1<?xml version="1.0" encoding="iso-8859-1"?> 2<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc"> 3<chapter id="ntmigration"> 4 <title>Migrating NT4 Domain to Samba-3</title> 5 6 <para> 7 Ever since Microsoft announced that it was discontinuing support for Windows 8 NT4, Samba users started to ask for detailed instructions on how to migrate 9 from NT4 to Samba-3. This chapter provides background information that should 10 meet these needs. 11 </para> 12 13 <para> 14 One wonders how many NT4 systems will be left in service by the time you read this 15 book though. 16 </para> 17 18<sect1> 19 <title>Introduction</title> 20 21 <para><indexterm> 22 <primary>migration</primary> 23 </indexterm> 24 Network administrators who want to migrate off a Windows NT4 environment know 25 one thing with certainty. They feel that NT4 has been abandoned, and they want 26 to update. The desire to get off NT4 and to not adopt Windows 200x and Active 27 Directory is driven by a mixture of concerns over complexity, cost, fear of 28 failure, and much more. 29 </para> 30 31 <para> 32 <indexterm><primary>group policies</primary></indexterm> 33 <indexterm><primary>accounts</primary><secondary>user</secondary></indexterm> 34 <indexterm><primary>accounts</primary><secondary>group</secondary></indexterm> 35 <indexterm><primary>accounts</primary><secondary>machine</secondary></indexterm> 36 The migration from NT4 to Samba-3 can involve a number of factors, including 37 migration of data to another server, migration of network environment controls 38 such as group policies, and migration of the users, groups, and machine 39 accounts. 40 </para> 41 42 <para> 43 <indexterm><primary>accounts</primary><secondary>Domain</secondary></indexterm> 44 It should be pointed out now that it is possible to migrate some systems from 45 a Windows NT4 domain environment to a Samba-3 domain environment. This is certainly 46 not possible in every case. It is possible to just migrate the domain accounts 47 to Samba-3 and then to switch machines, but as a hands-off transition, this is more 48 the exception than the rule. Most systems require some tweaking after 49 migration before an environment that is acceptable for immediate use 50 is obtained. 51 </para> 52 53 <sect2> 54 <title>Assignment Tasks</title> 55 56 <para> 57 <indexterm><primary>LDAP</primary></indexterm> 58 <indexterm><primary>ldapsam</primary></indexterm> 59 <indexterm><primary>passdb backend</primary></indexterm> 60 You are about to migrate an MS Windows NT4 domain accounts database to 61 a Samba-3 server. The Samba-3 server is using a 62 <parameter>passdb backend</parameter> based on LDAP. The 63 <constant>ldapsam</constant> is ideal because an LDAP backend can be distributed 64 for use with BDCs &smbmdash; generally essential for larger networks. 65 </para> 66 67 <para> 68 Your objective is to document the process of migrating user and group accounts 69 from several NT4 domains into a single Samba-3 LDAP backend database. 70 </para> 71 72 </sect2> 73</sect1> 74 75<sect1> 76 <title>Dissection and Discussion</title> 77 78 <para> 79 <indexterm><primary>snap-shot</primary></indexterm> 80 <indexterm><primary>NT4 registry</primary></indexterm> 81 <indexterm><primary>registry</primary><secondary>keys</secondary><tertiary>SAM</tertiary></indexterm> 82 <indexterm><primary>registry</primary><secondary>keys</secondary><tertiary>SECURITY</tertiary></indexterm> 83 <indexterm><primary>SAM</primary></indexterm> 84 <indexterm><primary>Security Account Manager</primary><see>SAM</see></indexterm> 85 The migration process takes a snapshot of information that is stored in the 86 Windows NT4 registry-based accounts database. That information resides in 87 the Security Account Manager (SAM) portion of the NT4 registry under keys called 88 <constant>SAM</constant> and <constant>SECURITY</constant>. 89 </para> 90 91 <warning><para> 92 <indexterm><primary>crippled</primary></indexterm> 93 <indexterm><primary>inoperative</primary></indexterm> 94 The Windows NT4 registry keys called <constant>SAM</constant> and <constant>SECURITY</constant> 95 are protected so that you cannot view the contents. If you change the security setting 96 to reveal the contents under these hive keys, your Windows NT4 domain is crippled. Do not 97 do this unless you are willing to render your domain controller inoperative. 98 </para></warning> 99 100 <para> 101 <indexterm><primary>migration</primary><secondary>objectives</secondary></indexterm> 102 <indexterm><primary>disruptive</primary></indexterm> 103 Before commencing an NT4 to Samba-3 migration, you should consider what your objectives are. 104 While in some cases it is possible simply to migrate an NT4 domain to a single Samba-3 server, 105 that may not be a good idea from an administration perspective. Since the process involves going 106 through a certain amount of disruptive activity anyhow, why not take this opportunity to 107 review the structure of the network, how Windows clients are controlled and how they 108 interact with the network environment. 109 </para> 110 111 <para> 112 <indexterm><primary>network</primary><secondary>logon scripts</secondary></indexterm> 113 <indexterm><primary>profiles share</primary></indexterm> 114 <indexterm><primary>security descriptors</primary></indexterm> 115 MS Windows NT4 was introduced some time around 1996. Many environments in which NT4 was deployed 116 have done little to keep the NT4 server environment up to date with more recent Windows releases, 117 particularly Windows XP Professional. The migration provides opportunity to revise and update 118 roaming profile deployment as well as folder redirection. Given that you must port the 119 greater network configuration of this from the old NT4 server to the new Samba-3 server. 120 Do not forget to validate the security descriptors in the profiles share as well as network logon 121 scripts. Feedback from sites that are migrating to Samba-3 suggests that many are using this 122 as a good time to update desktop systems also. In all, the extra effort should constitute no 123 real disruption to users, but rather, with due diligence and care, should make their network experience 124 a much happier one. 125 </para> 126 127 <sect2> 128 <title>Technical Issues</title> 129 130 <para> 131 <indexterm><primary>strategic</primary></indexterm> 132 <indexterm><primary>active directory</primary></indexterm> 133 Migration of an NT4 domain user and group database to Samba-3 involves a certain strategic 134 element. Many sites have asked for instructions regarding merging of multiple NT4 135 domains into one Samba-3 LDAP database. It seems that this is viewed as a significant 136 added value compared with the alternative of migration to Windows Server 200x and Active 137 Directory. The diagram in <link linkend="ch8-migration"/> illustrates the effect of migration 138 from a Windows NT4 domain to a Samba domain. 139 </para> 140 141 <figure id="ch8-migration"> 142 <title>Schematic Explaining the <command>net rpc vampire</command> Process</title> 143 <imagefile scale="55">ch8-migration</imagefile> 144 </figure> 145 146 <para> 147 <indexterm><primary>merge</primary></indexterm> 148 <indexterm><primary>passdb.tdb</primary></indexterm> 149 If you want to merge multiple NT4 domain account databases into one Samba domain, 150 you must now dump the contents of the first migration and edit it as appropriate. Now clean 151 out (remove) the tdbsam backend file (<filename>passdb.tdb</filename>) or the LDAP database 152 files. You must start each migration with a new database into which you merge your NT4 153 domains. 154 </para> 155 156 <para><indexterm> 157 <primary>dump</primary> 158 </indexterm> 159 At this point, you are ready to perform the second migration, following the same steps as 160 for the first. In other words, dump the database, edit it, and then you may merge the 161 dump for the first and second migrations. 