- Timestamp:
- Sep 30, 2008, 7:14:08 AM (17 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/ntmigration.html
r134 r158 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 9. Migrating NT4 Domain to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="upgrades.html" title="Chapter 8. Updating Samba-3"><link rel="next" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 9. Migrating NT4 Domain to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrades.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="nw4migration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ntmigration"></a>Chapter 9. Migrating NT4 Domain to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ntmigration.html#id3 86514">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id386589">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id386640">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id386802">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id387105">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id387125">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id389442">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id389787">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id389822">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 9. Migrating NT4 Domain to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="upgrades.html" title="Chapter 8. Updating Samba-3"><link rel="next" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 9. Migrating NT4 Domain to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrades.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="nw4migration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ntmigration"></a>Chapter 9. Migrating NT4 Domain to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ntmigration.html#id360948">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id361024">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id361074">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id361236">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id361540">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id361560">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id361684">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id363877">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id364222">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id364256">Questions and Answers</a></span></dt></dl></div><p> 2 2 Ever since Microsoft announced that it was discontinuing support for Windows 3 3 NT4, Samba users started to ask for detailed instructions on how to migrate … … 7 7 One wonders how many NT4 systems will be left in service by the time you read this 8 8 book though. 9 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 86514"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id386520"></a>9 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id360948"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id360954"></a> 10 10 Network administrators who want to migrate off a Windows NT4 environment know 11 11 one thing with certainty. They feel that NT4 has been abandoned, and they want … … 14 14 failure, and much more. 15 15 </p><p> 16 <a class="indexterm" name="id3 86535"></a>17 <a class="indexterm" name="id3 86542"></a>18 <a class="indexterm" name="id3 86551"></a>19 <a class="indexterm" name="id3 86560"></a>16 <a class="indexterm" name="id360970"></a> 17 <a class="indexterm" name="id360976"></a> 18 <a class="indexterm" name="id360986"></a> 19 <a class="indexterm" name="id360995"></a> 20 20 The migration from NT4 to Samba-3 can involve a number of factors, including 21 21 migration of data to another server, migration of network environment controls … … 23 23 accounts. 24 24 </p><p> 25 <a class="indexterm" name="id3 86575"></a>25 <a class="indexterm" name="id361009"></a> 26 26 It should be pointed out now that it is possible to migrate some systems from 27 27 a Windows NT4 domain environment to a Samba-3 domain environment. This is certainly … … 31 31 migration before an environment that is acceptable for immediate use 32 32 is obtained. 33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 86589"></a>Assignment Tasks</h3></div></div></div><p>34 <a class="indexterm" name="id3 86597"></a>35 <a class="indexterm" name="id3 86604"></a>36 <a class="indexterm" name="id3 86611"></a>33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id361024"></a>Assignment Tasks</h3></div></div></div><p> 34 <a class="indexterm" name="id361031"></a> 35 <a class="indexterm" name="id361038"></a> 36 <a class="indexterm" name="id361045"></a> 37 37 You are about to migrate an MS Windows NT4 domain accounts database to 38 38 a Samba-3 server. The Samba-3 server is using a … … 43 43 Your objective is to document the process of migrating user and group accounts 44 44 from several NT4 domains into a single Samba-3 LDAP backend database. 45 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 86640"></a>Dissection and Discussion</h2></div></div></div><p>46 <a class="indexterm" name="id3 86648"></a>47 <a class="indexterm" name="id3 86654"></a>48 <a class="indexterm" name="id3 86661"></a>49 <a class="indexterm" name="id3 86672"></a>50 <a class="indexterm" name="id3 86684"></a>51 <a class="indexterm" name="id3 86691"></a>45 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id361074"></a>Dissection and Discussion</h2></div></div></div><p> 46 <a class="indexterm" name="id361082"></a> 47 <a class="indexterm" name="id361089"></a> 48 <a class="indexterm" name="id361096"></a> 49 <a class="indexterm" name="id361107"></a> 50 <a class="indexterm" name="id361118"></a> 51 <a class="indexterm" name="id361125"></a> 52 52 The migration process takes a snapshot of information that is stored in the 53 53 Windows NT4 registry-based accounts database. That information resides in … … 55 55 <code class="constant">SAM</code> and <code class="constant">SECURITY</code>. 56 56 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 57 <a class="indexterm" name="id3 86713"></a>58 <a class="indexterm" name="id3 86720"></a>57 <a class="indexterm" name="id361147"></a> 58 <a class="indexterm" name="id361154"></a> 59 59 The Windows NT4 registry keys called <code class="constant">SAM</code> and <code class="constant">SECURITY</code> 60 60 are protected so that you cannot view the contents. If you change the security setting … … 62 62 do this unless you are willing to render your domain controller inoperative. 