| blob | 883a2447a6f200e0d4c31667179805354fa4ccea |
1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
3 <chapter id="nw4migration">
4 <title>Migrating NetWare 4.11 Server to Samba-3</title>
6 <para>
7 <indexterm><primary>Novell</primary></indexterm>
8 <indexterm><primary>SuSE</primary></indexterm>
9 <indexterm><primary>Ximian</primary></indexterm>
10 <indexterm><primary>FLOSS</primary><see>Free-Libre/Open Source Software</see></indexterm>
11 <indexterm><primary>Free-Libre/Open Source Software</primary></indexterm>
12 Novell is a company any seasoned IT manager has to admire. Since the acquisition of
13 the SuSE Linux company, the acquisition on Ximian, and other moves that are friendly
14 to the FLOSS (Free-Libre/Open Source Software) movement, Novell are emerging out of
15 a deep regression that almost saw the company disappear into obscurity. The now Linux
16 friendly Novell's SUSE Linux is being used as a host to which NetWare servers are being
17 migrated. It is in many ways ironic that Novell are today hosting NetWare on top of
18 Linux. At the same time older NetWare servers are still being migrated to Samba servers.
19 It will be interesting to see what will become of NetWare over time.
20 </para>
22 <para>
23 <indexterm><primary>Red Hat</primary></indexterm>
24 <indexterm><primary>Debian</primary></indexterm>
25 <indexterm><primary>Gentoo</primary></indexterm>
26 <indexterm><primary>Mandrake</primary></indexterm>
27 Whatever flavor of Linux is preferred in your environment, whether Red Hat, Debian,
28 Gentoo, Mandrake, SUSE (Novell) the information in this chapter should be read with
29 appropriate cognizance that file locations may vary a little; even so the information
30 in this chapter should provide something of value.
31 </para>
33 <para>
34 <indexterm><primary>migration</primary></indexterm>
35 This chapter was contributed by Misty Stanley-Jones, a UNIX administrator of many
36 years who surfaced on the Samba mailing list with a barrage of questions, and who
37 regularly now helps other administrators to solve thorny Samba migration questions.
38 </para>
40 <para>
41 <indexterm><primary>NetWare</primary></indexterm>
42 <indexterm><primary>NLM</primary></indexterm>
43 <indexterm><primary>NetWare</primary></indexterm>
44 <indexterm><primary>Mars_NWE</primary></indexterm>
45 One wonders how many NetWare servers remain in active service. Many are being migrated
46 to Samba on Linux. Red Hat Linux, SUSE Linux 9.x and SUSE Linux Enterprise Server 9 are
47 ideal target platforms to which a NetWare server may be migrated. The migration method
48 of choice is much dependant on the tools that the administrator finds most natural to use.
49 The old-hand NetWare guru will likely want to use the tools like the NetWare NLM for
50 <command>rsync</command> to migrate files from the NetWare server to the Samba server.
51 The UNIX administrator might prefer tools that are part of the Mars_NWE (Martin Stovers' NetWare
52 Emulator) open source package. The MS Windows network administrator will likely make use of the
53 NWConv utility that is a part of Windows NT4 Server. Whatever your tool of choice,
54 migration will be filled with joyous and challenging moments - though probably not
55 concurrently.
56 </para>
58 <para>
59 This chapter tells its own story, so ride along, ... maybe the information here presented
60 will help to smooth over a similar migration challenge in your favorite networking environment.
61 </para>
63 <sect1>
64 <title>Introduction</title>
66 <para>
67 <indexterm><primary>Novell</primary></indexterm>
68 Misty Stanley-Jones was recruited by Abmas Inc. to administer a network that had
69 not received much attention for some years and was much in need of a make-over.
70 As a brand-new sysadmin to this company, she inherited a very old Novell file server,
71 and came with a determination to change things for the better.
72 </para>
74 <para>
75 A site survey turned up the following details for the old NetWare server:
76 </para>
78 <simplelist>
79 <member><para>200 MHz MMX processor</para></member>
80 <member><para>512K RAM</para></member>
81 <member><para>24 GB disk space in RAID1</para></member>
82 <member><para>Novell 4.11 patched to service pack 7</para></member>
83 <member><para>60+ users</para></member>
84 <member><para>7 network-attached printers</para></member>
85 </simplelist>
87 <para>
88 The company had outgrown this server several years ago and were dealing with
89 severe growing pains. Some of the problems experienced were:
90 </para>
92 <itemizedlist>
93 <listitem>
94 <para>Very slow performance</para>
95 </listitem>
96 <listitem>
97 <para>Available storage hovering around the 5% range.</para>
98 <itemizedlist>
99 <listitem>
100 <para>Extremely slow print spooling.</para>
101 </listitem>
102 <listitem>
103 <para>
104 Users storing information on their local hard
105 drives, causing backup integrity problems.
106 </para>
107 </listitem>
108 </itemizedlist>
109 </listitem>
110 </itemizedlist>
112 <para>
113 <indexterm><primary>payroll</primary></indexterm>
114 At one point disk space had filled up to 100% causing the payroll database
115 to become corrupt. This caused the accounting department to be down for over
116 a week and necessitated deployment of another file server. The replacement
117 server was created with very poor security and design considerations from
118 a discarded desktop PC.
119 </para>
121 <sect2>
122 <title>Assignment Tasks</title>
124 <para>
125 Misty has provided this summary of her migration experience in the hope
126 that it will help someone to avoid the challenges she faced. Perhaps her
127 configuration files and background will accelerate your learning as you
128 grapple with a similar migration challenge.
129 </para>
131 <para>
132 After presenting a cost-benefit report to management, as well as an estimated
133 time-to-completion, approval was given proceed with the solution proposed.
134 The server was built from purchased components. The total project cost
135 was $3000. A brief description of the configuration follows:
136 </para>
138 <simplelist>
139 <member>
140 <para>3.0 GHz P4 Processor</para>
141 </member>
142 <member>
143 <para>1 GB RAM</para>
144 </member>
145 <member>
146 <para>120 GB SATA operating system drive</para>
147 </member>
148 <member>
149 <para>4 x 80 GB SATA data drives (RAID5 240 GB capacity)</para>
150 </member>
151 <member>
152 <para>2 x 80 GB SATA removable drives for online backup</para>
153 </member>
154 <member>
155 <para>A DLT drive for asynchronous offline backup</para>
156 </member>
157 <member>
158 <para>SUSE Linux Professional 9.2</para>
159 </member>
160 </simplelist>
162 <para>
163 The new system has operated for six months without problems. Over the past months
164 much attention has been focused on cleaning up desktops and user profiles.
165 </para>
167 </sect2>
168 </sect1>
170 <sect1>
171 <title>Dissection and Discussion</title>
173 <para>
174 <indexterm><primary>LDAP</primary></indexterm>
175 <indexterm><primary>e-Directory</primary></indexterm>
176 <indexterm><primary>authentication</primary></indexterm>
177 <indexterm><primary>identity management</primary></indexterm>
178 A decision to use LDAP was made even though I know nothing about LDAP except that
179 I had been reading the book <quote>LDAP System Administration</quote>, by Gerald Carter.
180 LDAP seemed to provide some of the functionality of Novell's e-Directory Services
181 and would provide centralized authentication and identity management.
182 </para>
184 <para>
185 <indexterm><primary>database</primary></indexterm>
186 <indexterm><primary>RPM</primary></indexterm>
187 <indexterm><primary>tree</primary></indexterm>
188 Building the LDAP database took a while, and a lot of trial and error. Following
189 the guidance I obtained from Jerry Carter's book <quote>LDAP System
190 Administration</quote>, I installed OpenLDAP (from RPM; later I compiled
191 a more current version from source) and built my initial LDAP tree.
192 </para>
194 <sect2>
195 <title>Technical Issues</title>
197 <para>
198 <indexterm><primary>white-pages</primary></indexterm>
199 <indexterm><primary>inetOrgPerson</primary></indexterm>
200 <indexterm><primary>OpenLDAP</primary></indexterm>
201 <indexterm><primary>/etc/passwd</primary></indexterm>
202 <indexterm><primary>/etc/shadow</primary></indexterm>
203 <indexterm><primary>LDIF</primary></indexterm>
204 <indexterm><primary>IMAP</primary></indexterm>
205 <indexterm><primary>POP3</primary></indexterm>
206 <indexterm><primary>SMTP</primary></indexterm>
207 The first challenge was to create a company white-pages, followed by manually
208 entering everything from the printed company directory. This used only the inetOrgPerson
209 objectclass from the OpenLDAP schemas. The next step was to write a shell script which
210 would look at the <filename>/etc/passwd</filename> and <filename>/etc/shadow</filename>
211 files on our mail server, and create a LDIF file from which the information could be
212 imported into LDAP. This would allow use of LDAP for Linux authentication, IMAP, POP3,
213 and SMTP.
