- Timestamp:
- May 23, 2008, 6:56:41 AM (17 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/upgrades.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 8. Updating Samba-3</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"><link rel="next" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 8. Updating Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="unixclients.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="ntmigration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="upgrades"></a>Chapter 8. Updating Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="upgrades.html#id361313">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id361397">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id362605">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id363269">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id363384">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id363478">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id363662">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id364040">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></div><p>2 <a class="indexterm" name="id3 61239"></a>3 <a class="indexterm" name="id3 61246"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 8. Updating Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"><link rel="next" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 8. Updating Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="unixclients.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="ntmigration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="upgrades"></a>Chapter 8. Updating Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="upgrades.html#id383639">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id383722">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id384934">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id385597">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id385712">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id385807">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id385991">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id386368">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></div><p> 2 <a class="indexterm" name="id383565"></a> 3 <a class="indexterm" name="id383571"></a> 4 4 It was a little difficult to select an appropriate title for this chapter. 5 5 From email messages on the Samba mailing lists it is clear that many people … … 8 8 installing a new Samba server to replace an older existing Samba server. 9 9 </p><p> 10 <a class="indexterm" name="id3 61259"></a>11 <a class="indexterm" name="id3 61266"></a>10 <a class="indexterm" name="id383585"></a> 11 <a class="indexterm" name="id383592"></a> 12 12 There has also been much talk about migration of Samba-3 from an smbpasswd 13 13 passdb backend to the use of the tdbsam or ldapsam facilities that are new … … 18 18 highlighted by an email posting that included the following neat remark: 19 19 </p><div class="blockquote"><blockquote class="blockquote"><p> 20 <a class="indexterm" name="id3 61284"></a>20 <a class="indexterm" name="id383609"></a> 21 21 I like the “<span class="quote">net rpc vampire</span>” on NT4, but that to my surprise does 22 22 not seem to work against a Samba PDC and, if addressed in the Samba to Samba 23 23 context in either book, I could not find it. 24 24 </p></blockquote></div><p> 25 <a class="indexterm" name="id3 61303"></a>25 <a class="indexterm" name="id383629"></a> 26 26 So in response to the significant request for these situations to be better 27 27 documented, this chapter has now been added. User contributions and documentation 28 28 of real-world experiences are a most welcome addition to this chapter. 29 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 61313"></a>Introduction</h2></div></div></div><p>30 <a class="indexterm" name="id3 61321"></a>31 <a class="indexterm" name="id3 61328"></a>32 <a class="indexterm" name="id3 61335"></a>29 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id383639"></a>Introduction</h2></div></div></div><p> 30 <a class="indexterm" name="id383646"></a> 31 <a class="indexterm" name="id383653"></a> 32 <a class="indexterm" name="id383660"></a> 33 33 A Windows network administrator explained in an email what changes he was 34 34 planning to make and followed with the question: “<span class="quote">Anyone done this … … 45 45 productivity on them. 46 46 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 47 <a class="indexterm" name="id3 61359"></a>48 <a class="indexterm" name="id3 61366"></a>47 <a class="indexterm" name="id383685"></a> 48 <a class="indexterm" name="id383692"></a> 49 49 Samba makes it possible to upgrade and update configuration files, but it 50 50 is not possible to downgrade the configuration files. Please ensure that … … 52 52 in the rare event that this may be necessary. 53 53 </p></div><p> 54 <a class="indexterm" name="id3 61378"></a>55 <a class="indexterm" name="id3 61385"></a>54 <a class="indexterm" name="id383704"></a> 55 <a class="indexterm" name="id383711"></a> 56 56 It is prudent also to backup all data files on the server before attempting 57 57 to perform a major upgrade. Many administrators have experienced the consequences … … 60 60 the precautions taken were inadequate. If a backup was not needed, but was available, 61 61 caution was on the side of the victor. 