63 63 </p></div><p> 64 <a class="indexterm" name="id3 86739"></a>65 <a class="indexterm" name="id3 86749"></a>64 <a class="indexterm" name="id361174"></a> 65 <a class="indexterm" name="id361183"></a> 66 66 Before commencing an NT4 to Samba-3 migration, you should consider what your objectives are. 67 67 While in some cases it is possible simply to migrate an NT4 domain to a single Samba-3 server, … … 71 71 interact with the network environment. 72 72 </p><p> 73 <a class="indexterm" name="id3 86763"></a>74 <a class="indexterm" name="id3 86772"></a>75 <a class="indexterm" name="id3 86779"></a>73 <a class="indexterm" name="id361197"></a> 74 <a class="indexterm" name="id361207"></a> 75 <a class="indexterm" name="id361213"></a> 76 76 MS Windows NT4 was introduced some time around 1996. Many environments in which NT4 was deployed 77 77 have done little to keep the NT4 server environment up to date with more recent Windows releases, … … 84 84 real disruption to users, but rather, with due diligence and care, should make their network experience 85 85 a much happier one. 86 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 86802"></a>Technical Issues</h3></div></div></div><p>87 <a class="indexterm" name="id3 86810"></a>88 <a class="indexterm" name="id3 86816"></a>86 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id361236"></a>Technical Issues</h3></div></div></div><p> 87 <a class="indexterm" name="id361244"></a> 88 <a class="indexterm" name="id361251"></a> 89 89 Migration of an NT4 domain user and group database to Samba-3 involves a certain strategic 90 90 element. Many sites have asked for instructions regarding merging of multiple NT4 … … 94 94 from a Windows NT4 domain to a Samba domain. 95 95 </p><div class="figure"><a name="ch8-migration"></a><p class="title"><b>Figure 9.1. Schematic Explaining the <code class="literal">net rpc vampire</code> Process</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch8-migration.png" width="297" alt="Schematic Explaining the net rpc vampire Process"></div></div></div><br class="figure-break"><p> 96 <a class="indexterm" name="id3 86884"></a>97 <a class="indexterm" name="id3 86891"></a>96 <a class="indexterm" name="id361318"></a> 97 <a class="indexterm" name="id361325"></a> 98 98 If you want to merge multiple NT4 domain account databases into one Samba domain, 99 99 you must now dump the contents of the first migration and edit it as appropriate. Now clean … … 101 101 files. You must start each migration with a new database into which you merge your NT4 102 102 domains. 103 </p><p><a class="indexterm" name="id3 86908"></a>103 </p><p><a class="indexterm" name="id361343"></a> 104 104 At this point, you are ready to perform the second migration, following the same steps as 105 105 for the first. In other words, dump the database, edit it, and then you may merge the 106 106 dump for the first and second migrations. 107 </p><p><a class="indexterm" name="id3 86922"></a><a class="indexterm" name="id386929"></a><a class="indexterm" name="id386937"></a>107 </p><p><a class="indexterm" name="id361356"></a><a class="indexterm" name="id361364"></a><a class="indexterm" name="id361372"></a> 108 108 You must be careful. If you choose to migrate to an LDAP backend, your dump file 109 109 now contains the full account information, including the domain SID. The domain SID for each … … 111 111 portion of the account SIDs so that all are the same. 112 112 </p><p> 113 <a class="indexterm" name="id3 86952"></a>114 <a class="indexterm" name="id3 86959"></a>115 <a class="indexterm" name="id3 86966"></a>116 <a class="indexterm" name="id3 86973"></a>117 <a class="indexterm" name="id3 86979"></a>118 <a class="indexterm" name="id3 86986"></a>119 <a class="indexterm" name="id3 86993"></a>120 <a class="indexterm" name="id3 87000"></a>121 <a class="indexterm" name="id3 87007"></a>122 <a class="indexterm" name="id3 87013"></a>123 <a class="indexterm" name="id3 87020"></a>124 <a class="indexterm" name="id3 87027"></a>113 <a class="indexterm" name="id361387"></a> 114 <a class="indexterm" name="id361393"></a> 115 <a class="indexterm" name="id361400"></a> 116 <a class="indexterm" name="id361407"></a> 117 <a class="indexterm" name="id361414"></a> 118 <a class="indexterm" name="id361421"></a> 119 <a class="indexterm" name="id361427"></a> 120 <a class="indexterm" name="id361434"></a> 121 <a class="indexterm" name="id361441"></a> 122 <a class="indexterm" name="id361448"></a> 123 <a class="indexterm" name="id361455"></a> 124 <a class="indexterm" name="id361461"></a> 125 125 If you choose to use a tdbsam (<code class="filename">passdb.tdb</code>) backend file, your best choice 126 126 is to use <code class="literal">pdbedit</code> to export the contents of the tdbsam file into an … … 132 132 may be exported or imported into either a tdbsam (<code class="filename">passdb.tdb</code>) or 133 133 an LDAP backend. 134 </p><div class="figure"><a name="NT4DUM"></a><p class="title"><b>Figure 9.2. View of Accounts in NT4 Domain User Manager</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UserMgrNT4.png" width="270" alt="View of Accounts in NT4 Domain User Manager"></div></div></div><br class="figure-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 87105"></a>Political Issues</h3></div></div></div><p>134 </p><div class="figure"><a name="NT4DUM"></a><p class="title"><b>Figure 9.2. View of Accounts in NT4 Domain User Manager</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UserMgrNT4.png" width="270" alt="View of Accounts in NT4 Domain User Manager"></div></div></div><br class="figure-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id361540"></a>Political Issues</h3></div></div></div><p> 135 135 The merging of multiple Windows NT4-style domains into a single LDAP-backend-based Samba-3 136 136 domain may be seen by those who had power over them as a loss of prestige or a loss of … … 142 142 Samba-3 domain is to promote (sell) the action as one that reduces costs and delivers 143 143 greater network interoperability and manageability. 