtt min/avg/max/mdev = 0.141/0.164/0.192/0.021 ms
373	</pre><p>
374	Do not proceed to the next step if this step fails. It is imperative that the name of the PDC
375	can be resolved to its IP address. If this is broken, fix it.
376	</p></li><li class="step" title="Step 6"><p>
377	Pull the domain SID from the NT4 domain that is being migrated as follows:
378	</p><pre class="screen">
379	<code class="prompt">root# </code> net rpc getsid -S TRANGRESSION -U Administrator%not24get
380	Storing SID S-1-5-21-1385457007-882775198-1210191635 \
381	for Domain DAMNATION in secrets.tdb
382	</pre><p>
383	</p><p>
384	Another way to obtain the domain SID from the target NT4 domain that is being
385	migrated to Samba-3 is by executing the following:
386	</p><pre class="screen">
387	<code class="prompt">root# </code> net rpc info -S TRANSGRESSION
388	</pre><p>
389	If this method is used, do not forget to store the SID obtained into the
390	<code class="filename">secrets.tdb</code> file. This can be done by executing:
391	</p><pre class="screen">
392	<code class="prompt">root# </code> net setlocalsid S-1-5-21-1385457007-882775198-1210191635
393	</pre><p>
394	</p></li><li class="step" title="Step 7"><p>
395	<a class="indexterm" name="id371235"></a>
396	<a class="indexterm" name="id371242"></a>
397	<a class="indexterm" name="id371249"></a>
398	<a class="indexterm" name="id371256"></a>
399	Install the Idealx <code class="literal">smbldap-tools</code> software package, following
400	the instructions given in <a class="link" href="happy.html#sbeidealx" title="Install and Configure Idealx smbldap-tools Scripts">“Install and Configure Idealx smbldap-tools Scripts”</a>. The resulting perl scripts
401	should be located in the <code class="filename">/opt/IDEALX/sbin</code> directory.
402	Change into that location, or wherever the scripts have been installed. Execute the
403	<code class="filename">configure.pl</code> script to configure the Idealx package for use.
404	Note: Use the domain SID obtained from the step above. The following is
405	an example configuration session:
406	</p><pre class="screen">
407	<code class="prompt">root# </code> ./configure.pl
408	-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
409	smbldap-tools script configuration
410	-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
411	Before starting, check
412	. if your samba controller is up and running.
413	. if the domain SID is defined
414	(you can get it with the 'net getlocalsid')
415
416	. you can leave the configuration using the Crtl-c key combination
417	. empty value can be set with the "." character
418	-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
419	Looking for configuration files...
420
421	Samba Config File Location [/etc/samba/smb.conf] >
422	smbldap Config file Location (global parameters)
423	[/etc/smbldap-tools/smbldap.conf] >
424	smbldap Config file Location (bind parameters)
425	[/etc/smbldap-tools/smbldap_bind.conf] >
426	-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
427	Let's start configuring the smbldap-tools scripts ...
428
429	. workgroup name: name of the domain Samba act as a PDC
430	workgroup name [DAMNATION] >
431	. netbios name: netbios name of the samba controller
432	netbios name [MERLIN] >
433	. logon drive: local path to which the home directory
434	will be connected (for NT Workstations). Ex: 'H:'
435	logon drive [X:] > H:
436	. logon home: home directory location (for Win95/98 or NT Workstation)
437	(use %U as username) Ex:'\\MERLIN\home\%U'
438	logon home (leave blank if you don't want homeDirectory)
439	[\\MERLIN\home\%U] > \\%L\%U
440	. logon path: directory where roaming profiles are stored.
441	Ex:'\\MERLIN\profiles\%U'
442	logon path (leave blank if you don't want roaming profile)
443	[\\MERLIN\profiles\%U] > \\%L\profiles\%U
444	. home directory prefix (use %U as username) [/home/%U] >
445	/home/users/%U
446	. default user netlogon script (use %U as username)
447	[%U.cmd] > scripts\logon.cmd
448	default password validation time (time in days) [45] > 180
449	. ldap suffix [dc=terpstra-world,dc=org] >
450	. ldap group suffix [ou=Groups] >
451	. ldap user suffix [ou=People] >
452	. ldap machine suffix [ou=People] >
453	. Idmap suffix [ou=Idmap] >
454	. sambaUnixIdPooldn: object where you want to store the next uidNumber
455	and gidNumber available for new users and groups
456	sambaUnixIdPooldn object (relative to ${suffix})
457	[sambaDomainName=DAMNATION] >
458	. ldap master server:
459	IP address or DNS name of the master (writable) ldap server
460	ldap master server [] > 127.0.0.1
461	. ldap master port [389] >
462	. ldap master bind dn [cn=Manager,dc=terpstra-world,dc=org] >
463	. ldap master bind password [] >
464	. ldap slave server: IP address or DNS name of the slave ldap server:
465	can also be the master one
466	ldap slave server [] > 127.0.0.1
467	. ldap slave port [389] >
468	. ldap slave bind dn [cn=Manager,dc=terpstra-world,dc=org] >
469	. ldap slave bind password [] >
470	. ldap tls support (1/0) [0] >
471	. SID for domain DAMNATION: SID of the domain
472	(can be obtained with 'net getlocalsid MERLIN')
473	SID for domain DAMNATION []
474	> S-1-5-21-1385457007-882775198-1210191635
475	. unix password encryption: encryption used for unix passwords
476	unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA) [SSHA] > MD5
477	. default user gidNumber [513] >
478	. default computer gidNumber [515] >
479	. default login shell [/bin/bash] >
480	. default domain name to append to mail address [] >
481	terpstra-world.org
482	-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
483	backup old configuration files:
484	/etc/smbldap-tools/smbldap.conf->
485	/etc/smbldap-tools/smbldap.conf.old
486	/etc/smbldap-tools/smbldap_bind.conf->
487	/etc/smbldap-tools/smbldap_bind.conf.old
488	writing new configuration file:
489	/etc/smbldap-tools/smbldap.conf done.
