docs/Samba3-HOWTO/TOSHARG-upgrading-to-3.0.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3 <chapter id="upgrading-to-3.0">
   4 <chapterinfo>
   5         &author.jelmer;
   6         &author.jht;
   7         &author.jerry;
   8         <pubdate>June 30, 2003</pubdate>
   9 </chapterinfo>
  10
  11 <title>Upgrading from Samba-2.x to Samba-3.0.20</title>
  12
  13 <para>
  14 <indexterm><primary>Samba differences</primary></indexterm>
  15 <indexterm><primary>changed parameters</primary></indexterm>
  16 <indexterm><primary>simple guide</primary></indexterm>
  17 This chapter deals exclusively with the differences between Samba-3.0.20 and Samba-2.2.8a.
  18 It points out where configuration parameters have changed, and provides a simple guide for
  19 the move from 2.2.x to 3.0.20.
  20 </para>
  21
  22 <sect1>
  23 <title>Quick Migration Guide</title>
  24
  25 <para>
  26 Samba-3.0.20 default behavior should be approximately the same as Samba-2.2.x.
  27 The default behavior when the new parameter <smbconfoption name="passdb backend"/>
  28 is not defined in the &smb.conf; file provides the same default behavior as Samba-2.2.x
  29 with <smbconfoption name="encrypt passwords">Yes</smbconfoption> and
  30 will use the <filename>smbpasswd</filename> database.
  31 </para>
  32
  33 <para>
  34 <indexterm><primary>behavior approximately same</primary></indexterm>
  35 <indexterm><primary>differing protocol</primary></indexterm>
  36 So why say that <emphasis>behavior should be approximately the same as Samba-2.2.x</emphasis>? Because
  37 Samba-3.0.20 can negotiate new protocols, such as support for native Unicode, that may result in
  38 differing protocol code paths being taken. The new behavior under such circumstances is not
  39 exactly the same as the old one. The good news is that the domain and machine SIDs will be
  40 preserved across the upgrade.
  41 </para>
  42
  43 <para>
  44 <indexterm><primary>LDAP backend</primary></indexterm>
  45 <indexterm><primary>database</primary></indexterm>
  46 <indexterm><primary>pdbedit</primary></indexterm>
  47 <indexterm><primary>Samba-3-compatible LDAP backend</primary></indexterm>
  48 If the Samba-2.2.x system is using an LDAP backend, and there is no time to update the LDAP
  49 database, then make sure that <smbconfoption name="passdb backend">ldapsam_compat</smbconfoption>
  50 is specified in the &smb.conf; file. For the rest, behavior should remain more or less the same.
  51 At a later date, when there is time to implement a new Samba-3-compatible LDAP backend, it is possible
  52 to migrate the old LDAP database to the new one through use of the <command>pdbedit</command>.
  53 See <link linkend="pdbeditthing">The <emphasis>pdbedit</emphasis> Command</link>.
  54 </para>
  55
  56 </sect1>
  57
  58 <sect1>
  59 <title>New Features in Samba-3</title>
  60
  61 <para>
  62 The major new features are:
  63 </para>
  64
  65 <orderedlist numeration="arabic">
  66         <listitem><para>
  67 <indexterm><primary>ADS</primary></indexterm>
  68 <indexterm><primary>LDAP/Kerberos</primary></indexterm>
  69         Active Directory support. This release is able to join an ADS realm
  70         as a member server and authenticate users using LDAP/Kerberos.
  71         </para></listitem>
  72
  73         <listitem><para>
  74 <indexterm><primary>Unicode</primary></indexterm>
  75 <indexterm><primary>multibyte character sets</primary></indexterm>
  76         Unicode support. Samba will now negotiate Unicode on the wire, and
  77         internally there is a much better infrastructure for multibyte
  78         and Unicode character sets.
  79         </para></listitem>
  80
  81         <listitem><para>
  82 <indexterm><primary>authentication system</primary></indexterm>
  83         New authentication system. The internal authentication system has
  84         been almost completely rewritten. Most of the changes are internal,
  85         but the new authoring system is also very configurable.
