docs/Samba3-HOWTO/TOSHARG-upgrading-to-3.0.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3 <chapter id="upgrading-to-3.0">
   4 <chapterinfo>
   5         &author.jelmer;
   6         &author.jht;
   7         &author.jerry;
   8         <pubdate>June 30, 2003</pubdate>
   9 </chapterinfo>
  10
  11 <title>Upgrading from Samba-2.x to Samba-3.0.20</title>
  12
  13 <para>
  14 <indexterm><primary>Samba differences</primary></indexterm>
  15 <indexterm><primary>changed parameters</primary></indexterm>
  16 <indexterm><primary>simple guide</primary></indexterm>
  17 This chapter deals exclusively with the differences between Samba-3.0.20 and Samba-2.2.8a.
  18 It points out where configuration parameters have changed, and provides a simple guide for
  19 the move from 2.2.x to 3.0.20.
  20 </para>
  21
  22 <sect1>
  23 <title>Quick Migration Guide</title>
  24
  25 <para>
  26 Samba-3.0.20 default behavior should be approximately the same as Samba-2.2.x.
  27 The default behavior when the new parameter <smbconfoption name="passdb backend"/>
  28 is not defined in the &smb.conf; file provides the same default behavior as Samba-2.2.x
  29 with <smbconfoption name="encrypt passwords">Yes</smbconfoption> and
  30 will use the <filename>smbpasswd</filename> database.
  31 </para>
  32
  33 <para>
  34 <indexterm><primary>behavior approximately same</primary></indexterm>
  35 <indexterm><primary>differing protocol</primary></indexterm>
  36 So why say that <emphasis>behavior should be approximately the same as Samba-2.2.x</emphasis>? Because
  37 Samba-3.0.20 can negotiate new protocols, such as support for native Unicode, that may result in
  38 differing protocol code paths being taken. The new behavior under such circumstances is not
  39 exactly the same as the old one. The good news is that the domain and machine SIDs will be
  40 preserved across the upgrade.
  41 </para>
  42
  43 <para>
  44 <indexterm><primary>LDAP backend</primary></indexterm>
  45 <indexterm><primary>database</primary></indexterm>
  46 <indexterm><primary>pdbedit</primary></indexterm>
  47 <indexterm><primary>Samba-3-compatible LDAP backend</primary></indexterm>
  48 If the Samba-2.2.x system is using an LDAP backend, and there is no time to update the LDAP
  49 database, then make sure that <smbconfoption name="passdb backend">ldapsam_compat</smbconfoption>
  50 is specified in the &smb.conf; file. For the rest, behavior should remain more or less the same.
  51 At a later date, when there is time to implement a new Samba-3-compatible LDAP backend, it is possible
  52 to migrate the old LDAP database to the new one through use of the <command>pdbedit</command>.
  53 See <link linkend="pdbeditthing">The <emphasis>pdbedit</emphasis> Command</link>.
  54 </para>
  55
  56 </sect1>
  57
  58 <sect1>
  59 <title>New Features in Samba-3</title>
  60
  61 <para>
  62 The major new features are:
  63 </para>
  64
  65 <orderedlist numeration="arabic">
  66         <listitem><para>
  67 <indexterm><primary>ADS</primary></indexterm>
  68 <indexterm><primary>LDAP/Kerberos</primary></indexterm>
  69         Active Directory support. This release is able to join an ADS realm
  70         as a member server and authenticate users using LDAP/Kerberos.
  71         </para></listitem>
  72
  73         <listitem><para>
  74 <indexterm><primary>Unicode</primary></indexterm>
  75 <indexterm><primary>multibyte character sets</primary></indexterm>
  76         Unicode support. Samba will now negotiate Unicode on the wire, and
  77         internally there is a much better infrastructure for multibyte
  78         and Unicode character sets.
  79         </para></listitem>
  80
  81         <listitem><para>
  82 <indexterm><primary>authentication system</primary></indexterm>
  83         New authentication system. The internal authentication system has
  84         been almost completely rewritten. Most of the changes are internal,
  85         but the new authoring system is also very configurable.
  86         </para></listitem>
  87
  88         <listitem><para>
  89 <indexterm><primary>filename mangling</primary></indexterm>
  90         New filename mangling system. The filename mangling system has been
  91         completely rewritten. An internal database now stores mangling maps
  92         persistently.
