1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�8.�Migrating NT4 Domain to Samba-3</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.66.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="2000users.html" title="Chapter�7.�A Distributed 2000 User Network"><link rel="next" href="nw4migration.html" title="Chapter�9.�Migrating NetWare 4.11 Server to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�8.�Migrating NT4 Domain to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="2000users.html">Prev</a>�</td><th width="60%" align="center">�</th><td width="20%" align="right">�<a accesskey="n" href="nw4migration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="migration"></a>Chapter�8.�Migrating NT4 Domain to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="migration.html#id2570469">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="migration.html#id2570564">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="migration.html#id2570623">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="migration.html#id2570815">Technical Issues</a></span></dt><dt><span class="sect2"><a href="migration.html#id2571217">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="migration.html#id2571243">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="migration.html#id2571269">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="migration.html#id2571964">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="migration.html#id2572352">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="migration.html#id2572391">Questions and Answers</a></span></dt></dl></div><p> 2 Ever since Microsoft announced that they are discontinuing support for Windows 3 NT4, Samba users started to ask for detailed instructions for how to migrate 4 from NT4 to Samba-3. This chapter provides background information that should 5 meet these needs. 6 </p><p> 7 One wonders how many NT4 systems will be left in service by the time you read this 8 book though. 9 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2570469"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id2570476"></a> 10 Network administrators who want to migrate off a Windows NT4 environment know 11 one thing with certainty. They feel that NT4 has been abandoned and they want 12 to update. The desire to get off NT4 and to not adopt Windows 200x and Active 13 Directory is driven by a mixture of concerns over complexity, cost, fear of 14 failure, and much more. 15 </p><p><a class="indexterm" name="id2570493"></a><a class="indexterm" name="id2570501"></a><a class="indexterm" name="id2570512"></a><a class="indexterm" name="id2570524"></a> 16 The migration from NT4 to Samba-3 can involve a number of factors, including: 17 migration of data to another server, migration of network environment controls 18 such as group policies, and finally migration of the users, groups, and machine 19 accounts. 20 </p><p><a class="indexterm" name="id2570542"></a> 21 It should be pointed out now that it is possible to migrate some systems from 22 Windows NT4 Domain environments to a Samba-3 Domain Environment. This is certainly 23 not possible in every case. It is possible to just migrate the Domain accounts 24 to Samba-3 and then to switch machines, but as a hands-off transition, this is more 25 an exception than the rule. Most systems require some tweaking and adjusting 26 following migration before an environment that is acceptable for immediate use 27 is obtained. 28 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2570564"></a>Assignment Tasks</h3></div></div></div><p><a class="indexterm" name="id2570571"></a><a class="indexterm" name="id2570579"></a><a class="indexterm" name="id2570587"></a> 29 You are about to migrate an MS Windows NT4 Domain accounts database to 30 a Samba-3 server. The Samba-3 server is using a 31 <i class="parameter"><tt>passdb backend</tt></i> based on LDAP. The 32 <tt class="constant">ldapsam</tt> is ideal because an LDAP backend can be distributed 33 for use with BDCs generally essential for larger networks. 34 </p><p> 35 Your objective is to document the process of migrating user and group accounts 36 from several NT4 Domains into a single Samba-3 LDAP backend database. 37 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2570623"></a>Dissection and Discussion</h2></div></div></div><p><a class="indexterm" name="id2570629"></a><a class="indexterm" name="id2570637"></a><a class="indexterm" name="id2570645"></a><a class="indexterm" name="id2570660"></a><a class="indexterm" name="id2570674"></a><a class="indexterm" name="id2570682"></a> 38 The migration process takes a snap-shot of information that is stored in the 39 Windows NT4 registry based accounts database. That information resides in 40 the Security Account Manager (SAM) portion of the NT4 Registry under keys called 41 <tt class="constant">SAM</tt> and <tt class="constant">SECURITY</tt>. 42 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p><a class="indexterm" name="id2570709"></a><a class="indexterm" name="id2570716"></a> 43 The Windows NT4 registry keys called <tt class="constant">SAM</tt> and <tt class="constant">SECURITY</tt> 44 are protected so that you cannot view the contents. If you change the security setting 45 to reveal the contents under these hive keys, your Windows NT4 Domain is crippled. Do not 46 do this unless you are willing to render your domain controller inoperative. 