- Timestamp:
- Sep 24, 2009, 9:15:13 AM (16 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.2.x/docs/htmldocs/Samba3-HOWTO/NT4Migration.html
r272 r335 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 36. Migration from NT4 PDC to Samba-3 PDC</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="migration.html" title="Part IV. Migration and Updating"><link rel="prev" href="upgrading-to-3.0.html" title="Chapter 35. Updating and Upgrading Samba"><link rel="next" href="SWAT.html" title="Chapter 37. SWAT: The Samba Web Administration Tool"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 36. Migration from NT4 PDC to Samba-3 PDC</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrading-to-3.0.html">Prev</a> </td><th width="60%" align="center">Part IV. Migration and Updating</th><td width="20%" align="right"> <a accesskey="n" href="SWAT.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="NT4Migration"></a>Chapter 36. Migration from NT4 PDC to Samba-3 PDC</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><p class="pubdate">April 3, 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="NT4Migration.html#id26790 86">Planning and Getting Started</a></span></dt><dd><dl><dt><span class="sect2"><a href="NT4Migration.html#id2679120">Objectives</a></span></dt><dt><span class="sect2"><a href="NT4Migration.html#id2680066">Steps in Migration Process</a></span></dt></dl></dd><dt><span class="sect1"><a href="NT4Migration.html#id2680301">Migration Options</a></span></dt><dd><dl><dt><span class="sect2"><a href="NT4Migration.html#id2680388">Planning for Success</a></span></dt><dt><span class="sect2"><a href="NT4Migration.html#id2680621">Samba-3 Implementation Choices</a></span></dt></dl></dd></dl></div><p>2 <a class="indexterm" name="id26790 69"></a>3 <a class="indexterm" name="id26790 76"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 36. Migration from NT4 PDC to Samba-3 PDC</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="migration.html" title="Part IV. Migration and Updating"><link rel="prev" href="upgrading-to-3.0.html" title="Chapter 35. Updating and Upgrading Samba"><link rel="next" href="SWAT.html" title="Chapter 37. SWAT: The Samba Web Administration Tool"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 36. Migration from NT4 PDC to Samba-3 PDC</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrading-to-3.0.html">Prev</a> </td><th width="60%" align="center">Part IV. Migration and Updating</th><td width="20%" align="right"> <a accesskey="n" href="SWAT.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="NT4Migration"></a>Chapter 36. Migration from NT4 PDC to Samba-3 PDC</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><p class="pubdate">April 3, 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="NT4Migration.html#id2679090">Planning and Getting Started</a></span></dt><dd><dl><dt><span class="sect2"><a href="NT4Migration.html#id2679125">Objectives</a></span></dt><dt><span class="sect2"><a href="NT4Migration.html#id2680070">Steps in Migration Process</a></span></dt></dl></dd><dt><span class="sect1"><a href="NT4Migration.html#id2680306">Migration Options</a></span></dt><dd><dl><dt><span class="sect2"><a href="NT4Migration.html#id2680392">Planning for Success</a></span></dt><dt><span class="sect2"><a href="NT4Migration.html#id2680625">Samba-3 Implementation Choices</a></span></dt></dl></dd></dl></div><p> 2 <a class="indexterm" name="id2679074"></a> 3 <a class="indexterm" name="id2679080"></a> 4 4 This is a rough guide to assist those wishing to migrate from NT4 domain control to 5 5 Samba-3-based domain control. 6 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id26790 86"></a>Planning and Getting Started</h2></div></div></div><p>7 <a class="indexterm" name="id267909 4"></a>6 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2679090"></a>Planning and Getting Started</h2></div></div></div><p> 7 <a class="indexterm" name="id2679098"></a> 8 8 In the IT world there is often a saying that all problems are encountered because of 9 9 poor planning. The corollary to this saying is that not all problems can be anticipated 10 10 and planned for. Then again, good planning will anticipate most show-stopper-type situations. 