162 </para> 163 164 <para><indexterm> 165 <primary>LDAP</primary> 166 </indexterm><indexterm> 167 <primary>migrate</primary> 168 </indexterm><indexterm> 169 <primary>Domain SID</primary> 170 </indexterm> 171 You must be careful. If you choose to migrate to an LDAP backend, your dump file 172 now contains the full account information, including the domain SID. The domain SID for each 173 of the two NT4 domains will be different. You must choose one and change the domain 174 portion of the account SIDs so that all are the same. 175 </para> 176 177 <para> 178 <indexterm><primary>passdb.tdb</primary></indexterm> 179 <indexterm><primary>/etc/passwd</primary></indexterm> 180 <indexterm><primary>merged</primary></indexterm> 181 <indexterm><primary>logon script</primary></indexterm> 182 <indexterm><primary>logon hours</primary></indexterm> 183 <indexterm><primary>logon machines</primary></indexterm> 184 <indexterm><primary>profile path</primary></indexterm> 185 <indexterm><primary>smbpasswd</primary></indexterm> 186 <indexterm><primary>tdbsam</primary></indexterm> 187 <indexterm><primary>LDAP backend</primary></indexterm> 188 <indexterm><primary>export</primary></indexterm> 189 <indexterm><primary>import</primary></indexterm> 190 If you choose to use a tdbsam (<filename>passdb.tdb</filename>) backend file, your best choice 191 is to use <command>pdbedit</command> to export the contents of the tdbsam file into an 192 smbpasswd data file. This automatically strips out all domain-specific information, 193 such as logon hours, logon machines, logon script, profile path, as well as the domain SID. 194 The resulting file can be easily merged with other migration attempts (each of which must start 195 with a clean file). It should also be noted that all users who end up in the merged smbpasswd 196 file must have an account in <filename>/etc/passwd</filename>. The resulting smbpasswd file 197 may be exported or imported into either a tdbsam (<filename>passdb.tdb</filename>) or 198 an LDAP backend. 199 </para> 200 201 <figure id="NT4DUM"> 202 <title>View of Accounts in NT4 Domain User Manager</title> 203 <imagefile scale="50">UserMgrNT4</imagefile> 204 </figure> 205 206</sect2> 207 208 209<sect2> 210 <title>Political Issues</title> 211 212 <para> 213 The merging of multiple Windows NT4-style domains into a single LDAP-backend-based Samba-3 214 domain may be seen by those who had power over them as a loss of prestige or a loss of 215 power. The imposition of a single domain may even be seen as a threat. So in migrating and 216 merging account databases, be consciously aware of the political fall-out in which you 217 may find yourself entangled when key staff feel a loss of prestige. 218 </para> 219 220 <para> 221 The best advice that can be given to those who set out to merge NT4 domains into a single 222 Samba-3 domain is to promote (sell) the action as one that reduces costs and delivers 223 greater network interoperability and manageability. 224 </para> 225 226 </sect2> 227 228</sect1> 229 230<sect1> 231 <title>Implementation</title> 232 233 <para> 234 From feedback on the Samba mailing lists, it seems that most Windows NT4 migrations 235 to Samba-3 are being performed using a new server or a new installation of a Linux or UNIX 236 server. If you contemplate doing this, please note that the steps that follow in this 237 chapter assume familiarity with the information that has been previously covered in this 238 book. You are particularly encouraged to be familiar with <link linkend="secure"/>, 239 <link linkend="Big500users"/> and <link linkend="happy"/>. 240 </para> 241 242 <para> 243 We present here the steps and example output for two NT4 to Samba-3 domain migrations. The 244 first uses an LDAP-based backend, and the second uses a tdbsam backend. In each case the 245 scripts you specify in the &smb.conf; file for the <parameter>add user script</parameter> 246 collection of parameters are used to effect the addition of accounts into the passdb backend. 247 </para> 248 249 <para> 250 Before proceeding to NT4 migration using either a tdbsam or ldapsam, it is most strongly recommended to 251 review <link linkend="ch5-dnshcp-setup"/> for DNS and DHCP configuration. The importance of correctly 252 functioning name resolution must be recognized. This applies equally for both hostname and NetBIOS names 253 (machine names, computer names, domain names, workgroup names &smbmdash; ALL names!). 254 </para> 255 256 <para> 257 The migration process involves the following steps: 258 </para> 259 260 <itemizedlist> 261 <listitem><para> 262 Prepare the target Samba-3 server. This involves configuring Samba-3 for 263 migration to either a tdbsam or an ldapsam backend. 264 </para></listitem> 265 266 <listitem><para> 267 <indexterm><primary>uppercase</primary></indexterm> 268 <indexterm><primary>Posix</primary></indexterm> 269 <indexterm><primary>lower-case</primary></indexterm> 270 Clean up the source NT4 PDC. Delete all accounts that need not be migrated. 271 Delete all files that should not be migrated. Where possible, change NT group 272 names so there are no spaces or uppercase characters. This is important if 273 the target UNIX host insists on POSIX-compliant all lowercase user and group 274 names. 275 </para></listitem> 276 277 <listitem><para> 278 Step through the migration process. 279 </para></listitem> 280 281 <listitem><para><indexterm><primary>PDC</primary></indexterm> 282 Remove the NT4 PDC from the network. 283 </para></listitem> 284 285 <listitem><para> 286 Upgrade the Samba-3 server from a BDC to a PDC, and validate all account 287 information. 288 </para></listitem> 289 </itemizedlist> 290 291 <para> 292 It may help to use the above outline as a pre-migration checklist. 293 </para> 294 295 <sect2> 296 <title>NT4 Migration Using LDAP Backend</title> 297 298 <para> 299 In this example, the migration is of an NT4 PDC to a Samba-3 PDC with an LDAP backend. The accounts about 300 to be migrated are shown in <link linkend="NT4DUM"/>. In this example use is made of the 301 smbldap-tools scripts to add the accounts that are migrated into the ldapsam passdb backend. 302 Four scripts are essential to the migration process. Other scripts will be required 303 for daily management, but these are not critical to migration. The critical scripts are dependant 304 on which passdb backend is being used. Refer to <link linkend="ch8-vampire"/> to see which scripts 305 must be provided so that the migration process can complete. 306 </para> 307 308 <para> 309 Verify that you have correctly specified in the &smb.conf; file the scripts and arguments 310 that should be passed to them before attempting to perform the account migration. Note also 311 that the deletion scripts must be commented out during migration. These should be uncommented 312 following successful migration of the NT4 Domain accounts. 313 </para> 314 315 <warning><para> 316 Under absolutely no circumstances should the Samba daemons be started until instructed to do so. 317 Delete the <filename>/etc/samba/secrets.tdb</filename> file and all Samba control tdb files 318 before commencing the following configuration steps. 319 </para></warning> 320 321 <table id="ch8-vampire"> 322 <title>Samba &smb.conf; Scripts Essential to Samba Operation</title> 323 <tgroup cols="3"> 324 <colspec align="left"/> 325 <colspec align="center"/> 326 <colspec align="center"/> 327 <thead> 328 <row> 329 <entry>Entity</entry> 330 <entry>ldapsam Script</entry> 331 <entry>tdbsam Script</entry> 332 </row> 333 </thead> 334 <tbody> 335 <row> 336 <entry>Add User Accounts</entry> 337 <entry>smbldap-useradd</entry> 338 <entry>useradd</entry> 339 </row> 340 <row> 341 <entry>Delete User Accounts</entry> 342 <entry>smbldap-userdel</entry> 343 <entry>userdel</entry> 344 </row> 345 <row> 346 <entry>Add Group Accounts</entry> 347 <entry>smbldap-groupadd</entry> 348 <entry>groupadd</entry> 349 </row> 350 <row> 351 <entry>Delete Group Accounts</entry> 352 <entry>smbldap-groupdel</entry> 353 <entry>groupdel</entry> 354 </row> 355 <row> 356 <entry>Add User to Group</entry> 357 <entry>smbldap-groupmod</entry> 358 <entry>usermod (See Note)</entry> 359 </row> 360 <row> 361 <entry>Add Machine Accounts</entry> 362 <entry>smbldap-useradd</entry> 363 <entry>useradd</entry> 364 </row> 365 </tbody> 366 </tgroup> 367 </table> 368 369 <note><para> 370 <indexterm><primary>usermod</primary></indexterm> 371 <indexterm><primary>groupmem</primary></indexterm> 372 <indexterm><primary>smbldap-tools</primary></indexterm> 373 The UNIX/Linux <command>usermod</command> utility does not permit simple user addition to (or deletion 374 of users from) groups. This is a feature provided by the smbldap-tools scripts. If you want this 375 capability, you must create your own tool to do this. Alternately, you can search the Web 376 to locate a utility called <command>groupmem</command> (by George Kraft) that provides this functionality. 377 The <command>groupmem</command> utility was contributed to the shadow package but has not surfaced 378 in the formal commands provided by Linux distributions (March 2004). 379 </para></note> 380 381 <note><para> 382 <indexterm><primary>tdbdump</primary></indexterm> 383 The <command>tdbdump</command> utility is a utility that you can build from the Samba source-code tree. Not all Linux binary distributions include this tool. If it is missing from your 384 Linux distribution, you will need to build this yourself or else forgo its use. 385 </para></note> 386 387 <para> 388 <indexterm><primary>User Manager</primary></indexterm> 389 Before starting the migration, all dead accounts were removed from the NT4 domain using the User Manager for Domains. 390 </para> 391 392 <procedure> 393 <title>User Migration Steps</title> 394 395 <step><para> 396 Configure the Samba &smb.conf; file to create a BDC. An example configuration is 397 given in <link linkend="sbent4smb"/>. 