1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
3 <chapter id="ntmigration">
4 <title>Migrating NT4 Domain to Samba-3</title>
7 Ever since Microsoft announced that it was discontinuing support for Windows
8 NT4, Samba users started to ask for detailed instructions on how to migrate
9 from NT4 to Samba-3. This chapter provides background information that should
14 One wonders how many NT4 systems will be left in service by the time you read this
19 <title>Introduction</title>
22 <primary>migration</primary>
24 Network administrators who want to migrate off a Windows NT4 environment know
25 one thing with certainty. They feel that NT4 has been abandoned, and they want
26 to update. The desire to get off NT4 and to not adopt Windows 200x and Active
27 Directory is driven by a mixture of concerns over complexity, cost, fear of
28 failure, and much more.
32 <indexterm><primary>group policies</primary></indexterm>
33 <indexterm><primary>accounts</primary><secondary>user</secondary></indexterm>
34 <indexterm><primary>accounts</primary><secondary>group</secondary></indexterm>
35 <indexterm><primary>accounts</primary><secondary>machine</secondary></indexterm>
36 The migration from NT4 to Samba-3 can involve a number of factors, including
37 migration of data to another server, migration of network environment controls
38 such as group policies, and migration of the users, groups, and machine
43 <indexterm><primary>accounts</primary><secondary>Domain</secondary></indexterm>
44 It should be pointed out now that it is possible to migrate some systems from
45 a Windows NT4 domain environment to a Samba-3 domain environment. This is certainly
46 not possible in every case. It is possible to just migrate the domain accounts
47 to Samba-3 and then to switch machines, but as a hands-off transition, this is more
48 the exception than the rule. Most systems require some tweaking after
49 migration before an environment that is acceptable for immediate use
54 <title>Assignment Tasks</title>
57 <indexterm><primary>LDAP</primary></indexterm>
58 <indexterm><primary>ldapsam</primary></indexterm>
59 <indexterm><primary>passdb backend</primary></indexterm>
60 You are about to migrate an MS Windows NT4 domain accounts database to
61 a Samba-3 server. The Samba-3 server is using a
62 <parameter>passdb backend</parameter> based on LDAP. The
63 <constant>ldapsam</constant> is ideal because an LDAP backend can be distributed
64 for use with BDCs &smbmdash; generally essential for larger networks.
68 Your objective is to document the process of migrating user and group accounts
69 from several NT4 domains into a single Samba-3 LDAP backend database.
76 <title>Dissection and Discussion</title>
79 <indexterm><primary>snap-shot</primary></indexterm>
80 <indexterm><primary>NT4 registry</primary></indexterm>
81 <indexterm><primary>registry</primary><secondary>keys</secondary><tertiary>SAM</tertiary></indexterm>
82 <indexterm><primary>registry</primary><secondary>keys</secondary><tertiary>SECURITY</tertiary></indexterm>
83 <indexterm><primary>SAM</primary></indexterm>
84 <indexterm><primary>Security Account Manager</primary><see>SAM</see></indexterm>
85 The migration process takes a snapshot of information that is stored in the
86 Windows NT4 registry-based accounts database. That information resides in
87 the Security Account Manager (SAM) portion of the NT4 registry under keys called
88 <constant>SAM</constant> and <constant>SECURITY</constant>.
92 <indexterm><primary>crippled</primary></indexterm>
93 <indexterm><primary>inoperative</primary></indexterm>
94 The Windows NT4 registry keys called <constant>SAM</constant> and <constant>SECURITY</constant>
95 are protected so that you cannot view the contents. If you change the security setting
96 to reveal the contents under these hive keys, your Windows NT4 domain is crippled. Do not
97 do this unless you are willing to render your domain controller inoperative.
101 <indexterm><primary>migration</primary><secondary>objectives</secondary></indexterm>
102 <indexterm><primary>disruptive</primary></indexterm>
103 Before commencing an NT4 to Samba-3 migration, you should consider what your objectives are.
104 While in some cases it is possible simply to migrate an NT4 domain to a single Samba-3 server,
105 that may not be a good idea from an administration perspective. Since the process involves going
106 through a certain amount of disruptive activity anyhow, why not take this opportunity to
107 review the structure of the network, how Windows clients are controlled and how they
108 interact with the network environment.
112 <indexterm><primary>network</primary><secondary>logon scripts</secondary></indexterm>
113 <indexterm><primary>profiles share</primary></indexterm>
114 <indexterm><primary>security descriptors</primary></indexterm>
115 MS Windows NT4 was introduced some time around 1996. Many environments in which NT4 was deployed
116 have done little to keep the NT4 server environment up to date with more recent Windows releases,
117 particularly Windows XP Professional. The migration provides opportunity to revise and update
118 roaming profile deployment as well as folder redirection. Given that you must port the
119 greater network configuration of this from the old NT4 server to the new Samba-3 server.
120 Do not forget to validate the security descriptors in the profiles share as well as network logon
121 scripts. Feedback from sites that are migrating to Samba-3 suggests that many are using this
122 as a good time to update desktop systems also. In all, the extra effort should constitute no
123 real disruption to users, but rather, with due diligence and care should make their network experience
128 <title>Technical Issues</title>
131 <indexterm><primary>strategic</primary></indexterm>
132 <indexterm><primary>active directory</primary></indexterm>
133 Migration of an NT4 domain user and group database to Samba-3 involves a certain strategic
134 element. Many sites have asked for instructions regarding merging of multiple NT4
135 domains into one Samba-3 LDAP database. It seems that this is viewed as a significant
136 added value compared with the alternative of migration to Windows Server 200x and Active
137 Directory. The diagram in <link linkend="ch8-migration"/> illustrates the effect of migration
138 from a Windows NT4 domain to a Samba domain.
141 <figure id="ch8-migration">
142 <title>Schematic Explaining the <command>net rpc vampire</command> Process</title>
143 <imagefile scale="55">ch8-migration</imagefile>
147 <indexterm><primary>merge</primary></indexterm>
148 <indexterm><primary>passdb.tdb</primary></indexterm>
149 If you want to merge multiple NT4 domain account databases into one Samba domain,
150 you must now dump the contents of the first migration and edit it as appropriate. Now clean
151 out (remove) the tdbsam backend file (<filename>passdb.tdb</filename>) or the LDAP database
152 files. You must start each migration with a new database into which you merge your NT4
157 <primary>dump</primary>
159 At this point, you are ready to perform the second migration, following the same steps as
160 for the first. In other words, dump the database, edit it, and then you may merge the
161 dump for the first and second migrations.
165 <primary>LDAP</primary>
166 </indexterm><indexterm>
167 <primary>migrate</primary>
168 </indexterm><indexterm>
169 <primary>Domain SID</primary>
171 You must be careful. If you choose to migrate to an LDAP backend, your dump file
172 now contains the full account information, including the domain SID. The domain SID for each
173 of the two NT4 domains will be different. You must choose one and change the domain
174 portion of the account SIDs so that all are the same.
178 <indexterm><primary>passdb.tdb</primary></indexterm>
179 <indexterm><primary>/etc/passwd</primary></indexterm>
180 <indexterm><primary>merged</primary></indexterm>
181 <indexterm><primary>logon script</primary></indexterm>
182 <indexterm><primary>logon hours</primary></indexterm>
183 <indexterm><primary>logon machines</primary></indexterm>
184 <indexterm><primary>profile path</primary></indexterm>
185 <indexterm><primary>smbpasswd</primary></indexterm>
186 <indexterm><primary>tdbsam</primary></indexterm>
187 <indexterm><primary>LDAP backend</primary></indexterm>
188 <indexterm><primary>export</primary></indexterm>
189 <indexterm><primary>import</primary></indexterm>
190 If you choose to use a tdbsam (<filename>passdb.tdb</filename>) backend file, your best choice
191 is to use <command>pdbedit</command> to export the contents of the tdbsam file into an
192 smbpasswd data file. This automatically strips out all domain-specific information,
193 such as logon hours, logon machines, logon script, profile path, as well as the domain SID.