144 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 87125"></a>Implementation</h2></div></div></div><p>144 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id361560"></a>Implementation</h2></div></div></div><p> 145 145 From feedback on the Samba mailing lists, it seems that most Windows NT4 migrations 146 146 to Samba-3 are being performed using a new server or a new installation of a Linux or UNIX … … 165 165 migration to either a tdbsam or an ldapsam backend. 166 166 </p></li><li><p> 167 <a class="indexterm" name="id3 87200"></a>168 <a class="indexterm" name="id3 87207"></a>169 <a class="indexterm" name="id3 87214"></a>167 <a class="indexterm" name="id361635"></a> 168 <a class="indexterm" name="id361642"></a> 169 <a class="indexterm" name="id361648"></a> 170 170 Clean up the source NT4 PDC. Delete all accounts that need not be migrated. 171 171 Delete all files that should not be migrated. Where possible, change NT group … … 175 175 </p></li><li><p> 176 176 Step through the migration process. 177 </p></li><li><p><a class="indexterm" name="id3 87232"></a>177 </p></li><li><p><a class="indexterm" name="id361666"></a> 178 178 Remove the NT4 PDC from the network. 179 179 </p></li><li><p> … … 182 182 </p></li></ul></div><p> 183 183 It may help to use the above outline as a pre-migration checklist. 184 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 87250"></a>NT4 Migration Using LDAP Backend</h3></div></div></div><p>184 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id361684"></a>NT4 Migration Using LDAP Backend</h3></div></div></div><p> 185 185 In this example, the migration is of an NT4 PDC to a Samba-3 PDC with an LDAP backend. The accounts about 186 186 to be migrated are shown in <a class="link" href="ntmigration.html#NT4DUM" title="Figure 9.2. View of Accounts in NT4 Domain User Manager">“View of Accounts in NT4 Domain User Manager”</a>. In this example use is made of the … … 200 200 before commencing the following configuration steps. 201 201 </p></div><div class="table"><a name="ch8-vampire"></a><p class="title"><b>Table 9.1. Samba <code class="filename">smb.conf</code> Scripts Essential to Samba Operation</b></p><div class="table-contents"><table summary="Samba smb.conf Scripts Essential to Samba Operation" border="1"><colgroup><col align="left"><col align="center"><col align="center"></colgroup><thead><tr><th align="left">Entity</th><th align="center">ldapsam Script</th><th align="center">tdbsam Script</th></tr></thead><tbody><tr><td align="left">Add User Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr><tr><td align="left">Delete User Accounts</td><td align="center">smbldap-userdel</td><td align="center">userdel</td></tr><tr><td align="left">Add Group Accounts</td><td align="center">smbldap-groupadd</td><td align="center">groupadd</td></tr><tr><td align="left">Delete Group Accounts</td><td align="center">smbldap-groupdel</td><td align="center">groupdel</td></tr><tr><td align="left">Add User to Group</td><td align="center">smbldap-groupmod</td><td align="center">usermod (See Note)</td></tr><tr><td align="left">Add Machine Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr></tbody></table></div></div><br class="table-break"><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 202 <a class="indexterm" name="id3 87440"></a>203 <a class="indexterm" name="id3 87447"></a>204 <a class="indexterm" name="id3 87453"></a>202 <a class="indexterm" name="id361874"></a> 203 <a class="indexterm" name="id361881"></a> 204 <a class="indexterm" name="id361888"></a> 205 205 The UNIX/Linux <code class="literal">usermod</code> utility does not permit simple user addition to (or deletion 206 206 of users from) groups. This is a feature provided by the smbldap-tools scripts. If you want this … … 210 210 in the formal commands provided by Linux distributions (March 2004). 211 211 </p></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 212 <a class="indexterm" name="id3 87486"></a>212 <a class="indexterm" name="id361921"></a> 213 213 The <code class="literal">tdbdump</code> utility is a utility that you can build from the Samba source-code tree. Not all Linux binary distributions include this tool. If it is missing from your 214 214 Linux distribution, you will need to build this yourself or else forgo its use. 215 215 </p></div><p> 216 <a class="indexterm" name="id3 87504"></a>216 <a class="indexterm" name="id361939"></a> 217 217 Before starting the migration, all dead accounts were removed from the NT4 domain using the User Manager for Domains. 218 </p><div class="procedure"><a name="id3 87514"></a><p class="title"><b>Procedure 9.1. User Migration Steps</b></p><div class="example"><a name="sbent4smb"></a><p class="title"><b>Example 9.1. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id387571"></a><em class="parameter"><code>workgroup = DAMNATION</code></em></td></tr><tr><td><a class="indexterm" name="id387583"></a><em class="parameter"><code>netbios name = MERLIN</code></em></td></tr><tr><td><a class="indexterm" name="id387594"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id387606"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id387618"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id387629"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id387641"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id387652"></a><em class="parameter"><code>smb ports = 139 445</code></em></td></tr><tr><td><a class="indexterm" name="id387664"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id387675"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id387687"></a><em class="parameter"><code>#delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id387699"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id387711"></a><em class="parameter"><code>#delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id387723"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/ smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id387735"></a><em class="parameter"><code>#delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id387747"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id387759"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id387771"></a><em class="parameter"><code>logon script = scripts\logon.cmd</code></em></td></tr><tr><td><a