11 11 </p><p> 12 <a class="indexterm" name="id26791 09"></a>12 <a class="indexterm" name="id2679113"></a> 13 13 Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control 14 14 environment would do well to develop a detailed migration plan. So here are a few pointers to 15 15 help migration get underway. 16 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id267912 0"></a>Objectives</h3></div></div></div><p>17 <a class="indexterm" name="id26791 28"></a>16 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2679125"></a>Objectives</h3></div></div></div><p> 17 <a class="indexterm" name="id2679133"></a> 18 18 The key objective for most organizations is to make the migration from MS Windows NT4 19 19 to Samba-3 domain control as painless as possible. One of the challenges you may experience … … 22 22 pressure to return to a Microsoft-based platform solution at the first sign of trouble. 23 23 </p><p> 24 <a class="indexterm" name="id26791 46"></a>24 <a class="indexterm" name="id2679150"></a> 25 25 Before attempting a migration to a Samba-3-controlled network, make every possible effort to 26 26 gain all-round commitment to the change. Know precisely <span class="emphasis"><em>why</em></span> the change 27 27 is important for the organization. Possible motivations to make a change include: 28 </p><a class="indexterm" name="id267916 2"></a><a class="indexterm" name="id2679169"></a><a class="indexterm" name="id2679176"></a><a class="indexterm" name="id2679183"></a><a class="indexterm" name="id2679190"></a><div class="itemizedlist"><ul type="disc"><li><p>Improve network manageability.</p></li><li><p>Obtain better user-level functionality.</p></li><li><p>Reduce network operating costs.</p></li><li><p>Reduce exposure caused by Microsoft withdrawal of NT4 support.</p></li><li><p>Avoid MS License 6 implications.</p></li><li><p>Reduce organization's dependency on Microsoft.</p></li></ul></div><p>29 <a class="indexterm" name="id267923 2"></a>30 <a class="indexterm" name="id26792 39"></a>31 <a class="indexterm" name="id26792 46"></a>32 <a class="indexterm" name="id267925 3"></a>33 <a class="indexterm" name="id267926 0"></a>34 <a class="indexterm" name="id26792 66"></a>28 </p><a class="indexterm" name="id2679166"></a><a class="indexterm" name="id2679173"></a><a class="indexterm" name="id2679180"></a><a class="indexterm" name="id2679187"></a><a class="indexterm" name="id2679194"></a><div class="itemizedlist"><ul type="disc"><li><p>Improve network manageability.</p></li><li><p>Obtain better user-level functionality.</p></li><li><p>Reduce network operating costs.</p></li><li><p>Reduce exposure caused by Microsoft withdrawal of NT4 support.</p></li><li><p>Avoid MS License 6 implications.</p></li><li><p>Reduce organization's dependency on Microsoft.</p></li></ul></div><p> 29 <a class="indexterm" name="id2679237"></a> 30 <a class="indexterm" name="id2679244"></a> 31 <a class="indexterm" name="id2679251"></a> 32 <a class="indexterm" name="id2679258"></a> 33 <a class="indexterm" name="id2679264"></a> 34 <a class="indexterm" name="id2679271"></a> 35 35 Make sure everyone knows that Samba-3 is not MS Windows NT4. Samba-3 offers 36 36 an alternative solution that is both different from MS Windows NT4 and offers … … 40 40 </p><p> 41 41 What are the features that Samba-3 cannot provide? 42 </p><a class="indexterm" name="id26792 85"></a><a class="indexterm" name="id2679292"></a><a class="indexterm" name="id2679299"></a><a class="indexterm" name="id2679306"></a><a class="indexterm" name="id2679313"></a><div class="itemizedlist"><ul type="disc"><li><p>Active Directory Server.</p></li><li><p>Group Policy Objects (in Active Directory).</p></li><li><p>Machine Policy Objects.</p></li><li><p>Logon Scripts in Active Directory.</p></li><li><p>Software Application and Access Controls in Active Directory.</p></li></ul></div><p>42 </p><a class="indexterm" name="id2679290"></a><a class="indexterm" name="id2679297"></a><a class="indexterm" name="id2679304"></a><a class="indexterm" name="id2679311"></a><a class="indexterm" name="id2679318"></a><div class="itemizedlist"><ul type="disc"><li><p>Active Directory Server.</p></li><li><p>Group Policy Objects (in Active Directory).</p></li><li><p>Machine Policy Objects.</p></li><li><p>Logon Scripts in Active Directory.</p></li><li><p>Software Application and Access Controls in Active Directory.