194 The resulting file can be easily merged with other migration attempts (each of which must start
195 with a clean file). It should also be noted that all users who end up in the merged smbpasswd
196 file must have an account in <filename>/etc/passwd</filename>. The resulting smbpasswd file
197 may be exported or imported into either a tdbsam (<filename>passdb.tdb</filename>) or
202 <title>View of Accounts in NT4 Domain User Manager</title>
203 <imagefile scale="50">UserMgrNT4</imagefile>
210 <title>Political Issues</title>
213 The merging of multiple Windows NT4-style domains into a single LDAP-backend-based Samba-3
214 domain may be seen by those who had power over them as a loss of prestige or a loss of
215 power. The imposition of a single domain may even be seen as a threat. So in migrating and
216 merging account databases, be consciously aware of the political fall-out in which you
217 may find yourself entangled when key staff feel a loss of prestige.
221 The best advice that can be given to those who set out to merge NT4 domains into a single
222 Samba-3 domain is to promote (sell) the action as one that reduces costs and delivers
223 greater network interoperability and manageability.
231 <title>Implementation</title>
234 From feedback on the Samba mailing lists, it seems that most Windows NT4 migrations
235 to Samba-3 are being performed using a new server or a new installation of a Linux or UNIX
236 server. If you contemplate doing this, please note that the steps that follow in this
237 chapter assume familiarity with the information that has been previously covered in this
238 book. You are particularly encouraged to be familiar with <link linkend="secure"/>,
239 <link linkend="Big500users"/> and <link linkend="happy"/>.
243 We present here the steps and example output for two NT4 to Samba-3 domain migrations. The
244 first uses an LDAP-based backend, and the second uses a tdbsam backend. In each case the
245 scripts you specify in the &smb.conf; file for the <parameter>add user script</parameter>
246 collection of parameters are used to effect the addition of accounts into the passdb backend.
250 Before proceeding to NT4 migration using either a tdbsam or ldapsam, it is most strongly recommended to
251 review <link linkend="ch5-dnshcp-setup"/> for DNS and DHCP configuration. The importance of correctly
252 functioning name resolution must be recognized. This applies equally for both hostname and NetBIOS names
253 (machine names, computer names, domain names, workgroup names &smbmdash; ALL names!).
257 The migration process involves the following steps:
262 Prepare the target Samba-3 server. This involves configuring Samba-3 for
263 migration to either a tdbsam or an ldapsam backend.
267 <indexterm><primary>uppercase</primary></indexterm>
268 <indexterm><primary>Posix</primary></indexterm>
269 <indexterm><primary>lower-case</primary></indexterm>
270 Clean up the source NT4 PDC. Delete all accounts that need not be migrated.
271 Delete all files that should not be migrated. Where possible, change NT group
272 names so there are no spaces or uppercase characters. This is important if
273 the target UNIX host insists on POSIX-compliant all lowercase user and group
278 Step through the migration process.
281 <listitem><para><indexterm><primary>PDC</primary></indexterm>
282 Remove the NT4 PDC from the network.
286 Upgrade the Samba-3 server from a BDC to a PDC, and validate all account
292 It may help to use the above outline as a pre-migration checklist.
296 <title>NT4 Migration Using LDAP Backend</title>
299 In this example, the migration is of an NT4 PDC to a Samba-3 PDC with an LDAP backend. The accounts about
300 to be migrated are shown in <link linkend="NT4DUM"/>. In this example use is made of the
301 smbldap-tools scripts to add the accounts that are migrated into the ldapsam passdb backend.
302 Four scripts are essential to the migration process. Other scripts will be required
303 for daily management, but these are not critical to migration. The critical scripts are dependant
304 on which passdb backend is being used. Refer to <link linkend="ch8-vampire"/> to see which scripts
305 must be provided so that the migration process can complete.
309 Verify that you have correctly specified in the &smb.conf; file the scripts and arguments
310 that should be passed to them before attempting to perform the account migration. Note also
311 that the deletion scripts must be commented out during migration. These should be uncommented
312 following successful migration of the NT4 Domain accounts.
316 Under absolutely no circumstances should the Samba daemons be started until instructed to do so.
317 Delete the <filename>/etc/samba/secrets.tdb</filename> file and all Samba control tdb files
318 before commencing the following configuration steps.
321 <table id="ch8-vampire">
322 <title>Samba &smb.conf; Scripts Essential to Samba Operation</title>
324 <colspec align="left"/>
325 <colspec align="center"/>
326 <colspec align="center"/>
329 <entry>Entity</entry>
330 <entry>ldapsam Script</entry>
331 <entry>tdbsam Script</entry>
336 <entry>Add User Accounts</entry>
337 <entry>smbldap-useradd</entry>
338 <entry>useradd</entry>
341 <entry>Delete User Accounts</entry>
342 <entry>smbldap-userdel</entry>
343 <entry>userdel</entry>
346 <entry>Add Group Accounts</entry>
347 <entry>smbldap-groupadd</entry>
348 <entry>groupadd</entry>
351 <entry>Delete Group Accounts</entry>
352 <entry>smbldap-groupdel</entry>
353 <entry>groupdel</entry>
356 <entry>Add User to Group</entry>
357 <entry>smbldap-groupmod</entry>
358 <entry>usermod (See Note)</entry>
361 <entry>Add Machine Accounts</entry>
362 <entry>smbldap-useradd</entry>
363 <entry>useradd</entry>
370 <indexterm><primary>usermod</primary></indexterm>
371 <indexterm><primary>groupmem</primary></indexterm>
372 <indexterm><primary>smbldap-tools</primary></indexterm>
373 The UNIX/Linux <command>usermod</command> utility does not permit simple user addition to (or deletion
374 of users from) groups. This is a feature provided by the smbldap-tools scripts. If you want this
375 capability, you must create your own tool to do this. Alternately, you can search the Web
376 to locate a utility called <command>groupmem</command> (by George Kraft) that provides this functionality.
377 The <command>groupmem</command> utility was contributed to the shadow package but has not surfaced
378 in the formal commands provided by Linux distributions (March 2004).
382 <indexterm><primary>tdbdump</primary></indexterm>
383 The <command>tdbdump</command> utility is a utility that you can build from the Samba source-code tree. Not all Linux binary distributions include this tool. If it is missing from your
384 Linux distribution, you will need to build this yourself or else forgo its use.
388 <indexterm><primary>User Manager</primary></indexterm>
389 Before starting the migration, all dead accounts were removed from the NT4 domain using the User Manager for Domains.
393 <title>User Migration Steps</title>
396 Configure the Samba &smb.conf; file to create a BDC. An example configuration is
397 given in <link linkend="sbent4smb"/>.
398 The delete scripts are commented out so that during the process of migration
399 no account information can be deleted.