490	/etc/smbldap-tools/smbldap_bind.conf done.
491	</pre><p>
492	<a class="indexterm" name="id371351"></a>
493	<a class="indexterm" name="id371358"></a>
494	<a class="indexterm" name="id371365"></a>
495	<a class="indexterm" name="id371371"></a>
496	Note that the NT4 domain SID that was previously obtained was entered above. Also,
497	the sambaUnixIdPooldn object was specified as sambaDomainName=DAMNATION. This is
498	the location into which the Idealx smbldap-tools store the next available UID/GID
499	information. It is also where Samba stores domain specific information such as the
500	next RID, the SID, and so on. In older version of the smbldap-tools this information
501	was stored in the sambaUnixIdPooldn DIT location cn=NextFreeUnixId. Where smbldap-tools
502	are being upgraded to version 0.9.1 it is appropriate to update this to the new location
503	only if the directory information is also relocated.
504	</p></li><li class="step" title="Step 8"><p>
505	Start the LDAP server using the system interface script. On Novell SLES9
506	this is done as shown here:
507	</p><pre class="screen">
508	<code class="prompt">root# </code> rcldap start
509	</pre><p>
510	</p></li><li class="step" title="Step 9"><p>
511	Edit the <code class="filename">/etc/nsswitch.conf</code> file so it has the entries shown in
512	<a class="link" href="ntmigration.html#sbentnss2" title="Example 9.7. NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:2)">“NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:2)”</a>. Note that the LDAP entries have now been uncommented.
513	</p></li><li class="step" title="Step 10"><p>
514	The LDAP management password must be installed into the <code class="filename">secrets.tdb</code>
515	file as follows:
516	</p><pre class="screen">
517	<code class="prompt">root# </code> smbpasswd -w not24get
518	Setting stored password for
519	"cn=Manager,dc=terpstra-world,dc=org" in secrets.tdb
520	</pre><p>
521	</p></li><li class="step" title="Step 11"><p>
522	Populate the LDAP directory as shown here:
523	</p><pre class="screen">
524	<code class="prompt">root# </code> /opt/IDEALX/sbin/smbldap-populate -a root -k 0 -m 0
525	Using workgroup name from sambaUnixIdPooldn (smbldap.conf):
526	sambaDomainName=DAMNATION
527	Using builtin directory structure
528	adding new entry: dc=terpstra-world,dc=org
529	adding new entry: ou=People,dc=terpstra-world,dc=org
530	adding new entry: ou=Groups,dc=terpstra-world,dc=org
531	entry ou=People,dc=terpstra-world,dc=org already exist.
532	adding new entry: ou=Idmap,dc=terpstra-world,dc=org
533	adding new entry: sambaDomainName=DAMNATION,dc=terpstra-world,dc=org
534	adding new entry: uid=root,ou=People,dc=terpstra-world,dc=org
535	adding new entry: uid=nobody,ou=People,dc=terpstra-world,dc=org
536	adding new entry: cn=Domain Admins,ou=Groups,dc=terpstra-world,dc=org
537	adding new entry: cn=Domain Users,ou=Groups,dc=terpstra-world,dc=org
538	adding new entry: cn=Domain Guests,ou=Groups,dc=terpstra-world,dc=org
539	adding new entry: cn=Domain Computers,ou=Groups,dc=terpstra-world,dc=org
540	adding new entry: cn=Administrators,ou=Groups,dc=terpstra-world,dc=org
541	adding new entry: cn=Print Operators,ou=Groups,dc=terpstra-world,dc=org
542	adding new entry: cn=Backup Operators,ou=Groups,dc=terpstra-world,dc=org
543	adding new entry: cn=Replicators,ou=Groups,dc=terpstra-world,dc=org
544	</pre><p>
545	The script tries to add the ou=People container twice, hence the error message.
546	This is expected behavior.
547	</p></li><li class="step" title="Step 12"><p>
548	<a class="indexterm" name="id371510"></a>
549	Restart the LDAP server following initialization of the LDAP directory. Execute the
550	system control script provided on your system. The following steps can be used on
551	Novell SUSE SLES 9:
552	</p><pre class="screen">
553	<code class="prompt">root# </code> rcldap restart
554	<code class="prompt">root# </code> chkconfig ldap on
555	</pre><p>
556	</p></li><li class="step" title="Step 13"><p>
557	Verify that the new user accounts that have been added to the LDAP directory can be
558	resolved as follows:
559	</p><pre class="screen">
560	<code class="prompt">root# </code> getent passwd
561	...
562	nobody:x:65534:65533:nobody:/var/lib/nobody:/bin/bash
563	man:x:13:62:Manual pages viewer:/var/cache/man:/bin/bash
564	news:x:9:13:News system:/etc/news:/bin/bash
565	uucp:x:10:14:Unix-to-Unix CoPy system:/etc/uucp:/bin/bash
566	+::0:0:::
567	root:x:0:0:Netbios Domain Administrator:/home/users/root:/bin/false
568	nobody:x:999:514:nobody:/dev/null:/bin/false
569	</pre><p>
570	Now repeat this for the group accounts as shown here:
571	</p><pre class="screen">
572	<code class="prompt">root# </code> getent group
573	...