47 </p></div><p><a class="indexterm" name="id2570740"></a><a class="indexterm" name="id2570751"></a> 48 Before commencing an NT4 to Samba-3 migration, you should consider what your objectives are. 49 While in some cases it is possible simply to migrate an NT4 domain to a single Samba-3 server, 50 that may not be a good idea from an administration perspective. Since you are going through a 51 certain amount of disruptive activity anyhow, why not take this as an opportunity to review 52 the structure of the network, how Windows clients are controlled and how they 53 interact with the network environment. 54 </p><p><a class="indexterm" name="id2570770"></a><a class="indexterm" name="id2570782"></a><a class="indexterm" name="id2570790"></a> 55 MS Windows NT4 was introduced some time around 1996. Many environments in which NT4 was deployed 56 have done little to keep the NT4 server environment up-to-date with more recent Windows releases, 57 particularly Windows XP Professional. The migration provides opportunity to revise and update 58 roaming profile deployment as well as folder redirection. Given that you must port the 59 greater network configuration of this from the old NT4 server to the new Samba-3 server, you 60 also must validate the security descriptors in the profiles share as well as network logon 61 scripts. Feedback from sites that are migrating to Samba-3 suggests that many are using this 62 as a good time to update desktop systems also. In all, the extra effort should constitute no 63 real disruption to users, rather with due diligence and care should make their network experience 64 a much happier one. 65 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2570815"></a>Technical Issues</h3></div></div></div><p><a class="indexterm" name="id2570822"></a> 66 Migration of an NT4 Domain user and group database to Samba-3 involves a certain strategic 67 element. Many sites have asked for instructions regarding merging of multiple different NT4 68 Domains into one Samba-3 LDAP database. It would appear that this is viewed as a significant 69 added value compared with the alternative of migration to Windows Server 200x and Active 70 Directory. The diagram in <a href="migration.html#ch8-migration" title="Figure�8.1.�Schematic Explaining the net rpc vampire Process">???</a> illustrates the effect of migration 71 from a Windows NT4 Domain to a Samba Domain. 72 </p><div class="figure"><a name="ch8-migration"></a><p class="title"><b>Figure�8.1.�Schematic Explaining the net rpc vampire Process</b></p><div class="mediaobject"><img src="images/ch8-migration.png" width="297" alt="Schematic Explaining the net rpc vampire Process"></div></div><p> 73 In any case, the migration process involves the following steps: 74 </p><div class="itemizedlist"><ul type="disc"><li><p> 75 Prepare the target Samba-3 server. This involves configuring Samba-3 for 76 migration to either a tdbsam or an ldapsam backend. 77 </p></li><li><p><a class="indexterm" name="id2570907"></a><a class="indexterm" name="id2570914"></a><a class="indexterm" name="id2570922"></a> 78 Clean up the source NT4 PDC. Delete all accounts that need not be migrated. 79 Delete all files that should not be migrated. Where possible, change NT Group 80 names so there are no spaces or uppercase characters. This is important if 81 the target UNIX host insists on Posix compliant all lower-case user and group 82 names. 83 </p></li><li><p> 84 Step through the migration process. 85 </p></li><li><p><a class="indexterm" name="id2570945"></a> 86 Remove the NT4 PDC from the network. 87 </p></li><li><p> 88 Upgrade the Samba-3 server from a BDC to a PDC, and validate all account 89 information. 90 </p></li></ul></div><p><a class="indexterm" name="id2570964"></a><a class="indexterm" name="id2570972"></a> 91 If you are wanting to merge multiple NT4 Domain account databases into one Samba Domain, 92 you must now dump the contents of the first migration and edit it as appropriate. Now clean 93 out (remove) the tdbsam backend file (<tt class="filename">passdb.tdb</tt>), or the LDAP database 94 files. You must start each migration with a new database into which you merge your NT4 95 domains. 96 </p><p><a class="indexterm" name="id2570995"></a> 97 At this point, you are ready to perform the second migration following the same steps as 98 for the first. In other words, dump the database, edit it, and then you may merge the 99 dump for the first and second migrations. 100 </p><p><a class="indexterm" name="id2571010"></a><a class="indexterm" name="id2571018"></a><a class="indexterm" name="id2571026"></a> 101 You must be careful. If you choose to migrate to an LDAP backend, your dump file 102 now contains the full account information, including the Domain SID. The Domain SID for each 103 of the two NT4 Domains will be different. You must choose one, and change the Domain 104 portion of the account SIDs so that all are the same. 105 </p><p><a class="indexterm" name="id2571042"></a><a class="indexterm" name="id2571050"></a><a class="indexterm" name="id2571058"></a><a class="indexterm" name="id2571066"></a><a class="indexterm" name="id2571073"></a><a class="indexterm" name="id2571081"></a><a class="indexterm" name="id2571089"></a><a class="indexterm" name="id2571097"></a><a class="indexterm" name="id2571105"></a><a class="indexterm" name="id2571113"></a><a class="indexterm" name="id2571121"></a><a class="indexterm" name="id2571129"></a> 106 If you choose to use a tdbsam (<tt class="filename">passdb.tdb</tt>) backend file, your best choice 107 is to use <span><b class="command">pdbedit</b></span> to export the contents of the tdbsam file into an 108 smbpasswd data file. This automatically strips out all Domain specific information, 109 such as logon hours, logon machines, logon script, profile path, as well as the Domain SID. 110 The resulting file can be easily merged with other migration attempts (each of which must start 111 with a clean file). It should also be noted that all users that end up in the merged smbpasswd 112 file must have an account in <tt class="filename">/etc/passwd</tt>. The resulting smbpasswd file 113 may be exported/imported into either a tdbsam (<tt class="filename">passdb.tdb</tt>), or else into 114 an LDAP backend. 