62 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 61397"></a>Cautions and Notes</h3></div></div></div><p>62 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id383722"></a>Cautions and Notes</h3></div></div></div><p> 63 63 Someone once said, “<span class="quote">It is good to be sorry, but better never to need to be!</span>” 64 64 These are wise words of advice to those contemplating a Samba upgrade or update. 65 65 </p><p> 66 <a class="indexterm" name="id3 61413"></a>67 <a class="indexterm" name="id3 61419"></a>68 <a class="indexterm" name="id3 61426"></a>66 <a class="indexterm" name="id383738"></a> 67 <a class="indexterm" name="id383745"></a> 68 <a class="indexterm" name="id383752"></a> 69 69 This is as good a time as any to define the terms <code class="constant">upgrade</code> and 70 70 <code class="constant">update</code>. The term <code class="constant">upgrade</code> refers to … … 74 74 is in development. 75 75 </p><p> 76 <a class="indexterm" name="id3 61450"></a>76 <a class="indexterm" name="id383776"></a> 77 77 The term <code class="constant">update</code> refers to a minor version number installation 78 78 in place of one of the same generation. For example, updating from Samba 3.0.10 to 3.0.14 79 79 is an update. The move from Samba 2.0.7 to 3.0.14 is an upgrade. 80 80 </p><p> 81 <a class="indexterm" name="id3 61466"></a>81 <a class="indexterm" name="id383791"></a> 82 82 While the use of these terms is an exercise in semantics, what needs to be realized 83 83 is that there are major functional differences between a Samba 2.x release and a Samba … … 91 91 noone can read it!</span>” While true, some documentation is an evil necessity. 92 92 It is hoped that this update to the documentation will avoid both extremes. 93 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 61487"></a>Security Identifiers (SIDs)</h4></div></div></div><p>94 <a class="indexterm" name="id3 61495"></a>95 <a class="indexterm" name="id3 61504"></a>96 <a class="indexterm" name="id3 61511"></a>97 <a class="indexterm" name="id3 61517"></a>98 <a class="indexterm" name="id3 61524"></a>99 <a class="indexterm" name="id3 61533"></a>93 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id383812"></a>Security Identifiers (SIDs)</h4></div></div></div><p> 94 <a class="indexterm" name="id383820"></a> 95 <a class="indexterm" name="id383829"></a> 96 <a class="indexterm" name="id383836"></a> 97 <a class="indexterm" name="id383843"></a> 98 <a class="indexterm" name="id383849"></a> 99 <a class="indexterm" name="id383858"></a> 100 100 Before the days of Windows NT and OS/2, every Windows and DOS networking client 101 101 that used the SMB protocols was an entirely autonomous entity. There was no concept … … 105 105 Windows NT 3.10. 106 106 </p><p> 107 <a class="indexterm" name="id3 61549"></a>108 <a class="indexterm" name="id3 61556"></a>109 <a class="indexterm" name="id3 61562"></a>110 <a class="indexterm" name="id3 61569"></a>111 <a class="indexterm" name="id3 61576"></a>112 <a class="indexterm" name="id3 61582"></a>107 <a class="indexterm" name="id383874"></a> 108 <a class="indexterm" name="id383881"></a> 109 <a class="indexterm" name="id383888"></a> 110 <a class="indexterm" name="id383895"></a> 111 <a class="indexterm" name="id383901"></a> 112 <a class="indexterm" name="id383908"></a> 113 113 Versions of Samba prior to 1.9 did not make use of a SID. Instead they make exclusive use 114 114 of the username that is embedded in the SessionSetUpAndX component of the connection 115 115 setup process between a Windows client and an SMB/CIFS server. 116 116 </p><p> 117 <a class="indexterm" name="id3 61597"></a>118 <a class="indexterm" name="id3 61604"></a>119 <a class="indexterm" name="id3 61610"></a>117 <a class="indexterm" name="id383922"></a> 118 <a class="indexterm" name="id383929"></a> 119 <a class="indexterm" name="id383936"></a> 120 120 Around November 1997 support was added to Samba-1.9 to handle the Windows security 121 121 RPC-based protocols that implemented support for Samba to store a machine SID. This 122 122 information was stored in a file called <code class="filename">MACHINE.SID.</code> 123 123 </p><p> 124 <a class="indexterm" name="id3 61628"></a>125 <a class="indexterm" name="id3 61635"></a>126 <a class="indexterm" name="id3 61641"></a>124 <a class="indexterm" name="id383953"></a> 125 <a class="indexterm" name="id383960"></a> 126 <a class="indexterm" name="id383967"></a> 127 127 Within the lifetime of the early Samba 2.x series, the machine SID information was 128 128 relocated into a tdb file called <code class="filename">secrets.tdb</code>, which is where … … 130 130 local machine and its role within a domain security context. 131 131 </p><p> 132 <a class="indexterm" name="id3 61660"></a>133 <a class="indexterm" name="id3 61669"></a>134 <a class="indexterm" name="id3 61678"></a>135 <a class="indexterm" name="id3 61684"></a>132 <a class="indexterm" name="id383985"></a> 133 <a class="indexterm" name="id383994"></a> 134 <a class="indexterm" name="id384003"></a> 135 <a class="indexterm" name="id384010"></a> 136 136 There are two types of SID, those pertaining to the machine itself and the domain to 137 137 which it may belong, and those pertaining to users and groups within the security … … 139 139 servers (DMS). 