docs-xml/Samba3-ByExample/SBE-MigrateNT4Samba3.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3 <chapter id="ntmigration">
   4   <title>Migrating NT4 Domain to Samba</title>
   5
   6         <para>
   7         Ever since Microsoft announced that it was discontinuing support for Windows
   8         NT4, Samba users started to ask for detailed instructions on how to migrate
   9         from NT4 to Samba. This chapter provides background information that should
  10         meet these needs.
  11         </para>
  12
  13         <para>
  14         One wonders how many NT4 systems will be left in service by the time you read this
  15         book though.
  16         </para>
  17
  18 <sect1>
  19         <title>Introduction</title>
  20
  21       <para><indexterm>
  22           <primary>migration</primary>
  23         </indexterm>
  24         Network administrators who want to migrate off a Windows NT4 environment know
  25         one thing with certainty. They feel that NT4 has been abandoned, and they want
  26         to update. The desire to get off NT4 and to not adopt Windows 200x and Active
  27         Directory is driven by a mixture of concerns over complexity, cost, fear of
  28         failure, and much more.
  29         </para>
  30
  31         <para>
  32         <indexterm><primary>group policies</primary></indexterm>
  33         <indexterm><primary>accounts</primary><secondary>user</secondary></indexterm>
  34         <indexterm><primary>accounts</primary><secondary>group</secondary></indexterm>
  35         <indexterm><primary>accounts</primary><secondary>machine</secondary></indexterm>
  36         The migration from NT4 to Samba can involve a number of factors, including
  37         migration of data to another server, migration of network environment controls
  38         such as group policies, and migration of the users, groups, and machine
  39         accounts.
  40         </para>
  41
  42         <para>
  43         <indexterm><primary>accounts</primary><secondary>Domain</secondary></indexterm>
  44         It should be pointed out now that it is possible to migrate some systems from
  45         a Windows NT4 domain environment to a Samba domain environment. This is certainly
  46         not possible in every case. It is possible to just migrate the domain accounts
  47         to Samba and then to switch machines, but as a hands-off transition, this is more
  48         the exception than the rule. Most systems require some tweaking after
  49         migration before an environment that is acceptable for immediate use
  50         is obtained.
  51         </para>
  52
  53         <sect2>
  54         <title>Assignment Tasks</title>
  55
  56         <para>
  57         <indexterm><primary>LDAP</primary></indexterm>
  58         <indexterm><primary>ldapsam</primary></indexterm>
  59         <indexterm><primary>passdb backend</primary></indexterm>
  60         You are about to migrate an MS Windows NT4 domain accounts database to
  61         a Samba server. The Samba-3 server is using a
  62         <parameter>passdb backend</parameter> based on LDAP. The
  63         <constant>ldapsam</constant> is ideal because an LDAP backend can be distributed
  64         for use with BDCs &smbmdash; generally essential for larger networks.
  65         </para>
  66
  67         <para>
  68         Your objective is to document the process of migrating user and group accounts
  69         from several NT4 domains into a single Samba LDAP backend database.
  70         </para>
  71
  72         </sect2>
  73 </sect1>
  74
  75 <sect1>
  76         <title>Dissection and Discussion</title>
  77
  78         <para>
  79         <indexterm><primary>snap-shot</primary></indexterm>
  80         <indexterm><primary>NT4 registry</primary></indexterm>
  81         <indexterm><primary>registry</primary><secondary>keys</secondary><tertiary>SAM</tertiary></indexterm>
  82         <indexterm><primary>registry</primary><secondary>keys</secondary><tertiary>SECURITY</tertiary></indexterm>
  83         <indexterm><primary>SAM</primary></indexterm>
  84         <indexterm><primary>Security Account Manager</primary><see>SAM</see></indexterm>
  85         The migration process takes a snapshot of information that is stored in the
  86         Windows NT4 registry-based accounts database. That information resides in
  87         the Security Account Manager (SAM) portion of the NT4 registry under keys called
  88         <constant>SAM</constant> and <constant>SECURITY</constant>.
  89         </para>
  90
  91         <warning><para>
  92         <indexterm><primary>crippled</primary></indexterm>
  93         <indexterm><primary>inoperative</primary></indexterm>
  94         The Windows NT4 registry keys called <constant>SAM</constant> and <constant>SECURITY</constant>
  95         are protected so that you cannot view the contents. If you change the security setting
  96         to reveal the contents under these hive keys, your Windows NT4 domain is crippled. Do not
  97         do this unless you are willing to render your domain controller inoperative.
  98         </para></warning>
  99
 100         <para>
 101         <indexterm><primary>migration</primary><secondary>objectives</secondary></indexterm>
 102         <indexterm><primary>disruptive</primary></indexterm>
 103         Before commencing an NT4 to Samba migration, you should consider what your objectives are.
 104         While in some cases it is possible simply to migrate an NT4 domain to a single Samba server,
 105         that may not be a good idea from an administration perspective. Since the process involves going
 106         through a certain amount of disruptive activity anyhow, why not take this opportunity to
 107         review the structure of the network, how Windows clients are controlled and how they
 108         interact with the network environment.
 109         </para>
 110
 111         <para>
 112         <indexterm><primary>network</primary><secondary>logon scripts</secondary></indexterm>
 113         <indexterm><primary>profiles share</primary></indexterm>
 114         <indexterm><primary>security descriptors</primary></indexterm>
 115         MS Windows NT4 was introduced some time around 1996. Many environments in which NT4 was deployed
 116         have done little to keep the NT4 server environment up to date with more recent Windows releases,
 117         particularly Windows XP Professional. The migration provides opportunity to revise and update
 118         roaming profile deployment as well as folder redirection. Given that you must port the
 119         greater network configuration of this from the old NT4 server to the new Samba server.
 120         Do not forget to validate the security descriptors in the profiles share as well as network logon
 121         scripts. Feedback from sites that are migrating to Samba suggests that many are using this
 122         as a good time to update desktop systems also. In all, the extra effort should constitute no
 123         real disruption to users, but rather, with due diligence and care, should make their network experience
 124         a much happier one.
 125         </para>
 126
 127         <sect2>
 128         <title>Technical Issues</title>
 129
 130         <para>
 131         <indexterm><primary>strategic</primary></indexterm>
 132         <indexterm><primary>active directory</primary></indexterm>
 133         Migration of an NT4 domain user and group database to Samba involves a certain strategic
 134         element. Many sites have asked for instructions regarding merging of multiple NT4
 135         domains into one Samba LDAP database. It seems that this is viewed as a significant
 136         added value compared with the alternative of migration to Windows Server 200x and Active
 137         Directory. The diagram in <link linkend="ch8-migration"/> illustrates the effect of migration
 138         from a Windows NT4 domain to a Samba domain.
 139         </para>
 140
 141         <figure id="ch8-migration">
 142                 <title>Schematic Explaining the <command>net rpc vampire</command> Process</title>
 143                 <imagefile scale="55">ch8-migration</imagefile>
 144         </figure>
 145
 146         <para>
 147         <indexterm><primary>merge</primary></indexterm>
 148         <indexterm><primary>passdb.tdb</primary></indexterm>
 149         If you want to merge multiple NT4 domain account databases into one Samba domain,
 150         you must now dump the contents of the first migration and edit it as appropriate. Now clean
 151         out (remove) the tdbsam backend file (<filename>passdb.tdb</filename>) or the LDAP database
 152         files. You must start each migration with a new database into which you merge your NT4
 153         domains.
 154         </para>
 155
 156         <para><indexterm>
 157         <primary>dump</primary>
 158         </indexterm>
 159         At this point, you are ready to perform the second migration, following the same steps as
 160         for the first. In other words, dump the database, edit it, and then you may merge the
 161         dump for the first and second migrations.
 162         </para>
 163
 164         <para><indexterm>
 165         <primary>LDAP</primary>
 166         </indexterm><indexterm>
 167         <primary>migrate</primary>
 168         </indexterm><indexterm>
 169         <primary>Domain SID</primary>
 170         </indexterm>
 171         You must be careful. If you choose to migrate to an LDAP backend, your dump file
 172         now contains the full account information, including the domain SID. The domain SID for each
 173         of the two NT4 domains will be different. You must choose one and change the domain
 174         portion of the account SIDs so that all are the same.
 175         </para>
 176
 177         <para>
 178         <indexterm><primary>passdb.tdb</primary></indexterm>
 179         <indexterm><primary>/etc/passwd</primary></indexterm>
 180         <indexterm><primary>merged</primary></indexterm>
 181         <indexterm><primary>logon script</primary></indexterm>
 182         <indexterm><primary>logon hours</primary></indexterm>
 183         <indexterm><primary>logon machines</primary></indexterm>
 184         <indexterm><primary>profile path</primary></indexterm>
 185         <indexterm><primary>smbpasswd</primary></indexterm>
 186         <indexterm><primary>tdbsam</primary></indexterm>
 187         <indexterm><primary>LDAP backend</primary></indexterm>
 188         <indexterm><primary>export</primary></indexterm>
 189         <indexterm><primary>import</primary></indexterm>
 190         If you choose to use a tdbsam (<filename>passdb.tdb</filename>) backend file, your best choice
 191         is to use <command>pdbedit</command> to export the contents of the tdbsam file into an
 192         smbpasswd data file. This automatically strips out all domain-specific information,
 193         such as logon hours, logon machines, logon script, profile path, as well as the domain SID.
 194         The resulting file can be easily merged with other migration attempts (each of which must start
 195         with a clean file). It should also be noted that all users who end up in the merged smbpasswd
 196         file must have an account in <filename>/etc/passwd</filename>. The resulting smbpasswd file
 197         may be exported or imported into either a tdbsam (<filename>passdb.tdb</filename>) or
 198         an LDAP backend.
 199         </para>
 200
 201         <figure id="NT4DUM">
 202                 <title>View of Accounts in NT4 Domain User Manager</title>
 203                 <imagefile scale="50">UserMgrNT4</imagefile>
 204         </figure>
 205
 206 </sect2>
 207
 208
 209 <sect2>
 210         <title>Political Issues</title>
 211
 212         <para>
 213         The merging of multiple Windows NT4-style domains into a single LDAP-backend-based Samba
 214         domain may be seen by those who had power over them as a loss of prestige or a loss of
 215         power. The imposition of a single domain may even be seen as a threat. So in migrating and
 216         merging account databases, be consciously aware of the political fall-out in which you
 217         may find yourself entangled when key staff feel a loss of prestige.