115 </p><div class="figure"><a name="NT4DUM"></a><p class="title"><b>Figure�8.2.�View of Accounts in NT4 Domain User Manager</b></p><div class="mediaobject"><img src="images/UserMgrNT4.png" width="270" alt="View of Accounts in NT4 Domain User Manager"></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2571217"></a>Political Issues</h3></div></div></div><p> 116 The merging of multiple Windows NT4 style Domains into a single LDAP-backend-based Samba-3 117 Domain may be seen by those who had power over them as a loss of prestige or a loss of 118 power. The imposition of a single Domain may even be seen as a threat. So in migrating and 119 merging account databases, be consciously aware of the political fall-out in which you 120 may find yourself entangled when key staff feel a loss of prestige. 121 </p><p> 122 The best advice that can be given to those who set out to merge NT4 Domains into one single 123 Samba-3 Domain is to promote (sell) the action as one that reduces costs and delivers 124 greater network interoperability and manageability. 125 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2571243"></a>Implementation</h2></div></div></div><p> 126 You can present here the steps and example output for two NT4 to Samba-3 Domain migrations. The 127 first uses an LDAP-based backend, and the second uses a tdbsam backend. In each case the 128 scripts you specify in the <tt class="filename">smb.conf</tt> file for the <i class="parameter"><tt>add user script</tt></i> 129 collection of parameters are used to effect the addition of accounts into the passdb backend. 130 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2571269"></a>NT4 Migration Using LDAP Backend</h3></div></div></div><p> 131 In this instance, you migrate an NT4 PDC to an LDAP backend. The accounts you are about 132 to migrate are shown in <a href="migration.html#NT4DUM" title="Figure�8.2.�View of Accounts in NT4 Domain User Manager">???</a>. In this example you make use of the 133 smbldap-tools scripts to add the accounts that are migrated into the ldapsam passdb backend. 134 Four scripts are essential to the migration process. There are other scripts that will be required 135 for daily management, but these are not critical to migration. The critical scripts are dependant 136 on which passdb backend is being used. Refer to <a href="migration.html#ch8-vampire" title="Table�8.1.�Samba smb.conf Scripts Essential to Migration">???</a> to see which scripts 137 must be provided so that the migration process can complete. 138 </p><p> 139 Do verify that you have correctly specified in the <tt class="filename">smb.conf</tt> file the scripts, and arguments 140 that should be passed to them, before attempting to perform the account migration. 141 </p><div class="table"><a name="ch8-vampire"></a><p class="title"><b>Table�8.1.�Samba <tt class="filename">smb.conf</tt> Scripts Essential to Migration</b></p><table summary="Samba smb.conf Scripts Essential to Migration" border="1"><colgroup><col align="left"><col align="center"><col align="center"></colgroup><thead><tr><th align="left">Entity</th><th align="center">ldapsam Script</th><th align="center">tdbsam Script</th></tr></thead><tbody><tr><td align="left">Add User Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr><tr><td align="left">Delete User Accounts</td><td align="center">smbldap-userdel</td><td align="center">userdel</td></tr><tr><td align="left">Add Group Accounts</td><td align="center">smbldap-groupadd</td><td align="center">groupadd</td></tr><tr><td align="left">Delete Group Accounts</td><td align="center">smbldap-groupdel</td><td align="center">groupdel</td></tr><tr><td align="left">Add User to Group</td><td align="center">smbldap-groupmod</td><td align="center">usermod (See Note)</td></tr><tr><td align="left">Add Machine Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr></tbody></table></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 142 The UNIX/Linux <span><b class="command">usermod</b></span> utility does not permit simple user addition to (or deletion 143 of users from) groups. This is a feature provided by the smbldap-tools scripts. If you want this 144 capability you will need to create your own tool to do this. Alternately, you can search the web 145 to locate a utility called <span><b class="command">groupmem</b></span> (by George Kraft) that provides this functionality. 146 The <span><b class="command">groupmem</b></span> utility was contributed to the shadow package but has not surfaced 147 in the formal commands provided by Linux distributions (March 2004). 148 </p></div><p> 149 Before starting the migration, all dead accounts were removed using the User Manager for Domains. 