140 140 </p><p> 141 <a class="indexterm" name="id3 61697"></a>142 <a class="indexterm" name="id3 61704"></a>143 <a class="indexterm" name="id3 61710"></a>144 <a class="indexterm" name="id3 61717"></a>145 <a class="indexterm" name="id3 61724"></a>146 <a class="indexterm" name="id3 61731"></a>141 <a class="indexterm" name="id384022"></a> 142 <a class="indexterm" name="id384029"></a> 143 <a class="indexterm" name="id384036"></a> 144 <a class="indexterm" name="id384043"></a> 145 <a class="indexterm" name="id384050"></a> 146 <a class="indexterm" name="id384056"></a> 147 147 When the Samba <code class="literal">smbd</code> daemon is first started, if the <code class="filename">secrets.tdb</code> 148 148 file does not exist, it is created at the first client connection attempt. If this file does … … 154 154 (hostname) and domain name (workgroup), it will be different. 155 155 </p><p> 156 <a class="indexterm" name="id3 61775"></a>156 <a class="indexterm" name="id384101"></a> 157 157 The SID is the key used by MS Windows networking for all networking operations. This means 158 158 that when the machine or domain SID changes, all security-encoded objects such as profiles … … 163 163 be restored to its previous value. 164 164 </p></div><p> 165 <a class="indexterm" name="id3 61793"></a>166 <a class="indexterm" name="id3 61800"></a>167 <a class="indexterm" name="id3 61806"></a>168 <a class="indexterm" name="id3 61813"></a>169 <a class="indexterm" name="id3 61820"></a>170 <a class="indexterm" name="id3 61826"></a>171 <a class="indexterm" name="id3 61833"></a>172 <a class="indexterm" name="id3 61840"></a>173 <a class="indexterm" name="id3 61847"></a>174 <a class="indexterm" name="id3 61853"></a>165 <a class="indexterm" name="id384118"></a> 166 <a class="indexterm" name="id384125"></a> 167 <a class="indexterm" name="id384132"></a> 168 <a class="indexterm" name="id384138"></a> 169 <a class="indexterm" name="id384145"></a> 170 <a class="indexterm" name="id384152"></a> 171 <a class="indexterm" name="id384159"></a> 172 <a class="indexterm" name="id384166"></a> 173 <a class="indexterm" name="id384172"></a> 174 <a class="indexterm" name="id384179"></a> 175 175 In Samba-3 on a domain controller (PDC or BDC), the domain name controls the domain 176 176 SID. On all prior versions the hostname (computer name, or NetBIOS name) controlled 177 177 the SID. On a standalone server the hostname still controls the SID. 178 178 </p><p> 179 <a class="indexterm" name="id3 61865"></a>180 <a class="indexterm" name="id3 61874"></a>179 <a class="indexterm" name="id384191"></a> 180 <a class="indexterm" name="id384200"></a> 181 181 The local machine SID can be backed up using this procedure (Samba-3): 182 182 </p><pre class="screen"> … … 201 201 This is not a reversible process it is a one-way upgrade. 202 202 </p><p> 203 <a class="indexterm" name="id3 61956"></a>203 <a class="indexterm" name="id384281"></a> 204 204 In the course of the Samba 2.0.x series the <code class="literal">smbpasswd</code> was modified to 205 205 permit the domain SID to be captured to the <code class="filename">secrets.tdb</code> file by executing: … … 218 218 </pre><p> 219 219 </p><p> 220 <a class="indexterm" name="id3 62024"></a>221 <a class="indexterm" name="id3 62031"></a>220 <a class="indexterm" name="id384350"></a> 221 <a class="indexterm" name="id384356"></a> 222 222 Domain security information, which includes the domain SID, can be obtained from Samba-2.2.x 223 223 systems by executing: … … 238 238 case it is ever needed at a later date. 239 239 </p><p> 240 <a class="indexterm" name="id3 62073"></a>241 <a class="indexterm" name="id3 62079"></a>242 <a class="indexterm" name="id3 62086"></a>240 <a class="indexterm" name="id384398"></a> 241 <a class="indexterm" name="id384405"></a> 242 <a class="indexterm" name="id384412"></a> 243 243 Take note that the domain SID is used extensively in Samba. Where LDAP is used for the 244 244 <em class="parameter"><code>passdb backend</code></em>, all user, group, and trust accounts are encoded … … 251 251 </pre><p> 252 252 </p><p> 253 <a class="indexterm" name="id3 62118"></a>254 <a class="indexterm" name="id3 62124"></a>255 <a class="indexterm" name="id3 62131"></a>253 <a class="indexterm" name="id384443"></a> 254 <a class="indexterm" name="id384450"></a> 255 <a class="indexterm" name="id384456"></a> 256 256 When the domain SID has changed, roaming profiles cease to be functional. The recovery 257 257 of roaming profiles necessitates resetting of the domain portion of the user SID … … 262 262 addressed to the creator of the RPM package. The Samba Team do their best to make 263 263 available all the tools needed to manage a Samba-based Windows networking environment. 264 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 62157"></a>Change of hostname</h4></div></div></div><p>265 <a class="indexterm" name="id3 62165"></a>266 <a class="indexterm" name="id3 62174"></a>264 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id384485"></a>Change of hostname</h4></div></div></div><p> 265 <a class="indexterm" name="id384493"></a> 266 <a class="indexterm" name="id384502"></a> 267 267 Samba uses two methods by which the primary NetBIOS machine name (also known as a computer 268 268 name or the hostname) may be determined: If the <code class="filename">smb.conf</code> file contains a … … 278 278 is changed, be sure to reset the machine SID to the original setting. Otherwise 279 279 there may be serious interoperability and/or operational problems. 