class="indexterm" name="id387782"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id387794"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id387806"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id387817"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id387828"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id387840"></a><em class="parameter"><code>#wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id387851"></a><em class="parameter"><code>wins server = 192.168.123.124</code></em></td></tr><tr><td><a class="indexterm" name="id387863"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id387875"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id387886"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id387898"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id387910"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id387921"></a><em class="parameter"><code>ldap suffix = dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id387933"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id387944"></a><em class="parameter"><code>ldap timeout = 20</code></em></td></tr><tr><td><a class="indexterm" name="id387956"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id387967"></a><em class="parameter"><code>idmap backend = ldap:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id387979"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id387990"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id388002"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id388013"></a><em class="parameter"><code>ea support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id388025"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbent4smb2"></a><p class="title"><b>Example 9.2. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id388069"></a><em class="parameter"><code>comment = Application Data</code></em></td></tr><tr><td><a class="indexterm" name="id388081"></a><em class="parameter"><code>path = /data/home/apps</code></em></td></tr><tr><td><a class="indexterm" name="id388092"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id388113"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id388124"></a><em class="parameter"><code>path = /home/users/%U/Documents</code></em></td></tr><tr><td><a class="indexterm" name="id388136"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id388147"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id388159"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id388179"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id388191"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id388202"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id388214"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id388225"></a><em class="parameter"><code>use client driver = No</code></em></td></tr><tr><td><a class="indexterm" name="id388237"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id388257"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id388269"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id388280"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id388292"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id388312"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id388324"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id388335"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id388347"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id388367"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id388379"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id388390"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id388402"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id388422"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id388434"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbentslapd"></a><p class="title"><b>Example 9.3. NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</b></p><div class="example-contents"><pre class="screen">218 </p><div class="procedure"><a name="id361948"></a><p class="title"><b>Procedure 9.1. User Migration Steps</b></p><div class="example"><a name="sbent4smb"></a><p class="title"><b>Example 9.1. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id362006"></a><em class="parameter"><code>workgroup = DAMNATION</code></em></td></tr><tr><td><a class="indexterm" name="id362017"></a><em class="parameter"><code>netbios name = MERLIN</code></em></td></tr><tr><td><a class="indexterm" name="id362029"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id362040"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id362052"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id362063"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id362075"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id362086"></a><em class="parameter"><code>smb ports = 139 445</code></em></td></tr><tr><td><a class="indexterm" name="id362098"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id362110"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id362121"></a><em class="parameter"><code>#delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id362133"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id362145"></a><em class="parameter"><code>#delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id362157"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/ smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id362169"></a><em class="parameter"><code>#delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id362181"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id362193"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id362205"></a><em class="parameter"><code>logon script = scripts\logon.cmd</code></em></td></tr><tr><td><a class="indexterm" name="id362217"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id362228"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id362240"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id362251"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id362263"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id362274"></a><em class="parameter"><code>#wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id362286"></a><em class="parameter"><code>wins server = 192.168.123.124</code></em></td></tr><tr><td><a class="indexterm" name="id362297"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id362309"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id362321"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id362332"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id362344"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id362355"></a><em