398 The delete scripts are commented out so that during the process of migration 399 no account information can be deleted. 400 </para></step> 401 402<example id="sbent4smb"> 403<title>NT4 Migration Samba-3 Server <filename>smb.conf</filename> &smbmdash; Part: A</title> 404<smbconfblock> 405<smbconfsection name="[global]"/> 406 <smbconfoption name="workgroup">DAMNATION</smbconfoption> 407 <smbconfoption name="netbios name">MERLIN</smbconfoption> 408 <smbconfoption name="passdb backend">ldapsam:ldap://localhost</smbconfoption> 409 <smbconfoption name="log level">1</smbconfoption> 410 <smbconfoption name="syslog">0</smbconfoption> 411 <smbconfoption name="log file">/var/log/samba/%m</smbconfoption> 412 <smbconfoption name="max log size">0</smbconfoption> 413 <smbconfoption name="smb ports">139 445</smbconfoption> 414 <smbconfoption name="name resolve order">wins bcast hosts</smbconfoption> 415 <smbconfoption name="add user script">/opt/IDEALX/sbin/smbldap-useradd -m '%u'</smbconfoption> 416 <smbconfoption name="#delete user script">/opt/IDEALX/sbin/smbldap-userdel '%u'</smbconfoption> 417 <smbconfoption name="add group script">/opt/IDEALX/sbin/smbldap-groupadd '%g'</smbconfoption> 418 <smbconfoption name="#delete group script">/opt/IDEALX/sbin/smbldap-groupdel '%g'</smbconfoption> 419 <smbconfoption name="add user to group script">/opt/IDEALX/sbin/ smbldap-groupmod -m '%u' '%g'</smbconfoption> 420 <smbconfoption name="#delete user from group script">/opt/IDEALX/sbin/smbldap-groupmod -x '%u' '%g'</smbconfoption> 421 <smbconfoption name="set primary group script">/opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</smbconfoption> 422 <smbconfoption name="add machine script">/opt/IDEALX/sbin/smbldap-useradd -w '%u'</smbconfoption> 423 <smbconfoption name="logon script">scripts\logon.cmd</smbconfoption> 424 <smbconfoption name="logon path">\\%L\profiles\%U</smbconfoption> 425 <smbconfoption name="logon home">\\%L\%U</smbconfoption> 426 <smbconfoption name="logon drive">X:</smbconfoption> 427 <smbconfoption name="domain logons">Yes</smbconfoption> 428 <smbconfoption name="domain master">No</smbconfoption> 429 <smbconfoption name="#wins support">Yes</smbconfoption> 430 <smbconfoption name="wins server">192.168.123.124</smbconfoption> 431 <smbconfoption name="ldap admin dn">cn=Manager,dc=terpstra-world,dc=org</smbconfoption> 432 <smbconfoption name="ldap group suffix">ou=Groups</smbconfoption> 433 <smbconfoption name="ldap idmap suffix">ou=Idmap</smbconfoption> 434 <smbconfoption name="ldap machine suffix">ou=People</smbconfoption> 435 <smbconfoption name="ldap passwd sync">Yes</smbconfoption> 436 <smbconfoption name="ldap suffix">dc=terpstra-world,dc=org</smbconfoption> 437 <smbconfoption name="ldap ssl">no</smbconfoption> 438 <smbconfoption name="ldap timeout">20</smbconfoption> 439 <smbconfoption name="ldap user suffix">ou=People</smbconfoption> 440 <smbconfoption name="idmap backend">ldap:ldap://localhost</smbconfoption> 441 <smbconfoption name="idmap uid">15000-20000</smbconfoption> 442 <smbconfoption name="idmap gid">15000-20000</smbconfoption> 443 <smbconfoption name="winbind nested groups">Yes</smbconfoption> 444 <smbconfoption name="ea support">Yes</smbconfoption> 445 <smbconfoption name="map acl inherit">Yes</smbconfoption> 446 </smbconfblock> 447</example> 448 449<example id="sbent4smb2"> 450<title>NT4 Migration Samba-3 Server <filename>smb.conf</filename> &smbmdash; Part: B</title> 451<smbconfblock> 452<smbconfsection name="[apps]"/> 453 <smbconfoption name="comment">Application Data</smbconfoption> 454 <smbconfoption name="path">/data/home/apps</smbconfoption> 455 <smbconfoption name="read only">No</smbconfoption> 456 457<smbconfsection name="[homes]"/> 458 <smbconfoption name="comment">Home Directories</smbconfoption> 459 <smbconfoption name="path">/home/users/%U/Documents</smbconfoption> 460 <smbconfoption name="valid users">%S</smbconfoption> 461 <smbconfoption name="read only">No</smbconfoption> 462 <smbconfoption name="browseable">No</smbconfoption> 463 464<smbconfsection name="[printers]"/> 465 <smbconfoption name="comment">SMB Print Spool</smbconfoption> 466 <smbconfoption name="path">/var/spool/samba</smbconfoption> 467 <smbconfoption name="guest ok">Yes</smbconfoption> 468 <smbconfoption name="printable">Yes</smbconfoption> 469 <smbconfoption name="use client driver">No</smbconfoption> 470 <smbconfoption name="browseable">No</smbconfoption> 471 472<smbconfsection name="[netlogon]"/> 473 <smbconfoption name="comment">Network Logon Service</smbconfoption> 474 <smbconfoption name="path">/var/lib/samba/netlogon</smbconfoption> 475 <smbconfoption name="guest ok">Yes</smbconfoption> 476 <smbconfoption name="locking">No</smbconfoption> 477 478<smbconfsection name="[profiles]"/> 479 <smbconfoption name="comment">Profile Share</smbconfoption> 480 <smbconfoption name="path">/var/lib/samba/profiles</smbconfoption> 481 <smbconfoption name="read only">No</smbconfoption> 482 <smbconfoption name="profile acls">Yes</smbconfoption> 483 484<smbconfsection name="[profdata]"/> 485 <smbconfoption name="comment">Profile Data Share</smbconfoption> 486 <smbconfoption name="path">/var/lib/samba/profdata</smbconfoption> 487 <smbconfoption name="read only">No</smbconfoption> 488 <smbconfoption name="profile acls">Yes</smbconfoption> 489 490<smbconfsection name="[print$]"/> 491 <smbconfoption name="comment">Printer Drivers</smbconfoption> 492 <smbconfoption name="path">/var/lib/samba/drivers</smbconfoption> 493 </smbconfblock> 494</example> 495 496 <step><para> 497 <indexterm><primary>slapd.conf</primary></indexterm> 498 Configure OpenLDAP in preparation for the migration. An example 499 <filename>sladp.conf</filename> file is shown in <link linkend="sbentslapd"/>. 500 The <constant>rootpw</constant> value is an encrypted password string that can 501 be obtained by executing the <command>slappasswd</command> command. 502 </para></step> 503 504<example id="sbentslapd"> 505<title>NT4 Migration LDAP Server Configuration File: <filename>/etc/openldap/slapd.conf</filename> &smbmdash; Part A</title> 506<screen> 507include /etc/openldap/schema/core.schema 508include /etc/openldap/schema/cosine.schema 509include /etc/openldap/schema/inetorgperson.schema 510include /etc/openldap/schema/nis.schema 511include /etc/openldap/schema/samba3.schema 512 513pidfile /var/run/slapd/slapd.pid 514argsfile /var/run/slapd/slapd.args 515 516access to dn.base="" 517 by self write 518 by * auth 519 520access to attr=userPassword 521 by self write 522 by * auth 523 524access to attr=shadowLastChange 525 by self write 526 by * read 527 528access to * 529 by * read 530 by anonymous auth 531</screen> 532</example> 533 534<example id="sbentslapd2"> 535<title>NT4 Migration LDAP Server Configuration File: <filename>/etc/openldap/slapd.conf</filename> &smbmdash; Part B</title> 536<screen> 537#loglevel 256 538 539#schemacheck on 540idletimeout 30 541#backend bdb 542database bdb 543checkpoint 1024 5 544cachesize 10000 545 546suffix "dc=terpstra-world,dc=org" 547rootdn "cn=Manager,dc=terpstra-world,dc=org" 548 549# rootpw = not24get 550rootpw {SSHA}86kTavd9Dw3FAz6qzWTrCOKX/c0Qe+UV 551 552directory /var/lib/ldap 553 554# Indices to maintain 555index objectClass eq 556index cn pres,sub,eq 557index sn pres,sub,eq 558index uid pres,sub,eq 559index displayName pres,sub,eq 560index uidNumber eq 561index gidNumber eq 562index memberUID eq 563index sambaSID eq 564index sambaPrimaryGroupSID eq 565index sambaDomainName eq 566index default sub 567</screen> 568</example> 569 570 <step><para> 571 <indexterm><primary>nss_ldap</primary></indexterm> 572 <indexterm><primary>/etc/ldap.conf</primary></indexterm> 573 Install the PADL <command>nss_ldap</command> tool set, then configure the <filename>/etc/ldap.conf</filename> 574 as shown in <link linkend="sbrntldapconf"/>. 575 </para></step> 576 577<example id="sbrntldapconf"> 578<title>NT4 Migration NSS LDAP File: <filename>/etc/ldap.conf</filename></title> 579<screen> 580host 127.0.0.1 581 582base dc=terpstra-world,dc=org 583 584ldap_version 3 585 586binddn cn=Manager,dc=terpstra-world,dc=org 587bindpw not24get 588 589pam_password exop 590 591nss_base_passwd ou=People,dc=terpstra-world,dc=org?one 592nss_base_shadow ou=People,dc=terpstra-world,dc=org?one 593nss_base_group ou=Groups,dc=terpstra-world,dc=org?one 594 595ssl off 596</screen> 597</example> 598 599 <step><para> 600 <indexterm><primary>/etc/nsswitch.conf</primary></indexterm> 601 Edit the <filename>/etc/nsswitch.conf</filename> file so it has the entries shown 602 in <link linkend="sbentnss"/>. Note that the LDAP entries have been commented out. 603 This is deliberate. If these entries are active (not commented out), and the 604 <filename>/etc/ldap.conf</filename> file has been configured, when the LDAP server 605 is started, the process of starting the LDAP server will cause LDAP lookups. This 606 causes the LDAP server <command>slapd</command> to hang because it finds port 389 607 open and therefore cannot gain exclusive control of it. By commenting these entries 608 out, it is possible to avoid this gridlock situation and thus the overall 609 installation and configuration will progress more smoothly. 