</p></li></ul></div><p> 43 43 The features that Samba-3 does provide and that may be of compelling interest to your site 44 44 include: 45 </p><a class="indexterm" name="id267935 4"></a><a class="indexterm" name="id2679360"></a><a class="indexterm" name="id2679367"></a><a class="indexterm" name="id2679374"></a><a class="indexterm" name="id2679381"></a><a class="indexterm" name="id2679388"></a><a class="indexterm" name="id2679395"></a><a class="indexterm" name="id2679402"></a><a class="indexterm" name="id2679409"></a><a class="indexterm" name="id2679416"></a><a class="indexterm" name="id2679423"></a><a class="indexterm" name="id2679430"></a><a class="indexterm" name="id2679437"></a><a class="indexterm" name="id2679443"></a><a class="indexterm" name="id2679450"></a><div class="itemizedlist"><ul type="disc"><li><p>Lower cost of ownership.</p></li><li><p>Global availability of support with no strings attached.</p></li><li><p>Dynamic SMB servers (can run more than one SMB/CIFS server per UNIX/Linux system).</p></li><li><p>Creation of on-the-fly logon scripts.</p></li><li><p>Creation of on-the-fly policy files.</p></li><li><p>Greater stability, reliability, performance, and availability.</p></li><li><p>Manageability via an SSH connection.</p></li><li><p>Flexible choices of backend authentication technologies (tdbsam, ldapsam).</p></li><li><p>Ability to implement a full single-sign-on architecture.</p></li><li><p>Ability to distribute authentication systems for absolute minimum wide-area network bandwidth demand.</p></li></ul></div><p>46 <a class="indexterm" name="id26795 16"></a>45 </p><a class="indexterm" name="id2679358"></a><a class="indexterm" name="id2679365"></a><a class="indexterm" name="id2679372"></a><a class="indexterm" name="id2679379"></a><a class="indexterm" name="id2679386"></a><a class="indexterm" name="id2679393"></a><a class="indexterm" name="id2679400"></a><a class="indexterm" name="id2679407"></a><a class="indexterm" name="id2679413"></a><a class="indexterm" name="id2679420"></a><a class="indexterm" name="id2679427"></a><a class="indexterm" name="id2679434"></a><a class="indexterm" name="id2679441"></a><a class="indexterm" name="id2679448"></a><a class="indexterm" name="id2679455"></a><div class="itemizedlist"><ul type="disc"><li><p>Lower cost of ownership.</p></li><li><p>Global availability of support with no strings attached.</p></li><li><p>Dynamic SMB servers (can run more than one SMB/CIFS server per UNIX/Linux system).</p></li><li><p>Creation of on-the-fly logon scripts.</p></li><li><p>Creation of on-the-fly policy files.</p></li><li><p>Greater stability, reliability, performance, and availability.</p></li><li><p>Manageability via an SSH connection.</p></li><li><p>Flexible choices of backend authentication technologies (tdbsam, ldapsam).</p></li><li><p>Ability to implement a full single-sign-on architecture.</p></li><li><p>Ability to distribute authentication systems for absolute minimum wide-area network bandwidth demand.</p></li></ul></div><p> 46 <a class="indexterm" name="id2679521"></a> 47 47 Before migrating a network from MS Windows NT4 to Samba-3, consider all necessary factors. Users 48 48 should be educated about changes they may experience so the change will be a welcome one 49 49 and not become an obstacle to the work they need to do. The following sections explain factors that will 50 50 help ensure a successful migration. 51 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id267953 0"></a>Domain Layout</h4></div></div></div><p>52 <a class="indexterm" name="id26795 38"></a>53 <a class="indexterm" name="id26795 45"></a>54 <a class="indexterm" name="id267955 2"></a>55 <a class="indexterm" name="id26795 59"></a>56 <a class="indexterm" name="id26795 66"></a>57 <a class="indexterm" name="id267957 3"></a>58 <a class="indexterm" name="id267958 0"></a>59 <a class="indexterm" name="id26795 87"></a>60 <a class="indexterm" name="id267959 3"></a>61 <a class="indexterm" name="id267960 0"></a>62 <a class="indexterm" name="id26796 07"></a>63 <a class="indexterm" name="id267961 4"></a>64 <a class="indexterm" name="id267962 1"></a>65 <a class="indexterm" name="id26796 28"></a>66 <a class="indexterm" name="id26796 35"></a>67 <a class="indexterm" name="id267964 2"></a>51 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2679535"></a>Domain Layout</h4></div></div></div><p> 52 <a class="indexterm" name="id2679543"></a> 53 <a class="indexterm" name="id2679550"></a> 54 <a