class="parameter"><code>ldap suffix = dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id362367"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id362378"></a><em class="parameter"><code>ldap timeout = 20</code></em></td></tr><tr><td><a class="indexterm" name="id362390"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id362402"></a><em class="parameter"><code>idmap backend = ldap:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id362413"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id362425"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id362436"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id362448"></a><em class="parameter"><code>ea support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id362459"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbent4smb2"></a><p class="title"><b>Example 9.2. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id362504"></a><em class="parameter"><code>comment = Application Data</code></em></td></tr><tr><td><a class="indexterm" name="id362515"></a><em class="parameter"><code>path = /data/home/apps</code></em></td></tr><tr><td><a class="indexterm" name="id362527"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id362547"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id362559"></a><em class="parameter"><code>path = /home/users/%U/Documents</code></em></td></tr><tr><td><a class="indexterm" name="id362570"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id362582"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id362593"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id362614"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id362625"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id362637"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id362648"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id362660"></a><em class="parameter"><code>use client driver = No</code></em></td></tr><tr><td><a class="indexterm" name="id362671"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id362692"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id362703"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id362715"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id362726"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id362747"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id362758"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id362770"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id362781"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id362802"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id362813"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id362825"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id362836"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id362857"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id362868"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbentslapd"></a><p class="title"><b>Example 9.3. NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</b></p><div class="example-contents"><pre class="screen"> 219 219 include /etc/openldap/schema/core.schema 220 220 include /etc/openldap/schema/cosine.schema … … 337 337 no account information can be deleted. 338 338 </p></li><li><p> 339 <a class="indexterm" name="id3 88452"></a>339 <a class="indexterm" name="id362886"></a> 340 340 Configure OpenLDAP in preparation for the migration. An example 341 341 <code class="filename">sladp.conf</code> file is shown in <a class="link" href="ntmigration.html#sbentslapd" title="Example 9.3. NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A">“NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A”</a>. … … 343 343 be obtained by executing the <code class="literal">slappasswd</code> command. 344 344 </p></li><li><p> 345 <a class="indexterm" name="id3 88551"></a>346 <a class="indexterm" name="id3 88557"></a>345 <a class="indexterm" name="id362985"></a> 346 <a class="indexterm" name="id362992"></a> 347 347 Install the PADL <code class="literal">nss_ldap</code> tool set, then configure the <code class="filename">/etc/ldap.conf</code> 348 348 as shown in <a class="link" href="ntmigration.html#sbrntldapconf" title="Example 9.5. NT4 Migration NSS LDAP File: /etc/ldap.conf">“NT4 Migration NSS LDAP File: /etc/ldap.conf”</a>. 349 349 </p></li><li><p> 350 <a class="indexterm" name="id3 88613"></a>350 <a class="indexterm" name="id363048"></a> 351 351 Edit the <code class="filename">/etc/nsswitch.conf</code> file so it has the entries shown 352 352 in <a class="link" href="ntmigration.html#sbentnss" title="Example 9.6. NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)">“NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)”</a>. Note that the LDAP entries have been commented out. … … 393 393 </pre><p> 394 394 </p></li><li><p> 395 <a class="indexterm" name="id3 88761"></a>396 <a class="indexterm" name="id3 88768"></a>397 <a class="indexterm" name="id3 88774"></a>398 <a class="indexterm" name="id3 88781"></a>395 <a class="indexterm" name="id363195"></a> 396 <a class="indexterm" name="id363202"></a> 397 <a class="indexterm" name="id363209"></a> 398 <a class="indexterm" name="id363216"></a> 399 399 Install the Idealx <code class="literal">smbldap-tools</code> software package, following 400 400 the instructions given in <a class="link" href="happy.html#sbeidealx" title="Install and Configure Idealx smbldap-tools Scripts">“Install and Configure Idealx smbldap-tools Scripts”</a>. The resulting perl scripts … … 490 490 /etc/smbldap-tools/smbldap_bind.conf done. 491 491 </pre><p> 492 <a class="indexterm" name="id3 88877"></a>493 <a class="indexterm" name="id3 88883"></a>494 <a class="indexterm" name="id3 88890"></a>495 <a class="indexterm" name="id3 88897"></a>492 <a class="indexterm" name="id363311"></a> 493 <a class="indexterm" name="id363318"></a> 494 <a class="indexterm" name="id363325"></a> 495 <a class="indexterm" name="id363331"></a> 496 496 Note that the NT4 domain SID that was previously obtained was entered above. Also, 497 497 the sambaUnixIdPooldn object was specified as sambaDomainName=DAMNATION. This is … … 546 546 This is expected behavior. 