610 </para></step> 611 612<example id="sbentnss"> 613<title>NT4 Migration NSS Control File: <filename>/etc/nsswitch.conf</filename> (Stage:1)</title> 614<screen> 615passwd: files #ldap 616shadow: files #ldap 617group: files #ldap 618 619hosts: files dns wins 620networks: files dns 621 622services: files 623protocols: files 624rpc: files 625ethers: files 626netmasks: files 627netgroup: files 628publickey: files 629 630bootparams: files 631automount: files nis 632aliases: files 633#passwd_compat: ldap #Not needed. 634#group_compat: ldap #Not needed. 635</screen> 636</example> 637 638 <step><para> 639 Validate the the target NT4 PDC name is being correctly resolved to its IP address by 640 executing the following: 641<screen> 642&rootprompt; ping transgression 643PING transgression.terpstra-world.org (192.168.1.5) 56(84) bytes of data. 64464 bytes from (192.168.1.5): icmp_seq=1 ttl=128 time=0.159 ms 64564 bytes from (192.168.1.5): icmp_seq=2 ttl=128 time=0.192 ms 64664 bytes from (192.168.1.5): icmp_seq=3 ttl=128 time=0.141 ms 647 648--- transgression.terpstra-world.org ping statistics --- 6493 packets transmitted, 3 received, 0% packet loss, time 2000ms 650rtt min/avg/max/mdev = 0.141/0.164/0.192/0.021 ms 651</screen> 652 Do not proceed to the next step if this step fails. It is imperative that the name of the PDC 653 can be resolved to its IP address. If this is broken, fix it. 654 </para></step> 655 656 <step><para> 657 Pull the domain SID from the NT4 domain that is being migrated as follows: 658<screen> 659&rootprompt; net rpc getsid -S TRANGRESSION -U Administrator%not24get 660Storing SID S-1-5-21-1385457007-882775198-1210191635 \ 661 for Domain DAMNATION in secrets.tdb 662</screen> 663 </para> 664 665 <para> 666 Another way to obtain the domain SID from the target NT4 domain that is being 667 migrated to Samba-3 is by executing the following: 668<screen> 669&rootprompt; net rpc info -S TRANSGRESSION 670</screen> 671 If this method is used, do not forget to store the SID obtained into the 672 <filename>secrets.tdb</filename> file. This can be done by executing: 673<screen> 674&rootprompt; net setlocalsid S-1-5-21-1385457007-882775198-1210191635 675</screen> 676 </para></step> 677 678 <step><para> 679 <indexterm><primary>Idealx</primary></indexterm> 680 <indexterm><primary>configure.pl</primary></indexterm> 681 <indexterm><primary>/opt/IDEALX/sbin</primary></indexterm> 682 <indexterm><primary>smbldap-tools</primary></indexterm> 683 Install the Idealx <command>smbldap-tools</command> software package, following 684 the instructions given in <link linkend="sbeidealx"/>. The resulting perl scripts 685 should be located in the <filename>/opt/IDEALX/sbin</filename> directory. 686 Change into that location, or wherever the scripts have been installed. Execute the 687 <filename>configure.pl</filename> script to configure the Idealx package for use. 688 Note: Use the domain SID obtained from the step above. The following is 689 an example configuration session: 690<screen> 691&rootprompt; ./configure.pl 692-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 693 smbldap-tools script configuration 694 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 695Before starting, check 696 . if your samba controller is up and running. 697 . if the domain SID is defined 698 (you can get it with the 'net getlocalsid') 699 700 . you can leave the configuration using the Crtl-c key combination 701 . empty value can be set with the "." character 702-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 703Looking for configuration files... 704 705Samba Config File Location [/etc/samba/smb.conf] > 706smbldap Config file Location (global parameters) 707 [/etc/smbldap-tools/smbldap.conf] > 708smbldap Config file Location (bind parameters) 709 [/etc/smbldap-tools/smbldap_bind.conf] > 710-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 711Let's start configuring the smbldap-tools scripts ... 712 713. workgroup name: name of the domain Samba act as a PDC 714 workgroup name [DAMNATION] > 715. netbios name: netbios name of the samba controller 716 netbios name [MERLIN] > 717. logon drive: local path to which the home directory 718 will be connected (for NT Workstations). Ex: 'H:' 719 logon drive [X:] > H: 720. logon home: home directory location (for Win95/98 or NT Workstation) 721 (use %U as username) Ex:'\\MERLIN\home\%U' 722 logon home (leave blank if you don't want homeDirectory) 723 [\\MERLIN\home\%U] > \\%L\%U 724. logon path: directory where roaming profiles are stored. 725 Ex:'\\MERLIN\profiles\%U' 726 logon path (leave blank if you don't want roaming profile) 727 [\\MERLIN\profiles\%U] > \\%L\profiles\%U 728. home directory prefix (use %U as username) [/home/%U] > 729 /home/users/%U 730. default user netlogon script (use %U as username) 731 [%U.cmd] > scripts\logon.cmd 732 default password validation time (time in days) [45] > 180 733. ldap suffix [dc=terpstra-world,dc=org] > 734. ldap group suffix [ou=Groups] > 735. ldap user suffix [ou=People] > 736. ldap machine suffix [ou=People] > 737. Idmap suffix [ou=Idmap] > 738. sambaUnixIdPooldn: object where you want to store the next uidNumber 739 and gidNumber available for new users and groups 740 sambaUnixIdPooldn object (relative to ${suffix}) 741 [sambaDomainName=DAMNATION] > 742. ldap master server: 743 IP address or DNS name of the master (writable) ldap server 744 ldap master server [] > 127.0.0.1 745. ldap master port [389] > 746. ldap master bind dn [cn=Manager,dc=terpstra-world,dc=org] > 747. ldap master bind password [] > 748. ldap slave server: IP address or DNS name of the slave ldap server: 749 can also be the master one 750 ldap slave server [] > 127.0.0.1 751. ldap slave port [389] > 752. ldap slave bind dn [cn=Manager,dc=terpstra-world,dc=org] > 753. ldap slave bind password [] > 754. ldap tls support (1/0) [0] > 755. SID for domain DAMNATION: SID of the domain 756 (can be obtained with 'net getlocalsid MERLIN') 757 SID for domain DAMNATION [] 758 > S-1-5-21-1385457007-882775198-1210191635 759. unix password encryption: encryption used for unix passwords 760unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA) [SSHA] > MD5 761. default user gidNumber [513] > 762. default computer gidNumber [515] > 763. default login shell [/bin/bash] > 764. default domain name to append to mail address [] > 765 terpstra-world.org 766-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 767backup old configuration files: 768 /etc/smbldap-tools/smbldap.conf-> 769 /etc/smbldap-tools/smbldap.conf.old 770 /etc/smbldap-tools/smbldap_bind.conf-> 771 /etc/smbldap-tools/smbldap_bind.conf.old 772writing new configuration file: 773 /etc/smbldap-tools/smbldap.conf done. 774 /etc/smbldap-tools/smbldap_bind.conf done. 775</screen> 776 <indexterm><primary>sambaDomainName</primary></indexterm> 777 <indexterm><primary>NextFreeUnixId</primary></indexterm> 778 <indexterm><primary>updating smbldap-tools</primary></indexterm> 779 <indexterm><primary>smbldap-tools updating</primary></indexterm> 780 Note that the NT4 domain SID that was previously obtained was entered above. Also, 781 the sambaUnixIdPooldn object was specified as sambaDomainName=DAMNATION. This is 782 the location into which the Idealx smbldap-tools store the next available UID/GID 783 information. It is also where Samba stores domain specific information such as the 784 next RID, the SID, and so on. In older version of the smbldap-tools this information 785 was stored in the sambaUnixIdPooldn DIT location cn=NextFreeUnixId. Where smbldap-tools 786 are being upgraded to version 0.9.1 it is appropriate to update this to the new location 787 only if the directory information is also relocated. 788 </para></step> 789 790 <step><para> 791 Start the LDAP server using the system interface script. On Novell SLES9 792 this is done as shown here: 793<screen> 794&rootprompt; rcldap start 795</screen> 796 </para></step> 797 798 <step><para> 799 Edit the <filename>/etc/nsswitch.conf</filename> file so it has the entries shown in 800 <link linkend="sbentnss2"/>. Note that the LDAP entries have now been uncommented. 801 </para></step> 802 803<example id="sbentnss2"> 804<title>NT4 Migration NSS Control File: <filename>/etc/nsswitch.conf</filename> (Stage:2)</title> 805<screen> 806passwd: files ldap 807shadow: files ldap 808group: files ldap 809 810hosts: files dns wins 811networks: files dns 812 813services: files 814protocols: files 815rpc: files 816ethers: files 817netmasks: files 818netgroup: files 819publickey: files 820 821bootparams: files 822automount: files nis 823aliases: files 824#passwd_compat: ldap #Not needed. 