- Timestamp:
- May 27, 2009, 9:08:03 AM (16 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/upgrades.html
r226 r231 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 8. Updating Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 3.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"><link rel="next" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 8. Updating Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="unixclients.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="ntmigration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="upgrades"></a>Chapter 8. Updating Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="upgrades.html#id2591226">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2591322">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2592651">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593353">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2593535">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2593645">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593848">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2594263">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></div><p>2 <a class="indexterm" name="id259 1142"></a>3 <a class="indexterm" name="id259 1148"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 8. Updating Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"><link rel="next" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 8. Updating Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="unixclients.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="ntmigration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="upgrades"></a>Chapter 8. Updating Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="upgrades.html#id2598126">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2598223">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2599552">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2599920">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2600254">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2600436">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2600546">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2600749">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2601164">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></div><p> 2 <a class="indexterm" name="id2598042"></a> 3 <a class="indexterm" name="id2598049"></a> 4 4 It was a little difficult to select an appropriate title for this chapter. 5 5 From email messages on the Samba mailing lists it is clear that many people … … 8 8 installing a new Samba server to replace an older existing Samba server. 9 9 </p><p> 10 <a class="indexterm" name="id259 1165"></a>11 <a class="indexterm" name="id259 1172"></a>10 <a class="indexterm" name="id2598065"></a> 11 <a class="indexterm" name="id2598072"></a> 12 12 There has also been much talk about migration of Samba-3 from an smbpasswd 13 13 passdb backend to the use of the tdbsam or ldapsam facilities that are new … … 18 18 highlighted by an email posting that included the following neat remark: 19 19 </p><div class="blockquote"><blockquote class="blockquote"><p> 20 <a class="indexterm" name="id259 1193"></a>20 <a class="indexterm" name="id2598093"></a> 21 21 I like the “<span class="quote">net rpc vampire</span>” on NT4, but that to my surprise does 22 22 not seem to work against a Samba PDC and, if addressed in the Samba to Samba 23 23 context in either book, I could not find it. 24 24 </p></blockquote></div><p> 25 <a class="indexterm" name="id259 1214"></a>25 <a class="indexterm" name="id2598114"></a> 26 26 So in response to the significant request for these situations to be better 27 27 documented, this chapter has now been added. User contributions and documentation 28 28 of real-world experiences are a most welcome addition to this chapter. 29 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id259 1226"></a>Introduction</h2></div></div></div><p>30 <a class="indexterm" name="id259 1234"></a>31 <a class="indexterm" name="id259 1241"></a>32 <a class="indexterm" name="id259 1247"></a>29 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2598126"></a>Introduction</h2></div></div></div><p> 30 <a class="indexterm" name="id2598134"></a> 31 <a class="indexterm" name="id2598141"></a> 32 <a class="indexterm" name="id2598148"></a> 33 33 A Windows network administrator explained in an email what changes he was 34 34 planning to make and followed with the question: “<span class="quote">Anyone done this … … 45 45 productivity on them. 46 46 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 47 <a class="indexterm" name="id259 1279"></a>48 <a class="indexterm" name="id259 1286"></a>47 <a class="indexterm" name="id2598179"></a> 48 <a class="indexterm" name="id2598186"></a> 49 49 Samba makes it possible to upgrade and update configuration files, but it 50 50 is not possible to downgrade the configuration files. Please ensure that … … 52 52 in the rare event that this may be necessary. 