402 <example id="sbent4smb">
403 <title>NT4 Migration Samba-3 Server <filename>smb.conf</filename> &smbmdash; Part: A</title>
405 <smbconfsection name="[global]"/>
406 <smbconfoption name="workgroup">DAMNATION</smbconfoption>
407 <smbconfoption name="netbios name">MERLIN</smbconfoption>
408 <smbconfoption name="passdb backend">ldapsam:ldap://localhost</smbconfoption>
409 <smbconfoption name="log level">1</smbconfoption>
410 <smbconfoption name="syslog">0</smbconfoption>
411 <smbconfoption name="log file">/var/log/samba/%m</smbconfoption>
412 <smbconfoption name="max log size">0</smbconfoption>
413 <smbconfoption name="smb ports">139 445</smbconfoption>
414 <smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
415 <smbconfoption name="add user script">/opt/IDEALX/sbin/smbldap-useradd -m '%u'</smbconfoption>
416 <smbconfoption name="#delete user script">/opt/IDEALX/sbin/smbldap-userdel '%u'</smbconfoption>
417 <smbconfoption name="add group script">/opt/IDEALX/sbin/smbldap-groupadd '%g'</smbconfoption>
418 <smbconfoption name="#delete group script">/opt/IDEALX/sbin/smbldap-groupdel '%g'</smbconfoption>
419 <smbconfoption name="add user to group script">/opt/IDEALX/sbin/ smbldap-groupmod -m '%u' '%g'</smbconfoption>
420 <smbconfoption name="#delete user from group script">/opt/IDEALX/sbin/smbldap-groupmod -x '%u' '%g'</smbconfoption>
421 <smbconfoption name="set primary group script">/opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</smbconfoption>
422 <smbconfoption name="add machine script">/opt/IDEALX/sbin/smbldap-useradd -w '%u'</smbconfoption>
423 <smbconfoption name="logon script">scripts\logon.cmd</smbconfoption>
424 <smbconfoption name="logon path">\\%L\profiles\%U</smbconfoption>
425 <smbconfoption name="logon home">\\%L\%U</smbconfoption>
426 <smbconfoption name="logon drive">X:</smbconfoption>
427 <smbconfoption name="domain logons">Yes</smbconfoption>
428 <smbconfoption name="domain master">No</smbconfoption>
429 <smbconfoption name="#wins support">Yes</smbconfoption>
430 <smbconfoption name="wins server">192.168.123.124</smbconfoption>
431 <smbconfoption name="ldap admin dn">cn=Manager,dc=terpstra-world,dc=org</smbconfoption>
432 <smbconfoption name="ldap group suffix">ou=Groups</smbconfoption>
433 <smbconfoption name="ldap idmap suffix">ou=Idmap</smbconfoption>
434 <smbconfoption name="ldap machine suffix">ou=People</smbconfoption>
435 <smbconfoption name="ldap passwd sync">Yes</smbconfoption>
436 <smbconfoption name="ldap suffix">dc=terpstra-world,dc=org</smbconfoption>
437 <smbconfoption name="ldap ssl">no</smbconfoption>
438 <smbconfoption name="ldap timeout">20</smbconfoption>
439 <smbconfoption name="ldap user suffix">ou=People</smbconfoption>
440 <smbconfoption name="idmap backend">ldap:ldap://localhost</smbconfoption>
441 <smbconfoption name="idmap uid">15000-20000</smbconfoption>
442 <smbconfoption name="idmap gid">15000-20000</smbconfoption>
443 <smbconfoption name="winbind nested groups">Yes</smbconfoption>
444 <smbconfoption name="ea support">Yes</smbconfoption>
445 <smbconfoption name="map acl inherit">Yes</smbconfoption>
449 <example id="sbent4smb2">
450 <title>NT4 Migration Samba-3 Server <filename>smb.conf</filename> &smbmdash; Part: B</title>
452 <smbconfsection name="[apps]"/>
453 <smbconfoption name="comment">Application Data</smbconfoption>
454 <smbconfoption name="path">/data/home/apps</smbconfoption>
455 <smbconfoption name="read only">No</smbconfoption>
457 <smbconfsection name="[homes]"/>
458 <smbconfoption name="comment">Home Directories</smbconfoption>
459 <smbconfoption name="path">/home/users/%U/Documents</smbconfoption>
460 <smbconfoption name="valid users">%S</smbconfoption>
461 <smbconfoption name="read only">No</smbconfoption>
462 <smbconfoption name="browseable">No</smbconfoption>
464 <smbconfsection name="[printers]"/>
465 <smbconfoption name="comment">SMB Print Spool</smbconfoption>
466 <smbconfoption name="path">/var/spool/samba</smbconfoption>
467 <smbconfoption name="guest ok">Yes</smbconfoption>
468 <smbconfoption name="printable">Yes</smbconfoption>
469 <smbconfoption name="use client driver">No</smbconfoption>
470 <smbconfoption name="browseable">No</smbconfoption>
472 <smbconfsection name="[netlogon]"/>
473 <smbconfoption name="comment">Network Logon Service</smbconfoption>
474 <smbconfoption name="path">/var/lib/samba/netlogon</smbconfoption>
475 <smbconfoption name="guest ok">Yes</smbconfoption>
476 <smbconfoption name="locking">No</smbconfoption>
478 <smbconfsection name="[profiles]"/>
479 <smbconfoption name="comment">Profile Share</smbconfoption>
480 <smbconfoption name="path">/var/lib/samba/profiles</smbconfoption>
481 <smbconfoption name="read only">No</smbconfoption>
482 <smbconfoption name="profile acls">Yes</smbconfoption>
484 <smbconfsection name="[profdata]"/>
485 <smbconfoption name="comment">Profile Data Share</smbconfoption>
486 <smbconfoption name="path">/var/lib/samba/profdata</smbconfoption>
487 <smbconfoption name="read only">No</smbconfoption>
488 <smbconfoption name="profile acls">Yes</smbconfoption>
490 <smbconfsection name="[print$]"/>
491 <smbconfoption name="comment">Printer Drivers</smbconfoption>
492 <smbconfoption name="path">/var/lib/samba/drivers</smbconfoption>
497 <indexterm><primary>slapd.conf</primary></indexterm>
498 Configure OpenLDAP in preparation for the migration. An example
499 <filename>sladp.conf</filename> file is shown in <link linkend="sbentslapd"/>.
500 The <constant>rootpw</constant> value is an encrypted password string that can
501 be obtained by executing the <command>slappasswd</command> command.
504 <example id="sbentslapd">
505 <title>NT4 Migration LDAP Server Configuration File: <filename>/etc/openldap/slapd.conf</filename> &smbmdash; Part A</title>
507 include /etc/openldap/schema/core.schema
508 include /etc/openldap/schema/cosine.schema
509 include /etc/openldap/schema/inetorgperson.schema
510 include /etc/openldap/schema/nis.schema
511 include /etc/openldap/schema/samba3.schema
513 pidfile /var/run/slapd/slapd.pid
514 argsfile /var/run/slapd/slapd.args
520 access to attr=userPassword
524 access to attr=shadowLastChange
534 <example id="sbentslapd2">
535 <title>NT4 Migration LDAP Server Configuration File: <filename>/etc/openldap/slapd.conf</filename> &smbmdash; Part B</title>
546 suffix "dc=terpstra-world,dc=org"
547 rootdn "cn=Manager,dc=terpstra-world,dc=org"
550 rootpw {SSHA}86kTavd9Dw3FAz6qzWTrCOKX/c0Qe+UV
552 directory /var/lib/ldap
554 # Indices to maintain
558 index uid pres,sub,eq
559 index displayName pres,sub,eq
564 index sambaPrimaryGroupSID eq
565 index sambaDomainName eq
571 <indexterm><primary>nss_ldap</primary></indexterm>
572 <indexterm><primary>/etc/ldap.conf</primary></indexterm>
573 Install the PADL <command>nss_ldap</command> tool set, then configure the <filename>/etc/ldap.conf</filename>
574 as shown in <link linkend="sbrntldapconf"/>.
577 <example id="sbrntldapconf">
578 <title>NT4 Migration NSS LDAP File: <filename>/etc/ldap.conf</filename></title>
582 base dc=terpstra-world,dc=org
586 binddn cn=Manager,dc=terpstra-world,dc=org
591 nss_base_passwd ou=People,dc=terpstra-world,dc=org?one
592 nss_base_shadow ou=People,dc=terpstra-world,dc=org?one
593 nss_base_group ou=Groups,dc=terpstra-world,dc=org?one
600 <indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
601 Edit the <filename>/etc/nsswitch.conf</filename> file so it has the entries shown
602 in <link linkend="sbentnss"/>. Note that the LDAP entries have been commented out.
603 This is deliberate. If these entries are active (not commented out), and the
604 <filename>/etc/ldap.conf</filename> file has been configured, when the LDAP server
605 is started, the process of starting the LDAP server will cause LDAP lookups. This
606 causes the LDAP server <command>slapd</command> to hang because it finds port 389
607 open and therefore cannot gain exclusive control of it. By commenting these entries
608 out, it is possible to avoid this gridlock situation and thus the overall
609 installation and configuration will progress more smoothly.
612 <example id="sbentnss">
613 <title>NT4 Migration NSS Control File: <filename>/etc/nsswitch.conf</filename> (Stage:1)</title>
619 hosts: files dns wins
633 #passwd_compat: ldap #Not needed.
634 #group_compat: ldap #Not needed.