  93         </para></listitem>
  94
  95         <listitem><para>
  96 <indexterm><primary>net command</primary></indexterm>
  97         New <quote>net</quote> command. A new <quote>net</quote> command has been added. It is
  98         somewhat similar to the <quote>net</quote> command in Windows. Eventually, we
  99         plan to replace a bunch of other utilities (such as smbpasswd)
 100         with subcommands in <quote>net</quote>.
 101         </para></listitem>
 102
 103         <listitem><para>
 104 <indexterm><primary>status32 codes</primary></indexterm>
 105         Samba now negotiates NT-style status32 codes on the wire. This
 106         considerably improves error handling.
 107         </para></listitem>
 108
 109         <listitem><para>
 110 <indexterm><primary>printer attributes publishing</primary></indexterm>
 111         Better Windows 200x/XP printing support, including publishing
 112         printer attributes in Active Directory.
 113         </para></listitem>
 114
 115         <listitem><para>
 116 <indexterm><primary>RPC modules</primary></indexterm>
 117 <indexterm><primary>passdb backends</primary></indexterm>
 118 <indexterm><primary>character sets</primary></indexterm>
 119         New loadable RPC modules for passdb backends and character sets.
 120         </para></listitem>
 121
 122         <listitem><para>
 123 <indexterm><primary>dual-daemon winbindd</primary></indexterm>
 124         New default dual-daemon winbindd support for better performance.
 125         </para></listitem>
 126
 127         <listitem><para>
 128 <indexterm><primary>migrating</primary></indexterm>
 129 <indexterm><primary>maintaining ids</primary></indexterm>
 130 <indexterm><primary>SID</primary></indexterm>
 131         Support for migrating from a Windows NT 4.0 domain to a Samba
 132         domain and maintaining user, group, and domain SIDs.
 133         </para></listitem>
 134
 135         <listitem><para>
 136 <indexterm><primary>trust relationships</primary></indexterm>
 137 <indexterm><primary>domain controllers</primary></indexterm>
 138         Support for establishing trust relationships with Windows NT 4.0
 139         domain controllers.
 140         </para></listitem>
 141
 142         <listitem><para>
 143 <indexterm><primary>Winbind architecture</primary></indexterm>
 144 <indexterm><primary>LDAP directory</primary></indexterm>
 145 <indexterm><primary>ID mapping</primary></indexterm>
 146         Initial support for a distributed Winbind architecture using
 147         an LDAP directory for storing SID to UID/GID mappings.
 148         </para></listitem>
 149
 150         <listitem><para>
 151         Major updates to the Samba documentation tree.
 152         </para></listitem>
 153
 154         <listitem><para>
 155 <indexterm><primary>SMB signing</primary></indexterm>
 156 <indexterm><primary>security settings</primary></indexterm>
 157         Full support for client and server SMB signing to ensure
 158         compatibility with default Windows 2003 security settings.
 159         </para></listitem>
 160 </orderedlist>
 161
 162 <para>
 163 Plus lots of other improvements!
 164 </para>
 165
 166 </sect1>
 167
 168 <sect1>
 169 <title>Configuration Parameter Changes</title>
 170
 171 <para>
 172 This section contains a brief listing of changes to &smb.conf; options since the Samba-2.2.x series up to an
 173 including Samba-3.0.21. Please refer to the smb.conf(5) man page for complete descriptions of new or modified
 174 parameters.