214 </para>
216 <para>
217 Given that a decision had been made to use Courier-IMAP the schema <quote>courier.schema</quote>
218 from the Courier-IMAP source tarball is ncessary to resolve Courier-specific LDAP directory
219 needs.
220 </para>
222 </sect2>
224 </sect1>
226 <sect1>
227 <title>Implementation</title>
229 <para>
230 </para>
232 <sect2>
233 <title>NetWare Migration Using LDAP Backend</title>
235 <para>
236 The following software must be installed on the SUSE Linux Enterprise Server to perform
237 this migration:
238 </para>
240 <simplelist>
241 <member><para>openldap2</para></member>
242 <member><para>openldap2-client</para></member>
243 <member><para>openldap2-devel (only for Samba compilation)</para></member>
244 <member><para>nss_ldap</para></member>
245 <member><para>smbldap-tools Version 0.8.7</para></member>
246 <member><para>perl-ldap</para></member>
247 <member><para>samba-3.0.12 or later</para></member>
248 <member><para>samba-client-3.0.12 or later</para></member>
249 <member><para>samba-winbind-3.0.12 or later</para></member>
250 </simplelist>
252 <para>
253 Each software application must be carefully configured in preparation for migration.
254 The configuration files used at Abmas are provided as a guide and should be modified
255 to meet needs at your site.
256 </para>
258 <sect3>
259 <title>LDAP Server Configuration</title>
261 <para>
262 The <filename>/etc/openldap/slapd.conf</filename> file Misty used is shown in <link linkend="ch8slapd"/>.
263 </para>
265 <example id="ch8slapd">
266 <title>OpenLDAP Control File &smbmdash; slapd.conf Part A</title>
267 <screen>
268 #/usr/local/etc/openldap/slapd.conf
269 #
270 # See slapd.conf(5) for details on configuration options.
271 # This file should NOT be world readable.
272 #
273 include /etc/openldap/schema/core.schema
274 include /etc/openldap/schema/cosine.schema
275 include /etc/openldap/schema/inetorgperson.schema
276 include /etc/openldap/schema/nis.schema
277 include /etc/openldap/schema/samba.schema
278 include /etc/openldap/schema/dhcp.schema
279 include /etc/openldap/schema/misc.schema
280 include /etc/openldap/schema/idpool.schema
281 include /etc/openldap/schema/eduperson.schema
282 include /etc/openldap/schema/commURI.schema
283 include /etc/openldap/schema/local.schema
284 include /etc/openldap/schema/authldap.schema
286 pidfile /var/run/slapd/run/slapd.pid
287 argsfile /var/run/slapd/run/slapd.args
289 replogfile /data/ldap/log/slapd.replog
291 # Load dynamic backend modules:
292 modulepath /usr/lib/openldap/modules
294 #######################################################################
295 # Logging parameters
296 #######################################################################
297 loglevel 256
299 #######################################################################
300 # SASL and TLS options
301 #######################################################################
302 sasl-host ldap.corp.abmas.org
303 sasl-realm DIGEST-MD5
304 sasl-secprops none
305 TLSCipherSuite HIGH:MEDIUM:+SSLV2
306 TLSCertificateFile /etc/ssl/certs/private/abmas-cert.pem
307 TLSCertificateKeyFile /etc/ssl/certs/private/abmas-key.pem
308 password-hash {SSHA}
309 defaultsearchbase "dc=abmas,dc=biz"
310 </screen>
311 </example>
314 <example id="ch8slapd2">
315 <title>OpenLDAP Control File &smbmdash; slapd.conf Part B</title>
316 <screen>
317 #######################################################################
318 # bdb database definitions
319 #######################################################################
320 database bdb
321 suffix "dc=abmas,dc=biz"
322 rootdn "cn=manager,dc=abmas,dc=biz"
323 rootpw {SSHA}gdo/dUvoT4ZJmULz3rUt6A3H/hBEduJ5
324 directory /data/ldap
325 mode 0600
326 # The following is for BDB to make it flush its data to disk every
327 # 500 seconds or 5kb of data
328 checkpoint 500 5
330 ## For running slapindex
331 #readonly on
333 ## Indexes for often-requested attributes
334 index objectClass eq
335 index cn eq,sub
336 index sn eq,sub
337 index uid eq,sub
338 index uidNumber eq
339 index gidNumber eq
340 index sambaSID eq
341 index sambaPrimaryGroupSID eq
342 index sambaDomainName eq
343 index default sub
344 cachesize 2000
346 replica host=baa.corp.abmas.org:389
347 suffix="dc=abmas,dc=biz"
348 binddn="cn=replica,dc=abmas,dc=biz"
349 credentials=verysecret
350 bindmethod=simple
351 tls=yes
352 replica host=ns.abmas.org:389
353 suffix="dc=abmas,dc=biz"
354 binddn="cn=replica,dc=abmas,dc=biz"
355 credentials=verysecret
356 bindmethod=simple
357 tls=yes
358 </screen>
359 </example>
361 <example id="ch8slapd3">
362 <title>OpenLDAP Control File &smbmdash; slapd.conf Part C</title>
363 <screen>
364 #######################################################################
365 # ACL section
366 #######################################################################
367 ## MOST RESTRICTIVE RULES MUST GO FIRST!
369 ## Users can change their own passwords.
370 ## Nobody else can read the password
371 access to attrs=userPassword
372 by group/groupOfUniqueNames/uniqueMember="cn=LDAP Administrators, \
373 dc=abmas,dc=biz" write
374 by self write
375 by * auth
377 ## Home contact info restricted to the logged-in user
378 access to attrs=hometelephoneNumber,homePostalAddress,\
379 mobileTelephoneNumber,pagerTelephoneNumber
380 by group/groupOfUniqueNames/uniqueMember="cn=LDAP Administrators,\
381 dc=abmas,dc=biz" write
382 by self write
383 by * none
385 ## Only admins can manage email aliases
386 access to dn.sub="ou=Email Aliases,dc=abmas,dc=biz"
387 filter=(roleOccupant=*)
388 attrs=maildrop
389 by dnattr=roleOccupant write
390 by * read
392 ## Allow delegated management of certain aliases which are
393 ## for mailman-style mailing lists.
394 access to dn.sub="ou=Email Aliases,dc=abmas,dc=biz"
395 by group/groupOfUniqueNames/uniqueMember="cn=LDAP Administrators,\
396 dc=abmas,dc=biz" write
397 by * read
399 ## Default to read-only access
400 access to *
401 by dn.base="cn=replica,ou=people,ou=corp,dc=abmas,dc=biz" write
402 by group/groupOfUniqueNames/uniqueMember="cn=LDAP Administrators,\
403 dc=abmas,dc=biz" write
404 by * read
405 access to attrs=namingcontexts
406 by anonymous read
407 </screen>
408 </example>
410 <para>
411 <indexterm><primary>/etc/ldap.conf</primary></indexterm>
412 The <filename>/etc/ldap.conf</filename> file used is listed in <link linkend="ch8ldap"/>.
413 </para>
415 <example id="ch8ldap">
416 <title>NSS LDAP Control File &smbmdash; /etc/ldap.conf</title>
417 <screen>
418 # /etc/ldap.conf
419 # This file is present on every *NIX client that authenticates to LDAP.
420 # For me, most of the defaults are fine. There is an amazing amount of
421 # customization that can be done see the man page for info.
423 # Your LDAP server. Must be resolvable without using LDAP. The following
424 # is for the LDAP server all others use the FQDN of the server
425 URI ldap://127.0.0.1
427 # The distinguished name of the search base.
428 base ou=corp,dc=abmas,dc=biz
430 # The LDAP version to use (defaults to 3 if supported by client library)
431 ldap_version 3
433 # The distinguished name to bind to the server with if the effective
434 # user ID is root. Password is stored in /etc/ldap.secret (mode 600)
435 rootbinddn cn=Manager,dc=abmas,dc=biz
437 # Filter to AND with uid=%s
438 pam_filter objectclass=posixAccoun
440 # The user ID attribute (defaults to uid)
441 pam_login_attribute uid
443 # Group member attribute
444 pam_member_attribute memberUID
446 # Use the OpenLDAP password change
447 # extended operation to update the password.