547 547 </p></li><li><p> 548 <a class="indexterm" name="id3 89036"></a>548 <a class="indexterm" name="id363470"></a> 549 549 Restart the LDAP server following initialization of the LDAP directory. Execute the 550 550 system control script provided on your system. The following steps can be used on … … 713 713 across, set up privileges, and set share and file/directory access controls. 714 714 </p></li><li><p> 715 <a class="indexterm" name="id3 89291"></a>716 <a class="indexterm" name="id3 89297"></a>715 <a class="indexterm" name="id363725"></a> 716 <a class="indexterm" name="id363732"></a> 717 717 Edit the <code class="filename">smb.conf</code> file to reset the parameter 718 718 <a class="link" href="smb.conf.5.html#DOMAINMASTER">domain master = Yes</a> so that … … 842 842 Creating unix group: 'Users' 843 843 </pre><p> 844 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 89442"></a>NT4 Migration Using tdbsam Backend</h3></div></div></div><p>844 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id363877"></a>NT4 Migration Using tdbsam Backend</h3></div></div></div><p> 845 845 In this example, we change the domain name of the NT4 server from 846 846 <code class="constant">DRUGPREP</code> to <code class="constant">MEGANET</code> prior to the use … … 850 850 databases. These entries must therefore be present, and correct options specified, 851 851 in your <code class="filename">smb.conf</code> file, or else the migration does not work as it should. 852 </p><div class="procedure"><a name="id3 89486"></a><p class="title"><b>Procedure 9.2. Migration Steps Using tdbsam</b></p><ol type="1"><li><p>852 </p><div class="procedure"><a name="id363920"></a><p class="title"><b>Procedure 9.2. Migration Steps Using tdbsam</b></p><ol type="1"><li><p> 853 853 Prepare a Samba-3 server precisely per the instructions shown in <a class="link" href="Big500users.html" title="Chapter 4. The 500-User Office">“The 500-User Office”</a>. 854 854 Set the workgroup name to <code class="constant">MEGANET</code>. 855 </p></li><li><p><a class="indexterm" name="id3 89513"></a><a class="indexterm" name="id389520"></a>855 </p></li><li><p><a class="indexterm" name="id363947"></a><a class="indexterm" name="id363955"></a> 856 856 Edit the <code class="filename">smb.conf</code> file to temporarily change the parameter 857 857 <a class="link" href="smb.conf.5.html#DOMAINMASTER">domain master = No</a> so … … 859 859 </p></li><li><p> 860 860 Start Samba as you have done previously. 861 </p></li><li><p><a class="indexterm" name="id3 89559"></a>861 </p></li><li><p><a class="indexterm" name="id363994"></a> 862 862 Join the NT4 Domain as a BDC, as shown here: 863 863 </p><pre class="screen"> … … 865 865 Joined domain MEGANET. 866 866 </pre><p> 867 </p></li><li><p><a class="indexterm" name="id3 89593"></a>867 </p></li><li><p><a class="indexterm" name="id364027"></a> 868 868 You may vampire the accounts from the NT4 PDC by executing the command, as shown here: 869 869 </p><pre class="screen"> … … 905 905 SAM_DELTA_DOMAIN_INFO not handled 906 906 </pre><p> 907 </p></li><li><p><a class="indexterm" name="id3 89636"></a>907 </p></li><li><p><a class="indexterm" name="id364070"></a> 908 908 At this point, we can validate our migration. Let's look at the accounts 909 909 in the form in which they are seen in a smbpasswd file. This achieves that: … … 937 937 CF271B744F7A55AFDA277FF88D80C527:[UX ]:LCT-3E8B4270: 938 938 </pre><p> 939 </p></li><li><p><a class="indexterm" name="id3 89688"></a>939 </p></li><li><p><a class="indexterm" name="id364122"></a> 940 940 An expanded view of a user account entry shows more of what was 941 941 obtained from the NT4 PDC: … … 963 963 Password must change: Mon, 18 Jan 2038 20:14:07 GMT 964 964 </pre><p> 965 </p></li><li><p><a class="indexterm" name="id3 89715"></a>965 </p></li><li><p><a class="indexterm" name="id364150"></a> 966 966 The following command lists the long names of the groups that have been 967 967 imported (vampired) from the NT4 PDC: … … 980 980 </pre><p> 981 981 Everything looks well and in order. 982 </p></li><li><p><a class="indexterm" name="id3 89750"></a><a class="indexterm" name="id389758"></a>982 </p></li><li><p><a class="indexterm" name="id364184"></a><a class="indexterm" name="id364192"></a> 983 983 Edit the <code class="filename">smb.conf</code> file to reset the parameter 984 984 <a class="link" href="smb.conf.5.html#DOMAINMASTER">domain master = Yes</a> so 985 985 the Samba server functions as a PDC for the purpose of migration. 986 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 89787"></a>Key Points Learned</h3></div></div></div><p>986 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id364222"></a>Key Points Learned</h3></div></div></div><p> 987 987 Migration of an NT4 PDC database to a Samba-3 PDC is possible. 988 988 </p><div class="itemizedlist"><ul type="disc"><li><p> … … 996 996 The net Samba-3 domain most likely requires some 997 997 administration and updating before going live. 998 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 89822"></a>Questions and Answers</h2></div></div></div><p>999 </p><div class="qandaset"><dl><dt> <a href="ntmigration.html#id3 89838">998 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id364256"></a>Questions and Answers</h2></div></div></div><p> 999 </p><div class="qandaset"><dl><dt> <a href="ntmigration.html#id364272"> 1000 1000 Why must I start each migration with a clean database? 1001 </a></dt><dt> <a href="ntmigration.html#id3 89874">1001 </a></dt><dt> <a href="ntmigration.html#id364308"> 1002 1002 Is it possible to set my domain SID to anything I like? 1003 </a></dt><dt> <a href="ntmigration.html#id3 89926">1003 </a></dt><dt> <a href="ntmigration.html#id364360"> 1004 1004 When using a tdbsam passdb backend, why must I have all domain user and group accounts 1005 1005 in /etc/passwd and /etc/group? 1006 </a></dt><dt> <a href="ntmigration.html#id3 90096">1006 </a></dt><dt> <a href="ntmigration.html#id364530"> 1007 1007 Why did you validate connectivity before attempting migration? 1008 </a></dt><dt> <a href="ntmigration.html#id3 90138">1008 </a></dt><dt> <a href="ntmigration.html#id364573"> 1009 1009 How would you merge 10 tdbsam-based domains into an LDAP database? 