574	nobody:x:65533:
575	nogroup:x:65534:nobody
576	users:x:100:
577	+::0:
578	Domain Admins:x:512:root
579	Domain Users:x:513:
580	Domain Guests:x:514:
581	Domain Computers:x:515:
582	Administrators:x:544:
583	Print Operators:x:550:
584	Backup Operators:x:551:
585	Replicators:x:552:
586	</pre><p>
587	In both cases the LDAP accounts follow the <span class="quote">“<span class="quote">+::0:</span>”</span> entry.
588	</p></li><li class="step" title="Step 14"><p>
589	Now it is time to join the Samba BDC to the target NT4 domain that is being
590	migrated to Samba-3 by executing the following:
591	</p><pre class="screen">
592	<code class="prompt">root# </code> net rpc join -S TRANSGRESSION -U Administrator%not24get
593	merlin:/opt/IDEALX/sbin # net rpc join -S TRANSGRESSION \
594	-U Administrator%not24get
595	Joined domain DAMNATION.
596	</pre><p>
597	</p></li><li class="step" title="Step 15"><p>
598	Set the new domain administrator (root) password for both UNIX and Windows as shown here:
599	</p><pre class="screen">
600	<code class="prompt">root# </code> /opt/IDEALX/sbin/smbldap-passwd root
601	Changing password for root
602	New password : ********
603	Retype new password : ********
604	</pre><p>
605	Note: During account migration, the Windows Administrator account will not be migrated
606	to the Samba server.
607	</p></li><li class="step" title="Step 16"><p>
608	Now validate that these accounts can be resolved using Samba's tools as
609	shown here for user accounts:
610	</p><pre class="screen">
611	<code class="prompt">root# </code> pdbedit -Lw
612	root:0:84B0D8E14D158FF8417EAF50CFAC29C3:
613	AF6DD3FD4E2EA8BDE1695A3F05EFBF52:[U ]:LCT-425F6467:
614	nobody:65534:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:
615	NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:[NU ]:LCT-00000000:
616	</pre><p>
617	Now complete the following step to validate that group account mappings have
618	been correctly set:
619	</p><pre class="screen">
620	<code class="prompt">root# </code> net groupmap list
621	Domain Admins (S-1-5-21-1385457007-882775198-1210191635-512)
622	-> Domain Admins
623	Domain Users (S-1-5-21-1385457007-882775198-1210191635-513)
624	-> Domain Users
625	Domain Guests (S-1-5-21-1385457007-882775198-1210191635-514)
626	-> Domain Guests
627	Domain Computers (S-1-5-21-1385457007-882775198-1210191635-515)
628	-> Domain Computers
629	Administrators (S-1-5-32-544) -> Administrators
630	Print Operators (S-1-5-32-550) -> Print Operators
631	Backup Operators (S-1-5-32-551) -> Backup Operators
632	Replicators (S-1-5-32-552) -> Replicators
633	</pre><p>
634	These are the expected results for a correctly configured system.
635	</p></li><li class="step" title="Step 17"><p>
636	Commence migration as shown here:
637	</p><pre class="screen">
638	<code class="prompt">root# </code> net rpc vampire -S TRANSGRESSION \
639	-U Administrator%not24get > /tmp/vampire.log 2>1
640	</pre><p>
641	Check the vampire log to confirm that only expected errors have been
642	reported. See <a class="link" href="ntmigration.html#sbevam1" title="Migration Log Validation">“Migration Log Validation”</a>.
643	</p></li><li class="step" title="Step 18"><p>
644	The migration of user accounts can be quickly validated as follows:
645	</p><pre class="screen">
646	<code class="prompt">root# </code> pdbedit -Lw
647	root:0:84B0D8E14D158FF8417EAF50CFAC29C3:...
648	nobody:65534:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:...
649	Administrator:0:84B0D8E14D158FF8417EAF50CFAC29C3:...
650	Guest:1:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:...
651	TRANSGRESSION$:2:CC044B748CEE294CE76B6B0D1B86C1A8:...
652	IUSR_TRANSGRESSION:3:64046AC81B056C375F9537FC409085F8:...
653	MIDEARTH$:4:E93186E5819706D2AAD3B435B51404EE:...
654	atrickhoffer:5:DC08CFE0C12B2867352502E32A407F23:...
655	barryf:6:B829BCDE01FF24376E45D5F10408CFBD:...
656	fsellerby:7:6A97CBEBE8F9826B417EAF50CFAC29C3:...
657	gdaison:8:48F6A8C8A900024351DA8C2061C5F1D3:...
658	hrambotham:9:7330D9EA0964465EAAD3B435B51404EE:...
659	jrhapsody:10:ACBA7D207E2BA35D9BD41A26B01626BD:...
660	maryk:11:293B5A4CA41F6CA1A7D80430B8342B73:...
661	jacko:12:8E8982D86BD037C364BBD09A598E07AD:...
662	bridge:13:0D2CA7D2BE67FE2193BE3A377C968336:...
663	sharpec:14:8841A75CAC19D2855D8B73B1F4D430F8:...
664	jimbo:15:6E8BDC904FD9EC5C17306D272A9441BB:...
665	dhenwick:16:D1694A03C33584BDAAD3B435B51404EE:...
666	dork:17:69E2D19E69A593D5AAD3B435B51404EE:...
667	blue:18:E355EBF9559979FEAAD3B435B51404EE:...
668	billw:19:EE35C3481CF7F7DB484448BC86A641A5:...
669	rfreshmill:20:7EC033B58661B60CAAD3B435B51404EE:...
670	MAGGOT$:21:A3B9334765AD30F7AAD3B435B51404EE:...
671	TRENTWARE$:22:1D92C8DD5E7F0DDF93BE3A377C968336:...
672	MORTON$:23:89342E69DCA9D3F8AAD3B435B51404EE:...
673	NARM$:24:2B93E2D1D25448BDAAD3B435B51404EE:...
674	LAPDOG$:25:14AA535885120943AAD3B435B51404EE:...
675	SCAVENGER$:26:B6288EB6D147B56F8963805A19B0ED49:...
676	merlin$:27:820C50523F368C54AB9D85AE603AD09D:...