class="indexterm" name="id2679557"></a> 55 <a class="indexterm" name="id2679564"></a> 56 <a class="indexterm" name="id2679571"></a> 57 <a class="indexterm" name="id2679578"></a> 58 <a class="indexterm" name="id2679584"></a> 59 <a class="indexterm" name="id2679591"></a> 60 <a class="indexterm" name="id2679598"></a> 61 <a class="indexterm" name="id2679605"></a> 62 <a class="indexterm" name="id2679612"></a> 63 <a class="indexterm" name="id2679619"></a> 64 <a class="indexterm" name="id2679626"></a> 65 <a class="indexterm" name="id2679633"></a> 66 <a class="indexterm" name="id2679640"></a> 67 <a class="indexterm" name="id2679646"></a> 68 68 Samba-3 can be configured as a domain controller, a backup domain controller (probably best called 69 69 a secondary controller), a domain member, or a standalone server. The Windows network security … … 75 75 a master server and multiple slave servers) that can simultaneously serve multiple domains. 76 76 </p><p> 77 <a class="indexterm" name="id26796 65"></a>77 <a class="indexterm" name="id2679670"></a> 78 78 From a design perspective, the number of users per server as well as the number of servers per 79 79 domain should be scaled taking into consideration server capacity and network bandwidth. 80 80 </p><p> 81 <a class="indexterm" name="id26796 78"></a>82 <a class="indexterm" name="id26796 85"></a>83 <a class="indexterm" name="id267969 2"></a>84 <a class="indexterm" name="id2679 699"></a>85 <a class="indexterm" name="id26797 06"></a>86 <a class="indexterm" name="id267971 3"></a>81 <a class="indexterm" name="id2679683"></a> 82 <a class="indexterm" name="id2679690"></a> 83 <a class="indexterm" name="id2679697"></a> 84 <a class="indexterm" name="id2679704"></a> 85 <a class="indexterm" name="id2679711"></a> 86 <a class="indexterm" name="id2679717"></a> 87 87 A physical network segment may house several domains. Each may span multiple network segments. 88 88 Where domains span routed network segments, consider and test the performance implications of … … 91 91 response time (ping timing) between the remote segment and the PDC. If it's long (more than 100 ms), 92 92 locate a BDC on the remote segment to serve as the local authentication and access control server. 93 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id267973 1"></a>Server Share and Directory Layout</h4></div></div></div><p>94 <a class="indexterm" name="id267974 0"></a>95 <a class="indexterm" name="id26797 46"></a>93 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2679736"></a>Server Share and Directory Layout</h4></div></div></div><p> 94 <a class="indexterm" name="id2679744"></a> 95 <a class="indexterm" name="id2679751"></a> 96 96 There are cardinal rules to effective network design that cannot be broken with impunity. 97 97 The most important rule: Simplicity is king in every well-controlled network. Every part of … … 99 99 of keeping systems secure and functional. 100 100 </p><p> 101 <a class="indexterm" name="id267976 2"></a>102 <a class="indexterm" name="id26797 69"></a>103 <a class="indexterm" name="id26797 76"></a>104 <a class="indexterm" name="id267978 3"></a>105 <a class="indexterm" name="id26797 89"></a>106 <a class="indexterm" name="id2679 796"></a>101 <a class="indexterm" name="id2679767"></a> 102 <a class="indexterm" name="id2679774"></a> 103 <a class="indexterm" name="id2679780"></a> 104 <a class="indexterm" name="id2679787"></a> 105 <a class="indexterm" name="id2679794"></a> 106 <a class="indexterm" name="id2679801"></a> 107 107 Keep in mind the nature of how data must be shared. Physical disk space layout should be considered 108 108 carefully. Some data must be backed up. The simpler the disk layout, the easier it will be to … … 112 112 backup, test, and validate every backup; create a disaster recovery plan and prove that it works. 113 113 </p><p> 114 <a class="indexterm" name="id26798 26"></a>115 <a class="indexterm" name="id267983 3"></a>116 <a class="indexterm" name="id267984 0"></a>114 <a class="indexterm" name="id2679830"></a> 115 <a class="indexterm" name="id2679838"></a> 116 <a class="indexterm" name="id2679844"></a> 117 117 Users should be grouped according to data access control needs. File and directory access 118 118 is best controlled via group permissions, and the use of the “<span class="quote">sticky bit</span>” on group-controlled 119 119 directories may substantially avoid file access complaints from Samba share users. 