- Timestamp:
- Jan 15, 2010, 8:21:06 AM (16 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.3.x/docs/htmldocs/Samba3-ByExample/upgrades.html
r218 r368 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 8. Updating Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"><link rel="next" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 8. Updating Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="unixclients.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="ntmigration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="upgrades"></a>Chapter 8. Updating Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="upgrades.html#id2598126">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2598223">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2599552">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2599920">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2600254">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2600436">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2600546">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2600749">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2601164">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></div><p>2 <a class="indexterm" name="id2 598042"></a>3 <a class="indexterm" name="id2 598049"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 8. Updating Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"><link rel="next" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 8. Updating Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="unixclients.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="ntmigration.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 8. Updating Samba-3"><div class="titlepage"><div><div><h2 class="title"><a name="upgrades"></a>Chapter 8. Updating Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="upgrades.html#id2604185">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2604281">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2605610">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2605979">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2606312">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2606494">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2606604">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2606808">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2607222">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></div><p> 2 <a class="indexterm" name="id2604100"></a> 3 <a class="indexterm" name="id2604107"></a> 4 4 It was a little difficult to select an appropriate title for this chapter. 5 5 From email messages on the Samba mailing lists it is clear that many people … … 8 8 installing a new Samba server to replace an older existing Samba server. 9 9 </p><p> 10 <a class="indexterm" name="id2 598065"></a>11 <a class="indexterm" name="id2 598072"></a>10 <a class="indexterm" name="id2604124"></a> 11 <a class="indexterm" name="id2604130"></a> 12 12 There has also been much talk about migration of Samba-3 from an smbpasswd 13 13 passdb backend to the use of the tdbsam or ldapsam facilities that are new … … 18 18 highlighted by an email posting that included the following neat remark: 19 19 </p><div class="blockquote"><blockquote class="blockquote"><p> 20 <a class="indexterm" name="id2 598093"></a>21 I like the “<span class="quote">net rpc vampire</span>”on NT4, but that to my surprise does20 <a class="indexterm" name="id2604152"></a> 21 I like the <span class="quote">“<span class="quote">net rpc vampire</span>”</span> on NT4, but that to my surprise does 22 22 not seem to work against a Samba PDC and, if addressed in the Samba to Samba 23 23 context in either book, I could not find it. 24 24 </p></blockquote></div><p> 25 <a class="indexterm" name="id2 598114"></a>25 <a class="indexterm" name="id2604173"></a> 26 26 So in response to the significant request for these situations to be better 27 27 documented, this chapter has now been added. User contributions and documentation 28 28 of real-world experiences are a most welcome addition to this chapter. 29 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2598126"></a>Introduction</h2></div></div></div><p>30 <a class="indexterm" name="id2 598134"></a>31 <a class="indexterm" name="id2 598141"></a>32 <a class="indexterm" name="id2 598148"></a>29 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2604185"></a>Introduction</h2></div></div></div><p> 30 <a class="indexterm" name="id2604193"></a> 31 <a class="indexterm" name="id2604199"></a> 32 <a class="indexterm" name="id2604206"></a> 33 33 A Windows network administrator explained in an email what changes he was 34 planning to make and followed with the question: “<span class="quote">Anyone done this35 before?</span>” Many of us have upgraded and updated Samba without incident.34 planning to make and followed with the question: <span class="quote">“<span class="quote">Anyone done this 35 before?</span>”</span> Many of us have upgraded and updated Samba without incident. 36 36 Others have experienced much pain and user frustration. So it is to be hoped 37 37 that the notes in this chapter will make a positive difference by assuring … … 44 44 fails to take adequate steps to avoid situations that may inflict lost 45 45 productivity on them. 46 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>47 <a class="indexterm" name="id2 598179"></a>48 <a class="indexterm" name="id2 598186"></a>46 </p><div class="warning" title="Warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 47 <a class="indexterm" name="id2604237"></a> 48 <a class="indexterm" name="id2604244"></a> 49 49 Samba makes it possible to upgrade and update configuration files, but it 50 50 is not possible to downgrade the configuration files. Please ensure that … … 52 52 in the rare event that this may be necessary. 53 53 </p></div><p> 54 <a class="indexterm" name="id2 598200"></a>55 <a class="indexterm" name="id2 598208"></a>54 <a class="indexterm" name="id2604259"></a> 55 <a class="indexterm" name="id2604266"></a> 56 56 It is prudent also to backup all data files on the server before attempting 57 57 to perform a major upgrade. Many administrators have experienced the consequences … … 60 60 the precautions taken were inadequate. If a backup was not needed, but was available, 61 61 caution was on the side of the victor. 62 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2598223"></a>Cautions and Notes</h3></div></div></div><p>63 Someone once said, “<span class="quote">It is good to be sorry, but better never to need to be!