677	</pre><p>
678	</p></li><li class="step" title="Step 19"><p>
679	The mapping of UNIX and Windows groups can be validated as show here:
680	</p><pre class="screen">
681	<code class="prompt">root# </code> net groupmap list
682	Domain Admins (S-1-5-21-1385457007-882775198-1210191635-512)
683	-> Domain Admins
684	Domain Users (S-1-5-21-1385457007-882775198-1210191635-513)
685	-> Domain Users
686	Domain Guests (S-1-5-21-1385457007-882775198-1210191635-514)
687	-> Domain Guests
688	Domain Computers (S-1-5-21-1385457007-882775198-1210191635-515)
689	-> Domain Computers
690	Administrators (S-1-5-32-544) -> Administrators
691	Print Operators (S-1-5-32-550) -> Print Operators
692	Backup Operators (S-1-5-32-551) -> Backup Operators
693	Replicator (S-1-5-32-552) -> Replicators
694	Engineers (S-1-5-21-1385457007-882775198-1210191635-1020) -> Engineers
695	Marketoids (S-1-5-21-1385457007-882775198-1210191635-1022) -> Marketoids
696	Gnomes (S-1-5-21-1385457007-882775198-1210191635-1023) -> Gnomes
697	Catalyst (S-1-5-21-1385457007-882775198-1210191635-1024) -> Catalyst
698	Recieving (S-1-5-21-1385457007-882775198-1210191635-1025) -> Recieving
699	Rubberboot (S-1-5-21-1385457007-882775198-1210191635-1026) -> Rubberboot
700	Sales (S-1-5-21-1385457007-882775198-1210191635-1027) -> Sales
701	Accounting (S-1-5-21-1385457007-882775198-1210191635-1028) -> Accounting
702	Shipping (S-1-5-21-1385457007-882775198-1210191635-1029) -> Shipping
703	Account Operators (S-1-5-32-548) -> Account Operators
704	Guests (S-1-5-32-546) -> Guests
705	Server Operators (S-1-5-32-549) -> Server Operators
706	Users (S-1-5-32-545) -> Users
707	</pre><p>
708	It is of vital importance that the domain SID portions of all group
709	accounts are identical.
710	</p></li><li class="step" title="Step 20"><p>
711	The final responsibility in the migration process is to create identical
712	shares and printing resources on the new Samba-3 server, copy all data
713	across, set up privileges, and set share and file/directory access controls.
714	</p></li><li class="step" title="Step 21"><p>
715	<a class="indexterm" name="id371765"></a>
716	<a class="indexterm" name="id371772"></a>
717	Edit the <code class="filename">smb.conf</code> file to reset the parameter
718	<a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = Yes</a> so that
719	the Samba server functions as a PDC for the purpose of migration.
720	Also, uncomment the deletion scripts so they will now be fully functional,
721	enable the <em class="parameter"><code>wins support = yes</code></em> parameter and
722	comment out the <em class="parameter"><code>wins server</code></em>. Validate the configuration
723	with the <code class="literal">testparm</code> utility as shown here:
724	</p><pre class="screen">
725	<code class="prompt">root# </code> testparm
726	Load smb config files from /etc/samba/smb.conf
727	Processing section "[apps]"
728	Processing section "[media]"
729	Processing section "[homes]"
730	Processing section "[printers]"
731	Processing section "[netlogon]"
732	Processing section "[profiles]"
733	Processing section "[profdata]"
734	Processing section "[print$]"
735	Loaded services file OK.
736	Server role: ROLE_DOMAIN_PDC
737	Press enter to see a dump of your service definitions
738	</pre><p>
739	</p></li><li class="step" title="Step 22"><p>
740	Now shut down the old NT4 PDC. Only when the old NT4 PDC and all
741	NT4 BDCs have been shut down can the Samba-3 PDC be started.
742	</p></li><li class="step" title="Step 23"><p>
743	All workstations should function as they did with the old NT4 PDC. All
744	interdomain trust accounts should remain in place and fully functional.
745	All machine accounts and user logon accounts should also function correctly.
746	</p></li><li class="step" title="Step 24"><p>
747	The configuration of Samba-3 BDC servers can be accomplished now or at any
748	convenient time in the future. Please refer to the carefully detailed process
749	for doing so is outlined in <a class="link" href="happy.html#sbehap-bldg1" title="Samba-3 BDC Configuration">“Samba-3 BDC Configuration”</a>.
750	</p></li></ol></div><div class="sect3" title="Migration Log Validation"><div class="titlepage"><div><div><h4 class="title"><a name="sbevam1"></a>Migration Log Validation</h4></div></div></div><p>