120 120 </p><p> 121 <a class="indexterm" name="id26798 58"></a>122 <a class="indexterm" name="id26798 65"></a>123 <a class="indexterm" name="id267987 2"></a>124 <a class="indexterm" name="id26798 79"></a>125 <a class="indexterm" name="id26798 86"></a>121 <a class="indexterm" name="id2679862"></a> 122 <a class="indexterm" name="id2679870"></a> 123 <a class="indexterm" name="id2679876"></a> 124 <a class="indexterm" name="id2679884"></a> 125 <a class="indexterm" name="id2679890"></a> 126 126 Inexperienced network administrators often attempt elaborate techniques to set access 127 127 controls on files, directories, shares, as well as in share definitions. … … 132 132 controls simple and effective, and make sure that users will never be interrupted by obtuse 133 133 complexity. 134 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id26799 06"></a>Logon Scripts</h4></div></div></div><p>135 <a class="indexterm" name="id267991 4"></a>134 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2679910"></a>Logon Scripts</h4></div></div></div><p> 135 <a class="indexterm" name="id2679918"></a> 136 136 Logon scripts can help to ensure that all users gain the share and printer connections they need. 137 137 </p><p> … … 141 141 the <a class="link" href="smb.conf.5.html#ROOTPREEXEC" target="_top">root preexec</a> parameters to the <em class="parameter"><code>NETLOGON</code></em> share. 142 142 </p><p> 143 <a class="indexterm" name="id267995 2"></a>143 <a class="indexterm" name="id2679957"></a> 144 144 Some sites prefer to use a tool such as <code class="literal">kixstart</code> to establish a controlled 145 145 user environment. In any case, you may wish to do a Google search for logon script process controls. 146 146 In particular, you may wish to explore the use of the Microsoft Knowledge Base article KB189105 that 147 147 deals with how to add printers without user intervention via the logon script process. 148 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id267997 2"></a>Profile Migration/Creation</h4></div></div></div><p>148 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2679977"></a>Profile Migration/Creation</h4></div></div></div><p> 149 149 User and group profiles may be migrated using the tools described in the section titled Desktop Profile 150 150 Management. 151 151 </p><p> 152 <a class="indexterm" name="id26799 86"></a>153 <a class="indexterm" name="id267999 2"></a>152 <a class="indexterm" name="id2679990"></a> 153 <a class="indexterm" name="id2679997"></a> 154 154 Profiles may also be managed using the Samba-3 tool <code class="literal">profiles</code>. This tool allows the MS 155 155 Windows NT-style security identifiers (SIDs) that are stored inside the profile 156 156 <code class="filename">NTuser.DAT</code> file to be changed to the SID of the Samba-3 domain. 157 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id26800 17"></a>User and Group Accounts</h4></div></div></div><p>158 <a class="indexterm" name="id268002 5"></a>159 <a class="indexterm" name="id268003 2"></a>160 <a class="indexterm" name="id26800 39"></a>161 <a class="indexterm" name="id26800 46"></a>157 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2680021"></a>User and Group Accounts</h4></div></div></div><p> 158 <a class="indexterm" name="id2680029"></a> 159 <a class="indexterm" name="id2680036"></a> 160 <a class="indexterm" name="id2680043"></a> 161 <a class="indexterm" name="id2680050"></a> 162 162 It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before 163 163 attempting to migrate user and group accounts, you are STRONGLY advised to create in Samba-3 the … … 165 165 suitable UNIX/Linux groups. By following this simple advice, all user and group attributes 166 166 should migrate painlessly. 167 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26800 66"></a>Steps in Migration Process</h3></div></div></div><p>167 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2680070"></a>Steps in Migration Process</h3></div></div></div><p> 168 168 The approximate migration process is described below. 169 169 </p><div class="itemizedlist"><ul type="disc"><li><p> 170 170 You have an NT4 PDC that has the users, groups, policies, and profiles to be migrated. 