1010 </a></dt><dt> <a href="ntmigration.html#id3 90253">1010 </a></dt><dt> <a href="ntmigration.html#id364688"> 1011 1011 I want to change my domain name after I migrate all accounts from an NT4 domain to a 1012 1012 Samba-3 domain. Does it make any sense to migrate the machine accounts in that case? 1013 </a></dt><dt> <a href="ntmigration.html#id3 90325">1013 </a></dt><dt> <a href="ntmigration.html#id364759"> 1014 1014 After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why? 1015 </a></dt><dt> <a href="ntmigration.html#id3 90383">1015 </a></dt><dt> <a href="ntmigration.html#id364817"> 1016 1016 How can I reset group membership after loading the account information into the LDAP database? 1017 </a></dt><dt> <a href="ntmigration.html#id3 90415">1017 </a></dt><dt> <a href="ntmigration.html#id364849"> 1018 1018 What are the limits or constraints that apply to group names? 1019 </a></dt><dt> <a href="ntmigration.html#id3 90512">1019 </a></dt><dt> <a href="ntmigration.html#id364946"> 1020 1020 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 1021 1021 LDAP backend system using the vampire process? 1022 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id3 89838"></a><a name="id389840"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id389843"></a>1022 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id364272"></a><a name="id364274"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id364277"></a> 1023 1023 Why must I start each migration with a clean database? 1024 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 89858"></a>1024 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id364292"></a> 1025 1025 This is a recommendation that permits the data from each NT4 domain to 1026 1026 be kept separate until you are ready to merge them. Also, if you do not start with a clean database, … … 1029 1029 without undue errors and then to handle the merging of vampired data under 1030 1030 proper supervision. 1031 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 89874"></a><a name="id389876"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id389879"></a>1031 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id364308"></a><a name="id364310"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id364313"></a> 1032 1032 Is it possible to set my domain SID to anything I like? 1033 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 89894"></a><a class="indexterm" name="id389902"></a><a class="indexterm" name="id389909"></a>1033 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id364328"></a><a class="indexterm" name="id364336"></a><a class="indexterm" name="id364344"></a> 1034 1034 Yes, so long as the SID you create has the same structure as an autogenerated SID. 1035 1035 The typical SID looks like this: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX, where … … 1038 1038 You may want to set the SID to one that is already in use somewhere on your network, 1039 1039 but that is a little different from straight out creating your own domain SID. 1040 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 89926"></a><a name="id389928"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id389931"></a><a class="indexterm" name="id389939"></a><a class="indexterm" name="id389947"></a><a class="indexterm" name="id389955"></a><a class="indexterm" name="id389963"></a><a class="indexterm" name="id389974"></a><a class="indexterm" name="id389985"></a>1040 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id364360"></a><a name="id364362"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id364366"></a><a class="indexterm" name="id364374"></a><a class="indexterm" name="id364381"></a><a class="indexterm" name="id364389"></a><a class="indexterm" name="id364397"></a><a class="indexterm" name="id364408"></a><a class="indexterm" name="id364420"></a> 1041 1041 When using a tdbsam passdb backend, why must I have all domain user and group accounts 1042 1042 in <code class="filename">/etc/passwd</code> and <code class="filename">/etc/group</code>? 1043 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 90016"></a><a class="indexterm" name="id390024"></a><a class="indexterm" name="id390031"></a><a class="indexterm" name="id390039"></a><a class="indexterm" name="id390047"></a><a class="indexterm" name="id390055"></a>1043 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id364450"></a><a class="indexterm" name="id364458"></a><a class="indexterm" name="id364466"></a><a class="indexterm" name="id364474"></a><a class="indexterm" name="id364481"></a><a class="indexterm" name="id364489"></a> 1044 1044 Samba-3 must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba 1045 1045 does not fabricate the UNIX IDs from thin air, but rather requires them to be located … … 1056 1056 In short then, all UNIX and Windows networking accounts, both in tdbsam as well as in 1057 1057 LDAP, require UIDs/GIDs. 1058 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 90096"></a><a name="id390098"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id390101"></a><a class="indexterm" name="id390109"></a><a class="indexterm" name="id390117"></a>1058 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id364530"></a><a name="id364532"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id364535"></a><a class="indexterm" name="id364543"></a><a class="indexterm" name="id364551"></a> 1059 1059 Why did you validate connectivity before attempting migration? 1060 1060 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1062 1062 potential problems that may otherwise affect or impede account migration. I am always 1063 1063 mindful of the 4 P's of migration: Planning Prevents Poor Performance. 1064 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 90138"></a><a name="id390140"></a></td><td align="left" valign="top"><p>1064 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id364573"></a><a name="id364575"></a></td><td align="left" valign="top"><p> 1065 1065 How would you merge 10 tdbsam-based domains into an LDAP database? 