280 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 62215"></a>Change of Workgroup (Domain) Name</h4></div></div></div><p>281 <a class="indexterm" name="id3 62223"></a>280 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id384544"></a>Change of Workgroup (Domain) Name</h4></div></div></div><p> 281 <a class="indexterm" name="id384551"></a> 282 282 The domain name of a Samba server is identical to the workgroup name and is 283 283 set in the <code class="filename">smb.conf</code> file using the <em class="parameter"><code>workgroup</code></em> parameter. 284 284 This has been consistent throughout the history of Samba and across all versions. 285 285 </p><p> 286 <a class="indexterm" name="id3 62246"></a>286 <a class="indexterm" name="id384575"></a> 287 287 Be aware that when the workgroup name is changed, a new SID will be generated. 288 288 The old domain SID can be reset using the procedure outlined earlier in this chapter. … … 293 293 for network administrators. 294 294 </p><p> 295 <a class="indexterm" name="id3 62274"></a>295 <a class="indexterm" name="id384602"></a> 296 296 The Samba 1.9.x <code class="filename">smb.conf</code> file may be found either in the <code class="filename">/etc</code> 297 297 directory or in <code class="filename">/usr/local/samba/lib</code>. … … 301 301 remains located also for Samba 3.0.x installations. 302 302 </p><p> 303 <a class="indexterm" name="id3 62318"></a>303 <a class="indexterm" name="id384647"></a> 304 304 Samba 2.x introduced the <code class="filename">secrets.tdb</code> file that is also stored in the 305 305 <code class="filename">/etc/samba</code> directory, or in the <code class="filename">/usr/local/samba/lib</code> 306 306 directory subsystem. 307 307 </p><p> 308 <a class="indexterm" name="id3 62347"></a>308 <a class="indexterm" name="id384676"></a> 309 309 The location at which <code class="literal">smbd</code> expects to find all configuration and control 310 310 files is determined at the time of compilation of Samba. For versions of Samba prior to … … 318 318 <code class="filename">/usr/local/samba/sbin</code>. 319 319 </p><p> 320 <a class="indexterm" name="id3 62401"></a>320 <a class="indexterm" name="id384730"></a> 321 321 Samba-3 provides a neat new way to track the location of all control files as well as to 322 322 find the compile-time options used as the Samba package was built. Here is how the dark … … 349 349 </pre><p> 350 350 </p><p> 351 <a class="indexterm" name="id3 62430"></a>351 <a class="indexterm" name="id384759"></a> 352 352 It is important that both the <code class="filename">smb.conf</code> file and the <code class="filename">secrets.tdb</code> 353 353 be backed up before attempting any upgrade. The <code class="filename">secrets.tdb</code> file … … 355 355 of Samba. A backup means that it is always possible to revert a failed or problematic 356 356 upgrade. 357 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 62458"></a>International Language Support</h4></div></div></div><p>358 <a class="indexterm" name="id3 62466"></a>359 <a class="indexterm" name="id3 62473"></a>360 <a class="indexterm" name="id3 62480"></a>361 <a class="indexterm" name="id3 62486"></a>357 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id384787"></a>International Language Support</h4></div></div></div><p> 358 <a class="indexterm" name="id384795"></a> 359 <a class="indexterm" name="id384801"></a> 360 <a class="indexterm" name="id384808"></a> 361 <a class="indexterm" name="id384815"></a> 362 362 Samba-2.x had no support for Unicode; instead, all national language character-set support in file names 363 363 was done using particular locale codepage mapping techniques. Samba-3 supports Unicode in file names, thus 364 364 providing true internationalization support. 365 365 </p><p> 366 <a class="indexterm" name="id3 62499"></a>366 <a class="indexterm" name="id384827"></a> 367 367 Non-English users whose national language character set has special characters and who upgrade naively will 368 368 find that many files that have the special characters in the file name will see them garbled and jumbled up. … … 370 370 that was in use with Samba-2.x using an 8-bit encoding scheme. 371 371 </p><p> 372 <a class="indexterm" name="id3 62512"></a>372 <a class="indexterm" name="id384841"></a> 373 373 Files that are created with Samba-3 will use UTF-8 encoding. Should the file system ever end up with a 374 374 mix of codepage (unix charset)-encoded file names and UTF-8-encoded file names, the mess will take some 375 375 effort to set straight. 376 376 </p><p> 377 <a class="indexterm" name="id3 62524"></a>378 A very helpful tool is available from Bjorn Jacke's <a href="http://j3e.de/linux/convmv/" target="_top">convmv</a>377 <a class="indexterm" name="id384853"></a> 378 A very helpful tool is available from Bjorn Jacke's <a class="ulink" href="http://j3e.de/linux/convmv/" target="_top">convmv</a> 379 379 work. Convmv is a tool that can be used to convert file and directory names from one encoding method to 380 380 another. The most common use for this tool is to convert locale-encoded files to UTF-8 Unicode encoding. 381 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 62542"></a>Updates and Changes in Idealx smbldap-tools</h4></div></div></div><p>381 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id384870"></a>Updates and Changes in Idealx smbldap-tools</h4></div></div></div><p> 382 382 The smbldap-tools have been maturing rapidly over the past year. With maturation comes change. 