 218         </para>
 219
 220         <para>
 221         The best advice that can be given to those who set out to merge NT4 domains into a single
 222         Samba domain is to promote (sell) the action as one that reduces costs and delivers
 223         greater network interoperability and manageability.
 224         </para>
 225
 226         </sect2>
 227
 228 </sect1>
 229
 230 <sect1>
 231         <title>Implementation</title>
 232
 233         <para>
 234         From feedback on the Samba mailing lists, it seems that most Windows NT4 migrations
 235         to Samba are being performed using a new server or a new installation of a Linux or UNIX
 236         server. If you contemplate doing this, please note that the steps that follow in this
 237         chapter assume familiarity with the information that has been previously covered in this
 238         book. You are particularly encouraged to be familiar with <link linkend="secure"/>,
 239         <link linkend="Big500users"/> and <link linkend="happy"/>.
 240         </para>
 241
 242         <para>
 243         We present here the steps and example output for two NT4 to Samba domain migrations. The
 244         first uses an LDAP-based backend, and the second uses a tdbsam backend. In each case the
 245         scripts you specify in the &smb.conf; file for the <parameter>add user script</parameter>
 246         collection of parameters are used to effect the addition of accounts into the passdb backend.
 247         </para>
 248
 249         <para>
 250         Before proceeding to NT4 migration using either a tdbsam or ldapsam, it is most strongly recommended to
 251         review <link linkend="ch5-dnshcp-setup"/> for DNS and DHCP configuration. The importance of correctly
 252         functioning name resolution must be recognized. This applies equally for both hostname and NetBIOS names
 253         (machine names, computer names, domain names, workgroup names &smbmdash; ALL names!).
 254         </para>
 255
 256         <para>
 257         The migration process involves the following steps:
 258         </para>
 259
 260         <itemizedlist>
 261                 <listitem><para>
 262                 Prepare the target Samba server. This involves configuring Samba-3 for
 263                 migration to either a tdbsam or an ldapsam backend.
 264                 </para></listitem>
 265
 266                 <listitem><para>
 267                 <indexterm><primary>uppercase</primary></indexterm>
 268                 <indexterm><primary>Posix</primary></indexterm>
 269                 <indexterm><primary>lower-case</primary></indexterm>
 270                 Clean up the source NT4 PDC. Delete all accounts that need not be migrated.
 271                 Delete all files that should not be migrated. Where possible, change NT group
 272                 names so there are no spaces or uppercase characters. This is important if
 273                 the target UNIX host insists on POSIX-compliant all lowercase user and group
 274                 names.
 275                 </para></listitem>
 276
 277                 <listitem><para>
 278                 Step through the migration process.
 279                 </para></listitem>
 280
 281                 <listitem><para><indexterm><primary>PDC</primary></indexterm>
 282                 Remove the NT4 PDC from the network.
 283                 </para></listitem>
 284
 285                 <listitem><para>
 286                 Upgrade the Samba server from a BDC to a PDC, and validate all account
 287                 information.
 288                 </para></listitem>
 289         </itemizedlist>
 290
 291         <para>
 292         It may help to use the above outline as a pre-migration checklist.
 293         </para>
 294
 295         <sect2>
 296         <title>NT4 Migration Using LDAP Backend</title>
 297
 298         <para>
 299         In this example, the migration is of an NT4 PDC to a Samba PDC with an LDAP backend. The accounts about
 300         to be migrated are shown in <link linkend="NT4DUM"/>. In this example use is made of the
 301         smbldap-tools scripts to add the accounts that are migrated into the ldapsam passdb backend.
 302         Four scripts are essential to the migration process. Other scripts will be required
 303         for daily management, but these are not critical to migration. The critical scripts are dependant
 304         on which passdb backend is being used. Refer to <link linkend="ch8-vampire"/> to see which scripts
 305         must be provided so that the migration process can complete.
 306         </para>
 307
 308         <para>
 309         Verify that you have correctly specified in the &smb.conf; file the scripts and arguments
 310         that should be passed to them before attempting to perform the account migration. Note also
 311         that the deletion scripts must be commented out during migration. These should be uncommented
 312         following successful migration of the NT4 Domain accounts.
 313         </para>
 314
 315         <warning><para>
 316         Under absolutely no circumstances should the Samba daemons be started until instructed to do so.
 317         Delete the <filename>/etc/samba/secrets.tdb</filename> file and all Samba control tdb files
 318         before commencing the following configuration steps.
 319         </para></warning>
 320
 321         <table id="ch8-vampire">
 322                 <title>Samba &smb.conf; Scripts Essential to Samba Operation</title>
 323                 <tgroup cols="3">
 324                         <colspec align="left"/>
 325                         <colspec align="center"/>
 326                         <colspec align="center"/>
 327                         <thead>
 328                                 <row>
 329                                         <entry>Entity</entry>
 330                                         <entry>ldapsam Script</entry>
 331                                         <entry>tdbsam Script</entry>
 332                                 </row>
 333                         </thead>
 334                         <tbody>
 335                                 <row>
 336                                         <entry>Add User Accounts</entry>
 337                                         <entry>smbldap-useradd</entry>
 338                                         <entry>useradd</entry>
 339                                 </row>
 340                                 <row>
 341                                         <entry>Delete User Accounts</entry>
 342                                         <entry>smbldap-userdel</entry>
 343                                         <entry>userdel</entry>
 344                                 </row>
 345                                 <row>
 346                                         <entry>Add Group Accounts</entry>
 347                                         <entry>smbldap-groupadd</entry>
 348                                         <entry>groupadd</entry>
 349                                 </row>
 350                                 <row>
 351                                         <entry>Delete Group Accounts</entry>
 352                                         <entry>smbldap-groupdel</entry>
 353                                         <entry>groupdel</entry>
 354                                 </row>
 355                                 <row>
 356                                         <entry>Add User to Group</entry>
 357                                         <entry>smbldap-groupmod</entry>
 358                                         <entry>usermod (See Note)</entry>
 359                                 </row>
 360                                 <row>
 361                                         <entry>Add Machine Accounts</entry>
 362                                         <entry>smbldap-useradd</entry>
 363                                         <entry>useradd</entry>
 364                                 </row>
 365                         </tbody>
 366                 </tgroup>
 367         </table>
 368
 369         <note><para>
 370         <indexterm><primary>usermod</primary></indexterm>
 371         <indexterm><primary>groupmem</primary></indexterm>
 372         <indexterm><primary>smbldap-tools</primary></indexterm>
 373         The UNIX/Linux <command>usermod</command> utility does not permit simple user addition to (or deletion
 374         of users from) groups. This is a feature provided by the smbldap-tools scripts. If you want this
 375         capability, you must create your own tool to do this. Alternately, you can search the Web
 376         to locate a utility called <command>groupmem</command> (by George Kraft) that provides this functionality.
 377         The <command>groupmem</command> utility was contributed to the shadow package but has not surfaced
 378         in the formal commands provided by Linux distributions (March 2004).
 379         </para></note>
 380
 381         <note><para>
 382         <indexterm><primary>tdbdump</primary></indexterm>
 383         The <command>tdbdump</command> utility is a utility that you can build from the Samba source-code tree. Not all Linux binary distributions include this tool. If it is missing from your
 384         Linux distribution, you will need to build this yourself or else forgo its use.
 385         </para></note>
 386
 387         <para>
 388         <indexterm><primary>User Manager</primary></indexterm>
 389         Before starting the migration, all dead accounts were removed from the NT4 domain using the User Manager for Domains.
 390         </para>
 391
 392         <procedure>
 393         <title>User Migration Steps</title>
 394
 395                 <step><para>
 396                 Configure the Samba &smb.conf; file to create a BDC. An example configuration is
 397                 given in <link linkend="sbent4smb"/>.
 398                 The delete scripts are commented out so that during the process of migration
 399                 no account information can be deleted.