53 53 </p></div><p> 54 <a class="indexterm" name="id259 1300"></a>55 <a class="indexterm" name="id259 1307"></a>54 <a class="indexterm" name="id2598200"></a> 55 <a class="indexterm" name="id2598208"></a> 56 56 It is prudent also to backup all data files on the server before attempting 57 57 to perform a major upgrade. Many administrators have experienced the consequences … … 60 60 the precautions taken were inadequate. If a backup was not needed, but was available, 61 61 caution was on the side of the victor. 62 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id259 1322"></a>Cautions and Notes</h3></div></div></div><p>62 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2598223"></a>Cautions and Notes</h3></div></div></div><p> 63 63 Someone once said, “<span class="quote">It is good to be sorry, but better never to need to be!</span>” 64 64 These are wise words of advice to those contemplating a Samba upgrade or update. 65 65 </p><p> 66 <a class="indexterm" name="id259 1340"></a>67 <a class="indexterm" name="id259 1347"></a>68 <a class="indexterm" name="id259 1353"></a>66 <a class="indexterm" name="id2598240"></a> 67 <a class="indexterm" name="id2598247"></a> 68 <a class="indexterm" name="id2598254"></a> 69 69 This is as good a time as any to define the terms <code class="constant">upgrade</code> and 70 70 <code class="constant">update</code>. The term <code class="constant">upgrade</code> refers to … … 74 74 is in development. 75 75 </p><p> 76 <a class="indexterm" name="id259 1380"></a>76 <a class="indexterm" name="id2598281"></a> 77 77 The term <code class="constant">update</code> refers to a minor version number installation 78 78 in place of one of the same generation. For example, updating from Samba 3.0.10 to 3.0.14 79 79 is an update. The move from Samba 2.0.7 to 3.0.14 is an upgrade. 80 80 </p><p> 81 <a class="indexterm" name="id259 1398"></a>81 <a class="indexterm" name="id2598298"></a> 82 82 While the use of these terms is an exercise in semantics, what needs to be realized 83 83 is that there are major functional differences between a Samba 2.x release and a Samba … … 91 91 noone can read it!</span>” While true, some documentation is an evil necessity. 92 92 It is hoped that this update to the documentation will avoid both extremes. 93 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id259 1426"></a>Security Identifiers (SIDs)</h4></div></div></div><p>94 <a class="indexterm" name="id259 1434"></a>95 <a class="indexterm" name="id259 1443"></a>96 <a class="indexterm" name="id259 1450"></a>97 <a class="indexterm" name="id259 1456"></a>98 <a class="indexterm" name="id259 1463"></a>99 <a class="indexterm" name="id259 1472"></a>93 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2598326"></a>Security Identifiers (SIDs)</h4></div></div></div><p> 94 <a class="indexterm" name="id2598334"></a> 95 <a class="indexterm" name="id2598344"></a> 96 <a class="indexterm" name="id2598350"></a> 97 <a class="indexterm" name="id2598357"></a> 98 <a class="indexterm" name="id2598364"></a> 99 <a class="indexterm" name="id2598373"></a> 100 100 Before the days of Windows NT and OS/2, every Windows and DOS networking client 101 101 that used the SMB protocols was an entirely autonomous entity. There was no concept … … 105 105 Windows NT 3.10. 106 106 </p><p> 107 <a class="indexterm" name="id259 1492"></a>108 <a class="indexterm" name="id259 1499"></a>109 <a class="indexterm" name="id259 1505"></a>110 <a class="indexterm" name="id259 1512"></a>111 <a class="indexterm" name="id259 1518"></a>112 <a class="indexterm" name="id259 1525"></a>107 <a class="indexterm" name="id2598393"></a> 108 <a class="indexterm" name="id2598400"></a> 109 <a class="indexterm" name="id2598407"></a> 110 <a class="indexterm" name="id2598414"></a> 111 <a class="indexterm" name="id2598420"></a> 112 <a class="indexterm" name="id2598427"></a> 113 113 Versions of Samba prior to 1.9 did not make use of a SID. Instead they make exclusive use 114 114 of the username that is embedded in the SessionSetUpAndX component of the connection 115 115 setup process between a Windows client and an SMB/CIFS server. 116 116 </p><p> 117 <a class="indexterm" name="id259 1542"></a>118 <a class="indexterm" name="id259 1549"></a>119 <a class="indexterm" name="id259 1555"></a>117 <a class="indexterm" name="id2598444"></a> 118 <a class="indexterm" name="id2598450"></a> 119 <a class="indexterm" name="id2598457"></a> 120 120 Around November 1997 support was added to Samba-1.9 to handle the Windows security 121 121 RPC-based protocols that implemented support for Samba to store a machine SID. This 122 122 information was stored in a file called <code class="filename">MACHINE.SID.</code> 123 123 </p><p> 124 <a class="indexterm" name="id259 1575"></a>125 <a class="indexterm" name="id259 1582"></a>126 <a class="indexterm" name="id259 1588"></a>124 <a class="indexterm" name="id2598476"></a> 125 <a class="indexterm" name="id2598483"></a> 126 <a class="indexterm" name="id2598490"></a> 127 127 Within the lifetime of the early Samba 2.x series, the machine SID information was 128 128 relocated into a tdb file called <code class="filename">secrets.tdb</code>, which is where … … 130 130 local machine and its role within a domain security context. 