150 </p><div class="procedure"><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 151The <span><b class="command">tdbdump</b></span> utility is a utility that you can build from the Samba source 152code tree. Not all Linux binary distributions include this tool. If it is missing from your 153Linux distribution you will need to build this yourself, or else for-go its use. 154</p></div><ol type="1"><li><p> 155 Install and configure the Samba-3 server precisely as shown in Chapter 6 for the server 156 called <tt class="constant">MASSIVE</tt>. The Domain name <tt class="constant">MEGANET</tt> must 157 match that of the NT4 Domain from which you are about to migrate. Do not execute any Samba 158 executables. 159 </p></li><li><p><a class="indexterm" name="id2571512"></a><a class="indexterm" name="id2571520"></a> 160 Edit the <tt class="filename">smb.conf</tt> file to temporarily change the parameter 161 <a class="indexterm" name="id2571536"></a>domain master = No so 162 the Samba server functions as a BDC for the purpose of migration. Also, temporarily 163 (only during domain account migration) comment out the lines that specify deletion 164 scripts (delete user script, etc.). 165 </p></li><li><p><a class="indexterm" name="id2571553"></a> 166 Create a file called <tt class="filename">preload.LDIF</tt> as shown in <a href="migration.html#ch8-LDIF" title="Example�8.1.�LDAP Preload LDIF file preload.LDIF">???</a>. 167 Edit the contents so that the domain name and SID are correct for the site being installed. 168 </p></li><li><p><a class="indexterm" name="id2571583"></a> 169 Preload the LDAP database so it is ready to receive the information from the NT4 PDC. 170 This pre-loads the LDAP directory with the top-level information, as well as the 171 top level containers for user, group, computer, and domain account data. Execute the 172 instruction shown here: 173</p><pre class="screen"> 174<tt class="prompt">root# </tt> slapadd -v -l preload.LDIF 175added: "dc=abmas,dc=biz" (00000001) 176added: "cn=Manager,dc=abmas,dc=biz" (00000002) 177added: "ou=People,dc=abmas,dc=biz" (00000003) 178added: "ou=Computers,dc=abmas,dc=biz" (00000004) 179added: "ou=Groups,dc=abmas,dc=biz" (00000005) 180added: "ou=Idmap,dc=abmas,dc=biz" (00000006) 181added: "sambaDomainName=MEGANET,dc=abmas,dc=biz" (00000007) 182</pre><p> 183 </p></li><li><p> 184 Start the LDAP server. 185 </p></li><li><p><a class="indexterm" name="id2571627"></a> 186 Verify that the NT4 PDC can be reached: 187</p><pre class="screen"> 188<tt class="prompt">root# </tt> ping nt4s 189PING nt4s.abmas.biz (192.168.2.250) 56(84) bytes of data. 19064 bytes from NT4S (192.168.2.250): icmp_seq=1 ttl=128 time=10.2 ms 19164 bytes from NT4S (192.168.2.250): icmp_seq=2 ttl=128 time=0.518 ms 19264 bytes from NT4S (192.168.2.250): icmp_seq=3 ttl=128 time=0.578 ms 193 194--- nt4s.abmas.biz ping statistics --- 1953 packets transmitted, 3 received, 0% packet loss, time 2003ms 196rtt min/avg/max/mdev = 0.518/3.773/10.223/4.560 ms 197</pre><p> 198 It can. Great. 199 </p></li><li><p><a class="indexterm" name="id2571661"></a> 200 Validate that the resources on the NT4 PDC can be listed: 201</p><pre class="screen"> 202<tt class="prompt">root# </tt> smbclient -L nt4s -UAdministrator%not24get 203 204 Sharename Type Comment 205 --------- ---- ------- 206 NETLOGON Disk Logon server share 207 IPC$ IPC Remote IPC 208 UserProfiles Disk All Network User Profiles 209 210 Server Comment 211 --------- ------- 212 NT4S 213 214 Workgroup Master 215 --------- ------- 216 MEGANET NT4S 217</pre><p> 218 This looks good. 219 </p></li><li><p><a class="indexterm" name="id2571697"></a><a class="indexterm" name="id2571704"></a> 220 At this point, it is necessary to fetch the Domain SID from the NT4 PDC and 221 apply that to the Samba-3 BDC (soon to be PDC): 222</p><pre class="screen"> 223<tt class="prompt">root# </tt> net rpc getsid -S NT4S -W MEGANET 224Storing SID S-1-5-21-1988699175-926296742-1295600288 for 225 Domain MEGANET in secrets.tdb 226</pre><p> 227 Done. 228 </p></li><li><p><a class="indexterm" name="id2571742"></a><a class="indexterm" name="id2571750"></a><a class="indexterm" name="id2571758"></a> 229 At this point, you can validate that the information is correct in the 230 <tt class="filename">secrets.tdb</tt> file, as shown here: 231</p><pre class="screen"> 232<tt class="prompt">root# </tt> tdbdump /etc/samba/secrets.tdb 233{ 234key = "SECRETS/SID/MASSIVE" 235data = "\01\04\00\00\00\00\00\05\15\00\00\00'$\89v\A6*67\A0J9M\ 23600\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\ 23700\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00" 238} 239{ 240key = "SECRETS/LDAP_BIND_PW/cn=Manager,dc=abmas,dc=biz" 241data = "not24get\00" 242} 243</pre><p> 244 This has returned the information expected. 245 </p></li><li><p><a class="indexterm" name="id2571812"></a> 246 We are ready to join the NT4 Domain as a BDC by executing the following: 247</p><pre class="screen"> 248<tt class="prompt">root# </tt> net rpc join -S NT4S -W MEGANET -U Administrator%not24get 249Joined domain MEGANET. 250</pre><p> 251 Done. 252 </p></li><li><p><a class="indexterm" name="id2571848"></a> 253 The Samba-3 BDC is now ready to receive the NT4 PDC accounts database, as shown here: 254</p><pre class="screen"> 255<tt class="prompt">root# </tt> net rpc vampire -S NT4S 256Fetching DOMAIN database 257SAM_DELTA_DOMAIN_INFO not handled 258Creating account: Administrator 259Creating account: Guest 260Creating account: NT4S$ 261Creating account: massive$ 262Creating account: barryf 263Creating account: gdaison 264Creating account: atrikhoffer 265Creating account: hramsbotham 266Creating account: fsellerby 267Creating account: jrhapsody 268Group members of Domain Admins: 269Group members of Domain Users: NT4S$(primary),massive$(primary), 270Group members of Domain Guests: nobody(primary), 271Group members of rubberboot: 272Group members of engineers: 273Group members of accounting: 274Group members of catalyst: 275Group members of shipping: 276Group members of receiving: 277Group members of marketiod: 278Group members of sales: 279Fetching BUILTIN database 280SAM_DELTA_DOMAIN_INFO not handled 281</pre><p> 282 </p></li><li><p><a class="indexterm" name="id2571894"></a><a class="indexterm" name="id2571902"></a> 283 Edit the <tt class="filename">smb.conf</tt> file to reset the parameter 284 <a class="indexterm" name="id2571918"></a>domain master = Yes so that 285 the Samba server functions as a PDC for the purpose of migration. 