1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 9. Migrating NT4 Domain to Samba-3</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.68.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="upgrades.html" title="Chapter 8. Updating Samba-3"><link rel="next" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 9. Migrating NT4 Domain to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrades.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="nw4migration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ntmigration"></a>Chapter 9. Migrating NT4 Domain to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ntmigration.html#id2569410">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2569495">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2569550">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2569721">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2570044">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2570070">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2570211">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2572803">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2573196">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2573235">Questions and Answers</a></span></dt></dl></div><p>
2 Ever since Microsoft announced that it was discontinuing support for Windows
3 NT4, Samba users started to ask for detailed instructions on how to migrate
4 from NT4 to Samba-3. This chapter provides background information that should
7 One wonders how many NT4 systems will be left in service by the time you read this
9 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2569410"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id2569416"></a>
10 Network administrators who want to migrate off a Windows NT4 environment know
11 one thing with certainty. They feel that NT4 has been abandoned, and they want
12 to update. The desire to get off NT4 and to not adopt Windows 200x and Active
13 Directory is driven by a mixture of concerns over complexity, cost, fear of
14 failure, and much more.
16 <a class="indexterm" name="id2569434"></a>
17 <a class="indexterm" name="id2569441"></a>
18 <a class="indexterm" name="id2569450"></a>
19 <a class="indexterm" name="id2569460"></a>
20 The migration from NT4 to Samba-3 can involve a number of factors, including
21 migration of data to another server, migration of network environment controls
22 such as group policies, and migration of the users, groups, and machine
25 <a class="indexterm" name="id2569476"></a>
26 It should be pointed out now that it is possible to migrate some systems from
27 a Windows NT4 domain environment to a Samba-3 domain environment. This is certainly
28 not possible in every case. It is possible to just migrate the domain accounts
29 to Samba-3 and then to switch machines, but as a hands-off transition, this is more
30 the exception than the rule. Most systems require some tweaking after
31 migration before an environment that is acceptable for immediate use
33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2569495"></a>Assignment Tasks</h3></div></div></div><p>
34 <a class="indexterm" name="id2569503"></a>
35 <a class="indexterm" name="id2569509"></a>
36 <a class="indexterm" name="id2569516"></a>
37 You are about to migrate an MS Windows NT4 domain accounts database to
38 a Samba-3 server. The Samba-3 server is using a
39 <em class="parameter"><code>passdb backend</code></em> based on LDAP. The
40 <code class="constant">ldapsam</code> is ideal because an LDAP backend can be distributed
41 for use with BDCs generally essential for larger networks.
43 Your objective is to document the process of migrating user and group accounts
44 from several NT4 domains into a single Samba-3 LDAP backend database.
45 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2569550"></a>Dissection and Discussion</h2></div></div></div><p>
46 <a class="indexterm" name="id2569557"></a>
47 <a class="indexterm" name="id2569564"></a>
48 <a class="indexterm" name="id2569571"></a>
49 <a class="indexterm" name="id2569582"></a>
50 <a class="indexterm" name="id2569594"></a>
51 <a class="indexterm" name="id2569600"></a>
52 The migration process takes a snapshot of information that is stored in the
53 Windows NT4 registry-based accounts database. That information resides in
54 the Security Account Manager (SAM) portion of the NT4 registry under keys called
55 <code class="constant">SAM</code> and <code class="constant">SECURITY</code>.
56 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
57 <a class="indexterm" name="id2569625"></a>
58 <a class="indexterm" name="id2569632"></a>
59 The Windows NT4 registry keys called <code class="constant">SAM</code> and <code class="constant">SECURITY</code>
60 are protected so that you cannot view the contents. If you change the security setting
61 to reveal the contents under these hive keys, your Windows NT4 domain is crippled. Do not
62 do this unless you are willing to render your domain controller inoperative.
64 <a class="indexterm" name="id2569654"></a>
65 <a class="indexterm" name="id2569663"></a>
66 Before commencing an NT4 to Samba-3 migration, you should consider what your objectives are.
67 While in some cases it is possible simply to migrate an NT4 domain to a single Samba-3 server,
68 that may not be a good idea from an administration perspective. Since the process involves going
69 through a certain amount of disruptive activity anyhow, why not take this opportunity to
70 review the structure of the network, how Windows clients are controlled and how they
71 interact with the network environment.
73 <a class="indexterm" name="id2569681"></a>
74 <a class="indexterm" name="id2569691"></a>
75 <a class="indexterm" name="id2569698"></a>
76 MS Windows NT4 was introduced some time around 1996. Many environments in which NT4 was deployed
77 have done little to keep the NT4 server environment up to date with more recent Windows releases,
78 particularly Windows XP Professional. The migration provides opportunity to revise and update
79 roaming profile deployment as well as folder redirection. Given that you must port the
80 greater network configuration of this from the old NT4 server to the new Samba-3 server.
81 Do not forget to validate the security descriptors in the profiles share as well as network logon
82 scripts. Feedback from sites that are migrating to Samba-3 suggests that many are using this
83 as a good time to update desktop systems also. In all, the extra effort should constitute no
84 real disruption to users, but rather, with due diligence and care, should make their network experience
86 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2569721"></a>Technical Issues</h3></div></div></div><p>
87 <a class="indexterm" name="id2569729"></a>
88 <a class="indexterm" name="id2569735"></a>
89 Migration of an NT4 domain user and group database to Samba-3 involves a certain strategic
90 element. Many sites have asked for instructions regarding merging of multiple NT4
91 domains into one Samba-3 LDAP database. It seems that this is viewed as a significant
92 added value compared with the alternative of migration to Windows Server 200x and Active
93 Directory. The diagram in <a href="ntmigration.html#ch8-migration" title="Figure 9.1. Schematic Explaining the net rpc vampire Process">???</a> illustrates the effect of migration
94 from a Windows NT4 domain to a Samba domain.
95 </p><div class="figure"><a name="ch8-migration"></a><p class="title"><b>Figure 9.1. Schematic Explaining the <span>net rpc vampire</span> Process</b></p><div class="mediaobject"><img src="images/ch8-migration.png" width="297" alt="Schematic Explaining the net rpc vampire Process"></div></div><p>
96 <a class="indexterm" name="id2569809"></a>
97 <a class="indexterm" name="id2569815"></a>
98 If you want to merge multiple NT4 domain account databases into one Samba domain,
99 you must now dump the contents of the first migration and edit it as appropriate. Now clean
100 out (remove) the tdbsam backend file (<code class="filename">passdb.tdb</code>) or the LDAP database
101 files. You must start each migration with a new database into which you merge your NT4
103 </p><p><a class="indexterm" name="id2569836"></a>
104 At this point, you are ready to perform the second migration, following the same steps as
105 for the first. In other words, dump the database, edit it, and then you may merge the
106 dump for the first and second migrations.
107 </p><p><a class="indexterm" name="id2569851"></a><a class="indexterm" name="id2569859"></a><a class="indexterm" name="id2569867"></a>
108 You must be careful. If you choose to migrate to an LDAP backend, your dump file
109 now contains the full account information, including the domain SID. The domain SID for each
110 of the two NT4 domains will be different. You must choose one and change the domain
111 portion of the account SIDs so that all are the same.
113 <a class="indexterm" name="id2569884"></a>
114 <a class="indexterm" name="id2569891"></a>
115 <a class="indexterm" name="id2569898"></a>
116 <a class="indexterm" name="id2569905"></a>
117 <a class="indexterm" name="id2569912"></a>
118 <a class="indexterm" name="id2569918"></a>
119 <a class="indexterm" name="id2569925"></a>
120 <a class="indexterm" name="id2569932"></a>
121 <a class="indexterm" name="id2569939"></a>
122 <a class="indexterm" name="id2569946"></a>
123 <a class="indexterm" name="id2569953"></a>
124 <a class="indexterm" name="id2569960"></a>
125 If you choose to use a tdbsam (<code class="filename">passdb.tdb</code>) backend file, your best choice
126 is to use <span><strong class="command">pdbedit</strong></span> to export the contents of the tdbsam file into an
127 smbpasswd data file. This automatically strips out all domain-specific information,
128 such as logon hours, logon machines, logon script, profile path, as well as the domain SID.