448 pam_password exop
450 # OpenLDAP SSL mechanism
451 # start_tls mechanism uses the normal LDAP port, LDAPS typically 636
452 ssl start_tls
454 tls_cacertfile /etc/ssl/certs/private/abmas-cert.pem
455 ...
456 </screen>
457 </example>
459 <para>
460 The Name Server Switch control file <filename>/etc/nsswitch.conf</filename> has the following contents:
461 <screen>
462 # /etc/nsswitch.conf
463 # This file controls the resolve order for system databases.
465 # the following two lines obviate the "+" entry in /etc/passwd and /etc/group.
466 passwd: files ldap
467 group: files ldap
468 shadow: files ldap
469 # The above are all that I store in LDAP at this point. There are
470 # possibilities to store hosts, services, ethers, and lots of other things.
471 </screen>
472 </para>
474 <para>
475 <indexterm><primary>PAM</primary></indexterm>
476 <indexterm><primary>NSS</primary></indexterm>
477 In my setup, users authenticate via PAM and NSS using LDAP-based accounts.
478 This works out of the box with the configuration files in this chapter. It
479 enables you to have no local accounts for users (it is highly advisable
480 to have a local account for the root user). Traps for the unwary include:
481 </para>
483 <indexterm><primary>LDAP</primary></indexterm>
484 <indexterm><primary>authenticate</primary></indexterm>
485 <indexterm><primary>DNS</primary></indexterm>
486 <itemizedlist>
487 <listitem>
488 <para>
489 If your LDAP database goes down, nobody can authenticate except for root.
490 </para>
491 </listitem>
493 <listitem>
494 <para>
495 If fail-over is configured incorrectly weird behavior can occur. For example,
496 DNS failing to resolve.
497 </para>
498 </listitem>
499 </itemizedlist>
501 <para>
502 I do have two LDAP slave servers configured. That subject is beyond the scope
503 of this document and steps for implementing it are well-documented.
504 </para>
506 <para>
507 The following services authenticate using LDAP:
508 </para>
509 <indexterm><primary>UNIX</primary></indexterm>
510 <indexterm><primary>Postfix</primary></indexterm>
511 <indexterm><primary>Courier-IMAP</primary></indexterm>
512 <simplelist>
513 <member><para>UNIX login/ssh</para></member>
514 <member><para>Postfix (SMTP)</para></member>
515 <member><para>Courier-IMAP/IMAPS/POP3/POP3S</para></member>
516 </simplelist>
518 <para>
519 <indexterm><primary>white-pages</primary></indexterm>
520 <indexterm><primary>Windows Address Book</primary></indexterm>
521 Company-wide White-Pages can be searched using a LDAP client
522 such as the one in the Windows Address Book.
523 </para>
525 <para>
526 <indexterm><primary>LDAP</primary></indexterm>
527 <indexterm><primary>smbldap-tools</primary></indexterm>
528 Having gained a solid understanding of LDAP, and a relatively workable LDAP tree
529 thus far, it was time to configure Samba. I compiled the latest stable SAMBA and
530 also installed the latest <command>smbldap-tools</command> from
531 <ulink url="http://idealx.com">Idealx</ulink>.
532 </para>
534 <para>
535 The Samba &smb.conf; file was configured as shown in <link linkend="ch8smbconf"/>.
536 </para>
538 <smbconfexample id="ch8smbconf">
539 <title>Samba Configuration File &smbmdash; smb.conf Part A</title>
540 <smbconfcomment>Global parameters</smbconfcomment>
541 <smbconfsection name="[global]"/>
542 <smbconfoption name="workgroup">MEGANET2</smbconfoption>
543 <smbconfoption name="netbios name">MASSIVE</smbconfoption>
544 <smbconfoption name="server string">Corp File Server</smbconfoption>
545 <smbconfoption name="passdb backend">ldapsam:ldap://localhost</smbconfoption>
546 <smbconfoption name="pam password change">Yes</smbconfoption>
547 <smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
548 <smbconfoption name="log level">1</smbconfoption>
549 <smbconfoption name="log file">/data/samba/log/%m.log</smbconfoption>
550 <smbconfoption name="name resolve order">wins host bcast</smbconfoption>
551 <smbconfoption name="time server">Yes</smbconfoption>
552 <smbconfoption name="printcap name">cups</smbconfoption>
553 <smbconfoption name="show add printer wizard">No</smbconfoption>
554 <smbconfoption name="add user script">/opt/IDEALX/sbin/smbldap-useradd -m "%u"</smbconfoption>
555 <smbconfoption name="add group script">/opt/IDEALX/sbin/smbldap-groupadd -p "%g"</smbconfoption>
556 <smbconfoption name="add user to group script"></smbconfoption>
557 <member><parameter>/opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</parameter></member>
558 <smbconfoption name="delete user from group script"></smbconfoption>
559 <member><parameter>/opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</parameter></member>
560 <smbconfoption name="set primary group script"></smbconfoption>
561 <member><parameter>/opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</parameter></member>
562 <smbconfoption name="add machine script">/usr/local/sbin/smbldap-useradd -w "%m"</smbconfoption>
563 <smbconfoption name="logon script">logon.bat</smbconfoption>
564 <smbconfoption name="logon path">\\%L\profiles\%U\%a</smbconfoption>
565 <smbconfoption name="logon drive">H:</smbconfoption>
566 <smbconfoption name="logon home">\\%L\%U</smbconfoption>
567 <smbconfoption name="domain logons">Yes</smbconfoption>
568 <smbconfoption name="wins support">Yes</smbconfoption>
569 <smbconfoption name="ldap admin dn">cn=Manager,dc=abmas,dc=biz</smbconfoption>
570 <smbconfoption name="ldap group suffix">ou=Groups</smbconfoption>
571 <smbconfoption name="ldap idmap suffix">ou=People</smbconfoption>
572 <smbconfoption name="ldap machine suffix">ou=People</smbconfoption>
573 <smbconfoption name="ldap passwd sync">Yes</smbconfoption>
574 <smbconfoption name="ldap suffix">ou=MEGANET2,dc=abmas,dc=biz</smbconfoption>
575 <smbconfoption name="ldap ssl">no</smbconfoption>
576 <smbconfoption name="ldap user suffix">ou=People</smbconfoption>
577 <smbconfoption name="admin users">root, "@Domain Admins"</smbconfoption>
578 <smbconfoption name="printer admin">"@Domain Admins"</smbconfoption>
579 <smbconfoption name="force printername">Yes</smbconfoption>
580 </smbconfexample>
582 <smbconfexample id="ch8smbconf2">
583 <title>Samba Configuration File &smbmdash; smb.conf Part B</title>
584 <smbconfsection name="[netlogon]"/>
585 <smbconfoption name="comment">Network logon service</smbconfoption>
586 <smbconfoption name="path">/data/samba/netlogon</smbconfoption>
587 <smbconfoption name="write list">"@Domain Admins"</smbconfoption>
588 <smbconfoption name="guest ok">Yes</smbconfoption>
590 <smbconfsection name="[profiles]"/>
591 <smbconfoption name="comment">Roaming Profile Share</smbconfoption>
592 <smbconfoption name="path">/data/samba/profiles/</smbconfoption>
593 <smbconfoption name="read only">No</smbconfoption>
594 <smbconfoption name="profile acls">Yes</smbconfoption>
595 <smbconfoption name="veto files">desktop.ini</smbconfoption>
596 <smbconfoption name="browseable">No</smbconfoption>
598 <smbconfsection name="[homes]"/>
599 <smbconfoption name="comment">Home Directories</smbconfoption>
600 <smbconfoption name="valid users">%S</smbconfoption>
601 <smbconfoption name="read only">No</smbconfoption>
602 <smbconfoption name="create mask">0770</smbconfoption>
603 <smbconfoption name="veto files">desktop.ini</smbconfoption>
604 <smbconfoption name="hide files">desktop.ini</smbconfoption>
605 <smbconfoption name="browseable">No</smbconfoption>
607 <smbconfsection name="[software]"/>
608 <smbconfoption name="comment">Software for %a computers</smbconfoption>
609 <smbconfoption name="path">/data/samba/shares/software/%a</smbconfoption>
610 <smbconfoption name="guest ok">Yes</smbconfoption>
612 <smbconfsection name="[public]"/>
613 <smbconfoption name="comment">Public Files</smbconfoption>