1066 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 90151"></a><a class="indexterm" name="id390159"></a><a class="indexterm" name="id390166"></a><a class="indexterm" name="id390174"></a><a class="indexterm" name="id390182"></a><a class="indexterm" name="id390190"></a><a class="indexterm" name="id390197"></a><a class="indexterm" name="id390205"></a><a class="indexterm" name="id390213"></a><a class="indexterm" name="id390221"></a><a class="indexterm" name="id390229"></a>1066 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id364585"></a><a class="indexterm" name="id364593"></a><a class="indexterm" name="id364601"></a><a class="indexterm" name="id364609"></a><a class="indexterm" name="id364617"></a><a class="indexterm" name="id364624"></a><a class="indexterm" name="id364632"></a><a class="indexterm" name="id364640"></a><a class="indexterm" name="id364648"></a><a class="indexterm" name="id364655"></a><a class="indexterm" name="id364663"></a> 1067 1067 If you have 10 tdbsam Samba domains, there is considerable risk that there are a number of 1068 1068 accounts that have the same UNIX identifier (UID/GID). This means that you almost … … 1074 1074 you have migrated before handing over access to a user. After all, too many users with a bad 1075 1075 migration experience may threaten your career. 1076 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 90253"></a><a name="id390256"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id390259"></a><a class="indexterm" name="id390267"></a>1076 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id364688"></a><a name="id364690"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id364693"></a><a class="indexterm" name="id364701"></a> 1077 1077 I want to change my domain name after I migrate all accounts from an NT4 domain to a 1078 1078 Samba-3 domain. Does it make any sense to migrate the machine accounts in that case? 1079 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 90286"></a><a class="indexterm" name="id390294"></a><a class="indexterm" name="id390302"></a><a class="indexterm" name="id390310"></a>1079 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id364720"></a><a class="indexterm" name="id364728"></a><a class="indexterm" name="id364736"></a><a class="indexterm" name="id364744"></a> 1080 1080 I would recommend not to migrate the machine account. The machine accounts should still work, but there are registry entries 1081 1081 on each Windows NT4 and upward client that have a tattoo of the old domain name. If you 1082 1082 unjoin the domain and then rejoin the newly renamed Samba-3 domain, you can be certain to avoid 1083 1083 this tattooing effect. 1084 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 90325"></a><a name="id390327"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id390330"></a>1084 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id364759"></a><a name="id364761"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id364764"></a> 1085 1085 After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why? 1086 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 90345"></a><a class="indexterm" name="id390353"></a>1086 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id364780"></a><a class="indexterm" name="id364788"></a> 1087 1087 Samba-3 currently does not implement multiple group membership internally. If you use the Windows 1088 1088 NT4 Domain User Manager to manage accounts and you have an LDAP backend, the multiple group … … 1093 1093 and <code class="filename">/etc/group</code> information also. That is where the multiple group information 1094 1094 is most closely at your fingertips. 1095 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 90383"></a><a name="id390385"></a></td><td align="left" valign="top"><p>1095 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id364817"></a><a name="id364820"></a></td><td align="left" valign="top"><p> 1096 1096 How can I reset group membership after loading the account information into the LDAP database? 1097 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 90396"></a>1097 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id364830"></a> 1098 1098 You can use the NT4 Domain User Manager that can be downloaded from the Microsoft Web site. The 1099 1099 installation file is called <code class="filename">SRVTOOLS.EXE</code>. 1100 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 90415"></a><a name="id390417"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id390420"></a>1100 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id364849"></a><a name="id364852"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id364855"></a> 1101 1101 What are the limits or constraints that apply to group names? 1102 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 90435"></a><a class="indexterm" name="id390443"></a><a class="indexterm" name="id390451"></a><a class="indexterm" name="id390459"></a><a class="indexterm" name="id390467"></a><a class="indexterm" name="id390475"></a>1102 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id364870"></a><a class="indexterm" name="id364878"></a><a class="indexterm" name="id364885"></a><a class="indexterm" name="id364893"></a><a class="indexterm" name="id364901"></a><a class="indexterm" name="id364909"></a> 1103 1103 A Windows 200x group name can be up to 254 characters long, while in Windows NT4 the group 1104 1104 name is limited to 20 characters. Most UNIX systems limit this to 32 characters. Windows … … 1112 1112 or user account names. You have to experiment with your system to find what its 1113 1113 peculiarities are. 1114 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 90512"></a><a name="id390514"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id390517"></a>1114 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id364946"></a><a name="id364948"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id364951"></a> 1115 1115 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 1116 1116 LDAP backend system using the vampire process? … … 1121 1121 integer. UNIX/Linux systems that have a 32-bit UID/GID can easily handle this number of accounts. 1122 1122 Please check this carefully before you attempt to effect a migration using the vampire process. 1123 </p><p><a class="indexterm" name="id3 90544"></a>1123 </p><p><a class="indexterm" name="id364979"></a> 1124 1124 Migration speed depends much on the processor speed, the network speed, disk I/O capability, and 1125 1125 LDAP update overheads. On a dual processor AMD MP1600+ with 1 GB memory that was mirroring LDAP
Note:
See TracChangeset
for help on using the changeset viewer.