751	The following <code class="filename">vampire.log</code> file is typical of a valid migration.
752	</p><pre class="screen">
753	adding user Administrator to group Domain Admins
754	adding user atrickhoffer to group Engineers
755	adding user dhenwick to group Engineers
756	adding user dork to group Engineers
757	adding user rfreshmill to group Marketoids
758	adding user jacko to group Gnomes
759	adding user jimbo to group Gnomes
760	adding user maryk to group Gnomes
761	adding user gdaison to group Gnomes
762	adding user dhenwick to group Catalyst
763	adding user jacko to group Catalyst
764	adding user jacko to group Recieving
765	adding user blue to group Recieving
766	adding user hrambotham to group Rubberboot
767	adding user billw to group Sales
768	adding user bridge to group Sales
769	adding user jrhapsody to group Sales
770	adding user maryk to group Sales
771	adding user rfreshmill to group Sales
772	adding user fsellerby to group Sales
773	adding user sharpec to group Sales
774	adding user jimbo to group Accounting
775	adding user gdaison to group Accounting
776	adding user jacko to group Shipping
777	adding user blue to group Shipping
778	Fetching DOMAIN database
779	Creating unix group: 'Engineers'
780	Creating unix group: 'Marketoids'
781	Creating unix group: 'Gnomes'
782	Creating unix group: 'Catalyst'
783	Creating unix group: 'Recieving'
784	Creating unix group: 'Rubberboot'
785	Creating unix group: 'Sales'
786	Creating unix group: 'Accounting'
787	Creating unix group: 'Shipping'
788	Creating account: Administrator
789	Creating account: Guest
790	Creating account: TRANSGRESSION$
791	Creating account: IUSR_TRANSGRESSION
792	Creating account: MIDEARTH$
793	Creating account: atrickhoffer
794	Creating account: barryf
795	Creating account: fsellerby
796	Creating account: gdaison
797	Creating account: hrambotham
798	Creating account: jrhapsody
799	Creating account: maryk
800	Creating account: jacko
801	Creating account: bridge
802	Creating account: sharpec
803	Creating account: jimbo
804	Creating account: dhenwick
805	Creating account: dork
806	Creating account: blue
807	Creating account: billw
808	Creating account: rfreshmill
809	Creating account: MAGGOT$
810	Creating account: TRENTWARE$
811	Creating account: MORTON$
812	Creating account: NARM$
813	Creating account: LAPDOG$
814	Creating account: SCAVENGER$
815	Creating account: merlin$
816	Group members of Domain Admins: Administrator,
817	Group members of Domain Users: Administrator(primary),
818	TRANSGRESSION$(primary),IUSR_TRANSGRESSION(primary),
819	MIDEARTH$(primary),atrickhoffer(primary),barryf(primary),
820	fsellerby(primary),gdaison(primary),hrambotham(primary),
821	jrhapsody(primary),maryk(primary),jacko(primary),bridge(primary),
822	sharpec(primary),jimbo(primary),dhenwick(primary),dork(primary),
823	blue(primary),billw(primary),rfreshmill(primary),MAGGOT$(primary),
824	TRENTWARE$(primary),MORTON$(primary),NARM$(primary),
825	LAPDOG$(primary),SCAVENGER$(primary),merlin$(primary),
826	Group members of Domain Guests: Guest(primary),
827	Group members of Engineers: atrickhoffer,dhenwick,dork,
828	Group members of Marketoids: rfreshmill,
829	Group members of Gnomes: jacko,jimbo,maryk,gdaison,
830	Group members of Catalyst: dhenwick,jacko,
831	Group members of Recieving: jacko,blue,
832	Group members of Rubberboot: hrambotham,
833	Group members of Sales: billw,bridge,jrhapsody,maryk,
834	rfreshmill,fsellerby,sharpec,
835	Group members of Accounting: jimbo,gdaison,
836	Group members of Shipping: jacko,blue,
837	Fetching BUILTIN database
838	skipping SAM_DOMAIN_INFO delta for 'Builtin' (is not my domain)
839	Creating unix group: 'Account Operators'
840	Creating unix group: 'Guests'
841	Creating unix group: 'Server Operators'
842	Creating unix group: 'Users'
843	</pre><p>
844	</p></div></div><div class="sect2" title="NT4 Migration Using tdbsam Backend"><div class="titlepage"><div><div><h3 class="title"><a name="id371918"></a>NT4 Migration Using tdbsam Backend</h3></div></div></div><p>
845	In this example, we change the domain name of the NT4 server from
846	<code class="constant">DRUGPREP</code> to <code class="constant">MEGANET</code> prior to the use
847	of the vampire (migration) tool. This migration process makes use of Linux system tools
848	(like <code class="literal">useradd</code>) to add the accounts that are migrated into the
849	UNIX/Linux <code class="filename">/etc/passwd</code> and <code class="filename">/etc/group</code>
850	databases. These entries must therefore be present, and correct options specified,
851	in your <code class="filename">smb.conf</code> file, or else the migration does not work as it should.
852	</p><div class="procedure" title="Procedure 9.2. Migration Steps Using tdbsam"><a name="id371961"></a><p class="title"><b>Procedure 9.2. Migration Steps Using tdbsam</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
853	Prepare a Samba-3 server precisely per the instructions shown in <a class="link" href="Big500users.html" title="Chapter 4. The 500-User Office">“The 500-User Office”</a>.
854	Set the workgroup name to <code class="constant">MEGANET</code>.
855	</p></li><li class="step" title="Step 2"><p><a class="indexterm" name="id371988"></a><a class="indexterm" name="id371996"></a>
856	Edit the <code class="filename">smb.conf</code> file to temporarily change the parameter
857	<a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = No</a> so
858	the Samba server functions as a BDC for the purpose of migration.
859	</p></li><li class="step" title="Step 3"><p>
860	Start Samba as you have done previously.
861	</p></li><li class="step" title="Step 4"><p><a class="indexterm" name="id372035"></a>
862	Join the NT4 Domain as a BDC, as shown here:
863	</p><pre class="screen">
864	<code class="prompt">root# </code> net rpc join -S oldnt4pdc -W MEGANET -UAdministrator%not24get