131 131 </p><p> 132 <a class="indexterm" name="id259 1609"></a>133 <a class="indexterm" name="id259 1618"></a>134 <a class="indexterm" name="id259 1627"></a>135 <a class="indexterm" name="id259 1634"></a>132 <a class="indexterm" name="id2598510"></a> 133 <a class="indexterm" name="id2598520"></a> 134 <a class="indexterm" name="id2598529"></a> 135 <a class="indexterm" name="id2598536"></a> 136 136 There are two types of SID, those pertaining to the machine itself and the domain to 137 137 which it may belong, and those pertaining to users and groups within the security … … 139 139 servers (DMS). 140 140 </p><p> 141 <a class="indexterm" name="id259 1649"></a>142 <a class="indexterm" name="id259 1656"></a>143 <a class="indexterm" name="id259 1662"></a>144 <a class="indexterm" name="id259 1669"></a>145 <a class="indexterm" name="id259 1676"></a>146 <a class="indexterm" name="id259 1683"></a>141 <a class="indexterm" name="id2598550"></a> 142 <a class="indexterm" name="id2598557"></a> 143 <a class="indexterm" name="id2598564"></a> 144 <a class="indexterm" name="id2598570"></a> 145 <a class="indexterm" name="id2598577"></a> 146 <a class="indexterm" name="id2598584"></a> 147 147 When the Samba <code class="literal">smbd</code> daemon is first started, if the <code class="filename">secrets.tdb</code> 148 148 file does not exist, it is created at the first client connection attempt. If this file does … … 154 154 (hostname) and domain name (workgroup), it will be different. 155 155 </p><p> 156 <a class="indexterm" name="id259 1732"></a>156 <a class="indexterm" name="id2598634"></a> 157 157 The SID is the key used by MS Windows networking for all networking operations. This means 158 158 that when the machine or domain SID changes, all security-encoded objects such as profiles … … 163 163 be restored to its previous value. 164 164 </p></div><p> 165 <a class="indexterm" name="id259 1754"></a>166 <a class="indexterm" name="id259 1761"></a>167 <a class="indexterm" name="id259 1767"></a>168 <a class="indexterm" name="id259 1774"></a>169 <a class="indexterm" name="id259 1781"></a>170 <a class="indexterm" name="id259 1787"></a>171 <a class="indexterm" name="id259 1794"></a>172 <a class="indexterm" name="id259 1801"></a>173 <a class="indexterm" name="id259 1808"></a>174 <a class="indexterm" name="id259 1815"></a>165 <a class="indexterm" name="id2598655"></a> 166 <a class="indexterm" name="id2598662"></a> 167 <a class="indexterm" name="id2598668"></a> 168 <a class="indexterm" name="id2598675"></a> 169 <a class="indexterm" name="id2598682"></a> 170 <a class="indexterm" name="id2598689"></a> 171 <a class="indexterm" name="id2598696"></a> 172 <a class="indexterm" name="id2598702"></a> 173 <a class="indexterm" name="id2598709"></a> 174 <a class="indexterm" name="id2598716"></a> 175 175 In Samba-3 on a domain controller (PDC or BDC), the domain name controls the domain 176 176 SID. On all prior versions the hostname (computer name, or NetBIOS name) controlled 177 177 the SID. On a standalone server the hostname still controls the SID. 178 178 </p><p> 179 <a class="indexterm" name="id259 1829"></a>180 <a class="indexterm" name="id259 1838"></a>179 <a class="indexterm" name="id2598730"></a> 180 <a class="indexterm" name="id2598739"></a> 181 181 The local machine SID can be backed up using this procedure (Samba-3): 182 182 </p><pre class="screen"> … … 201 201 This is not a reversible process it is a one-way upgrade. 202 202 </p><p> 203 <a class="indexterm" name="id259 1926"></a>203 <a class="indexterm" name="id2598827"></a> 204 204 In the course of the Samba 2.0.x series the <code class="literal">smbpasswd</code> was modified to 205 205 permit the domain SID to be captured to the <code class="filename">secrets.tdb</code> file by executing: … … 218 218 </pre><p> 219 219 </p><p> 220 <a class="indexterm" name="id259 2000"></a>221 <a class="indexterm" name="id259 2006"></a>220 <a class="indexterm" name="id2598901"></a> 221 <a class="indexterm" name="id2598908"></a> 222 222 Domain security information, which includes the domain SID, can be obtained from Samba-2.2.x 223 223 systems by executing: … … 238 238 case it is ever needed at a later date. 239 239 </p><p> 240 <a class="indexterm" name="id259 2053"></a>241 <a class="indexterm" name="id259 2060"></a>242 <a class="indexterm" name="id259 2067"></a>240 <a class="indexterm" name="id2598954"></a> 241 <a class="indexterm" name="id2598961"></a> 242 <a class="indexterm" name="id2598968"></a> 243 243 Take note that the domain SID is used extensively in Samba. Where LDAP is used for the 244 244 <em class="parameter"><code>passdb backend</code></em>, all user, group, and trust accounts are encoded … … 251 251 </pre><p> 252 252 </p><p> 253 <a class="indexterm" name="id259 2103"></a>254 <a class="indexterm" name="id259 2109"></a>255 <a class="indexterm" name="id259 2116"></a>253 <a class="indexterm" name="id2599004"></a> 254 <a class="indexterm" name="id2599011"></a> 255 <a class="indexterm" name="id2599017"></a> 256 256 When the domain SID has changed, roaming profiles cease to be functional. The recovery 257 257 of roaming profiles necessitates resetting of the domain portion of the user SID … … 262 262 addressed to the creator of the RPM package. The Samba Team do their best to make 263 263 available all the tools needed to manage a Samba-based Windows networking environment. 