</span>”62 </p><div class="sect2" title="Cautions and Notes"><div class="titlepage"><div><div><h3 class="title"><a name="id2604281"></a>Cautions and Notes</h3></div></div></div><p> 63 Someone once said, <span class="quote">“<span class="quote">It is good to be sorry, but better never to need to be!</span>”</span> 64 64 These are wise words of advice to those contemplating a Samba upgrade or update. 65 65 </p><p> 66 <a class="indexterm" name="id2 598240"></a>67 <a class="indexterm" name="id2 598247"></a>68 <a class="indexterm" name="id2 598254"></a>66 <a class="indexterm" name="id2604299"></a> 67 <a class="indexterm" name="id2604305"></a> 68 <a class="indexterm" name="id2604312"></a> 69 69 This is as good a time as any to define the terms <code class="constant">upgrade</code> and 70 70 <code class="constant">update</code>. The term <code class="constant">upgrade</code> refers to … … 74 74 is in development. 75 75 </p><p> 76 <a class="indexterm" name="id2 598281"></a>76 <a class="indexterm" name="id2604339"></a> 77 77 The term <code class="constant">update</code> refers to a minor version number installation 78 78 in place of one of the same generation. For example, updating from Samba 3.0.10 to 3.0.14 79 79 is an update. The move from Samba 2.0.7 to 3.0.14 is an upgrade. 80 80 </p><p> 81 <a class="indexterm" name="id2 598298"></a>81 <a class="indexterm" name="id2604356"></a> 82 82 While the use of these terms is an exercise in semantics, what needs to be realized 83 83 is that there are major functional differences between a Samba 2.x release and a Samba … … 87 87 modified to preserve prior functionality. 88 88 </p><p> 89 There is an old axiom that says, “<span class="quote">The greater the volume of the documentation,89 There is an old axiom that says, <span class="quote">“<span class="quote">The greater the volume of the documentation, 90 90 the greater the risk that noone will read it, but where there is no documentation, 91 noone can read it!</span>” While true, some documentation is an evil necessity.91 noone can read it!</span>”</span> While true, some documentation is an evil necessity. 92 92 It is hoped that this update to the documentation will avoid both extremes. 93 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2598326"></a>Security Identifiers (SIDs)</h4></div></div></div><p>94 <a class="indexterm" name="id2 598334"></a>95 <a class="indexterm" name="id2 598344"></a>96 <a class="indexterm" name="id2 598350"></a>97 <a class="indexterm" name="id2 598357"></a>98 <a class="indexterm" name="id2 598364"></a>99 <a class="indexterm" name="id2 598373"></a>93 </p><div class="sect3" title="Security Identifiers (SIDs)"><div class="titlepage"><div><div><h4 class="title"><a name="id2604385"></a>Security Identifiers (SIDs)</h4></div></div></div><p> 94 <a class="indexterm" name="id2604393"></a> 95 <a class="indexterm" name="id2604402"></a> 96 <a class="indexterm" name="id2604409"></a> 97 <a class="indexterm" name="id2604416"></a> 98 <a class="indexterm" name="id2604422"></a> 99 <a class="indexterm" name="id2604432"></a> 100 100 Before the days of Windows NT and OS/2, every Windows and DOS networking client 101 101 that used the SMB protocols was an entirely autonomous entity. There was no concept … … 105 105 Windows NT 3.10. 106 106 </p><p> 107 <a class="indexterm" name="id2 598393"></a>108 <a class="indexterm" name="id2 598400"></a>109 <a class="indexterm" name="id2 598407"></a>110 <a class="indexterm" name="id2 598414"></a>111 <a class="indexterm" name="id2 598420"></a>112 <a class="indexterm" name="id2 598427"></a>107 <a class="indexterm" name="id2604451"></a> 108 <a class="indexterm" name="id2604458"></a> 109 <a class="indexterm" name="id2604465"></a> 110 <a class="indexterm" name="id2604472"></a> 111 <a class="indexterm" name="id2604478"></a> 112 <a class="indexterm" name="id2604485"></a> 113 113 Versions of Samba prior to 1.9 did not make use of a SID. Instead they make exclusive use 114 114 of the username that is embedded in the SessionSetUpAndX component of the connection 115 115 setup process between a Windows client and an SMB/CIFS server. 116 116 </p><p> 117 <a class="indexterm" name="id2 598444"></a>118 <a class="indexterm" name="id2 598450"></a>119 <a class="indexterm" name="id2 598457"></a>117 <a class="indexterm" name="id2604502"></a> 118 <a class="indexterm" name="id2604509"></a> 119 <a class="indexterm" name="id2604515"></a> 120 120 Around November 1997 support was added to Samba-1.9 to handle the Windows security 121 121 RPC-based protocols that implemented support for Samba to store a machine SID. This 122 122 information was stored in a file called <code class="filename">MACHINE.SID.</code> 123 123 </p><p> 124 <a class="indexterm" name="id2 598476"></a>125 <a class="indexterm" name="id2 598483"></a>126 <a class="indexterm" name="id2 598490"></a>124 <a class="indexterm" name="id2604535"></a> 125 <a class="indexterm" name="id2604542"></a> 126 <a class="indexterm" name="id2604548"></a> 127 127 Within the lifetime of the early Samba 2.x series, the machine SID information was 128 128 relocated into a tdb file called <code class="filename">secrets.tdb</code>, which is where … … 130 130 local machine and its role within a domain security context. 131 131 </p><p> 132 <a class="indexterm" name="id2 598510"></a>133 <a class="indexterm" name="id2 598520"></a>134 <a class="indexterm" name="id2 598529"></a>135 <a class="indexterm" name="id2 598536"></a>132 <a class="indexterm" name="id2604569"></a> 133 <a class="indexterm" name="id2604578"></a> 134 <a class="indexterm" name="id2604587"></a> 135 <a class="indexterm" name="id2604594"></a> 136 136 There are two types of SID, those pertaining to the machine itself and the domain to 137 137 which it may belong, and those pertaining to users and groups within the security … … 139 139 servers (DMS). 140 140 </p><p> 141 <a class="indexterm" name="id2 598550"></a>142 <a class="indexterm" name="id2 598557"></a>143 <a class="indexterm" name="id2 598564"></a>144 <a class="indexterm" name="id2 598570"></a>145 <a class="indexterm" name="id2 598577"></a>146 <a class="indexterm" name="id2 598584"></a>141 <a class="indexterm" name="id2604608"></a> 142 <a class="indexterm" name="id2604615"></a> 143 <a class="indexterm" name="id2604622"></a> 144 <a class="indexterm" name="id2604629"></a> 145 <a class="indexterm" name="id2604636"></a> 146 <a class="indexterm" name="id2604642"></a> 147 147 When the Samba <code class="literal">smbd</code> daemon is first started, if the <code class="filename">secrets.tdb</code> 148 148 file does not exist, it is created at the first client connection attempt. If this file does … … 154 154 (hostname) and domain name (workgroup), it will be different. 