286 </p></li></ol></div><div class="example"><a name="ch8-LDIF"></a><p class="title"><b>Example�8.1.�LDAP Preload LDIF file <tt class="filename">preload.LDIF</tt></b></p><pre class="screen"> 287dn: dc=abmas,dc=biz 288objectClass: dcObject 289objectClass: organization 290dc: abmas 291o: Abmas Demo 292description: POSIX and Samba LDAP Identity Database 293 294dn: ou=People,dc=abmas,dc=biz 295objectClass: top 296objectClass: organizationalUnit 297ou: People 298 299dn: ou=Groups,dc=abmas,dc=biz 300objectClass: top 301objectClass: organizationalUnit 302ou: Groups 303 304dn: ou=Idmap,dc=abmas,dc=biz 305objectClass: top 306objectClass: organizationalUnit 307ou: Idmap 308 309dn: sambaDomainName=MEGANET2,dc=abmas,dc=biz 310objectClass: sambaDomain 311objectClass: sambaUnixIdPool 312sambaDomainName: MEGANET 313sambaSID: S-1-5-21-1988699175-926296742-1295600288 314uidNumber: 1000 315gidNumber: 1000 316</pre></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2571964"></a>NT4 Migration Using tdbsam Backend</h3></div></div></div><p> 317 In this example, you have chosen to change the Domain name of the NT4 server from 318 <tt class="constant">DRUGPREP</tt> to <tt class="constant">MEGANET</tt> prior to the use 319 of the vampire (migration) tool. This migration process makes use of Linux system tools 320 (like <span><b class="command">useradd</b></span>) to add the accounts that are migrated into the 321 UNIX/Linux <tt class="filename">/etc/passwd</tt>, and <tt class="filename">/etc/group</tt> 322 databases. These entries must therefore be present, and correct options specified, 323 in your <tt class="filename">smb.conf</tt> file or else the migration does not work as it should. 324 </p><div class="procedure"><ol type="1"><li><p> 325 Prepare a Samba-3 server precisely per the instructions shown in Chapter 5. 326 Set the workgroup name to <tt class="constant">MEGANET</tt>. 327 </p></li><li><p><a class="indexterm" name="id2572030"></a><a class="indexterm" name="id2572038"></a> 328 Edit the <tt class="filename">smb.conf</tt> file to temporarily change the parameter 329 <a class="indexterm" name="id2572054"></a>domain master = No so 330 the Samba server functions as a BDC for the purpose of migration. 331 </p></li><li><p> 332 Start Samba as you have done previously. 333 </p></li><li><p><a class="indexterm" name="id2572076"></a> 334 Join the NT4 Domain as a BDC, as shown here: 335</p><pre class="screen"> 336<tt class="prompt">root# </tt> net rpc join -S oldnt4pdc -W MEGANET -UAdministrator%not24get 337Joined domain MEGANET. 338</pre><p> 339 </p></li><li><p><a class="indexterm" name="id2572110"></a> 340 You may vampire the accounts from the NT4 PDC by executing the command, as shown here: 341</p><pre class="screen"> 342<tt class="prompt">root# </tt> net rpc vampire -S oldnt4pdc -U Administrator%not24get 343Fetching DOMAIN database 344SAM_DELTA_DOMAIN_INFO not handled 345Creating unix group: 'Domain Admins' 346Creating unix group: 'Domain Users' 347Creating unix group: 'Domain Guests' 348Creating unix group: 'Engineers' 349Creating unix group: 'Marketoids' 350Creating unix group: 'Account Operators' 351Creating unix group: 'Administrators' 352Creating unix group: 'Backup Operators' 353Creating unix group: 'Guests' 354Creating unix group: 'Print Operators' 355Creating unix group: 'Replicator' 356Creating unix group: 'Server Operators' 357Creating unix group: 'Users' 358Creating account: Administrator 359Creating account: Guest 360Creating account: oldnt4pdc$ 361Creating account: jacko 362Creating account: maryk 363Creating account: bridge 364Creating account: sharpec 365Creating account: jimbo 366Creating account: dhenwick 367Creating account: dork 368Creating account: blue 369Creating account: billw 370Creating account: massive$ 371Group members of Engineers: Administrator, 372 sharpec(primary),bridge,billw(primary),dhenwick 373Group members of Marketoids: Administrator,jacko(primary), 374 maryk(primary),jimbo,blue(primary),dork(primary) 375Creating unix group: 'Gnomes' 376Fetching BUILTIN database 377SAM_DELTA_DOMAIN_INFO not handled 378</pre><p> 379 </p></li><li><p><a class="indexterm" name="id2572165"></a> 380 At this point, we can validate our migration. Let's look at the accounts 381 in the form as they would be seen in a smbpasswd file. This achieves that: 382</p><pre class="screen"> 383<tt class="prompt">root# </tt> pdbedit -Lw 384Administrator:505:84B0D8E14D158FF8417EAF50CFAC29C3: 385 AF6DD3FD4E2EA8BDE1695A3F05EFBF52:[UX ]:LCT-3DF7AA9F: 386jimbo:512:6E9A2A51F64A1BD5C187B8085FE1D9DF: 387 CDF7E305E639966E489A0CEFB95EE5E0:[UX ]:LCT-3E9362BC: 388sharpec:511:E4301A7CD8FDD1EC6BBF9BC19CDF8151: 389 7000255938831D5B948C95C1931534C5:[UX ]:LCT-3E8B42C4: 390dhenwick:513:DCD8886141E3F892AAD3B435B51404EE: 391 2DB36465949CB938DD98C312EFDC2639:[UX ]:LCT-3E939F41: 392bridge:510:3FE6873A43101B46417EAF50CFAC29C3: 393 891741F481AF111B4CAA09A94016BD01:[UX ]:LCT-3E8B4291: 394blue:515:256D41D2559BB3D2AAD3B435B51404EE: 395 9CCADDA4F7D281DD0FAD321478C6F971:[UX ]:LCT-3E939FDC: 396diamond$:517:6C8E7B64EDCDBC4218B6345447A4454B: 397 3323AC63C666CFAACB60C13F65D54E9A:[S ]:LCT-00000000: 398oldnt4pdc$:507:3E39430CDCABB5B09ED320D0448AE568: 399 95DBAF885854A919C7C7E671060478B9:[S ]:LCT-3DF7AA9F: 400Guest:506:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX: 401 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[DUX ]:LCT-3E93A008: 402billw:516:85380CA7C21B6EBE168C8150662AF11B: 403 5D7478508293709937E55FB5FBA14C17:[UX ]:LCT-3FED7CA1: 404dork:514:78C70DDEC35A35B5AAD3B435B51404EE: 405 0AD886E015AC595EC0AF40E6C9689E1A:[UX ]:LCT-3E939F9A: 406jacko:508:BC472F3BF9A0A5F63832C92FC614B7D1: 407 0C6822AAF85E86600A40DC73E40D06D5:[UX ]:LCT-3E8B4242: 408maryk:509:3636AB7E12EBE79AB79AE2610DD89D4C: 409 CF271B744F7A55AFDA277FF88D80C527:[UX ]:LCT-3E8B4270: 410</pre><p> 411 </p></li><li><p><a class="indexterm" name="id2572242"></a> 412 An expanded view of a user account entry shows more of what was 413 obtained from the NT4 PDC: 414</p><pre class="screen"> 415sleeth:~ # pdbedit -Lv maryk 416Unix username: maryk 417NT username: maryk 418Account Flags: [UX ] 419User SID: S-1-5-21-1988699175-926296742-1295600288-1003 420Primary Group SID: S-1-5-21-1988699175-926296742-1295600288-1007 421Full Name: Mary Kathleen 422Home Directory: \\diamond\maryk 423HomeDir Drive: X: 424Logon Script: scripts\logon.bat 425Profile Path: \\diamond\profiles\maryk 426Domain: MEGANET 427Account desc: Peace Maker 428Workstations: 429Munged dial: 430Logon time: 0 431Logoff time: Mon, 18 Jan 2038 20:14:07 GMT 432Kickoff time: Mon, 18 Jan 2038 20:14:07 GMT 433Password last set: Wed, 02 Apr 2003 13:05:04 GMT 434Password can change: 0 435Password must change: Mon, 18 Jan 2038 20:14:07 GMT 436</pre><p> 437 </p></li><li><p><a class="indexterm" name="id2572277"></a> 438 And this command lists the long names of the groups that have been 439 imported (vampired) from the NT4 PDC: 440</p><pre class="screen"> 441<tt class="prompt">root# </tt> net group -l -Uroot%not24get -Smassive 442 443Group name Comment 444----------------------------- 445Engineers Snake Oil Engineers 446Marketoids Untrustworthy Hype Vendors 447Gnomes Plain Vanilla Garden Gnomes 448Replicator Supports file replication in a domain 449Guests Users granted guest access to the computer/domain 450Administrators Members can fully administer the computer/domain 451Users Ordinary users 452</pre><p> 453 Everything looks well and in order. 454 </p></li><li><p><a class="indexterm" name="id2572317"></a><a class="indexterm" name="id2572325"></a> 455 Edit the <tt class="filename">smb.conf</tt> file to reset the parameter 456 <a class="indexterm" name="id2572340"></a>domain master = Yes so 457 the Samba server functions as a PDC for the purpose of migration. 458 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2572352"></a>Key Points Learned</h3></div></div></div><p> 459 Migration of an NT4 PDC database to a Samba-3 PDC is possible. 460 </p><div class="itemizedlist"><ul type="disc"><li><p> 461 An LDAP backend is a suitable vehicle for NT4 migrations. 462 </p></li><li><p> 463 A tdbsam backend can be used to perform a migration. 464 </p></li><li><p> 465 Multiple NT4 Domains can be merged into a single Samba-3 466 Domain. 467 </p></li><li><p> 468 The net Samba-3 Domain most likely requires some 469 administration and updating before going live. 470 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2572391"></a>Questions and Answers</h2></div></div></div><p> 471 </p><div class="qandaset"><dl><dt> <a href="migration.html#id2572406">clean database 472 Why must I start each migration with a clean database? 473 </a></dt><dt> <a href="migration.html#id2572447">Domain SID 474 Is it possible to set my Domain SID to anything I like? 475 </a></dt><dt> <a href="migration.html#id2572504">/etc/passwd/etc/grouptdbsampassdb backendaccountsuseraccountsgroupaccountsDomain 476 When using a tdbsam passdb backend, why must I have all Domain user and group accounts 477 in /etc/passwd and /etc/group? 478 </a></dt><dt> <a href="migration.html#id2572678">validateconnectivitymigration 479 Why did you validate connectivity before attempting migration? 480 </a></dt><dt> <a href="migration.html#id2572727"> 481 How would you merge 10 tdbsam-based domains into an LDAP database? 482 </a></dt><dt> <a href="migration.html#id2572849">machine accountsaccountsmachine 483 I want to change my Domain name after I migrate all accounts from an NT4 Domain to a 484 Samba-3 Domain. Does it make any sense to migrate the machine accounts in that case? 485 </a></dt><dt> <a href="migration.html#id2572924">multiple group mappings 486 After merging multiple NT4 Domains into a Samba-3 Domain, I lost all multiple group mappings. Why? 487 </a></dt><dt> <a href="migration.html#id2572989"> 488 How can I reset group membership after loading the account information into the LDAP database? 489 </a></dt><dt> <a href="migration.html#id2573023">group names 490 What are the limits or constraints that apply to group names? 491 </a></dt><dt> <a href="migration.html#id2573117">vampire 492 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 493 LDAP backend system using the vampire process? 494 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2572406"></a><a name="id2572409"></a><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2572412"></a> 495 Why must I start each migration with a clean database? 496 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2572427"></a> 497 This is a recommendation that permits the data from each NT4 Domain to 498 be kept separate until you are ready to merge them. Also, if you do not do this, 499 you may find errors due to users or groups from multiple Domains having the 500 same name, but different SIDs. It is better to permit each migration to complete 501 without undue errors and then to handle the merging of vampired data under 502 proper supervision. 503 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2572447"></a><a name="id2572449"></a><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2572452"></a> 504 Is it possible to set my Domain SID to anything I like? 505 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2572467"></a><a class="indexterm" name="id2572475"></a><a class="indexterm" name="id2572483"></a> 506 Yes, so long as the SID you create has the same structure as an auto-generated SID. 507 The typical SID looks like this: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX, where 508 the XXXXXXXXXX can be any number with from 6 to 10 digits. On the other hand, why 509 would you really want to create your own SID? I cannot think of a good reason. 510 You may want to set the SID to one that is already in use somewhere on your network, 511 but that is a little different from straight out creating your own Domain SID. 512 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2572504"></a><a name="id2572506"></a><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2572509"></a><a class="indexterm" name="id2572517"></a><a class="indexterm" name="id2572525"></a><a class="indexterm" name="id2572533"></a><a class="indexterm" name="id2572541"></a><a class="indexterm" name="id2572552"></a><a class="indexterm" name="id2572563"></a> 513 When using a tdbsam passdb backend, why must I have all Domain user and group accounts 514 in <tt class="filename">/etc/passwd</tt> and <tt class="filename">/etc/group</tt>? 515 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2572595"></a><a class="indexterm" name="id2572602"></a><a class="indexterm" name="id2572610"></a><a class="indexterm" name="id2572618"></a><a class="indexterm" name="id2572626"></a><a class="indexterm" name="id2572634"></a> 516 Samba-3 must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba 517 does not fabricate the UNIX IDs from thin air, but rather requires them to be located 518 in a suitable place. 519 </p><p> 520 When migrating a <tt class="filename">smbpasswd</tt> file to an LDAP backend, the 521 UID of each account is taken together with the account information in the 522 <tt class="filename">/etc/passwd</tt> and both sets of data are used to create the account 523 entrt in the LDAP database. 524 </p><p> 525 If you elect to create the Posix account also, the entire UNIX account is copied to the 526 LDAP backend. The same occurs with NT groups and UNIX groups. At the conclusion of 527 migration to the LDAP database, the accounts may be removed from the UNIX database files. 528 In short then, all UNIX and Windows networking accounts, both in tdbsam as well as in 529 LDAP, require UIDs/GIDs. 530 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2572678"></a><a name="id2572680"></a><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2572683"></a><a class="indexterm" name="id2572691"></a><a class="indexterm" name="id2572699"></a> 531 Why did you validate connectivity before attempting migration? 532 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p> 533 Access validation before attempting to migrate NT4 Domain accounts helps to pin-point 534 potential problems that may otherwise affect or impede account migration. I am always 535 mindful of the 4P's of migration Planning Prevents Poor Performance. 536 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2572727"></a><a name="id2572729"></a><b></b></td><td align="left" valign="top"><p> 537 How would you merge 10 tdbsam-based domains into an LDAP database? 538 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2572740"></a><a class="indexterm" name="id2572747"></a><a class="indexterm" name="id2572755"></a><a class="indexterm" name="id2572763"></a><a class="indexterm" name="id2572771"></a><a class="indexterm" name="id2572778"></a><a class="indexterm" name="id2572786"></a><a class="indexterm" name="id2572794"></a><a class="indexterm" name="id2572802"></a><a class="indexterm" name="id2572810"></a><a class="indexterm" name="id2572818"></a> 539 If you have 10 tdbsam Samba Domains, there is considerable risk that there are a number of 540 accounts that have the same UNIX identifier (UID/GID). This means that you almost 541 certainly have to edit a lot of data. It would be easiest to dump each database in smbpasswd 542 file format and then manually edit all records to ensure that each has a unique UID. Each 543 file can then be imported a number of ways. You can use the <span><b class="command">pdbedit</b></span> tool, 544 to affect a transfer from the smbpasswd file to LDAP, or you can migrate them en masse to 545 tdbsam and then to LDAP. The final choice is yours. Just remember to verify all accounts that 546 you have migrated before handing over access to a user. After all, too many users with a bad 547 migration experience may threaten your career. 548 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2572849"></a><a name="id2572851"></a><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2572854"></a><a class="indexterm" name="id2572862"></a> 549 I want to change my Domain name after I migrate all accounts from an NT4 Domain to a 550 Samba-3 Domain. Does it make any sense to migrate the machine accounts in that case? 551 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2572883"></a><a class="indexterm" name="id2572891"></a><a class="indexterm" name="id2572898"></a><a class="indexterm" name="id2572906"></a> 552 I would recommend not. The machine accounts should still work, but there are registry entries 553 on each Windows NT4 and upward client that have a tattoo of the old domain name. If you 554 un-join the domain and then rejoin the newly renamed Samba-3 Domain, you can be certain to avoid 555 this tattooing effect. 556 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2572924"></a><a name="id2572926"></a><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2572929"></a> 557 After merging multiple NT4 Domains into a Samba-3 Domain, I lost all multiple group mappings. Why? 558 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2572946"></a><a class="indexterm" name="id2572953"></a> 559 Samba-3 currently does not implement multiple group membership internally. If you use the Windows 560 NT4 Domain User Manager to manage accounts and you have an LDAP backend, the multiple group 561 membership is stored in the Posix groups area. If you use either tdbsam or smbpasswd backend, 562 then multiple group membership is handled through the UNIX groups file. When you dump the user 563 accounts no group account information is provided. When you edit (change) UIDs and GIDs in each 564 file to which you migrated the NT4 Domain data, do not forget to edit the UNIX <tt class="filename">/etc/passwd</tt> 565 and <tt class="filename">/etc/group</tt> information also. That is where the multiple group information 566 is most closely at your fingertips. 567 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2572989"></a><a name="id2572991"></a><b></b></td><td align="left" valign="top"><p> 568 How can I reset group membership after loading the account information into the LDAP database? 569 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573002"></a> 570 You can use the NT4 Domain User Manager that can be downloaded from the Microsoft Web site. The 571 installation file is called <tt class="filename">SRVTOOLS.EXE</tt>. 572 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2573023"></a><a name="id2573025"></a><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573028"></a> 573 What are the limits or constraints that apply to group names? 574 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573044"></a><a class="indexterm" name="id2573052"></a><a class="indexterm" name="id2573060"></a><a class="indexterm" name="id2573068"></a><a class="indexterm" name="id2573075"></a><a class="indexterm" name="id2573083"></a> 575 A Windows 200x group name can be up to 254 characters long, while in Windows NT4 the group 576 name is limited to 20 characters. Most UNIX systems limit this to 32 characters. Windows 577 groups can contain upper- and lower-case characters, as well as spaces. 578 Many UNIX system do not permit the use of upper-case characters, and some do not permit the 579 space character either. A number of systems (i.e., Linux) work fine with both upper-case 580 and space characters in group names, but the shadow-utils package that provides the group 581 control functions (<span><b class="command">groupadd, groupmod, groupdel</b></span>, and so on) do not permit them. 582 Also, a number of UNIX systems management tools enforce their own particular interpretation 583 of the Posix standards, and likewise do not permit upper-case or space characters in group 584 or user account names. You have to experiment with your system to find what its 585 peculiarities are. 586 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2573117"></a><a name="id2573119"></a><b></b></td><td align="left" valign="top"><p><a class="indexterm" name="id2573122"></a> 587 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 588 LDAP backend system using the vampire process? 589 </p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p> 590 UNIX UIDs and GIDs on most UNIX systems use an unsigned short or an unsigned integer. Recent Linux 591 kernels support at least a much larger number. On systems that have a 16-bit constraint on UID/GIDs, 592 you would not be able to migrate 323,000 accounts because this number can not fit into a 16-bit unsigned 593 integer. UNIX/Linux systems that have a 32-bit UID/GID can easily handle this number of accounts. 594 Please check this carefully before you attempt to effect a migration using the vampire process. 595 </p><p><a class="indexterm" name="id2573151"></a> 596 Migration speed depends much on the processor speed, the network speed, disk I/O capability, and 597 LDAP update overheads. On a dual processor AMD MP1600+ with 1 GB memory, that was mirroring LDAP 598 to a second identical system over 1 gigabit ethernet, I was able to migrate around 180 user accounts 599 per minute. Migration would obviously go much faster if LDAP mirroring is turned off during the migration. 600 </p></td></tr></tbody></table></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="2000users.html">Prev</a>�</td><td width="20%" align="center"><a accesskey="u" href="index.html">Up</a></td><td width="40%" align="right">�<a accesskey="n" href="nw4migration.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter�7.�A Distributed 2000 User Network�</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">�Chapter�9.�Migrating NetWare 4.11 Server to Samba-3</td></tr></table></div></body></html> 601