 175 </para>
 176
 177 <sect2>
 178 <title>Removed Parameters</title>
 179
 180 <indexterm><primary>deleted parameters</primary></indexterm>
 181 <para>
 182 In alphabetical order, these are the parameters eliminated from Samba-2.2.x through 3.0.21.
 183 </para>
 184
 185 <itemizedlist>
 186         <listitem><para>admin log</para></listitem>
 187         <listitem><para>alternate permissions</para></listitem>
 188         <listitem><para>character set</para></listitem>
 189         <listitem><para>client codepage</para></listitem>
 190         <listitem><para>code page directory</para></listitem>
 191         <listitem><para>coding system</para></listitem>
 192         <listitem><para>domain admin group</para></listitem>
 193         <listitem><para>domain guest group</para></listitem>
 194         <listitem><para>enable svcctl</para></listitem>
 195         <listitem><para>force unknown acl user</para></listitem>
 196         <listitem><para>ldap filter</para></listitem>
 197         <listitem><para>min password length</para></listitem>
 198         <listitem><para>nt smb support</para></listitem>
 199         <listitem><para>post script</para></listitem>
 200         <listitem><para>printer admin</para></listitem>
 201         <listitem><para>printer driver</para></listitem>
 202         <listitem><para>printer driver file</para></listitem>
 203         <listitem><para>printer driver location</para></listitem>
 204         <listitem><para>read size</para></listitem>
 205         <listitem><para>source environment</para></listitem>
 206         <listitem><para>status </para></listitem>
 207         <listitem><para>strip dot </para></listitem>
 208         <listitem><para>total print jobs</para></listitem>
 209         <listitem><para>unicode</para></listitem>
 210         <listitem><para>use rhosts</para></listitem>
 211         <listitem><para>valid chars</para></listitem>
 212         <listitem><para>vfs options</para></listitem>
 213         <listitem><para>winbind enable local accounts</para></listitem>
 214 </itemizedlist>
 215
 216 </sect2>
 217
 218 <sect2>
 219 <title>New Parameters</title>
 220
 221 <para>New parameters in the Samba 3.0.0 series prior to release of Samba 3.0.20 are grouped by function):</para>
 222
 223 <para>Remote Management</para>
 224
 225 <indexterm><primary>new parameters</primary></indexterm>
 226
 227 <itemizedlist>
 228         <listitem><para>abort shutdown script</para></listitem>
 229         <listitem><para>shutdown script</para></listitem>
 230 </itemizedlist>
 231
 232 <para>User and Group Account Management</para>
 233
 234 <itemizedlist>
 235         <listitem><para>add group script</para></listitem>
 236         <listitem><para>add machine script</para></listitem>
 237         <listitem><para>add user to group script</para></listitem>
 238         <listitem><para>algorithmic rid base</para></listitem>
 239         <listitem><para>delete group script</para></listitem>
 240         <listitem><para>delete user from group script</para></listitem>
 241         <listitem><para>passdb backend</para></listitem>
 242         <listitem><para>rename user script</para></listitem>
 243         <listitem><para>set primary group script</para></listitem>
 244         <listitem><para>username map script</para></listitem>
 245 </itemizedlist>
 246
 247 <para>Authentication</para>
 248
 249 <itemizedlist>
 250         <listitem><para>auth methods</para></listitem>
 251         <listitem><para>ldap password sync</para></listitem>
 252         <listitem><para>passdb expand explicit</para></listitem>
 253         <listitem><para>realm</para></listitem>
 254 </itemizedlist>
 255
 256 <para>Protocol Options</para>
 257
 258 <itemizedlist>
 259         <listitem><para>afs token lifetime</para></listitem>
 260         <listitem><para>client lanman auth</para></listitem>
 261         <listitem><para>client NTLMv2 auth</para></listitem>
 262         <listitem><para>client schannel</para></listitem>
 263         <listitem><para>client signing</para></listitem>
 264         <listitem><para>client use spnego</para></listitem>
 265         <listitem><para>defer sharing violations</para></listitem>
 266         <listitem><para>disable netbios</para></listitem>
 267         <listitem><para>enable privileges</para></listitem>
 268         <listitem><para>use kerberos keytab</para></listitem>
 269         <listitem><para>log nt token command</para></listitem>
 270         <listitem><para>ntlm auth</para></listitem>
 271         <listitem><para>paranoid server security </para></listitem>
 272         <listitem><para>sendfile</para></listitem>
 273         <listitem><para>server schannel</para></listitem>
 274         <listitem><para>server signing</para></listitem>
 275         <listitem><para>smb ports</para></listitem>
 276         <listitem><para>svcctl list</para></listitem>
 277         <listitem><para>use spnego</para></listitem>
 278 </itemizedlist>
 279
 280 <para>File Service</para>
 281
 282 <itemizedlist>
 283         <listitem><para>allocation roundup size</para></listitem>
 284         <listitem><para>acl check permissions</para></listitem>