155 155 </p><p> 156 <a class="indexterm" name="id2 598634"></a>156 <a class="indexterm" name="id2604692"></a> 157 157 The SID is the key used by MS Windows networking for all networking operations. This means 158 158 that when the machine or domain SID changes, all security-encoded objects such as profiles 159 159 and ACLs may become unusable. 160 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>160 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 161 161 It is of paramount importance that the machine and domain SID be backed up so that in 162 162 the event of a change of hostname (machine name) or domain name (workgroup) the SID can 163 163 be restored to its previous value. 164 164 </p></div><p> 165 <a class="indexterm" name="id2 598655"></a>166 <a class="indexterm" name="id2 598662"></a>167 <a class="indexterm" name="id2 598668"></a>168 <a class="indexterm" name="id2 598675"></a>169 <a class="indexterm" name="id2 598682"></a>170 <a class="indexterm" name="id2 598689"></a>171 <a class="indexterm" name="id2 598696"></a>172 <a class="indexterm" name="id2 598702"></a>173 <a class="indexterm" name="id2 598709"></a>174 <a class="indexterm" name="id2 598716"></a>165 <a class="indexterm" name="id2604713"></a> 166 <a class="indexterm" name="id2604720"></a> 167 <a class="indexterm" name="id2604727"></a> 168 <a class="indexterm" name="id2604733"></a> 169 <a class="indexterm" name="id2604740"></a> 170 <a class="indexterm" name="id2604747"></a> 171 <a class="indexterm" name="id2604754"></a> 172 <a class="indexterm" name="id2604761"></a> 173 <a class="indexterm" name="id2604768"></a> 174 <a class="indexterm" name="id2604774"></a> 175 175 In Samba-3 on a domain controller (PDC or BDC), the domain name controls the domain 176 176 SID. On all prior versions the hostname (computer name, or NetBIOS name) controlled 177 177 the SID. On a standalone server the hostname still controls the SID. 178 178 </p><p> 179 <a class="indexterm" name="id2 598730"></a>180 <a class="indexterm" name="id2 598739"></a>179 <a class="indexterm" name="id2604788"></a> 180 <a class="indexterm" name="id2604797"></a> 181 181 The local machine SID can be backed up using this procedure (Samba-3): 182 182 </p><pre class="screen"> … … 201 201 This is not a reversible process it is a one-way upgrade. 202 202 </p><p> 203 <a class="indexterm" name="id2 598827"></a>203 <a class="indexterm" name="id2604886"></a> 204 204 In the course of the Samba 2.0.x series the <code class="literal">smbpasswd</code> was modified to 205 205 permit the domain SID to be captured to the <code class="filename">secrets.tdb</code> file by executing: … … 218 218 </pre><p> 219 219 </p><p> 220 <a class="indexterm" name="id2 598901"></a>221 <a class="indexterm" name="id2 598908"></a>220 <a class="indexterm" name="id2604959"></a> 221 <a class="indexterm" name="id2604966"></a> 222 222 Domain security information, which includes the domain SID, can be obtained from Samba-2.2.x 223 223 systems by executing: … … 238 238 case it is ever needed at a later date. 239 239 </p><p> 240 <a class="indexterm" name="id2 598954"></a>241 <a class="indexterm" name="id2 598961"></a>242 <a class="indexterm" name="id2 598968"></a>240 <a class="indexterm" name="id2605013"></a> 241 <a class="indexterm" name="id2605020"></a> 242 <a class="indexterm" name="id2605026"></a> 243 243 Take note that the domain SID is used extensively in Samba. Where LDAP is used for the 244 244 <em class="parameter"><code>passdb backend</code></em>, all user, group, and trust accounts are encoded … … 251 251 </pre><p> 252 252 </p><p> 253 <a class="indexterm" name="id2 599004"></a>254 <a class="indexterm" name="id2 599011"></a>255 <a class="indexterm" name="id2 599017"></a>253 <a class="indexterm" name="id2605062"></a> 254 <a class="indexterm" name="id2605069"></a> 255 <a class="indexterm" name="id2605076"></a> 256 256 When the domain SID has changed, roaming profiles cease to be functional. The recovery 257 257 of roaming profiles necessitates resetting of the domain portion of the user SID … … 262 262 addressed to the creator of the RPM package. The Samba Team do their best to make 263 263 available all the tools needed to manage a Samba-based Windows networking environment. 264 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2599055"></a>Change of hostname</h4></div></div></div><p>265 <a class="indexterm" name="id2 599063"></a>266 <a class="indexterm" name="id2 599072"></a>264 </p></div><div class="sect3" title="Change of hostname"><div class="titlepage"><div><div><h4 class="title"><a name="id2605113"></a>Change of hostname</h4></div></div></div><p> 265 <a class="indexterm" name="id2605121"></a> 266 <a class="indexterm" name="id2605130"></a> 267 267 Samba uses two methods by which the primary NetBIOS machine name (also known as a computer 268 268 name or the hostname) may be determined: If the <code class="filename">smb.conf</code> file contains a … … 274 274 SID to be generated. If this happens on a domain controller, it will also change the 275 275 domain SID. These SIDs can be updated (restored) using the procedure outlined previously. 276 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>276 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 277 277 Do NOT change the hostname or the <em class="parameter"><code>netbios name</code></em>. If this 278 278 is changed, be sure to reset the machine SID to the original setting. Otherwise 279 279 there may be serious interoperability and/or operational problems. 280 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2599120"></a>Change of Workgroup (Domain) Name</h4></div></div></div><p>281 <a class="indexterm" name="id2 599129"></a>280 </p></div></div><div class="sect3" title="Change of Workgroup (Domain) Name"><div class="titlepage"><div><div><h4 class="title"><a name="id2605179"></a>Change of Workgroup (Domain) Name</h4></div></div></div><p> 281 <a class="indexterm" name="id2605187"></a> 282 282 The domain name of a Samba server is identical to the workgroup name and is 283 283 set in the <code class="filename">smb.conf</code> file using the <em class="parameter"><code>workgroup</code></em> parameter. 284 284 This has been consistent throughout the history of Samba and across all versions. 285 285 </p><p> 286 <a class="indexterm" name="id2 599154"></a>286 <a class="indexterm" name="id2605212"></a> 287 287 Be aware that when the workgroup name is changed, a new SID will be generated. 