  86         </para></listitem>
  87
  88         <listitem><para>
  89 <indexterm><primary>filename mangling</primary></indexterm>
  90         New filename mangling system. The filename mangling system has been
  91         completely rewritten. An internal database now stores mangling maps
  92         persistently.
  93         </para></listitem>
  94
  95         <listitem><para>
  96 <indexterm><primary>net command</primary></indexterm>
  97         New <quote>net</quote> command. A new <quote>net</quote> command has been added. It is
  98         somewhat similar to the <quote>net</quote> command in Windows. Eventually, we
  99         plan to replace a bunch of other utilities (such as smbpasswd)
 100         with subcommands in <quote>net</quote>.
 101         </para></listitem>
 102
 103         <listitem><para>
 104 <indexterm><primary>status32 codes</primary></indexterm>
 105         Samba now negotiates NT-style status32 codes on the wire. This
 106         considerably improves error handling.
 107         </para></listitem>
 108
 109         <listitem><para>
 110 <indexterm><primary>printer attributes publishing</primary></indexterm>
 111         Better Windows 200x/XP printing support, including publishing
 112         printer attributes in Active Directory.
 113         </para></listitem>
 114
 115         <listitem><para>
 116 <indexterm><primary>RPC modules</primary></indexterm>
 117 <indexterm><primary>passdb backends</primary></indexterm>
 118 <indexterm><primary>character sets</primary></indexterm>
 119         New loadable RPC modules for passdb backends and character sets.
 120         </para></listitem>
 121
 122         <listitem><para>
 123 <indexterm><primary>dual-daemon winbindd</primary></indexterm>
 124         New default dual-daemon winbindd support for better performance.
 125         </para></listitem>
 126
 127         <listitem><para>
 128 <indexterm><primary>migrating</primary></indexterm>
 129 <indexterm><primary>maintaining ids</primary></indexterm>
 130 <indexterm><primary>SID</primary></indexterm>
 131         Support for migrating from a Windows NT 4.0 domain to a Samba
 132         domain and maintaining user, group, and domain SIDs.
 133         </para></listitem>
 134
 135         <listitem><para>
 136 <indexterm><primary>trust relationships</primary></indexterm>
 137 <indexterm><primary>domain controllers</primary></indexterm>
 138         Support for establishing trust relationships with Windows NT 4.0
 139         domain controllers.
 140         </para></listitem>
 141
 142         <listitem><para>
 143 <indexterm><primary>Winbind architecture</primary></indexterm>
 144 <indexterm><primary>LDAP directory</primary></indexterm>
 145 <indexterm><primary>ID mapping</primary></indexterm>
 146         Initial support for a distributed Winbind architecture using
 147         an LDAP directory for storing SID to UID/GID mappings.
 148         </para></listitem>
 149
 150         <listitem><para>
 151         Major updates to the Samba documentation tree.
 152         </para></listitem>
 153
 154         <listitem><para>
 155 <indexterm><primary>SMB signing</primary></indexterm>
 156 <indexterm><primary>security settings</primary></indexterm>
 157         Full support for client and server SMB signing to ensure
 158         compatibility with default Windows 2003 security settings.
 159         </para></listitem>
 160 </orderedlist>
 161
 162 <para>
 163 Plus lots of other improvements!
 164 </para>
 165
 166 </sect1>
 167
 168 <sect1>
 169 <title>Configuration Parameter Changes</title>
 170
 171 <para>
 172 This section contains a brief listing of changes to &smb.conf; options
 173 in the 3.0.20 release. Please refer to the smb.conf(5) man page for
 174 complete descriptions of new or modified parameters.
 175 </para>
 176
 177 <sect2>
 178 <title>Removed Parameters</title>
 179
 180 <indexterm><primary>deleted parameters</primary></indexterm>
 181 <para>In alphabetical order, these are the parameters eliminated during the Samba 3.0.0 series prior to release of Samba 3.0.20.</para>
 182
 183 <itemizedlist>
 184         <listitem><para>admin log </para></listitem>
 185         <listitem><para>alternate permissions </para></listitem>
 186         <listitem><para>character set </para></listitem>
 187         <listitem><para>client codepage </para></listitem>
 188         <listitem><para>code page directory </para></listitem>
 189         <listitem><para>coding system </para></listitem>
 190         <listitem><para>domain admin group </para></listitem>
 191         <listitem><para>domain guest group </para></listitem>
 192         <listitem><para>force unknown acl user </para></listitem>
 193         <listitem><para>ldap filter</para></listitem>
 194         <listitem><para>nt smb support </para></listitem>
 195         <listitem><para>post script </para></listitem>
 196         <listitem><para>printer driver </para></listitem>
 197         <listitem><para>printer driver file </para></listitem>
 198         <listitem><para>printer driver location </para></listitem>
 199         <listitem><para>read size</para></listitem>
 200         <listitem><para>source environment</para></listitem>
 201         <listitem><para>status </para></listitem>
 202         <listitem><para>strip dot </para></listitem>
 203         <listitem><para>total print jobs </para></listitem>
 204         <listitem><para>unicode</para></listitem>
 205         <listitem><para>use rhosts </para></listitem>
 206         <listitem><para>valid chars </para></listitem>
 207         <listitem><para>vfs options </para></listitem>
 208         <listitem><para>winbind enable local accounts</para></listitem>
 209 </itemizedlist>
 210
 211 </sect2>
 212
 213 <sect2>
 214 <title>New Parameters</title>
 215
 216 <para>New parameters in the Samba 3.0.0 series prior to release of Samba 3.0.20 are grouped by function):</para>
 217
 218 <para>Remote Management</para>
 219
 220 <indexterm><primary>new parameters</primary></indexterm>
 221
 222 <itemizedlist>
 223         <listitem><para>abort shutdown script</para></listitem>
 224         <listitem><para>shutdown script</para></listitem>
 225 </itemizedlist>
 226
 227 <para>User and Group Account Management</para>
 228
 229 <itemizedlist>
 230         <listitem><para>add group script</para></listitem>
 231         <listitem><para>add machine script</para></listitem>
 232         <listitem><para>add user to group script</para></listitem>
 233         <listitem><para>algorithmic rid base</para></listitem>
 234         <listitem><para>delete group script</para></listitem>
 235         <listitem><para>delete user from group script</para></listitem>
 236         <listitem><para>passdb backend</para></listitem>
 237         <listitem><para>set primary group script</para></listitem>
 238 </itemizedlist>
 239
 240 <para>Authentication</para>
 241
 242 <itemizedlist>
 243         <listitem><para>auth methods</para></listitem>
 244         <listitem><para>ldap password sync</para></listitem>
 245         <listitem><para>realm</para></listitem>
 246 </itemizedlist>
 247
 248 <para>Protocol Options</para>
 249
 250 <itemizedlist>
 251         <listitem><para>afs token lifetime</para></listitem>
 252         <listitem><para>client lanman auth</para></listitem>
 253         <listitem><para>client NTLMv2 auth</para></listitem>
 254         <listitem><para>client schannel</para></listitem>
 255         <listitem><para>client signing</para></listitem>
 256         <listitem><para>client use spnego</para></listitem>
 257         <listitem><para>defer sharing violations</para></listitem>
 258         <listitem><para>disable netbios</para></listitem>
 259         <listitem><para>enable privileges</para></listitem>
 260         <listitem><para>use kerberos keytab</para></listitem>
 261         <listitem><para>log nt token command</para></listitem>
 262         <listitem><para>ntlm auth</para></listitem>
 263         <listitem><para>paranoid server security </para></listitem>
 264         <listitem><para>sendfile</para></listitem>
 265         <listitem><para>server schannel</para></listitem>
 266         <listitem><para>server signing</para></listitem>
 267         <listitem><para>smb ports</para></listitem>
 268         <listitem><para>use spnego</para></listitem>
 269 </itemizedlist>
 270
 271 <para>File Service</para>
 272
 273 <itemizedlist>
 274         <listitem><para>allocation roundup size</para></listitem>
 275         <listitem><para>acl check permissions</para></listitem>
 276         <listitem><para>ea support</para></listitem>
 277         <listitem><para>enable asu support</para></listitem>
 278         <listitem><para>force unknown acl user</para></listitem>
 279         <listitem><para>get quota command</para></listitem>
 280         <listitem><para>hide special files</para></listitem>
 281         <listitem><para>hide unwriteable files</para></listitem>
 282         <listitem><para>inherit owner</para></listitem>
 283         <listitem><para>hostname lookups</para></listitem>
 284         <listitem><para>kernel change notify</para></listitem>
 285         <listitem><para>mangle prefix</para></listitem>
 286         <listitem><para>map acl inherit</para></listitem>
 287         <listitem><para>max stat cache size</para></listitem>
 288         <listitem><para>msdfs proxy</para></listitem>
 289         <listitem><para>set quota command</para></listitem>
 290         <listitem><para>store dos attributes</para></listitem>
 291         <listitem><para>use sendfile</para></listitem>
 292         <listitem><para>vfs objects</para></listitem>
 293 </itemizedlist>
 294
 295 <para>Printing</para>
 296
 297 <itemizedlist>
 298         <listitem><para>cups options</para></listitem>
 299         <listitem><para>cups server</para></listitem>
 300         <listitem><para>force printername</para></listitem>
 301         <listitem><para>max reported print jobs</para></listitem>
 302         <listitem><para>printcap cache time</para></listitem>
 303 </itemizedlist>
 304
 305
 306 <para>Unicode and Character Sets</para>
 307
 308 <itemizedlist>
 309         <listitem><para>display charset</para></listitem>
 310         <listitem><para>dos charset</para></listitem>
 311         <listitem><para>UNIX charset</para></listitem>
 312 </itemizedlist>
 313
 314 <para>SID to UID/GID Mappings</para>
 315
 316 <itemizedlist>
 317         <listitem><para>idmap backend</para></listitem>
 318         <listitem><para>idmap gid</para></listitem>
 319         <listitem><para>idmap uid</para></listitem>
 320         <listitem><para>winbind enable local accounts</para></listitem>
 321         <listitem><para>winbind nested groups</para></listitem>
 322         <listitem><para>winbind trusted domains only</para></listitem>
 323         <listitem><para>template primary group</para></listitem>
 324         <listitem><para>enable rid algorithm</para></listitem>
 325 </itemizedlist>
 326
 327 <para>LDAP</para>
 328
 329 <itemizedlist>
 330         <listitem><para>ldap delete dn</para></listitem>
 331         <listitem><para>ldap group suffix</para></listitem>
 332         <listitem><para>ldap idmap suffix</para></listitem>
 333         <listitem><para>ldap machine suffix</para></listitem>
 334         <listitem><para>ldap passwd sync</para></listitem>
 335         <listitem><para>ldap replication sleep</para></listitem>
 336         <listitem><para>ldap timeout</para></listitem>
 337         <listitem><para>ldap user suffix</para></listitem>
 338 </itemizedlist>
 339
 340 <para>General Configuration</para>
 341
 342 <itemizedlist>
 343         <listitem><para>preload modules</para></listitem>
 344         <listitem><para>privatedir</para></listitem>
 345 </itemizedlist>
 346
 347 </sect2>
 348
 349 <sect2>
 350 <title>Modified Parameters (Changes in Behavior)</title>
 351
 352 <itemizedlist>
 353         <listitem><para>dos filetimes (enabled by default)</para></listitem>
 354         <listitem><para>encrypt passwords (enabled by default) </para></listitem>
 355         <listitem><para>mangling method (set to hash2 by default) </para></listitem>
 356         <listitem><para>map to guest (new parameter added)</para></listitem>
 357         <listitem><para>min password length (deprecated)</para></listitem>
 358         <listitem><para>only user (deprecated)</para></listitem>
 359         <listitem><para>passwd chat </para></listitem>
 360         <listitem><para>passwd program </para></listitem>
 361         <listitem><para>password server </para></listitem>
 362         <listitem><para>printer admin (deprecated)</para></listitem>
 363         <listitem><para>restrict anonymous (integer value) </para></listitem>
 364         <listitem><para>security (new ads value) </para></listitem>
 365         <listitem><para>strict locking (enabled by default) </para></listitem>
 366         <listitem><para>winbind cache time (increased to 5 minutes) </para></listitem>
 367         <listitem><para>winbind uid (deprecated in favor of idmap uid) </para></listitem>
 368         <listitem><para>winbind gid (deprecated in favor of idmap gid) </para></listitem>
 369         <listitem><para>write cache (deprecated)</para></listitem>
 370 </itemizedlist>
 371
 372 </sect2>
 373
 374 </sect1>
 375
 376 <sect1>
 377 <title>New Functionality</title>
 378
 379         <sect2>
 380         <title>Databases</title>
 381
 382         <para>
 383         This section contains brief descriptions of any new databases
 384         introduced in Samba-3. Please remember to back up your existing
 385         ${lock directory}/*tdb before upgrading to Samba-3. Samba will
 386         upgrade databases as they are opened (if necessary), but downgrading
 387         from 3.0 to 2.2 is an unsupported path.