 400                 </para></step>
 401
 402 <example id="sbent4smb">
 403 <title>NT4 Migration Samba Server <filename>smb.conf</filename> &smbmdash; Part: A</title>
 404 <smbconfblock>
 405 <smbconfsection name="[global]"/>
 406         <smbconfoption name="workgroup">DAMNATION</smbconfoption>
 407         <smbconfoption name="netbios name">MERLIN</smbconfoption>
 408         <smbconfoption name="passdb backend">ldapsam:ldap://localhost</smbconfoption>
 409         <smbconfoption name="log level">1</smbconfoption>
 410         <smbconfoption name="syslog">0</smbconfoption>
 411         <smbconfoption name="log file">/var/log/samba/%m</smbconfoption>
 412         <smbconfoption name="max log size">0</smbconfoption>
 413         <smbconfoption name="smb ports">139 445</smbconfoption>
 414         <smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
 415         <smbconfoption name="add user script">/opt/IDEALX/sbin/smbldap-useradd -m '%u'</smbconfoption>
 416         <smbconfoption name="#delete user script">/opt/IDEALX/sbin/smbldap-userdel '%u'</smbconfoption>
 417         <smbconfoption name="add group script">/opt/IDEALX/sbin/smbldap-groupadd '%g'</smbconfoption>
 418         <smbconfoption name="#delete group script">/opt/IDEALX/sbin/smbldap-groupdel '%g'</smbconfoption>
 419                 <smbconfoption name="add user to group script">/opt/IDEALX/sbin/ smbldap-groupmod -m '%u' '%g'</smbconfoption>
 420                 <smbconfoption name="#delete user from group script">/opt/IDEALX/sbin/smbldap-groupmod -x '%u' '%g'</smbconfoption>
 421                 <smbconfoption name="set primary group script">/opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</smbconfoption>
 422                 <smbconfoption name="add machine script">/opt/IDEALX/sbin/smbldap-useradd -w '%u'</smbconfoption>
 423         <smbconfoption name="logon script">scripts\logon.cmd</smbconfoption>
 424         <smbconfoption name="logon path">\\%L\profiles\%U</smbconfoption>
 425         <smbconfoption name="logon home">\\%L\%U</smbconfoption>
 426         <smbconfoption name="logon drive">X:</smbconfoption>
 427         <smbconfoption name="domain logons">Yes</smbconfoption>
 428         <smbconfoption name="domain master">No</smbconfoption>
 429         <smbconfoption name="#wins support">Yes</smbconfoption>
 430         <smbconfoption name="wins server">192.168.123.124</smbconfoption>
 431         <smbconfoption name="ldap admin dn">cn=Manager,dc=terpstra-world,dc=org</smbconfoption>
 432         <smbconfoption name="ldap group suffix">ou=Groups</smbconfoption>
 433         <smbconfoption name="ldap idmap suffix">ou=Idmap</smbconfoption>
 434         <smbconfoption name="ldap machine suffix">ou=People</smbconfoption>
 435         <smbconfoption name="ldap passwd sync">Yes</smbconfoption>
 436         <smbconfoption name="ldap suffix">dc=terpstra-world,dc=org</smbconfoption>
 437         <smbconfoption name="ldap ssl">no</smbconfoption>
 438         <smbconfoption name="ldap timeout">20</smbconfoption>
 439         <smbconfoption name="ldap user suffix">ou=People</smbconfoption>
 440         <smbconfoption name="idmap backend">ldap:ldap://localhost</smbconfoption>
 441         <smbconfoption name="idmap uid">15000-20000</smbconfoption>
 442         <smbconfoption name="idmap gid">15000-20000</smbconfoption>
 443         <smbconfoption name="winbind nested groups">Yes</smbconfoption>
 444         <smbconfoption name="ea support">Yes</smbconfoption>
 445         <smbconfoption name="map acl inherit">Yes</smbconfoption>
 446         </smbconfblock>
 447 </example>
 448
 449 <example id="sbent4smb2">
 450 <title>NT4 Migration Samba Server <filename>smb.conf</filename> &smbmdash; Part: B</title>
 451 <smbconfblock>
 452 <smbconfsection name="[apps]"/>
 453         <smbconfoption name="comment">Application Data</smbconfoption>
 454         <smbconfoption name="path">/data/home/apps</smbconfoption>
 455                 <smbconfoption name="read only">No</smbconfoption>
 456
 457 <smbconfsection name="[homes]"/>
 458         <smbconfoption name="comment">Home Directories</smbconfoption>
 459         <smbconfoption name="path">/home/users/%U/Documents</smbconfoption>
 460         <smbconfoption name="valid users">%S</smbconfoption>
 461         <smbconfoption name="read only">No</smbconfoption>
 462         <smbconfoption name="browseable">No</smbconfoption>
 463
 464 <smbconfsection name="[printers]"/>
 465         <smbconfoption name="comment">SMB Print Spool</smbconfoption>
 466         <smbconfoption name="path">/var/spool/samba</smbconfoption>
 467         <smbconfoption name="guest ok">Yes</smbconfoption>
 468         <smbconfoption name="printable">Yes</smbconfoption>
 469         <smbconfoption name="use client driver">No</smbconfoption>
 470         <smbconfoption name="browseable">No</smbconfoption>
 471
 472 <smbconfsection name="[netlogon]"/>
 473         <smbconfoption name="comment">Network Logon Service</smbconfoption>
 474         <smbconfoption name="path">/var/lib/samba/netlogon</smbconfoption>
 475         <smbconfoption name="guest ok">Yes</smbconfoption>
 476         <smbconfoption name="locking">No</smbconfoption>
 477
 478 <smbconfsection name="[profiles]"/>
 479         <smbconfoption name="comment">Profile Share</smbconfoption>
 480         <smbconfoption name="path">/var/lib/samba/profiles</smbconfoption>
 481         <smbconfoption name="read only">No</smbconfoption>
 482         <smbconfoption name="profile acls">Yes</smbconfoption>
 483
 484 <smbconfsection name="[profdata]"/>
 485         <smbconfoption name="comment">Profile Data Share</smbconfoption>
 486         <smbconfoption name="path">/var/lib/samba/profdata</smbconfoption>
 487         <smbconfoption name="read only">No</smbconfoption>
 488         <smbconfoption name="profile acls">Yes</smbconfoption>
 489
 490 <smbconfsection name="[print$]"/>
 491         <smbconfoption name="comment">Printer Drivers</smbconfoption>
 492         <smbconfoption name="path">/var/lib/samba/drivers</smbconfoption>
 493         </smbconfblock>
 494 </example>
 495
 496                 <step><para>
 497                 <indexterm><primary>slapd.conf</primary></indexterm>
 498                 Configure OpenLDAP in preparation for the migration. An example
 499                 <filename>sladp.conf</filename> file is shown in <link linkend="sbentslapd"/>.
 500                 The <constant>rootpw</constant> value is an encrypted password string that can
 501                 be obtained by executing the <command>slappasswd</command> command.
 502                 </para></step>
 503
 504 <example id="sbentslapd">
 505 <title>NT4 Migration LDAP Server Configuration File: <filename>/etc/openldap/slapd.conf</filename> &smbmdash; Part A</title>
 506 <screen>
 507 include         /etc/openldap/schema/core.schema
 508 include         /etc/openldap/schema/cosine.schema
 509 include         /etc/openldap/schema/inetorgperson.schema
 510 include         /etc/openldap/schema/nis.schema
 511 include         /etc/openldap/schema/samba3.schema
 512
 513 pidfile         /var/run/slapd/slapd.pid
 514 argsfile        /var/run/slapd/slapd.args
 515
 516 access to dn.base=""
 517                 by self write
 518                 by * auth
 519
 520 access to attr=userPassword
 521                 by self write
 522                 by * auth
 523
 524 access to attr=shadowLastChange
 525                 by self write
 526                 by * read
 527
 528 access to *
 529                 by * read
 530                 by anonymous auth
 531 </screen>
 532 </example>
 533
 534 <example id="sbentslapd2">
 535 <title>NT4 Migration LDAP Server Configuration File: <filename>/etc/openldap/slapd.conf</filename> &smbmdash; Part B</title>
 536 <screen>
 537 #loglevel       256
 538
 539 #schemacheck     on
 540 idletimeout     30
 541 #backend         bdb
 542 database        bdb
 543 checkpoint      1024 5
 544 cachesize       10000
 545
 546 suffix          "dc=terpstra-world,dc=org"
 547 rootdn          "cn=Manager,dc=terpstra-world,dc=org"
 548
 549 # rootpw = not24get
 550 rootpw          {SSHA}86kTavd9Dw3FAz6qzWTrCOKX/c0Qe+UV
 551
 552 directory       /var/lib/ldap
 553
 554 # Indices to maintain
 555 index objectClass           eq
 556 index cn                    pres,sub,eq
 557 index sn                    pres,sub,eq
 558 index uid                   pres,sub,eq
 559 index displayName           pres,sub,eq
 560 index uidNumber             eq
 561 index gidNumber             eq
 562 index memberUID             eq
 563 index sambaSID              eq
 564 index sambaPrimaryGroupSID  eq
 565 index sambaDomainName       eq
 566 index default               sub
 567 </screen>
 568 </example>
 569
 570                 <step><para>
 571                 <indexterm><primary>nss_ldap</primary></indexterm>
 572                 <indexterm><primary>/etc/ldap.conf</primary></indexterm>
 573                 Install the PADL <command>nss_ldap</command> tool set, then configure the <filename>/etc/ldap.conf</filename>
 574                 as shown in <link linkend="sbrntldapconf"/>.
 575                 </para></step>
 576
 577 <example id="sbrntldapconf">
 578 <title>NT4 Migration NSS LDAP File: <filename>/etc/ldap.conf</filename></title>
 579 <screen>
 580 host    127.0.0.1
 581
 582 base    dc=terpstra-world,dc=org
 583
 584 ldap_version    3
 585
 586 binddn cn=Manager,dc=terpstra-world,dc=org
 587 bindpw not24get
 588
 589 pam_password exop
 590
 591 nss_base_passwd         ou=People,dc=terpstra-world,dc=org?one
 592 nss_base_shadow         ou=People,dc=terpstra-world,dc=org?one
 593 nss_base_group          ou=Groups,dc=terpstra-world,dc=org?one
 594
 595 ssl off
 596 </screen>
 597 </example>
 598
 599                 <step><para>
 600                 <indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
 601                 Edit the <filename>/etc/nsswitch.conf</filename> file so it has the entries shown
 602                 in <link linkend="sbentnss"/>. Note that the LDAP entries have been commented out.
 603                 This is deliberate. If these entries are active (not commented out), and the
 604                 <filename>/etc/ldap.conf</filename> file has been configured, when the LDAP server
 605                 is started, the process of starting the LDAP server will cause LDAP lookups. This
 606                 causes the LDAP server <command>slapd</command> to hang because it finds port 389
 607                 open and therefore cannot gain exclusive control of it. By commenting these entries
 608                 out, it is possible to avoid this gridlock situation and thus the overall
 609                 installation and configuration will progress more smoothly.
 610                 </para></step>
 611
 612 <example id="sbentnss">
 613 <title>NT4 Migration NSS Control File: <filename>/etc/nsswitch.conf</filename> (Stage:1)</title>
 614 <screen>
 615 passwd:         files #ldap
 616 shadow:         files #ldap
 617 group:          files #ldap
 618
 619 hosts:          files dns wins
 620 networks:       files dns
 621
 622 services:       files
 623 protocols:      files
 624 rpc:            files
 625 ethers:         files
 626 netmasks:       files
 627 netgroup:       files
 628 publickey:      files
 629
 630 bootparams:     files
 631 automount:      files nis
 632 aliases:        files
 633 #passwd_compat: ldap       #Not needed.
 634 #group_compat:  ldap      #Not needed.
 635 </screen>
 636 </example>
 637
 638                 <step><para>
 639                 Validate the the target NT4 PDC name is being correctly resolved to its IP address by
 640                 executing the following:
 641 <screen>
 642 &rootprompt; ping transgression
 643 PING transgression.terpstra-world.org (192.168.1.5) 56(84) bytes of data.
 644 64 bytes from (192.168.1.5): icmp_seq=1 ttl=128 time=0.159 ms
 645 64 bytes from (192.168.1.5): icmp_seq=2 ttl=128 time=0.192 ms
 646 64 bytes from (192.168.1.5): icmp_seq=3 ttl=128 time=0.141 ms
 647
 648 --- transgression.terpstra-world.org ping statistics ---
 649 3 packets transmitted, 3 received, 0% packet loss, time 2000ms
 650 rtt min/avg/max/mdev = 0.141/0.164/0.192/0.021 ms
 651 </screen>
 652                 Do not proceed to the next step if this step fails. It is imperative that the name of the PDC
 653                 can be resolved to its IP address. If this is broken, fix it.