614 <smbconfoption name="path">/data/samba/shares/public</smbconfoption>
615 <smbconfoption name="read only">No</smbconfoption>
616 <smbconfoption name="guest ok">Yes</smbconfoption>
618 <smbconfsection name="[PDF]"/>
619 <smbconfoption name="comment">Location of documents printed to PDFCreator printer</smbconfoption>
620 <smbconfoption name="path">/data/samba/shares/pdf</smbconfoption>
621 <smbconfoption name="guest ok">Yes</smbconfoption>
622 </smbconfexample>
624 <smbconfexample id="ch8smbconf3">
625 <title>Samba Configuration File &smbmdash; smb.conf Part C</title>
626 <smbconfsection name="[EVERYTHING]"/>
627 <smbconfoption name="comment">All shares</smbconfoption>
628 <smbconfoption name="path">/data/samba</smbconfoption>
629 <smbconfoption name="valid users">"@Domain Admins"</smbconfoption>
630 <smbconfoption name="read only">No</smbconfoption>
632 <smbconfsection name="[CDROM]"/>
633 <smbconfoption name="comment">CD-ROM on MASSIVE</smbconfoption>
634 <smbconfoption name="path">/mnt</smbconfoption>
635 <smbconfoption name="guest ok">Yes</smbconfoption>
637 <smbconfsection name="[print$]"/>
638 <smbconfoption name="comment">Printer Drivers Share</smbconfoption>
639 <smbconfoption name="path">/data/samba/drivers</smbconfoption>
640 <smbconfoption name="write list">root</smbconfoption>
641 <smbconfoption name="browseable">No</smbconfoption>
643 <smbconfsection name="[printers]"/>
644 <smbconfoption name="comment">All Printers</smbconfoption>
645 <smbconfoption name="path">/data/samba/spool</smbconfoption>
646 <smbconfoption name="create mask">0644</smbconfoption>
647 <smbconfoption name="printable">Yes</smbconfoption>
648 <smbconfoption name="browseable">No</smbconfoption>
650 <smbconfsection name="[acct_hp8500]"/>
651 <smbconfoption name="comment">"Accounting Color Laser Printer"</smbconfoption>
652 <smbconfoption name="path">/data/samba/spool/private</smbconfoption>
653 <smbconfoption name="valid users">@acct, @acct_admin, @hr, "@Domain Admins",\</smbconfoption>
654 <member><parameter>@Receptionist, dwayne, terri, danae, jerry</parameter></member>
655 <smbconfoption name="create mask">0644</smbconfoption>
656 <smbconfoption name="printable">Yes</smbconfoption>
657 <smbconfoption name="copy">printers</smbconfoption>
659 <smbconfsection name="[plotter]"/>
660 <smbconfoption name="comment">Engineering Plotter</smbconfoption>
661 <smbconfoption name="path">/data/samba/spool</smbconfoption>
662 <smbconfoption name="create mask">0644</smbconfoption>
663 <smbconfoption name="printable">Yes</smbconfoption>
664 <smbconfoption name="use client driver">Yes</smbconfoption>
665 <smbconfoption name="copy">printers</smbconfoption>
666 </smbconfexample>
668 <smbconfexample id="ch8smbconf4">
669 <title>Samba Configuration File &smbmdash; smb.conf Part D</title>
670 <smbconfsection name="[APPS]"/>
671 <smbconfoption name="path">/data/samba/shares/Apps</smbconfoption>
672 <smbconfoption name="force group">"Domain Users"</smbconfoption>
673 <smbconfoption name="read only">No</smbconfoption>
675 <smbconfsection name="[ACCT]"/>
676 <smbconfoption name="path">/data/samba/shares/Accounting</smbconfoption>
677 <smbconfoption name="valid users">@acct, "@Domain Admins"</smbconfoption>
678 <smbconfoption name="force group">acct</smbconfoption>
679 <smbconfoption name="read only">No</smbconfoption>
680 <smbconfoption name="create mask">0660</smbconfoption>
681 <smbconfoption name="directory mask">0770</smbconfoption>
683 <smbconfsection name="[ACCT_ADMIN]"/>
684 <smbconfoption name="path">/data/samba/shares/Acct_Admin</smbconfoption>
685 <smbconfoption name="valid users">@”acct_admin”</smbconfoption>
686 <smbconfoption name="force group">acct_admin</smbconfoption>
688 <smbconfsection name="[HR_PR]"/>
689 <smbconfoption name="path">/data/samba/shares/HR_PR</smbconfoption>
690 <smbconfoption name="valid users">@hr, @acct_admin</smbconfoption>
691 <smbconfoption name="force group">hr</smbconfoption>
693 <smbconfsection name="[ENGR]"/>
694 <smbconfoption name="path">/data/samba/shares/Engr</smbconfoption>
695 <smbconfoption name="valid users">@engr, @receptionist, @truss, "@Domain Admins", cheri</smbconfoption>
696 <smbconfoption name="force group">engr</smbconfoption>
697 <smbconfoption name="read only">No</smbconfoption>
698 <smbconfoption name="create mask">0770</smbconfoption>
700 <smbconfsection name="[DATA]"/>
701 <smbconfoption name="path">/data/samba/shares/DATA</smbconfoption>
702 <smbconfoption name="valid users">@engr, @receptionist, @truss, "@Domain Admins", cheri</smbconfoption>
703 <smbconfoption name="force group">engr</smbconfoption>
704 <smbconfoption name="read only">No</smbconfoption>
705 <smbconfoption name="create mask">0770</smbconfoption>
706 <smbconfoption name="copy">engr</smbconfoption>
707 </smbconfexample>
709 <smbconfexample id="ch8smbconf5">
710 <title>Samba Configuration File &smbmdash; smb.conf Part E</title>
711 <smbconfsection name="[X]"/>
712 <smbconfoption name="path">/data/samba/shares/X</smbconfoption>
713 <smbconfoption name="valid users">@engr, @acct</smbconfoption>
714 <smbconfoption name="force group">engr</smbconfoption>
715 <smbconfoption name="read only">No</smbconfoption>
716 <smbconfoption name="create mask">0770</smbconfoption>
717 <smbconfoption name="copy">engr</smbconfoption>
719 <smbconfsection name="[NETWORK]"/>
720 <smbconfoption name="path">/data/samba/shares/network</smbconfoption>
721 <smbconfoption name="valid users">"@Domain Users"</smbconfoption>
722 <smbconfoption name="read only">No</smbconfoption>
723 <smbconfoption name="create mask">0770</smbconfoption>
724 <smbconfoption name="guest ok">Yes</smbconfoption>
726 <smbconfsection name="[UTILS]"/>
727 <smbconfoption name="path">/data/samba/shares/Utils</smbconfoption>
728 <smbconfoption name="write list">"@Domain Admins"</smbconfoption>
730 <smbconfsection name="[SYS]"/>
731 <smbconfoption name="path">/data/samba/shares/SYS</smbconfoption>
732 <smbconfoption name="valid users">chad</smbconfoption>
733 <smbconfoption name="read only">No</smbconfoption>
734 <smbconfoption name="browseable">No</smbconfoption>
735 </smbconfexample>
737 <para>
738 <indexterm><primary>Qbasic</primary></indexterm>
739 <indexterm><primary>Rbase</primary></indexterm>
740 <indexterm><primary>drive letters</primary></indexterm>
741 Most of these shares are only used by one company group, but they are required
742 because of some ancient Qbasic and Rbase applications were that written expecting
743 their own drive letters.
744 </para>
746 <para>
747 <indexterm><primary>rsync</primary></indexterm>
748 <indexterm><primary>rsyncd.conf</primary></indexterm>
749 <indexterm><primary>synchronize</primary></indexterm>
750 Note: During the process of building the new server, I kept data files up-to-date
751 with the Novell server via use of <command>rsync</command>. On a separate system (my workstation
752 in fact) which could be rebooted whenever necessary, I set up a mount point to the
753 Novell server via <command>ncpmount</command>. I then created a
754 <filename>rsyncd.conf</filename> to share that mount point out to my new server,
755 and synchronized once an hour. The script I used to synchronize is quite nice, so
756 I will include it in an appendix. The reason I had to have the
757 <command>rsync</command> daemon running on a system which could be rebooted
758 frequently is because <constant>ncpfs</constant> has a nasty habit of creating
759 stale mount points which cannot be recovered without a reboot. The reason for
760 hourly synchronization is because some part of the chain was very slow and
761 performance-heavy (whether <command>rsync</command> itself, the network, or
762 the Novell server I am not sure probably the Novell server).
763 </para>
765 <para>
766 After Samba had been configured, I initialized the LDAP database. So the first
767 thing I had to do was to store the LDAP password in the Samba configuration by
768 issuing the command (as root):
769 <screen>
770 &rootprompt; smbpasswd -w verysecret
771 </screen>
772 where <quote>verysecret</quote> is replaced by the LDAP bind password.
773 </para>
775 <note><para>
776 The Idealx smbldap-tools package can be configured using a script called
777 <command>configure.pl</command> that is provided as part of the tool. See Chapter 6
778 for an example of its use. Many administrators, like Misty, choose to do this manually
779 so as to maintain greater awareness of how the tool-chain works, and possibly to avoid
780 undesirable actions from occurring un-noticed.
781 </para></note>
783 <para>
784 Now Samba is ready for use. Now configure the smbldap-tools. There are two
785 relevant files, which are usually put into the directory
786 <filename>/etc/smbldap-tools</filename>. The main file,
787 <filename>smbldap.conf</filename> is shown in <link linkend="ch8ideal"/>.
788 </para>
790 <example id="ch8ideal">
791 <title>Idealx smbldap-tools Control File &smbmdash; Part A</title>
792 <screen>
793 #########
794 #
795 # located in /etc/smbldap-tools/smbldap.conf
796 #
797 ##############################################################################
798 #
799 # General Configuration
800 #
801 ##############################################################################
803 # Put your own SID
804 # to obtain this number do: net getlocalsid
805 SID="S-1-5-21-725326080-1709766072-2910717368"
807 ##############################################################################
808 #
809 # LDAP Configuration
810 #
811 ##############################################################################
813 # Notes: to use to dual ldap servers backend for Samba, you must patch
814 # Samba with the dual-head patch from IDEALX. If not using this patch
815 # just use the same server for slaveLDAP and masterLDAP.
816 # Those two servers declarations can also be used when you have
817 # . one master LDAP server where all writing operations must be done
818 # . one slave LDAP server where all reading operations must be done
819 # (typically a replication directory)
821 # Ex: slaveLDAP=127.0.0.1
822 slaveLDAP="127.0.0.1"
823 slavePort="389"
825 # Master LDAP : needed for write operations
826 # Ex: masterLDAP=127.0.0.1
827 masterLDAP="127.0.0.1"
828 masterPort="389"
830 # Use TLS for LDAP
831 # If set to 1, this option will use start_tls for connection
832 # (you should also used the port 389)
833 ldapTLS="0"
835 # How to verify the server's certificate (none, optional or require)
836 # see "man Net::LDAP" in start_tls section for more details
837 verify=""
838 </screen>
839 </example>
841 <example id="ch8ideal2">
842 <title>Idealx smbldap-tools Control File &smbmdash; Part B</title>
843 <screen>
844 # CA certificate
845 # see "man Net::LDAP" in start_tls section for more details
846 cafile=""
847 certificate to use to connect to the ldap server
848 # see "man Net::LDAP" in start_tls section for more details
849 clientcert=""
851 # key certificate to use to connect to the ldap server
852 # see "man Net::LDAP" in start_tls section for more details
853 clientkey=""
855 # LDAP Suffix
856 # Ex: suffix=dc=IDEALX,dc=ORG
857 suffix="ou=MEGANET2,dc=abmas,dc=biz"
859 # Where are stored Users
860 # Ex: usersdn="ou=Users,dc=IDEALX,dc=ORG"
861 usersdn="ou=People,${suffix}"
863 # Where are stored Computers
864 # Ex: computersdn="ou=Computers,dc=IDEALX,dc=ORG"
865 computersdn="ou=People,${suffix}"
867 # Where are stored Groups
868 # Ex groupsdn="ou=Groups,dc=IDEALX,dc=ORG"
869 groupsdn="ou=Groups,${suffix}"
871 # Where are stored Idmap entries (used if samba is a domain member server)
872 # Ex groupsdn="ou=Idmap,dc=IDEALX,dc=ORG"
873 idmapdn="ou=Idmap,${suffix}"
875 # Where to store next uidNumber and gidNumber available
876 sambaUnixIdPooldn="sambaDomainName=MEGANET2,dc=abmas,dc=biz"
878 # Default scope Used
879 scope="sub"
880 </screen>
881 </example>
883 <example id="ch8ideal3">
884 <title>Idealx smbldap-tools Control File &smbmdash; Part C</title>
885 <screen>
886 # Unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA)
887 hash_encrypt="MD5"
889 # if hash_encrypt is set to CRYPT, you may set a salt format.
890 # default is "%s", but many systems will generate MD5 hashed
891 # passwords if you use "$1$%.8s". This parameter is optional!
892 crypt_salt_format="%s"
894 ##############################################################################
895 #
896 # Unix Accounts Configuration
897 #
898 ##############################################################################
900 # Login defs
901 # Default Login Shell
902 # Ex: userLoginShell="/bin/bash"
903 userLoginShell="/bin/false"
905 # Home directory
906 # Ex: userHome="/home/%U"
907 userHome="/home/%U"
909 # Gecos
910 userGecos="Samba User"
912 # Default User (POSIX and Samba) GID
913 defaultUserGid="513"
915 # Default Computer (Samba) GID
916 defaultComputerGid="515"
918 # Skel dir
919 skeletonDir="/etc/skel"
921 # Default password validation time (time in days) Comment the next line if
922 # you don't want password to be enable for defaultMaxPasswordAge days (be
923 # careful to the sambaPwdMustChange attribute's value)
924 defaultMaxPasswordAge="45"
925 </screen>
926 </example>
928 <example id="ch8ideal4">
929 <title>Idealx smbldap-tools Control File &smbmdash; Part D</title>
930 <screen>
931 ##############################################################################
932 #
933 # SAMBA Configuration
934 #
935 ##############################################################################
937 # The UNC path to home drives location (%U username substitution)
938 # Ex: \\My-PDC-netbios-name\homes\%U
939 # Just set it to a null string if you want to use the smb.conf 'logon home'
940 # directive and/or disable roaming profiles
941 userSmbHome=""
943 # The UNC path to profiles locations (%U username substitution)
944 # Ex: \\My-PDC-netbios-name\profiles\%U
945 # Just set it to a null string if you want to use the smb.conf 'logon path'
946 # directive and/or disable roaming profiles
947 userProfile=""
949 # The default Home Drive Letter mapping
950 # (will be automatically mapped at logon time if home directory exist)
951 # Ex: H: for H:
952 userHomeDrive=""
954 # The default user netlogon script name (%U username substitution)
955 # if not used, will be automatically username.cmd
956 # make sure script file is edited under dos
957 # Ex: %U.cmd
958 # userScript="startup.cmd" # make sure script file is edited under dos
959 userScript=""
961 # Domain appended to the users "mail"-attribute
962 # when smbldap-useradd -M is used
963 mailDomain="abmas.org"
965 ##############################################################################
966 #
967 # SMBLDAP-TOOLS Configuration (default are ok for a RedHat)
968 #
969 ##############################################################################
970 # Allows not to use smbpasswd (if with_smbpasswd == 0 in smbldap_conf.pm) but
971 # prefer Crypt::SmbHash library
972 with_smbpasswd="0"
973 smbpasswd="/usr/bin/smbpasswd"
974 </screen>
975 </example>
977 <para>
978 <indexterm><primary>TLS</primary></indexterm>
979 NOTE: I chose not to take advantage of the TLS capability of this.
980 Eventually I may go back and tweak it. Also I chose not to take advantage
981 of the master/slave configuration as I heard horror stories that it was
982 unstable. My slave servers are replicas only.
983 </para>
985 <para>
986 The <filename>/etc/smbldap-tools/smbldap_bind.conf</filename> file is shown here:
987 <screen>
988 # smbldap_bind.conf
989 #
990 # This file simply tells smbldap-tools how to bind to your LDAP server.
991 # It has to be a DN with full write access to the Samba portion of
992 # the database.
994 ############################
995 # Credential Configuration #
996 ############################
997 # Notes: you can specify two differents configuration if you use a
998 # master ldap for writing access and a slave ldap server for reading access
999 # By default, we will use the same DN (so it will work for standard Samba
1000 # release)
1001 slaveDN="cn=Manager,dc=abmas,dc=biz"
1002 slavePw="verysecret"
1003 masterDN="cn=Manager,dc=abmas,dc=biz"
1004 masterPw="verysecret"
1005 </screen>
1006 </para>
1008 <para>
1009 We can now run the <command>smbldap-populate</command> command which will populate
1010 the LDAP tree with the appropriate default users, groups, and UID and GID pools.
1011 It will create a user called Administrator with UID=0 and GID=0 matching the
1012 Domain Admins group. This is fine you can still log in a root to a Windows system,
1013 but it will break cached credentials if you need to log in as the administrator
1014 to a system that is not on the network for whatever reason.
1015 </para>
1017 <para>
1018 After the LDAP database has been pre-loaded it is prudent to validate that the
1019 information needed is in the LDAP directory. This can be done done by restarting
1020 the LDAP server, then performing an LDAP search by executing:
1021 <screen>
1022 &rootprompt; ldapsearch -W -x -b "dc=abmas,dc=biz"\
1023 -D "cn=Manager,dc=abmas,dc=biz" \
1024 "(Objectclass=*)"
1025 Enter LDAP Password:
1026 # extended LDIF
1027 #
1028 # LDAPv3
1029 # base <dc=abmas,dc=biz> with scope sub
1030 # filter: (ObjectClass=*)
1031 # requesting: ALL
1032 #
1034 # abmas.biz
1035 dn: dc=abmas,dc=biz
1036 objectClass: dcObject
1037 objectClass: organization
1038 o: abmas
1039 dc: abmas
1041 # People, abmas.biz
1042 dn: ou=People,dc=abmas,dc=biz
1043 objectClass: organizationalUnit
1044 ou: People
1046 # Groups, abmas.biz
1047 dn: ou=Groups,dc=abmas,dc=biz
1048 objectClass: organizationalUnit
1049 ou: Groups
1051 # Idmap, abmas.biz
1052 dn: ou=Idmap,dc=abmas,dc=biz
1053 objectClass: organizationalUnit
1054 ou: Idmap
1055 ...
1056 </screen>
1057 </para>
1059 <para>
1060 <indexterm><primary>Windows</primary></indexterm>
1061 <indexterm><primary>POSIX</primary></indexterm>
1062 <indexterm><primary>smbldap-groupadd</primary></indexterm>
1063 <indexterm><primary>RID</primary></indexterm>
1064 <indexterm><primary>sambaGroupMapping</primary></indexterm>
1065 With the LDAP directory now intialized it is time to create the Windows and POSIX
1066 (UNIX) group accounts as well as the mappings from Windows groups to UNIX groups.
1067 The easiest way to do this is to use <command>smbldap-groupadd</command> command.
1068 It will create the group with the posixGroup and sambaGroupMapping attributes, a
1069 unique GID, and an automatically-determined RID. I learned the hard way not to
1070 try to do this by hand.
1071 </para>
1073 <para>
1074 <indexterm><primary>group mapping</primary></indexterm>
1075 <indexterm><primary>smbldap-groupmod</primary></indexterm>
1076 <indexterm><primary>memberUID</primary></indexterm>
1077 After I had my group mappings in place, I added users to the groups (the users
1078 don't really have to exist yet). I used the <command>smbldap-groupmod</command>
1079 command to accomplish this. It can also be done manually by adding memberUID
1080 attributes to the group entries in LDAP.
1081 </para>
1083 <para>
1084 <indexterm><primary>sambaSamAccount</primary></indexterm>
1085 <indexterm><primary>posixAccount</primary></indexterm>
1086 <indexterm><primary>smbldap-usermod</primary></indexterm>
1087 The most monumental task of all was adding the sambaSamAccount information to each
1088 already-existent posixAccount entry. I did it one at a time as I moved people onto
1089 the new server, by issuing the command:
1090 <screen>
1091 &rootprompt; smbldap-usermod -a -P username
1092 </screen>
1093 <indexterm><primary>NetWare</primary></indexterm>
1094 <indexterm><primary>LDIF</primary></indexterm>
1095 <indexterm><primary>slapcat</primary></indexterm>
1096 I completed that step for every user after asking the person what their current
1097 NetWare password was. The wiser way to have done it would probably be to dump the
1098 entire database to an LDIF file. This can be done by executing:
1099 <screen>
1100 &rootprompt; slapcat > somefile.ldif
1101 </screen>
1102 <indexterm><primary>Perl</primary></indexterm>
1103 <indexterm><primary>objectClass</primary></indexterm>
1104 Then update the LDIF file created by using a Perl script to parse and add the
1105 appropriate attributes and objectClasses to each entry, followed by re-importing
1106 the entire database into the LDAP directory.
1107 </para>
1109 <para>
1110 Rebuilding of the LDAP directory can be done as follows:
1111 <screen>
1112 &rootprompt; rcldap stop
1113 &rootprompt; cd /data/ldap
1114 &rootprompt; rm *bdb _* log*
1115 &rootprompt; su - ldap -c "slapadd -l somefile.ldif"
1116 &rootprompt; rcldap start
1117 </screen>
1118 This can be done at any time and for any reason, with no harm to the database.
1119 </para>
1121 <para>
1122 So first I added a test user, of course. The LDIF for this test user looks like
1123 this, to give you an idea:
1124 <screen>
1125 # Entry 1: cn=Test User,ou=people,ou=corp,dc=abmas,dc=biz
1126 dn:cn=Test User,ou=people,ou=corp,dc=abmas,dc=biz
1127 cn: Test User
1128 gecos: Test User
1129 gidNumber: 513
1130 givenName: Test
1131 homeDirectory: /home/test.user
1132 homePhone: 555
1133 l: Somewhere
1134 l: ST
1135 mail: test.user
1136 o: Corp
1137 objectClass: top
1138 objectClass: inetOrgPerson
1139 objectClass: posixAccount
1140 objectClass: sambaSamAccount
1141 postalCode: 12345
1142 sn: User
1143 street: 10 Some St.
1144 uid: test.user
1145 uidNumber: 1074
1146 sambaLogonTime: 0
1147 sambaLogoffTime: 2147483647
1148 sambaKickoffTime: 2147483647
1149 sambaPwdCanChange: 0
1150 displayName: Samba User
1151 sambaSID: S-1-5-21-725326080-1709766072-2910717368-3148
1152 sambaLMPassword: 9D29C287C58448F9AAD3B435B51404EE
1153 sambaAcctFlags: [U]
1154 sambaNTPassword: D062088E99C95E37D7702287BB35E770
1155 sambaPwdLastSet: 1102537694
1156 sambaPwdMustChange: 1106425694
1157 userPassword: {SSHA}UzFZ2VxRGdwUueLnTGtsTBtnsvMO1oj8
1158 loginShell: /bin/false
1159 </screen>
1160 </para>
1162 <para>
1163 Then I went over to a spare Windows NT machine and joined it to the MEGANET2 domain.
1164 It worked, and the machine's account entry under ou=Computers looks like this:
1165 <screen>
1166 dn:uid=w2kengrspare$,ou=Computers,ou=MEGANET2,dc=abmas,dc=biz
1167 objectClass: top
1168 objectClass: inetOrgPerson
1169 objectClass: posixAccount
1170 objectClass: sambaSamAccount
1171 cn: w2kengrspare$
1172 sn: w2kengrspare$
1173 uid: w2kengrspare$
1174 uidNumber: 1104
1175 gidNumber: 515
1176 homeDirectory: /dev/null
1177 loginShell: /bin/false
1178 description: Computer
1179 gecos: Computer
1180 sambaSID: S-1-5-21-725326080-1709766072-2910717368-3208
1181 sambaPrimaryGroupSID: S-1-5-21-725326080-1709766072-2910717368-2031
1182 displayName: W2KENGRSPARE$
1183 sambaPwdCanChange: 1103149236
1184 sambaPwdMustChange: 2147483647
1185 sambaNTPassword: CA199C45CB6737035DB6D9D9F6CD1834
1186 sambaPwdLastSet: 1103149236
1187 sambaAcctFlags: [W ]
1188 </screen>
1189 </para>
1191 <para>
1192 <indexterm><primary>netlogon</primary></indexterm>
1193 So now I can log in with a test user from the machine w2kengrspare. It's all fine and
1194 good, but that user is in no groups yet so has pretty boring access. We can fix that
1195 by writing the login script! To write the login script, I used
1196 <ulink url="http://www.kixtart.org">Kixstart</ulink>. I used it because it will work
1197 with every architecture of Windows, has an active and helpful user base, and was both
1198 easier to learn and more powerful than the standard netlogon scripts I have seen.
1199 I also did not have to do a logon script per user or per group.
1200 </para>
1202 <para>
1203 <indexterm><primary>Kixtart</primary></indexterm>
1204 I downloaded Kixtart and put the following files in my [netlogon] share:
1205 <screen>
1206 KIX32.EXE
1207 KX32.dll
1208 KX95.dll <-- Not needed unless you are running Win9x clients.
1209 kx16.dll <-- Probably not needed unless you are running DOS clients.
1210 kxrpc.exe <-- Probably useless as it has to run on the server and can
1211 only be run on NT. It's for Windows 95 to become group-aware.
1212 We can get around the need.
1213 </screen>
1214 </para>
1216 <para>
1217 <indexterm><primary>logon.kix</primary></indexterm>
1218 I then wrote the <filename>logon.kix</filename> file that is shown in
1219 <link linkend="ch8kix"/>. I chose to keep it all in one file, but it
1220 can be split up and linked via include directives.
1221 </para>
1223 <example id="ch8kix">
1224 <title>Kixstart Control File &smbmdash; File: logon.kix</title>
1225 <screen>
1226 ; This script just calls the other scripts.
1228 ; First we want to get things done for everyone.
1230 ; Second, we do first-time login stuff.
1232 ; Third, we go through the group-oriented scripts one at a time.
1235 ; We want to check for group membership here to avoid the overhead of running
1236 ; scripts which don't apply.
1237 call "\\massive\netlogon\scripts\main.kix"
1238 call "\\massive\netlogon\scripts\setup.kix"
1239 IF INGROUP("MEGANET2\ACCT")
1240 call "scripts\acct.kix"
1241 ENDIF
1242 IF INGROUP("MEGANET2\ENGR","MEGANET2\RECEPTIONIST")
1243 call "\\massive\netlogon\scripts\engr.kix"
1244 ENDIF
1245 IF INGROUP("MEGANET2\FURN")
1246 call "\\massive\netlogon\scripts\furn.kix"
1247 ENDIF
1248 IF INGROUP("MEGANET2\TRUSS")
1249 call "\\massive\netlogon\scripts\truss.kix"
1250 ENDIF
1251 </screen>
1252 </example>
1254 <example id="ch8kix2">
1255 <title>Kixstart Control File &smbmdash; File: main.kix</title>
1256 <screen>
1257 break on
1259 ; Choose whether to hide the login window or not
1260 IF INGROUP("MEGANET2\Domain Admins")
1261 USE Z: \\massive\everything
1262 SETCONSOLE("show")
1263 ELSE
1264 ; Nobody cares about seeing the login script except admins
1265 SETCONSOLE("hide")
1266 ENDIF
1268 ; Delete all previously connected shares
1269 USE * /delete
1271 SETTITLE("Logging on @USERID to @LDOMAIN at @TIME")
1273 ; Set the time on the workstation
1274 $Timeserver = "\\massive"
1275 Settime $TimeServer
1277 ; Map the home directory
1278 USE H: @HOMESHR ; connect to user's home share
1279 IF @ERROR = 0
1281 H:
1282 CD @HOMEDIR ; change directory to user's home directory
1283 ENDIF
1285 ; Everyone gets the N drive
1286 USE N: \\massive\network
1287 </screen>
1288 </example>
1290 <example id="ch8kix3">
1291 <title>Kixstart Control File &smbmdash; File: setup.kix, Part A</title>
1292 <screen>
1293 ; My setup.kix is where all of the redirection stuff happens. Note that with
1294 ; the use of registry keys, ths only happens the first time they log in ,or if
1295 ; I delete the pertinent registry keys which triggers it to happen again:
1297 ; Check to see if we have written the Borkholder subkey before
1298 $RETURNCODE = EXISTKEY("HKEY_CURRENT_USER\Borkholder")
1299 IF NOT $RETURNCODE = 0
1300 ; Add key for Borkholder-specific things on the first login
1301 ADDKEY("HKEY_CURRENT_USER\Borkholder")
1302 ; The following key gets deleted at the end of the first login
1303 ADDKEY("HKEY_CURRENT_USER\Borkholder\FIRST_LOGIN")
1304 ENDIF
1306 ; People with laptops need My Documents to be in their profile. People with
1307 ; desktops can have My Documents redirected to their home directory to avoid
1308 ; long delays with logging out and out-of-sync files.
1310 ; Check to see if this is the first login -- doesn't make sense to do this
1311 ; at the very first login
1313 $RETURNCODE = EXISTKEY("HKEY_CURRENT_USER\Borkholder\FIRST_LOGIN")
1314 IF NOT $RETURNCODE = 0
1316 ; We don't want to do this stuff for people with laptops or people in the FURN
1317 ; group. (They store their profiles in a different server)
1319 IF NOT INGROUP("MASSIVE\Laptop","MASSIVE\FURN")
1320 $RETURNCODE=EXISTKEY("HKEY_CURRENT_USER\Borkholder\profile_copied")
1322 ; A crude way to tell what OS our profile is for and copy the "My Documents"
1323 ; to the redirected folder on the server. It works because the profiles
1324 ; are stored as \\server\profiles\user\architecture
1325 IF NOT $RETURNCODE = 0
1326 IF EXIST("\\massive\profiles\@userID\WinXP")
1327 copy "\\massive\profiles\@userID\WinXP\My Documents\*"
1328 "\\massive\@userID\"
1329 ENDIF
1330 IF EXIST("\\massive\profiles\@userID\Win2K")
1331 copy "\\massive\profiles\@userID\Win2K\My Documents\*"
1332 "\\massive\@userID\"
1333 ENDIF
1334 IF EXIST("\\massive\profiles\@userID\WinNT")
1335 copy "\\massive\profiles\@userID\WinNT\My Documents\*"
1336 "\\massive\@userID\"
1337 ENDIF
1338 </screen>
1339 </example>
1341 <example id="ch8kix3b">
1342 <title>Kixstart Control File &smbmdash; File: setup.kix, Part B</title>
1343 <screen>
1344 ; Now we will write the registry values to redirect the locations of "My
1345 Documents"
1346 ; and other folders.
1347 ADDKEY("HKEY_CURRENT_USER\Borkholder\profile_copied")
1348 WRITEVALUE("HKEY_CURRENT_USER\Software\Microsoft\
1349 Windows\CurrentVersion\Explorer\User
1350 Shell Folders", "Personal","\\massive\@userID","REG_SZ")
1351 WRITEVALUE("HKEY_CURRENT_USER\Software\Microsoft\
1352 Windows\CurrentVersion\Explorer\User
1353 Shell Folders", "My Pictures", "\\massive\@userID\My Pictures", "REG_SZ")
1354 IF @PRODUCTTYPE="Windows 2000 Professional" or @PRODUCTTYPE="Windows XP
1355 Professional"
1356 WRITEVALUE("HKEY_CURRENT_USER\Software\Microsoft\
1357 Windows\CurrentVersion\Explorer\User
1358 Shell Folders", "My Videos", "\\massive\@userID\My Videos", "REG_SZ")
1359 WRITEVALUE("HKEY_CURRENT_USER\Software\Microsoft\
1360 Windows\CurrentVersion\Explorer\User
1361 Shell Folders", "My Music", "\\massive\@userID\My Music", "REG_SZ")
1362 WRITEVALUE("HKEY_CURRENT_USER\Software\Microsoft\
1363 Windows\CurrentVersion\Explorer\User
1364 Shell Folders", "My eBooks", "\\massive\@userID\My eBooks", "REG_SZ")
1365 ENDIF
1366 ENDIF
1367 ENDIF
1369 ; Now we will delete the FIRST_LOGIN subkey that we made before.
1370 ; Note - to run this script again you will want to delete the HKCU\Borkholder
1371 ; subkey, log out, and log back in.