264 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id259 2154"></a>Change of hostname</h4></div></div></div><p>265 <a class="indexterm" name="id259 2161"></a>266 <a class="indexterm" name="id259 2171"></a>264 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2599055"></a>Change of hostname</h4></div></div></div><p> 265 <a class="indexterm" name="id2599063"></a> 266 <a class="indexterm" name="id2599072"></a> 267 267 Samba uses two methods by which the primary NetBIOS machine name (also known as a computer 268 268 name or the hostname) may be determined: If the <code class="filename">smb.conf</code> file contains a … … 278 278 is changed, be sure to reset the machine SID to the original setting. Otherwise 279 279 there may be serious interoperability and/or operational problems. 280 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id259 2219"></a>Change of Workgroup (Domain) Name</h4></div></div></div><p>281 <a class="indexterm" name="id259 2227"></a>280 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2599120"></a>Change of Workgroup (Domain) Name</h4></div></div></div><p> 281 <a class="indexterm" name="id2599129"></a> 282 282 The domain name of a Samba server is identical to the workgroup name and is 283 283 set in the <code class="filename">smb.conf</code> file using the <em class="parameter"><code>workgroup</code></em> parameter. 284 284 This has been consistent throughout the history of Samba and across all versions. 285 285 </p><p> 286 <a class="indexterm" name="id259 2253"></a>286 <a class="indexterm" name="id2599154"></a> 287 287 Be aware that when the workgroup name is changed, a new SID will be generated. 288 288 The old domain SID can be reset using the procedure outlined earlier in this chapter. … … 293 293 for network administrators. 294 294 </p><p> 295 <a class="indexterm" name="id259 2284"></a>295 <a class="indexterm" name="id2599185"></a> 296 296 The Samba 1.9.x <code class="filename">smb.conf</code> file may be found either in the <code class="filename">/etc</code> 297 297 directory or in <code class="filename">/usr/local/samba/lib</code>. … … 301 301 remains located also for Samba 3.0.x installations. 302 302 </p><p> 303 <a class="indexterm" name="id259 2331"></a>303 <a class="indexterm" name="id2599231"></a> 304 304 Samba 2.x introduced the <code class="filename">secrets.tdb</code> file that is also stored in the 305 305 <code class="filename">/etc/samba</code> directory, or in the <code class="filename">/usr/local/samba/lib</code> 306 306 directory subsystem. 307 307 </p><p> 308 <a class="indexterm" name="id259 2360"></a>308 <a class="indexterm" name="id2599261"></a> 309 309 The location at which <code class="literal">smbd</code> expects to find all configuration and control 310 310 files is determined at the time of compilation of Samba. For versions of Samba prior to … … 318 318 <code class="filename">/usr/local/samba/sbin</code>. 319 319 </p><p> 320 <a class="indexterm" name="id259 2418"></a>320 <a class="indexterm" name="id2599319"></a> 321 321 Samba-3 provides a neat new way to track the location of all control files as well as to 322 322 find the compile-time options used as the Samba package was built. Here is how the dark … … 349 349 </pre><p> 350 350 </p><p> 351 <a class="indexterm" name="id259 2456"></a>351 <a class="indexterm" name="id2599356"></a> 352 352 It is important that both the <code class="filename">smb.conf</code> file and the <code class="filename">secrets.tdb</code> 353 353 be backed up before attempting any upgrade. The <code class="filename">secrets.tdb</code> file … … 355 355 of Samba. A backup means that it is always possible to revert a failed or problematic 356 356 upgrade. 357 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id259 2486"></a>International Language Support</h4></div></div></div><p>358 <a class="indexterm" name="id259 2494"></a>359 <a class="indexterm" name="id259 2501"></a>360 <a class="indexterm" name="id259 2508"></a>361 <a class="indexterm" name="id259 2514"></a>357 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2599386"></a>International Language Support</h4></div></div></div><p> 358 <a class="indexterm" name="id2599395"></a> 359 <a class="indexterm" name="id2599401"></a> 360 <a class="indexterm" name="id2599408"></a> 361 <a class="indexterm" name="id2599415"></a> 362 362 Samba-2.x had no support for Unicode; instead, all national language character-set support in file names 363 363 was done using particular locale codepage mapping techniques. Samba-3 supports Unicode in file names, thus 364 364 providing true internationalization support. 365 365 </p><p> 366 <a class="indexterm" name="id259 2529"></a>366 <a class="indexterm" name="id2599430"></a> 367 367 Non-English users whose national language character set has special characters and who upgrade naively will 368 368 find that many files that have the special characters in the file name will see them garbled and jumbled up. … … 370 370 that was in use with Samba-2.x using an 8-bit encoding scheme. 