288 288 The old domain SID can be reset using the procedure outlined earlier in this chapter. 289 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sbeug1"></a>Location of config files</h4></div></div></div><p>289 </p></div><div class="sect3" title="Location of config files"><div class="titlepage"><div><div><h4 class="title"><a name="sbeug1"></a>Location of config files</h4></div></div></div><p> 290 290 The Samba-Team has maintained a constant default location for all Samba control files 291 291 throughout the life of the project. People who have produced binary packages of Samba … … 293 293 for network administrators. 294 294 </p><p> 295 <a class="indexterm" name="id2 599185"></a>295 <a class="indexterm" name="id2605243"></a> 296 296 The Samba 1.9.x <code class="filename">smb.conf</code> file may be found either in the <code class="filename">/etc</code> 297 297 directory or in <code class="filename">/usr/local/samba/lib</code>. … … 301 301 remains located also for Samba 3.0.x installations. 302 302 </p><p> 303 <a class="indexterm" name="id2 599231"></a>303 <a class="indexterm" name="id2605290"></a> 304 304 Samba 2.x introduced the <code class="filename">secrets.tdb</code> file that is also stored in the 305 305 <code class="filename">/etc/samba</code> directory, or in the <code class="filename">/usr/local/samba/lib</code> 306 306 directory subsystem. 307 307 </p><p> 308 <a class="indexterm" name="id2 599261"></a>308 <a class="indexterm" name="id2605320"></a> 309 309 The location at which <code class="literal">smbd</code> expects to find all configuration and control 310 310 files is determined at the time of compilation of Samba. For versions of Samba prior to … … 318 318 <code class="filename">/usr/local/samba/sbin</code>. 319 319 </p><p> 320 <a class="indexterm" name="id2 599319"></a>320 <a class="indexterm" name="id2605378"></a> 321 321 Samba-3 provides a neat new way to track the location of all control files as well as to 322 322 find the compile-time options used as the Samba package was built. Here is how the dark … … 349 349 </pre><p> 350 350 </p><p> 351 <a class="indexterm" name="id2 599356"></a>351 <a class="indexterm" name="id2605415"></a> 352 352 It is important that both the <code class="filename">smb.conf</code> file and the <code class="filename">secrets.tdb</code> 353 353 be backed up before attempting any upgrade. The <code class="filename">secrets.tdb</code> file … … 355 355 of Samba. A backup means that it is always possible to revert a failed or problematic 356 356 upgrade. 357 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2599386"></a>International Language Support</h4></div></div></div><p>358 <a class="indexterm" name="id2 599395"></a>359 <a class="indexterm" name="id2 599401"></a>360 <a class="indexterm" name="id2 599408"></a>361 <a class="indexterm" name="id2 599415"></a>357 </p></div><div class="sect3" title="International Language Support"><div class="titlepage"><div><div><h4 class="title"><a name="id2605445"></a>International Language Support</h4></div></div></div><p> 358 <a class="indexterm" name="id2605453"></a> 359 <a class="indexterm" name="id2605460"></a> 360 <a class="indexterm" name="id2605467"></a> 361 <a class="indexterm" name="id2605474"></a> 362 362 Samba-2.x had no support for Unicode; instead, all national language character-set support in file names 363 363 was done using particular locale codepage mapping techniques. Samba-3 supports Unicode in file names, thus 364 364 providing true internationalization support. 365 365 </p><p> 366 <a class="indexterm" name="id2 599430"></a>366 <a class="indexterm" name="id2605488"></a> 367 367 Non-English users whose national language character set has special characters and who upgrade naively will 368 368 find that many files that have the special characters in the file name will see them garbled and jumbled up. … … 370 370 that was in use with Samba-2.x using an 8-bit encoding scheme. 371 371 </p><p> 372 <a class="indexterm" name="id2 599447"></a>372 <a class="indexterm" name="id2605505"></a> 373 373 Files that are created with Samba-3 will use UTF-8 encoding. Should the file system ever end up with a 374 374 mix of codepage (unix charset)-encoded file names and UTF-8-encoded file names, the mess will take some 375 375 effort to set straight. 376 376 </p><p> 377 <a class="indexterm" name="id2 599461"></a>377 <a class="indexterm" name="id2605519"></a> 378 378 A very helpful tool is available from Bjorn Jacke's <a class="ulink" href="http://j3e.de/linux/convmv/" target="_top">convmv</a> 379 379 work. Convmv is a tool that can be used to convert file and directory names from one encoding method to 380 380 another. The most common use for this tool is to convert locale-encoded files to UTF-8 Unicode encoding. 381 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2599480"></a>Updates and Changes in Idealx smbldap-tools</h4></div></div></div><p>381 </p></div><div class="sect3" title="Updates and Changes in Idealx smbldap-tools"><div class="titlepage"><div><div><h4 class="title"><a name="id2605539"></a>Updates and Changes in Idealx smbldap-tools</h4></div></div></div><p> 382 382 The smbldap-tools have been maturing rapidly over the past year. With maturation comes change. 383 383 The location of the <code class="filename">smbldap.conf</code> and the <code class="filename">smbldap_bind.conf</code> … … 393 393 current release should note that the information stored under <code class="constant">NextFreeUnixId</code> 394 394 must now be relocated to the DIT object <code class="constant">sambaDomainName</code>. 395 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2599552"></a>Upgrading from Samba 1.x and 2.x to Samba-3</h2></div></div></div><p>395 </p></div></div></div><div class="sect1" title="Upgrading from Samba 1.x and 2.x to Samba-3"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2605610"></a>Upgrading from Samba 1.x and 2.x to Samba-3</h2></div></div></div><p> 396 396 Sites that are being upgraded from Samba-2 (or earlier versions) to Samba-3 397 397 may experience little difficulty or may require a lot of effort, depending … … 403 403 does not use LDAP, the other does. Samba-1.9.x did not provide LDAP support. 404 404 Samba-2.x could be compiled with LDAP support. 