171 171 </p></li><li><p> 172 <a class="indexterm" name="id26800 87"></a>173 <a class="indexterm" name="id268009 4"></a>174 <a class="indexterm" name="id268010 1"></a>172 <a class="indexterm" name="id2680092"></a> 173 <a class="indexterm" name="id2680098"></a> 174 <a class="indexterm" name="id2680105"></a> 175 175 Samba-3 is set up as a domain controller with netlogon share, profile share, and so on. Configure the <code class="filename">smb.conf</code> file 176 176 to function as a BDC: <em class="parameter"><code>domain master = No</code></em>. 177 </p></li></ul></div><div class="procedure"><a name="id268012 4"></a><p class="title"><b>Procedure 36.1. The Account Migration Process</b></p><a class="indexterm" name="id2680212"></a><ol type="1"><li><p>178 <a class="indexterm" name="id26801 35"></a>177 </p></li></ul></div><div class="procedure"><a name="id2680128"></a><p class="title"><b>Procedure 36.1. The Account Migration Process</b></p><a class="indexterm" name="id2680216"></a><ol type="1"><li><p> 178 <a class="indexterm" name="id2680140"></a> 179 179 Create a BDC account in the old NT4 domain for the Samba server using NT Server Manager. 180 180 <span class="emphasis"><em>Samba must not be running.</em></span> 181 181 </p></li><li><p> 182 <a class="indexterm" name="id268015 4"></a>182 <a class="indexterm" name="id2680158"></a> 183 183 <strong class="userinput"><code>net rpc join -S <em class="replaceable"><code>NT4PDC</code></em> -w <em class="replaceable"><code>DOMNAME</code></em> -U 184 184 Administrator%<em class="replaceable"><code>passwd</code></em></code></strong> 185 185 </p></li><li><p> 186 <a class="indexterm" name="id26801 87"></a>186 <a class="indexterm" name="id2680192"></a> 187 187 <strong class="userinput"><code>net rpc vampire -S <em class="replaceable"><code>NT4PDC</code></em> -U 188 188 administrator%<em class="replaceable"><code>passwd</code></em></code></strong> 189 189 </p></li><li><p><strong class="userinput"><code>pdbedit -L</code></strong></p><p>Note: Did the users migrate?</p></li><li><p> 190 <a class="indexterm" name="id26802 39"></a>191 <a class="indexterm" name="id26802 48"></a>190 <a class="indexterm" name="id2680244"></a> 191 <a class="indexterm" name="id2680253"></a> 192 192 Now assign each of the UNIX groups to NT groups: 193 193 (It may be useful to copy this text to a script called <code class="filename">initGroups.sh</code>) … … 209 209 </p></li></ol></div><p> 210 210 Migrate all the profiles, then migrate all policy files. 211 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id268030 1"></a>Migration Options</h2></div></div></div><p>211 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2680306"></a>Migration Options</h2></div></div></div><p> 212 212 Sites that wish to migrate from MS Windows NT4 domain control to a Samba-based solution 213 213 generally fit into three basic categories. <a class="link" href="NT4Migration.html#majtypes" title="Table 36.1. The Three Major Site Types">Following table</a> shows the possibilities. 214 214 </p><div class="table"><a name="majtypes"></a><p class="title"><b>Table 36.1. The Three Major Site Types</b></p><div class="table-contents"><table summary="The Three Major Site Types" border="1"><colgroup><col align="left"><col align="justify"></colgroup><thead><tr><th align="left">Number of Users</th><th align="justify">Description</th></tr></thead><tbody><tr><td align="left">< 50</td><td align="justify"><p>Want simple conversion with no pain.</p></td></tr><tr><td align="left">50 - 250</td><td align="justify"><p>Want new features; can manage some inhouse complexity.</p></td></tr><tr><td align="left">> 250</td><td align="justify"><p>Solution/implementation must scale well; complex needs. 215 Cross-departmental decision process. Local expertise in most areas.</p></td></tr></tbody></table></div></div><br class="table-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26803 88"></a>Planning for Success</h3></div></div></div><p>215 Cross-departmental decision process. Local expertise in most areas.</p></td></tr></tbody></table></div></div><br class="table-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2680392"></a>Planning for Success</h3></div></div></div><p> 216 216 There are three basic choices for sites that intend to migrate from MS Windows NT4 217 217 to Samba-3: … … 234 234 </p></li></ul></div><p><a class="link" href="NT4Migration.html#natconchoices" title="Table 36.2. Nature of the Conversion Choices">Following table</a> lists the conversion choices given the type of migration 235 235 being contemplated. 