371 371 </p><p> 372 <a class="indexterm" name="id259 2546"></a>372 <a class="indexterm" name="id2599447"></a> 373 373 Files that are created with Samba-3 will use UTF-8 encoding. Should the file system ever end up with a 374 374 mix of codepage (unix charset)-encoded file names and UTF-8-encoded file names, the mess will take some 375 375 effort to set straight. 376 376 </p><p> 377 <a class="indexterm" name="id259 2560"></a>377 <a class="indexterm" name="id2599461"></a> 378 378 A very helpful tool is available from Bjorn Jacke's <a class="ulink" href="http://j3e.de/linux/convmv/" target="_top">convmv</a> 379 379 work. Convmv is a tool that can be used to convert file and directory names from one encoding method to 380 380 another. The most common use for this tool is to convert locale-encoded files to UTF-8 Unicode encoding. 381 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id259 2580"></a>Updates and Changes in Idealx smbldap-tools</h4></div></div></div><p>381 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2599480"></a>Updates and Changes in Idealx smbldap-tools</h4></div></div></div><p> 382 382 The smbldap-tools have been maturing rapidly over the past year. With maturation comes change. 383 383 The location of the <code class="filename">smbldap.conf</code> and the <code class="filename">smbldap_bind.conf</code> … … 393 393 current release should note that the information stored under <code class="constant">NextFreeUnixId</code> 394 394 must now be relocated to the DIT object <code class="constant">sambaDomainName</code>. 395 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id259 2651"></a>Upgrading from Samba 1.x and 2.x to Samba-3</h2></div></div></div><p>395 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2599552"></a>Upgrading from Samba 1.x and 2.x to Samba-3</h2></div></div></div><p> 396 396 Sites that are being upgraded from Samba-2 (or earlier versions) to Samba-3 397 397 may experience little difficulty or may require a lot of effort, depending … … 406 406 Where it is necessary to upgrade an old Samba installation to Samba-3, 407 407 the following procedure can be followed: 408 </p><div class="procedure"><a name="id259 2689"></a><p class="title"><b>Procedure 8.1. Upgrading from a Pre-Samba-3 Version</b></p><ol type="1"><li><p>409 <a class="indexterm" name="id259 2700"></a>410 <a class="indexterm" name="id259 2707"></a>411 <a class="indexterm" name="id259 2714"></a>408 </p><div class="procedure"><a name="id2599590"></a><p class="title"><b>Procedure 8.1. Upgrading from a Pre-Samba-3 Version</b></p><ol type="1"><li><p> 409 <a class="indexterm" name="id2599601"></a> 410 <a class="indexterm" name="id2599608"></a> 411 <a class="indexterm" name="id2599615"></a> 412 412 Stop Samba. This can be done using the appropriate system tool 413 413 that is particular for each operating system or by executing the … … 424 424 back it up to a safe location. 425 425 </p></li><li><p> 426 <a class="indexterm" name="id259 2795"></a>427 <a class="indexterm" name="id259 2802"></a>428 <a class="indexterm" name="id259 2809"></a>429 <a class="indexterm" name="id259 2816"></a>426 <a class="indexterm" name="id2599696"></a> 427 <a class="indexterm" name="id2599703"></a> 428 <a class="indexterm" name="id2599710"></a> 429 <a class="indexterm" name="id2599717"></a> 430 430 Find the location of the lock directory. This is the directory 431 431 in which Samba stores all its tdb control files. The default … … 438 438 tdb files to a safe location. 439 439 </p></li><li><p> 440 <a class="indexterm" name="id259 2854"></a>440 <a class="indexterm" name="id2599755"></a> 441 441 It is now safe to upgrade the Samba installation. On Linux systems 442 442 it is not necessary to remove the Samba RPMs because a simple … … 457 457 Do not change the workgroup name. 458 458 </p></li><li><p> 459 <a class="indexterm" name="id259 2910"></a>459 <a class="indexterm" name="id2599810"></a> 460 460 Execute the <code class="literal">testparm</code> to validate the <code class="filename">smb.conf</code> file. 461 461 This process will flag any parameters that are no longer supported. … … 469 469 <code class="prompt">root# </code> testparm -s smb.conf.master > smb.conf 470 470 </pre><p> 471 <a class="indexterm" name="id259 2967"></a>471 <a class="indexterm" name="id2599868"></a> 472 472 The resulting <code class="filename">smb.conf</code> file will be stripped of all comments 473 473 and of all nonconforming configuration settings. 474 474 </p></li><li><p> 475 <a class="indexterm" name="id259 2988"></a>475 <a class="indexterm" name="id2599889"></a> 476 476 It is now safe to start Samba using the appropriate system tool. 477 477 Alternately, it is possible to just execute <code class="literal">nmbd</code>, 478 478 <code class="literal">smbd</code>, and <code class="literal">winbindd</code> for the command 479 479 line while logged in as the root user. 480 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id259 3019"></a>Applicable to All Samba 2.x to Samba-3 Upgrades</h3></div></div></div><p>481 <a class="indexterm" name="id259 3028"></a>482 <a class="indexterm" name="id259 3034"></a>483 <a class="indexterm" name="id259 3041"></a>480 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2599920"></a>Applicable to All Samba 2.x to Samba-3 Upgrades</h3></div></div></div><p> 481 <a class="indexterm" name="id2599929"></a> 482 <a class="indexterm" name="id2599935"></a> 483 <a class="indexterm" name="id2599942"></a> 484 484 Samba 2.x servers that were running as a domain controller (PDC) 485 485 require changes to the configuration of the scripting interface … … 487 487 users, groups, and trust accounts (machines and interdomain). 