 654                 </para></step>
 655
 656                 <step><para>
 657                 Pull the domain SID from the NT4 domain that is being migrated as follows:
 658 <screen>
 659 &rootprompt; net rpc getsid -S TRANGRESSION -U Administrator%not24get
 660 Storing SID S-1-5-21-1385457007-882775198-1210191635 \
 661                      for Domain DAMNATION in secrets.tdb
 662 </screen>
 663                 </para>
 664
 665                 <para>
 666                 Another way to obtain the domain SID from the target NT4 domain that is being
 667                 migrated to Samba is by executing the following:
 668 <screen>
 669 &rootprompt; net rpc info -S TRANSGRESSION
 670 </screen>
 671                 If this method is used, do not forget to store the SID obtained into the
 672                 <filename>secrets.tdb</filename> file. This can be done by executing:
 673 <screen>
 674 &rootprompt; net setlocalsid S-1-5-21-1385457007-882775198-1210191635
 675 </screen>
 676                 </para></step>
 677
 678                 <step><para>
 679                 <indexterm><primary>Idealx</primary></indexterm>
 680                 <indexterm><primary>configure.pl</primary></indexterm>
 681                 <indexterm><primary>/opt/IDEALX/sbin</primary></indexterm>
 682                 <indexterm><primary>smbldap-tools</primary></indexterm>
 683                 Install the Idealx <command>smbldap-tools</command> software package, following
 684                 the instructions given in <link linkend="sbeidealx"/>. The resulting perl scripts
 685                 should be located in the <filename>/opt/IDEALX/sbin</filename> directory.
 686                 Change into that location, or wherever the scripts have been installed. Execute the
 687                 <filename>configure.pl</filename> script to configure the Idealx package for use.
 688                 Note: Use the domain SID obtained from the step above. The following is
 689                 an example configuration session:
 690 <screen>
 691 &rootprompt; ./configure.pl
 692 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 693        smbldap-tools script configuration
 694        -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 695 Before starting, check
 696  . if your samba controller is up and running.
 697  . if the domain SID is defined
 698                            (you can get it with the 'net getlocalsid')
 699
 700  . you can leave the configuration using the Crtl-c key combination
 701  . empty value can be set with the "." character
 702 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 703 Looking for configuration files...
 704
 705 Samba Config File Location [/etc/samba/smb.conf] &gt;
 706 smbldap Config file Location (global parameters)
 707            [/etc/smbldap-tools/smbldap.conf] &gt;
 708 smbldap Config file Location (bind parameters)
 709       [/etc/smbldap-tools/smbldap_bind.conf] &gt;
 710 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 711 Let's start configuring the smbldap-tools scripts ...
 712
 713 . workgroup name: name of the domain Samba act as a PDC
 714   workgroup name [DAMNATION] &gt;
 715 . netbios name: netbios name of the samba controller
 716   netbios name [MERLIN] &gt;
 717 . logon drive: local path to which the home directory
 718          will be connected (for NT Workstations). Ex: 'H:'
 719   logon drive [X:] &gt; H:
 720 . logon home: home directory location (for Win95/98 or NT Workstation)
 721   (use %U as username) Ex:'\\MERLIN\home\%U'
 722   logon home (leave blank if you don't want homeDirectory)
 723                                        [\\MERLIN\home\%U] &gt; \\%L\%U
 724 . logon path: directory where roaming profiles are stored.
 725                                      Ex:'\\MERLIN\profiles\%U'
 726   logon path (leave blank if you don't want roaming profile)
 727                           [\\MERLIN\profiles\%U] &gt; \\%L\profiles\%U
 728 . home directory prefix (use %U as username) [/home/%U] >
 729                                                         /home/users/%U
 730 . default user netlogon script (use %U as username)
 731                                [%U.cmd] &gt; scripts\logon.cmd
 732   default password validation time (time in days) [45] > 180
 733 . ldap suffix [dc=terpstra-world,dc=org] &gt;
 734 . ldap group suffix [ou=Groups] &gt;
 735 . ldap user suffix [ou=People] &gt;
 736 . ldap machine suffix [ou=People] &gt;
 737 . Idmap suffix [ou=Idmap] &gt;
 738 . sambaUnixIdPooldn: object where you want to store the next uidNumber
 739   and gidNumber available for new users and groups
 740   sambaUnixIdPooldn object (relative to ${suffix})
 741                                          [sambaDomainName=DAMNATION] >
 742 . ldap master server:
 743            IP address or DNS name of the master (writable) ldap server
 744   ldap master server [] &gt; 127.0.0.1
 745 . ldap master port [389] &gt;
 746 . ldap master bind dn [cn=Manager,dc=terpstra-world,dc=org] &gt;
 747 . ldap master bind password [] &gt;
 748 . ldap slave server: IP address or DNS name of the slave ldap server:
 749                                          can also be the master one
 750   ldap slave server [] &gt; 127.0.0.1
 751 . ldap slave port [389] &gt;
 752 . ldap slave bind dn [cn=Manager,dc=terpstra-world,dc=org] &gt;
 753 . ldap slave bind password [] &gt;
 754 . ldap tls support (1/0) [0] &gt;
 755 . SID for domain DAMNATION: SID of the domain
 756                        (can be obtained with 'net getlocalsid MERLIN')
 757   SID for domain DAMNATION []
 758         &gt; S-1-5-21-1385457007-882775198-1210191635
 759 . unix password encryption: encryption used for unix passwords
 760 unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA) [SSHA] &gt; MD5
 761 . default user gidNumber [513] &gt;
 762 . default computer gidNumber [515] &gt;
 763 . default login shell [/bin/bash] &gt;
 764 . default domain name to append to mail address [] &gt;
 765                                                     terpstra-world.org
 766 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 767 backup old configuration files:
 768   /etc/smbldap-tools/smbldap.conf-&gt;
 769                               /etc/smbldap-tools/smbldap.conf.old
 770   /etc/smbldap-tools/smbldap_bind.conf-&gt;
 771                               /etc/smbldap-tools/smbldap_bind.conf.old
 772 writing new configuration file:
 773   /etc/smbldap-tools/smbldap.conf done.
 774   /etc/smbldap-tools/smbldap_bind.conf done.
 775 </screen>
 776                 <indexterm><primary>sambaDomainName</primary></indexterm>
 777                 <indexterm><primary>NextFreeUnixId</primary></indexterm>
 778                 <indexterm><primary>updating smbldap-tools</primary></indexterm>
 779                 <indexterm><primary>smbldap-tools updating</primary></indexterm>
 780                 Note that the NT4 domain SID that was previously obtained was entered above. Also,
 781                 the sambaUnixIdPooldn object was specified as sambaDomainName=DAMNATION. This is
 782                 the location into which the Idealx smbldap-tools store the next available UID/GID
 783                 information. It is also where Samba stores domain specific information such as the
 784                 next RID, the SID, and so on. In older version of the smbldap-tools this information
 785                 was stored in the sambaUnixIdPooldn DIT location cn=NextFreeUnixId. Where smbldap-tools
 786                 are being upgraded to version 0.9.1 it is appropriate to update this to the new location
 787                 only if the directory information is also relocated.
 788                 </para></step>
 789
 790                 <step><para>
 791                 Start the LDAP server using the system interface script. On Novell SLES9
 792                 this is done as shown here:
 793 <screen>
 794 &rootprompt; rcldap start
 795 </screen>
 796                 </para></step>
 797
 798                 <step><para>
 799                 Edit the <filename>/etc/nsswitch.conf</filename> file so it has the entries shown in
 800                 <link linkend="sbentnss2"/>. Note that the LDAP entries have now been uncommented.
 801                 </para></step>
 802
 803 <example id="sbentnss2">
 804 <title>NT4 Migration NSS Control File: <filename>/etc/nsswitch.conf</filename> (Stage:2)</title>
 805 <screen>
 806 passwd:         files ldap
 807 shadow:         files ldap
 808 group:          files ldap
 809
 810 hosts:          files dns wins
 811 networks:       files dns
 812
 813 services:       files
 814 protocols:      files
 815 rpc:            files
 816 ethers:         files
 817 netmasks:       files
 818 netgroup:       files
 819 publickey:      files
 820
 821 bootparams:     files
 822 automount:      files nis
 823 aliases:        files
 824 #passwd_compat: ldap       #Not needed.
 825 #group_compat:  ldap      #Not needed.
 826 </screen>
 827 </example>
 828
 829                 <step><para>
 830                 The LDAP management password must be installed into the <filename>secrets.tdb</filename>
 831                 file as follows:
 832 <screen>
 833 &rootprompt; smbpasswd -w not24get
 834 Setting stored password for
 835             "cn=Manager,dc=terpstra-world,dc=org" in secrets.tdb
 836 </screen>
 837                 </para></step>
 838
 839                 <step><para>
 840                 Populate the LDAP directory as shown here:
 841 <screen>
 842 &rootprompt; /opt/IDEALX/sbin/smbldap-populate -a root -k 0 -m 0
 843 Using workgroup name from sambaUnixIdPooldn (smbldap.conf):
 844                           sambaDomainName=DAMNATION
 845 Using builtin directory structure
 846 adding new entry: dc=terpstra-world,dc=org
 847 adding new entry: ou=People,dc=terpstra-world,dc=org
 848 adding new entry: ou=Groups,dc=terpstra-world,dc=org
 849 entry ou=People,dc=terpstra-world,dc=org already exist.
 850 adding new entry: ou=Idmap,dc=terpstra-world,dc=org
 851 adding new entry: sambaDomainName=DAMNATION,dc=terpstra-world,dc=org
 852 adding new entry: uid=root,ou=People,dc=terpstra-world,dc=org
 853 adding new entry: uid=nobody,ou=People,dc=terpstra-world,dc=org
 854 adding new entry: cn=Domain Admins,ou=Groups,dc=terpstra-world,dc=org
 855 adding new entry: cn=Domain Users,ou=Groups,dc=terpstra-world,dc=org
 856 adding new entry: cn=Domain Guests,ou=Groups,dc=terpstra-world,dc=org
 857 adding new entry: cn=Domain Computers,ou=Groups,dc=terpstra-world,dc=org
 858 adding new entry: cn=Administrators,ou=Groups,dc=terpstra-world,dc=org
 859 adding new entry: cn=Print Operators,ou=Groups,dc=terpstra-world,dc=org
 860 adding new entry: cn=Backup Operators,ou=Groups,dc=terpstra-world,dc=org
 861 adding new entry: cn=Replicators,ou=Groups,dc=terpstra-world,dc=org
 862 </screen>
 863                 The script tries to add the ou=People container twice, hence the error message.
 864                 This is expected behavior.
 865                 </para></step>
 866
 867                 <step><para>
 868                 <indexterm><primary>Novell SUSE SLES 9</primary></indexterm>
 869                 Restart the LDAP server following initialization of the LDAP directory. Execute the
 870                 system control script provided on your system. The following steps can be used on
 871                 Novell SUSE SLES 9:
 872 <screen>
 873 &rootprompt; rcldap restart
 874 &rootprompt; chkconfig ldap on
 875 </screen>
 876                 </para></step>
 877
 878                 <step><para>
 879                 Verify that the new user accounts that have been added to the LDAP directory can be
 880                 resolved as follows:
 881 <screen>
 882 &rootprompt; getent passwd
 883 ...
 884 nobody:x:65534:65533:nobody:/var/lib/nobody:/bin/bash
 885 man:x:13:62:Manual pages viewer:/var/cache/man:/bin/bash
 886 news:x:9:13:News system:/etc/news:/bin/bash
 887 uucp:x:10:14:Unix-to-Unix CoPy system:/etc/uucp:/bin/bash
 888 +::0:0:::
 889 root:x:0:0:Netbios Domain Administrator:/home/users/root:/bin/false
 890 nobody:x:999:514:nobody:/dev/null:/bin/false
 891 </screen>
 892                 Now repeat this for the group accounts as shown here:
 893 <screen>
 894 &rootprompt; getent group
 895 ...
 896 nobody:x:65533:
 897 nogroup:x:65534:nobody
 898 users:x:100:
 899 +::0:
 900 Domain Admins:x:512:root
 901 Domain Users:x:513:
 902 Domain Guests:x:514:
 903 Domain Computers:x:515:
 904 Administrators:x:544:
 905 Print Operators:x:550:
 906 Backup Operators:x:551:
 907 Replicators:x:552:
 908 </screen>
 909                 In both cases the LDAP accounts follow the <quote>+::0:</quote> entry.
 910                 </para></step>
 911
 912                 <step><para>
 913                 Now it is time to join the Samba BDC to the target NT4 domain that is being
 914                 migrated to Samba by executing the following:
 915 <screen>
 916 &rootprompt; net rpc join -S TRANSGRESSION -U Administrator%not24get
 917 merlin:/opt/IDEALX/sbin # net rpc join -S TRANSGRESSION \
 918                          -U Administrator%not24get
 919 Joined domain DAMNATION.
 920 </screen>
 921                 </para></step>
 922
 923                 <step><para>
 924                 Set the new domain administrator (root) password for both UNIX and Windows as shown here:
 925 <screen>
 926 &rootprompt; /opt/IDEALX/sbin/smbldap-passwd root
 927 Changing password for root
 928 New password : ********
 929 Retype new password : ********
 930 </screen>
 931                 Note: During account migration, the Windows Administrator account will not be migrated
 932                 to the Samba server.
 933                 </para></step>
 934
 935                 <step><para>
 936                 Now validate that these accounts can be resolved using Samba's tools as
 937                 shown here for user accounts:
 938 <screen>
 939 &rootprompt; pdbedit -Lw
 940 root:0:84B0D8E14D158FF8417EAF50CFAC29C3:
 941         AF6DD3FD4E2EA8BDE1695A3F05EFBF52:[U          ]:LCT-425F6467:
 942 nobody:65534:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:
 943         NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:[NU         ]:LCT-00000000:
 944 </screen>
 945                 Now complete the following step to validate that group account mappings have
 946                 been correctly set:
 947 <screen>
 948 &rootprompt; net groupmap list
 949 Domain Admins (S-1-5-21-1385457007-882775198-1210191635-512)
 950                                             -&gt; Domain Admins
 951 Domain Users (S-1-5-21-1385457007-882775198-1210191635-513)
 952                                              -&gt; Domain Users
 953 Domain Guests (S-1-5-21-1385457007-882775198-1210191635-514)
 954                                             -&gt; Domain Guests
 955 Domain Computers (S-1-5-21-1385457007-882775198-1210191635-515)
 956                                           -&gt; Domain Computers
 957 Administrators (S-1-5-32-544) -&gt; Administrators
 958 Print Operators (S-1-5-32-550) -&gt; Print Operators
 959 Backup Operators (S-1-5-32-551) -&gt; Backup Operators
 960 Replicators (S-1-5-32-552) -> Replicators
 961 </screen>
 962                 These are the expected results for a correctly configured system.
 963                 </para></step>
 964
 965                 <step><para>
 966                 Commence migration as shown here:
 967 <screen>
 968 &rootprompt; net rpc vampire -S TRANSGRESSION \
 969        -U Administrator%not24get &gt; /tmp/vampire.log 2&gt;1
 970 </screen>
 971                 Check the vampire log to confirm that only expected errors have been
 972                 reported. See <link linkend="sbevam1"/>.
 973                 </para></step>
 974
 975                 <step><para>
 976                 The migration of user accounts can be quickly validated as follows:
 977 <screen>
 978 &rootprompt; pdbedit -Lw
 979 root:0:84B0D8E14D158FF8417EAF50CFAC29C3:...
 980 nobody:65534:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:...
 981 Administrator:0:84B0D8E14D158FF8417EAF50CFAC29C3:...
 982 Guest:1:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:...
 983 TRANSGRESSION$:2:CC044B748CEE294CE76B6B0D1B86C1A8:...
 984 IUSR_TRANSGRESSION:3:64046AC81B056C375F9537FC409085F8:...
 985 MIDEARTH$:4:E93186E5819706D2AAD3B435B51404EE:...
 986 atrickhoffer:5:DC08CFE0C12B2867352502E32A407F23:...
 987 barryf:6:B829BCDE01FF24376E45D5F10408CFBD:...
 988 fsellerby:7:6A97CBEBE8F9826B417EAF50CFAC29C3:...
 989 gdaison:8:48F6A8C8A900024351DA8C2061C5F1D3:...
 990 hrambotham:9:7330D9EA0964465EAAD3B435B51404EE:...
 991 jrhapsody:10:ACBA7D207E2BA35D9BD41A26B01626BD:...
 992 maryk:11:293B5A4CA41F6CA1A7D80430B8342B73:...
 993 jacko:12:8E8982D86BD037C364BBD09A598E07AD:...
 994 bridge:13:0D2CA7D2BE67FE2193BE3A377C968336:...
 995 sharpec:14:8841A75CAC19D2855D8B73B1F4D430F8:...
 996 jimbo:15:6E8BDC904FD9EC5C17306D272A9441BB:...
 997 dhenwick:16:D1694A03C33584BDAAD3B435B51404EE:...
 998 dork:17:69E2D19E69A593D5AAD3B435B51404EE:...
 999 blue:18:E355EBF9559979FEAAD3B435B51404EE:...
1000 billw:19:EE35C3481CF7F7DB484448BC86A641A5:...
1001 rfreshmill:20:7EC033B58661B60CAAD3B435B51404EE:...
1002 MAGGOT$:21:A3B9334765AD30F7AAD3B435B51404EE:...
1003 TRENTWARE$:22:1D92C8DD5E7F0DDF93BE3A377C968336:...
1004 MORTON$:23:89342E69DCA9D3F8AAD3B435B51404EE:...
1005 NARM$:24:2B93E2D1D25448BDAAD3B435B51404EE:...
1006 LAPDOG$:25:14AA535885120943AAD3B435B51404EE:...
1007 SCAVENGER$:26:B6288EB6D147B56F8963805A19B0ED49:...
1008 merlin$:27:820C50523F368C54AB9D85AE603AD09D:...
1009 </screen>
1010                 </para></step>
1011
1012                 <step><para>
1013                 The mapping of UNIX and Windows groups can be validated as show here:
1014 <screen>
1015 &rootprompt; net groupmap list
1016 Domain Admins (S-1-5-21-1385457007-882775198-1210191635-512)
1017                                                      -&gt; Domain Admins
1018 Domain Users (S-1-5-21-1385457007-882775198-1210191635-513)
1019                                                       -&gt; Domain Users
1020 Domain Guests (S-1-5-21-1385457007-882775198-1210191635-514)
1021                                                      -&gt; Domain Guests
1022 Domain Computers (S-1-5-21-1385457007-882775198-1210191635-515)
1023                                                    -&gt; Domain Computers
1024 Administrators (S-1-5-32-544) -&gt; Administrators
1025 Print Operators (S-1-5-32-550) -&gt; Print Operators
1026 Backup Operators (S-1-5-32-551) -&gt; Backup Operators
1027 Replicator (S-1-5-32-552) -&gt; Replicators
1028 Engineers (S-1-5-21-1385457007-882775198-1210191635-1020) -&gt; Engineers
1029 Marketoids (S-1-5-21-1385457007-882775198-1210191635-1022) -&gt; Marketoids
1030 Gnomes (S-1-5-21-1385457007-882775198-1210191635-1023) -&gt; Gnomes
1031 Catalyst (S-1-5-21-1385457007-882775198-1210191635-1024) -&gt; Catalyst
1032 Recieving (S-1-5-21-1385457007-882775198-1210191635-1025) -&gt; Recieving
1033 Rubberboot (S-1-5-21-1385457007-882775198-1210191635-1026) -&gt; Rubberboot
1034 Sales (S-1-5-21-1385457007-882775198-1210191635-1027) -&gt; Sales
1035 Accounting (S-1-5-21-1385457007-882775198-1210191635-1028) -&gt; Accounting
1036 Shipping (S-1-5-21-1385457007-882775198-1210191635-1029) -&gt; Shipping
1037 Account Operators (S-1-5-32-548) -&gt; Account Operators
1038 Guests (S-1-5-32-546) -&gt; Guests
1039 Server Operators (S-1-5-32-549) -&gt; Server Operators
1040 Users (S-1-5-32-545) -&gt; Users
1041 </screen>
1042                 It is of vital importance that the domain SID portions of all group
1043                 accounts are identical.
1044                 </para></step>
1045
1046                 <step><para>
1047                 The final responsibility in the migration process is to create identical
1048                 shares and printing resources on the new Samba server, copy all data
1049                 across, set up privileges, and set share and file/directory access controls.
1050                 </para></step>
1051
1052                 <step><para>
1053                 <indexterm><primary>domain master</primary></indexterm>
1054                 <indexterm><primary>PDC</primary></indexterm>
1055                 Edit the &smb.conf; file to  reset the parameter
1056                 <smbconfoption name="domain master">Yes</smbconfoption> so that
1057                 the Samba server functions as a PDC for the purpose of migration.
1058                 Also, uncomment the deletion scripts so they will now be fully functional,
1059                 enable the <parameter>wins support = yes</parameter> parameter and
1060                 comment out the <parameter>wins server</parameter>. Validate the configuration
1061                 with the <command>testparm</command> utility as shown here:
1062 <screen>
1063 &rootprompt; testparm
1064 Load smb config files from /etc/samba/smb.conf
1065 Processing section "[apps]"
1066 Processing section "[media]"
1067 Processing section "[homes]"
1068 Processing section "[printers]"
1069 Processing section "[netlogon]"
1070 Processing section "[profiles]"
1071 Processing section "[profdata]"
1072 Processing section "[print$]"
1073 Loaded services file OK.
1074 Server role: ROLE_DOMAIN_PDC
1075 Press enter to see a dump of your service definitions
1076 </screen>
1077                 </para></step>
1078
1079                 <step><para>
1080                 Now shut down the old NT4 PDC. Only when the old NT4 PDC and all
1081                 NT4 BDCs have been shut down can the Samba PDC be started.
1082                 </para></step>
1083
1084                 <step><para>
1085                 All workstations should function as they did with the old NT4 PDC. All
1086                 interdomain trust accounts should remain in place and fully functional.
1087                 All machine accounts and user logon accounts should also function correctly.
1088                 </para></step>
1089
1090                 <step><para>
1091                 The configuration of Samba BDC servers can be accomplished now or at any
1092                 convenient time in the future. Please refer to the carefully detailed process
1093                 for doing so is outlined in <link linkend="sbehap-bldg1"/>.
1094                 </para></step>
1095
1096         </procedure>
1097
1098         <sect3 id="sbevam1">
1099         <title>Migration Log Validation</title>
1100
1101         <para>
1102         The following <filename>vampire.log</filename> file is typical of a valid migration.
1103 <screen>
1104 adding user Administrator to group Domain Admins
1105 adding user atrickhoffer to group Engineers
1106 adding user dhenwick to group Engineers
1107 adding user dork to group Engineers
1108 adding user rfreshmill to group Marketoids
1109 adding user jacko to group Gnomes
1110 adding user jimbo to group Gnomes
1111 adding user maryk to group Gnomes
1112 adding user gdaison to group Gnomes
1113 adding user dhenwick to group Catalyst
1114 adding user jacko to group Catalyst
1115 adding user jacko to group Recieving
1116 adding user blue to group Recieving
1117 adding user hrambotham to group Rubberboot
1118 adding user billw to group Sales
1119 adding user bridge to group Sales
1120 adding user jrhapsody to group Sales
1121 adding user maryk to group Sales
1122 adding user rfreshmill to group Sales
1123 adding user fsellerby to group Sales
1124 adding user sharpec to group Sales
1125 adding user jimbo to group Accounting
1126 adding user gdaison to group Accounting
1127 adding user jacko to group Shipping
1128 adding user blue to group Shipping
1129 Fetching DOMAIN database
1130 Creating unix group: 'Engineers'
1131 Creating unix group: 'Marketoids'
1132 Creating unix group: 'Gnomes'
1133 Creating unix group: 'Catalyst'
1134 Creating unix group: 'Recieving'
1135 Creating unix group: 'Rubberboot'
1136 Creating unix group: 'Sales'
1137 Creating unix group: 'Accounting'
1138 Creating unix group: 'Shipping'
1139 Creating account: Administrator
1140 Creating account: Guest
1141 Creating account: TRANSGRESSION$
1142 Creating account: IUSR_TRANSGRESSION
1143 Creating account: MIDEARTH$
1144 Creating account: atrickhoffer
1145 Creating account: barryf
1146 Creating account: fsellerby
1147 Creating account: gdaison
1148 Creating account: hrambotham
1149 Creating account: jrhapsody
1150 Creating account: maryk
1151 Creating account: jacko
1152 Creating account: bridge
1153 Creating account: sharpec
1154 Creating account: jimbo
1155 Creating account: dhenwick
1156 Creating account: dork
1157 Creating account: blue
1158 Creating account: billw
1159 Creating account: rfreshmill
1160 Creating account: MAGGOT$
1161 Creating account: TRENTWARE$
1162 Creating account: MORTON$
1163 Creating account: NARM$
1164 Creating account: LAPDOG$
1165 Creating account: SCAVENGER$
1166 Creating account: merlin$
1167 Group members of Domain Admins: Administrator,
1168 Group members of Domain Users: Administrator(primary),
1169 TRANSGRESSION$(primary),IUSR_TRANSGRESSION(primary),
1170 MIDEARTH$(primary),atrickhoffer(primary),barryf(primary),
1171 fsellerby(primary),gdaison(primary),hrambotham(primary),
1172 jrhapsody(primary),maryk(primary),jacko(primary),bridge(primary),
1173 sharpec(primary),jimbo(primary),dhenwick(primary),dork(primary),
1174 blue(primary),billw(primary),rfreshmill(primary),MAGGOT$(primary),
1175 TRENTWARE$(primary),MORTON$(primary),NARM$(primary),
1176 LAPDOG$(primary),SCAVENGER$(primary),merlin$(primary),
1177 Group members of Domain Guests: Guest(primary),
1178 Group members of Engineers: atrickhoffer,dhenwick,dork,
1179 Group members of Marketoids: rfreshmill,
1180 Group members of Gnomes: jacko,jimbo,maryk,gdaison,
1181 Group members of Catalyst: dhenwick,jacko,
1182 Group members of Recieving: jacko,blue,
1183 Group members of Rubberboot: hrambotham,
1184 Group members of Sales: billw,bridge,jrhapsody,maryk,
1185 rfreshmill,fsellerby,sharpec,
1186 Group members of Accounting: jimbo,gdaison,
1187 Group members of Shipping: jacko,blue,
1188 Fetching BUILTIN database
1189 skipping SAM_DOMAIN_INFO delta for 'Builtin' (is not my domain)
1190 Creating unix group: 'Account Operators'
1191 Creating unix group: 'Guests'
1192 Creating unix group: 'Server Operators'
1193 Creating unix group: 'Users'
1194 </screen>
1195         </para>
1196
1197         </sect3>
1198
1199         </sect2>
1200
1201         <sect2>
1202         <title>NT4 Migration Using tdbsam Backend</title>
1203
1204         <para>
1205         In this example, we change the domain name of the NT4 server from
1206         <constant>DRUGPREP</constant> to <constant>MEGANET</constant> prior to the use
1207         of the vampire (migration) tool. This migration process makes use of Linux system tools
1208         (like <command>useradd</command>) to add the accounts that are migrated into the
1209         UNIX/Linux <filename>/etc/passwd</filename> and <filename>/etc/group</filename>
1210         databases. These entries must therefore be present, and correct options specified,
1211         in your &smb.conf; file, or else the migration does not work as it should.
1212         </para>
1213
1214         <procedure>
1215         <title>Migration Steps Using tdbsam</title>
1216
1217                 <step><para>
1218                 Prepare a Samba server precisely per the instructions shown in <link linkend="Big500users"/>.
1219                 Set the workgroup name to <constant>MEGANET</constant>.
1220                 </para></step>
1221
1222           <step><para><indexterm>
1223                 <primary>domain master</primary>
1224               </indexterm><indexterm>
1225                 <primary>BDC</primary>
1226               </indexterm>
1227                 Edit the &smb.conf; file to temporarily change the parameter
1228                 <smbconfoption name="domain master">No</smbconfoption> so
1229                 the Samba server functions as a BDC for the purpose of migration.
1230                 </para></step>
1231
1232                 <step><para>
1233                 Start Samba as you have done previously.
1234                 </para></step>
1235
1236           <step><para><indexterm>
1237                 <primary>net</primary>
1238                 <secondary>rpc</secondary>
1239                 <tertiary>join</tertiary>
1240               </indexterm>
1241                 Join the NT4 Domain as a BDC, as shown here:
1242 <screen>
1243 &rootprompt; net rpc join -S oldnt4pdc -W MEGANET -UAdministrator%not24get
1244 Joined domain MEGANET.
1245 </screen>
1246                 </para></step>
1247
1248                 <step><para><indexterm>
1249                 <primary>net</primary>
1250                 <secondary>rpc</secondary>
1251                 <tertiary>vampire</tertiary>
1252               </indexterm>
1253                 You may vampire the accounts from the NT4 PDC by executing the command, as shown here:
1254 <screen>
1255 &rootprompt; net rpc vampire -S oldnt4pdc -U Administrator%not24get
1256 Fetching DOMAIN database
1257 SAM_DELTA_DOMAIN_INFO not handled
1258 Creating unix group: 'Domain Admins'
1259 Creating unix group: 'Domain Users'
1260 Creating unix group: 'Domain Guests'
1261 Creating unix group: 'Engineers'
1262 Creating unix group: 'Marketoids'
1263 Creating unix group: 'Account Operators'
1264 Creating unix group: 'Administrators'
1265 Creating unix group: 'Backup Operators'
1266 Creating unix group: 'Guests'
1267 Creating unix group: 'Print Operators'
1268 Creating unix group: 'Replicator'
1269 Creating unix group: 'Server Operators'
1270 Creating unix group: 'Users'
1271 Creating account: Administrator
1272 Creating account: Guest
1273 Creating account: oldnt4pdc$
1274 Creating account: jacko
1275 Creating account: maryk
1276 Creating account: bridge
1277 Creating account: sharpec
1278 Creating account: jimbo
1279 Creating account: dhenwick
1280 Creating account: dork
1281 Creating account: blue
1282 Creating account: billw
1283 Creating account: massive$
1284 Group members of Engineers: Administrator,
1285                  sharpec(primary),bridge,billw(primary),dhenwick
1286 Group members of Marketoids: Administrator,jacko(primary),
1287                 maryk(primary),jimbo,blue(primary),dork(primary)
1288 Creating unix group: 'Gnomes'
1289 Fetching BUILTIN database
1290 SAM_DELTA_DOMAIN_INFO not handled
1291 </screen>
1292                 </para></step>
1293
1294           <step><para><indexterm>
1295                 <primary>pdbedit</primary>
1296               </indexterm>
1297                 At this point, we can validate our migration. Let's look at the accounts
1298                 in the form in which they are seen in a smbpasswd file. This achieves that:
1299 <screen>
1300 &rootprompt; pdbedit -Lw
1301 Administrator:505:84B0D8E14D158FF8417EAF50CFAC29C3:
1302      AF6DD3FD4E2EA8BDE1695A3F05EFBF52:[UX         ]:LCT-3DF7AA9F:
1303 jimbo:512:6E9A2A51F64A1BD5C187B8085FE1D9DF:
1304      CDF7E305E639966E489A0CEFB95EE5E0:[UX         ]:LCT-3E9362BC:
1305 sharpec:511:E4301A7CD8FDD1EC6BBF9BC19CDF8151:
1306      7000255938831D5B948C95C1931534C5:[UX         ]:LCT-3E8B42C4:
1307 dhenwick:513:DCD8886141E3F892AAD3B435B51404EE:
1308      2DB36465949CB938DD98C312EFDC2639:[UX         ]:LCT-3E939F41:
1309 bridge:510:3FE6873A43101B46417EAF50CFAC29C3:
1310      891741F481AF111B4CAA09A94016BD01:[UX         ]:LCT-3E8B4291:
1311 blue:515:256D41D2559BB3D2AAD3B435B51404EE:
1312      9CCADDA4F7D281DD0FAD321478C6F971:[UX         ]:LCT-3E939FDC:
1313 diamond$:517:6C8E7B64EDCDBC4218B6345447A4454B:
1314      3323AC63C666CFAACB60C13F65D54E9A:[S          ]:LCT-00000000:
1315 oldnt4pdc$:507:3E39430CDCABB5B09ED320D0448AE568:
1316      95DBAF885854A919C7C7E671060478B9:[S          ]:LCT-3DF7AA9F:
1317 Guest:506:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:
1318      XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[DUX        ]:LCT-3E93A008:
1319 billw:516:85380CA7C21B6EBE168C8150662AF11B:
1320      5D7478508293709937E55FB5FBA14C17:[UX         ]:LCT-3FED7CA1:
1321 dork:514:78C70DDEC35A35B5AAD3B435B51404EE:
1322      0AD886E015AC595EC0AF40E6C9689E1A:[UX         ]:LCT-3E939F9A:
1323 jacko:508:BC472F3BF9A0A5F63832C92FC614B7D1:
1324      0C6822AAF85E86600A40DC73E40D06D5:[UX         ]:LCT-3E8B4242:
1325 maryk:509:3636AB7E12EBE79AB79AE2610DD89D4C:
1326      CF271B744F7A55AFDA277FF88D80C527:[UX         ]:LCT-3E8B4270:
1327 </screen>
1328                 </para></step>
1329
1330                 <step><para><indexterm>
1331                 <primary>pdbedit</primary>
1332               </indexterm>
1333                 An expanded view of a user account entry shows more of what was
1334                 obtained from the NT4 PDC:
1335 <screen>
1336 sleeth:~ # pdbedit -Lv maryk
1337 Unix username:        maryk
1338 NT username:          maryk
1339 Account Flags:        [UX         ]
1340 User SID:             S-1-5-21-1988699175-926296742-1295600288-1003
1341 Primary Group SID:    S-1-5-21-1988699175-926296742-1295600288-1007
1342 Full Name:            Mary Kathleen
1343 Home Directory:       \\diamond\maryk
1344 HomeDir Drive:        X:
1345 Logon Script:         scripts\logon.bat
1346 Profile Path:         \\diamond\profiles\maryk
1347 Domain:               MEGANET
1348 Account desc:         Peace Maker
1349 Workstations:
1350 Munged dial:
1351 Logon time:           0
1352 Logoff time:          Mon, 18 Jan 2038 20:14:07 GMT
1353 Kickoff time:         Mon, 18 Jan 2038 20:14:07 GMT
1354 Password last set:    Wed, 02 Apr 2003 13:05:04 GMT
1355 Password can change:  0
1356 Password must change: Mon, 18 Jan 2038 20:14:07 GMT
1357 </screen>
1358                 </para></step>
1359
1360           <step><para><indexterm>
1361                 <primary>net</primary>
1362                 <secondary>group</secondary>
1363               </indexterm>
1364                 The following command lists the long names of the groups that have been
1365                 imported (vampired) from the NT4 PDC:
1366 <screen>
1367 &rootprompt; net group -l -Uroot%not24get -Smassive
1368
1369 Group name            Comment
1370 -----------------------------
1371 Engineers             Snake Oil Engineers
1372 Marketoids            Untrustworthy Hype Vendors
1373 Gnomes                Plain Vanilla Garden Gnomes
1374 Replicator            Supports file replication in a domain
1375 Guests                Users granted guest access to the computer/domain
1376 Administrators        Members can fully administer the computer/domain
1377 Users                 Ordinary users
1378 </screen>
1379                 Everything looks well and in order.
1380                 </para></step>
1381
1382           <step><para><indexterm>
1383                 <primary>domain master</primary>
1384               </indexterm><indexterm>
1385                 <primary>PDC</primary>
1386               </indexterm>
1387                 Edit the &smb.conf; file to  reset the parameter
1388                 <smbconfoption name="domain master">Yes</smbconfoption> so
1389                 the Samba server functions as a PDC for the purpose of migration.
1390                 </para></step>
1391         </procedure>
1392         </sect2>
1393
1394         <sect2>
1395                 <title>Key Points Learned</title>
1396
1397                 <para>
1398                 Migration of an NT4 PDC database to a Samba PDC is possible.
1399                 </para>
1400
1401                 <itemizedlist>
1402                         <listitem><para>
1403                         An LDAP backend is a suitable vehicle for NT4 migrations.
1404                         </para></listitem>
1405
1406                         <listitem><para>
1407                         A tdbsam backend can be used to perform a migration.
1408                         </para></listitem>
1409
1410                         <listitem><para>
1411                         Multiple NT4 domains can be merged into a single Samba
1412                         domain.
1413                         </para></listitem>
1414
1415                         <listitem><para>
1416                         The net Samba domain most likely requires some
1417                         administration and updating before going live.
1418                         </para></listitem>
1419                 </itemizedlist>
1420
1421         </sect2>
1422
1423 </sect1>
1424
1425 <sect1>
1426         <title>Questions and Answers</title>
1427
1428         <para>
1429         </para>
1430
1431         <qandaset defaultlabel="chap08qa" type="number">
1432         <qandaentry>
1433         <question>
1434
1435             <para><indexterm>
1436                 <primary>clean database</primary>
1437               </indexterm>
1438                 Why must I start each migration with a clean database?
1439                 </para>
1440
1441         </question>
1442         <answer>
1443
1444             <para><indexterm>
1445                 <primary>merge</primary>
1446               </indexterm>
1447                 This is a recommendation that permits the data from each NT4 domain to
1448                 be kept separate until you are ready to merge them. Also, if you do not start with a clean database,
1449                 you may find errors due to users or groups from multiple domains having the
1450                 same name but different SIDs. It is better to permit each migration to complete
1451                 without undue errors and then to handle the merging of vampired data under
1452                 proper supervision.
1453                 </para>
1454
1455         </answer>
1456         </qandaentry>
1457
1458         <qandaentry>
1459         <question>
1460
1461             <para><indexterm>
1462                 <primary>Domain SID</primary>
1463               </indexterm>
1464                 Is it possible to set my domain SID to anything I like?
1465                 </para>
1466
1467         </question>
1468         <answer>
1469
1470             <para><indexterm>
1471                 <primary>auto-generated SID</primary>
1472               </indexterm><indexterm>
1473                 <primary>SID</primary>
1474               </indexterm><indexterm>
1475                 <primary>Domain SID</primary>
1476               </indexterm>
1477                 Yes, so long as the SID you create has the same structure as an autogenerated SID.
1478                 The typical SID looks like this: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX, where
1479                 the XXXXXXXXXX can be any number with from 6 to 10 digits. On the other hand, why
1480                 would you really want to create your own SID? I cannot think of a good reason.
1481                 You may want to set the SID to one that is already in use somewhere on your network,
1482                 but that is a little different from straight out creating your own domain SID.
1483                 </para>
1484
1485         </answer>
1486         </qandaentry>
1487
1488         <qandaentry>
1489         <question>
1490
1491             <para><indexterm>
1492                 <primary>/etc/passwd</primary>
1493               </indexterm><indexterm>
1494                 <primary>/etc/group</primary>
1495               </indexterm><indexterm>
1496                 <primary>tdbsam</primary>
1497               </indexterm><indexterm>
1498                 <primary>passdb backend</primary>
1499               </indexterm><indexterm>
1500                 <primary>accounts</primary>
1501                 <secondary>user</secondary>
1502               </indexterm><indexterm>
1503                 <primary>accounts</primary>
1504                 <secondary>group</secondary>
1505               </indexterm><indexterm>
1506                 <primary>accounts</primary>
1507                 <secondary>Domain</secondary>
1508               </indexterm>
1509                 When using a tdbsam passdb backend, why must I have all domain user and group accounts
1510                 in <filename>/etc/passwd</filename> and <filename>/etc/group</filename>?