383 383 The location of the <code class="filename">smbldap.conf</code> and the <code class="filename">smbldap_bind.conf</code> … … 393 393 current release should note that the information stored under <code class="constant">NextFreeUnixId</code> 394 394 must now be relocated to the DIT object <code class="constant">sambaDomainName</code>. 395 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 62605"></a>Upgrading from Samba 1.x and 2.x to Samba-3</h2></div></div></div><p>395 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id384934"></a>Upgrading from Samba 1.x and 2.x to Samba-3</h2></div></div></div><p> 396 396 Sites that are being upgraded from Samba-2 (or earlier versions) to Samba-3 397 397 may experience little difficulty or may require a lot of effort, depending … … 406 406 Where it is necessary to upgrade an old Samba installation to Samba-3, 407 407 the following procedure can be followed: 408 </p><div class="procedure"><a name="id3 62636"></a><p class="title"><b>Procedure 8.1. Upgrading from a Pre-Samba-3 Version</b></p><ol type="1"><li><p>409 <a class="indexterm" name="id3 62647"></a>410 <a class="indexterm" name="id3 62654"></a>411 <a class="indexterm" name="id3 62661"></a>408 </p><div class="procedure"><a name="id384965"></a><p class="title"><b>Procedure 8.1. Upgrading from a Pre-Samba-3 Version</b></p><ol type="1"><li><p> 409 <a class="indexterm" name="id384976"></a> 410 <a class="indexterm" name="id384983"></a> 411 <a class="indexterm" name="id384989"></a> 412 412 Stop Samba. This can be done using the appropriate system tool 413 413 that is particular for each operating system or by executing the … … 424 424 back it up to a safe location. 425 425 </p></li><li><p> 426 <a class="indexterm" name="id3 62739"></a>427 <a class="indexterm" name="id3 62746"></a>428 <a class="indexterm" name="id3 62753"></a>429 <a class="indexterm" name="id3 62760"></a>426 <a class="indexterm" name="id385068"></a> 427 <a class="indexterm" name="id385074"></a> 428 <a class="indexterm" name="id385081"></a> 429 <a class="indexterm" name="id385088"></a> 430 430 Find the location of the lock directory. This is the directory 431 431 in which Samba stores all its tdb control files. The default … … 438 438 tdb files to a safe location. 439 439 </p></li><li><p> 440 <a class="indexterm" name="id3 62794"></a>440 <a class="indexterm" name="id385122"></a> 441 441 It is now safe to upgrade the Samba installation. On Linux systems 442 442 it is not necessary to remove the Samba RPMs because a simple … … 450 450 When the Samba upgrade has been installed, the first step that should 451 451 be completed is to identify the new target locations for the control 452 files. Follow the steps shown in <a href="upgrades.html#sbeug1" title="Location of config files">???</a> to locate452 files. Follow the steps shown in <a class="link" href="upgrades.html#sbeug1" title="Location of config files">“Location of config files”</a> to locate 453 453 the correct directories to which each control file must be moved. 454 454 </p></li><li><p> … … 457 457 Do not change the workgroup name. 458 458 </p></li><li><p> 459 <a class="indexterm" name="id3 62843"></a>459 <a class="indexterm" name="id385171"></a> 460 460 Execute the <code class="literal">testparm</code> to validate the <code class="filename">smb.conf</code> file. 461 461 This process will flag any parameters that are no longer supported. … … 469 469 <code class="prompt">root# </code> testparm -s smb.conf.master > smb.conf 470 470 </pre><p> 471 <a class="indexterm" name="id3 62897"></a>471 <a class="indexterm" name="id385226"></a> 472 472 The resulting <code class="filename">smb.conf</code> file will be stripped of all comments 473 473 and of all nonconforming configuration settings. 474 474 </p></li><li><p> 475 <a class="indexterm" name="id3 62917"></a>475 <a class="indexterm" name="id385246"></a> 476 476 It is now safe to start Samba using the appropriate system tool. 477 477 Alternately, it is possible to just execute <code class="literal">nmbd</code>, 478 478 <code class="literal">smbd</code>, and <code class="literal">winbindd</code> for the command 479 479 line while logged in as the root user. 480 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 62947"></a>Applicable to All Samba 2.x to Samba-3 Upgrades</h3></div></div></div><p>481 <a class="indexterm" name="id3 62955"></a>482 <a class="indexterm" name="id3 62961"></a>483 <a class="indexterm" name="id3 62968"></a>480 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id385275"></a>Applicable to All Samba 2.x to Samba-3 Upgrades</h3></div></div></div><p> 481 <a class="indexterm" name="id385283"></a> 482 <a class="indexterm" name="id385290"></a> 483 <a class="indexterm" name="id385297"></a> 484 484 Samba 2.x servers that were running as a domain controller (PDC) 485 485 require changes to the configuration of the scripting interface … … 487 487 users, groups, and trust accounts (machines and interdomain). 488 488 </p><p> 489 <a class="indexterm" name="id3 62980"></a>489 <a class="indexterm" name="id385309"></a> 490 490 The following parameters are new to Samba-3 and should be correctly configured. 491 Please refer to <a href="secure.html" title="Chapter 3. Secure Office Networking">???</a> through <a href="2000users.html" title="Chapter 6. A Distributed 2000-User Network">???