488 488 </p><p> 489 <a class="indexterm" name="id259 3056"></a>489 <a class="indexterm" name="id2599956"></a> 490 490 The following parameters are new to Samba-3 and should be correctly configured. 491 491 Please refer to <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a> through <a class="link" href="2000users.html" title="Chapter 6. A Distributed 2000-User Network">“A Distributed 2000-User Network”</a> 492 492 in this book for examples of use of the new parameters shown here: 493 <a class="indexterm" name="id259 3077"></a>494 <a class="indexterm" name="id259 3083"></a>495 <a class="indexterm" name="id259 3090"></a>496 <a class="indexterm" name="id259 3097"></a>497 <a class="indexterm" name="id2 593104"></a>498 <a class="indexterm" name="id2 593112"></a>499 <a class="indexterm" name="id2 593119"></a>493 <a class="indexterm" name="id2599978"></a> 494 <a class="indexterm" name="id2599984"></a> 495 <a class="indexterm" name="id2599991"></a> 496 <a class="indexterm" name="id2599998"></a> 497 <a class="indexterm" name="id2600005"></a> 498 <a class="indexterm" name="id2600012"></a> 499 <a class="indexterm" name="id2600019"></a> 500 500 </p><p> 501 501 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><p>add group script</p></td></tr><tr><td><p>add machine script</p></td></tr><tr><td><p>add user to group script</p></td></tr><tr><td><p>delete group script</p></td></tr><tr><td><p>delete user from group script</p></td></tr><tr><td><p>passdb backend</p></td></tr><tr><td><p>set primary group script</p></td></tr></table><p> 502 502 </p><p> 503 <a class="indexterm" name="id2 593171"></a>504 <a class="indexterm" name="id2 593178"></a>503 <a class="indexterm" name="id2600071"></a> 504 <a class="indexterm" name="id2600078"></a> 505 505 The <em class="parameter"><code>add machine script</code></em> functionality was previously 506 506 handled by the <em class="parameter"><code>add user script</code></em>, which in Samba-3 is 507 507 used exclusively to add user accounts. 508 508 </p><p> 509 <a class="indexterm" name="id2 593202"></a>510 <a class="indexterm" name="id2 593209"></a>511 <a class="indexterm" name="id2 593216"></a>512 <a class="indexterm" name="id2 593222"></a>513 <a class="indexterm" name="id2 593229"></a>514 <a class="indexterm" name="id2 593236"></a>515 <a class="indexterm" name="id2 593243"></a>516 <a class="indexterm" name="id2 593250"></a>517 <a class="indexterm" name="id2 593256"></a>509 <a class="indexterm" name="id2600103"></a> 510 <a class="indexterm" name="id2600110"></a> 511 <a class="indexterm" name="id2600116"></a> 512 <a class="indexterm" name="id2600123"></a> 513 <a class="indexterm" name="id2600130"></a> 514 <a class="indexterm" name="id2600137"></a> 515 <a class="indexterm" name="id2600144"></a> 516 <a class="indexterm" name="id2600150"></a> 517 <a class="indexterm" name="id2600157"></a> 518 518 Where the <em class="parameter"><code>passdb backend</code></em> used is either <code class="constant">smbpasswd</code> 519 519 (the default) or the new <code class="constant">tdbsam</code>, the system interface scripts … … 522 522 <code class="literal">groupmod</code>, <code class="literal">groupdel</code>, and so on. 523 523 </p><p> 524 <a class="indexterm" name="id2 593317"></a>525 <a class="indexterm" name="id2 593324"></a>526 <a class="indexterm" name="id2 593331"></a>524 <a class="indexterm" name="id2600218"></a> 525 <a class="indexterm" name="id2600225"></a> 526 <a class="indexterm" name="id2600231"></a> 527 527 Where the <em class="parameter"><code>passdb backend</code></em> makes use of an LDAP directory, 528 528 it is necessary either to use the <code class="constant">smbldap-tools</code> provided 529 529 by Idealx or to use an alternate toolset provided by a third 530 530 party or else home-crafted to manage the LDAP directory accounts. 531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2 593353"></a>Samba-2.x with LDAP Support</h3></div></div></div><p>531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2600254"></a>Samba-2.x with LDAP Support</h3></div></div></div><p> 532 532 Samba version 2.x could be compiled for use either with or without LDAP. 533 533 The LDAP control settings in the <code class="filename">smb.conf</code> file in this old version are … … 539 539 of all files to the correct locations. 540 540 </p><p> 541 <a class="indexterm" name="id2 593388"></a>542 <a class="indexterm" name="id2 593394"></a>541 <a class="indexterm" name="id2600288"></a> 542 <a class="indexterm" name="id2600295"></a> 543 543 The Samba SAM schema required for Samba-3 is significantly different from that 544 544 used with Samba 2.x. This means that the LDAP directory must be updated … … 695 695 the DN's with quotation marks. 