 285         <listitem><para>acl group control</para></listitem>
 286         <listitem><para>acl map full control</para></listitem>
 287         <listitem><para>aio read size</para></listitem>
 288         <listitem><para>aio write size</para></listitem>
 289         <listitem><para>dfree cache time</para></listitem>
 290         <listitem><para>dfree command</para></listitem>
 291         <listitem><para>ea support</para></listitem>
 292         <listitem><para>enable asu support</para></listitem>
 293         <listitem><para>force unknown acl user</para></listitem>
 294         <listitem><para>get quota command</para></listitem>
 295         <listitem><para>hide special files</para></listitem>
 296         <listitem><para>hide unwriteable files</para></listitem>
 297         <listitem><para>inherit owner</para></listitem>
 298         <listitem><para>hostname lookups</para></listitem>
 299         <listitem><para>kernel change notify</para></listitem>
 300         <listitem><para>mangle prefix</para></listitem>
 301         <listitem><para>map acl inherit</para></listitem>
 302         <listitem><para>map read only</para></listitem>
 303         <listitem><para>max stat cache size</para></listitem>
 304         <listitem><para>msdfs proxy</para></listitem>
 305         <listitem><para>set quota command</para></listitem>
 306         <listitem><para>store dos attributes</para></listitem>
 307         <listitem><para>use sendfile</para></listitem>
 308         <listitem><para>vfs objects</para></listitem>
 309 </itemizedlist>
 310
 311 <para>Printing</para>
 312
 313 <itemizedlist>
 314         <listitem><para>cups options</para></listitem>
 315         <listitem><para>cups server</para></listitem>
 316         <listitem><para>force printername</para></listitem>
 317         <listitem><para>iprint server</para></listitem>
 318         <listitem><para>max reported print jobs</para></listitem>
 319         <listitem><para>printcap cache time</para></listitem>
 320 </itemizedlist>
 321
 322
 323 <para>Unicode and Character Sets</para>
 324
 325 <itemizedlist>
 326         <listitem><para>display charset</para></listitem>
 327         <listitem><para>dos charset</para></listitem>
 328         <listitem><para>UNIX charset</para></listitem>
 329 </itemizedlist>
 330
 331 <para>SID to UID/GID Mappings</para>
 332
 333 <itemizedlist>
 334         <listitem><para>idmap backend</para></listitem>
 335         <listitem><para>idmap gid</para></listitem>
 336         <listitem><para>idmap uid</para></listitem>
 337         <listitem><para>username map script</para></listitem>
 338         <listitem><para>winbind nested groups</para></listitem>
 339         <listitem><para>winbind nss info</para></listitem>
 340         <listitem><para>winbind trusted domains only</para></listitem>
 341         <listitem><para>template primary group</para></listitem>
 342         <listitem><para>enable rid algorithm</para></listitem>
 343 </itemizedlist>
 344
 345 <para>LDAP</para>
 346
 347 <itemizedlist>
 348         <listitem><para>ldap delete dn</para></listitem>
 349         <listitem><para>ldap group suffix</para></listitem>
 350         <listitem><para>ldap idmap suffix</para></listitem>
 351         <listitem><para>ldap machine suffix</para></listitem>
 352         <listitem><para>ldap passwd sync</para></listitem>
 353         <listitem><para>ldap replication sleep</para></listitem>
 354         <listitem><para>ldap timeout</para></listitem>
 355         <listitem><para>ldap user suffix</para></listitem>
 356 </itemizedlist>
 357
 358 <para>General Configuration</para>
 359
 360 <itemizedlist>
 361         <listitem><para>eventlog list</para></listitem>
 362         <listitem><para>preload modules</para></listitem>
 363         <listitem><para>reset on zero vc</para></listitem>
 364         <listitem><para>privatedir</para></listitem>
 365 </itemizedlist>
 366
 367 </sect2>
 368
 369 <sect2>
 370 <title>Modified Parameters (Changes in Behavior)</title>
 371
 372 <itemizedlist>
 373         <listitem><para>dos filetimes (enabled by default)</para></listitem>
 374         <listitem><para>encrypt passwords (enabled by default) </para></listitem>
 375         <listitem><para>mangling method (set to hash2 by default) </para></listitem>
 376         <listitem><para>map to guest</para></listitem>
 377         <listitem><para>only user (deprecated)</para></listitem>
 378         <listitem><para>passwd chat </para></listitem>
 379         <listitem><para>passwd program </para></listitem>
 380         <listitem><para>password server </para></listitem>
 381         <listitem><para>restrict anonymous (integer value) </para></listitem>
 382         <listitem><para>security (new ads value) </para></listitem>
 383         <listitem><para>strict locking (enabled by default) </para></listitem>
 384         <listitem><para>winbind cache time (increased to 5 minutes) </para></listitem>
 385         <listitem><para>winbind uid (deprecated in favor of idmap uid)</para></listitem>
 386         <listitem><para>winbind gid (deprecated in favor of idmap gid)</para></listitem>