825#group_compat: ldap #Not needed. 826</screen> 827</example> 828 829 <step><para> 830 The LDAP management password must be installed into the <filename>secrets.tdb</filename> 831 file as follows: 832<screen> 833&rootprompt; smbpasswd -w not24get 834Setting stored password for 835 "cn=Manager,dc=terpstra-world,dc=org" in secrets.tdb 836</screen> 837 </para></step> 838 839 <step><para> 840 Populate the LDAP directory as shown here: 841<screen> 842&rootprompt; /opt/IDEALX/sbin/smbldap-populate -a root -k 0 -m 0 843Using workgroup name from sambaUnixIdPooldn (smbldap.conf): 844 sambaDomainName=DAMNATION 845Using builtin directory structure 846adding new entry: dc=terpstra-world,dc=org 847adding new entry: ou=People,dc=terpstra-world,dc=org 848adding new entry: ou=Groups,dc=terpstra-world,dc=org 849entry ou=People,dc=terpstra-world,dc=org already exist. 850adding new entry: ou=Idmap,dc=terpstra-world,dc=org 851adding new entry: sambaDomainName=DAMNATION,dc=terpstra-world,dc=org 852adding new entry: uid=root,ou=People,dc=terpstra-world,dc=org 853adding new entry: uid=nobody,ou=People,dc=terpstra-world,dc=org 854adding new entry: cn=Domain Admins,ou=Groups,dc=terpstra-world,dc=org 855adding new entry: cn=Domain Users,ou=Groups,dc=terpstra-world,dc=org 856adding new entry: cn=Domain Guests,ou=Groups,dc=terpstra-world,dc=org 857adding new entry: cn=Domain Computers,ou=Groups,dc=terpstra-world,dc=org 858adding new entry: cn=Administrators,ou=Groups,dc=terpstra-world,dc=org 859adding new entry: cn=Print Operators,ou=Groups,dc=terpstra-world,dc=org 860adding new entry: cn=Backup Operators,ou=Groups,dc=terpstra-world,dc=org 861adding new entry: cn=Replicators,ou=Groups,dc=terpstra-world,dc=org 862</screen> 863 The script tries to add the ou=People container twice, hence the error message. 864 This is expected behavior. 865 </para></step> 866 867 <step><para> 868 <indexterm><primary>Novell SUSE SLES 9</primary></indexterm> 869 Restart the LDAP server following initialization of the LDAP directory. Execute the 870 system control script provided on your system. The following steps can be used on 871 Novell SUSE SLES 9: 872<screen> 873&rootprompt; rcldap restart 874&rootprompt; chkconfig ldap on 875</screen> 876 </para></step> 877 878 <step><para> 879 Verify that the new user accounts that have been added to the LDAP directory can be 880 resolved as follows: 881<screen> 882&rootprompt; getent passwd 883... 884nobody:x:65534:65533:nobody:/var/lib/nobody:/bin/bash 885man:x:13:62:Manual pages viewer:/var/cache/man:/bin/bash 886news:x:9:13:News system:/etc/news:/bin/bash 887uucp:x:10:14:Unix-to-Unix CoPy system:/etc/uucp:/bin/bash 888+::0:0::: 889root:x:0:0:Netbios Domain Administrator:/home/users/root:/bin/false 890nobody:x:999:514:nobody:/dev/null:/bin/false 891</screen> 892 Now repeat this for the group accounts as shown here: 893<screen> 894&rootprompt; getent group 895... 896nobody:x:65533: 897nogroup:x:65534:nobody 898users:x:100: 899+::0: 900Domain Admins:x:512:root 901Domain Users:x:513: 902Domain Guests:x:514: 903Domain Computers:x:515: 904Administrators:x:544: 905Print Operators:x:550: 906Backup Operators:x:551: 907Replicators:x:552: 908</screen> 909 In both cases the LDAP accounts follow the <quote>+::0:</quote> entry. 910 </para></step> 911 912 <step><para> 913 Now it is time to join the Samba BDC to the target NT4 domain that is being 914 migrated to Samba-3 by executing the following: 915<screen> 916&rootprompt; net rpc join -S TRANSGRESSION -U Administrator%not24get 917merlin:/opt/IDEALX/sbin # net rpc join -S TRANSGRESSION \ 918 -U Administrator%not24get 919Joined domain DAMNATION. 920</screen> 921 </para></step> 922 923 <step><para> 924 Set the new domain administrator (root) password for both UNIX and Windows as shown here: 925<screen> 926&rootprompt; /opt/IDEALX/sbin/smbldap-passwd root 927Changing password for root 928New password : ******** 929Retype new password : ******** 930</screen> 931 Note: During account migration, the Windows Administrator account will not be migrated 932 to the Samba server. 933 </para></step> 934 935 <step><para> 936 Now validate that these accounts can be resolved using Samba's tools as 937 shown here for user accounts: 938<screen> 939&rootprompt; pdbedit -Lw 940root:0:84B0D8E14D158FF8417EAF50CFAC29C3: 941 AF6DD3FD4E2EA8BDE1695A3F05EFBF52:[U ]:LCT-425F6467: 942nobody:65534:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX: 943 NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:[NU ]:LCT-00000000: 944</screen> 945 Now complete the following step to validate that group account mappings have 946 been correctly set: 947<screen> 948&rootprompt; net groupmap list 949Domain Admins (S-1-5-21-1385457007-882775198-1210191635-512) 950 -> Domain Admins 951Domain Users (S-1-5-21-1385457007-882775198-1210191635-513) 952 -> Domain Users 953Domain Guests (S-1-5-21-1385457007-882775198-1210191635-514) 954 -> Domain Guests 955Domain Computers (S-1-5-21-1385457007-882775198-1210191635-515) 956 -> Domain Computers 957Administrators (S-1-5-32-544) -> Administrators 958Print Operators (S-1-5-32-550) -> Print Operators 959Backup Operators (S-1-5-32-551) -> Backup Operators 960Replicators (S-1-5-32-552) -> Replicators 961</screen> 962 These are the expected results for a correctly configured system. 963 </para></step> 964 965 <step><para> 966 Commence migration as shown here: 967<screen> 968&rootprompt; net rpc vampire -S TRANSGRESSION \ 969 -U Administrator%not24get > /tmp/vampire.log 2>1 970</screen> 971 Check the vampire log to confirm that only expected errors have been 972 reported. See <link linkend="sbevam1"/>. 973 </para></step> 974 975 <step><para> 976 The migration of user accounts can be quickly validated as follows: 977<screen> 978&rootprompt; pdbedit -Lw 979root:0:84B0D8E14D158FF8417EAF50CFAC29C3:... 980nobody:65534:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:... 981Administrator:0:84B0D8E14D158FF8417EAF50CFAC29C3:... 982Guest:1:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:... 983TRANSGRESSION$:2:CC044B748CEE294CE76B6B0D1B86C1A8:... 984IUSR_TRANSGRESSION:3:64046AC81B056C375F9537FC409085F8:... 985MIDEARTH$:4:E93186E5819706D2AAD3B435B51404EE:... 986atrickhoffer:5:DC08CFE0C12B2867352502E32A407F23:... 987barryf:6:B829BCDE01FF24376E45D5F10408CFBD:... 988fsellerby:7:6A97CBEBE8F9826B417EAF50CFAC29C3:... 989gdaison:8:48F6A8C8A900024351DA8C2061C5F1D3:... 990hrambotham:9:7330D9EA0964465EAAD3B435B51404EE:... 991jrhapsody:10:ACBA7D207E2BA35D9BD41A26B01626BD:... 992maryk:11:293B5A4CA41F6CA1A7D80430B8342B73:... 993jacko:12:8E8982D86BD037C364BBD09A598E07AD:... 994bridge:13:0D2CA7D2BE67FE2193BE3A377C968336:... 995sharpec:14:8841A75CAC19D2855D8B73B1F4D430F8:... 996jimbo:15:6E8BDC904FD9EC5C17306D272A9441BB:... 997dhenwick:16:D1694A03C33584BDAAD3B435B51404EE:... 998dork:17:69E2D19E69A593D5AAD3B435B51404EE:... 999blue:18:E355EBF9559979FEAAD3B435B51404EE:... 1000billw:19:EE35C3481CF7F7DB484448BC86A641A5:... 1001rfreshmill:20:7EC033B58661B60CAAD3B435B51404EE:... 1002MAGGOT$:21:A3B9334765AD30F7AAD3B435B51404EE:... 1003TRENTWARE$:22:1D92C8DD5E7F0DDF93BE3A377C968336:... 1004MORTON$:23:89342E69DCA9D3F8AAD3B435B51404EE:... 1005NARM$:24:2B93E2D1D25448BDAAD3B435B51404EE:... 1006LAPDOG$:25:14AA535885120943AAD3B435B51404EE:... 1007SCAVENGER$:26:B6288EB6D147B56F8963805A19B0ED49:... 1008merlin$:27:820C50523F368C54AB9D85AE603AD09D:... 1009</screen> 1010 </para></step> 1011 1012 <step><para> 1013 The mapping of UNIX and Windows groups can be validated as show here: 1014<screen> 1015&rootprompt; net groupmap list 1016Domain Admins (S-1-5-21-1385457007-882775198-1210191635-512) 1017 -> Domain Admins 1018Domain Users (S-1-5-21-1385457007-882775198-1210191635-513) 1019 -> Domain Users 1020Domain Guests (S-1-5-21-1385457007-882775198-1210191635-514) 1021 -> Domain Guests 1022Domain Computers (S-1-5-21-1385457007-882775198-1210191635-515) 1023 -> Domain Computers 1024Administrators (S-1-5-32-544) -> Administrators 1025Print Operators (S-1-5-32-550) -> Print Operators 1026Backup Operators (S-1-5-32-551) -> Backup Operators 1027Replicator (S-1-5-32-552) -> Replicators 1028Engineers (S-1-5-21-1385457007-882775198-1210191635-1020) -> Engineers 1029Marketoids (S-1-5-21-1385457007-882775198-1210191635-1022) -> Marketoids 1030Gnomes (S-1-5-21-1385457007-882775198-1210191635-1023) -> Gnomes 1031Catalyst (S-1-5-21-1385457007-882775198-1210191635-1024) -> Catalyst 1032Recieving (S-1-5-21-1385457007-882775198-1210191635-1025) -> Recieving 1033Rubberboot (S-1-5-21-1385457007-882775198-1210191635-1026) -> Rubberboot 1034Sales (S-1-5-21-1385457007-882775198-1210191635-1027) -> Sales 1035Accounting (S-1-5-21-1385457007-882775198-1210191635-1028) -> Accounting 1036Shipping (S-1-5-21-1385457007-882775198-1210191635-1029) -> Shipping 1037Account Operators (S-1-5-32-548) -> Account Operators 1038Guests (S-1-5-32-546) -> Guests 1039Server Operators (S-1-5-32-549) -> Server Operators 1040Users (S-1-5-32-545) -> Users 1041</screen> 1042 It is of vital importance that the domain SID portions of all group 1043 accounts are identical. 