639 Validate the the target NT4 PDC name is being correctly resolved to its IP address by
640 executing the following:
642 &rootprompt; ping transgression
643 PING transgression.terpstra-world.org (192.168.1.5) 56(84) bytes of data.
644 64 bytes from (192.168.1.5): icmp_seq=1 ttl=128 time=0.159 ms
645 64 bytes from (192.168.1.5): icmp_seq=2 ttl=128 time=0.192 ms
646 64 bytes from (192.168.1.5): icmp_seq=3 ttl=128 time=0.141 ms
648 --- transgression.terpstra-world.org ping statistics ---
649 3 packets transmitted, 3 received, 0% packet loss, time 2000ms
650 rtt min/avg/max/mdev = 0.141/0.164/0.192/0.021 ms
652 Do not proceed to the next step if this step fails. It is imperative that the name of the PDC
653 can be resolved to its IP address. If this is broken, fix it.
657 Pull the domain SID from the NT4 domain that is being migrated as follows:
659 &rootprompt; net rpc getsid -S TRANGRESSION -U Administrator%not24get
660 Storing SID S-1-5-21-1385457007-882775198-1210191635 \
661 for Domain DAMNATION in secrets.tdb
666 Another way to obtain the domain SID from the target NT4 domain that is being
667 migrated to Samba-3 is by executing the following:
669 &rootprompt; net rpc info -S TRANSGRESSION
671 If this method is used, do not forget to store the SID obtained into the
672 <filename>secrets.tdb</filename> file. This can be done by executing:
674 &rootprompt; net setlocalsid S-1-5-21-1385457007-882775198-1210191635
679 <indexterm><primary>Idealx</primary></indexterm>
680 <indexterm><primary>configure.pl</primary></indexterm>
681 <indexterm><primary>/opt/IDEALX/sbin</primary></indexterm>
682 <indexterm><primary>smbldap-tools</primary></indexterm>
683 Install the Idealx <command>smbldap-tools</command> software package, following
684 the instructions given in <link linkend="sbeidealx"/>. The resulting perl scripts
685 should be located in the <filename>/opt/IDEALX/sbin</filename> directory.
686 Change into that location, or whereever the scripts have been installed. Execute the
687 <filename>configure.pl</filename> script to configure the Idealx package for use.
688 Note: Use the domain SID obtained from the step above. The following is
689 an example configuration session:
691 merlin:/opt/IDEALX/sbin # ./configure.pl
692 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
693 smbldap-tools script configuration
694 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
695 Before starting, check
696 . if your samba controller is up and running.
697 . if the domain SID is defined (you can get it with the 'net getlocalsid')
699 . you can leave the configuration using the Crtl-c key combination
700 . empty value can be set with the "." character
701 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
702 Looking for configuration files...
704 Samba Config File Location [/etc/samba/smb.conf] >
705 smbldap Config file Location (global parameters)
706 [/etc/smbldap-tools/smbldap.conf] >
707 smbldap Config file Location (bind parameters)
708 [/etc/smbldap-tools/smbldap_bind.conf] >
709 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
710 Let's start configuring the smbldap-tools scripts ...
712 . workgroup name: name of the domain Samba act as a PDC
713 workgroup name [DAMNATION] >
714 . netbios name: netbios name of the samba controller
715 netbios name [MERLIN] >
716 . logon drive: local path to which the home directory
717 will be connected (for NT Workstations). Ex: 'H:'
718 logon drive [X:] > H:
719 . logon home: home directory location (for Win95/98 or NT Workstation).
720 (use %U as username) Ex:'\\MERLIN\home\%U'
721 logon home (leave blank if you don't want homeDirectory)
722 [\\MERLIN\home\%U] > \\%L\%U
723 . logon path: directory where roaming profiles are stored.
724 Ex:'\\MERLIN\profiles\%U'
725 logon path (leave blank if you don't want roaming profile)
726 [\\MERLIN\profiles\%U] > \\%L\profiles\%U
727 . home directory prefix (use %U as username) [/home/%U] > /home/users/%U
728 . default user netlogon script (use %U as username)
729 [%U.cmd] > scripts\logon.cmd
730 default password validation time (time in days) [45] > 180
731 . ldap suffix [dc=terpstra-world,dc=org] >
732 . ldap group suffix [ou=Groups] >
733 . ldap user suffix [ou=People] >
734 . ldap machine suffix [ou=People] >
735 . Idmap suffix [ou=Idmap] >
736 . sambaUnixIdPooldn: object where you want to store the next uidNumber
737 and gidNumber available for new users and groups
738 sambaUnixIdPooldn object (relative to ${suffix})
739 [cn=NextFreeUnixId] > sambaDomainName=DAMNATION
740 . ldap master server:
741 IP address or DNS name of the master (writable) ldap server
742 ldap master server [] > 127.0.0.1
743 . ldap master port [389] >
744 . ldap master bind dn [cn=Manager,dc=terpstra-world,dc=org] >
745 . ldap master bind password [] >
746 . ldap slave server: IP address or DNS name of the slave ldap server:
747 can also be the master one
748 ldap slave server [] > 127.0.0.1
749 . ldap slave port [389] >
750 . ldap slave bind dn [cn=Manager,dc=terpstra-world,dc=org] >
751 . ldap slave bind password [] >
752 . ldap tls support (1/0) [0] >
753 . SID for domain DAMNATION: SID of the domain
754 (can be obtained with 'net getlocalsid MERLIN')
755 SID for domain DAMNATION []
756 > S-1-5-21-1385457007-882775198-1210191635
757 . unix password encryption: encryption used for unix passwords
758 unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA) [SSHA] > MD5
759 . default user gidNumber [513] >
760 . default computer gidNumber [515] >
761 . default login shell [/bin/bash] >
762 . default domain name to append to mail address [] > terpstra-world.org
763 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
764 backup old configuration files:
765 /etc/smbldap-tools/smbldap.conf->
766 /etc/smbldap-tools/smbldap.conf.old
767 /etc/smbldap-tools/smbldap_bind.conf->
768 /etc/smbldap-tools/smbldap_bind.conf.old
769 writing new configuration file:
770 /etc/smbldap-tools/smbldap.conf done.
771 /etc/smbldap-tools/smbldap_bind.conf done.
773 <indexterm><primary>sambaDomainName</primary></indexterm>
774 Note that the NT4 domain SID that was previously obtained was entered above. Also,
775 the sambaUnixIdPooldn object was specified as sambaDomainName=DAMNATION. This is
776 the location into which the Idealx smbldap-tools store the next available UID/GID
777 information. It is also where Samba stores domain specific information such as the
778 next RID, the SID, and so on.
782 Start the LDAP server using the system interface script. On Novell SLES9
783 this is done as shown here:
785 &rootprompt; rcldap start
790 Edit the <filename>/etc/nsswitch.conf</filename> file so it has the entries shown in
791 <link linkend="sbentnss2"/>. Note that the LDAP entries have now been uncommented.
794 <example id="sbentnss2">
795 <title>NT4 Migration NSS Control File: <filename>/etc/nsswitch.conf</filename> (Stage:2)</title>
801 hosts: files dns wins
815 #passwd_compat: ldap #Not needed.
816 #group_compat: ldap #Not needed.
821 The LDAP management password must be installed into the <filename>secrets.tdb</filename>
824 &rootprompt; smbpasswd -w not24get
825 Setting stored password for
826 "cn=Manager,dc=terpstra-world,dc=org" in secrets.tdb
831 Populate the LDAP directory as shown here:
833 &rootprompt; /opt/IDEALX/sbin/smbldap-populate -a root -k 0 -m 0
834 Using workgroup name from sambaUnixIdPooldn (smbldap.conf):
835 sambaDomainName=DAMNATION
836 Using builtin directory structure
837 adding new entry: dc=terpstra-world,dc=org
838 adding new entry: ou=People,dc=terpstra-world,dc=org
839 adding new entry: ou=Groups,dc=terpstra-world,dc=org
840 entry ou=People,dc=terpstra-world,dc=org already exist.