865	Joined domain MEGANET.
866	</pre><p>
867	</p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id372068"></a>
868	You may vampire the accounts from the NT4 PDC by executing the command, as shown here:
869	</p><pre class="screen">
870	<code class="prompt">root# </code> net rpc vampire -S oldnt4pdc -U Administrator%not24get
871	Fetching DOMAIN database
872	SAM_DELTA_DOMAIN_INFO not handled
873	Creating unix group: 'Domain Admins'
874	Creating unix group: 'Domain Users'
875	Creating unix group: 'Domain Guests'
876	Creating unix group: 'Engineers'
877	Creating unix group: 'Marketoids'
878	Creating unix group: 'Account Operators'
879	Creating unix group: 'Administrators'
880	Creating unix group: 'Backup Operators'
881	Creating unix group: 'Guests'
882	Creating unix group: 'Print Operators'
883	Creating unix group: 'Replicator'
884	Creating unix group: 'Server Operators'
885	Creating unix group: 'Users'
886	Creating account: Administrator
887	Creating account: Guest
888	Creating account: oldnt4pdc$
889	Creating account: jacko
890	Creating account: maryk
891	Creating account: bridge
892	Creating account: sharpec
893	Creating account: jimbo
894	Creating account: dhenwick
895	Creating account: dork
896	Creating account: blue
897	Creating account: billw
898	Creating account: massive$
899	Group members of Engineers: Administrator,
900	sharpec(primary),bridge,billw(primary),dhenwick
901	Group members of Marketoids: Administrator,jacko(primary),
902	maryk(primary),jimbo,blue(primary),dork(primary)
903	Creating unix group: 'Gnomes'
904	Fetching BUILTIN database
905	SAM_DELTA_DOMAIN_INFO not handled
906	</pre><p>
907	</p></li><li class="step" title="Step 6"><p><a class="indexterm" name="id372111"></a>
908	At this point, we can validate our migration. Let's look at the accounts
909	in the form in which they are seen in a smbpasswd file. This achieves that:
910	</p><pre class="screen">
911	<code class="prompt">root# </code> pdbedit -Lw
912	Administrator:505:84B0D8E14D158FF8417EAF50CFAC29C3:
913	AF6DD3FD4E2EA8BDE1695A3F05EFBF52:[UX ]:LCT-3DF7AA9F:
914	jimbo:512:6E9A2A51F64A1BD5C187B8085FE1D9DF:
915	CDF7E305E639966E489A0CEFB95EE5E0:[UX ]:LCT-3E9362BC:
916	sharpec:511:E4301A7CD8FDD1EC6BBF9BC19CDF8151:
917	7000255938831D5B948C95C1931534C5:[UX ]:LCT-3E8B42C4:
918	dhenwick:513:DCD8886141E3F892AAD3B435B51404EE:
919	2DB36465949CB938DD98C312EFDC2639:[UX ]:LCT-3E939F41:
920	bridge:510:3FE6873A43101B46417EAF50CFAC29C3:
921	891741F481AF111B4CAA09A94016BD01:[UX ]:LCT-3E8B4291:
922	blue:515:256D41D2559BB3D2AAD3B435B51404EE:
923	9CCADDA4F7D281DD0FAD321478C6F971:[UX ]:LCT-3E939FDC:
924	diamond$:517:6C8E7B64EDCDBC4218B6345447A4454B:
925	3323AC63C666CFAACB60C13F65D54E9A:[S ]:LCT-00000000:
926	oldnt4pdc$:507:3E39430CDCABB5B09ED320D0448AE568:
927	95DBAF885854A919C7C7E671060478B9:[S ]:LCT-3DF7AA9F:
928	Guest:506:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:
929	XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[DUX ]:LCT-3E93A008:
930	billw:516:85380CA7C21B6EBE168C8150662AF11B:
931	5D7478508293709937E55FB5FBA14C17:[UX ]:LCT-3FED7CA1:
932	dork:514:78C70DDEC35A35B5AAD3B435B51404EE:
933	0AD886E015AC595EC0AF40E6C9689E1A:[UX ]:LCT-3E939F9A:
934	jacko:508:BC472F3BF9A0A5F63832C92FC614B7D1:
935	0C6822AAF85E86600A40DC73E40D06D5:[UX ]:LCT-3E8B4242:
936	maryk:509:3636AB7E12EBE79AB79AE2610DD89D4C:
937	CF271B744F7A55AFDA277FF88D80C527:[UX ]:LCT-3E8B4270:
938	</pre><p>
939	</p></li><li class="step" title="Step 7"><p><a class="indexterm" name="id372163"></a>
940	An expanded view of a user account entry shows more of what was
941	obtained from the NT4 PDC:
942	</p><pre class="screen">
943	sleeth:~ # pdbedit -Lv maryk
944	Unix username: maryk
945	NT username: maryk
946	Account Flags: [UX ]
947	User SID: S-1-5-21-1988699175-926296742-1295600288-1003
948	Primary Group SID: S-1-5-21-1988699175-926296742-1295600288-1007
949	Full Name: Mary Kathleen
950	Home Directory: \\diamond\maryk
951	HomeDir Drive: X:
952	Logon Script: scripts\logon.bat
953	Profile Path: \\diamond\profiles\maryk
954	Domain: MEGANET
955	Account desc: Peace Maker
956	Workstations:
957	Munged dial:
958	Logon time: 0
959	Logoff time: Mon, 18 Jan 2038 20:14:07 GMT
960	Kickoff time: Mon, 18 Jan 2038 20:14:07 GMT
961	Password last set: Wed, 02 Apr 2003 13:05:04 GMT
962	Password can change: 0
963	Password must change: Mon, 18 Jan 2038 20:14:07 GMT
964	</pre><p>
965	</p></li><li class="step" title="Step 8"><p><a class="indexterm" name="id372190"></a>
966	The following command lists the long names of the groups that have been
967	imported (vampired) from the NT4 PDC:
968	</p><pre class="screen">
969	<code class="prompt">root# </code> net group -l -Uroot%not24get -Smassive
970
971	Group name Comment
972	-----------------------------
973	Engineers Snake Oil Engineers
974	Marketoids Untrustworthy Hype Vendors
975	Gnomes Plain Vanilla Garden Gnomes
976	Replicator Supports file replication in a domain
977	Guests Users granted guest access to the computer/domain
978	Administrators Members can fully administer the computer/domain
979	Users Ordinary users
980	</pre><p>
981	Everything looks well and in order.
982	</p></li><li class="step" title="Step 9"><p><a class="indexterm" name="id372225"></a><a class="indexterm" name="id372233"></a>
983	Edit the <code class="filename">smb.conf</code> file to reset the parameter
984	<a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = Yes</a> so
985	the Samba server functions as a PDC for the purpose of migration.