1044 </para></step> 1045 1046 <step><para> 1047 The final responsibility in the migration process is to create identical 1048 shares and printing resources on the new Samba-3 server, copy all data 1049 across, set up privileges, and set share and file/directory access controls. 1050 </para></step> 1051 1052 <step><para> 1053 <indexterm><primary>domain master</primary></indexterm> 1054 <indexterm><primary>PDC</primary></indexterm> 1055 Edit the &smb.conf; file to reset the parameter 1056 <smbconfoption name="domain master">Yes</smbconfoption> so that 1057 the Samba server functions as a PDC for the purpose of migration. 1058 Also, uncomment the deletion scripts so they will now be fully functional, 1059 enable the <parameter>wins support = yes</parameter> parameter and 1060 comment out the <parameter>wins server</parameter>. Validate the configuration 1061 with the <command>testparm</command> utility as shown here: 1062<screen> 1063&rootprompt; testparm 1064Load smb config files from /etc/samba/smb.conf 1065Processing section "[apps]" 1066Processing section "[media]" 1067Processing section "[homes]" 1068Processing section "[printers]" 1069Processing section "[netlogon]" 1070Processing section "[profiles]" 1071Processing section "[profdata]" 1072Processing section "[print$]" 1073Loaded services file OK. 1074Server role: ROLE_DOMAIN_PDC 1075Press enter to see a dump of your service definitions 1076</screen> 1077 </para></step> 1078 1079 <step><para> 1080 Now shut down the old NT4 PDC. Only when the old NT4 PDC and all 1081 NT4 BDCs have been shut down can the Samba-3 PDC be started. 1082 </para></step> 1083 1084 <step><para> 1085 All workstations should function as they did with the old NT4 PDC. All 1086 interdomain trust accounts should remain in place and fully functional. 1087 All machine accounts and user logon accounts should also function correctly. 1088 </para></step> 1089 1090 <step><para> 1091 The configuration of Samba-3 BDC servers can be accomplished now or at any 1092 convenient time in the future. Please refer to the carefully detailed process 1093 for doing so is outlined in <link linkend="sbehap-bldg1"/>. 1094 </para></step> 1095 1096 </procedure> 1097 1098 <sect3 id="sbevam1"> 1099 <title>Migration Log Validation</title> 1100 1101 <para> 1102 The following <filename>vampire.log</filename> file is typical of a valid migration. 1103<screen> 1104adding user Administrator to group Domain Admins 1105adding user atrickhoffer to group Engineers 1106adding user dhenwick to group Engineers 1107adding user dork to group Engineers 1108adding user rfreshmill to group Marketoids 1109adding user jacko to group Gnomes 1110adding user jimbo to group Gnomes 1111adding user maryk to group Gnomes 1112adding user gdaison to group Gnomes 1113adding user dhenwick to group Catalyst 1114adding user jacko to group Catalyst 1115adding user jacko to group Recieving 1116adding user blue to group Recieving 1117adding user hrambotham to group Rubberboot 1118adding user billw to group Sales 1119adding user bridge to group Sales 1120adding user jrhapsody to group Sales 1121adding user maryk to group Sales 1122adding user rfreshmill to group Sales 1123adding user fsellerby to group Sales 1124adding user sharpec to group Sales 1125adding user jimbo to group Accounting 1126adding user gdaison to group Accounting 1127adding user jacko to group Shipping 1128adding user blue to group Shipping 1129Fetching DOMAIN database 1130Creating unix group: 'Engineers' 1131Creating unix group: 'Marketoids' 1132Creating unix group: 'Gnomes' 1133Creating unix group: 'Catalyst' 1134Creating unix group: 'Recieving' 1135Creating unix group: 'Rubberboot' 1136Creating unix group: 'Sales' 1137Creating unix group: 'Accounting' 1138Creating unix group: 'Shipping' 1139Creating account: Administrator 1140Creating account: Guest 1141Creating account: TRANSGRESSION$ 1142Creating account: IUSR_TRANSGRESSION 1143Creating account: MIDEARTH$ 1144Creating account: atrickhoffer 1145Creating account: barryf 1146Creating account: fsellerby 1147Creating account: gdaison 1148Creating account: hrambotham 1149Creating account: jrhapsody 1150Creating account: maryk 1151Creating account: jacko 1152Creating account: bridge 1153Creating account: sharpec 1154Creating account: jimbo 1155Creating account: dhenwick 1156Creating account: dork 1157Creating account: blue 1158Creating account: billw 1159Creating account: rfreshmill 1160Creating account: MAGGOT$ 1161Creating account: TRENTWARE$ 1162Creating account: MORTON$ 1163Creating account: NARM$ 1164Creating account: LAPDOG$ 1165Creating account: SCAVENGER$ 1166Creating account: merlin$ 1167Group members of Domain Admins: Administrator, 1168Group members of Domain Users: Administrator(primary), 1169TRANSGRESSION$(primary),IUSR_TRANSGRESSION(primary), 1170MIDEARTH$(primary),atrickhoffer(primary),barryf(primary), 1171fsellerby(primary),gdaison(primary),hrambotham(primary), 1172jrhapsody(primary),maryk(primary),jacko(primary),bridge(primary), 1173sharpec(primary),jimbo(primary),dhenwick(primary),dork(primary), 1174blue(primary),billw(primary),rfreshmill(primary),MAGGOT$(primary), 1175TRENTWARE$(primary),MORTON$(primary),NARM$(primary), 1176LAPDOG$(primary),SCAVENGER$(primary),merlin$(primary), 1177Group members of Domain Guests: Guest(primary), 1178Group members of Engineers: atrickhoffer,dhenwick,dork, 1179Group members of Marketoids: rfreshmill, 1180Group members of Gnomes: jacko,jimbo,maryk,gdaison, 1181Group members of Catalyst: dhenwick,jacko, 1182Group members of Recieving: jacko,blue, 1183Group members of Rubberboot: hrambotham, 1184Group members of Sales: billw,bridge,jrhapsody,maryk, 1185rfreshmill,fsellerby,sharpec, 1186Group members of Accounting: jimbo,gdaison, 1187Group members of Shipping: jacko,blue, 1188Fetching BUILTIN database 1189skipping SAM_DOMAIN_INFO delta for 'Builtin' (is not my domain) 1190Creating unix group: 'Account Operators' 1191Creating unix group: 'Guests' 1192Creating unix group: 'Server Operators' 1193Creating unix group: 'Users' 1194</screen> 1195 </para> 1196 1197 </sect3> 1198 1199 </sect2> 1200 1201 <sect2> 1202 <title>NT4 Migration Using tdbsam Backend</title> 1203 1204 <para> 1205 In this example, we change the domain name of the NT4 server from 1206 <constant>DRUGPREP</constant> to <constant>MEGANET</constant> prior to the use 1207 of the vampire (migration) tool. This migration process makes use of Linux system tools 1208 (like <command>useradd</command>) to add the accounts that are migrated into the 1209 UNIX/Linux <filename>/etc/passwd</filename> and <filename>/etc/group</filename> 1210 databases. These entries must therefore be present, and correct options specified, 1211 in your &smb.conf; file, or else the migration does not work as it should. 1212 </para> 1213 1214 <procedure> 1215 <title>Migration Steps Using tdbsam</title> 1216 1217 <step><para> 1218 Prepare a Samba-3 server precisely per the instructions shown in <link linkend="Big500users"/>. 1219 Set the workgroup name to <constant>MEGANET</constant>. 1220 </para></step> 1221 1222 <step><para><indexterm> 1223 <primary>domain master</primary> 1224 </indexterm><indexterm> 1225 <primary>BDC</primary> 1226 </indexterm> 1227 Edit the &smb.conf; file to temporarily change the parameter 1228 <smbconfoption name="domain master">No</smbconfoption> so 1229 the Samba server functions as a BDC for the purpose of migration. 1230 </para></step> 1231 1232 <step><para> 1233 Start Samba as you have done previously. 1234 </para></step> 1235 1236 <step><para><indexterm> 1237 <primary>net</primary> 1238 <secondary>rpc</secondary> 1239 <tertiary>join</tertiary> 1240 </indexterm> 1241 Join the NT4 Domain as a BDC, as shown here: 1242<screen> 1243&rootprompt; net rpc join -S oldnt4pdc -W MEGANET -UAdministrator%not24get 1244Joined domain MEGANET. 