405 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbeug2"></a>Samba 1.9.x and 2.x Versions Without LDAP</h3></div></div></div><p>405 </p><div class="sect2" title="Samba 1.9.x and 2.x Versions Without LDAP"><div class="titlepage"><div><div><h3 class="title"><a name="sbeug2"></a>Samba 1.9.x and 2.x Versions Without LDAP</h3></div></div></div><p> 406 406 Where it is necessary to upgrade an old Samba installation to Samba-3, 407 407 the following procedure can be followed: 408 </p><div class="procedure" ><a name="id2599590"></a><p class="title"><b>Procedure 8.1. Upgrading from a Pre-Samba-3 Version</b></p><ol type="1"><li><p>409 <a class="indexterm" name="id2 599601"></a>410 <a class="indexterm" name="id2 599608"></a>411 <a class="indexterm" name="id2 599615"></a>408 </p><div class="procedure" title="Procedure 8.1. Upgrading from a Pre-Samba-3 Version"><a name="id2605648"></a><p class="title"><b>Procedure 8.1. Upgrading from a Pre-Samba-3 Version</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 409 <a class="indexterm" name="id2605659"></a> 410 <a class="indexterm" name="id2605666"></a> 411 <a class="indexterm" name="id2605673"></a> 412 412 Stop Samba. This can be done using the appropriate system tool 413 413 that is particular for each operating system or by executing the 414 414 <code class="literal">kill</code> command on <code class="literal">smbd</code>, 415 415 <code class="literal">nmbd</code>, and <code class="literal">winbindd</code>. 416 </p></li><li ><p>416 </p></li><li class="step" title="Step 2"><p> 417 417 Find the location of the Samba <code class="filename">smb.conf</code> file and back it up to a 418 418 safe location. 419 </p></li><li ><p>419 </p></li><li class="step" title="Step 3"><p> 420 420 Find the location of the <code class="filename">smbpasswd</code> file and 421 421 back it up to a safe location. 422 </p></li><li ><p>422 </p></li><li class="step" title="Step 4"><p> 423 423 Find the location of the <code class="filename">secrets.tdb</code> file and 424 424 back it up to a safe location. 425 </p></li><li ><p>426 <a class="indexterm" name="id2 599696"></a>427 <a class="indexterm" name="id2 599703"></a>428 <a class="indexterm" name="id2 599710"></a>429 <a class="indexterm" name="id2 599717"></a>425 </p></li><li class="step" title="Step 5"><p> 426 <a class="indexterm" name="id2605754"></a> 427 <a class="indexterm" name="id2605761"></a> 428 <a class="indexterm" name="id2605768"></a> 429 <a class="indexterm" name="id2605775"></a> 430 430 Find the location of the lock directory. This is the directory 431 431 in which Samba stores all its tdb control files. The default … … 437 437 <code class="filename">/var/lib/samba</code> directory. Copy all the 438 438 tdb files to a safe location. 439 </p></li><li ><p>440 <a class="indexterm" name="id2 599755"></a>439 </p></li><li class="step" title="Step 6"><p> 440 <a class="indexterm" name="id2605814"></a> 441 441 It is now safe to upgrade the Samba installation. On Linux systems 442 442 it is not necessary to remove the Samba RPMs because a simple … … 447 447 move it out of the way by renaming the directories that contain the 448 448 Samba binary files. 449 </p></li><li ><p>449 </p></li><li class="step" title="Step 7"><p> 450 450 When the Samba upgrade has been installed, the first step that should 451 451 be completed is to identify the new target locations for the control 452 452 files. Follow the steps shown in <a class="link" href="upgrades.html#sbeug1" title="Location of config files">“Location of config files”</a> to locate 453 453 the correct directories to which each control file must be moved. 454 </p></li><li ><p>454 </p></li><li class="step" title="Step 8"><p> 455 455 Do not change the hostname. 456 </p></li><li ><p>456 </p></li><li class="step" title="Step 9"><p> 457 457 Do not change the workgroup name. 458 </p></li><li ><p>459 <a class="indexterm" name="id2 599810"></a>458 </p></li><li class="step" title="Step 10"><p> 459 <a class="indexterm" name="id2605869"></a> 460 460 Execute the <code class="literal">testparm</code> to validate the <code class="filename">smb.conf</code> file. 461 461 This process will flag any parameters that are no longer supported. … … 469 469 <code class="prompt">root# </code> testparm -s smb.conf.master > smb.conf 470 470 </pre><p> 471 <a class="indexterm" name="id2 599868"></a>471 <a class="indexterm" name="id2605926"></a> 472 472 The resulting <code class="filename">smb.conf</code> file will be stripped of all comments 473 473 and of all nonconforming configuration settings. 474 </p></li><li ><p>475 <a class="indexterm" name="id2 599889"></a>474 </p></li><li class="step" title="Step 11"><p> 475 <a class="indexterm" name="id2605948"></a> 476 476 It is now safe to start Samba using the appropriate system tool. 477 477 Alternately, it is possible to just execute <code class="literal">nmbd</code>, 478 478 <code class="literal">smbd</code>, and <code class="literal">winbindd</code> for the command 479 479 line while logged in as the root user. 480 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2599920"></a>Applicable to All Samba 2.x to Samba-3 Upgrades</h3></div></div></div><p>481 <a class="indexterm" name="id2 599929"></a>482 <a class="indexterm" name="id2 599935"></a>483 <a class="indexterm" name="id2 599942"></a>480 </p></li></ol></div></div><div class="sect2" title="Applicable to All Samba 2.x to Samba-3 Upgrades"><div class="titlepage"><div><div><h3 class="title"><a name="id2605979"></a>Applicable to All Samba 2.x to Samba-3 Upgrades</h3></div></div></div><p> 481 <a class="indexterm" name="id2605987"></a> 482 <a class="indexterm" name="id2605994"></a> 483 <a class="indexterm" name="id2606000"></a> 484 484 Samba 2.x servers that were running as a domain controller (PDC) 485 485 require changes to the configuration of the scripting interface … … 487 487 users, groups, and trust accounts (machines and interdomain). 488 488 </p><p> 489 <a class="indexterm" name="id2 599956"></a>489 <a class="indexterm" name="id2606015"></a> 490 490 The following parameters are new to Samba-3 and should be correctly configured. 