986	</p></li></ol></div></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id372263"></a>Key Points Learned</h3></div></div></div><p>
987	Migration of an NT4 PDC database to a Samba-3 PDC is possible.
988	</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
989	An LDAP backend is a suitable vehicle for NT4 migrations.
990	</p></li><li class="listitem"><p>
991	A tdbsam backend can be used to perform a migration.
992	</p></li><li class="listitem"><p>
993	Multiple NT4 domains can be merged into a single Samba-3
994	domain.
995	</p></li><li class="listitem"><p>
996	The net Samba-3 domain most likely requires some
997	administration and updating before going live.
998	</p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id372297"></a>Questions and Answers</h2></div></div></div><p>
999	</p><div class="qandaset" title="Frequently Asked Questions"><a name="id372306"></a><dl><dt> <a href="ntmigration.html#id372313">
1000	Why must I start each migration with a clean database?
1001	</a></dt><dt> <a href="ntmigration.html#id372349">
1002	Is it possible to set my domain SID to anything I like?
1003	</a></dt><dt> <a href="ntmigration.html#id372401">
1004	When using a tdbsam passdb backend, why must I have all domain user and group accounts
1005	in /etc/passwd and /etc/group?
1006	</a></dt><dt> <a href="ntmigration.html#id372571">
1007	Why did you validate connectivity before attempting migration?
1008	</a></dt><dt> <a href="ntmigration.html#id372613">
1009	How would you merge 10 tdbsam-based domains into an LDAP database?
1010	</a></dt><dt> <a href="ntmigration.html#id372728">
1011	I want to change my domain name after I migrate all accounts from an NT4 domain to a
1012	Samba-3 domain. Does it make any sense to migrate the machine accounts in that case?
1013	</a></dt><dt> <a href="ntmigration.html#id372800">
1014	After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why?
1015	</a></dt><dt> <a href="ntmigration.html#id372858">
1016	How can I reset group membership after loading the account information into the LDAP database?
1017	</a></dt><dt> <a href="ntmigration.html#id372890">
1018	What are the limits or constraints that apply to group names?
1019	</a></dt><dt> <a href="ntmigration.html#id372987">
1020	My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3
1021	LDAP backend system using the vampire process?
1022	</a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id372313"></a><a name="id372315"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372318"></a>
1023	Why must I start each migration with a clean database?
1024	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id372333"></a>
1025	This is a recommendation that permits the data from each NT4 domain to
1026	be kept separate until you are ready to merge them. Also, if you do not start with a clean database,
1027	you may find errors due to users or groups from multiple domains having the
1028	same name but different SIDs. It is better to permit each migration to complete
1029	without undue errors and then to handle the merging of vampired data under
1030	proper supervision.
1031	</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id372349"></a><a name="id372351"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372354"></a>
1032	Is it possible to set my domain SID to anything I like?
1033	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id372369"></a><a class="indexterm" name="id372377"></a><a class="indexterm" name="id372384"></a>
1034	Yes, so long as the SID you create has the same structure as an autogenerated SID.
1035	The typical SID looks like this: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX, where
1036	the XXXXXXXXXX can be any number with from 6 to 10 digits. On the other hand, why
1037	would you really want to create your own SID? I cannot think of a good reason.
1038	You may want to set the SID to one that is already in use somewhere on your network,
1039	but that is a little different from straight out creating your own domain SID.
1040	</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id372401"></a><a name="id372403"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372406"></a><a class="indexterm" name="id372414"></a><a class="indexterm" name="id372422"></a><a class="indexterm" name="id372430"></a><a class="indexterm" name="id372438"></a><a class="indexterm" name="id372449"></a><a class="indexterm" name="id372460"></a>
1041	When using a tdbsam passdb backend, why must I have all domain user and group accounts
1042	in <code class="filename">/etc/passwd</code> and <code class="filename">/etc/group</code>?
1043	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id372491"></a><a class="indexterm" name="id372499"></a><a class="indexterm" name="id372506"></a><a class="indexterm" name="id372514"></a><a class="indexterm" name="id372522"></a><a class="indexterm" name="id372530"></a>
1044	Samba-3 must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba
1045	does not fabricate the UNIX IDs from thin air, but rather requires them to be located
1046	in a suitable place.
1047	</p><p>
1048	When migrating a <code class="filename">smbpasswd</code> file to an LDAP backend, the
1049	UID of each account is taken together with the account information in the
1050	<code class="filename">/etc/passwd</code>, and both sets of data are used to create the account
1051	entry in the LDAP database.
1052	</p><p>
1053	If you elect to create the POSIX account also, the entire UNIX account is copied to the
1054	LDAP backend. The same occurs with NT groups and UNIX groups. At the conclusion of
1055	migration to the LDAP database, the accounts may be removed from the UNIX database files.
1056	In short then, all UNIX and Windows networking accounts, both in tdbsam as well as in
1057	LDAP, require UIDs/GIDs.
1058	</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id372571"></a><a name="id372573"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372576"></a><a class="indexterm" name="id372584"></a><a class="indexterm" name="id372592"></a>
1059	Why did you validate connectivity before attempting migration?
1060	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1061	Access validation before attempting to migrate NT4 domain accounts helps to pinpoint
1062	potential problems that may otherwise affect or impede account migration. I am always
1063	mindful of the 4 P's of migration: Planning Prevents Poor Performance.