1245</screen> 1246 </para></step> 1247 1248 <step><para><indexterm> 1249 <primary>net</primary> 1250 <secondary>rpc</secondary> 1251 <tertiary>vampire</tertiary> 1252 </indexterm> 1253 You may vampire the accounts from the NT4 PDC by executing the command, as shown here: 1254<screen> 1255&rootprompt; net rpc vampire -S oldnt4pdc -U Administrator%not24get 1256Fetching DOMAIN database 1257SAM_DELTA_DOMAIN_INFO not handled 1258Creating unix group: 'Domain Admins' 1259Creating unix group: 'Domain Users' 1260Creating unix group: 'Domain Guests' 1261Creating unix group: 'Engineers' 1262Creating unix group: 'Marketoids' 1263Creating unix group: 'Account Operators' 1264Creating unix group: 'Administrators' 1265Creating unix group: 'Backup Operators' 1266Creating unix group: 'Guests' 1267Creating unix group: 'Print Operators' 1268Creating unix group: 'Replicator' 1269Creating unix group: 'Server Operators' 1270Creating unix group: 'Users' 1271Creating account: Administrator 1272Creating account: Guest 1273Creating account: oldnt4pdc$ 1274Creating account: jacko 1275Creating account: maryk 1276Creating account: bridge 1277Creating account: sharpec 1278Creating account: jimbo 1279Creating account: dhenwick 1280Creating account: dork 1281Creating account: blue 1282Creating account: billw 1283Creating account: massive$ 1284Group members of Engineers: Administrator, 1285 sharpec(primary),bridge,billw(primary),dhenwick 1286Group members of Marketoids: Administrator,jacko(primary), 1287 maryk(primary),jimbo,blue(primary),dork(primary) 1288Creating unix group: 'Gnomes' 1289Fetching BUILTIN database 1290SAM_DELTA_DOMAIN_INFO not handled 1291</screen> 1292 </para></step> 1293 1294 <step><para><indexterm> 1295 <primary>pdbedit</primary> 1296 </indexterm> 1297 At this point, we can validate our migration. Let's look at the accounts 1298 in the form in which they are seen in a smbpasswd file. This achieves that: 1299<screen> 1300&rootprompt; pdbedit -Lw 1301Administrator:505:84B0D8E14D158FF8417EAF50CFAC29C3: 1302 AF6DD3FD4E2EA8BDE1695A3F05EFBF52:[UX ]:LCT-3DF7AA9F: 1303jimbo:512:6E9A2A51F64A1BD5C187B8085FE1D9DF: 1304 CDF7E305E639966E489A0CEFB95EE5E0:[UX ]:LCT-3E9362BC: 1305sharpec:511:E4301A7CD8FDD1EC6BBF9BC19CDF8151: 1306 7000255938831D5B948C95C1931534C5:[UX ]:LCT-3E8B42C4: 1307dhenwick:513:DCD8886141E3F892AAD3B435B51404EE: 1308 2DB36465949CB938DD98C312EFDC2639:[UX ]:LCT-3E939F41: 1309bridge:510:3FE6873A43101B46417EAF50CFAC29C3: 1310 891741F481AF111B4CAA09A94016BD01:[UX ]:LCT-3E8B4291: 1311blue:515:256D41D2559BB3D2AAD3B435B51404EE: 1312 9CCADDA4F7D281DD0FAD321478C6F971:[UX ]:LCT-3E939FDC: 1313diamond$:517:6C8E7B64EDCDBC4218B6345447A4454B: 1314 3323AC63C666CFAACB60C13F65D54E9A:[S ]:LCT-00000000: 1315oldnt4pdc$:507:3E39430CDCABB5B09ED320D0448AE568: 1316 95DBAF885854A919C7C7E671060478B9:[S ]:LCT-3DF7AA9F: 1317Guest:506:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX: 1318 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[DUX ]:LCT-3E93A008: 1319billw:516:85380CA7C21B6EBE168C8150662AF11B: 1320 5D7478508293709937E55FB5FBA14C17:[UX ]:LCT-3FED7CA1: 1321dork:514:78C70DDEC35A35B5AAD3B435B51404EE: 1322 0AD886E015AC595EC0AF40E6C9689E1A:[UX ]:LCT-3E939F9A: 1323jacko:508:BC472F3BF9A0A5F63832C92FC614B7D1: 1324 0C6822AAF85E86600A40DC73E40D06D5:[UX ]:LCT-3E8B4242: 1325maryk:509:3636AB7E12EBE79AB79AE2610DD89D4C: 1326 CF271B744F7A55AFDA277FF88D80C527:[UX ]:LCT-3E8B4270: 1327</screen> 1328 </para></step> 1329 1330 <step><para><indexterm> 1331 <primary>pdbedit</primary> 1332 </indexterm> 1333 An expanded view of a user account entry shows more of what was 1334 obtained from the NT4 PDC: 1335<screen> 1336sleeth:~ # pdbedit -Lv maryk 1337Unix username: maryk 1338NT username: maryk 1339Account Flags: [UX ] 1340User SID: S-1-5-21-1988699175-926296742-1295600288-1003 1341Primary Group SID: S-1-5-21-1988699175-926296742-1295600288-1007 1342Full Name: Mary Kathleen 1343Home Directory: \\diamond\maryk 1344HomeDir Drive: X: 1345Logon Script: scripts\logon.bat 1346Profile Path: \\diamond\profiles\maryk 1347Domain: MEGANET 1348Account desc: Peace Maker 1349Workstations: 1350Munged dial: 1351Logon time: 0 1352Logoff time: Mon, 18 Jan 2038 20:14:07 GMT 1353Kickoff time: Mon, 18 Jan 2038 20:14:07 GMT 1354Password last set: Wed, 02 Apr 2003 13:05:04 GMT 1355Password can change: 0 1356Password must change: Mon, 18 Jan 2038 20:14:07 GMT 1357</screen> 1358 </para></step> 1359 1360 <step><para><indexterm> 1361 <primary>net</primary> 1362 <secondary>group</secondary> 1363 </indexterm> 1364 The following command lists the long names of the groups that have been 1365 imported (vampired) from the NT4 PDC: 1366<screen> 1367&rootprompt; net group -l -Uroot%not24get -Smassive 1368 1369Group name Comment 1370----------------------------- 1371Engineers Snake Oil Engineers 1372Marketoids Untrustworthy Hype Vendors 1373Gnomes Plain Vanilla Garden Gnomes 1374Replicator Supports file replication in a domain 1375Guests Users granted guest access to the computer/domain 1376Administrators Members can fully administer the computer/domain 1377Users Ordinary users 1378</screen> 1379 Everything looks well and in order. 1380 </para></step> 1381 1382 <step><para><indexterm> 1383 <primary>domain master</primary> 1384 </indexterm><indexterm> 1385 <primary>PDC</primary> 1386 </indexterm> 1387 Edit the &smb.conf; file to reset the parameter 1388 <smbconfoption name="domain master">Yes</smbconfoption> so 1389 the Samba server functions as a PDC for the purpose of migration. 1390 </para></step> 1391 </procedure> 1392 </sect2> 1393 1394 <sect2> 1395 <title>Key Points Learned</title> 1396 1397 <para> 1398 Migration of an NT4 PDC database to a Samba-3 PDC is possible. 1399 </para> 1400 1401 <itemizedlist> 1402 <listitem><para> 1403 An LDAP backend is a suitable vehicle for NT4 migrations. 1404 </para></listitem> 1405 1406 <listitem><para> 1407 A tdbsam backend can be used to perform a migration. 1408 </para></listitem> 1409 1410 <listitem><para> 1411 Multiple NT4 domains can be merged into a single Samba-3 1412 domain. 1413 </para></listitem> 1414 1415 <listitem><para> 1416 The net Samba-3 domain most likely requires some 1417 administration and updating before going live. 1418 </para></listitem> 1419 </itemizedlist> 1420 1421 </sect2> 1422 1423</sect1> 1424 1425<sect1> 1426 <title>Questions and Answers</title> 1427 1428 <para> 1429 </para> 1430 1431 <qandaset defaultlabel="chap08qa" type="number"> 1432 <qandaentry> 1433 <question> 1434 1435 <para><indexterm> 1436 <primary>clean database</primary> 1437 </indexterm> 1438 Why must I start each migration with a clean database? 1439 </para> 1440 1441 </question> 1442 <answer> 1443 1444 <para><indexterm> 1445 <primary>merge</primary> 1446 </indexterm> 1447 This is a recommendation that permits the data from each NT4 domain to 1448 be kept separate until you are ready to merge them. Also, if you do not start with a clean database, 1449 you may find errors due to users or groups from multiple domains having the 1450 same name but different SIDs. It is better to permit each migration to complete 1451 without undue errors and then to handle the merging of vampired data under 1452 proper supervision. 1453 </para> 1454 1455 </answer> 1456 </qandaentry> 1457 1458 <qandaentry> 1459 <question> 1460 1461 <para><indexterm> 1462 <primary>Domain SID</primary> 1463 </indexterm> 1464 Is it possible to set my domain SID to anything I like? 1465 </para> 1466 1467 </question> 1468 <answer> 1469 1470 <para><indexterm> 1471 <primary>auto-generated SID</primary> 1472 </indexterm><indexterm> 1473 <primary>SID</primary> 1474 </indexterm><indexterm> 1475 <primary>Domain SID</primary> 1476 </indexterm> 1477 Yes, so long as the SID you create has the same structure as an autogenerated SID. 1478 The typical SID looks like this: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX, where 1479 the XXXXXXXXXX can be any number with from 6 to 10 digits. On the other hand, why 1480 would you really want to create your own SID? I cannot think of a good reason. 1481 You may want to set the SID to one that is already in use somewhere on your network, 1482 but that is a little different from straight out creating your own domain SID. 1483 </para> 1484 1485 </answer> 1486 </qandaentry> 1487 1488 <qandaentry> 1489 <question> 1490 1491 <para><indexterm> 1492 <primary>/etc/passwd</primary> 1493 </indexterm><indexterm> 1494 <primary>/etc/group</primary> 1495 </indexterm><indexterm> 1496 <primary>tdbsam</primary> 1497 </indexterm><indexterm> 1498 <primary>passdb backend</primary> 1499 </indexterm><indexterm> 1500 <primary>accounts</primary> 1501 <secondary>user</secondary> 1502 </indexterm><indexterm> 1503 <primary>accounts</primary> 1504 <secondary>group</secondary> 1505 </indexterm><indexterm> 1506 <primary>accounts</primary> 1507 <secondary>Domain</secondary> 1508 </indexterm> 1509 When using a tdbsam passdb backend, why must I have all domain user and group accounts 1510 in <filename>/etc/passwd</filename> and <filename>/etc/group</filename>? 1511 </para> 1512 1513 </question> 1514 <answer> 1515 1516 <para><indexterm> 1517 <primary>UID</primary> 1518 </indexterm><indexterm> 1519 <primary>GID</primary> 1520 </indexterm><indexterm> 1521 <primary>smbpasswd</primary> 1522 </indexterm><indexterm> 1523 <primary>/etc/passwd</primary> 1524 </indexterm><indexterm> 1525 <primary>Posix</primary> 1526 </indexterm><indexterm> 1527 <primary>LDAP database</primary> 1528 </indexterm> 1529 Samba-3 must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba 1530 does not fabricate the UNIX IDs from thin air, but rather requires them to be located 1531 in a suitable place. 1532 </para> 1533 1534 <para> 1535 When migrating a <filename>smbpasswd</filename> file to an LDAP backend, the 1536 UID of each account is taken together with the account information in the 1537 <filename>/etc/passwd</filename>, and both sets of data are used to create the account 1538 entry in the LDAP database. 