</a>491 Please refer to <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a> through <a class="link" href="2000users.html" title="Chapter 6. A Distributed 2000-User Network">“A Distributed 2000-User Network”</a> 492 492 in this book for examples of use of the new parameters shown here: 493 <a class="indexterm" name="id3 63000"></a>494 <a class="indexterm" name="id3 63006"></a>495 <a class="indexterm" name="id3 63013"></a>496 <a class="indexterm" name="id3 63020"></a>497 <a class="indexterm" name="id3 63027"></a>498 <a class="indexterm" name="id3 63034"></a>499 <a class="indexterm" name="id3 63041"></a>493 <a class="indexterm" name="id385328"></a> 494 <a class="indexterm" name="id385335"></a> 495 <a class="indexterm" name="id385342"></a> 496 <a class="indexterm" name="id385349"></a> 497 <a class="indexterm" name="id385355"></a> 498 <a class="indexterm" name="id385362"></a> 499 <a class="indexterm" name="id385369"></a> 500 500 </p><p> 501 501 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><p>add group script</p></td></tr><tr><td><p>add machine script</p></td></tr><tr><td><p>add user to group script</p></td></tr><tr><td><p>delete group script</p></td></tr><tr><td><p>delete user from group script</p></td></tr><tr><td><p>passdb backend</p></td></tr><tr><td><p>set primary group script</p></td></tr></table><p> 502 502 </p><p> 503 <a class="indexterm" name="id3 63092"></a>504 <a class="indexterm" name="id3 63098"></a>503 <a class="indexterm" name="id385420"></a> 504 <a class="indexterm" name="id385427"></a> 505 505 The <em class="parameter"><code>add machine script</code></em> functionality was previously 506 506 handled by the <em class="parameter"><code>add user script</code></em>, which in Samba-3 is 507 507 used exclusively to add user accounts. 508 508 </p><p> 509 <a class="indexterm" name="id3 63121"></a>510 <a class="indexterm" name="id3 63128"></a>511 <a class="indexterm" name="id3 63135"></a>512 <a class="indexterm" name="id3 63142"></a>513 <a class="indexterm" name="id3 63148"></a>514 <a class="indexterm" name="id3 63155"></a>515 <a class="indexterm" name="id3 63162"></a>516 <a class="indexterm" name="id3 63169"></a>517 <a class="indexterm" name="id3 63176"></a>509 <a class="indexterm" name="id385450"></a> 510 <a class="indexterm" name="id385457"></a> 511 <a class="indexterm" name="id385463"></a> 512 <a class="indexterm" name="id385470"></a> 513 <a class="indexterm" name="id385477"></a> 514 <a class="indexterm" name="id385484"></a> 515 <a class="indexterm" name="id385491"></a> 516 <a class="indexterm" name="id385497"></a> 517 <a class="indexterm" name="id385504"></a> 518 518 Where the <em class="parameter"><code>passdb backend</code></em> used is either <code class="constant">smbpasswd</code> 519 519 (the default) or the new <code class="constant">tdbsam</code>, the system interface scripts … … 522 522 <code class="literal">groupmod</code>, <code class="literal">groupdel</code>, and so on. 523 523 </p><p> 524 <a class="indexterm" name="id3 63235"></a>525 <a class="indexterm" name="id3 63242"></a>526 <a class="indexterm" name="id3 63248"></a>524 <a class="indexterm" name="id385563"></a> 525 <a class="indexterm" name="id385570"></a> 526 <a class="indexterm" name="id385577"></a> 527 527 Where the <em class="parameter"><code>passdb backend</code></em> makes use of an LDAP directory, 528 528 it is necessary either to use the <code class="constant">smbldap-tools</code> provided 529 529 by Idealx or to use an alternate toolset provided by a third 530 530 party or else home-crafted to manage the LDAP directory accounts. 531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 63269"></a>Samba-2.x with LDAP Support</h3></div></div></div><p>531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id385597"></a>Samba-2.x with LDAP Support</h3></div></div></div><p> 532 532 Samba version 2.x could be compiled for use either with or without LDAP. 533 533 The LDAP control settings in the <code class="filename">smb.conf</code> file in this old version are … … 536 536 the LDAP settings entirely. 537 537 </p><p> 538 Follow the procedure outlined in <a href="upgrades.html#sbeug2" title="Samba 1.9.x and 2.x Versions Without LDAP">???</a> to affect a migration538 Follow the procedure outlined in <a class="link" href="upgrades.html#sbeug2" title="Samba 1.9.x and 2.x Versions Without LDAP">“Samba 1.9.x and 2.x Versions Without LDAP”</a> to affect a migration 539 539 of all files to the correct locations. 540 540 </p><p> 541 <a class="indexterm" name="id3 63299"></a>542 <a class="indexterm" name="id3 63306"></a>541 <a class="indexterm" name="id385628"></a> 542 <a class="indexterm" name="id385634"></a> 543 543 The Samba SAM schema required for Samba-3 is significantly different from that 544 544 used with Samba 2.x. This means that the LDAP directory must be updated … … 695 695 the DN's with quotation marks. 696 696 </pre><p> 697 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 63384"></a>Updating a Samba-3 Installation</h2></div></div></div><p>697 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id385712"></a>Updating a Samba-3 Installation</h2></div></div></div><p> 698 698 The key concern in this section is to deal with the changes that have been 699 699 affected in Samba-3 between the Samba-3.0.0 release and the current update. … … 701 701 taken to update Samba-3 versions. 702 702 </p><p> 703 <a class="indexterm" name="id3 63397"></a>704 The information in <a href="upgrades.html#sbeug1" title="Location of config files">???