696 696 </pre><p> 697 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2 593535"></a>Updating a Samba-3 Installation</h2></div></div></div><p>697 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2600436"></a>Updating a Samba-3 Installation</h2></div></div></div><p> 698 698 The key concern in this section is to deal with the changes that have been 699 699 affected in Samba-3 between the Samba-3.0.0 release and the current update. … … 701 701 taken to update Samba-3 versions. 702 702 </p><p> 703 <a class="indexterm" name="id2 593551"></a>703 <a class="indexterm" name="id2600451"></a> 704 704 The information in <a class="link" href="upgrades.html#sbeug1" title="Location of config files">“Location of config files”</a> would not be necessary if every 705 705 person who has ever produced Samba executable (binary) files could agree on … … 707 707 Clearly, such agreement is further away than a pipedream. 708 708 </p><p> 709 <a class="indexterm" name="id2 593576"></a>709 <a class="indexterm" name="id2600477"></a> 710 710 Vendors and packagers who produce Samba binary installable packages do not, 711 711 as a rule, use the default paths used by the Samba-Team for the location of … … 720 720 effect. 721 721 </p><p> 722 <a class="indexterm" name="id2 593610"></a>722 <a class="indexterm" name="id2600511"></a> 723 723 The best advice for those lacking in code compilation experience is to use 724 724 only vendor (or Samba-Team) provided binary packages. The Samba packages … … 726 726 that are compatible with the original OS vendor's practices. 727 727 </p><p> 728 <a class="indexterm" name="id2 593625"></a>729 <a class="indexterm" name="id2 593632"></a>728 <a class="indexterm" name="id2600526"></a> 729 <a class="indexterm" name="id2600533"></a> 730 730 If you are not sure whether a binary package complies with the OS 731 731 vendor's practices, it is better to ask the package maintainer via … … 733 733 Alternately, just diagnose the paths specified by the binary files following 734 734 the procedure outlined above. 735 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2 593645"></a>Samba-3 to Samba-3 Updates on the Same Server</h3></div></div></div><p>735 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2600546"></a>Samba-3 to Samba-3 Updates on the Same Server</h3></div></div></div><p> 736 736 The guidance in this section deals with updates to an existing 737 737 Samba-3 server installation. 738 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2 593656"></a>Updating from Samba Versions Earlier than 3.0.5</h4></div></div></div><p>738 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2600557"></a>Updating from Samba Versions Earlier than 3.0.5</h4></div></div></div><p> 739 739 With the provision that the binary Samba-3 package has been built 740 740 with the same path and feature settings as the existing Samba-3 … … 743 743 and without need to change either the <code class="filename">smb.conf</code> file or, where 744 744 used, the LDAP schema. 745 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2 593679"></a>Updating from Samba Versions between 3.0.6 and 3.0.10</h4></div></div></div><p>746 <a class="indexterm" name="id2 593687"></a>747 <a class="indexterm" name="id2 593694"></a>745 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2600580"></a>Updating from Samba Versions between 3.0.6 and 3.0.10</h4></div></div></div><p> 746 <a class="indexterm" name="id2600588"></a> 747 <a class="indexterm" name="id2600595"></a> 748 748 When updating versions of Samba-3 prior to 3.0.6 to 3.0.6 through 3.0.10, 749 749 it is necessary only to update the LDAP schema (where LDAP is used). … … 751 751 update. 752 752 </p><p> 753 <a class="indexterm" name="id2 593710"></a>754 <a class="indexterm" name="id2 593717"></a>755 <a class="indexterm" name="id2 593724"></a>753 <a class="indexterm" name="id2600611"></a> 754 <a class="indexterm" name="id2600618"></a> 755 <a class="indexterm" name="id2600625"></a> 756 756 Samba-3.0.6 introduced the ability to remember the last <span class="emphasis"><em>n</em></span> number 757 757 of passwords a user has used. This information will work only with … … 760 760 </p><p> 761 761 After updating the LDAP schema, do not forget to re-index the LDAP database. 762 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2 593757"></a>Updating from Samba Versions after 3.0.6 to a Current Release</h4></div></div></div><p>763 <a class="indexterm" name="id2 593766"></a>762 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2600658"></a>Updating from Samba Versions after 3.0.6 to a Current Release</h4></div></div></div><p> 763 <a class="indexterm" name="id2600667"></a> 764 764 Samba-3.0.8 introduced changes in how the <em class="parameter"><code>username map</code></em> 765 765 behaves. It also included a change in behavior of <code class="literal">winbindd</code>. … … 767 767 from versions prior to 3.0.8 to a current version. 768 768 </p><p> 769 <a class="indexterm" name="id2 593797"></a>769 <a class="indexterm" name="id2600699"></a> 770 770 In Samba-3.0.11 a new privileges interface was implemented. Please 771 771 refer to <a class="link" href="happy.html#sbehap-ppc" title="Addition of Machines to the Domain">“Addition of Machines to the Domain”</a> for information regarding this new … … 789 789 back to searching the 'ldap suffix' in some cases. 