129 The resulting file can be easily merged with other migration attempts (each of which must start
130 with a clean file). It should also be noted that all users who end up in the merged smbpasswd
131 file must have an account in <code class="filename">/etc/passwd</code>. The resulting smbpasswd file
132 may be exported or imported into either a tdbsam (<code class="filename">passdb.tdb</code>) or
134 </p><div class="figure"><a name="NT4DUM"></a><p class="title"><b>Figure 9.2. View of Accounts in NT4 Domain User Manager</b></p><div class="mediaobject"><img src="images/UserMgrNT4.png" width="270" alt="View of Accounts in NT4 Domain User Manager"></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2570044"></a>Political Issues</h3></div></div></div><p>
135 The merging of multiple Windows NT4-style domains into a single LDAP-backend-based Samba-3
136 domain may be seen by those who had power over them as a loss of prestige or a loss of
137 power. The imposition of a single domain may even be seen as a threat. So in migrating and
138 merging account databases, be consciously aware of the political fall-out in which you
139 may find yourself entangled when key staff feel a loss of prestige.
141 The best advice that can be given to those who set out to merge NT4 domains into a single
142 Samba-3 domain is to promote (sell) the action as one that reduces costs and delivers
143 greater network interoperability and manageability.
144 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2570070"></a>Implementation</h2></div></div></div><p>
145 From feedback on the Samba mailing lists, it seems that most Windows NT4 migrations
146 to Samba-3 are being performed using a new server or a new installation of a Linux or UNIX
147 server. If you contemplate doing this, please note that the steps that follow in this
148 chapter assume familiarity with the information that has been previously covered in this
149 book. You are particularly encouraged to be familiar with <a href="secure.html" title="Chapter 3. Secure Office Networking">???</a>,
150 <a href="Big500users.html" title="Chapter 4. The 500-User Office">???</a> and <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>.
152 We present here the steps and example output for two NT4 to Samba-3 domain migrations. The
153 first uses an LDAP-based backend, and the second uses a tdbsam backend. In each case the
154 scripts you specify in the <code class="filename">smb.conf</code> file for the <em class="parameter"><code>add user script</code></em>
155 collection of parameters are used to effect the addition of accounts into the passdb backend.
157 Before proceeding to NT4 migration using either a tdbsam or ldapsam, it is most strongly recommended to
158 review <a href="Big500users.html#ch5-dnshcp-setup" title="Installation of DHCP, DNS, and Samba Control Files">???</a> for DNS and DHCP configuration. The importance of correctly
159 functioning name resolution must be recognized. This applies equally for both hostname and NetBIOS names
160 (machine names, computer names, domain names, workgroup names ALL names!).
162 The migration process involves the following steps:
163 </p><div class="itemizedlist"><ul type="disc"><li><p>
164 Prepare the target Samba-3 server. This involves configuring Samba-3 for
165 migration to either a tdbsam or an ldapsam backend.
167 <a class="indexterm" name="id2570157"></a>
168 <a class="indexterm" name="id2570163"></a>
169 <a class="indexterm" name="id2570170"></a>
170 Clean up the source NT4 PDC. Delete all accounts that need not be migrated.
171 Delete all files that should not be migrated. Where possible, change NT group
172 names so there are no spaces or uppercase characters. This is important if
173 the target UNIX host insists on POSIX-compliant all lowercase user and group
176 Step through the migration process.
177 </p></li><li><p><a class="indexterm" name="id2570191"></a>
178 Remove the NT4 PDC from the network.
180 Upgrade the Samba-3 server from a BDC to a PDC, and validate all account
182 </p></li></ul></div><p>
183 It may help to use the above outline as a pre-migration checklist.
184 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2570211"></a>NT4 Migration Using LDAP Backend</h3></div></div></div><p>
185 In this example, the migration is of an NT4 PDC to a Samba-3 PDC with an LDAP backend. The accounts about
186 to be migrated are shown in <a href="ntmigration.html#NT4DUM" title="Figure 9.2. View of Accounts in NT4 Domain User Manager">???</a>. In this example use is made of the
187 smbldap-tools scripts to add the accounts that are migrated into the ldapsam passdb backend.
188 Four scripts are essential to the migration process. Other scripts will be required
189 for daily management, but these are not critical to migration. The critical scripts are dependant
190 on which passdb backend is being used. Refer to <a href="ntmigration.html#ch8-vampire" title="Table 9.1. Samba smb.conf Scripts Essential to Samba Operation">???</a> to see which scripts
191 must be provided so that the migration process can complete.
193 Verify that you have correctly specified in the <code class="filename">smb.conf</code> file the scripts and arguments
194 that should be passed to them before attempting to perform the account migration. Note also
195 that the deletion scripts must be commented out during migration. These should be uncommented
196 following successful migration of the NT4 Domain accounts.
197 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
198 Under absolutely no circumstances should the Samba daemons be started until instructed to do so.
199 Delete the <code class="filename">/etc/samba/secrets.tdb</code> file and all Samba control tdb files
200 before commencing the following configuration steps.
201 </p></div><div class="table"><a name="ch8-vampire"></a><p class="title"><b>Table 9.1. Samba <code class="filename">smb.conf</code> Scripts Essential to Samba Operation</b></p><table summary="Samba smb.conf Scripts Essential to Samba Operation" border="1"><colgroup><col align="left"><col align="center"><col align="center"></colgroup><thead><tr><th align="left">Entity</th><th align="center">ldapsam Script</th><th align="center">tdbsam Script</th></tr></thead><tbody><tr><td align="left">Add User Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr><tr><td align="left">Delete User Accounts</td><td align="center">smbldap-userdel</td><td align="center">userdel</td></tr><tr><td align="left">Add Group Accounts</td><td align="center">smbldap-groupadd</td><td align="center">groupadd</td></tr><tr><td align="left">Delete Group Accounts</td><td align="center">smbldap-groupdel</td><td align="center">groupdel</td></tr><tr><td align="left">Add User to Group</td><td align="center">smbldap-groupmod</td><td align="center">usermod (See Note)</td></tr><tr><td align="left">Add Machine Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr></tbody></table></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
202 <a class="indexterm" name="id2570413"></a>
203 <a class="indexterm" name="id2570420"></a>
204 <a class="indexterm" name="id2570427"></a>
205 The UNIX/Linux <span><strong class="command">usermod</strong></span> utility does not permit simple user addition to (or deletion
206 of users from) groups. This is a feature provided by the smbldap-tools scripts. If you want this
207 capability, you must create your own tool to do this. Alternately, you can search the Web
208 to locate a utility called <span><strong class="command">groupmem</strong></span> (by George Kraft) that provides this functionality.
209 The <span><strong class="command">groupmem</strong></span> utility was contributed to the shadow package but has not surfaced
210 in the formal commands provided by Linux distributions (March 2004).
211 </p></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
212 <a class="indexterm" name="id2570464"></a>
213 The <span><strong class="command">tdbdump</strong></span> utility is a utility that you can build from the Samba source-code tree. Not all Linux binary distributions include this tool. If it is missing from your
214 Linux distribution, you will need to build this yourself or else forgo its use.
216 <a class="indexterm" name="id2570484"></a>
217 Before starting the migration, all dead accounts were removed from the NT4 domain using the User Manager for Domains.
218 </p><div class="procedure"><a name="id2570494"></a><p class="title"><b>Procedure 9.1. User Migration Steps</b></p><div class="example"><a name="sbent4smb"></a><p class="title"><b>Example 9.1. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2570555"></a><em class="parameter"><code>workgroup = DAMNATION</code></em></td></tr><tr><td><a class="indexterm" name="id2570568"></a><em class="parameter"><code>netbios name = MERLIN</code></em></td></tr><tr><td><a class="indexterm" name="id2570580"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2570594"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2570606"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2570619"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2570632"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2570645"></a><em class="parameter"><code>smb ports = 139 445</code></em></td></tr><tr><td><a class="indexterm" name="id2570657"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2570670"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2570684"></a><em class="parameter"><code>#delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2570697"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2570711"></a><em class="parameter"><code>#delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2570725"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/ smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2570738"></a><em class="parameter"><code>#delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2570753"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2570766"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2570780"></a><em class="parameter"><code>logon script = scripts\logon.cmd</code></em></td></tr><tr><td><a class="indexterm" name="id2570793"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2570806"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2570819"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2570832"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2570844"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2570857"></a><em class="parameter"><code>#wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2570870"></a><em class="parameter"><code>wins server = 192.168.123.124</code></em></td></tr><tr><td><a class="indexterm" name="id2570883"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2570896"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2570909"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2570922"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2570935"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2570948"></a><em class="parameter"><code>ldap suffix = dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2570961"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2570974"></a><em class="parameter"><code>ldap timeout = 20</code></em></td></tr><tr><td><a class="indexterm" name="id2570987"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2571000"></a><em class="parameter"><code>idmap backend = ldap:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2571013"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2571026"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2571039"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2571052"></a><em class="parameter"><code>ea support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2571064"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr></table></div><div class="example"><a name="sbent4smb2"></a><p class="title"><b>Example 9.2. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2571111"></a><em class="parameter"><code>comment = Application Data</code></em></td></tr><tr><td><a class="indexterm" name="id2571124"></a><em class="parameter"><code>path = /data/home/apps</code></em></td></tr><tr><td><a class="indexterm" name="id2571136"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2571158"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2571171"></a><em class="parameter"><code>path = /home/users/%U/Documents</code></em></td></tr><tr><td><a class="indexterm" name="id2571184"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2571196"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2571209"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2571231"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2571244"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2571256"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2571269"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2571282"></a><em class="parameter"><code>use client driver = No</code></em></td></tr><tr><td><a class="indexterm" name="id2571295"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2571316"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2571329"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2571342"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2571355"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2571376"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2571389"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2571402"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2571415"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id2571436"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id2571449"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id2571462"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2571475"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2571497"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2571510"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr></table></div><div class="example"><a name="sbentslapd"></a><p class="title"><b>Example 9.3. NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</b></p><pre class="screen">
219 include /etc/openldap/schema/core.schema
220 include /etc/openldap/schema/cosine.schema
221 include /etc/openldap/schema/inetorgperson.schema
222 include /etc/openldap/schema/nis.schema
223 include /etc/openldap/schema/samba3.schema
225 pidfile /var/run/slapd/slapd.pid
226 argsfile /var/run/slapd/slapd.args
232 access to attr=userPassword
236 access to attr=shadowLastChange
243 </pre></div><div class="example"><a name="sbentslapd2"></a><p class="title"><b>Example 9.4. NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part B</b></p><pre class="screen">
253 suffix "dc=terpstra-world,dc=org"
254 rootdn "cn=Manager,dc=terpstra-world,dc=org"
257 rootpw {SSHA}86kTavd9Dw3FAz6qzWTrCOKX/c0Qe+UV
259 directory /var/lib/ldap
261 # Indices to maintain
265 index uid pres,sub,eq
266 index displayName pres,sub,eq
271 index sambaPrimaryGroupSID eq
272 index sambaDomainName eq
274 </pre></div><div class="example"><a name="sbrntldapconf"></a><p class="title"><b>Example 9.5. NT4 Migration NSS LDAP File: <code class="filename">/etc/ldap.conf</code></b></p><pre class="screen">
277 base dc=terpstra-world,dc=org
281 binddn cn=Manager,dc=terpstra-world,dc=org
286 nss_base_passwd ou=People,dc=terpstra-world,dc=org?one
287 nss_base_shadow ou=People,dc=terpstra-world,dc=org?one
288 nss_base_group ou=Groups,dc=terpstra-world,dc=org?one
291 </pre></div><div class="example"><a name="sbentnss"></a><p class="title"><b>Example 9.6. NT4 Migration NSS Control File: <code class="filename">/etc/nsswitch.conf</code> (Stage:1)</b></p><pre class="screen">
296 hosts: files dns wins
310 #passwd_compat: ldap #Not needed.
311 #group_compat: ldap #Not needed.
312 </pre></div><div class="example"><a name="sbentnss2"></a><p class="title"><b>Example 9.7. NT4 Migration NSS Control File: <code class="filename">/etc/nsswitch.conf</code> (Stage:2)</b></p><pre class="screen">
317 hosts: files dns wins
331 #passwd_compat: ldap #Not needed.
332 #group_compat: ldap #Not needed.
333 </pre></div><ol type="1"><li><p>
334 Configure the Samba <code class="filename">smb.conf</code> file to create a BDC. An example configuration is
335 given in <a href="ntmigration.html#sbent4smb" title="Example 9.1. NT4 Migration Samba-3 Server smb.conf Part: A">???</a>.
336 The delete scripts are commented out so that during the process of migration
337 no account information can be deleted.
339 <a class="indexterm" name="id2571529"></a>
340 Configure OpenLDAP in preparation for the migration. An example
341 <code class="filename">sladp.conf</code> file is shown in <a href="ntmigration.html#sbentslapd" title="Example 9.3. NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A">???</a>.
342 The <code class="constant">rootpw</code> value is an encrypted password string that can
343 be obtained by executing the <span><strong class="command">slappasswd</strong></span> command.
345 <a class="indexterm" name="id2571643"></a>
346 <a class="indexterm" name="id2571649"></a>
347 Install the PADL <span><strong class="command">nss_ldap</strong></span> tool set, then configure the <code class="filename">/etc/ldap.conf</code>
348 as shown in <a href="ntmigration.html#sbrntldapconf" title="Example 9.5. NT4 Migration NSS LDAP File: /etc/ldap.conf">???</a>.
350 <a class="indexterm" name="id2571710"></a>
351 Edit the <code class="filename">/etc/nsswitch.conf</code> file so it has the entries shown
352 in <a href="ntmigration.html#sbentnss" title="Example 9.6. NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)">???</a>. Note that the LDAP entries have been commented out.
353 This is deliberate. If these entries are active (not commented out), and the
354 <code class="filename">/etc/ldap.conf</code> file has been configured, when the LDAP server
355 is started, the process of starting the LDAP server will cause LDAP lookups. This
356 causes the LDAP server <span><strong class="command">slapd</strong></span> to hang because it finds port 389
357 open and therefore cannot gain exclusive control of it. By commenting these entries
358 out, it is possible to avoid this gridlock situation and thus the overall
359 installation and configuration will progress more smoothly.
361 Validate the the target NT4 PDC name is being correctly resolved to its IP address by
362 executing the following:
363 </p><pre class="screen">
364 <code class="prompt">root# </code> ping transgression
365 PING transgression.terpstra-world.org (192.168.1.5) 56(84) bytes of data.
366 64 bytes from (192.168.1.5): icmp_seq=1 ttl=128 time=0.159 ms
367 64 bytes from (192.168.1.5): icmp_seq=2 ttl=128 time=0.192 ms
368 64 bytes from (192.168.1.5): icmp_seq=3 ttl=128 time=0.141 ms
370 --- transgression.terpstra-world.org ping statistics ---
371 3 packets transmitted, 3 received, 0% packet loss, time 2000ms
372 rtt min/avg/max/mdev = 0.141/0.164/0.192/0.021 ms
374 Do not proceed to the next step if this step fails. It is imperative that the name of the PDC
375 can be resolved to its IP address. If this is broken, fix it.
377 Pull the domain SID from the NT4 domain that is being migrated as follows:
378 </p><pre class="screen">
379 <code class="prompt">root# </code> net rpc getsid -S TRANGRESSION -U Administrator%not24get
380 Storing SID S-1-5-21-1385457007-882775198-1210191635 \
381 for Domain DAMNATION in secrets.tdb
384 Another way to obtain the domain SID from the target NT4 domain that is being
385 migrated to Samba-3 is by executing the following:
386 </p><pre class="screen">
387 <code class="prompt">root# </code> net rpc info -S TRANSGRESSION
389 If this method is used, do not forget to store the SID obtained into the
390 <code class="filename">secrets.tdb</code> file. This can be done by executing:
391 </p><pre class="screen">
392 <code class="prompt">root# </code> net setlocalsid S-1-5-21-1385457007-882775198-1210191635
395 <a class="indexterm" name="id2571880"></a>
396 <a class="indexterm" name="id2571886"></a>
397 <a class="indexterm" name="id2571893"></a>
398 <a class="indexterm" name="id2571900"></a>
399 Install the Idealx <span><strong class="command">smbldap-tools</strong></span> software package, following
400 the instructions given in <a href="happy.html#sbeidealx" title="Install and Configure Idealx smbldap-tools Scripts">???</a>. The resulting perl scripts
401 should be located in the <code class="filename">/opt/IDEALX/sbin</code> directory.
402 Change into that location, or wherever the scripts have been installed. Execute the
403 <code class="filename">configure.pl</code> script to configure the Idealx package for use.
404 Note: Use the domain SID obtained from the step above. The following is
405 an example configuration session:
406 </p><pre class="screen">
407 <code class="prompt">root# </code> ./configure.pl
408 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
409 smbldap-tools script configuration
410 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
411 Before starting, check
412 . if your samba controller is up and running.
413 . if the domain SID is defined
414 (you can get it with the 'net getlocalsid')
416 . you can leave the configuration using the Crtl-c key combination
417 . empty value can be set with the "." character
418 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
419 Looking for configuration files...
421 Samba Config File Location [/etc/samba/smb.conf] >
422 smbldap Config file Location (global parameters)
423 [/etc/smbldap-tools/smbldap.conf] >
424 smbldap Config file Location (bind parameters)
425 [/etc/smbldap-tools/smbldap_bind.conf] >
426 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
427 Let's start configuring the smbldap-tools scripts ...
429 . workgroup name: name of the domain Samba act as a PDC
430 workgroup name [DAMNATION] >
431 . netbios name: netbios name of the samba controller
432 netbios name [MERLIN] >
433 . logon drive: local path to which the home directory
434 will be connected (for NT Workstations). Ex: 'H:'
435 logon drive [X:] > H:
436 . logon home: home directory location (for Win95/98 or NT Workstation)
437 (use %U as username) Ex:'\\MERLIN\home\%U'
438 logon home (leave blank if you don't want homeDirectory)
439 [\\MERLIN\home\%U] > \\%L\%U
440 . logon path: directory where roaming profiles are stored.
441 Ex:'\\MERLIN\profiles\%U'
442 logon path (leave blank if you don't want roaming profile)
443 [\\MERLIN\profiles\%U] > \\%L\profiles\%U
444 . home directory prefix (use %U as username) [/home/%U] >
446 . default user netlogon script (use %U as username)
447 [%U.cmd] > scripts\logon.cmd
448 default password validation time (time in days) [45] > 180
449 . ldap suffix [dc=terpstra-world,dc=org] >
450 . ldap group suffix [ou=Groups] >
451 . ldap user suffix [ou=People] >
452 . ldap machine suffix [ou=People] >
453 . Idmap suffix [ou=Idmap] >
454 . sambaUnixIdPooldn: object where you want to store the next uidNumber
455 and gidNumber available for new users and groups
456 sambaUnixIdPooldn object (relative to ${suffix})
457 [sambaDomainName=DAMNATION] >
458 . ldap master server:
459 IP address or DNS name of the master (writable) ldap server
460 ldap master server [] > 127.0.0.1
461 . ldap master port [389] >
462 . ldap master bind dn [cn=Manager,dc=terpstra-world,dc=org] >
463 . ldap master bind password [] >
464 . ldap slave server: IP address or DNS name of the slave ldap server:
465 can also be the master one
466 ldap slave server [] > 127.0.0.1
467 . ldap slave port [389] >
468 . ldap slave bind dn [cn=Manager,dc=terpstra-world,dc=org] >
469 . ldap slave bind password [] >
470 . ldap tls support (1/0) [0] >
471 . SID for domain DAMNATION: SID of the domain
472 (can be obtained with 'net getlocalsid MERLIN')
473 SID for domain DAMNATION []
474 > S-1-5-21-1385457007-882775198-1210191635
475 . unix password encryption: encryption used for unix passwords
476 unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA) [SSHA] > MD5
477 . default user gidNumber [513] >
478 . default computer gidNumber [515] >
479 . default login shell [/bin/bash] >
480 . default domain name to append to mail address [] >
482 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
483 backup old configuration files:
484 /etc/smbldap-tools/smbldap.conf->
485 /etc/smbldap-tools/smbldap.conf.old
486 /etc/smbldap-tools/smbldap_bind.conf->
487 /etc/smbldap-tools/smbldap_bind.conf.old
488 writing new configuration file:
489 /etc/smbldap-tools/smbldap.conf done.
490 /etc/smbldap-tools/smbldap_bind.conf done.
492 <a class="indexterm" name="id2572050"></a>
493 <a class="indexterm" name="id2572057"></a>
494 <a class="indexterm" name="id2572064"></a>
495 <a class="indexterm" name="id2572071"></a>
496 Note that the NT4 domain SID that was previously obtained was entered above. Also,
497 the sambaUnixIdPooldn object was specified as sambaDomainName=DAMNATION. This is
498 the location into which the Idealx smbldap-tools store the next available UID/GID
499 information. It is also where Samba stores domain specific information such as the
500 next RID, the SID, and so on. In older version of the smbldap-tools this information
501 was stored in the sambaUnixIdPooldn DIT location cn=NextFreeUnixId. Where smbldap-tools
502 are being upgraded to version 0.9.1 it is appropriate to update this to the new location
503 only if the directory information is also relocated.
505 Start the LDAP server using the system interface script. On Novell SLES9
506 this is done as shown here:
507 </p><pre class="screen">
508 <code class="prompt">root# </code> rcldap start
511 Edit the <code class="filename">/etc/nsswitch.conf</code> file so it has the entries shown in
512 <a href="ntmigration.html#sbentnss2" title="Example 9.7. NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:2)">???</a>. Note that the LDAP entries have now been uncommented.
514 The LDAP management password must be installed into the <code class="filename">secrets.tdb</code>
516 </p><pre class="screen">
517 <code class="prompt">root# </code> smbpasswd -w not24get
518 Setting stored password for
519 "cn=Manager,dc=terpstra-world,dc=org" in secrets.tdb
522 Populate the LDAP directory as shown here:
523 </p><pre class="screen">
524 <code class="prompt">root# </code> /opt/IDEALX/sbin/smbldap-populate -a root -k 0 -m 0
525 Using workgroup name from sambaUnixIdPooldn (smbldap.conf):
526 sambaDomainName=DAMNATION
527 Using builtin directory structure
528 adding new entry: dc=terpstra-world,dc=org
529 adding new entry: ou=People,dc=terpstra-world,dc=org
530 adding new entry: ou=Groups,dc=terpstra-world,dc=org
531 entry ou=People,dc=terpstra-world,dc=org already exist.
532 adding new entry: ou=Idmap,dc=terpstra-world,dc=org
533 adding new entry: sambaDomainName=DAMNATION,dc=terpstra-world,dc=org
534 adding new entry: uid=root,ou=People,dc=terpstra-world,dc=org
535 adding new entry: uid=nobody,ou=People,dc=terpstra-world,dc=org
536 adding new entry: cn=Domain Admins,ou=Groups,dc=terpstra-world,dc=org
537 adding new entry: cn=Domain Users,ou=Groups,dc=terpstra-world,dc=org
538 adding new entry: cn=Domain Guests,ou=Groups,dc=terpstra-world,dc=org
539 adding new entry: cn=Domain Computers,ou=Groups,dc=terpstra-world,dc=org
540 adding new entry: cn=Administrators,ou=Groups,dc=terpstra-world,dc=org
541 adding new entry: cn=Print Operators,ou=Groups,dc=terpstra-world,dc=org
542 adding new entry: cn=Backup Operators,ou=Groups,dc=terpstra-world,dc=org
543 adding new entry: cn=Replicators,ou=Groups,dc=terpstra-world,dc=org
545 The script tries to add the ou=People container twice, hence the error message.
546 This is expected behavior.
548 <a class="indexterm" name="id2572246"></a>
549 Restart the LDAP server following initialization of the LDAP directory. Execute the
550 system control script provided on your system. The following steps can be used on
552 </p><pre class="screen">
553 <code class="prompt">root# </code> rcldap restart
554 <code class="prompt">root# </code> chkconfig ldap on
557 Verify that the new user accounts that have been added to the LDAP directory can be
559 </p><pre class="screen">
560 <code class="prompt">root# </code> getent passwd
562 nobody:x:65534:65533:nobody:/var/lib/nobody:/bin/bash
563 man:x:13:62:Manual pages viewer:/var/cache/man:/bin/bash
564 news:x:9:13:News system:/etc/news:/bin/bash
565 uucp:x:10:14:Unix-to-Unix CoPy system:/etc/uucp:/bin/bash
567 root:x:0:0:Netbios Domain Administrator:/home/users/root:/bin/false
568 nobody:x:999:514:nobody:/dev/null:/bin/false
570 Now repeat this for the group accounts as shown here:
571 </p><pre class="screen">
572 <code class="prompt">root# </code> getent group
575 nogroup:x:65534:nobody
578 Domain Admins:x:512:root
581 Domain Computers:x:515:
582 Administrators:x:544:
583 Print Operators:x:550:
584 Backup Operators:x:551:
587 In both cases the LDAP accounts follow the “<span class="quote">+::0:</span>” entry.
589 Now it is time to join the Samba BDC to the target NT4 domain that is being
590 migrated to Samba-3 by executing the following:
591 </p><pre class="screen">
592 <code class="prompt">root# </code> net rpc join -S TRANSGRESSION -U Administrator%not24get
593 merlin:/opt/IDEALX/sbin # net rpc join -S TRANSGRESSION \
594 -U Administrator%not24get
595 Joined domain DAMNATION.
598 Set the new domain administrator (root) password for both UNIX and Windows as shown here:
599 </p><pre class="screen">
600 <code class="prompt">root# </code> /opt/IDEALX/sbin/smbldap-passwd root
601 Changing password for root
602 New password : ********
603 Retype new password : ********
605 Note: During account migration, the Windows Administrator account will not be migrated
608 Now validate that these accounts can be resolved using Samba's tools as
609 shown here for user accounts:
610 </p><pre class="screen">
611 <code class="prompt">root# </code> pdbedit -Lw
612 root:0:84B0D8E14D158FF8417EAF50CFAC29C3:
613 AF6DD3FD4E2EA8BDE1695A3F05EFBF52:[U ]:LCT-425F6467:
614 nobody:65534:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:
615 NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:[NU ]:LCT-00000000:
617 Now complete the following step to validate that group account mappings have
619 </p><pre class="screen">
620 <code class="prompt">root# </code> net groupmap list
621 Domain Admins (S-1-5-21-1385457007-882775198-1210191635-512)
623 Domain Users (S-1-5-21-1385457007-882775198-1210191635-513)
625 Domain Guests (S-1-5-21-1385457007-882775198-1210191635-514)
627 Domain Computers (S-1-5-21-1385457007-882775198-1210191635-515)
628 -> Domain Computers
629 Administrators (S-1-5-32-544) -> Administrators
630 Print Operators (S-1-5-32-550) -> Print Operators
631 Backup Operators (S-1-5-32-551) -> Backup Operators
632 Replicators (S-1-5-32-552) -> Replicators
634 These are the expected results for a correctly configured system.
636 Commence migration as shown here:
637 </p><pre class="screen">
638 <code class="prompt">root# </code> net rpc vampire -S TRANSGRESSION \
639 -U Administrator%not24get > /tmp/vampire.log 2>1
641 Check the vampire log to confirm that only expected errors have been
642 reported. See <a href="ntmigration.html#sbevam1" title="Migration Log Validation">???</a>.
644 The migration of user accounts can be quickly validated as follows:
645 </p><pre class="screen">
646 <code class="prompt">root# </code> pdbedit -Lw
647 root:0:84B0D8E14D158FF8417EAF50CFAC29C3:...
648 nobody:65534:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:...
649 Administrator:0:84B0D8E14D158FF8417EAF50CFAC29C3:...
650 Guest:1:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:...
651 TRANSGRESSION$:2:CC044B748CEE294CE76B6B0D1B86C1A8:...
652 IUSR_TRANSGRESSION:3:64046AC81B056C375F9537FC409085F8:...
653 MIDEARTH$:4:E93186E5819706D2AAD3B435B51404EE:...
654 atrickhoffer:5:DC08CFE0C12B2867352502E32A407F23:...
655 barryf:6:B829BCDE01FF24376E45D5F10408CFBD:...
656 fsellerby:7:6A97CBEBE8F9826B417EAF50CFAC29C3:...
657 gdaison:8:48F6A8C8A900024351DA8C2061C5F1D3:...
658 hrambotham:9:7330D9EA0964465EAAD3B435B51404EE:...
659 jrhapsody:10:ACBA7D207E2BA35D9BD41A26B01626BD:...
660 maryk:11:293B5A4CA41F6CA1A7D80430B8342B73:...
661 jacko:12:8E8982D86BD037C364BBD09A598E07AD:...
662 bridge:13:0D2CA7D2BE67FE2193BE3A377C968336:...
663 sharpec:14:8841A75CAC19D2855D8B73B1F4D430F8:...
664 jimbo:15:6E8BDC904FD9EC5C17306D272A9441BB:...
665 dhenwick:16:D1694A03C33584BDAAD3B435B51404EE:...
666 dork:17:69E2D19E69A593D5AAD3B435B51404EE:...
667 blue:18:E355EBF9559979FEAAD3B435B51404EE:...
668 billw:19:EE35C3481CF7F7DB484448BC86A641A5:...
669 rfreshmill:20:7EC033B58661B60CAAD3B435B51404EE:...
670 MAGGOT$:21:A3B9334765AD30F7AAD3B435B51404EE:...
671 TRENTWARE$:22:1D92C8DD5E7F0DDF93BE3A377C968336:...
672 MORTON$:23:89342E69DCA9D3F8AAD3B435B51404EE:...
673 NARM$:24:2B93E2D1D25448BDAAD3B435B51404EE:...
674 LAPDOG$:25:14AA535885120943AAD3B435B51404EE:...
675 SCAVENGER$:26:B6288EB6D147B56F8963805A19B0ED49:...
676 merlin$:27:820C50523F368C54AB9D85AE603AD09D:...
679 The mapping of UNIX and Windows groups can be validated as show here:
680 </p><pre class="screen">
681 <code class="prompt">root# </code> net groupmap list
682 Domain Admins (S-1-5-21-1385457007-882775198-1210191635-512)
684 Domain Users (S-1-5-21-1385457007-882775198-1210191635-513)
686 Domain Guests (S-1-5-21-1385457007-882775198-1210191635-514)
688 Domain Computers (S-1-5-21-1385457007-882775198-1210191635-515)
689 -> Domain Computers
690 Administrators (S-1-5-32-544) -> Administrators
691 Print Operators (S-1-5-32-550) -> Print Operators
692 Backup Operators (S-1-5-32-551) -> Backup Operators
693 Replicator (S-1-5-32-552) -> Replicators
694 Engineers (S-1-5-21-1385457007-882775198-1210191635-1020) -> Engineers
695 Marketoids (S-1-5-21-1385457007-882775198-1210191635-1022) -> Marketoids
696 Gnomes (S-1-5-21-1385457007-882775198-1210191635-1023) -> Gnomes
697 Catalyst (S-1-5-21-1385457007-882775198-1210191635-1024) -> Catalyst
698 Recieving (S-1-5-21-1385457007-882775198-1210191635-1025) -> Recieving
699 Rubberboot (S-1-5-21-1385457007-882775198-1210191635-1026) -> Rubberboot
700 Sales (S-1-5-21-1385457007-882775198-1210191635-1027) -> Sales
701 Accounting (S-1-5-21-1385457007-882775198-1210191635-1028) -> Accounting
702 Shipping (S-1-5-21-1385457007-882775198-1210191635-1029) -> Shipping
703 Account Operators (S-1-5-32-548) -> Account Operators
704 Guests (S-1-5-32-546) -> Guests
705 Server Operators (S-1-5-32-549) -> Server Operators
706 Users (S-1-5-32-545) -> Users
708 It is of vital importance that the domain SID portions of all group
709 accounts are identical.
711 The final responsibility in the migration process is to create identical
712 shares and printing resources on the new Samba-3 server, copy all data
713 across, set up privileges, and set share and file/directory access controls.
715 <a class="indexterm" name="id2572560"></a>
716 <a class="indexterm" name="id2572567"></a>
717 Edit the <code class="filename">smb.conf</code> file to reset the parameter
718 <a class="indexterm" name="id2572581"></a>domain master = Yes so that
719 the Samba server functions as a PDC for the purpose of migration.
720 Also, uncomment the deletion scripts so they will now be fully functional,
721 enable the <em class="parameter"><code>wins support = yes</code></em> parameter and
722 comment out the <em class="parameter"><code>wins server</code></em>. Validate the configuration
723 with the <span><strong class="command">testparm</strong></span> utility as shown here:
724 </p><pre class="screen">
725 <code class="prompt">root# </code> testparm
726 Load smb config files from /etc/samba/smb.conf
727 Processing section "[apps]"
728 Processing section "[media]"
729 Processing section "[homes]"
730 Processing section "[printers]"
731 Processing section "[netlogon]"
732 Processing section "[profiles]"
733 Processing section "[profdata]"
734 Processing section "[print$]"
735 Loaded services file OK.
736 Server role: ROLE_DOMAIN_PDC
737 Press enter to see a dump of your service definitions
740 Now shut down the old NT4 PDC. Only when the old NT4 PDC and all
741 NT4 BDCs have been shut down can the Samba-3 PDC be started.
743 All workstations should function as they did with the old NT4 PDC. All
744 interdomain trust accounts should remain in place and fully functional.
745 All machine accounts and user logon accounts should also function correctly.
747 The configuration of Samba-3 BDC servers can be accomplished now or at any
748 convenient time in the future. Please refer to the carefully detailed process
749 for doing so is outlined in <a href="happy.html#sbehap-bldg1" title="Samba-3 BDC Configuration">???</a>.
750 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sbevam1"></a>Migration Log Validation</h4></div></div></div><p>
751 The following <code class="filename">vampire.log</code> file is typical of a valid migration.
752 </p><pre class="screen">
753 adding user Administrator to group Domain Admins
754 adding user atrickhoffer to group Engineers
755 adding user dhenwick to group Engineers
756 adding user dork to group Engineers
757 adding user rfreshmill to group Marketoids
758 adding user jacko to group Gnomes
759 adding user jimbo to group Gnomes
760 adding user maryk to group Gnomes
761 adding user gdaison to group Gnomes
762 adding user dhenwick to group Catalyst
763 adding user jacko to group Catalyst
764 adding user jacko to group Recieving
765 adding user blue to group Recieving
766 adding user hrambotham to group Rubberboot
767 adding user billw to group Sales
768 adding user bridge to group Sales
769 adding user jrhapsody to group Sales
770 adding user maryk to group Sales
771 adding user rfreshmill to group Sales
772 adding user fsellerby to group Sales
773 adding user sharpec to group Sales
774 adding user jimbo to group Accounting
775 adding user gdaison to group Accounting
776 adding user jacko to group Shipping
777 adding user blue to group Shipping
778 Fetching DOMAIN database
779 Creating unix group: 'Engineers'
780 Creating unix group: 'Marketoids'
781 Creating unix group: 'Gnomes'
782 Creating unix group: 'Catalyst'
783 Creating unix group: 'Recieving'
784 Creating unix group: 'Rubberboot'
785 Creating unix group: 'Sales'
786 Creating unix group: 'Accounting'
787 Creating unix group: 'Shipping'
788 Creating account: Administrator
789 Creating account: Guest
790 Creating account: TRANSGRESSION$
791 Creating account: IUSR_TRANSGRESSION
792 Creating account: MIDEARTH$
793 Creating account: atrickhoffer
794 Creating account: barryf
795 Creating account: fsellerby
796 Creating account: gdaison
797 Creating account: hrambotham
798 Creating account: jrhapsody
799 Creating account: maryk
800 Creating account: jacko
801 Creating account: bridge
802 Creating account: sharpec
803 Creating account: jimbo
804 Creating account: dhenwick
805 Creating account: dork
806 Creating account: blue
807 Creating account: billw
808 Creating account: rfreshmill
809 Creating account: MAGGOT$
810 Creating account: TRENTWARE$
811 Creating account: MORTON$
812 Creating account: NARM$
813 Creating account: LAPDOG$
814 Creating account: SCAVENGER$
815 Creating account: merlin$
816 Group members of Domain Admins: Administrator,
817 Group members of Domain Users: Administrator(primary),
818 TRANSGRESSION$(primary),IUSR_TRANSGRESSION(primary),
819 MIDEARTH$(primary),atrickhoffer(primary),barryf(primary),
820 fsellerby(primary),gdaison(primary),hrambotham(primary),
821 jrhapsody(primary),maryk(primary),jacko(primary),bridge(primary),
822 sharpec(primary),jimbo(primary),dhenwick(primary),dork(primary),
823 blue(primary),billw(primary),rfreshmill(primary),MAGGOT$(primary),
824 TRENTWARE$(primary),MORTON$(primary),NARM$(primary),
825 LAPDOG$(primary),SCAVENGER$(primary),merlin$(primary),
826 Group members of Domain Guests: Guest(primary),
827 Group members of Engineers: atrickhoffer,dhenwick,dork,
828 Group members of Marketoids: rfreshmill,
829 Group members of Gnomes: jacko,jimbo,maryk,gdaison,
830 Group members of Catalyst: dhenwick,jacko,
831 Group members of Recieving: jacko,blue,
832 Group members of Rubberboot: hrambotham,
833 Group members of Sales: billw,bridge,jrhapsody,maryk,
834 rfreshmill,fsellerby,sharpec,
835 Group members of Accounting: jimbo,gdaison,
836 Group members of Shipping: jacko,blue,
837 Fetching BUILTIN database
838 skipping SAM_DOMAIN_INFO delta for 'Builtin' (is not my domain)
839 Creating unix group: 'Account Operators'
840 Creating unix group: 'Guests'
841 Creating unix group: 'Server Operators'
842 Creating unix group: 'Users'
844 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2572803"></a>NT4 Migration Using tdbsam Backend</h3></div></div></div><p>
845 In this example, we change the domain name of the NT4 server from
846 <code class="constant">DRUGPREP</code> to <code class="constant">MEGANET</code> prior to the use
847 of the vampire (migration) tool. This migration process makes use of Linux system tools
848 (like <span><strong class="command">useradd</strong></span>) to add the accounts that are migrated into the
849 UNIX/Linux <code class="filename">/etc/passwd</code> and <code class="filename">/etc/group</code>
850 databases. These entries must therefore be present, and correct options specified,
851 in your <code class="filename">smb.conf</code> file, or else the migration does not work as it should.
852 </p><div class="procedure"><a name="id2572850"></a><p class="title"><b>Procedure 9.2. Migration Steps Using tdbsam</b></p><ol type="1"><li><p>
853 Prepare a Samba-3 server precisely per the instructions shown in <a href="Big500users.html" title="Chapter 4. The 500-User Office">???</a>.
854 Set the workgroup name to <code class="constant">MEGANET</code>.
855 </p></li><li><p><a class="indexterm" name="id2572878"></a><a class="indexterm" name="id2572886"></a>
856 Edit the <code class="filename">smb.conf</code> file to temporarily change the parameter
857 <a class="indexterm" name="id2572902"></a>domain master = No so
858 the Samba server functions as a BDC for the purpose of migration.
860 Start Samba as you have done previously.
861 </p></li><li><p><a class="indexterm" name="id2572923"></a>
862 Join the NT4 Domain as a BDC, as shown here:
863 </p><pre class="screen">
864 <code class="prompt">root# </code> net rpc join -S oldnt4pdc -W MEGANET -UAdministrator%not24get
865 Joined domain MEGANET.
867 </p></li><li><p><a class="indexterm" name="id2572958"></a>
868 You may vampire the accounts from the NT4 PDC by executing the command, as shown here:
869 </p><pre class="screen">
870 <code class="prompt">root# </code> net rpc vampire -S oldnt4pdc -U Administrator%not24get
871 Fetching DOMAIN database
872 SAM_DELTA_DOMAIN_INFO not handled
873 Creating unix group: 'Domain Admins'
874 Creating unix group: 'Domain Users'
875 Creating unix group: 'Domain Guests'
876 Creating unix group: 'Engineers'
877 Creating unix group: 'Marketoids'
878 Creating unix group: 'Account Operators'
879 Creating unix group: 'Administrators'
880 Creating unix group: 'Backup Operators'
881 Creating unix group: 'Guests'
882 Creating unix group: 'Print Operators'
883 Creating unix group: 'Replicator'
884 Creating unix group: 'Server Operators'
885 Creating unix group: 'Users'
886 Creating account: Administrator
887 Creating account: Guest
888 Creating account: oldnt4pdc$
889 Creating account: jacko
890 Creating account: maryk
891 Creating account: bridge
892 Creating account: sharpec
893 Creating account: jimbo
894 Creating account: dhenwick
895 Creating account: dork
896 Creating account: blue
897 Creating account: billw
898 Creating account: massive$
899 Group members of Engineers: Administrator,
900 sharpec(primary),bridge,billw(primary),dhenwick
901 Group members of Marketoids: Administrator,jacko(primary),
902 maryk(primary),jimbo,blue(primary),dork(primary)
903 Creating unix group: 'Gnomes'
904 Fetching BUILTIN database
905 SAM_DELTA_DOMAIN_INFO not handled
907 </p></li><li><p><a class="indexterm" name="id2573033"></a>
908 At this point, we can validate our migration. Let's look at the accounts
909 in the form in which they are seen in a smbpasswd file. This achieves that:
910 </p><pre class="screen">
911 <code class="prompt">root# </code> pdbedit -Lw
912 Administrator:505:84B0D8E14D158FF8417EAF50CFAC29C3:
913 AF6DD3FD4E2EA8BDE1695A3F05EFBF52:[UX ]:LCT-3DF7AA9F:
914 jimbo:512:6E9A2A51F64A1BD5C187B8085FE1D9DF:
915 CDF7E305E639966E489A0CEFB95EE5E0:[UX ]:LCT-3E9362BC:
916 sharpec:511:E4301A7CD8FDD1EC6BBF9BC19CDF8151:
917 7000255938831D5B948C95C1931534C5:[UX ]:LCT-3E8B42C4:
918 dhenwick:513:DCD8886141E3F892AAD3B435B51404EE:
919 2DB36465949CB938DD98C312EFDC2639:[UX ]:LCT-3E939F41:
920 bridge:510:3FE6873A43101B46417EAF50CFAC29C3:
921 891741F481AF111B4CAA09A94016BD01:[UX ]:LCT-3E8B4291:
922 blue:515:256D41D2559BB3D2AAD3B435B51404EE:
923 9CCADDA4F7D281DD0FAD321478C6F971:[UX ]:LCT-3E939FDC:
924 diamond$:517:6C8E7B64EDCDBC4218B6345447A4454B:
925 3323AC63C666CFAACB60C13F65D54E9A:[S ]:LCT-00000000:
926 oldnt4pdc$:507:3E39430CDCABB5B09ED320D0448AE568:
927 95DBAF885854A919C7C7E671060478B9:[S ]:LCT-3DF7AA9F:
928 Guest:506:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:
929 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[DUX ]:LCT-3E93A008:
930 billw:516:85380CA7C21B6EBE168C8150662AF11B:
931 5D7478508293709937E55FB5FBA14C17:[UX ]:LCT-3FED7CA1:
932 dork:514:78C70DDEC35A35B5AAD3B435B51404EE:
933 0AD886E015AC595EC0AF40E6C9689E1A:[UX ]:LCT-3E939F9A:
934 jacko:508:BC472F3BF9A0A5F63832C92FC614B7D1:
935 0C6822AAF85E86600A40DC73E40D06D5:[UX ]:LCT-3E8B4242:
936 maryk:509:3636AB7E12EBE79AB79AE2610DD89D4C:
937 CF271B744F7A55AFDA277FF88D80C527:[UX ]:LCT-3E8B4270:
939 </p></li><li><p><a class="indexterm" name="id2573086"></a>
940 An expanded view of a user account entry shows more of what was
941 obtained from the NT4 PDC:
942 </p><pre class="screen">
943 sleeth:~ # pdbedit -Lv maryk
947 User SID: S-1-5-21-1988699175-926296742-1295600288-1003
948 Primary Group SID: S-1-5-21-1988699175-926296742-1295600288-1007
949 Full Name: Mary Kathleen
950 Home Directory: \\diamond\maryk
952 Logon Script: scripts\logon.bat
953 Profile Path: \\diamond\profiles\maryk
955 Account desc: Peace Maker
959 Logoff time: Mon, 18 Jan 2038 20:14:07 GMT
960 Kickoff time: Mon, 18 Jan 2038 20:14:07 GMT
961 Password last set: Wed, 02 Apr 2003 13:05:04 GMT
962 Password can change: 0
963 Password must change: Mon, 18 Jan 2038 20:14:07 GMT
965 </p></li><li><p><a class="indexterm" name="id2573121"></a>
966 The following command lists the long names of the groups that have been
967 imported (vampired) from the NT4 PDC:
968 </p><pre class="screen">
969 <code class="prompt">root# </code> net group -l -Uroot%not24get -Smassive
972 -----------------------------
973 Engineers Snake Oil Engineers
974 Marketoids Untrustworthy Hype Vendors
975 Gnomes Plain Vanilla Garden Gnomes
976 Replicator Supports file replication in a domain
977 Guests Users granted guest access to the computer/domain
978 Administrators Members can fully administer the computer/domain
981 Everything looks well and in order.
982 </p></li><li><p><a class="indexterm" name="id2573161"></a><a class="indexterm" name="id2573169"></a>
983 Edit the <code class="filename">smb.conf</code> file to reset the parameter
984 <a class="indexterm" name="id2573184"></a>domain master = Yes so
985 the Samba server functions as a PDC for the purpose of migration.
986 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2573196"></a>Key Points Learned</h3></div></div></div><p>
987 Migration of an NT4 PDC database to a Samba-3 PDC is possible.
988 </p><div class="itemizedlist"><ul type="disc"><li><p>
989 An LDAP backend is a suitable vehicle for NT4 migrations.
991 A tdbsam backend can be used to perform a migration.
993 Multiple NT4 domains can be merged into a single Samba-3
996 The net Samba-3 domain most likely requires some
997 administration and updating before going live.
998 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2573235"></a>Questions and Answers</h2></div></div></div><p>
999 </p><div class="qandaset"><dl><dt> <a href="ntmigration.html#id2573250">clean database
1000 Why must I start each migration with a clean database?
1001 </a></dt><dt> <a href="ntmigration.html#id2573291">Domain SID
1002 Is it possible to set my domain SID to anything I like?
1003 </a></dt><dt> <a href="ntmigration.html#id2573348">/etc/passwd/etc/grouptdbsampassdb backendaccountsuseraccountsgroupaccountsDomain
1004 When using a tdbsam passdb backend, why must I have all domain user and group accounts
1005 in /etc/passwd and /etc/group?
1006 </a></dt><dt> <a href="ntmigration.html#id2573522">validateconnectivitymigration
1007 Why did you validate connectivity before attempting migration?
1008 </a></dt><dt> <a href="ntmigration.html#id2573568">
1009 How would you merge 10 tdbsam-based domains into an LDAP database?
1010 </a></dt><dt> <a href="ntmigration.html#id2573697">machine accountsaccountsmachine
1011 I want to change my domain name after I migrate all accounts from an NT4 domain to a
1012 Samba-3 domain. Does it make any sense to migrate the machine accounts in that case?
1013 </a></dt><dt> <a href="ntmigration.html#id2573773">multiple group mappings
1014 After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why?
1015 </a></dt><dt> <a href="ntmigration.html#id2573838">
1016 How can I reset group membership after loading the account information into the LDAP database?
1017 </a></dt><dt> <a href="ntmigration.html#id2573872">group names
1018 What are the limits or constraints that apply to group names?
1019 </a></dt><dt> <a href="ntmigration.html#id2573977">vampire
1020 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3
1021 LDAP backend system using the vampire process?
1022 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2573250"></a><a name="id2573252"></a><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573256"></a>
1023 Why must I start each migration with a clean database?
1024 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573271"></a>
1025 This is a recommendation that permits the data from each NT4 domain to
1026 be kept separate until you are ready to merge them. Also, if you do not start with a clean database,
1027 you may find errors due to users or groups from multiple domains having the
1028 same name but different SIDs. It is better to permit each migration to complete
1029 without undue errors and then to handle the merging of vampired data under
1031 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2573291"></a><a name="id2573293"></a><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573296"></a>
1032 Is it possible to set my domain SID to anything I like?
1033 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573312"></a><a class="indexterm" name="id2573320"></a><a class="indexterm" name="id2573327"></a>
1034 Yes, so long as the SID you create has the same structure as an autogenerated SID.
1035 The typical SID looks like this: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX, where
1036 the XXXXXXXXXX can be any number with from 6 to 10 digits. On the other hand, why
1037 would you really want to create your own SID? I cannot think of a good reason.
1038 You may want to set the SID to one that is already in use somewhere on your network,
1039 but that is a little different from straight out creating your own domain SID.
1040 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2573348"></a><a name="id2573350"></a><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573353"></a><a class="indexterm" name="id2573361"></a><a class="indexterm" name="id2573369"></a><a class="indexterm" name="id2573377"></a><a class="indexterm" name="id2573385"></a><a class="indexterm" name="id2573396"></a><a class="indexterm" name="id2573408"></a>
1041 When using a tdbsam passdb backend, why must I have all domain user and group accounts
1042 in <code class="filename">/etc/passwd</code> and <code class="filename">/etc/group</code>?
1043 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573439"></a><a class="indexterm" name="id2573447"></a><a class="indexterm" name="id2573454"></a><a class="indexterm" name="id2573462"></a><a class="indexterm" name="id2573470"></a><a class="indexterm" name="id2573478"></a>
1044 Samba-3 must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba
1045 does not fabricate the UNIX IDs from thin air, but rather requires them to be located
1046 in a suitable place.
1048 When migrating a <code class="filename">smbpasswd</code> file to an LDAP backend, the
1049 UID of each account is taken together with the account information in the
1050 <code class="filename">/etc/passwd</code>, and both sets of data are used to create the account
1051 entry in the LDAP database.
1053 If you elect to create the POSIX account also, the entire UNIX account is copied to the
1054 LDAP backend. The same occurs with NT groups and UNIX groups. At the conclusion of
1055 migration to the LDAP database, the accounts may be removed from the UNIX database files.
1056 In short then, all UNIX and Windows networking accounts, both in tdbsam as well as in
1057 LDAP, require UIDs/GIDs.
1058 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2573522"></a><a name="id2573524"></a><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573528"></a><a class="indexterm" name="id2573536"></a><a class="indexterm" name="id2573544"></a>
1059 Why did you validate connectivity before attempting migration?
1060 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
1061 Access validation before attempting to migrate NT4 domain accounts helps to pinpoint
1062 potential problems that may otherwise affect or impede account migration. I am always
1063 mindful of the 4 P's of migration: Planning Prevents Poor Performance.
1064 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2573568"></a><a name="id2573570"></a><b></b></td><td align="left" valign="top"><p>
1065 How would you merge 10 tdbsam-based domains into an LDAP database?
1066 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573581"></a><a class="indexterm" name="id2573589"></a><a class="indexterm" name="id2573596"></a><a class="indexterm" name="id2573604"></a><a class="indexterm" name="id2573612"></a><a class="indexterm" name="id2573620"></a><a class="indexterm" name="id2573628"></a><a class="indexterm" name="id2573635"></a><a class="indexterm" name="id2573643"></a><a class="indexterm" name="id2573651"></a><a class="indexterm" name="id2573659"></a>
1067 If you have 10 tdbsam Samba domains, there is considerable risk that there are a number of
1068 accounts that have the same UNIX identifier (UID/GID). This means that you almost
1069 certainly have to edit a lot of data. It would be easiest to dump each database in smbpasswd
1070 file format and then manually edit all records to ensure that each has a unique UID. Each
1071 file can then be imported a number of ways. You can use the <span><strong class="command">pdbedit</strong></span> tool
1072 to affect a transfer from the smbpasswd file to LDAP, or you can migrate them en masse to
1073 tdbsam and then to LDAP. The final choice is yours. Just remember to verify all accounts that
1074 you have migrated before handing over access to a user. After all, too many users with a bad
1075 migration experience may threaten your career.
1076 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2573697"></a><a name="id2573699"></a><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573702"></a><a class="indexterm" name="id2573710"></a>
1077 I want to change my domain name after I migrate all accounts from an NT4 domain to a
1078 Samba-3 domain. Does it make any sense to migrate the machine accounts in that case?
1079 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573731"></a><a class="indexterm" name="id2573739"></a><a class="indexterm" name="id2573747"></a><a class="indexterm" name="id2573755"></a>
1080 I would recommend not to migrate the machine account. The machine accounts should still work, but there are registry entries
1081 on each Windows NT4 and upward client that have a tattoo of the old domain name. If you
1082 unjoin the domain and then rejoin the newly renamed Samba-3 domain, you can be certain to avoid
1083 this tattooing effect.
1084 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2573773"></a><a name="id2573775"></a><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573778"></a>
1085 After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why?
1086 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573795"></a><a class="indexterm" name="id2573802"></a>
1087 Samba-3 currently does not implement multiple group membership internally. If you use the Windows
1088 NT4 Domain User Manager to manage accounts and you have an LDAP backend, the multiple group
1089 membership is stored in the POSIX groups area. If you use either tdbsam or smbpasswd backend,
1090 then multiple group membership is handled through the UNIX groups file. When you dump the user
1091 accounts, no group account information is provided. When you edit (change) UIDs and GIDs in each
1092 file to which you migrated the NT4 Domain data, do not forget to edit the UNIX <code class="filename">/etc/passwd</code>
1093 and <code class="filename">/etc/group</code> information also. That is where the multiple group information
1094 is most closely at your fingertips.
1095 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2573838"></a><a name="id2573840"></a><b></b></td><td align="left" valign="top"><p>
1096 How can I reset group membership after loading the account information into the LDAP database?
1097 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573851"></a>
1098 You can use the NT4 Domain User Manager that can be downloaded from the Microsoft Web site. The
1099 installation file is called <code class="filename">SRVTOOLS.EXE</code>.
1100 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2573872"></a><a name="id2573874"></a><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573877"></a>
1101 What are the limits or constraints that apply to group names?
1102 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573893"></a><a class="indexterm" name="id2573901"></a><a class="indexterm" name="id2573909"></a><a class="indexterm" name="id2573917"></a><a class="indexterm" name="id2573924"></a><a class="indexterm" name="id2573932"></a>
1103 A Windows 200x group name can be up to 254 characters long, while in Windows NT4 the group
1104 name is limited to 20 characters. Most UNIX systems limit this to 32 characters. Windows
1105 groups can contain upper- and lowercase characters, as well as spaces.
1106 Many UNIX system do not permit the use of uppercase characters, and some do not permit the
1107 space character either. A number of systems (i.e., Linux) work fine with both uppercase
1108 and space characters in group names, but the shadow-utils package that provides the group
1109 control functions (<span><strong class="command">groupadd</strong></span>, <span><strong class="command">groupmod</strong></span>, <span><strong class="command">groupdel</strong></span>, and so on) do not permit them.
1110 Also, a number of UNIX systems management tools enforce their own particular interpretation
1111 of the POSIX standards and likewise do not permit uppercase or space characters in group
1112 or user account names. You have to experiment with your system to find what its
1114 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2573977"></a><a name="id2573979"></a><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573982"></a>
1115 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3
1116 LDAP backend system using the vampire process?
1117 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>
1118 UNIX UIDs and GIDs on most UNIX systems use an unsigned short or an unsigned integer. Recent Linux
1119 kernels support at least a much larger number. On systems that have a 16-bit constraint on UID/GIDs,
1120 you would not be able to migrate 323,000 accounts because this number cannot fit into a 16-bit unsigned
1121 integer. UNIX/Linux systems that have a 32-bit UID/GID can easily handle this number of accounts.
1122 Please check this carefully before you attempt to effect a migration using the vampire process.
1123 </p><p><a class="indexterm" name="id2574011"></a>
1124 Migration speed depends much on the processor speed, the network speed, disk I/O capability, and
1125 LDAP update overheads. On a dual processor AMD MP1600+ with 1 GB memory that was mirroring LDAP
1126 to a second identical system over 1 Gb Ethernet, I was able to migrate around 180 user accounts
1127 per minute. Migration would obviously go much faster if LDAP mirroring were turned off during the migration.
1128 </p></td></tr></tbody></table></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="upgrades.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="DMSMig.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="nw4migration.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 8. Updating Samba-3 </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 10. Migrating NetWare Server to Samba-3</td></tr></table></div></body></html>
projects / samba / blob