491 491 Please refer to <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a> through <a class="link" href="2000users.html" title="Chapter 6. A Distributed 2000-User Network">“A Distributed 2000-User Network”</a> 492 492 in this book for examples of use of the new parameters shown here: 493 <a class="indexterm" name="id2 599978"></a>494 <a class="indexterm" name="id2 599984"></a>495 <a class="indexterm" name="id2 599991"></a>496 <a class="indexterm" name="id2 599998"></a>497 <a class="indexterm" name="id260 0005"></a>498 <a class="indexterm" name="id260 0012"></a>499 <a class="indexterm" name="id260 0019"></a>500 </p><p> 501 </p><table class="simplelist" border="0" summary="Simplelist"><tr><td><p>add group script</p></td></tr><tr><td><p>add machine script</p></td></tr><tr><td><p>add user to group script</p></td></tr><tr><td><p>delete group script</p></td></tr><tr><td><p>delete user from group script</p></td></tr><tr><td><p>passdb backend</p></td></tr><tr><td><p>set primary group script</p></td></tr></table><p>502 </p><p> 503 <a class="indexterm" name="id260 0071"></a>504 <a class="indexterm" name="id260 0078"></a>493 <a class="indexterm" name="id2606036"></a> 494 <a class="indexterm" name="id2606043"></a> 495 <a class="indexterm" name="id2606050"></a> 496 <a class="indexterm" name="id2606057"></a> 497 <a class="indexterm" name="id2606064"></a> 498 <a class="indexterm" name="id2606071"></a> 499 <a class="indexterm" name="id2606078"></a> 500 </p><p> 501 </p><table border="0" summary="Simple list" class="simplelist"><tr><td><p>add group script</p></td></tr><tr><td><p>add machine script</p></td></tr><tr><td><p>add user to group script</p></td></tr><tr><td><p>delete group script</p></td></tr><tr><td><p>delete user from group script</p></td></tr><tr><td><p>passdb backend</p></td></tr><tr><td><p>set primary group script</p></td></tr></table><p> 502 </p><p> 503 <a class="indexterm" name="id2606130"></a> 504 <a class="indexterm" name="id2606137"></a> 505 505 The <em class="parameter"><code>add machine script</code></em> functionality was previously 506 506 handled by the <em class="parameter"><code>add user script</code></em>, which in Samba-3 is 507 507 used exclusively to add user accounts. 508 508 </p><p> 509 <a class="indexterm" name="id260 0103"></a>510 <a class="indexterm" name="id260 0110"></a>511 <a class="indexterm" name="id260 0116"></a>512 <a class="indexterm" name="id260 0123"></a>513 <a class="indexterm" name="id260 0130"></a>514 <a class="indexterm" name="id260 0137"></a>515 <a class="indexterm" name="id260 0144"></a>516 <a class="indexterm" name="id260 0150"></a>517 <a class="indexterm" name="id260 0157"></a>509 <a class="indexterm" name="id2606161"></a> 510 <a class="indexterm" name="id2606168"></a> 511 <a class="indexterm" name="id2606175"></a> 512 <a class="indexterm" name="id2606182"></a> 513 <a class="indexterm" name="id2606188"></a> 514 <a class="indexterm" name="id2606195"></a> 515 <a class="indexterm" name="id2606202"></a> 516 <a class="indexterm" name="id2606209"></a> 517 <a class="indexterm" name="id2606216"></a> 518 518 Where the <em class="parameter"><code>passdb backend</code></em> used is either <code class="constant">smbpasswd</code> 519 519 (the default) or the new <code class="constant">tdbsam</code>, the system interface scripts … … 522 522 <code class="literal">groupmod</code>, <code class="literal">groupdel</code>, and so on. 523 523 </p><p> 524 <a class="indexterm" name="id260 0218"></a>525 <a class="indexterm" name="id260 0225"></a>526 <a class="indexterm" name="id260 0231"></a>524 <a class="indexterm" name="id2606276"></a> 525 <a class="indexterm" name="id2606283"></a> 526 <a class="indexterm" name="id2606290"></a> 527 527 Where the <em class="parameter"><code>passdb backend</code></em> makes use of an LDAP directory, 528 528 it is necessary either to use the <code class="constant">smbldap-tools</code> provided 529 529 by Idealx or to use an alternate toolset provided by a third 530 530 party or else home-crafted to manage the LDAP directory accounts. 531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2600254"></a>Samba-2.x with LDAP Support</h3></div></div></div><p>531 </p></div><div class="sect2" title="Samba-2.x with LDAP Support"><div class="titlepage"><div><div><h3 class="title"><a name="id2606312"></a>Samba-2.x with LDAP Support</h3></div></div></div><p> 532 532 Samba version 2.x could be compiled for use either with or without LDAP. 533 533 The LDAP control settings in the <code class="filename">smb.conf</code> file in this old version are … … 539 539 of all files to the correct locations. 540 540 </p><p> 541 <a class="indexterm" name="id260 0288"></a>542 <a class="indexterm" name="id260 0295"></a>541 <a class="indexterm" name="id2606347"></a> 542 <a class="indexterm" name="id2606353"></a> 543 543 The Samba SAM schema required for Samba-3 is significantly different from that 544 544 used with Samba 2.x. This means that the LDAP directory must be updated … … 695 695 the DN's with quotation marks. 696 696 </pre><p> 697 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2600436"></a>Updating a Samba-3 Installation</h2></div></div></div><p>697 </p></div></div><div class="sect1" title="Updating a Samba-3 Installation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2606494"></a>Updating a Samba-3 Installation</h2></div></div></div><p> 698 698 The key concern in this section is to deal with the changes that have been 699 699 affected in Samba-3 between the Samba-3.0.0 release and the current update. … … 701 701 taken to update Samba-3 versions. 702 702 </p><p> 703 <a class="indexterm" name="id260 0451"></a>703 <a class="indexterm" name="id2606510"></a> 704 704 The information in <a class="link" href="upgrades.html#sbeug1" title="Location of config files">“Location of config files”</a> would not be necessary if every 705 705 person who has ever produced Samba executable (binary) files could agree on … … 707 707 Clearly, such agreement is further away than a pipedream. 708 708 </p><p> 709 <a class="indexterm" name="id260 0477"></a>709 <a class="indexterm" name="id2606536"></a> 710 710 Vendors and packagers who produce Samba binary installable packages do not, 711 711 as a rule, use the default paths used by the Samba-Team for the location of … … 720 720 effect. 721 721 </p><p> 722 <a class="indexterm" name="id260 0511"></a>722 <a class="indexterm" name="id2606569"></a> 723 723 The best advice for those lacking in code compilation experience is to use 724 724 only vendor (or Samba-Team) provided binary packages. The Samba packages … … 726 726 that are compatible with the original OS vendor's practices. 727 727 </p><p> 728 <a class="indexterm" name="id260 0526"></a>729 <a class="indexterm" name="id260 0533"></a>728 <a class="indexterm" name="id2606584"></a> 729 <a class="indexterm" name="id2606591"></a> 730 730 If you are not sure whether a binary package complies with the OS 731 731 vendor's practices, it is better to ask the package maintainer via … … 733 733 Alternately, just diagnose the paths specified by the binary files following 734 734 the procedure outlined above. 