 388         </para>
 389
 390         <para>
 391         The new tdb files are described in <link linkend="tdbfiledesc">the next table</link>.
 392         </para>
 393
 394
 395         <table frame='all' id="tdbfiledesc"><title>TDB File Descriptions</title>
 396         <tgroup cols='3'>
 397                         <colspec align="left"/>
 398                         <colspec align="justify" colwidth="1*"/>
 399                         <colspec align="left"/>
 400                 <thead>
 401                 <row>
 402                         <entry align="left">Name</entry>
 403                         <entry align="justify">Description</entry>
 404                         <entry align="center">Backup?</entry>
 405                 </row>
 406                 </thead>
 407                 <tbody>
 408                 <row>
 409                         <entry>account_policy</entry>
 410                         <entry>User policy settings</entry>
 411                         <entry>yes</entry>
 412                 </row>
 413                 <row>
 414                         <entry>gencache</entry>
 415                         <entry>Generic caching db</entry>
 416                         <entry>no</entry>
 417                 </row>
 418                 <row>
 419                         <entry>group_mapping</entry>
 420                         <entry><para>Mapping table from Windows groups/SID to UNIX groups</para></entry>
 421                         <entry>yes</entry>
 422                 </row>
 423                 <row>
 424                         <entry>idmap</entry>
 425                         <entry><para>New ID map table from SIDS to UNIX UIDs/GIDs</para></entry>
 426                         <entry>yes</entry>
 427                 </row>
 428                 <row>
 429                         <entry>namecache</entry>
 430                         <entry>Name resolution cache entries</entry>
 431                         <entry>no</entry>
 432                 </row>
 433                 <row>
 434                         <entry>netlogon_unigrp</entry>
 435                         <entry><para>Cache of universal group membership obtained when operating
 436                                 as a member of a Windows domain</para></entry>
 437                         <entry>no</entry>
 438                 </row>
 439                 <row>
 440                         <entry>printing/*.tdb</entry>
 441                         <entry><para>Cached output from lpq command created on a per-print-service basis</para></entry>
 442                         <entry>no</entry>
 443                 </row>
 444                 <row>
 445
 446                         <entry>registry</entry>
 447                         <entry><para>Read-only Samba registry skeleton that provides support for
 448                                 exporting various database tables via the winreg RPCs</para></entry>
 449                         <entry>no</entry>
 450                 </row>
 451                 </tbody>
 452         </tgroup>
 453         </table>
 454
 455         </sect2>
 456
 457         <sect2>
 458         <title>Changes in Behavior</title>
 459
 460         <para>
 461         The following issues are known changes in behavior between Samba-2.2 and
 462         Samba-3 that may affect certain installations of Samba.
 463         </para>
 464
 465         <orderedlist>
 466                 <listitem><para>
 467 <indexterm><primary>Windows domain</primary></indexterm>
 468 <indexterm><primary>getpwnam() call</primary></indexterm>
 469 <indexterm><primary>NT_STATUS_LOGON_FAILURE</primary></indexterm>
 470                 When operating as a member of a Windows domain, Samba-2.2 would map any users authenticated by the remote DC
 471                 to the <quote>guest account</quote> if a UID could not be obtained via the getpwnam() call. Samba-3 rejects
 472                 the connection with the error message <quote>NT_STATUS_LOGON_FAILURE.</quote> There is no current workaround
 473                 to re-establish the Samba-2.2 behavior.
 474                 </para></listitem>
 475
 476                 <listitem><para>
 477 <indexterm><primary>add user script</primary></indexterm>
 478 <indexterm><primary>add machine script</primary></indexterm>
 479                 When adding machines to a Samba-2.2 controlled domain, the
 480                 <quote>add user script</quote> was used to create the UNIX identity of the
 481                 machine trust account. Samba-3 introduces a new <quote>add machine
 482                 script</quote> that must be specified for this purpose. Samba-3 will
 483                 not fall back to using the <quote>add user script</quote> in the absence of
 484                 an <quote>add machine script</quote>.
 485                 </para></listitem>
 486         </orderedlist>
 487
 488         </sect2>
 489
 490         <sect2>
 491         <title>Passdb Backends and Authentication</title>
 492
 493         <para>
 494         There have been a few new changes that Samba administrators should be
 495         aware of when moving to Samba-3.
 496         </para>
 497
 498         <orderedlist>
 499                 <listitem><para>
 500 <indexterm><primary>encrypted passwords</primary></indexterm>
 501                 Encrypted passwords have been enabled by default in order to
 502                 interoperate better with out-of-the-box Windows client
 503                 installations. This does mean that either (a) a Samba account
 504                 must be created for each user, or (b) <quote>encrypt passwords = no</quote>
 505                 must be explicitly defined in &smb.conf;.
 506                 </para></listitem>
 507
 508                 <listitem><para>
 509 <indexterm><primary>ADS</primary></indexterm>
 510 <indexterm><primary>Kerberos</primary></indexterm>
 511 <indexterm><primary>LDAP</primary></indexterm>
 512                 Inclusion of new <smbconfoption name="security">ads</smbconfoption> option for integration
 513                 with an Active Directory domain using the native Windows Kerberos 5 and LDAP protocols.
 514                 </para></listitem>
 515         </orderedlist>
 516
 517         <para>
 518 <indexterm><primary>account storage backends</primary></indexterm>
 519         Samba-3 also includes the possibility of setting up chains of authentication methods (<smbconfoption
 520         name="auth methods"/>) and account storage backends (<smbconfoption name="passdb backend"/>).  Please refer to
 521         the &smb.conf; man page and <link linkend="passdb">Account Information Databases</link>, for
 522         details. While both parameters assume sane default values, it is likely that you will need to understand what
 523         the values actually mean in order to ensure Samba operates correctly.
 524         </para>
 525
 526         <para>
 527 <indexterm><primary>pdbedit</primary></indexterm>
 528 <indexterm><primary>smbpasswd</primary></indexterm>
 529 <indexterm><primary>net tool</primary></indexterm>
 530         Certain functions of the <command>smbpasswd</command> tool have been split between the
 531         new <command>smbpasswd</command> utility, the <command>net</command> tool, and the new <command>pdbedit</command>
 532         utility. See the respective man pages for details.
 533         </para>
 534
 535         </sect2>
 536
 537         <sect2>
 538         <title>LDAP</title>
 539
 540         <para>
 541         This section outlines the new features effecting Samba/LDAP integration.
 542         </para>
 543
 544                 <sect3>
 545                 <title>New Schema</title>
 546
 547                 <para>
 548 <indexterm><primary>object class</primary></indexterm>
 549 <indexterm><primary>sambaSamAccount</primary></indexterm>
 550 <indexterm><primary>LDIF</primary></indexterm>
 551 <indexterm><primary>attributes</primary></indexterm>
 552                 A new object class (sambaSamAccount) has been introduced to replace
 553                 the old sambaAccount. This change aids in the renaming of attributes
 554                 to prevent clashes with attributes from other vendors. There is a
 555                 conversion script (examples/LDAP/convertSambaAccount) to modify an LDIF
 556                 file to the new schema.
 557                 </para>
 558
 559                 <para>
 560                 Example:
 561 <indexterm><primary>ldapsearch</primary></indexterm>
 562                 </para>
 563                 <para><screen>
 564                 &prompt;ldapsearch .... -LLL -b "ou=people,dc=..." &gt; old.ldif
 565                 &prompt;convertSambaAccount --sid &lt;DOM SID&gt; --input old.ldif --output new.ldif
 566                 </screen></para>
 567
 568                 <para>
 569 <indexterm><primary>net</primary><secondary>getlocalsid</secondary></indexterm>
 570                 The &lt;DOM SID&gt; can be obtained by running
 571 <screen>
 572 &prompt;<userinput>net getlocalsid &lt;DOMAINNAME&gt;</userinput>
 573 </screen>
 574 <indexterm><primary>PDC</primary></indexterm>
 575                 on the Samba PDC as root.
 576                 </para>
 577
 578                 <para>
 579                 Under Samba-2.x the domain SID can be obtained by executing:
 580 <indexterm><primary>smbpasswd</primary></indexterm>
 581 <screen>
 582 &prompt;<userinput>smbpasswd -S &lt;DOMAINNAME&gt;</userinput>
 583 </screen>
 584                 </para>
 585
 586                 <para>
 587 <indexterm><primary>old sambaAccount</primary></indexterm>
 588 <indexterm><primary>ldapsam_compat</primary></indexterm>
 589 <indexterm><primary>object class declaration</primary></indexterm>
 590 <indexterm><primary>samba.schema</primary></indexterm>
 591                 The old <literal>sambaAccount</literal> schema may still be used by specifying the
 592                 <parameter>ldapsam_compat</parameter> passdb backend. However, the sambaAccount and
 593                 associated attributes have been moved to the historical section of
 594                 the schema file and must be uncommented before use if needed.
 595                 The Samba-2.2 object class declaration for a <literal>sambaAccount</literal> has not changed
 596                 in the Samba-3 <filename>samba.schema</filename> file.
 597                 </para>
 598
 599                 <para>
 600                 Other new object classes and their uses include:
 601                 </para>
 602
 603                 <itemizedlist>
 604                         <listitem><para>
 605 <indexterm><primary>sambaDomain</primary></indexterm>
 606 <indexterm><primary>domain information</primary></indexterm>
 607 <indexterm><primary>RID</primary></indexterm>
 608 <indexterm><primary>ldap suffix</primary></indexterm>
 609 <indexterm><primary>ldapsam</primary></indexterm>
 610 <indexterm><primary>idmap</primary></indexterm>
 611                         <literal>sambaDomain</literal> &smbmdash; domain information used to allocate RIDs
 612                         for users and groups as necessary. The attributes are added
 613                         in <quote>ldap suffix</quote> directory entry automatically if
 614                         an idmap UID/GID range has been set and the <quote>ldapsam</quote>
 615                         passdb backend has been selected.
 616                         </para></listitem>
 617
 618                         <listitem><para>
 619 <indexterm><primary>sambaGroupMapping</primary></indexterm>
 620 <indexterm><primary>ldap group suffix</primary></indexterm>
 621 <indexterm><primary>net groupmap</primary></indexterm>
 622                         sambaGroupMapping &smbmdash; an object representing the
 623                         relationship between a posixGroup and a Windows
 624                         group/SID. These entries are stored in the <quote>ldap
 625                         group suffix</quote> and managed by the <quote>net groupmap</quote> command.
 626                         </para></listitem>
 627
 628                         <listitem><para>
 629 <indexterm><primary>sambaUNIXIdPool</primary></indexterm>
 630 <indexterm><primary>ldap idmap suffix</primary></indexterm>
 631 <indexterm><primary>idmap UID</primary></indexterm>
 632 <indexterm><primary>idmap GID</primary></indexterm>
 633                         <literal>sambaUNIXIdPool</literal> &smbmdash; created in the <quote>ldap idmap suffix</quote> entry
 634                         automatically and contains the next available <quote>idmap UID</quote> and
 635                         <quote>idmap GID</quote>.
 636                         </para></listitem>
 637
 638                         <listitem><para>
 639 <indexterm><primary>sambaIdmapEntry</primary></indexterm>
 640 <indexterm><primary>idmap_ldap module</primary></indexterm>
 641                         <literal>sambaIdmapEntry</literal> &smbmdash; object storing a mapping between a
 642                         SID and a UNIX UID/GID. These objects are created by the
 643                         idmap_ldap module as needed.
 644                         </para></listitem>
 645                 </itemizedlist>
 646
 647                 </sect3>
 648
 649                 <sect3>
 650                 <title>New Suffix for Searching</title>
 651
 652                 <para>
 653 <indexterm><primary>LDAP queries</primary></indexterm>
 654 <indexterm><primary>passdb backend</primary></indexterm>
 655 <indexterm><primary>ldap suffix</primary></indexterm>
 656 <indexterm><primary>ldap user suffix</primary></indexterm>
 657 <indexterm><primary>ldap machine suffix</primary></indexterm>
 658 <indexterm><primary>ldap group suffix</primary></indexterm>
 659 <indexterm><primary>ldap idmap suffix</primary></indexterm>
 660                 The following new &smb.conf; parameters have been added to aid in directing
 661                 certain LDAP queries when <parameter>passdb backend = ldapsam://...</parameter> has been
 662                 specified.
 663                 </para>
 664
 665                 <itemizedlist>
 666                         <listitem><para>ldap suffix         &smbmdash; used to search for user and computer accounts.</para></listitem>
 667                         <listitem><para>ldap user suffix    &smbmdash; used to store user accounts.</para></listitem>
 668                         <listitem><para>ldap machine suffix &smbmdash; used to store machine trust accounts.</para></listitem>
 669                         <listitem><para>ldap group suffix   &smbmdash; location of posixGroup/sambaGroupMapping entries.</para></listitem>
 670                         <listitem><para>ldap idmap suffix   &smbmdash; location of sambaIdmapEntry objects.</para></listitem>
 671                 </itemizedlist>
 672
 673                 <para>
 674 <indexterm><primary>ldap suffix</primary></indexterm>
 675 <indexterm><primary>subsuffix parameters</primary></indexterm>
 676                 If an <parameter>ldap suffix</parameter> is defined, it will be appended to all of the
 677                 remaining subsuffix parameters. In this case, the order of the suffix
 678                 listings in &smb.conf; is important. Always place the <parameter>ldap suffix</parameter> first
 679                 in the list.
 680                 </para>
 681
 682                 <para>
 683                 Due to a limitation in Samba's &smb.conf; parsing, you should not surround
 684                 the domain names with quotation marks.
 685                 </para>
 686
 687                 </sect3>
 688
 689                 <sect3>
 690                 <title>IdMap LDAP Support</title>
 691
 692                 <para>
 693                 Samba-3 supports an LDAP backend for the idmap subsystem. The
 694                 following options inform Samba that the idmap table should be
 695                 stored on the directory server <emphasis>onterose</emphasis> in the ou=idmap,dc=quenya,dc=org partition.
 696                 </para>
 697
 698                 <smbconfblock>
 699                 <smbconfsection name="[global]"/>
 700                 <member>...</member>
 701                 <smbconfoption name="idmap backend">ldap:ldap://onterose/</smbconfoption>
 702                 <smbconfoption name="ldap idmap suffix">ou=idmap,dc=quenya,dc=org</smbconfoption>
 703                 <smbconfoption name="idmap uid">40000-50000</smbconfoption>
 704                 <smbconfoption name="idmap gid">40000-50000</smbconfoption>
 705                 </smbconfblock>
 706
 707                 <para>
 708 <indexterm><primary>NFS</primary></indexterm>
 709                 This configuration allows Winbind installations on multiple servers to
 710                 share a UID/GID number space, thus avoiding the interoperability problems
 711                 with NFS that were present in Samba-2.2.
 712                 </para>
 713
 714                 </sect3>
 715
 716         </sect2>
 717
 718 </sect1>
 719
 720 </chapter>