236 </p><div class="table"><a name="natconchoices"></a><p class="title"><b>Table 36.2. Nature of the Conversion Choices</b></p><div class="table-contents"><table summary="Nature of the Conversion Choices" border="1"><colgroup><col align="justify"><col align="justify"><col align="justify"></colgroup><thead><tr><th align="justify">Simple Install</th><th align="justify">Upgrade Decisions</th><th align="justify">Redesign Decisions</th></tr></thead><tbody><tr><td align="justify"><p>Make use of minimal OS-specific features</p></td><td align="justify"><p>Translate NT4 features to new host OS features</p></td><td align="justify"><p>Improve on NT4 functionality, enhance management capabilities</p></td></tr><tr><td align="justify"><p>Move all accounts from NT4 into Samba-3</p></td><td align="justify"><p>Copy and improve</p></td><td align="justify"><p>Authentication regime (database location and access)</p></td></tr><tr><td align="justify"><p>Make least number of operational changes</p></td><td align="justify"><p>Make progressive improvements</p></td><td align="justify"><p>Desktop management methods</p></td></tr><tr><td align="justify"><p>Take least amount of time to migrate</p></td><td align="justify"><p>Minimize user impact</p></td><td align="justify"><p>Better control of Desktops/Users</p></td></tr><tr><td align="justify"><p>Live versus isolated conversion</p></td><td align="justify"><p>Maximize functionality</p></td><td align="justify"><p>Identify Needs for: <span class="emphasis"><em>Manageability, Scalability, Security, Availability</em></span></p></td></tr><tr><td align="justify"><p>Integrate Samba-3, then migrate while users are active, then change of control (swap out)</p></td><td align="justify"><p>Take advantage of lower maintenance opportunity</p></td><td align="justify"><p></p></td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id268062 1"></a>Samba-3 Implementation Choices</h3></div></div></div><div class="variablelist"><dl><dt><span class="term">Authentication Database/Backend</span></dt><dd><p>236 </p><div class="table"><a name="natconchoices"></a><p class="title"><b>Table 36.2. Nature of the Conversion Choices</b></p><div class="table-contents"><table summary="Nature of the Conversion Choices" border="1"><colgroup><col align="justify"><col align="justify"><col align="justify"></colgroup><thead><tr><th align="justify">Simple Install</th><th align="justify">Upgrade Decisions</th><th align="justify">Redesign Decisions</th></tr></thead><tbody><tr><td align="justify"><p>Make use of minimal OS-specific features</p></td><td align="justify"><p>Translate NT4 features to new host OS features</p></td><td align="justify"><p>Improve on NT4 functionality, enhance management capabilities</p></td></tr><tr><td align="justify"><p>Move all accounts from NT4 into Samba-3</p></td><td align="justify"><p>Copy and improve</p></td><td align="justify"><p>Authentication regime (database location and access)</p></td></tr><tr><td align="justify"><p>Make least number of operational changes</p></td><td align="justify"><p>Make progressive improvements</p></td><td align="justify"><p>Desktop management methods</p></td></tr><tr><td align="justify"><p>Take least amount of time to migrate</p></td><td align="justify"><p>Minimize user impact</p></td><td align="justify"><p>Better control of Desktops/Users</p></td></tr><tr><td align="justify"><p>Live versus isolated conversion</p></td><td align="justify"><p>Maximize functionality</p></td><td align="justify"><p>Identify Needs for: <span class="emphasis"><em>Manageability, Scalability, Security, Availability</em></span></p></td></tr><tr><td align="justify"><p>Integrate Samba-3, then migrate while users are active, then change of control (swap out)</p></td><td align="justify"><p>Take advantage of lower maintenance opportunity</p></td><td align="justify"><p></p></td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2680625"></a>Samba-3 Implementation Choices</h3></div></div></div><div class="variablelist"><dl><dt><span class="term">Authentication Database/Backend</span></dt><dd><p> 237 237 Samba-3 can use an external authentication backend: 238 238 </p><p> … … 241 241 </p></li></ul></div></dd><dt><span class="term">Access Control Points</span></dt><dd><p> 242 242 Samba permits Access Control points to be set: 243 </p><a class="indexterm" name="id268069 4"></a><a class="indexterm" name="id2680701"></a><a class="indexterm" name="id2680708"></a><a class="indexterm" name="id2680715"></a><div class="itemizedlist"><ul type="disc"><li><p>On the share itself using share ACLs.