735 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2600546"></a>Samba-3 to Samba-3 Updates on the Same Server</h3></div></div></div><p>735 </p><div class="sect2" title="Samba-3 to Samba-3 Updates on the Same Server"><div class="titlepage"><div><div><h3 class="title"><a name="id2606604"></a>Samba-3 to Samba-3 Updates on the Same Server</h3></div></div></div><p> 736 736 The guidance in this section deals with updates to an existing 737 737 Samba-3 server installation. 738 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2600557"></a>Updating from Samba Versions Earlier than 3.0.5</h4></div></div></div><p>738 </p><div class="sect3" title="Updating from Samba Versions Earlier than 3.0.5"><div class="titlepage"><div><div><h4 class="title"><a name="id2606616"></a>Updating from Samba Versions Earlier than 3.0.5</h4></div></div></div><p> 739 739 With the provision that the binary Samba-3 package has been built 740 740 with the same path and feature settings as the existing Samba-3 … … 743 743 and without need to change either the <code class="filename">smb.conf</code> file or, where 744 744 used, the LDAP schema. 745 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2600580"></a>Updating from Samba Versions between 3.0.6 and 3.0.10</h4></div></div></div><p>746 <a class="indexterm" name="id260 0588"></a>747 <a class="indexterm" name="id260 0595"></a>745 </p></div><div class="sect3" title="Updating from Samba Versions between 3.0.6 and 3.0.10"><div class="titlepage"><div><div><h4 class="title"><a name="id2606638"></a>Updating from Samba Versions between 3.0.6 and 3.0.10</h4></div></div></div><p> 746 <a class="indexterm" name="id2606646"></a> 747 <a class="indexterm" name="id2606653"></a> 748 748 When updating versions of Samba-3 prior to 3.0.6 to 3.0.6 through 3.0.10, 749 749 it is necessary only to update the LDAP schema (where LDAP is used). … … 751 751 update. 752 752 </p><p> 753 <a class="indexterm" name="id260 0611"></a>754 <a class="indexterm" name="id260 0618"></a>755 <a class="indexterm" name="id260 0625"></a>753 <a class="indexterm" name="id2606670"></a> 754 <a class="indexterm" name="id2606676"></a> 755 <a class="indexterm" name="id2606683"></a> 756 756 Samba-3.0.6 introduced the ability to remember the last <span class="emphasis"><em>n</em></span> number 757 757 of passwords a user has used. This information will work only with … … 760 760 </p><p> 761 761 After updating the LDAP schema, do not forget to re-index the LDAP database. 762 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2600658"></a>Updating from Samba Versions after 3.0.6 to a Current Release</h4></div></div></div><p>763 <a class="indexterm" name="id260 0667"></a>762 </p></div><div class="sect3" title="Updating from Samba Versions after 3.0.6 to a Current Release"><div class="titlepage"><div><div><h4 class="title"><a name="id2606717"></a>Updating from Samba Versions after 3.0.6 to a Current Release</h4></div></div></div><p> 763 <a class="indexterm" name="id2606725"></a> 764 764 Samba-3.0.8 introduced changes in how the <em class="parameter"><code>username map</code></em> 765 765 behaves. It also included a change in behavior of <code class="literal">winbindd</code>. … … 767 767 from versions prior to 3.0.8 to a current version. 768 768 </p><p> 769 <a class="indexterm" name="id260 0699"></a>769 <a class="indexterm" name="id2606757"></a> 770 770 In Samba-3.0.11 a new privileges interface was implemented. Please 771 771 refer to <a class="link" href="happy.html#sbehap-ppc" title="Addition of Machines to the Domain">“Addition of Machines to the Domain”</a> for information regarding this new … … 789 789 back to searching the 'ldap suffix' in some cases. 790 790 </pre><p> 791 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2600749"></a>Migrating Samba-3 to a New Server</h3></div></div></div><p>791 </p></div></div><div class="sect2" title="Migrating Samba-3 to a New Server"><div class="titlepage"><div><div><h3 class="title"><a name="id2606808"></a>Migrating Samba-3 to a New Server</h3></div></div></div><p> 792 792 The two most likely candidates for replacement of a server are 793 793 domain member servers and domain controllers. Each needs to be 794 794 handled slightly differently. 795 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2600761"></a>Replacing a Domain Member Server</h4></div></div></div><p>796 <a class="indexterm" name="id260 0770"></a>795 </p><div class="sect3" title="Replacing a Domain Member Server"><div class="titlepage"><div><div><h4 class="title"><a name="id2606820"></a>Replacing a Domain Member Server</h4></div></div></div><p> 796 <a class="indexterm" name="id2606828"></a> 797 797 Replacement of a domain member server should be done 798 798 using the same procedure as outlined in <a class="link" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients">“Adding Domain Member Servers and Clients”</a>. … … 803 803 change its SID and will necessitate rejoining to the domain. 804 804 </p><p> 805 <a class="indexterm" name="id260 0795"></a>806 <a class="indexterm" name="id260 0802"></a>807 <a class="indexterm" name="id260 0808"></a>808 <a class="indexterm" name="id260 0815"></a>809 <a class="indexterm" name="id260 0822"></a>810 <a class="indexterm" name="id260 0829"></a>805 <a class="indexterm" name="id2606854"></a> 806 <a class="indexterm" name="id2606860"></a> 807 <a class="indexterm" name="id2606867"></a> 808 <a class="indexterm" name="id2606874"></a> 809 <a class="indexterm" name="id2606880"></a> 810 <a class="indexterm" name="id2606887"></a> 811 811 Following a change of hostname (NetBIOS name) it is a good idea on all servers 812 812 to shut down the Samba <code class="literal">smbd</code>, <code class="literal">nmbd</code>, and … … 818 818 change, but can persist for a longer period of time. 819 819 </p><p> 820 <a class="indexterm" name="id260 0876"></a>821 <a class="indexterm" name="id260 0883"></a>822 <a class="indexterm" name="id260 0890"></a>823 <a class="indexterm" name="id260 0896"></a>820 <a class="indexterm" name="id2606935"></a> 821 <a class="indexterm" name="id2606941"></a> 822 <a class="indexterm" name="id2606948"></a> 823 <a class="indexterm" name="id2606955"></a> 824 824 If the old domain member server had local accounts, it is necessary to create 825 825 on the new domain member server the same accounts with the same UID and GID … … 832 832 account entries to the new target server. 833 833 </p><p> 834 <a class="indexterm" name="id260 0945"></a>834 <a class="indexterm" name="id2607003"></a> 835 835 Where the user accounts for both UNIX and Samba are stored in LDAP, the new 836 836 target server must be configured to use the <code class="literal">nss_ldap</code> tool set. 837 837 This will automatically ensure that the appropriate user entities are 838 838 available on the new server. 