</a> would not be necessary if every703 <a class="indexterm" name="id385725"></a> 704 The information in <a class="link" href="upgrades.html#sbeug1" title="Location of config files">“Location of config files”</a> would not be necessary if every 705 705 person who has ever produced Samba executable (binary) files could agree on 706 706 the preferred location of the <code class="filename">smb.conf</code> file and other Samba control files. 707 707 Clearly, such agreement is further away than a pipedream. 708 708 </p><p> 709 <a class="indexterm" name="id3 63420"></a>709 <a class="indexterm" name="id385749"></a> 710 710 Vendors and packagers who produce Samba binary installable packages do not, 711 711 as a rule, use the default paths used by the Samba-Team for the location of … … 720 720 effect. 721 721 </p><p> 722 <a class="indexterm" name="id3 63448"></a>722 <a class="indexterm" name="id385777"></a> 723 723 The best advice for those lacking in code compilation experience is to use 724 724 only vendor (or Samba-Team) provided binary packages. The Samba packages … … 726 726 that are compatible with the original OS vendor's practices. 727 727 </p><p> 728 <a class="indexterm" name="id3 63461"></a>729 <a class="indexterm" name="id3 63468"></a>728 <a class="indexterm" name="id385789"></a> 729 <a class="indexterm" name="id385796"></a> 730 730 If you are not sure whether a binary package complies with the OS 731 731 vendor's practices, it is better to ask the package maintainer via … … 733 733 Alternately, just diagnose the paths specified by the binary files following 734 734 the procedure outlined above. 735 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 63478"></a>Samba-3 to Samba-3 Updates on the Same Server</h3></div></div></div><p>735 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id385807"></a>Samba-3 to Samba-3 Updates on the Same Server</h3></div></div></div><p> 736 736 The guidance in this section deals with updates to an existing 737 737 Samba-3 server installation. 738 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 63488"></a>Updating from Samba Versions Earlier than 3.0.5</h4></div></div></div><p>738 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id385817"></a>Updating from Samba Versions Earlier than 3.0.5</h4></div></div></div><p> 739 739 With the provision that the binary Samba-3 package has been built 740 740 with the same path and feature settings as the existing Samba-3 … … 743 743 and without need to change either the <code class="filename">smb.conf</code> file or, where 744 744 used, the LDAP schema. 745 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 63507"></a>Updating from Samba Versions between 3.0.6 and 3.0.10</h4></div></div></div><p>746 <a class="indexterm" name="id3 63515"></a>747 <a class="indexterm" name="id3 63522"></a>745 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id385836"></a>Updating from Samba Versions between 3.0.6 and 3.0.10</h4></div></div></div><p> 746 <a class="indexterm" name="id385844"></a> 747 <a class="indexterm" name="id385851"></a> 748 748 When updating versions of Samba-3 prior to 3.0.6 to 3.0.6 through 3.0.10, 749 749 it is necessary only to update the LDAP schema (where LDAP is used). … … 751 751 update. 752 752 </p><p> 753 <a class="indexterm" name="id3 63536"></a>754 <a class="indexterm" name="id3 63543"></a>755 <a class="indexterm" name="id3 63550"></a>753 <a class="indexterm" name="id385865"></a> 754 <a class="indexterm" name="id385872"></a> 755 <a class="indexterm" name="id385879"></a> 756 756 Samba-3.0.6 introduced the ability to remember the last <span class="emphasis"><em>n</em></span> number 757 757 of passwords a user has used. This information will work only with … … 760 760 </p><p> 761 761 After updating the LDAP schema, do not forget to re-index the LDAP database. 762 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 63581"></a>Updating from Samba Versions after 3.0.6 to a Current Release</h4></div></div></div><p>763 <a class="indexterm" name="id3 63589"></a>762 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id385909"></a>Updating from Samba Versions after 3.0.6 to a Current Release</h4></div></div></div><p> 763 <a class="indexterm" name="id385918"></a> 764 764 Samba-3.0.8 introduced changes in how the <em class="parameter"><code>username map</code></em> 765 765 behaves. It also included a change in behavior of <code class="literal">winbindd</code>. … … 767 767 from versions prior to 3.0.8 to a current version. 768 768 </p><p> 769 <a class="indexterm" name="id3 63618"></a>769 <a class="indexterm" name="id385947"></a> 770 770 In Samba-3.0.11 a new privileges interface was implemented. Please 771 refer to <a href="happy.html#sbehap-ppc" title="Addition of Machines to the Domain">???</a> for information regarding this new771 refer to <a class="link" href="happy.html#sbehap-ppc" title="Addition of Machines to the Domain">“Addition of Machines to the Domain”</a> for information regarding this new 772 772 feature. It is not necessary to implement the privileges interface, but it 773 773 is one that has been requested for several years and thus may be of interest … … 789 789 back to searching the 'ldap suffix' in some cases. 790 790 </pre><p> 791 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 63662"></a>Migrating Samba-3 to a New Server</h3></div></div></div><p>791 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id385991"></a>Migrating Samba-3 to a New Server</h3></div></div></div><p> 792 792 The two most likely candidates for replacement of a server are 793 793 domain member servers and domain controllers. Each needs to be 794 794 handled slightly differently. 