1511                 </para>
1512
1513         </question>
1514         <answer>
1515
1516             <para><indexterm>
1517                 <primary>UID</primary>
1518               </indexterm><indexterm>
1519                 <primary>GID</primary>
1520               </indexterm><indexterm>
1521                 <primary>smbpasswd</primary>
1522               </indexterm><indexterm>
1523                 <primary>/etc/passwd</primary>
1524               </indexterm><indexterm>
1525                 <primary>Posix</primary>
1526               </indexterm><indexterm>
1527                 <primary>LDAP database</primary>
1528               </indexterm>
1529                 Samba must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba
1530                 does not fabricate the UNIX IDs from thin air, but rather requires them to be located
1531                 in a suitable place.
1532                 </para>
1533
1534                 <para>
1535                 When migrating a <filename>smbpasswd</filename> file to an LDAP backend, the
1536                 UID of each account is taken together with the account information in the
1537                 <filename>/etc/passwd</filename>, and both sets of data are used to create the account
1538                 entry in the LDAP database.
1539                 </para>
1540
1541                 <para>
1542                 If you elect to create the POSIX account also, the entire UNIX account is copied to the
1543                 LDAP backend. The same occurs with NT groups and UNIX groups. At the conclusion of
1544                 migration to the LDAP database, the accounts may be removed from the UNIX database files.
1545                 In short then, all UNIX and Windows networking accounts, both in tdbsam as well as in
1546                 LDAP, require UIDs/GIDs.
1547                 </para>
1548
1549         </answer>
1550         </qandaentry>
1551
1552         <qandaentry>
1553         <question>
1554
1555             <para><indexterm>
1556                 <primary>validate</primary>
1557               </indexterm><indexterm>
1558                 <primary>connectivity</primary>
1559               </indexterm><indexterm>
1560                 <primary>migration</primary>
1561               </indexterm>
1562                 Why did you validate connectivity before attempting migration?
1563                 </para>
1564
1565         </question>
1566         <answer>
1567
1568                 <para>
1569                 Access validation before attempting to migrate NT4 domain accounts helps to pinpoint
1570                 potential problems that may otherwise affect or impede account migration. I am always
1571                 mindful of the 4 P's of migration: Planning Prevents Poor Performance.
1572                 </para>
1573
1574         </answer>
1575         </qandaentry>
1576
1577         <qandaentry>
1578         <question>
1579
1580                 <para>
1581                 How would you merge 10 tdbsam-based domains into an LDAP database?
1582                 </para>
1583
1584         </question>
1585         <answer>
1586
1587             <para><indexterm>
1588                 <primary>risk</primary>
1589               </indexterm><indexterm>
1590                 <primary>dump</primary>
1591               </indexterm><indexterm>
1592                 <primary>tdbsam</primary>
1593               </indexterm><indexterm>
1594                 <primary>Samba Domain</primary>
1595               </indexterm><indexterm>
1596                 <primary>UID</primary>
1597               </indexterm><indexterm>
1598                 <primary>GID</primary>
1599               </indexterm><indexterm>
1600                 <primary>pdbedit</primary>
1601               </indexterm><indexterm>
1602                 <primary>transfer</primary>
1603               </indexterm><indexterm>
1604                 <primary>smbpasswd</primary>
1605               </indexterm><indexterm>
1606                 <primary>LDAP</primary>
1607               </indexterm><indexterm>
1608                 <primary>tool</primary>
1609               </indexterm>
1610                 If you have 10 tdbsam Samba domains, there is considerable risk that there are a number of
1611                 accounts that have the same UNIX identifier (UID/GID). This means that you almost
1612                 certainly have to edit a lot of data. It would be easiest to dump each database in smbpasswd
1613                 file format and then manually edit all records to ensure that each has a unique UID. Each
1614                 file can then be imported a number of ways. You can use the <command>pdbedit</command> tool
1615                 to affect a transfer from the smbpasswd file to LDAP, or you can migrate them en masse to
1616                 tdbsam and then to LDAP. The final choice is yours. Just remember to verify all accounts that
1617                 you have migrated before handing over access to a user. After all, too many users with a bad
1618                 migration experience may threaten your career.
1619                 </para>
1620
1621         </answer>
1622         </qandaentry>
1623
1624         <qandaentry>
1625         <question>
1626
1627             <para><indexterm>
1628                 <primary>machine accounts</primary>
1629               </indexterm><indexterm>
1630                 <primary>accounts</primary>
1631                 <secondary>machine</secondary>
1632               </indexterm>
1633                 I want to change my domain name after I migrate all accounts from an NT4 domain to a
1634                 Samba domain. Does it make any sense to migrate the machine accounts in that case?
1635                 </para>
1636
1637         </question>
1638         <answer>
1639
1640             <para><indexterm>
1641                 <primary>registry</primary>
1642               </indexterm><indexterm>
1643                 <primary>un-join</primary>
1644               </indexterm><indexterm>
1645                 <primary>rejoin</primary>
1646               </indexterm><indexterm>
1647                 <primary>tattooing</primary>
1648               </indexterm>
1649                 I would recommend not to migrate the machine account. The machine accounts should still work, but there are registry entries
1650                 on each Windows NT4 and upward client that have a tattoo of the old domain name. If you
1651                 unjoin the domain and then rejoin the newly renamed Samba domain, you can be certain to avoid
1652                 this tattooing effect.
1653                 </para>
1654
1655         </answer>
1656         </qandaentry>
1657
1658         <qandaentry>
1659         <question>
1660
1661             <para><indexterm>
1662                 <primary>multiple group mappings</primary>
1663               </indexterm>
1664                 After merging multiple NT4 domains into a Samba domain, I lost all multiple group mappings. Why?
1665                 </para>
1666
1667         </question>
1668         <answer>
1669
1670             <para><indexterm>
1671                 <primary>/etc/passwd</primary>
1672               </indexterm><indexterm>
1673                 <primary>/etc/group</primary>
1674               </indexterm>
1675                 Samba currently does not implement multiple group membership internally. If you use the Windows
1676                 NT4 Domain User Manager to manage accounts and you have an LDAP backend, the multiple group
1677                 membership is stored in the POSIX groups area. If you use either tdbsam or smbpasswd backend,
1678                 then multiple group membership is handled through the UNIX groups file. When you dump the user
1679                 accounts, no group account information is provided. When you edit (change) UIDs and GIDs in each
1680                 file to which you migrated the NT4 Domain data, do not forget to edit the UNIX <filename>/etc/passwd</filename>
1681                 and <filename>/etc/group</filename> information also. That is where the multiple group information
1682                 is most closely at your fingertips.
1683                 </para>
1684
1685         </answer>
1686         </qandaentry>
1687
1688         <qandaentry>
1689         <question>
1690
1691                 <para>
1692                 How can I reset group membership after loading the account information into the LDAP database?
1693                 </para>
1694
1695         </question>
1696         <answer>
1697
1698             <para><indexterm>
1699                 <primary>SRVTOOLS.EXE</primary>
1700               </indexterm>
1701                 You can use the NT4 Domain User Manager that can be downloaded from the Microsoft Web site. The
1702                 installation file is called <filename>SRVTOOLS.EXE</filename>.
1703                 </para>
1704
1705         </answer>
1706         </qandaentry>
1707
1708         <qandaentry>
1709         <question>
1710
1711             <para><indexterm>
1712                 <primary>group names</primary>
1713               </indexterm>
1714                 What are the limits or constraints that apply to group names?
1715                 </para>
1716
1717         </question>
1718         <answer>
1719
1720             <para><indexterm>
1721                 <primary>limit</primary>
1722               </indexterm><indexterm>
1723                 <primary>shadow-utils</primary>
1724               </indexterm><indexterm>
1725                 <primary>groupadd</primary>
1726               </indexterm><indexterm>
1727                 <primary>groupdel</primary>
1728               </indexterm><indexterm>
1729                 <primary>groupmod</primary>
1730               </indexterm><indexterm>
1731                 <primary>account names</primary>
1732               </indexterm>
1733                 A Windows 200x group name can be up to 254 characters long, while in Windows NT4 the group
1734                 name is limited to 20 characters. Most UNIX systems limit this to 32 characters. Windows
1735                 groups can contain upper- and lowercase characters, as well as spaces.
1736                 Many UNIX system do not permit the use of uppercase characters, and some do not permit the
1737                 space character either. A number of systems (i.e., Linux) work fine with both uppercase
1738                 and space characters in group names, but the shadow-utils package that provides the group
1739                 control functions (<command>groupadd</command>, <command>groupmod</command>, <command>groupdel</command>, and so on) do not permit them.
1740                 Also, a number of UNIX systems management tools enforce their own particular interpretation
1741                 of the POSIX standards and likewise do not permit uppercase or space characters in group
1742                 or user account names. You have to experiment with your system to find what its
1743                 peculiarities are.
1744                 </para>
1745
1746         </answer>
1747         </qandaentry>
1748
1749         <qandaentry>
1750         <question>
1751
1752             <para><indexterm>
1753                 <primary>vampire</primary>
1754               </indexterm>
1755                 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba
1756                 LDAP backend system using the vampire process?
1757                 </para>
1758
1759         </question>
1760         <answer>
1761
1762                 <para>
1763                 UNIX UIDs and GIDs on most UNIX systems use an unsigned short or an unsigned integer. Recent Linux
1764                 kernels support at least a much larger number. On systems that have a 16-bit constraint on UID/GIDs,
1765                 you would not be able to migrate 323,000 accounts because this number cannot fit into a 16-bit unsigned
1766                 integer. UNIX/Linux systems that have a 32-bit UID/GID can easily handle this number of accounts.
1767                 Please check this carefully before you attempt to effect a migration using the vampire process.
1768                 </para>
1769
1770             <para><indexterm>
1771                 <primary>Migration speed</primary>
1772               </indexterm>
1773                 Migration speed depends much on the processor speed, the network speed, disk I/O capability, and
1774                 LDAP update overheads. On a dual processor AMD MP1600+ with 1 GB memory that was mirroring LDAP
1775                 to a second identical system over 1 Gb Ethernet, I was able to migrate around 180 user accounts
1776                 per minute. Migration would obviously go much faster if LDAP mirroring were turned off during the migration.
1777                 </para>
1778
1779         </answer>
1780         </qandaentry>
1781
1782         </qandaset>
1783
1784 </sect1>
1785
1786 </chapter>
1787