839 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2600964"></a>Replacing a Domain Controller</h4></div></div></div><p>840 <a class="indexterm" name="id260 0972"></a>839 </p></div><div class="sect3" title="Replacing a Domain Controller"><div class="titlepage"><div><div><h4 class="title"><a name="id2607022"></a>Replacing a Domain Controller</h4></div></div></div><p> 840 <a class="indexterm" name="id2607030"></a> 841 841 In the past, people who replaced a Windows NT4 domain controller typically 842 842 installed a new server, created printers and file shares on it, then migrate across … … 848 848 the same name as the old one. In this case, simply follow the same process 849 849 as for upgrading a Samba 2.x system and do the following: 850 </p><div class="itemizedlist"><ul type="disc"><li><p>850 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 851 851 Where UNIX (POSIX) user and group accounts are stored in the system 852 852 <code class="filename">/etc/passwd</code>, <code class="filename">/etc/shadow</code>, and … … 863 863 the <code class="literal">nss_ldap</code> tool and the <code class="filename">/etc/nsswitch.conf</code> 864 864 (as shown in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>). 865 </p></li><li ><p>865 </p></li><li class="listitem"><p> 866 866 Copy the <code class="filename">smb.conf</code> file from the old server to the new server into the correct 867 867 location as indicated previously in this chapter. 868 </p></li><li ><p>868 </p></li><li class="listitem"><p> 869 869 Copy the <code class="filename">secrets.tdb</code> file, the <code class="filename">smbpasswd</code> 870 870 file (if it is used), the <code class="filename">/etc/samba/passdb.tdb</code> file (only 871 871 used by the <code class="constant">tdbsam</code> backend), and all the tdb control files 872 872 from the old system to the correct location on the new system. 873 </p></li><li ><p>873 </p></li><li class="listitem"><p> 874 874 Before starting the Samba daemons, verify that the hostname of the new server 875 875 is identical to that of the old one. Note: The IP address can be different 876 876 from that of the old server. 877 </p></li><li ><p>877 </p></li><li class="listitem"><p> 878 878 Copy all files from the old server to the new server, taking precaution to 879 879 preserve all file ownership and permissions as well as any POSIX ACLs that … … 891 891 should correctly pick up the original SID and preserve all other settings. It is 892 892 sound advice to validate this before turning the system over to users. 893 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2601164"></a>Migration of Samba Accounts to Active Directory</h3></div></div></div><p>893 </p></div></div><div class="sect2" title="Migration of Samba Accounts to Active Directory"><div class="titlepage"><div><div><h3 class="title"><a name="id2607222"></a>Migration of Samba Accounts to Active Directory</h3></div></div></div><p> 894 894 Yes, it works. The Windows ADMT tool can be used to migrate Samba accounts 895 895 to MS Active Directory. There are a few pitfalls to be aware of: 896 </p><div class="procedure" ><a name="id2601176"></a><p class="title"><b>Procedure 8.2. Migration to Active Directory</b></p><ol type="1"><li><p>896 </p><div class="procedure" title="Procedure 8.2. Migration to Active Directory"><a name="id2607234"></a><p class="title"><b>Procedure 8.2. Migration to Active Directory</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 897 897 Administrator password must be THE SAME on the Samba server, 898 898 the 2003 ADS, and the local Administrator account on the workstations. … … 900 900 called <code class="constant">Administrator</code> in your Samba domain, with 901 901 full administrative (root) rights to that domain. 902 </p></li><li ><p>902 </p></li><li class="step" title="Step 2"><p> 903 903 In the Advanced/DNS section of the TCP/IP settings on your Windows 904 904 workstations, make sure the <em class="parameter"><code>DNS suffix for this 905 905 connection</code></em> field is blank. 906 </p></li><li ><p>906 </p></li><li class="step" title="Step 3"><p> 907 907 Because you are migrating from Samba, user passwords cannot be 908 908 migrated. You'll have to reset everyone's passwords. (If you were … … 911 911 To date this has not been attempted with roaming profile support; 912 912 it has been documented as working with local profiles. 913 </p></li><li ><p>913 </p></li><li class="step" title="Step 4"><p> 914 914 Disable the Windows Firewall on all workstations. Otherwise, 915 915 workstations won't be migrated to the new domain. 916 </p></li><li ><p>917 <a class="indexterm" name="id260 1242"></a>916 </p></li><li class="step" title="Step 5"><p> 917 <a class="indexterm" name="id2607301"></a> 918 918 When migrating machines, always test first (using ADMT's test mode) 919 919 and satisfy all errors before committing the migration. Note that the … … 923 923 a test. 924 924 </p></li></ol></div><p> 925 <a class="indexterm" name="id260 1260"></a>925 <a class="indexterm" name="id2607318"></a> 926 926 There are some significant benefits of using the ADMT, besides just 927 927 migrating user accounts. ADMT can be found on the Windows 2003 CD. 928 </p><div class="itemizedlist"><ul type="disc"><li><p>928 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 929 929 You can migrate workstations remotely. You can specify that SIDs 930 930 be simply added instead of replaced, giving you the option of joining a 931 931 workstation back to the old domain if something goes awry. The 932 932 workstations will be joined to the new domain. 933 </p></li><li ><p>933 </p></li><li class="listitem"><p> 934 934 Not only are user accounts migrated from the old domain to the new 935 935 domain, but ACLs on the workstations are migrated as well. Like SIDs, 936 936 ACLs can be added instead of replaced. 937 </p></li><li ><p>937 </p></li><li class="listitem"><p> 938 938 Locally stored user profiles on workstations are migrated as well, 939 939 presenting almost no disruption to the user. Saved passwords will be 940 940 lost, just as when you administratively reset the password in Windows ADS. 941 </p></li><li ><p>941 </p></li><li class="listitem"><p> 942 942 The ADMT lets you test all operations before actually performing the 943 943 migration. Accounts and workstations can be migrated individually or in
Note:
See TracChangeset
for help on using the changeset viewer.