</p></li><li><p>On the file system using UNIX permissions on files and directories.</p><p>Note: Can enable Posix ACLs in file system also.</p></li><li><p>Through Samba share parameters not recommended except as last resort.</p></li></ul></div></dd><dt><span class="term">Policies (migrate or create new ones)</span></dt><dd><p>244 <a class="indexterm" name="id268076 3"></a>245 <a class="indexterm" name="id26807 69"></a>243 </p><a class="indexterm" name="id2680699"></a><a class="indexterm" name="id2680706"></a><a class="indexterm" name="id2680712"></a><a class="indexterm" name="id2680719"></a><div class="itemizedlist"><ul type="disc"><li><p>On the share itself using share ACLs.</p></li><li><p>On the file system using UNIX permissions on files and directories.</p><p>Note: Can enable Posix ACLs in file system also.</p></li><li><p>Through Samba share parameters not recommended except as last resort.</p></li></ul></div></dd><dt><span class="term">Policies (migrate or create new ones)</span></dt><dd><p> 244 <a class="indexterm" name="id2680767"></a> 245 <a class="indexterm" name="id2680774"></a> 246 246 Exercise great caution when making registry changes; use the right tool and be aware 247 247 that changes made through NT4-style <code class="filename">NTConfig.POL</code> files can leave 248 248 permanent changes. 249 <a class="indexterm" name="id26807 85"></a>250 <a class="indexterm" name="id268079 2"></a>251 <a class="indexterm" name="id2680 799"></a>249 <a class="indexterm" name="id2680790"></a> 250 <a class="indexterm" name="id2680796"></a> 251 <a class="indexterm" name="id2680803"></a> 252 252 </p><div class="itemizedlist"><ul type="disc"><li><p>Using Group Policy Editor (NT4).</p></li><li><p>Watch out for tattoo effect.</p></li></ul></div></dd><dt><span class="term">User and Group Profiles</span></dt><dd><p> 253 <a class="indexterm" name="id268083 0"></a>254 <a class="indexterm" name="id26808 37"></a>253 <a class="indexterm" name="id2680835"></a> 254 <a class="indexterm" name="id2680841"></a> 255 255 Platform-specific, so use platform tool to change from a local to a roaming profile. 256 256 Can use new profiles tool to change SIDs (<code class="filename">NTUser.DAT</code>). … … 258 258 Know how they work. 259 259 </p></dd><dt><span class="term">User and Group Mapping to UNIX/Linux</span></dt><dd><p> 260 <a class="indexterm" name="id26808 75"></a>260 <a class="indexterm" name="id2680880"></a> 261 261 User and group mapping code is new. Many problems have been experienced as network administrators 262 262 who are familiar with Samba-2.2.x migrate to Samba-3. Carefully study the chapters that document … … 275 275 (Note: machine names may be limited to 16 characters).</p></li><li><p>Use <code class="literal">net groupmap</code> to connect NT4 groups to UNIX groups.</p></li><li><p>Add/Delete Groups: Note OS limits on size and nature. 276 276 Linux limit is 16 char, no spaces, and no uppercase chars (<code class="literal">groupadd</code>).</p></li></ul></div></dd><dt><span class="term">Migration Tools</span></dt><dd><p> 277 <a class="indexterm" name="id268099 3"></a>277 <a class="indexterm" name="id2680997"></a> 278 278 Domain Control (NT4-Style) Profiles, Policies, Access Controls, Security 279 279 </p><div class="itemizedlist"><ul type="disc"><li><p>Samba: <code class="literal">net, rpcclient, smbpasswd, pdbedit, profiles</code></p></li><li><p>Windows: <code class="literal">NT4 Domain User Manager, Server Manager (NEXUS)</code></p></li></ul></div></dd></dl></div></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="upgrading-to-3.0.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="migration.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="SWAT.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 35. Updating and Upgrading Samba </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 37. SWAT: The Samba Web Administration Tool</td></tr></table></div></body></html>
Note:
See TracChangeset
for help on using the changeset viewer.