1539 </para> 1540 1541 <para> 1542 If you elect to create the POSIX account also, the entire UNIX account is copied to the 1543 LDAP backend. The same occurs with NT groups and UNIX groups. At the conclusion of 1544 migration to the LDAP database, the accounts may be removed from the UNIX database files. 1545 In short then, all UNIX and Windows networking accounts, both in tdbsam as well as in 1546 LDAP, require UIDs/GIDs. 1547 </para> 1548 1549 </answer> 1550 </qandaentry> 1551 1552 <qandaentry> 1553 <question> 1554 1555 <para><indexterm> 1556 <primary>validate</primary> 1557 </indexterm><indexterm> 1558 <primary>connectivity</primary> 1559 </indexterm><indexterm> 1560 <primary>migration</primary> 1561 </indexterm> 1562 Why did you validate connectivity before attempting migration? 1563 </para> 1564 1565 </question> 1566 <answer> 1567 1568 <para> 1569 Access validation before attempting to migrate NT4 domain accounts helps to pinpoint 1570 potential problems that may otherwise affect or impede account migration. I am always 1571 mindful of the 4 P's of migration: Planning Prevents Poor Performance. 1572 </para> 1573 1574 </answer> 1575 </qandaentry> 1576 1577 <qandaentry> 1578 <question> 1579 1580 <para> 1581 How would you merge 10 tdbsam-based domains into an LDAP database? 1582 </para> 1583 1584 </question> 1585 <answer> 1586 1587 <para><indexterm> 1588 <primary>risk</primary> 1589 </indexterm><indexterm> 1590 <primary>dump</primary> 1591 </indexterm><indexterm> 1592 <primary>tdbsam</primary> 1593 </indexterm><indexterm> 1594 <primary>Samba Domain</primary> 1595 </indexterm><indexterm> 1596 <primary>UID</primary> 1597 </indexterm><indexterm> 1598 <primary>GID</primary> 1599 </indexterm><indexterm> 1600 <primary>pdbedit</primary> 1601 </indexterm><indexterm> 1602 <primary>transfer</primary> 1603 </indexterm><indexterm> 1604 <primary>smbpasswd</primary> 1605 </indexterm><indexterm> 1606 <primary>LDAP</primary> 1607 </indexterm><indexterm> 1608 <primary>tool</primary> 1609 </indexterm> 1610 If you have 10 tdbsam Samba domains, there is considerable risk that there are a number of 1611 accounts that have the same UNIX identifier (UID/GID). This means that you almost 1612 certainly have to edit a lot of data. It would be easiest to dump each database in smbpasswd 1613 file format and then manually edit all records to ensure that each has a unique UID. Each 1614 file can then be imported a number of ways. You can use the <command>pdbedit</command> tool 1615 to affect a transfer from the smbpasswd file to LDAP, or you can migrate them en masse to 1616 tdbsam and then to LDAP. The final choice is yours. Just remember to verify all accounts that 1617 you have migrated before handing over access to a user. After all, too many users with a bad 1618 migration experience may threaten your career. 1619 </para> 1620 1621 </answer> 1622 </qandaentry> 1623 1624 <qandaentry> 1625 <question> 1626 1627 <para><indexterm> 1628 <primary>machine accounts</primary> 1629 </indexterm><indexterm> 1630 <primary>accounts</primary> 1631 <secondary>machine</secondary> 1632 </indexterm> 1633 I want to change my domain name after I migrate all accounts from an NT4 domain to a 1634 Samba-3 domain. Does it make any sense to migrate the machine accounts in that case? 1635 </para> 1636 1637 </question> 1638 <answer> 1639 1640 <para><indexterm> 1641 <primary>registry</primary> 1642 </indexterm><indexterm> 1643 <primary>un-join</primary> 1644 </indexterm><indexterm> 1645 <primary>rejoin</primary> 1646 </indexterm><indexterm> 1647 <primary>tattooing</primary> 1648 </indexterm> 1649 I would recommend not to migrate the machine account. The machine accounts should still work, but there are registry entries 1650 on each Windows NT4 and upward client that have a tattoo of the old domain name. If you 1651 unjoin the domain and then rejoin the newly renamed Samba-3 domain, you can be certain to avoid 1652 this tattooing effect. 1653 </para> 1654 1655 </answer> 1656 </qandaentry> 1657 1658 <qandaentry> 1659 <question> 1660 1661 <para><indexterm> 1662 <primary>multiple group mappings</primary> 1663 </indexterm> 1664 After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why? 1665 </para> 1666 1667 </question> 1668 <answer> 1669 1670 <para><indexterm> 1671 <primary>/etc/passwd</primary> 1672 </indexterm><indexterm> 1673 <primary>/etc/group</primary> 1674 </indexterm> 1675 Samba-3 currently does not implement multiple group membership internally. If you use the Windows 1676 NT4 Domain User Manager to manage accounts and you have an LDAP backend, the multiple group 1677 membership is stored in the POSIX groups area. If you use either tdbsam or smbpasswd backend, 1678 then multiple group membership is handled through the UNIX groups file. When you dump the user 1679 accounts, no group account information is provided. When you edit (change) UIDs and GIDs in each 1680 file to which you migrated the NT4 Domain data, do not forget to edit the UNIX <filename>/etc/passwd</filename> 1681 and <filename>/etc/group</filename> information also. That is where the multiple group information 1682 is most closely at your fingertips. 1683 </para> 1684 1685 </answer> 1686 </qandaentry> 1687 1688 <qandaentry> 1689 <question> 1690 1691 <para> 1692 How can I reset group membership after loading the account information into the LDAP database? 1693 </para> 1694 1695 </question> 1696 <answer> 1697 1698 <para><indexterm> 1699 <primary>SRVTOOLS.EXE</primary> 1700 </indexterm> 1701 You can use the NT4 Domain User Manager that can be downloaded from the Microsoft Web site. The 1702 installation file is called <filename>SRVTOOLS.EXE</filename>. 1703 </para> 1704 1705 </answer> 1706 </qandaentry> 1707 1708 <qandaentry> 1709 <question> 1710 1711 <para><indexterm> 1712 <primary>group names</primary> 1713 </indexterm> 1714 What are the limits or constraints that apply to group names? 1715 </para> 1716 1717 </question> 1718 <answer> 1719 1720 <para><indexterm> 1721 <primary>limit</primary> 1722 </indexterm><indexterm> 1723 <primary>shadow-utils</primary> 1724 </indexterm><indexterm> 1725 <primary>groupadd</primary> 1726 </indexterm><indexterm> 1727 <primary>groupdel</primary> 1728 </indexterm><indexterm> 1729 <primary>groupmod</primary> 1730 </indexterm><indexterm> 1731 <primary>account names</primary> 1732 </indexterm> 1733 A Windows 200x group name can be up to 254 characters long, while in Windows NT4 the group 1734 name is limited to 20 characters. Most UNIX systems limit this to 32 characters. Windows 1735 groups can contain upper- and lowercase characters, as well as spaces. 1736 Many UNIX system do not permit the use of uppercase characters, and some do not permit the 1737 space character either. A number of systems (i.e., Linux) work fine with both uppercase 1738 and space characters in group names, but the shadow-utils package that provides the group 1739 control functions (<command>groupadd</command>, <command>groupmod</command>, <command>groupdel</command>, and so on) do not permit them. 1740 Also, a number of UNIX systems management tools enforce their own particular interpretation 1741 of the POSIX standards and likewise do not permit uppercase or space characters in group 1742 or user account names. You have to experiment with your system to find what its 1743 peculiarities are. 1744 </para> 1745 1746 </answer> 1747 </qandaentry> 1748 1749 <qandaentry> 1750 <question> 1751 1752 <para><indexterm> 1753 <primary>vampire</primary> 1754 </indexterm> 1755 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 1756 LDAP backend system using the vampire process? 1757 </para> 1758 1759 </question> 1760 <answer> 1761 1762 <para> 1763 UNIX UIDs and GIDs on most UNIX systems use an unsigned short or an unsigned integer. Recent Linux 1764 kernels support at least a much larger number. On systems that have a 16-bit constraint on UID/GIDs, 1765 you would not be able to migrate 323,000 accounts because this number cannot fit into a 16-bit unsigned 1766 integer. UNIX/Linux systems that have a 32-bit UID/GID can easily handle this number of accounts. 1767 Please check this carefully before you attempt to effect a migration using the vampire process. 1768 </para> 1769 1770 <para><indexterm> 1771 <primary>Migration speed</primary> 1772 </indexterm> 1773 Migration speed depends much on the processor speed, the network speed, disk I/O capability, and 1774 LDAP update overheads. On a dual processor AMD MP1600+ with 1 GB memory that was mirroring LDAP 1775 to a second identical system over 1 Gb Ethernet, I was able to migrate around 180 user accounts 1776 per minute. Migration would obviously go much faster if LDAP mirroring were turned off during the migration. 1777 </para> 1778 1779 </answer> 1780 </qandaentry> 1781 1782 </qandaset> 1783 1784</sect1> 1785 1786</chapter> 1787 1788