841 adding new entry: ou=Idmap,dc=terpstra-world,dc=org
842 adding new entry: sambaDomainName=DAMNATION,dc=terpstra-world,dc=org
843 adding new entry: uid=root,ou=People,dc=terpstra-world,dc=org
844 adding new entry: uid=nobody,ou=People,dc=terpstra-world,dc=org
845 adding new entry: cn=Domain Admins,ou=Groups,dc=terpstra-world,dc=org
846 adding new entry: cn=Domain Users,ou=Groups,dc=terpstra-world,dc=org
847 adding new entry: cn=Domain Guests,ou=Groups,dc=terpstra-world,dc=org
848 adding new entry: cn=Domain Computers,ou=Groups,dc=terpstra-world,dc=org
849 adding new entry: cn=Administrators,ou=Groups,dc=terpstra-world,dc=org
850 adding new entry: cn=Print Operators,ou=Groups,dc=terpstra-world,dc=org
851 adding new entry: cn=Backup Operators,ou=Groups,dc=terpstra-world,dc=org
852 adding new entry: cn=Replicators,ou=Groups,dc=terpstra-world,dc=org
854 The script tries to add the ou=People container twice, hence the error message.
855 This is expected behavior.
859 <indexterm><primary>Novell SUSE SLES 9</primary></indexterm>
860 Restart the LDAP server following initialization of the LDAP directory. Execute the
861 system control script provided on your system. The following steps can be used on
864 &rootprompt; rcldap restart
865 &rootprompt; chkconfig ldap on
870 Verify that the new user accounts that have been added to the LDAP directory can be
873 &rootprompt; getent passwd
875 nobody:x:65534:65533:nobody:/var/lib/nobody:/bin/bash
876 man:x:13:62:Manual pages viewer:/var/cache/man:/bin/bash
877 news:x:9:13:News system:/etc/news:/bin/bash
878 uucp:x:10:14:Unix-to-Unix CoPy system:/etc/uucp:/bin/bash
880 root:x:0:0:Netbios Domain Administrator:/home/users/root:/bin/false
881 nobody:x:999:514:nobody:/dev/null:/bin/false
883 Now repeat this for the group accounts as shown here:
885 &rootprompt; getent group
888 nogroup:x:65534:nobody
891 Domain Admins:x:512:root
894 Domain Computers:x:515:
895 Administrators:x:544:
896 Print Operators:x:550:
897 Backup Operators:x:551:
900 In both cases the LDAP accounts follow the <quote>+::0:</quote> entry.
904 Now it is time to join the Samba BDC to the target NT4 domain that is being
905 migrated to Samba-3 by executing the following:
907 &rootprompt; net rpc join -S TRANSGRESSION -U Administrator%not24get
908 merlin:/opt/IDEALX/sbin # net rpc join -S TRANSGRESSION \
909 -U Administrator%not24get
910 Joined domain DAMNATION.
915 Set the new domain administrator (root) password for both UNIX and Windows as shown here:
917 &rootprompt; /opt/IDEALX/sbin/smbldap-passwd root
918 Changing password for root
919 New password : ********
920 Retype new password : ********
922 Note: During account migration, the Windows Administrator account will not be migrated
927 Now validate that these accounts can be resolved using Samba's tools as
928 shown here for user accounts:
930 &rootprompt; pdbedit -Lw
931 root:0:84B0D8E14D158FF8417EAF50CFAC29C3:
932 AF6DD3FD4E2EA8BDE1695A3F05EFBF52:[U ]:LCT-425F6467:
933 nobody:65534:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:
934 NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:[NU ]:LCT-00000000:
936 Now complete the following step to validate that group account mappings have
939 &rootprompt; net groupmap list
940 Domain Admins (S-1-5-21-1385457007-882775198-1210191635-512)
942 Domain Users (S-1-5-21-1385457007-882775198-1210191635-513)
944 Domain Guests (S-1-5-21-1385457007-882775198-1210191635-514)
946 Domain Computers (S-1-5-21-1385457007-882775198-1210191635-515)
947 -> Domain Computers
948 Administrators (S-1-5-32-544) -> Administrators
949 Print Operators (S-1-5-32-550) -> Print Operators
950 Backup Operators (S-1-5-32-551) -> Backup Operators
951 Replicators (S-1-5-32-552) -> Replicators
953 These are the expected results for a correctly configured system.
957 Commence migration as shown here:
959 &rootprompt; net rpc vampire -S TRANSGRESSION \
960 -U Administrator%not24get > /tmp/vampire.log 2>1
962 Check the vampire log to confirm that only expected errors have been
963 reported. See <link linkend="sbevam1"/>.
967 The migration of user accounts can be quickly validated as follows:
969 &rootprompt; pdbedit -Lw
970 root:0:84B0D8E14D158FF8417EAF50CFAC29C3:...
971 nobody:65534:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:...
972 Administrator:0:84B0D8E14D158FF8417EAF50CFAC29C3:...
973 Guest:1:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:...
974 TRANSGRESSION$:2:CC044B748CEE294CE76B6B0D1B86C1A8:...
975 IUSR_TRANSGRESSION:3:64046AC81B056C375F9537FC409085F8:...
976 MIDEARTH$:4:E93186E5819706D2AAD3B435B51404EE:...
977 atrickhoffer:5:DC08CFE0C12B2867352502E32A407F23:...
978 barryf:6:B829BCDE01FF24376E45D5F10408CFBD:...
979 fsellerby:7:6A97CBEBE8F9826B417EAF50CFAC29C3:...
980 gdaison:8:48F6A8C8A900024351DA8C2061C5F1D3:...
981 hrambotham:9:7330D9EA0964465EAAD3B435B51404EE:...
982 jrhapsody:10:ACBA7D207E2BA35D9BD41A26B01626BD:...
983 maryk:11:293B5A4CA41F6CA1A7D80430B8342B73:...
984 jacko:12:8E8982D86BD037C364BBD09A598E07AD:...
985 bridge:13:0D2CA7D2BE67FE2193BE3A377C968336:...
986 sharpec:14:8841A75CAC19D2855D8B73B1F4D430F8:...
987 jimbo:15:6E8BDC904FD9EC5C17306D272A9441BB:...
988 dhenwick:16:D1694A03C33584BDAAD3B435B51404EE:...
989 dork:17:69E2D19E69A593D5AAD3B435B51404EE:...
990 blue:18:E355EBF9559979FEAAD3B435B51404EE:...
991 billw:19:EE35C3481CF7F7DB484448BC86A641A5:...
992 rfreshmill:20:7EC033B58661B60CAAD3B435B51404EE:...
993 MAGGOT$:21:A3B9334765AD30F7AAD3B435B51404EE:...
994 TRENTWARE$:22:1D92C8DD5E7F0DDF93BE3A377C968336:...
995 MORTON$:23:89342E69DCA9D3F8AAD3B435B51404EE:...
996 NARM$:24:2B93E2D1D25448BDAAD3B435B51404EE:...
997 LAPDOG$:25:14AA535885120943AAD3B435B51404EE:...
998 SCAVENGER$:26:B6288EB6D147B56F8963805A19B0ED49:...
999 merlin$:27:820C50523F368C54AB9D85AE603AD09D:...
1004 The mapping of UNIX and Windows groups can be validated as show here:
1006 &rootprompt; net groupmap list
1007 Domain Admins (S-1-5-21-1385457007-882775198-1210191635-512)
1009 Domain Users (S-1-5-21-1385457007-882775198-1210191635-513)
1011 Domain Guests (S-1-5-21-1385457007-882775198-1210191635-514)
1013 Domain Computers (S-1-5-21-1385457007-882775198-1210191635-515)
1014 -> Domain Computers
1015 Administrators (S-1-5-32-544) -> Administrators
1016 Print Operators (S-1-5-32-550) -> Print Operators
1017 Backup Operators (S-1-5-32-551) -> Backup Operators
1018 Replicator (S-1-5-32-552) -> Replicators
1019 Engineers (S-1-5-21-1385457007-882775198-1210191635-1020) -> Engineers
1020 Marketoids (S-1-5-21-1385457007-882775198-1210191635-1022) -> Marketoids
1021 Gnomes (S-1-5-21-1385457007-882775198-1210191635-1023) -> Gnomes
1022 Catalyst (S-1-5-21-1385457007-882775198-1210191635-1024) -> Catalyst
1023 Recieving (S-1-5-21-1385457007-882775198-1210191635-1025) -> Recieving
1024 Rubberboot (S-1-5-21-1385457007-882775198-1210191635-1026) -> Rubberboot
1025 Sales (S-1-5-21-1385457007-882775198-1210191635-1027) -> Sales
1026 Accounting (S-1-5-21-1385457007-882775198-1210191635-1028) -> Accounting
1027 Shipping (S-1-5-21-1385457007-882775198-1210191635-1029) -> Shipping
1028 Account Operators (S-1-5-32-548) -> Account Operators
1029 Guests (S-1-5-32-546) -> Guests
1030 Server Operators (S-1-5-32-549) -> Server Operators
1031 Users (S-1-5-32-545) -> Users
1033 It is of vital importance that the domain SID portions of all group
1034 accounts are identical.
1038 The final responsibility in the migration process is to create identical
1039 shares and printing resources on the new Samba-3 server, copy all data
1040 across, set up privileges, and set share and file/directory access controls.
1044 <indexterm><primary>domain master</primary></indexterm>
1045 <indexterm><primary>PDC</primary></indexterm>
1046 Edit the &smb.conf; file to reset the parameter
1047 <smbconfoption name="domain master">Yes</smbconfoption> so that
1048 the Samba server functions as a PDC for the purpose of migration.
1049 Also, uncomment the deletion scripts so they will now be fully functional,
1050 enable the <parameter>wins support = yes</parameter> parameter and
1051 comment out the <parameter>wins server</parameter>. Validate the configuration
1052 with the <command>testparm</command> utility as shown here:
1054 &rootprompt; testparm
1055 Load smb config files from /etc/samba/smb.conf
1056 Processing section "[apps]"
1057 Processing section "[media]"
1058 Processing section "[homes]"
1059 Processing section "[printers]"
1060 Processing section "[netlogon]"
1061 Processing section "[profiles]"
1062 Processing section "[profdata]"
1063 Processing section "[print$]"
1064 Loaded services file OK.
1065 Server role: ROLE_DOMAIN_PDC
1066 Press enter to see a dump of your service definitions
1071 Now shut down the old NT4 PDC. Only when the old NT4 PDC and all
1072 NT4 BDCs have been shut down can the Samba-3 PDC be started.
1076 All workstations should function as they did with the old NT4 PDC. All
1077 interdomain trust accounts should remain in place and fully functional.
1078 All machine accounts and user logon accounts should also function correctly.
1082 The configuration of Samba-3 BDC servers can be accomplished now or at any
1083 convenient time in the future. Please refer to the carefully detailed process
1084 for doing so is outlined in <link linkend="sbehap-bldg1"/>.
1089 <sect3 id="sbevam1">
1090 <title>Migration Log Validation</title>
1093 The following <filename>vampire.log</filename> file is typical of a valid migration.
1095 adding user Administrator to group Domain Admins
1096 adding user atrickhoffer to group Engineers
1097 adding user dhenwick to group Engineers
1098 adding user dork to group Engineers
1099 adding user rfreshmill to group Marketoids
1100 adding user jacko to group Gnomes
1101 adding user jimbo to group Gnomes
1102 adding user maryk to group Gnomes
1103 adding user gdaison to group Gnomes
1104 adding user dhenwick to group Catalyst
1105 adding user jacko to group Catalyst
1106 adding user jacko to group Recieving
1107 adding user blue to group Recieving
1108 adding user hrambotham to group Rubberboot
1109 adding user billw to group Sales
1110 adding user bridge to group Sales
1111 adding user jrhapsody to group Sales
1112 adding user maryk to group Sales
1113 adding user rfreshmill to group Sales
1114 adding user fsellerby to group Sales
1115 adding user sharpec to group Sales
1116 adding user jimbo to group Accounting
1117 adding user gdaison to group Accounting
1118 adding user jacko to group Shipping
1119 adding user blue to group Shipping
1120 Fetching DOMAIN database
1121 Creating unix group: 'Engineers'
1122 Creating unix group: 'Marketoids'
1123 Creating unix group: 'Gnomes'
1124 Creating unix group: 'Catalyst'
1125 Creating unix group: 'Recieving'
1126 Creating unix group: 'Rubberboot'
1127 Creating unix group: 'Sales'
1128 Creating unix group: 'Accounting'
1129 Creating unix group: 'Shipping'
1130 Creating account: Administrator
1131 Creating account: Guest
1132 Creating account: TRANSGRESSION$
1133 Creating account: IUSR_TRANSGRESSION
1134 Creating account: MIDEARTH$
1135 Creating account: atrickhoffer
1136 Creating account: barryf
1137 Creating account: fsellerby
1138 Creating account: gdaison
1139 Creating account: hrambotham
1140 Creating account: jrhapsody
1141 Creating account: maryk
1142 Creating account: jacko
1143 Creating account: bridge
1144 Creating account: sharpec
1145 Creating account: jimbo
1146 Creating account: dhenwick
1147 Creating account: dork
1148 Creating account: blue
1149 Creating account: billw
1150 Creating account: rfreshmill
1151 Creating account: MAGGOT$
1152 Creating account: TRENTWARE$
1153 Creating account: MORTON$
1154 Creating account: NARM$
1155 Creating account: LAPDOG$
1156 Creating account: SCAVENGER$
1157 Creating account: merlin$
1158 Group members of Domain Admins: Administrator,
1159 Group members of Domain Users: Administrator(primary),
1160 TRANSGRESSION$(primary),IUSR_TRANSGRESSION(primary),
1161 MIDEARTH$(primary),atrickhoffer(primary),barryf(primary),
1162 fsellerby(primary),gdaison(primary),hrambotham(primary),
1163 jrhapsody(primary),maryk(primary),jacko(primary),bridge(primary),
1164 sharpec(primary),jimbo(primary),dhenwick(primary),dork(primary),
1165 blue(primary),billw(primary),rfreshmill(primary),MAGGOT$(primary),
1166 TRENTWARE$(primary),MORTON$(primary),NARM$(primary),
1167 LAPDOG$(primary),SCAVENGER$(primary),merlin$(primary),
1168 Group members of Domain Guests: Guest(primary),
1169 Group members of Engineers: atrickhoffer,dhenwick,dork,
1170 Group members of Marketoids: rfreshmill,
1171 Group members of Gnomes: jacko,jimbo,maryk,gdaison,
1172 Group members of Catalyst: dhenwick,jacko,
1173 Group members of Recieving: jacko,blue,
1174 Group members of Rubberboot: hrambotham,
1175 Group members of Sales: billw,bridge,jrhapsody,maryk,
1176 rfreshmill,fsellerby,sharpec,
1177 Group members of Accounting: jimbo,gdaison,
1178 Group members of Shipping: jacko,blue,
1179 Fetching BUILTIN database
1180 skipping SAM_DOMAIN_INFO delta for 'Builtin' (is not my domain)
1181 Creating unix group: 'Account Operators'
1182 Creating unix group: 'Guests'
1183 Creating unix group: 'Server Operators'
1184 Creating unix group: 'Users'
1193 <title>NT4 Migration Using tdbsam Backend</title>
1196 In this example, we change the domain name of the NT4 server from
1197 <constant>DRUGPREP</constant> to <constant>MEGANET</constant> prior to the use
1198 of the vampire (migration) tool. This migration process makes use of Linux system tools
1199 (like <command>useradd</command>) to add the accounts that are migrated into the
1200 UNIX/Linux <filename>/etc/passwd</filename> and <filename>/etc/group</filename>
1201 databases. These entries must therefore be present, and correct options specified,
1202 in your &smb.conf; file, or else the migration does not work as it should.
1206 <title>Migration Steps Using tdbsam</title>
1209 Prepare a Samba-3 server precisely per the instructions shown in <link linkend="Big500users"/>.
1210 Set the workgroup name to <constant>MEGANET</constant>.
1213 <step><para><indexterm>
1214 <primary>domain master</primary>
1215 </indexterm><indexterm>
1216 <primary>BDC</primary>
1218 Edit the &smb.conf; file to temporarily change the parameter
1219 <smbconfoption name="domain master">No</smbconfoption> so
1220 the Samba server functions as a BDC for the purpose of migration.
1224 Start Samba as you have done previously.
1227 <step><para><indexterm>
1228 <primary>net</primary>
1229 <secondary>rpc</secondary>
1230 <tertiary>join</tertiary>
1232 Join the NT4 Domain as a BDC, as shown here:
1234 &rootprompt; net rpc join -S oldnt4pdc -W MEGANET -UAdministrator%not24get
1235 Joined domain MEGANET.
1239 <step><para><indexterm>
1240 <primary>net</primary>
1241 <secondary>rpc</secondary>
1242 <tertiary>vampire</tertiary>
1244 You may vampire the accounts from the NT4 PDC by executing the command, as shown here:
1246 &rootprompt; net rpc vampire -S oldnt4pdc -U Administrator%not24get
1247 Fetching DOMAIN database
1248 SAM_DELTA_DOMAIN_INFO not handled
1249 Creating unix group: 'Domain Admins'
1250 Creating unix group: 'Domain Users'
1251 Creating unix group: 'Domain Guests'
1252 Creating unix group: 'Engineers'
1253 Creating unix group: 'Marketoids'
1254 Creating unix group: 'Account Operators'
1255 Creating unix group: 'Administrators'
1256 Creating unix group: 'Backup Operators'
1257 Creating unix group: 'Guests'
1258 Creating unix group: 'Print Operators'
1259 Creating unix group: 'Replicator'
1260 Creating unix group: 'Server Operators'
1261 Creating unix group: 'Users'
1262 Creating account: Administrator
1263 Creating account: Guest
1264 Creating account: oldnt4pdc$
1265 Creating account: jacko
1266 Creating account: maryk
1267 Creating account: bridge
1268 Creating account: sharpec
1269 Creating account: jimbo
1270 Creating account: dhenwick
1271 Creating account: dork
1272 Creating account: blue
1273 Creating account: billw
1274 Creating account: massive$
1275 Group members of Engineers: Administrator,
1276 sharpec(primary),bridge,billw(primary),dhenwick
1277 Group members of Marketoids: Administrator,jacko(primary),
1278 maryk(primary),jimbo,blue(primary),dork(primary)
1279 Creating unix group: 'Gnomes'
1280 Fetching BUILTIN database
1281 SAM_DELTA_DOMAIN_INFO not handled
1285 <step><para><indexterm>
1286 <primary>pdbedit</primary>
1288 At this point, we can validate our migration. Let's look at the accounts
1289 in the form in which they are seen in a smbpasswd file. This achieves that:
1291 &rootprompt; pdbedit -Lw
1292 Administrator:505:84B0D8E14D158FF8417EAF50CFAC29C3:
1293 AF6DD3FD4E2EA8BDE1695A3F05EFBF52:[UX ]:LCT-3DF7AA9F:
1294 jimbo:512:6E9A2A51F64A1BD5C187B8085FE1D9DF:
1295 CDF7E305E639966E489A0CEFB95EE5E0:[UX ]:LCT-3E9362BC:
1296 sharpec:511:E4301A7CD8FDD1EC6BBF9BC19CDF8151:
1297 7000255938831D5B948C95C1931534C5:[UX ]:LCT-3E8B42C4:
1298 dhenwick:513:DCD8886141E3F892AAD3B435B51404EE:
1299 2DB36465949CB938DD98C312EFDC2639:[UX ]:LCT-3E939F41:
1300 bridge:510:3FE6873A43101B46417EAF50CFAC29C3:
1301 891741F481AF111B4CAA09A94016BD01:[UX ]:LCT-3E8B4291:
1302 blue:515:256D41D2559BB3D2AAD3B435B51404EE:
1303 9CCADDA4F7D281DD0FAD321478C6F971:[UX ]:LCT-3E939FDC:
1304 diamond$:517:6C8E7B64EDCDBC4218B6345447A4454B:
1305 3323AC63C666CFAACB60C13F65D54E9A:[S ]:LCT-00000000:
1306 oldnt4pdc$:507:3E39430CDCABB5B09ED320D0448AE568:
1307 95DBAF885854A919C7C7E671060478B9:[S ]:LCT-3DF7AA9F:
1308 Guest:506:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:
1309 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[DUX ]:LCT-3E93A008:
1310 billw:516:85380CA7C21B6EBE168C8150662AF11B:
1311 5D7478508293709937E55FB5FBA14C17:[UX ]:LCT-3FED7CA1:
1312 dork:514:78C70DDEC35A35B5AAD3B435B51404EE:
1313 0AD886E015AC595EC0AF40E6C9689E1A:[UX ]:LCT-3E939F9A:
1314 jacko:508:BC472F3BF9A0A5F63832C92FC614B7D1:
1315 0C6822AAF85E86600A40DC73E40D06D5:[UX ]:LCT-3E8B4242:
1316 maryk:509:3636AB7E12EBE79AB79AE2610DD89D4C:
1317 CF271B744F7A55AFDA277FF88D80C527:[UX ]:LCT-3E8B4270:
1321 <step><para><indexterm>
1322 <primary>pdbedit</primary>
1324 An expanded view of a user account entry shows more of what was
1325 obtained from the NT4 PDC:
1327 sleeth:~ # pdbedit -Lv maryk
1328 Unix username: maryk
1330 Account Flags: [UX ]
1331 User SID: S-1-5-21-1988699175-926296742-1295600288-1003
1332 Primary Group SID: S-1-5-21-1988699175-926296742-1295600288-1007
1333 Full Name: Mary Kathleen
1334 Home Directory: \\diamond\maryk
1336 Logon Script: scripts\logon.bat
1337 Profile Path: \\diamond\profiles\maryk
1339 Account desc: Peace Maker
1343 Logoff time: Mon, 18 Jan 2038 20:14:07 GMT
1344 Kickoff time: Mon, 18 Jan 2038 20:14:07 GMT
1345 Password last set: Wed, 02 Apr 2003 13:05:04 GMT
1346 Password can change: 0
1347 Password must change: Mon, 18 Jan 2038 20:14:07 GMT
1351 <step><para><indexterm>
1352 <primary>net</primary>
1353 <secondary>group</secondary>
1355 The following command lists the long names of the groups that have been
1356 imported (vampired) from the NT4 PDC:
1358 &rootprompt; net group -l -Uroot%not24get -Smassive
1361 -----------------------------
1362 Engineers Snake Oil Engineers
1363 Marketoids Untrustworthy Hype Vendors
1364 Gnomes Plain Vanilla Garden Gnomes
1365 Replicator Supports file replication in a domain
1366 Guests Users granted guest access to the computer/domain
1367 Administrators Members can fully administer the computer/domain
1368 Users Ordinary users
1370 Everything looks well and in order.
1373 <step><para><indexterm>
1374 <primary>domain master</primary>
1375 </indexterm><indexterm>
1376 <primary>PDC</primary>
1378 Edit the &smb.conf; file to reset the parameter
1379 <smbconfoption name="domain master">Yes</smbconfoption> so
1380 the Samba server functions as a PDC for the purpose of migration.
1386 <title>Key Points Learned</title>
1389 Migration of an NT4 PDC database to a Samba-3 PDC is possible.
1394 An LDAP backend is a suitable vehicle for NT4 migrations.
1398 A tdbsam backend can be used to perform a migration.
1402 Multiple NT4 domains can be merged into a single Samba-3
1407 The net Samba-3 domain most likely requires some
1408 administration and updating before going live.
1417 <title>Questions and Answers</title>
1422 <qandaset defaultlabel="chap08qa" type="number">
1427 <primary>clean database</primary>
1429 Why must I start each migration with a clean database?
1436 <primary>merge</primary>
1438 This is a recommendation that permits the data from each NT4 domain to
1439 be kept separate until you are ready to merge them. Also, if you do not start with a clean database,
1440 you may find errors due to users or groups from multiple domains having the
1441 same name but different SIDs. It is better to permit each migration to complete
1442 without undue errors and then to handle the merging of vampired data under
1453 <primary>Domain SID</primary>
1455 Is it possible to set my domain SID to anything I like?
1462 <primary>auto-generated SID</primary>
1463 </indexterm><indexterm>
1464 <primary>SID</primary>
1465 </indexterm><indexterm>
1466 <primary>Domain SID</primary>
1468 Yes, so long as the SID you create has the same structure as an autogenerated SID.
1469 The typical SID looks like this: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX, where
1470 the XXXXXXXXXX can be any number with from 6 to 10 digits. On the other hand, why
1471 would you really want to create your own SID? I cannot think of a good reason.
1472 You may want to set the SID to one that is already in use somewhere on your network,
1473 but that is a little different from straight out creating your own domain SID.
1483 <primary>/etc/passwd</primary>
1484 </indexterm><indexterm>
1485 <primary>/etc/group</primary>
1486 </indexterm><indexterm>
1487 <primary>tdbsam</primary>
1488 </indexterm><indexterm>
1489 <primary>passdb backend</primary>
1490 </indexterm><indexterm>
1491 <primary>accounts</primary>
1492 <secondary>user</secondary>
1493 </indexterm><indexterm>
1494 <primary>accounts</primary>
1495 <secondary>group</secondary>
1496 </indexterm><indexterm>
1497 <primary>accounts</primary>
1498 <secondary>Domain</secondary>
1500 When using a tdbsam passdb backend, why must I have all domain user and group accounts
1501 in <filename>/etc/passwd</filename> and <filename>/etc/group</filename>?
1508 <primary>UID</primary>
1509 </indexterm><indexterm>
1510 <primary>GID</primary>
1511 </indexterm><indexterm>
1512 <primary>smbpasswd</primary>
1513 </indexterm><indexterm>
1514 <primary>/etc/passwd</primary>
1515 </indexterm><indexterm>
1516 <primary>Posix</primary>
1517 </indexterm><indexterm>
1518 <primary>LDAP database</primary>
1520 Samba-3 must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba
1521 does not fabricate the UNIX IDs from thin air, but rather requires them to be located
1522 in a suitable place.
1526 When migrating a <filename>smbpasswd</filename> file to an LDAP backend, the
1527 UID of each account is taken together with the account information in the
1528 <filename>/etc/passwd,</filename> and both sets of data are used to create the account
1529 entry in the LDAP database.
1533 If you elect to create the POSIX account also, the entire UNIX account is copied to the
1534 LDAP backend. The same occurs with NT groups and UNIX groups. At the conclusion of
1535 migration to the LDAP database, the accounts may be removed from the UNIX database files.
1536 In short then, all UNIX and Windows networking accounts, both in tdbsam as well as in
1537 LDAP, require UIDs/GIDs.
1547 <primary>validate</primary>
1548 </indexterm><indexterm>
1549 <primary>connectivity</primary>
1550 </indexterm><indexterm>
1551 <primary>migration</primary>
1553 Why did you validate connectivity before attempting migration?
1560 Access validation before attempting to migrate NT4 domain accounts helps to pinpoint
1561 potential problems that may otherwise affect or impede account migration. I am always
1562 mindful of the 4 P's of migration: Planning Prevents Poor Performance.
1572 How would you merge 10 tdbsam-based domains into an LDAP database?
1579 <primary>risk</primary>
1580 </indexterm><indexterm>
1581 <primary>dump</primary>
1582 </indexterm><indexterm>
1583 <primary>tdbsam</primary>
1584 </indexterm><indexterm>
1585 <primary>Samba Domain</primary>
1586 </indexterm><indexterm>
1587 <primary>UID</primary>
1588 </indexterm><indexterm>
1589 <primary>GID</primary>
1590 </indexterm><indexterm>
1591 <primary>pdbedit</primary>
1592 </indexterm><indexterm>
1593 <primary>transfer</primary>
1594 </indexterm><indexterm>
1595 <primary>smbpasswd</primary>
1596 </indexterm><indexterm>
1597 <primary>LDAP</primary>
1598 </indexterm><indexterm>
1599 <primary>tool</primary>
1601 If you have 10 tdbsam Samba domains, there is considerable risk that there are a number of
1602 accounts that have the same UNIX identifier (UID/GID). This means that you almost
1603 certainly have to edit a lot of data. It would be easiest to dump each database in smbpasswd
1604 file format and then manually edit all records to ensure that each has a unique UID. Each
1605 file can then be imported a number of ways. You can use the <command>pdbedit</command> tool
1606 to affect a transfer from the smbpasswd file to LDAP, or you can migrate them en masse to
1607 tdbsam and then to LDAP. The final choice is yours. Just remember to verify all accounts that
1608 you have migrated before handing over access to a user. After all, too many users with a bad
1609 migration experience may threaten your career.
1619 <primary>machine accounts</primary>
1620 </indexterm><indexterm>
1621 <primary>accounts</primary>
1622 <secondary>machine</secondary>
1624 I want to change my domain name after I migrate all accounts from an NT4 domain to a
1625 Samba-3 domain. Does it make any sense to migrate the machine accounts in that case?
1632 <primary>registry</primary>
1633 </indexterm><indexterm>
1634 <primary>un-join</primary>
1635 </indexterm><indexterm>
1636 <primary>rejoin</primary>
1637 </indexterm><indexterm>
1638 <primary>tattooing</primary>
1640 I would recommend not to migrate the machine account. The machine accounts should still work, but there are registry entries
1641 on each Windows NT4 and upward client that have a tattoo of the old domain name. If you
1642 unjoin the domain and then rejoin the newly renamed Samba-3 domain, you can be certain to avoid
1643 this tattooing effect.
1653 <primary>multiple group mappings</primary>
1655 After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why?
1662 <primary>/etc/passwd</primary>
1663 </indexterm><indexterm>
1664 <primary>/etc/group</primary>
1666 Samba-3 currently does not implement multiple group membership internally. If you use the Windows
1667 NT4 Domain User Manager to manage accounts and you have an LDAP backend, the multiple group
1668 membership is stored in the POSIX groups area. If you use either tdbsam or smbpasswd backend,
1669 then multiple group membership is handled through the UNIX groups file. When you dump the user
1670 accounts, no group account information is provided. When you edit (change) UIDs and GIDs in each
1671 file to which you migrated the NT4 Domain data, do not forget to edit the UNIX <filename>/etc/passwd</filename>
1672 and <filename>/etc/group</filename> information also. That is where the multiple group information
1673 is most closely at your fingertips.
1683 How can I reset group membership after loading the account information into the LDAP database?
1690 <primary>SRVTOOLS.EXE</primary>
1692 You can use the NT4 Domain User Manager that can be downloaded from the Microsoft Web site. The
1693 installation file is called <filename>SRVTOOLS.EXE</filename>.
1703 <primary>group names</primary>
1705 What are the limits or constraints that apply to group names?
1712 <primary>limit</primary>
1713 </indexterm><indexterm>
1714 <primary>shadow-utils</primary>
1715 </indexterm><indexterm>
1716 <primary>groupadd</primary>
1717 </indexterm><indexterm>
1718 <primary>groupdel</primary>
1719 </indexterm><indexterm>
1720 <primary>groupmod</primary>
1721 </indexterm><indexterm>
1722 <primary>account names</primary>
1724 A Windows 200x group name can be up to 254 characters long, while in Windows NT4 the group
1725 name is limited to 20 characters. Most UNIX systems limit this to 32 characters. Windows
1726 groups can contain upper- and lowercase characters, as well as spaces.
1727 Many UNIX system do not permit the use of uppercase characters, and some do not permit the
1728 space character either. A number of systems (i.e., Linux) work fine with both uppercase
1729 and space characters in group names, but the shadow-utils package that provides the group
1730 control functions (<command>groupadd</command>, <command>groupmod</command>, <command>groupdel</command>, and so on) do not permit them.
1731 Also, a number of UNIX systems management tools enforce their own particular interpretation
1732 of the POSIX standards and likewise do not permit uppercase or space characters in group
1733 or user account names. You have to experiment with your system to find what its
1744 <primary>vampire</primary>
1746 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3
1747 LDAP backend system using the vampire process?
1754 UNIX UIDs and GIDs on most UNIX systems use an unsigned short or an unsigned integer. Recent Linux
1755 kernels support at least a much larger number. On systems that have a 16-bit constraint on UID/GIDs,
1756 you would not be able to migrate 323,000 accounts because this number cannot fit into a 16-bit unsigned
1757 integer. UNIX/Linux systems that have a 32-bit UID/GID can easily handle this number of accounts.
1758 Please check this carefully before you attempt to effect a migration using the vampire process.
1762 <primary>Migration speed</primary>
1764 Migration speed depends much on the processor speed, the network speed, disk I/O capability, and
1765 LDAP update overheads. On a dual processor AMD MP1600+ with 1 GB memory that was mirroring LDAP
1766 to a second identical system over 1 Gb Ethernet, I was able to migrate around 180 user accounts
1767 per minute. Migration would obviously go much faster if LDAP mirroring were turned off during the migration.