790 790 </pre><p> 791 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2 593848"></a>Migrating Samba-3 to a New Server</h3></div></div></div><p>791 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2600749"></a>Migrating Samba-3 to a New Server</h3></div></div></div><p> 792 792 The two most likely candidates for replacement of a server are 793 793 domain member servers and domain controllers. Each needs to be 794 794 handled slightly differently. 795 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2 593860"></a>Replacing a Domain Member Server</h4></div></div></div><p>796 <a class="indexterm" name="id2 593868"></a>795 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2600761"></a>Replacing a Domain Member Server</h4></div></div></div><p> 796 <a class="indexterm" name="id2600770"></a> 797 797 Replacement of a domain member server should be done 798 798 using the same procedure as outlined in <a class="link" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients">“Adding Domain Member Servers and Clients”</a>. … … 803 803 change its SID and will necessitate rejoining to the domain. 804 804 </p><p> 805 <a class="indexterm" name="id2 593894"></a>806 <a class="indexterm" name="id2 593900"></a>807 <a class="indexterm" name="id2 593907"></a>808 <a class="indexterm" name="id2 593914"></a>809 <a class="indexterm" name="id2 593921"></a>810 <a class="indexterm" name="id2 593928"></a>805 <a class="indexterm" name="id2600795"></a> 806 <a class="indexterm" name="id2600802"></a> 807 <a class="indexterm" name="id2600808"></a> 808 <a class="indexterm" name="id2600815"></a> 809 <a class="indexterm" name="id2600822"></a> 810 <a class="indexterm" name="id2600829"></a> 811 811 Following a change of hostname (NetBIOS name) it is a good idea on all servers 812 812 to shut down the Samba <code class="literal">smbd</code>, <code class="literal">nmbd</code>, and … … 818 818 change, but can persist for a longer period of time. 819 819 </p><p> 820 <a class="indexterm" name="id2 593975"></a>821 <a class="indexterm" name="id2 593982"></a>822 <a class="indexterm" name="id2 593988"></a>823 <a class="indexterm" name="id2 593995"></a>820 <a class="indexterm" name="id2600876"></a> 821 <a class="indexterm" name="id2600883"></a> 822 <a class="indexterm" name="id2600890"></a> 823 <a class="indexterm" name="id2600896"></a> 824 824 If the old domain member server had local accounts, it is necessary to create 825 825 on the new domain member server the same accounts with the same UID and GID … … 832 832 account entries to the new target server. 833 833 </p><p> 834 <a class="indexterm" name="id2 594044"></a>834 <a class="indexterm" name="id2600945"></a> 835 835 Where the user accounts for both UNIX and Samba are stored in LDAP, the new 836 836 target server must be configured to use the <code class="literal">nss_ldap</code> tool set. 837 837 This will automatically ensure that the appropriate user entities are 838 838 available on the new server. 839 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2 594062"></a>Replacing a Domain Controller</h4></div></div></div><p>840 <a class="indexterm" name="id2 594071"></a>839 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2600964"></a>Replacing a Domain Controller</h4></div></div></div><p> 840 <a class="indexterm" name="id2600972"></a> 841 841 In the past, people who replaced a Windows NT4 domain controller typically 842 842 installed a new server, created printers and file shares on it, then migrate across … … 891 891 should correctly pick up the original SID and preserve all other settings. It is 892 892 sound advice to validate this before turning the system over to users. 893 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2 594263"></a>Migration of Samba Accounts to Active Directory</h3></div></div></div><p>893 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2601164"></a>Migration of Samba Accounts to Active Directory</h3></div></div></div><p> 894 894 Yes, it works. The Windows ADMT tool can be used to migrate Samba accounts 895 895 to MS Active Directory. There are a few pitfalls to be aware of: 896 </p><div class="procedure"><a name="id2 594275"></a><p class="title"><b>Procedure 8.2. Migration to Active Directory</b></p><ol type="1"><li><p>896 </p><div class="procedure"><a name="id2601176"></a><p class="title"><b>Procedure 8.2. Migration to Active Directory</b></p><ol type="1"><li><p> 897 897 Administrator password must be THE SAME on the Samba server, 898 898 the 2003 ADS, and the local Administrator account on the workstations. … … 915 915 workstations won't be migrated to the new domain. 916 916 </p></li><li><p> 917 <a class="indexterm" name="id2 594341"></a>917 <a class="indexterm" name="id2601242"></a> 918 918 When migrating machines, always test first (using ADMT's test mode) 919 919 and satisfy all errors before committing the migration. Note that the … … 923 923 a test. 924 924 </p></li></ol></div><p> 925 <a class="indexterm" name="id2 594358"></a>925 <a class="indexterm" name="id2601260"></a> 926 926 There are some significant benefits of using the ADMT, besides just 927 927 migrating user accounts. ADMT can be found on the Windows 2003 CD.
Note:
See TracChangeset
for help on using the changeset viewer.