1372 $RETURNVALUE = EXISTKEY("HKEY_CURRENT_USER\Borkholder\FIRST_LOGIN")
1373 IF $RETURNVALUE = 0
1374 DELKEY("HKEY_CURRENT_USER\Borkholder\FIRST_LOGIN")
1375 ENDIF
1376 </screen>
1377 </example>
1379 <example id="ch8kix4">
1380 <title>Kixstart Control File &smbmdash; File: acct.kix</title>
1381 <screen>
1382 ; And here is one group-oriented script to show what can be
1383 ; done that way: acct.kix:
1385 IF INGROUP("MASSIVE\Acct_Admin","MASSIVE\HR")
1386 USE I: \\MEGANET2\HR_PR
1387 ENDIF
1389 ; Set up printer
1390 $RETURNVALUE = existkey("HKEY_CURRENT_USER\Printers\,,massive,acct_hp8500")
1391 IF NOT $RETURNVALUE = 0
1392 ADDPRINTERCONNECTION("\\massive\acct_hp8500")
1393 SETDEFAULTPRINTER("\\massive\acct_hp8500")
1394 ENDIF
1395 ; Set up drive mappings
1396 USE M: \\massive\ACCT
1397 IF INGROUP("MEGANET2\ABRA")
1398 USE T: \\trussrv\abra
1399 ENDIF
1400 </screen>
1401 </example>
1403 <para>
1404 As you can see in the script, I redirect the My Documents to the user's home
1405 share if they are not in the “Laptop” group. I also add printers on a
1406 group-by-group basis, and if applicable I setthe group printer. For this to
1407 be effective, the print drivers must be installed on the Samba server in the
1408 <filename>[print$]</filename> share. Ample documentation exists about how to do that so I did not
1409 cover it.
1410 </para>
1412 <para>
1413 I actually call this script via the logon.bat script in the [netlogon] directory:
1414 <screen>
1415 \\corpsrv\netlogon\kix32 \\corpsrv\netlogon\logon.kix /f
1416 </screen>
1417 I only had to fully qualify the paths for Windows 9x, as Windows NT and
1418 greater automatically add [NETLOGON] to the path.
1419 </para>
1421 <para>
1422 Also of note for Win9x is that the drive mappings and printer setup will not
1423 work because they rely on RPC. One merely has to put the appropriate settings
1424 into the <filename>c:\autoexec.bat</filename> file or map the drives manually. One option would
1425 be to check the OS as part of the Kixtart script, and if it is Win9x and if
1426 it is the first login, copy a pre-made <filename>autoexec.bat</filename> to the <filename>C:</filename> drive. I only
1427 have three such machines and one is going away in the very near future, so it
1428 was easier to do it by hand.
1429 </para>
1431 <para>
1432 <indexterm><primary>upgrade</primary></indexterm>
1433 At this point I was able to add the users. This is the part that really falls
1434 into “upgrade. I moved the users over one group at a time, starting with the
1435 people who used the least amount of resources on the network. With each group
1436 that I moved, I first logged in as a “standard” user in that group and took
1437 careful note of their environment, mainly the printers they used, their PATH,
1438 and what network resources they had access to (most importantly which ones
1439 they actually needed access to).
1440 </para>
1442 <para>
1443 I would then add the user's SambaSamAccount information as mentioned earlier,
1444 and join the computer to the domain. The very first thing I had to do was to
1445 copy the user's profile to the new server. This was very important, and I really
1446 struggled with the most effective way to do it. Here is the method that worked
1447 for every one of my users on Windows NT, 2000, and XP:
1448 </para>
1450 <procedure>
1451 <step><para>
1452 Log in as the user on the domain. This creates the local copy
1453 of the user's profile and copies it to the server as they log out.
1454 </para></step>
1456 <step><para>
1457 Reboot the computer and log in as the local machine administrator.
1458 </para></step>
1460 <step><para>
1461 Right-click My Computer, click Properties, and navigate to the
1462 user profiles tab (varies per version of Windows).
1463 </para></step>
1465 <step><para>
1466 Select the user's local profile <constant>(COMPUTERNAME\username)</constant>,
1467 and click the <command>Copy To</command> button.
1468 </para></step>
1470 <step><para>
1471 In the next dialog, copy it directly to the profiles share on the
1472 Samba server (\\PDCname\profiles\user\<architecture> in my
1473 case). You will have had to make a connection to the share as that
1474 user (e.g.: Windows Explorer type \\PDCname\profiles\username).
1475 </para></step>
1477 <step><para>
1478 When the copy is complete (it can take a while) log out, and log back in
1479 as the user. All his/her settings and all contents of My Documents,
1480 Favorites, and the registry should have been copied successfully.
1481 </para></step>
1483 <step><para>
1484 If it doesn't look right (the dead giveaway is the desktop background)
1485 shut down the computer without logging out (power cycle) and try logging
1486 in as the user again. If it still doesn't work, repeat the steps above.
1487 I only had to ever repeat it once.
1488 </para></step>
1490 </procedure>
1492 <para>
1493 WORDS TO THE WISE:
1494 </para>
1496 <itemizedlist>
1497 <listitem><para>
1498 If the user was anything other than a standard user on his/her system
1499 before, you will save yourself some headaches by giving them identical
1500 permissions (on the local machine) as their domain account, BEFORE
1501 copying their profile over. Do this through the User Administrator
1502 in the Control Panel, after joining the computer to the domain and
1503 before logging as that user for the first time. Otherwise they will
1504 have trouble with permissions on their registry keys.
1505 </para></listitem>
1507 <listitem><para>
1508 If any application was installed for the user only, rather than for
1509 the entire system, it will probably not work without being reinstalled.
1510 </para></listitem>
1511 </itemizedlist>
1513 <para>
1514 After all these steps are accomplished, only cleanup details are left. Make sure user's
1515 shortcuts and “Network Places” point to the appropriate place on the new server, check
1516 the important applications to be sure they work as expected and troubleshoot any problems
1517 that might arise, check to be sure the user's printers are present and working. By the
1518 way, if there are any network printers installed as system printers (the Novell way)
1519 you will need to log in as a local administrator and delete them.
1520 </para>
1522 <para>
1523 For my non-laptop systems, I would then log in and out a couple times as the user,
1524 to be sure that their registry settings were modified, then I was finished.
1525 </para>
1527 <para>
1528 Some compatibility issues that cropped up included:
1529 </para>
1531 <para>
1532 Blackberry client &smbmdash; It did not like having its registry settings moved around,
1533 and had to be reinstalled. Also it needed write permissions to a portion of
1534 the hard drive, and I had to give it those manually on the one system where
1535 this was an issue.
1536 </para>
1538 <para>
1539 CAMedia &smbmdash; digital camera software for Canon cameras I had all kinds of trouble
1540 with the registry. I had to use the Run as service to open the registry of
1541 the local user while logged in as the domain user, and give the domain user
1542 the appropriate permissions to some registry keys, then export that portion
1543 of the registry to a file. Then as the domain user I had to import that file
1544 into the registry.
1545 </para>
1547 <para>
1548 Crystal Reports version 7 &smbmdash; More registry problems that were solved by re-copying
1549 the user's profile.
1550 </para>
1552 <para>
1553 Printing from legacy applications &smbmdash; I found out that Novell sent its jobs to
1554 the printer in a raw format. CUPS sends them in Postscript by default. I had
1555 to make a second printer definition for one printer and tell CUPS specifically
1556 to send raw data to the printer, and assign this printer to the LPT port with
1557 Kixtart's version of the “net use”command.
1558 </para>
1560 <para>
1561 These were all eventually solved by elbow grease, queries to the Samba mailing
1562 list and others, and diligence. The complete migration took about 5 weeks.
1563 My userbase is relatively small, but includes multiple versions of Windows,
1564 multiple Linux member servers, a mechanized saw, a pen plotter, and legacy
1565 applications written in Qbasic and R:Base, just to name a few. I actually
1566 ended up making some of these applications work better (or work again, as
1567 some of them had stopped functioning on the old server) because as part of
1568 the process I had to find out how things were supposed to work.
1569 </para>
1571 <para>
1572 The one thing I have not been able to get working is a very old database that
1573 we had around for reference purposes which uses Novell's Btrieve engine.
1574 </para>
1576 <para>
1577 As the resources compare, I went from 95% disk usage to just around 10%.
1578 I went from a very high load on the server to an average load of between 1
1579 and 2 runnable processes on the server. I have improved the security and
1580 robustness of the system. I have also implemented
1581 <ulink url="http://www.clamav.net">ClamAV</ulink> Antivirus
1582 which scans the entire Samba server for viruses every two hours and
1583 quarantines them. I have found it much less problematic than our ancient
1584 version of Norton Antivirus Corporate Edition, and much more up-to-date.
1585 </para>
1587 <para>
1588 In short, my users are much happier now that the new server is running, that
1589 is what is important to me.
1590 </para>
1592 </sect3>
1594 </sect2>
1596 </sect1>
1598 </chapter>