1064	</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id372613"></a><a name="id372615"></a></td><td align="left" valign="top"><p>
1065	How would you merge 10 tdbsam-based domains into an LDAP database?
1066	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id372626"></a><a class="indexterm" name="id372634"></a><a class="indexterm" name="id372642"></a><a class="indexterm" name="id372649"></a><a class="indexterm" name="id372657"></a><a class="indexterm" name="id372665"></a><a class="indexterm" name="id372672"></a><a class="indexterm" name="id372680"></a><a class="indexterm" name="id372688"></a><a class="indexterm" name="id372696"></a><a class="indexterm" name="id372704"></a>
1067	If you have 10 tdbsam Samba domains, there is considerable risk that there are a number of
1068	accounts that have the same UNIX identifier (UID/GID). This means that you almost
1069	certainly have to edit a lot of data. It would be easiest to dump each database in smbpasswd
1070	file format and then manually edit all records to ensure that each has a unique UID. Each
1071	file can then be imported a number of ways. You can use the <code class="literal">pdbedit</code> tool
1072	to affect a transfer from the smbpasswd file to LDAP, or you can migrate them en masse to
1073	tdbsam and then to LDAP. The final choice is yours. Just remember to verify all accounts that
1074	you have migrated before handing over access to a user. After all, too many users with a bad
1075	migration experience may threaten your career.
1076	</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id372728"></a><a name="id372731"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372734"></a><a class="indexterm" name="id372742"></a>
1077	I want to change my domain name after I migrate all accounts from an NT4 domain to a
1078	Samba-3 domain. Does it make any sense to migrate the machine accounts in that case?
1079	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id372761"></a><a class="indexterm" name="id372769"></a><a class="indexterm" name="id372777"></a><a class="indexterm" name="id372785"></a>
1080	I would recommend not to migrate the machine account. The machine accounts should still work, but there are registry entries
1081	on each Windows NT4 and upward client that have a tattoo of the old domain name. If you
1082	unjoin the domain and then rejoin the newly renamed Samba-3 domain, you can be certain to avoid
1083	this tattooing effect.
1084	</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id372800"></a><a name="id372802"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372805"></a>
1085	After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why?
1086	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id372820"></a><a class="indexterm" name="id372828"></a>
1087	Samba-3 currently does not implement multiple group membership internally. If you use the Windows
1088	NT4 Domain User Manager to manage accounts and you have an LDAP backend, the multiple group
1089	membership is stored in the POSIX groups area. If you use either tdbsam or smbpasswd backend,
1090	then multiple group membership is handled through the UNIX groups file. When you dump the user
1091	accounts, no group account information is provided. When you edit (change) UIDs and GIDs in each
1092	file to which you migrated the NT4 Domain data, do not forget to edit the UNIX <code class="filename">/etc/passwd</code>
1093	and <code class="filename">/etc/group</code> information also. That is where the multiple group information
1094	is most closely at your fingertips.
1095	</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id372858"></a><a name="id372860"></a></td><td align="left" valign="top"><p>
1096	How can I reset group membership after loading the account information into the LDAP database?
1097	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id372871"></a>
1098	You can use the NT4 Domain User Manager that can be downloaded from the Microsoft Web site. The
1099	installation file is called <code class="filename">SRVTOOLS.EXE</code>.
1100	</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id372890"></a><a name="id372892"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372895"></a>
1101	What are the limits or constraints that apply to group names?
1102	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id372910"></a><a class="indexterm" name="id372918"></a><a class="indexterm" name="id372926"></a><a class="indexterm" name="id372934"></a><a class="indexterm" name="id372942"></a><a class="indexterm" name="id372950"></a>
1103	A Windows 200x group name can be up to 254 characters long, while in Windows NT4 the group
1104	name is limited to 20 characters. Most UNIX systems limit this to 32 characters. Windows
1105	groups can contain upper- and lowercase characters, as well as spaces.
1106	Many UNIX system do not permit the use of uppercase characters, and some do not permit the
1107	space character either. A number of systems (i.e., Linux) work fine with both uppercase
1108	and space characters in group names, but the shadow-utils package that provides the group
1109	control functions (<code class="literal">groupadd</code>, <code class="literal">groupmod</code>, <code class="literal">groupdel</code>, and so on) do not permit them.
1110	Also, a number of UNIX systems management tools enforce their own particular interpretation
1111	of the POSIX standards and likewise do not permit uppercase or space characters in group
1112	or user account names. You have to experiment with your system to find what its
1113	peculiarities are.
1114	</p></td></tr><tr class="question"><td align="left" valign="top"><a name="id372987"></a><a name="id372989"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372992"></a>
1115	My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3
1116	LDAP backend system using the vampire process?
1117	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1118	UNIX UIDs and GIDs on most UNIX systems use an unsigned short or an unsigned integer. Recent Linux
1119	kernels support at least a much larger number. On systems that have a 16-bit constraint on UID/GIDs,
1120	you would not be able to migrate 323,000 accounts because this number cannot fit into a 16-bit unsigned
1121	integer. UNIX/Linux systems that have a 32-bit UID/GID can easily handle this number of accounts.
1122	Please check this carefully before you attempt to effect a migration using the vampire process.
1123	</p><p><a class="indexterm" name="id373019"></a>
1124	Migration speed depends much on the processor speed, the network speed, disk I/O capability, and
1125	LDAP update overheads. On a dual processor AMD MP1600+ with 1 GB memory that was mirroring LDAP
1126	to a second identical system over 1 Gb Ethernet, I was able to migrate around 180 user accounts
1127	per minute. Migration would obviously go much faster if LDAP mirroring were turned off during the migration.
1128	</p></td></tr></tbody></table></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="upgrades.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="DMSMig.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="nw4migration.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 8. Updating Samba-3 </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 10. Migrating NetWare Server to Samba-3</td></tr></table></div></body></html>

Note: See TracBrowser for help on using the repository browser.

Download in other formats: