1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�9.�Migrating NT4 Domain to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part�II.�Domain Members, Updating Samba and Migration"><link rel="prev" href="upgrades.html" title="Chapter�8.�Updating Samba-3"><link rel="next" href="nw4migration.html" title="Chapter�10.�Migrating NetWare Server to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�9.�Migrating NT4 Domain to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrades.html">Prev</a>�</td><th width="60%" align="center">Part�II.�Domain Members, Updating Samba and Migration</th><td width="20%" align="right">�<a accesskey="n" href="nw4migration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ntmigration"></a>Chapter�9.�Migrating NT4 Domain to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ntmigration.html#id2601332">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2601417">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2601472">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2601658">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2601981">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2602007">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2604606">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2605013">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2605051">Questions and Answers</a></span></dt></dl></div><p> 2 Ever since Microsoft announced that it was discontinuing support for Windows 3 NT4, Samba users started to ask for detailed instructions on how to migrate 4 from NT4 to Samba-3. This chapter provides background information that should 5 meet these needs. 6 </p><p> 7 One wonders how many NT4 systems will be left in service by the time you read this 8 book though. 9 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2601332"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id2601338"></a> 10 Network administrators who want to migrate off a Windows NT4 environment know 11 one thing with certainty. They feel that NT4 has been abandoned, and they want 12 to update. The desire to get off NT4 and to not adopt Windows 200x and Active 13 Directory is driven by a mixture of concerns over complexity, cost, fear of 14 failure, and much more. 15 </p><p> 16 <a class="indexterm" name="id2601356"></a> 17 <a class="indexterm" name="id2601363"></a> 18 <a class="indexterm" name="id2601373"></a> 19 <a class="indexterm" name="id2601382"></a> 20 The migration from NT4 to Samba-3 can involve a number of factors, including 21 migration of data to another server, migration of network environment controls 22 such as group policies, and migration of the users, groups, and machine 23 accounts. 24 </p><p> 25 <a class="indexterm" name="id2601398"></a> 26 It should be pointed out now that it is possible to migrate some systems from 27 a Windows NT4 domain environment to a Samba-3 domain environment. This is certainly 28 not possible in every case. It is possible to just migrate the domain accounts 29 to Samba-3 and then to switch machines, but as a hands-off transition, this is more 30 the exception than the rule. Most systems require some tweaking after 31 migration before an environment that is acceptable for immediate use 32 is obtained. 33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2601417"></a>Assignment Tasks</h3></div></div></div><p> 34 <a class="indexterm" name="id2601425"></a> 35 <a class="indexterm" name="id2601432"></a> 36 <a class="indexterm" name="id2601438"></a> 37 You are about to migrate an MS Windows NT4 domain accounts database to 38 a Samba-3 server. The Samba-3 server is using a 39 <em class="parameter"><code>passdb backend</code></em> based on LDAP. The 40 <code class="constant">ldapsam</code> is ideal because an LDAP backend can be distributed 41 for use with BDCs generally essential for larger networks. 42 </p><p> 43 Your objective is to document the process of migrating user and group accounts 44 from several NT4 domains into a single Samba-3 LDAP backend database. 45 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2601472"></a>Dissection and Discussion</h2></div></div></div><p> 46 <a class="indexterm" name="id2601479"></a> 47 <a class="indexterm" name="id2601486"></a> 48 <a class="indexterm" name="id2601493"></a> 49 <a class="indexterm" name="id2601504"></a> 50 <a class="indexterm" name="id2601516"></a> 51 <a class="indexterm" name="id2601522"></a> 52 The migration process takes a snapshot of information that is stored in the 53 Windows NT4 registry-based accounts database. That information resides in 54 the Security Account Manager (SAM) portion of the NT4 registry under keys called 55 <code class="constant">SAM</code> and <code class="constant">SECURITY</code>. 56 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 57 <a class="indexterm" name="id2601547"></a> 58 <a class="indexterm" name="id2601554"></a> 59 The Windows NT4 registry keys called <code class="constant">SAM</code> and <code class="constant">SECURITY</code> 60 are protected so that you cannot view the contents. If you change the security setting 61 to reveal the contents under these hive keys, your Windows NT4 domain is crippled. Do not 62 do this unless you are willing to render your domain controller inoperative. 63 </p></div><p> 64 <a class="indexterm" name="id2601576"></a> 65 <a class="indexterm" name="id2601585"></a> 66 Before commencing an NT4 to Samba-3 migration, you should consider what your objectives are. 67 While in some cases it is possible simply to migrate an NT4 domain to a single Samba-3 server, 68 that may not be a good idea from an administration perspective. Since the process involves going 69 through a certain amount of disruptive activity anyhow, why not take this opportunity to 70 review the structure of the network, how Windows clients are controlled and how they 71 interact with the network environment. 72 </p><p> 73 <a class="indexterm" name="id2601604"></a> 74 <a class="indexterm" name="id2601613"></a> 75 <a class="indexterm" name="id2601620"></a> 76 MS Windows NT4 was introduced some time around 1996. Many environments in which NT4 was deployed 77 have done little to keep the NT4 server environment up to date with more recent Windows releases, 78 particularly Windows XP Professional. The migration provides opportunity to revise and update 79 roaming profile deployment as well as folder redirection. Given that you must port the 80 greater network configuration of this from the old NT4 server to the new Samba-3 server. 81 Do not forget to validate the security descriptors in the profiles share as well as network logon 82 scripts. Feedback from sites that are migrating to Samba-3 suggests that many are using this 83 as a good time to update desktop systems also. In all, the extra effort should constitute no 84 real disruption to users, but rather, with due diligence and care, should make their network experience 85 a much happier one. 86 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2601658"></a>Technical Issues</h3></div></div></div><p> 87 <a class="indexterm" name="id2601666"></a> 88 <a class="indexterm" name="id2601672"></a> 89 Migration of an NT4 domain user and group database to Samba-3 involves a certain strategic 90 element. Many sites have asked for instructions regarding merging of multiple NT4 91 domains into one Samba-3 LDAP database. It seems that this is viewed as a significant 92 added value compared with the alternative of migration to Windows Server 200x and Active 93 Directory. The diagram in <a class="link" href="ntmigration.html#ch8-migration" title="Figure�9.1.�Schematic Explaining the net rpc vampire Process">“Schematic Explaining the net rpc vampire Process”</a> illustrates the effect of migration 94 from a Windows NT4 domain to a Samba domain. 95 </p><div class="figure"><a name="ch8-migration"></a><p class="title"><b>Figure�9.1.�Schematic Explaining the <code class="literal">net rpc vampire</code> Process</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch8-migration.png" width="297" alt="Schematic Explaining the net rpc vampire Process"></div></div></div><br class="figure-break"><p> 96 <a class="indexterm" name="id2601746"></a> 97 <a class="indexterm" name="id2601752"></a> 98 If you want to merge multiple NT4 domain account databases into one Samba domain, 99 you must now dump the contents of the first migration and edit it as appropriate. Now clean 100 out (remove) the tdbsam backend file (<code class="filename">passdb.tdb</code>) or the LDAP database 101 files. You must start each migration with a new database into which you merge your NT4 102 domains. 103 </p><p><a class="indexterm" name="id2601773"></a> 104 At this point, you are ready to perform the second migration, following the same steps as 105 for the first. In other words, dump the database, edit it, and then you may merge the 106 dump for the first and second migrations. 107 </p><p><a class="indexterm" name="id2601788"></a><a class="indexterm" name="id2601796"></a><a class="indexterm" name="id2601804"></a> 108 You must be careful. If you choose to migrate to an LDAP backend, your dump file 109 now contains the full account information, including the domain SID. The domain SID for each 110 of the two NT4 domains will be different. You must choose one and change the domain 111 portion of the account SIDs so that all are the same. 112 </p><p> 113 <a class="indexterm" name="id2601821"></a> 114 <a class="indexterm" name="id2601828"></a> 115 <a class="indexterm" name="id2601835"></a> 116 <a class="indexterm" name="id2601842"></a> 117 <a class="indexterm" name="id2601849"></a> 118 <a class="indexterm" name="id2601855"></a> 119 <a class="indexterm" name="id2601862"></a> 120 <a class="indexterm" name="id2601869"></a> 121 <a class="indexterm" name="id2601876"></a> 122 <a class="indexterm" name="id2601883"></a> 123 <a class="indexterm" name="id2601890"></a> 124 <a class="indexterm" name="id2601897"></a> 125 If you choose to use a tdbsam (<code class="filename">passdb.tdb</code>) backend file, your best choice 126 is to use <code class="literal">pdbedit</code> to export the contents of the tdbsam file into an 127 smbpasswd data file. This automatically strips out all domain-specific information, 128 such as logon hours, logon machines, logon script, profile path, as well as the domain SID. 129 The resulting file can be easily merged with other migration attempts (each of which must start 130 with a clean file). It should also be noted that all users who end up in the merged smbpasswd 131 file must have an account in <code class="filename">/etc/passwd</code>. The resulting smbpasswd file 132 may be exported or imported into either a tdbsam (<code class="filename">passdb.tdb</code>) or 133 an LDAP backend. 134 </p><div class="figure"><a name="NT4DUM"></a><p class="title"><b>Figure�9.2.�View of Accounts in NT4 Domain User Manager</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UserMgrNT4.png" width="270" alt="View of Accounts in NT4 Domain User Manager"></div></div></div><br class="figure-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2601981"></a>Political Issues</h3></div></div></div><p> 135 The merging of multiple Windows NT4-style domains into a single LDAP-backend-based Samba-3 136 domain may be seen by those who had power over them as a loss of prestige or a loss of 137 power. The imposition of a single domain may even be seen as a threat. So in migrating and 138 merging account databases, be consciously aware of the political fall-out in which you 139 may find yourself entangled when key staff feel a loss of prestige. 140 </p><p> 141 The best advice that can be given to those who set out to merge NT4 domains into a single 142 Samba-3 domain is to promote (sell) the action as one that reduces costs and delivers 143 greater network interoperability and manageability. 144 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2602007"></a>Implementation</h2></div></div></div><p> 145 From feedback on the Samba mailing lists, it seems that most Windows NT4 migrations 146 to Samba-3 are being performed using a new server or a new installation of a Linux or UNIX 147 server. If you contemplate doing this, please note that the steps that follow in this 148 chapter assume familiarity with the information that has been previously covered in this 149 book. You are particularly encouraged to be familiar with <a class="link" href="secure.html" title="Chapter�3.�Secure Office Networking">“Secure Office Networking”</a>, 150 <a class="link" href="Big500users.html" title="Chapter�4.�The 500-User Office">“The 500-User Office”</a> and <a class="link" href="happy.html" title="Chapter�5.�Making Happy Users">“Making Happy Users”</a>. 151 </p><p> 152 We present here the steps and example output for two NT4 to Samba-3 domain migrations. The 153 first uses an LDAP-based backend, and the second uses a tdbsam backend. In each case the 154 scripts you specify in the <code class="filename">smb.conf</code> file for the <em class="parameter"><code>add user script</code></em> 155 collection of parameters are used to effect the addition of accounts into the passdb backend. 156 </p><p> 157 Before proceeding to NT4 migration using either a tdbsam or ldapsam, it is most strongly recommended to 158 review <a class="link" href="Big500users.html#ch5-dnshcp-setup" title="Installation of DHCP, DNS, and Samba Control Files">“Installation of DHCP, DNS, and Samba Control Files”</a> for DNS and DHCP configuration. The importance of correctly 159 functioning name resolution must be recognized. This applies equally for both hostname and NetBIOS names 160 (machine names, computer names, domain names, workgroup names ALL names!). 161 </p><p> 162 The migration process involves the following steps: 163 </p><div class="itemizedlist"><ul type="disc"><li><p> 164 Prepare the target Samba-3 server. This involves configuring Samba-3 for 165 migration to either a tdbsam or an ldapsam backend. 166 </p></li><li><p> 167 <a class="indexterm" name="id2602094"></a> 168 <a class="indexterm" name="id2602100"></a> 169 <a class="indexterm" name="id2602107"></a> 170 Clean up the source NT4 PDC. Delete all accounts that need not be migrated. 171 Delete all files that should not be migrated. Where possible, change NT group 172 names so there are no spaces or uppercase characters. This is important if 173 the target UNIX host insists on POSIX-compliant all lowercase user and group 174 names. 175 </p></li><li><p> 176 Step through the migration process. 177 </p></li><li><p><a class="indexterm" name="id2602128"></a> 178 Remove the NT4 PDC from the network. 179 </p></li><li><p> 180 Upgrade the Samba-3 server from a BDC to a PDC, and validate all account 181 information. 182 </p></li></ul></div><p> 183 It may help to use the above outline as a pre-migration checklist. 184 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2602148"></a>NT4 Migration Using LDAP Backend</h3></div></div></div><p> 185 In this example, the migration is of an NT4 PDC to a Samba-3 PDC with an LDAP backend. The accounts about 186 to be migrated are shown in <a class="link" href="ntmigration.html#NT4DUM" title="Figure�9.2.�View of Accounts in NT4 Domain User Manager">“View of Accounts in NT4 Domain User Manager”</a>. In this example use is made of the 187 smbldap-tools scripts to add the accounts that are migrated into the ldapsam passdb backend. 188 Four scripts are essential to the migration process. Other scripts will be required 189 for daily management, but these are not critical to migration. The critical scripts are dependant 190 on which passdb backend is being used. Refer to <a class="link" href="ntmigration.html#ch8-vampire" title="Table�9.1.�Samba smb.conf Scripts Essential to Samba Operation">“Samba smb.conf Scripts Essential to Samba Operation”</a> to see which scripts 191 must be provided so that the migration process can complete. 192 </p><p> 193 Verify that you have correctly specified in the <code class="filename">smb.conf</code> file the scripts and arguments 194 that should be passed to them before attempting to perform the account migration. Note also 195 that the deletion scripts must be commented out during migration. These should be uncommented 196 following successful migration of the NT4 Domain accounts. 197 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 198 Under absolutely no circumstances should the Samba daemons be started until instructed to do so. 199 Delete the <code class="filename">/etc/samba/secrets.tdb</code> file and all Samba control tdb files 200 before commencing the following configuration steps. 201 </p></div><div class="table"><a name="ch8-vampire"></a><p class="title"><b>Table�9.1.�Samba <code class="filename">smb.conf</code> Scripts Essential to Samba Operation</b></p><div class="table-contents"><table summary="Samba smb.conf Scripts Essential to Samba Operation" border="1"><colgroup><col align="left"><col align="center"><col align="center"></colgroup><thead><tr><th align="left">Entity</th><th align="center">ldapsam Script</th><th align="center">tdbsam Script</th></tr></thead><tbody><tr><td align="left">Add User Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr><tr><td align="left">Delete User Accounts</td><td align="center">smbldap-userdel</td><td align="center">userdel</td></tr><tr><td align="left">Add Group Accounts</td><td align="center">smbldap-groupadd</td><td align="center">groupadd</td></tr><tr><td align="left">Delete Group Accounts</td><td align="center">smbldap-groupdel</td><td align="center">groupdel</td></tr><tr><td align="left">Add User to Group</td><td align="center">smbldap-groupmod</td><td align="center">usermod (See Note)</td></tr><tr><td align="left">Add Machine Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr></tbody></table></div></div><br class="table-break"><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 202 <a class="indexterm" name="id2602350"></a> 203 <a class="indexterm" name="id2602357"></a> 204 <a class="indexterm" name="id2602364"></a> 205 The UNIX/Linux <code class="literal">usermod</code> utility does not permit simple user addition to (or deletion 206 of users from) groups. This is a feature provided by the smbldap-tools scripts. If you want this 207 capability, you must create your own tool to do this. Alternately, you can search the Web 208 to locate a utility called <code class="literal">groupmem</code> (by George Kraft) that provides this functionality. 209 The <code class="literal">groupmem</code> utility was contributed to the shadow package but has not surfaced 210 in the formal commands provided by Linux distributions (March 2004). 211 </p></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 212 <a class="indexterm" name="id2602401"></a> 213 The <code class="literal">tdbdump</code> utility is a utility that you can build from the Samba source-code tree. Not all Linux binary distributions include this tool. If it is missing from your 214 Linux distribution, you will need to build this yourself or else forgo its use. 215 </p></div><p> 216 <a class="indexterm" name="id2602421"></a> 217 Before starting the migration, all dead accounts were removed from the NT4 domain using the User Manager for Domains. 218 </p><div class="procedure"><a name="id2602431"></a><p class="title"><b>Procedure�9.1.�User Migration Steps</b></p><div class="example"><a name="sbent4smb"></a><p class="title"><b>Example�9.1.�NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2602491"></a><em class="parameter"><code>workgroup = DAMNATION</code></em></td></tr><tr><td><a class="indexterm" name="id2602503"></a><em class="parameter"><code>netbios name = MERLIN</code></em></td></tr><tr><td><a class="indexterm" name="id2602515"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2602527"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2602539"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2602550"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2602562"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2602574"></a><em class="parameter"><code>smb ports = 139 445</code></em></td></tr><tr><td><a class="indexterm" name="id2602585"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2602598"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2602610"></a><em class="parameter"><code>#delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2602622"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2602635"></a><em class="parameter"><code>#delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2602647"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/ smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2602660"></a><em class="parameter"><code>#delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2602673"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2602686"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2602699"></a><em class="parameter"><code>logon script = scripts\logon.cmd</code></em></td></tr><tr><td><a class="indexterm" name="id2602711"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2602722"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2602734"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2602746"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2602758"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2602769"></a><em class="parameter"><code>#wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2602781"></a><em class="parameter"><code>wins server = 192.168.123.124</code></em></td></tr><tr><td><a class="indexterm" name="id2602793"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2602805"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2602817"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2602829"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2602841"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2602853"></a><em class="parameter"><code>ldap suffix = dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2602865"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2602877"></a><em class="parameter"><code>ldap timeout = 20</code></em></td></tr><tr><td><a class="indexterm" name="id2602888"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2602900"></a><em class="parameter"><code>idmap backend = ldap:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2602912"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2602924"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2602936"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2602948"></a><em class="parameter"><code>ea support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2602960"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbent4smb2"></a><p class="title"><b>Example�9.2.�NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2603005"></a><em class="parameter"><code>comment = Application Data</code></em></td></tr><tr><td><a class="indexterm" name="id2603017"></a><em class="parameter"><code>path = /data/home/apps</code></em></td></tr><tr><td><a class="indexterm" name="id2603028"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2603049"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2603061"></a><em class="parameter"><code>path = /home/users/%U/Documents</code></em></td></tr><tr><td><a class="indexterm" name="id2603072"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2603084"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2603096"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2603116"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2603128"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2603140"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2603151"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2603163"></a><em class="parameter"><code>use client driver = No</code></em></td></tr><tr><td><a class="indexterm" name="id2603175"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2603195"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2603207"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2603219"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2603231"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2603251"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2603263"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2603275"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2603286"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id2603307"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id2603319"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id2603331"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2603342"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2603363"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2603375"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbentslapd"></a><p class="title"><b>Example�9.3.�NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</b></p><div class="example-contents"><pre class="screen"> 219include /etc/openldap/schema/core.schema 220include /etc/openldap/schema/cosine.schema 221include /etc/openldap/schema/inetorgperson.schema 222include /etc/openldap/schema/nis.schema 223include /etc/openldap/schema/samba3.schema 224 225pidfile /var/run/slapd/slapd.pid 226argsfile /var/run/slapd/slapd.args 227 228access to dn.base="" 229 by self write 230 by * auth 231 232access to attr=userPassword 233 by self write 234 by * auth 235 236access to attr=shadowLastChange 237 by self write 238 by * read 239 240access to * 241 by * read 242 by anonymous auth 243</pre></div></div><br class="example-break"><div class="example"><a name="sbentslapd2"></a><p class="title"><b>Example�9.4.�NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part B</b></p><div class="example-contents"><pre class="screen"> 244#loglevel 256 245 246#schemacheck on 247idletimeout 30 248#backend bdb 249database bdb 250checkpoint 1024 5 251cachesize 10000 252 253suffix "dc=terpstra-world,dc=org" 254rootdn "cn=Manager,dc=terpstra-world,dc=org" 255 256# rootpw = not24get 257rootpw {SSHA}86kTavd9Dw3FAz6qzWTrCOKX/c0Qe+UV 258 259directory /var/lib/ldap 260 261# Indices to maintain 262index objectClass eq 263index cn pres,sub,eq 264index sn pres,sub,eq 265index uid pres,sub,eq 266index displayName pres,sub,eq 267index uidNumber eq 268index gidNumber eq 269index memberUID eq 270index sambaSID eq 271index sambaPrimaryGroupSID eq 272index sambaDomainName eq 273index default sub 274</pre></div></div><br class="example-break"><div class="example"><a name="sbrntldapconf"></a><p class="title"><b>Example�9.5.�NT4 Migration NSS LDAP File: <code class="filename">/etc/ldap.conf</code></b></p><div class="example-contents"><pre class="screen"> 275host 127.0.0.1 276 277base dc=terpstra-world,dc=org 278 279ldap_version 3 280 281binddn cn=Manager,dc=terpstra-world,dc=org 282bindpw not24get 283 284pam_password exop 285 286nss_base_passwd ou=People,dc=terpstra-world,dc=org?one 287nss_base_shadow ou=People,dc=terpstra-world,dc=org?one 288nss_base_group ou=Groups,dc=terpstra-world,dc=org?one 289 290ssl off 291</pre></div></div><br class="example-break"><div class="example"><a name="sbentnss"></a><p class="title"><b>Example�9.6.�NT4 Migration NSS Control File: <code class="filename">/etc/nsswitch.conf</code> (Stage:1)</b></p><div class="example-contents"><pre class="screen"> 292passwd: files #ldap 293shadow: files #ldap 294group: files #ldap 295 296hosts: files dns wins 297networks: files dns 298 299services: files 300protocols: files 301rpc: files 302ethers: files 303netmasks: files 304netgroup: files 305publickey: files 306 307bootparams: files 308automount: files nis 309aliases: files 310#passwd_compat: ldap #Not needed. 311#group_compat: ldap #Not needed. 312</pre></div></div><br class="example-break"><div class="example"><a name="sbentnss2"></a><p class="title"><b>Example�9.7.�NT4 Migration NSS Control File: <code class="filename">/etc/nsswitch.conf</code> (Stage:2)</b></p><div class="example-contents"><pre class="screen"> 313passwd: files ldap 314shadow: files ldap 315group: files ldap 316 317hosts: files dns wins 318networks: files dns 319 320services: files 321protocols: files 322rpc: files 323ethers: files 324netmasks: files 325netgroup: files 326publickey: files 327 328bootparams: files 329automount: files nis 330aliases: files 331#passwd_compat: ldap #Not needed. 332#group_compat: ldap #Not needed. 333</pre></div></div><br class="example-break"><ol type="1"><li><p> 334 Configure the Samba <code class="filename">smb.conf</code> file to create a BDC. An example configuration is 335 given in <a class="link" href="ntmigration.html#sbent4smb" title="Example�9.1.�NT4 Migration Samba-3 Server smb.conf Part: A">“NT4 Migration Samba-3 Server smb.conf Part: A”</a>. 336 The delete scripts are commented out so that during the process of migration 337 no account information can be deleted. 338 </p></li><li><p> 339 <a class="indexterm" name="id2603393"></a> 340 Configure OpenLDAP in preparation for the migration. An example 341 <code class="filename">sladp.conf</code> file is shown in <a class="link" href="ntmigration.html#sbentslapd" title="Example�9.3.�NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A">“NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A”</a>. 342 The <code class="constant">rootpw</code> value is an encrypted password string that can 343 be obtained by executing the <code class="literal">slappasswd</code> command. 344 </p></li><li><p> 345 <a class="indexterm" name="id2603507"></a> 346 <a class="indexterm" name="id2603514"></a> 347 Install the PADL <code class="literal">nss_ldap</code> tool set, then configure the <code class="filename">/etc/ldap.conf</code> 348 as shown in <a class="link" href="ntmigration.html#sbrntldapconf" title="Example�9.5.�NT4 Migration NSS LDAP File: /etc/ldap.conf">“NT4 Migration NSS LDAP File: /etc/ldap.conf”</a>. 349 </p></li><li><p> 350 <a class="indexterm" name="id2603574"></a> 351 Edit the <code class="filename">/etc/nsswitch.conf</code> file so it has the entries shown 352 in <a class="link" href="ntmigration.html#sbentnss" title="Example�9.6.�NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)">“NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)”</a>. Note that the LDAP entries have been commented out. 353 This is deliberate. If these entries are active (not commented out), and the 354 <code class="filename">/etc/ldap.conf</code> file has been configured, when the LDAP server 355 is started, the process of starting the LDAP server will cause LDAP lookups. This 356 causes the LDAP server <code class="literal">slapd</code> to hang because it finds port 389 357 open and therefore cannot gain exclusive control of it. By commenting these entries 358 out, it is possible to avoid this gridlock situation and thus the overall 359 installation and configuration will progress more smoothly. 360 </p></li><li><p> 361 Validate the the target NT4 PDC name is being correctly resolved to its IP address by 362 executing the following: 363</p><pre class="screen"> 364<code class="prompt">root# </code> ping transgression 365PING transgression.terpstra-world.org (192.168.1.5) 56(84) bytes of data. 36664 bytes from (192.168.1.5): icmp_seq=1 ttl=128 time=0.159 ms 36764 bytes from (192.168.1.5): icmp_seq=2 ttl=128 time=0.192 ms 36864 bytes from (192.168.1.5): icmp_seq=3 ttl=128 time=0.141 ms 369 370--- transgression.terpstra-world.org ping statistics --- 3713 packets transmitted, 3 received, 0% packet loss, time 2000ms 372rtt min/avg/max/mdev = 0.141/0.164/0.192/0.021 ms 373</pre><p> 374 Do not proceed to the next step if this step fails. It is imperative that the name of the PDC 375 can be resolved to its IP address. If this is broken, fix it. 376 </p></li><li><p> 377 Pull the domain SID from the NT4 domain that is being migrated as follows: 378</p><pre class="screen"> 379<code class="prompt">root# </code> net rpc getsid -S TRANGRESSION -U Administrator%not24get 380Storing SID S-1-5-21-1385457007-882775198-1210191635 \ 381 for Domain DAMNATION in secrets.tdb 382</pre><p> 383 </p><p> 384 Another way to obtain the domain SID from the target NT4 domain that is being 385 migrated to Samba-3 is by executing the following: 386</p><pre class="screen"> 387<code class="prompt">root# </code> net rpc info -S TRANSGRESSION 388</pre><p> 389 If this method is used, do not forget to store the SID obtained into the 390 <code class="filename">secrets.tdb</code> file. This can be done by executing: 391</p><pre class="screen"> 392<code class="prompt">root# </code> net setlocalsid S-1-5-21-1385457007-882775198-1210191635 393</pre><p> 394 </p></li><li><p> 395 <a class="indexterm" name="id2603744"></a> 396 <a class="indexterm" name="id2603750"></a> 397 <a class="indexterm" name="id2603757"></a> 398 <a class="indexterm" name="id2603764"></a> 399 Install the Idealx <code class="literal">smbldap-tools</code> software package, following 400 the instructions given in <a class="link" href="happy.html#sbeidealx" title="Install and Configure Idealx smbldap-tools Scripts">“Install and Configure Idealx smbldap-tools Scripts”</a>. The resulting perl scripts 401 should be located in the <code class="filename">/opt/IDEALX/sbin</code> directory. 402 Change into that location, or wherever the scripts have been installed. Execute the 403 <code class="filename">configure.pl</code> script to configure the Idealx package for use. 404 Note: Use the domain SID obtained from the step above. The following is 405 an example configuration session: 406</p><pre class="screen"> 407<code class="prompt">root# </code> ./configure.pl 408-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 409 smbldap-tools script configuration 410 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 411Before starting, check 412 . if your samba controller is up and running. 413 . if the domain SID is defined 414 (you can get it with the 'net getlocalsid') 415 416 . you can leave the configuration using the Crtl-c key combination 417 . empty value can be set with the "." character 418-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 419Looking for configuration files... 420 421Samba Config File Location [/etc/samba/smb.conf] > 422smbldap Config file Location (global parameters) 423 [/etc/smbldap-tools/smbldap.conf] > 424smbldap Config file Location (bind parameters) 425 [/etc/smbldap-tools/smbldap_bind.conf] > 426-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 427Let's start configuring the smbldap-tools scripts ... 428 429. workgroup name: name of the domain Samba act as a PDC 430 workgroup name [DAMNATION] > 431. netbios name: netbios name of the samba controller 432 netbios name [MERLIN] > 433. logon drive: local path to which the home directory 434 will be connected (for NT Workstations). Ex: 'H:' 435 logon drive [X:] > H: 436. logon home: home directory location (for Win95/98 or NT Workstation) 437 (use %U as username) Ex:'\\MERLIN\home\%U' 438 logon home (leave blank if you don't want homeDirectory) 439 [\\MERLIN\home\%U] > \\%L\%U 440. logon path: directory where roaming profiles are stored. 441 Ex:'\\MERLIN\profiles\%U' 442 logon path (leave blank if you don't want roaming profile) 443 [\\MERLIN\profiles\%U] > \\%L\profiles\%U 444. home directory prefix (use %U as username) [/home/%U] > 445 /home/users/%U 446. default user netlogon script (use %U as username) 447 [%U.cmd] > scripts\logon.cmd 448 default password validation time (time in days) [45] > 180 449. ldap suffix [dc=terpstra-world,dc=org] > 450. ldap group suffix [ou=Groups] > 451. ldap user suffix [ou=People] > 452. ldap machine suffix [ou=People] > 453. Idmap suffix [ou=Idmap] > 454. sambaUnixIdPooldn: object where you want to store the next uidNumber 455 and gidNumber available for new users and groups 456 sambaUnixIdPooldn object (relative to ${suffix}) 457 [sambaDomainName=DAMNATION] > 458. ldap master server: 459 IP address or DNS name of the master (writable) ldap server 460 ldap master server [] > 127.0.0.1 461. ldap master port [389] > 462. ldap master bind dn [cn=Manager,dc=terpstra-world,dc=org] > 463. ldap master bind password [] > 464. ldap slave server: IP address or DNS name of the slave ldap server: 465 can also be the master one 466 ldap slave server [] > 127.0.0.1 467. ldap slave port [389] > 468. ldap slave bind dn [cn=Manager,dc=terpstra-world,dc=org] > 469. ldap slave bind password [] > 470. ldap tls support (1/0) [0] > 471. SID for domain DAMNATION: SID of the domain 472 (can be obtained with 'net getlocalsid MERLIN') 473 SID for domain DAMNATION [] 474 > S-1-5-21-1385457007-882775198-1210191635 475. unix password encryption: encryption used for unix passwords 476unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA) [SSHA] > MD5 477. default user gidNumber [513] > 478. default computer gidNumber [515] > 479. default login shell [/bin/bash] > 480. default domain name to append to mail address [] > 481 terpstra-world.org 482-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 483backup old configuration files: 484 /etc/smbldap-tools/smbldap.conf-> 485 /etc/smbldap-tools/smbldap.conf.old 486 /etc/smbldap-tools/smbldap_bind.conf-> 487 /etc/smbldap-tools/smbldap_bind.conf.old 488writing new configuration file: 489 /etc/smbldap-tools/smbldap.conf done. 490 /etc/smbldap-tools/smbldap_bind.conf done. 491</pre><p> 492 <a class="indexterm" name="id2603914"></a> 493 <a class="indexterm" name="id2603921"></a> 494 <a class="indexterm" name="id2603928"></a> 495 <a class="indexterm" name="id2603935"></a> 496 Note that the NT4 domain SID that was previously obtained was entered above. Also, 497 the sambaUnixIdPooldn object was specified as sambaDomainName=DAMNATION. This is 498 the location into which the Idealx smbldap-tools store the next available UID/GID 499 information. It is also where Samba stores domain specific information such as the 500 next RID, the SID, and so on. In older version of the smbldap-tools this information 501 was stored in the sambaUnixIdPooldn DIT location cn=NextFreeUnixId. Where smbldap-tools 502 are being upgraded to version 0.9.1 it is appropriate to update this to the new location 503 only if the directory information is also relocated. 504 </p></li><li><p> 505 Start the LDAP server using the system interface script. On Novell SLES9 506 this is done as shown here: 507</p><pre class="screen"> 508<code class="prompt">root# </code> rcldap start 509</pre><p> 510 </p></li><li><p> 511 Edit the <code class="filename">/etc/nsswitch.conf</code> file so it has the entries shown in 512 <a class="link" href="ntmigration.html#sbentnss2" title="Example�9.7.�NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:2)">“NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:2)”</a>. Note that the LDAP entries have now been uncommented. 513 </p></li><li><p> 514 The LDAP management password must be installed into the <code class="filename">secrets.tdb</code> 515 file as follows: 516</p><pre class="screen"> 517<code class="prompt">root# </code> smbpasswd -w not24get 518Setting stored password for 519 "cn=Manager,dc=terpstra-world,dc=org" in secrets.tdb 520</pre><p> 521 </p></li><li><p> 522 Populate the LDAP directory as shown here: 523</p><pre class="screen"> 524<code class="prompt">root# </code> /opt/IDEALX/sbin/smbldap-populate -a root -k 0 -m 0 525Using workgroup name from sambaUnixIdPooldn (smbldap.conf): 526 sambaDomainName=DAMNATION 527Using builtin directory structure 528adding new entry: dc=terpstra-world,dc=org 529adding new entry: ou=People,dc=terpstra-world,dc=org 530adding new entry: ou=Groups,dc=terpstra-world,dc=org 531entry ou=People,dc=terpstra-world,dc=org already exist. 532adding new entry: ou=Idmap,dc=terpstra-world,dc=org 533adding new entry: sambaDomainName=DAMNATION,dc=terpstra-world,dc=org 534adding new entry: uid=root,ou=People,dc=terpstra-world,dc=org 535adding new entry: uid=nobody,ou=People,dc=terpstra-world,dc=org 536adding new entry: cn=Domain Admins,ou=Groups,dc=terpstra-world,dc=org 537adding new entry: cn=Domain Users,ou=Groups,dc=terpstra-world,dc=org 538adding new entry: cn=Domain Guests,ou=Groups,dc=terpstra-world,dc=org 539adding new entry: cn=Domain Computers,ou=Groups,dc=terpstra-world,dc=org 540adding new entry: cn=Administrators,ou=Groups,dc=terpstra-world,dc=org 541adding new entry: cn=Print Operators,ou=Groups,dc=terpstra-world,dc=org 542adding new entry: cn=Backup Operators,ou=Groups,dc=terpstra-world,dc=org 543adding new entry: cn=Replicators,ou=Groups,dc=terpstra-world,dc=org 544</pre><p> 545 The script tries to add the ou=People container twice, hence the error message. 546 This is expected behavior. 547 </p></li><li><p> 548 <a class="indexterm" name="id2604099"></a> 549 Restart the LDAP server following initialization of the LDAP directory. Execute the 550 system control script provided on your system. The following steps can be used on 551 Novell SUSE SLES 9: 552</p><pre class="screen"> 553<code class="prompt">root# </code> rcldap restart 554<code class="prompt">root# </code> chkconfig ldap on 555</pre><p> 556 </p></li><li><p> 557 Verify that the new user accounts that have been added to the LDAP directory can be 558 resolved as follows: 559</p><pre class="screen"> 560<code class="prompt">root# </code> getent passwd 561... 562nobody:x:65534:65533:nobody:/var/lib/nobody:/bin/bash 563man:x:13:62:Manual pages viewer:/var/cache/man:/bin/bash 564news:x:9:13:News system:/etc/news:/bin/bash 565uucp:x:10:14:Unix-to-Unix CoPy system:/etc/uucp:/bin/bash 566+::0:0::: 567root:x:0:0:Netbios Domain Administrator:/home/users/root:/bin/false 568nobody:x:999:514:nobody:/dev/null:/bin/false 569</pre><p> 570 Now repeat this for the group accounts as shown here: 571</p><pre class="screen"> 572<code class="prompt">root# </code> getent group 573... 574nobody:x:65533: 575nogroup:x:65534:nobody 576users:x:100: 577+::0: 578Domain Admins:x:512:root 579Domain Users:x:513: 580Domain Guests:x:514: 581Domain Computers:x:515: 582Administrators:x:544: 583Print Operators:x:550: 584Backup Operators:x:551: 585Replicators:x:552: 586</pre><p> 587 In both cases the LDAP accounts follow the “<span class="quote">+::0:</span>” entry. 588 </p></li><li><p> 589 Now it is time to join the Samba BDC to the target NT4 domain that is being 590 migrated to Samba-3 by executing the following: 591</p><pre class="screen"> 592<code class="prompt">root# </code> net rpc join -S TRANSGRESSION -U Administrator%not24get 593merlin:/opt/IDEALX/sbin # net rpc join -S TRANSGRESSION \ 594 -U Administrator%not24get 595Joined domain DAMNATION. 596</pre><p> 597 </p></li><li><p> 598 Set the new domain administrator (root) password for both UNIX and Windows as shown here: 599</p><pre class="screen"> 600<code class="prompt">root# </code> /opt/IDEALX/sbin/smbldap-passwd root 601Changing password for root 602New password : ******** 603Retype new password : ******** 604</pre><p> 605 Note: During account migration, the Windows Administrator account will not be migrated 606 to the Samba server. 607 </p></li><li><p> 608 Now validate that these accounts can be resolved using Samba's tools as 609 shown here for user accounts: 610</p><pre class="screen"> 611<code class="prompt">root# </code> pdbedit -Lw 612root:0:84B0D8E14D158FF8417EAF50CFAC29C3: 613 AF6DD3FD4E2EA8BDE1695A3F05EFBF52:[U ]:LCT-425F6467: 614nobody:65534:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX: 615 NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:[NU ]:LCT-00000000: 616</pre><p> 617 Now complete the following step to validate that group account mappings have 618 been correctly set: 619</p><pre class="screen"> 620<code class="prompt">root# </code> net groupmap list 621Domain Admins (S-1-5-21-1385457007-882775198-1210191635-512) 622 -> Domain Admins 623Domain Users (S-1-5-21-1385457007-882775198-1210191635-513) 624 -> Domain Users 625Domain Guests (S-1-5-21-1385457007-882775198-1210191635-514) 626 -> Domain Guests 627Domain Computers (S-1-5-21-1385457007-882775198-1210191635-515) 628 -> Domain Computers 629Administrators (S-1-5-32-544) -> Administrators 630Print Operators (S-1-5-32-550) -> Print Operators 631Backup Operators (S-1-5-32-551) -> Backup Operators 632Replicators (S-1-5-32-552) -> Replicators 633</pre><p> 634 These are the expected results for a correctly configured system. 635 </p></li><li><p> 636 Commence migration as shown here: 637</p><pre class="screen"> 638<code class="prompt">root# </code> net rpc vampire -S TRANSGRESSION \ 639 -U Administrator%not24get > /tmp/vampire.log 2>1 640</pre><p> 641 Check the vampire log to confirm that only expected errors have been 642 reported. See <a class="link" href="ntmigration.html#sbevam1" title="Migration Log Validation">“Migration Log Validation”</a>. 643 </p></li><li><p> 644 The migration of user accounts can be quickly validated as follows: 645</p><pre class="screen"> 646<code class="prompt">root# </code> pdbedit -Lw 647root:0:84B0D8E14D158FF8417EAF50CFAC29C3:... 648nobody:65534:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:... 649Administrator:0:84B0D8E14D158FF8417EAF50CFAC29C3:... 650Guest:1:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:... 651TRANSGRESSION$:2:CC044B748CEE294CE76B6B0D1B86C1A8:... 652IUSR_TRANSGRESSION:3:64046AC81B056C375F9537FC409085F8:... 653MIDEARTH$:4:E93186E5819706D2AAD3B435B51404EE:... 654atrickhoffer:5:DC08CFE0C12B2867352502E32A407F23:... 655barryf:6:B829BCDE01FF24376E45D5F10408CFBD:... 656fsellerby:7:6A97CBEBE8F9826B417EAF50CFAC29C3:... 657gdaison:8:48F6A8C8A900024351DA8C2061C5F1D3:... 658hrambotham:9:7330D9EA0964465EAAD3B435B51404EE:... 659jrhapsody:10:ACBA7D207E2BA35D9BD41A26B01626BD:... 660maryk:11:293B5A4CA41F6CA1A7D80430B8342B73:... 661jacko:12:8E8982D86BD037C364BBD09A598E07AD:... 662bridge:13:0D2CA7D2BE67FE2193BE3A377C968336:... 663sharpec:14:8841A75CAC19D2855D8B73B1F4D430F8:... 664jimbo:15:6E8BDC904FD9EC5C17306D272A9441BB:... 665dhenwick:16:D1694A03C33584BDAAD3B435B51404EE:... 666dork:17:69E2D19E69A593D5AAD3B435B51404EE:... 667blue:18:E355EBF9559979FEAAD3B435B51404EE:... 668billw:19:EE35C3481CF7F7DB484448BC86A641A5:... 669rfreshmill:20:7EC033B58661B60CAAD3B435B51404EE:... 670MAGGOT$:21:A3B9334765AD30F7AAD3B435B51404EE:... 671TRENTWARE$:22:1D92C8DD5E7F0DDF93BE3A377C968336:... 672MORTON$:23:89342E69DCA9D3F8AAD3B435B51404EE:... 673NARM$:24:2B93E2D1D25448BDAAD3B435B51404EE:... 674LAPDOG$:25:14AA535885120943AAD3B435B51404EE:... 675SCAVENGER$:26:B6288EB6D147B56F8963805A19B0ED49:... 676merlin$:27:820C50523F368C54AB9D85AE603AD09D:... 677</pre><p> 678 </p></li><li><p> 679 The mapping of UNIX and Windows groups can be validated as show here: 680</p><pre class="screen"> 681<code class="prompt">root# </code> net groupmap list 682Domain Admins (S-1-5-21-1385457007-882775198-1210191635-512) 683 -> Domain Admins 684Domain Users (S-1-5-21-1385457007-882775198-1210191635-513) 685 -> Domain Users 686Domain Guests (S-1-5-21-1385457007-882775198-1210191635-514) 687 -> Domain Guests 688Domain Computers (S-1-5-21-1385457007-882775198-1210191635-515) 689 -> Domain Computers 690Administrators (S-1-5-32-544) -> Administrators 691Print Operators (S-1-5-32-550) -> Print Operators 692Backup Operators (S-1-5-32-551) -> Backup Operators 693Replicator (S-1-5-32-552) -> Replicators 694Engineers (S-1-5-21-1385457007-882775198-1210191635-1020) -> Engineers 695Marketoids (S-1-5-21-1385457007-882775198-1210191635-1022) -> Marketoids 696Gnomes (S-1-5-21-1385457007-882775198-1210191635-1023) -> Gnomes 697Catalyst (S-1-5-21-1385457007-882775198-1210191635-1024) -> Catalyst 698Recieving (S-1-5-21-1385457007-882775198-1210191635-1025) -> Recieving 699Rubberboot (S-1-5-21-1385457007-882775198-1210191635-1026) -> Rubberboot 700Sales (S-1-5-21-1385457007-882775198-1210191635-1027) -> Sales 701Accounting (S-1-5-21-1385457007-882775198-1210191635-1028) -> Accounting 702Shipping (S-1-5-21-1385457007-882775198-1210191635-1029) -> Shipping 703Account Operators (S-1-5-32-548) -> Account Operators 704Guests (S-1-5-32-546) -> Guests 705Server Operators (S-1-5-32-549) -> Server Operators 706Users (S-1-5-32-545) -> Users 707</pre><p> 708 It is of vital importance that the domain SID portions of all group 709 accounts are identical. 710 </p></li><li><p> 711 The final responsibility in the migration process is to create identical 712 shares and printing resources on the new Samba-3 server, copy all data 713 across, set up privileges, and set share and file/directory access controls. 714 </p></li><li><p> 715 <a class="indexterm" name="id2604414"></a> 716 <a class="indexterm" name="id2604420"></a> 717 Edit the <code class="filename">smb.conf</code> file to reset the parameter 718 <a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = Yes</a> so that 719 the Samba server functions as a PDC for the purpose of migration. 720 Also, uncomment the deletion scripts so they will now be fully functional, 721 enable the <em class="parameter"><code>wins support = yes</code></em> parameter and 722 comment out the <em class="parameter"><code>wins server</code></em>. Validate the configuration 723 with the <code class="literal">testparm</code> utility as shown here: 724</p><pre class="screen"> 725<code class="prompt">root# </code> testparm 726Load smb config files from /etc/samba/smb.conf 727Processing section "[apps]" 728Processing section "[media]" 729Processing section "[homes]" 730Processing section "[printers]" 731Processing section "[netlogon]" 732Processing section "[profiles]" 733Processing section "[profdata]" 734Processing section "[print$]" 735Loaded services file OK. 736Server role: ROLE_DOMAIN_PDC 737Press enter to see a dump of your service definitions 738</pre><p> 739 </p></li><li><p> 740 Now shut down the old NT4 PDC. Only when the old NT4 PDC and all 741 NT4 BDCs have been shut down can the Samba-3 PDC be started. 742 </p></li><li><p> 743 All workstations should function as they did with the old NT4 PDC. All 744 interdomain trust accounts should remain in place and fully functional. 745 All machine accounts and user logon accounts should also function correctly. 746 </p></li><li><p> 747 The configuration of Samba-3 BDC servers can be accomplished now or at any 748 convenient time in the future. Please refer to the carefully detailed process 749 for doing so is outlined in <a class="link" href="happy.html#sbehap-bldg1" title="Samba-3 BDC Configuration">“Samba-3 BDC Configuration”</a>. 750 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sbevam1"></a>Migration Log Validation</h4></div></div></div><p> 751 The following <code class="filename">vampire.log</code> file is typical of a valid migration. 752</p><pre class="screen"> 753adding user Administrator to group Domain Admins 754adding user atrickhoffer to group Engineers 755adding user dhenwick to group Engineers 756adding user dork to group Engineers 757adding user rfreshmill to group Marketoids 758adding user jacko to group Gnomes 759adding user jimbo to group Gnomes 760adding user maryk to group Gnomes 761adding user gdaison to group Gnomes 762adding user dhenwick to group Catalyst 763adding user jacko to group Catalyst 764adding user jacko to group Recieving 765adding user blue to group Recieving 766adding user hrambotham to group Rubberboot 767adding user billw to group Sales 768adding user bridge to group Sales 769adding user jrhapsody to group Sales 770adding user maryk to group Sales 771adding user rfreshmill to group Sales 772adding user fsellerby to group Sales 773adding user sharpec to group Sales 774adding user jimbo to group Accounting 775adding user gdaison to group Accounting 776adding user jacko to group Shipping 777adding user blue to group Shipping 778Fetching DOMAIN database 779Creating unix group: 'Engineers' 780Creating unix group: 'Marketoids' 781Creating unix group: 'Gnomes' 782Creating unix group: 'Catalyst' 783Creating unix group: 'Recieving' 784Creating unix group: 'Rubberboot' 785Creating unix group: 'Sales' 786Creating unix group: 'Accounting' 787Creating unix group: 'Shipping' 788Creating account: Administrator 789Creating account: Guest 790Creating account: TRANSGRESSION$ 791Creating account: IUSR_TRANSGRESSION 792Creating account: MIDEARTH$ 793Creating account: atrickhoffer 794Creating account: barryf 795Creating account: fsellerby 796Creating account: gdaison 797Creating account: hrambotham 798Creating account: jrhapsody 799Creating account: maryk 800Creating account: jacko 801Creating account: bridge 802Creating account: sharpec 803Creating account: jimbo 804Creating account: dhenwick 805Creating account: dork 806Creating account: blue 807Creating account: billw 808Creating account: rfreshmill 809Creating account: MAGGOT$ 810Creating account: TRENTWARE$ 811Creating account: MORTON$ 812Creating account: NARM$ 813Creating account: LAPDOG$ 814Creating account: SCAVENGER$ 815Creating account: merlin$ 816Group members of Domain Admins: Administrator, 817Group members of Domain Users: Administrator(primary), 818TRANSGRESSION$(primary),IUSR_TRANSGRESSION(primary), 819MIDEARTH$(primary),atrickhoffer(primary),barryf(primary), 820fsellerby(primary),gdaison(primary),hrambotham(primary), 821jrhapsody(primary),maryk(primary),jacko(primary),bridge(primary), 822sharpec(primary),jimbo(primary),dhenwick(primary),dork(primary), 823blue(primary),billw(primary),rfreshmill(primary),MAGGOT$(primary), 824TRENTWARE$(primary),MORTON$(primary),NARM$(primary), 825LAPDOG$(primary),SCAVENGER$(primary),merlin$(primary), 826Group members of Domain Guests: Guest(primary), 827Group members of Engineers: atrickhoffer,dhenwick,dork, 828Group members of Marketoids: rfreshmill, 829Group members of Gnomes: jacko,jimbo,maryk,gdaison, 830Group members of Catalyst: dhenwick,jacko, 831Group members of Recieving: jacko,blue, 832Group members of Rubberboot: hrambotham, 833Group members of Sales: billw,bridge,jrhapsody,maryk, 834rfreshmill,fsellerby,sharpec, 835Group members of Accounting: jimbo,gdaison, 836Group members of Shipping: jacko,blue, 837Fetching BUILTIN database 838skipping SAM_DOMAIN_INFO delta for 'Builtin' (is not my domain) 839Creating unix group: 'Account Operators' 840Creating unix group: 'Guests' 841Creating unix group: 'Server Operators' 842Creating unix group: 'Users' 843</pre><p> 844 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2604606"></a>NT4 Migration Using tdbsam Backend</h3></div></div></div><p> 845 In this example, we change the domain name of the NT4 server from 846 <code class="constant">DRUGPREP</code> to <code class="constant">MEGANET</code> prior to the use 847 of the vampire (migration) tool. This migration process makes use of Linux system tools 848 (like <code class="literal">useradd</code>) to add the accounts that are migrated into the 849 UNIX/Linux <code class="filename">/etc/passwd</code> and <code class="filename">/etc/group</code> 850 databases. These entries must therefore be present, and correct options specified, 851 in your <code class="filename">smb.conf</code> file, or else the migration does not work as it should. 852 </p><div class="procedure"><a name="id2604653"></a><p class="title"><b>Procedure�9.2.�Migration Steps Using tdbsam</b></p><ol type="1"><li><p> 853 Prepare a Samba-3 server precisely per the instructions shown in <a class="link" href="Big500users.html" title="Chapter�4.�The 500-User Office">“The 500-User Office”</a>. 854 Set the workgroup name to <code class="constant">MEGANET</code>. 855 </p></li><li><p><a class="indexterm" name="id2604681"></a><a class="indexterm" name="id2604689"></a> 856 Edit the <code class="filename">smb.conf</code> file to temporarily change the parameter 857 <a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = No</a> so 858 the Samba server functions as a BDC for the purpose of migration. 859 </p></li><li><p> 860 Start Samba as you have done previously. 861 </p></li><li><p><a class="indexterm" name="id2604732"></a> 862 Join the NT4 Domain as a BDC, as shown here: 863</p><pre class="screen"> 864<code class="prompt">root# </code> net rpc join -S oldnt4pdc -W MEGANET -UAdministrator%not24get 865Joined domain MEGANET. 866</pre><p> 867 </p></li><li><p><a class="indexterm" name="id2604766"></a> 868 You may vampire the accounts from the NT4 PDC by executing the command, as shown here: 869</p><pre class="screen"> 870<code class="prompt">root# </code> net rpc vampire -S oldnt4pdc -U Administrator%not24get 871Fetching DOMAIN database 872SAM_DELTA_DOMAIN_INFO not handled 873Creating unix group: 'Domain Admins' 874Creating unix group: 'Domain Users' 875Creating unix group: 'Domain Guests' 876Creating unix group: 'Engineers' 877Creating unix group: 'Marketoids' 878Creating unix group: 'Account Operators' 879Creating unix group: 'Administrators' 880Creating unix group: 'Backup Operators' 881Creating unix group: 'Guests' 882Creating unix group: 'Print Operators' 883Creating unix group: 'Replicator' 884Creating unix group: 'Server Operators' 885Creating unix group: 'Users' 886Creating account: Administrator 887Creating account: Guest 888Creating account: oldnt4pdc$ 889Creating account: jacko 890Creating account: maryk 891Creating account: bridge 892Creating account: sharpec 893Creating account: jimbo 894Creating account: dhenwick 895Creating account: dork 896Creating account: blue 897Creating account: billw 898Creating account: massive$ 899Group members of Engineers: Administrator, 900 sharpec(primary),bridge,billw(primary),dhenwick 901Group members of Marketoids: Administrator,jacko(primary), 902 maryk(primary),jimbo,blue(primary),dork(primary) 903Creating unix group: 'Gnomes' 904Fetching BUILTIN database 905SAM_DELTA_DOMAIN_INFO not handled 906</pre><p> 907 </p></li><li><p><a class="indexterm" name="id2604820"></a> 908 At this point, we can validate our migration. Let's look at the accounts 909 in the form in which they are seen in a smbpasswd file. This achieves that: 910</p><pre class="screen"> 911<code class="prompt">root# </code> pdbedit -Lw 912Administrator:505:84B0D8E14D158FF8417EAF50CFAC29C3: 913 AF6DD3FD4E2EA8BDE1695A3F05EFBF52:[UX ]:LCT-3DF7AA9F: 914jimbo:512:6E9A2A51F64A1BD5C187B8085FE1D9DF: 915 CDF7E305E639966E489A0CEFB95EE5E0:[UX ]:LCT-3E9362BC: 916sharpec:511:E4301A7CD8FDD1EC6BBF9BC19CDF8151: 917 7000255938831D5B948C95C1931534C5:[UX ]:LCT-3E8B42C4: 918dhenwick:513:DCD8886141E3F892AAD3B435B51404EE: 919 2DB36465949CB938DD98C312EFDC2639:[UX ]:LCT-3E939F41: 920bridge:510:3FE6873A43101B46417EAF50CFAC29C3: 921 891741F481AF111B4CAA09A94016BD01:[UX ]:LCT-3E8B4291: 922blue:515:256D41D2559BB3D2AAD3B435B51404EE: 923 9CCADDA4F7D281DD0FAD321478C6F971:[UX ]:LCT-3E939FDC: 924diamond$:517:6C8E7B64EDCDBC4218B6345447A4454B: 925 3323AC63C666CFAACB60C13F65D54E9A:[S ]:LCT-00000000: 926oldnt4pdc$:507:3E39430CDCABB5B09ED320D0448AE568: 927 95DBAF885854A919C7C7E671060478B9:[S ]:LCT-3DF7AA9F: 928Guest:506:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX: 929 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[DUX ]:LCT-3E93A008: 930billw:516:85380CA7C21B6EBE168C8150662AF11B: 931 5D7478508293709937E55FB5FBA14C17:[UX ]:LCT-3FED7CA1: 932dork:514:78C70DDEC35A35B5AAD3B435B51404EE: 933 0AD886E015AC595EC0AF40E6C9689E1A:[UX ]:LCT-3E939F9A: 934jacko:508:BC472F3BF9A0A5F63832C92FC614B7D1: 935 0C6822AAF85E86600A40DC73E40D06D5:[UX ]:LCT-3E8B4242: 936maryk:509:3636AB7E12EBE79AB79AE2610DD89D4C: 937 CF271B744F7A55AFDA277FF88D80C527:[UX ]:LCT-3E8B4270: 938</pre><p> 939 </p></li><li><p><a class="indexterm" name="id2604897"></a> 940 An expanded view of a user account entry shows more of what was 941 obtained from the NT4 PDC: 942</p><pre class="screen"> 943sleeth:~ # pdbedit -Lv maryk 944Unix username: maryk 945NT username: maryk 946Account Flags: [UX ] 947User SID: S-1-5-21-1988699175-926296742-1295600288-1003 948Primary Group SID: S-1-5-21-1988699175-926296742-1295600288-1007 949Full Name: Mary Kathleen 950Home Directory: \\diamond\maryk 951HomeDir Drive: X: 952Logon Script: scripts\logon.bat 953Profile Path: \\diamond\profiles\maryk 954Domain: MEGANET 955Account desc: Peace Maker 956Workstations: 957Munged dial: 958Logon time: 0 959Logoff time: Mon, 18 Jan 2038 20:14:07 GMT 960Kickoff time: Mon, 18 Jan 2038 20:14:07 GMT 961Password last set: Wed, 02 Apr 2003 13:05:04 GMT 962Password can change: 0 963Password must change: Mon, 18 Jan 2038 20:14:07 GMT 964</pre><p> 965 </p></li><li><p><a class="indexterm" name="id2604932"></a> 966 The following command lists the long names of the groups that have been 967 imported (vampired) from the NT4 PDC: 968</p><pre class="screen"> 969<code class="prompt">root# </code> net group -l -Uroot%not24get -Smassive 970 971Group name Comment 972----------------------------- 973Engineers Snake Oil Engineers 974Marketoids Untrustworthy Hype Vendors 975Gnomes Plain Vanilla Garden Gnomes 976Replicator Supports file replication in a domain 977Guests Users granted guest access to the computer/domain 978Administrators Members can fully administer the computer/domain 979Users Ordinary users 980</pre><p> 981 Everything looks well and in order. 982 </p></li><li><p><a class="indexterm" name="id2604972"></a><a class="indexterm" name="id2604980"></a> 983 Edit the <code class="filename">smb.conf</code> file to reset the parameter 984 <a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = Yes</a> so 985 the Samba server functions as a PDC for the purpose of migration. 986 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2605013"></a>Key Points Learned</h3></div></div></div><p> 987 Migration of an NT4 PDC database to a Samba-3 PDC is possible. 988 </p><div class="itemizedlist"><ul type="disc"><li><p> 989 An LDAP backend is a suitable vehicle for NT4 migrations. 990 </p></li><li><p> 991 A tdbsam backend can be used to perform a migration. 992 </p></li><li><p> 993 Multiple NT4 domains can be merged into a single Samba-3 994 domain. 995 </p></li><li><p> 996 The net Samba-3 domain most likely requires some 997 administration and updating before going live. 998 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2605051"></a>Questions and Answers</h2></div></div></div><p> 999 </p><div class="qandaset"><dl><dt> <a href="ntmigration.html#id2605066"> 1000 Why must I start each migration with a clean database? 1001 </a></dt><dt> <a href="ntmigration.html#id2605107"> 1002 Is it possible to set my domain SID to anything I like? 1003 </a></dt><dt> <a href="ntmigration.html#id2605164"> 1004 When using a tdbsam passdb backend, why must I have all domain user and group accounts 1005 in /etc/passwd and /etc/group? 1006 </a></dt><dt> <a href="ntmigration.html#id2605344"> 1007 Why did you validate connectivity before attempting migration? 1008 </a></dt><dt> <a href="ntmigration.html#id2605389"> 1009 How would you merge 10 tdbsam-based domains into an LDAP database? 1010 </a></dt><dt> <a href="ntmigration.html#id2605512"> 1011 I want to change my domain name after I migrate all accounts from an NT4 domain to a 1012 Samba-3 domain. Does it make any sense to migrate the machine accounts in that case? 1013 </a></dt><dt> <a href="ntmigration.html#id2605588"> 1014 After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why? 1015 </a></dt><dt> <a href="ntmigration.html#id2605652"> 1016 How can I reset group membership after loading the account information into the LDAP database? 1017 </a></dt><dt> <a href="ntmigration.html#id2605687"> 1018 What are the limits or constraints that apply to group names? 1019 </a></dt><dt> <a href="ntmigration.html#id2605791"> 1020 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 1021 LDAP backend system using the vampire process? 1022 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2605066"></a><a name="id2605069"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605072"></a> 1023 Why must I start each migration with a clean database? 1024 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2605087"></a> 1025 This is a recommendation that permits the data from each NT4 domain to 1026 be kept separate until you are ready to merge them. Also, if you do not start with a clean database, 1027 you may find errors due to users or groups from multiple domains having the 1028 same name but different SIDs. It is better to permit each migration to complete 1029 without undue errors and then to handle the merging of vampired data under 1030 proper supervision. 1031 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2605107"></a><a name="id2605109"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605112"></a> 1032 Is it possible to set my domain SID to anything I like? 1033 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2605128"></a><a class="indexterm" name="id2605136"></a><a class="indexterm" name="id2605143"></a> 1034 Yes, so long as the SID you create has the same structure as an autogenerated SID. 1035 The typical SID looks like this: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX, where 1036 the XXXXXXXXXX can be any number with from 6 to 10 digits. On the other hand, why 1037 would you really want to create your own SID? I cannot think of a good reason. 1038 You may want to set the SID to one that is already in use somewhere on your network, 1039 but that is a little different from straight out creating your own domain SID. 1040 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2605164"></a><a name="id2605166"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605169"></a><a class="indexterm" name="id2605177"></a><a class="indexterm" name="id2605184"></a><a class="indexterm" name="id2605192"></a><a class="indexterm" name="id2605200"></a><a class="indexterm" name="id2605212"></a><a class="indexterm" name="id2605223"></a> 1041 When using a tdbsam passdb backend, why must I have all domain user and group accounts 1042 in <code class="filename">/etc/passwd</code> and <code class="filename">/etc/group</code>? 1043 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2605254"></a><a class="indexterm" name="id2605262"></a><a class="indexterm" name="id2605270"></a><a class="indexterm" name="id2605277"></a><a class="indexterm" name="id2605285"></a><a class="indexterm" name="id2605293"></a> 1044 Samba-3 must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba 1045 does not fabricate the UNIX IDs from thin air, but rather requires them to be located 1046 in a suitable place. 1047 </p><p> 1048 When migrating a <code class="filename">smbpasswd</code> file to an LDAP backend, the 1049 UID of each account is taken together with the account information in the 1050 <code class="filename">/etc/passwd</code>, and both sets of data are used to create the account 1051 entry in the LDAP database. 1052 </p><p> 1053 If you elect to create the POSIX account also, the entire UNIX account is copied to the 1054 LDAP backend. The same occurs with NT groups and UNIX groups. At the conclusion of 1055 migration to the LDAP database, the accounts may be removed from the UNIX database files. 1056 In short then, all UNIX and Windows networking accounts, both in tdbsam as well as in 1057 LDAP, require UIDs/GIDs. 1058 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2605344"></a><a name="id2605346"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605349"></a><a class="indexterm" name="id2605357"></a><a class="indexterm" name="id2605365"></a> 1059 Why did you validate connectivity before attempting migration? 1060 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 1061 Access validation before attempting to migrate NT4 domain accounts helps to pinpoint 1062 potential problems that may otherwise affect or impede account migration. I am always 1063 mindful of the 4 P's of migration: Planning Prevents Poor Performance. 1064 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2605389"></a><a name="id2605392"></a></td><td align="left" valign="top"><p> 1065 How would you merge 10 tdbsam-based domains into an LDAP database? 1066 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2605402"></a><a class="indexterm" name="id2605410"></a><a class="indexterm" name="id2605418"></a><a class="indexterm" name="id2605426"></a><a class="indexterm" name="id2605434"></a><a class="indexterm" name="id2605442"></a><a class="indexterm" name="id2605449"></a><a class="indexterm" name="id2605457"></a><a class="indexterm" name="id2605465"></a><a class="indexterm" name="id2605473"></a><a class="indexterm" name="id2605481"></a> 1067 If you have 10 tdbsam Samba domains, there is considerable risk that there are a number of 1068 accounts that have the same UNIX identifier (UID/GID). This means that you almost 1069 certainly have to edit a lot of data. It would be easiest to dump each database in smbpasswd 1070 file format and then manually edit all records to ensure that each has a unique UID. Each 1071 file can then be imported a number of ways. You can use the <code class="literal">pdbedit</code> tool 1072 to affect a transfer from the smbpasswd file to LDAP, or you can migrate them en masse to 1073 tdbsam and then to LDAP. The final choice is yours. Just remember to verify all accounts that 1074 you have migrated before handing over access to a user. After all, too many users with a bad 1075 migration experience may threaten your career. 1076 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2605512"></a><a name="id2605514"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605517"></a><a class="indexterm" name="id2605525"></a> 1077 I want to change my domain name after I migrate all accounts from an NT4 domain to a 1078 Samba-3 domain. Does it make any sense to migrate the machine accounts in that case? 1079 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2605546"></a><a class="indexterm" name="id2605554"></a><a class="indexterm" name="id2605562"></a><a class="indexterm" name="id2605570"></a> 1080 I would recommend not to migrate the machine account. The machine accounts should still work, but there are registry entries 1081 on each Windows NT4 and upward client that have a tattoo of the old domain name. If you 1082 unjoin the domain and then rejoin the newly renamed Samba-3 domain, you can be certain to avoid 1083 this tattooing effect. 1084 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2605588"></a><a name="id2605590"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605593"></a> 1085 After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why? 1086 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2605609"></a><a class="indexterm" name="id2605617"></a> 1087 Samba-3 currently does not implement multiple group membership internally. If you use the Windows 1088 NT4 Domain User Manager to manage accounts and you have an LDAP backend, the multiple group 1089 membership is stored in the POSIX groups area. If you use either tdbsam or smbpasswd backend, 1090 then multiple group membership is handled through the UNIX groups file. When you dump the user 1091 accounts, no group account information is provided. When you edit (change) UIDs and GIDs in each 1092 file to which you migrated the NT4 Domain data, do not forget to edit the UNIX <code class="filename">/etc/passwd</code> 1093 and <code class="filename">/etc/group</code> information also. That is where the multiple group information 1094 is most closely at your fingertips. 1095 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2605652"></a><a name="id2605655"></a></td><td align="left" valign="top"><p> 1096 How can I reset group membership after loading the account information into the LDAP database? 1097 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2605666"></a> 1098 You can use the NT4 Domain User Manager that can be downloaded from the Microsoft Web site. The 1099 installation file is called <code class="filename">SRVTOOLS.EXE</code>. 1100 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2605687"></a><a name="id2605689"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605692"></a> 1101 What are the limits or constraints that apply to group names? 1102 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2605708"></a><a class="indexterm" name="id2605715"></a><a class="indexterm" name="id2605723"></a><a class="indexterm" name="id2605731"></a><a class="indexterm" name="id2605739"></a><a class="indexterm" name="id2605747"></a> 1103 A Windows 200x group name can be up to 254 characters long, while in Windows NT4 the group 1104 name is limited to 20 characters. Most UNIX systems limit this to 32 characters. Windows 1105 groups can contain upper- and lowercase characters, as well as spaces. 1106 Many UNIX system do not permit the use of uppercase characters, and some do not permit the 1107 space character either. A number of systems (i.e., Linux) work fine with both uppercase 1108 and space characters in group names, but the shadow-utils package that provides the group 1109 control functions (<code class="literal">groupadd</code>, <code class="literal">groupmod</code>, <code class="literal">groupdel</code>, and so on) do not permit them. 1110 Also, a number of UNIX systems management tools enforce their own particular interpretation 1111 of the POSIX standards and likewise do not permit uppercase or space characters in group 1112 or user account names. You have to experiment with your system to find what its 1113 peculiarities are. 1114 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2605791"></a><a name="id2605794"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605797"></a> 1115 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 1116 LDAP backend system using the vampire process? 1117 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 1118 UNIX UIDs and GIDs on most UNIX systems use an unsigned short or an unsigned integer. Recent Linux 1119 kernels support at least a much larger number. On systems that have a 16-bit constraint on UID/GIDs, 1120 you would not be able to migrate 323,000 accounts because this number cannot fit into a 16-bit unsigned 1121 integer. UNIX/Linux systems that have a 32-bit UID/GID can easily handle this number of accounts. 1122 Please check this carefully before you attempt to effect a migration using the vampire process. 1123 </p><p><a class="indexterm" name="id2605834"></a> 1124 Migration speed depends much on the processor speed, the network speed, disk I/O capability, and 1125 LDAP update overheads. On a dual processor AMD MP1600+ with 1 GB memory that was mirroring LDAP 1126 to a second identical system over 1 Gb Ethernet, I was able to migrate around 180 user accounts 1127 per minute. Migration would obviously go much faster if LDAP mirroring were turned off during the migration. 1128 </p></td></tr></tbody></table></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="upgrades.html">Prev</a>�</td><td width="20%" align="center"><a accesskey="u" href="DMSMig.html">Up</a></td><td width="40%" align="right">�<a accesskey="n" href="nw4migration.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter�8.�Updating Samba-3�</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">�Chapter�10.�Migrating NetWare Server to Samba-3</td></tr></table></div></body></html> 1129