795 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 63672"></a>Replacing a Domain Member Server</h4></div></div></div><p>796 <a class="indexterm" name="id3 63680"></a>795 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id386001"></a>Replacing a Domain Member Server</h4></div></div></div><p> 796 <a class="indexterm" name="id386009"></a> 797 797 Replacement of a domain member server should be done 798 using the same procedure as outlined in <a href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients">???</a>.798 using the same procedure as outlined in <a class="link" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients">“Adding Domain Member Servers and Clients”</a>. 799 799 </p><p> 800 800 Usually the new server will be introduced with a temporary name. After … … 803 803 change its SID and will necessitate rejoining to the domain. 804 804 </p><p> 805 <a class="indexterm" name="id3 63703"></a>806 <a class="indexterm" name="id3 63709"></a>807 <a class="indexterm" name="id3 63716"></a>808 <a class="indexterm" name="id3 63723"></a>809 <a class="indexterm" name="id3 63730"></a>810 <a class="indexterm" name="id3 63736"></a>805 <a class="indexterm" name="id386031"></a> 806 <a class="indexterm" name="id386038"></a> 807 <a class="indexterm" name="id386045"></a> 808 <a class="indexterm" name="id386051"></a> 809 <a class="indexterm" name="id386058"></a> 810 <a class="indexterm" name="id386065"></a> 811 811 Following a change of hostname (NetBIOS name) it is a good idea on all servers 812 812 to shut down the Samba <code class="literal">smbd</code>, <code class="literal">nmbd</code>, and … … 818 818 change, but can persist for a longer period of time. 819 819 </p><p> 820 <a class="indexterm" name="id3 63780"></a>821 <a class="indexterm" name="id3 63786"></a>822 <a class="indexterm" name="id3 63793"></a>823 <a class="indexterm" name="id3 63800"></a>820 <a class="indexterm" name="id386108"></a> 821 <a class="indexterm" name="id386115"></a> 822 <a class="indexterm" name="id386122"></a> 823 <a class="indexterm" name="id386129"></a> 824 824 If the old domain member server had local accounts, it is necessary to create 825 825 on the new domain member server the same accounts with the same UID and GID … … 832 832 account entries to the new target server. 833 833 </p><p> 834 <a class="indexterm" name="id3 63845"></a>834 <a class="indexterm" name="id386173"></a> 835 835 Where the user accounts for both UNIX and Samba are stored in LDAP, the new 836 836 target server must be configured to use the <code class="literal">nss_ldap</code> tool set. 837 837 This will automatically ensure that the appropriate user entities are 838 838 available on the new server. 839 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 63862"></a>Replacing a Domain Controller</h4></div></div></div><p>840 <a class="indexterm" name="id3 63870"></a>839 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id386190"></a>Replacing a Domain Controller</h4></div></div></div><p> 840 <a class="indexterm" name="id386198"></a> 841 841 In the past, people who replaced a Windows NT4 domain controller typically 842 842 installed a new server, created printers and file shares on it, then migrate across … … 862 862 <code class="literal">slapadd</code> command. Do not forget to install and configure 863 863 the <code class="literal">nss_ldap</code> tool and the <code class="filename">/etc/nsswitch.conf</code> 864 (as shown in <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>).864 (as shown in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>). 865 865 </p></li><li><p> 866 866 Copy the <code class="filename">smb.conf</code> file from the old server to the new server into the correct … … 891 891 should correctly pick up the original SID and preserve all other settings. It is 892 892 sound advice to validate this before turning the system over to users. 893 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 64040"></a>Migration of Samba Accounts to Active Directory</h3></div></div></div><p>893 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id386368"></a>Migration of Samba Accounts to Active Directory</h3></div></div></div><p> 894 894 Yes, it works. The Windows ADMT tool can be used to migrate Samba accounts 895 895 to MS Active Directory. There are a few pitfalls to be aware of: 896 </p><div class="procedure"><a name="id3 64050"></a><p class="title"><b>Procedure 8.2. Migration to Active Directory</b></p><ol type="1"><li><p>896 </p><div class="procedure"><a name="id386378"></a><p class="title"><b>Procedure 8.2. Migration to Active Directory</b></p><ol type="1"><li><p> 897 897 Administrator password must be THE SAME on the Samba server, 898 898 the 2003 ADS, and the local Administrator account on the workstations. … … 915 915 workstations won't be migrated to the new domain. 916 916 </p></li><li><p> 917 <a class="indexterm" name="id3 64108"></a>917 <a class="indexterm" name="id386436"></a> 918 918 When migrating machines, always test first (using ADMT's test mode) 919 919 and satisfy all errors before committing the migration. Note that the … … 923 923 a test. 924 924 </p></li></ol></div><p> 925 <a class="indexterm" name="id3 64122"></a>925 <a class="indexterm" name="id386451"></a> 926 926 There are some significant benefits of using the ADMT, besides just 927 927 migrating user accounts. ADMT can be found on the Windows 2003 CD.
Note:
See TracChangeset
for help on using the changeset viewer.