 387         <listitem><para>winbindd nss info</para></listitem>
 388         <listitem><para>write cache (deprecated)</para></listitem>
 389 </itemizedlist>
 390
 391 </sect2>
 392
 393 </sect1>
 394
 395 <sect1>
 396 <title>New Functionality</title>
 397
 398         <para>
 399 <indexterm><primary>major changes</primary></indexterm>
 400         The major changes in behavior since that Samba-2.2.x series are documented in this section.
 401         Please refer to the <filename>WHATSNEW.txt</filename> file that ships with every release of
 402         Samba to obtain detailed information regarding the changes that have been made during the
 403         life of the current Samba release.
 404         </para>
 405
 406         <sect2>
 407         <title>TDB Data Files</title>
 408
 409 <indexterm><primary>tdb data files</primary></indexterm>
 410         <para>
 411         Refer to <link linkend="install">Installation, Chapter 1</link>, <link linkend="tdbdocs">Chapter 1</link>
 412         for information pertaining to the Samba-3 data files, their location and the information that must be
 413         preserved across server migrations, updates and upgrades.
 414         </para>
 415
 416         <para>
 417 <indexterm><primary>tdb file backup</primary></indexterm>
 418         Please remember to back up your existing ${lock directory}/*tdb before upgrading to Samba-3. If necessary, Samba will
 419         upgrade databases as they are opened. Downgrading from Samba-3 to 2.2, or reversion to an earlier version
 420         of Samba-3 from a later release, is an unsupported path.
 421         </para>
 422
 423         <para>
 424 <indexterm><primary>tdb file descriptions</primary></indexterm>
 425         The old Samba-2.2.x tdb files are described in <link linkend="oldtdbfiledesc">the next table</link>.
 426         </para>
 427
 428
 429         <table frame='all' id="oldtdbfiledesc"><title>Samba-2.2.x TDB File Descriptions</title>
 430         <tgroup cols='3'>
 431                         <colspec align="left"/>
 432                         <colspec align="justify" colwidth="1*"/>
 433                         <colspec align="left"/>
 434                 <thead>
 435                 <row>
 436                         <entry align="left">Name</entry>
 437                         <entry align="justify">Description</entry>
 438                         <entry align="center">Backup?</entry>
 439                 </row>
 440                 </thead>
 441                 <tbody>
 442                 <row>
 443                         <entry>account_policy</entry>
 444                         <entry>User policy settings</entry>
 445                         <entry>yes</entry>
 446                 </row>
 447                 <row>
 448                         <entry>brlock</entry>
 449                         <entry>Byte-range file locking information.</entry>
 450                         <entry>no</entry>
 451                 </row>
 452                 <row>
 453                         <entry>connections</entry>
 454                         <entry><para>Client connection information</para></entry>
 455                         <entry>no</entry>
 456                 </row>
 457                 <row>
 458                         <entry>locking</entry>
 459                         <entry>Temporary file locking data.</entry>
 460                         <entry>no</entry>
 461                 </row>
 462                 <row>
 463                         <entry>messages</entry>
 464                         <entry><para>Temporary storage of messages being processed by smbd.</para></entry>
 465                         <entry>no</entry>
 466                 </row>
 467        <row>
 468             <entry>ntdrivers</entry>
 469             <entry><para>Stores per-printer driver information.</para></entry>
 470                         <entry>yes</entry>
 471         </row>
 472         <row>
 473             <entry>ntforms</entry>
 474             <entry><para>Stores per-printer forms information.</para></entry>
 475                         <entry>yes</entry>
 476         </row>
 477         <row>
 478             <entry>ntprinters</entry>
 479             <entry><para>Stores the per-printer devmode configuration settings.</para></entry>
 480                         <entry>yes</entry>
 481         </row>
 482                 <row>
 483                         <entry>printing/*.tdb</entry>
 484                         <entry><para>Cached output from lpq command created on a per-print-service basis.</para></entry>
 485                         <entry>no</entry>
 486                 </row>
 487                 <row>
 488
 489                         <entry>registry</entry>
 490                         <entry><para>Read-only Samba registry skeleton that provides support for
 491                                 exporting various database tables via the winreg RPCs.</para></entry>
 492                         <entry>no</entry>
 493                 </row>
 494                 <row>
 495                         <entry>sessionid</entry>
 496                         <entry><para>Temporary cache for miscellaneous session information.</para></entry>
 497                         <entry>no</entry>
 498                 </row>
 499                 <row>
 500                         <entry>share_info</entry>
 501                         <entry>Share ACL settings.</entry>
 502                         <entry>yes</entry>
 503                 </row>
 504                 <row>
 505
 506                         <entry>unexpected</entry>
 507                         <entry><para>Packets received for which no process was listening.</para></entry>
 508                         <entry>no</entry>
 509                 </row>
 510                 <row>
 511                         <entry>winbindd_cache</entry>
 512                         <entry><para>Cache of identity information received from an NT4 or an ADS domain.</para></entry>
 513                         <entry>yes</entry>
 514                 </row>
 515                 <row>
 516                         <entry>winbindd_idmap</entry>
 517                         <entry><para>New ID map table from SIDS to UNIX UIDs/GIDs.</para></entry>
 518                         <entry>yes</entry>
 519                 </row>
 520                 </tbody>
 521         </tgroup>
 522         </table>
 523
 524         </sect2>
 525
 526         <sect2>
 527         <title>Changes in Behavior</title>
 528
 529         <para>
 530         The following issues are known changes in behavior between Samba-2.2 and
 531         Samba-3 that may affect certain installations of Samba.
 532         </para>
 533
 534         <orderedlist>
 535                 <listitem><para>
 536 <indexterm><primary>Windows domain</primary></indexterm>
 537 <indexterm><primary>getpwnam() call</primary></indexterm>
 538 <indexterm><primary>NT_STATUS_LOGON_FAILURE</primary></indexterm>
 539                 When operating as a member of a Windows domain, Samba-2.2 would map any users authenticated by the remote DC
 540                 to the <quote>guest account</quote> if a UID could not be obtained via the getpwnam() call. Samba-3 rejects
 541                 the connection with the error message <quote>NT_STATUS_LOGON_FAILURE.</quote> There is no current workaround
 542                 to re-establish the Samba-2.2 behavior.
 543                 </para></listitem>
 544
 545                 <listitem><para>
 546 <indexterm><primary>add user script</primary></indexterm>
 547 <indexterm><primary>add machine script</primary></indexterm>
 548                 When adding machines to a Samba-2.2 controlled domain, the
 549                 <quote>add user script</quote> was used to create the UNIX identity of the
 550                 machine trust account. Samba-3 introduces a new <quote>add machine
 551                 script</quote> that must be specified for this purpose. Samba-3 will
 552                 not fall back to using the <quote>add user script</quote> in the absence of
 553                 an <quote>add machine script</quote>.
 554                 </para></listitem>
 555         </orderedlist>
 556
 557         </sect2>
 558
 559         <sect2>
 560         <title>Passdb Backends and Authentication</title>
 561
 562         <para>
 563         There have been a few new changes that Samba administrators should be
 564         aware of when moving to Samba-3.
 565         </para>
 566
 567         <orderedlist>
 568                 <listitem><para>
 569 <indexterm><primary>encrypted passwords</primary></indexterm>
 570                 Encrypted passwords have been enabled by default in order to
 571                 interoperate better with out-of-the-box Windows client
 572                 installations. This does mean that either (a) a Samba account
 573                 must be created for each user, or (b) <quote>encrypt passwords = no</quote>
 574                 must be explicitly defined in &smb.conf;.
 575                 </para></listitem>
 576
 577                 <listitem><para>
 578 <indexterm><primary>ADS</primary></indexterm>
 579 <indexterm><primary>Kerberos</primary></indexterm>
 580 <indexterm><primary>LDAP</primary></indexterm>
 581                 Inclusion of new <smbconfoption name="security">ads</smbconfoption> option for integration
 582                 with an Active Directory domain using the native Windows Kerberos 5 and LDAP protocols.
 583                 </para></listitem>
 584         </orderedlist>
 585
 586         <para>
 587 <indexterm><primary>account storage backends</primary></indexterm>
 588         Samba-3 also includes the possibility of setting up chains of authentication methods (<smbconfoption
 589         name="auth methods"/>) and account storage backends (<smbconfoption name="passdb backend"/>).  Please refer to
 590         the &smb.conf; man page and <link linkend="passdb">Account Information Databases</link>, for
 591         details. While both parameters assume sane default values, it is likely that you will need to understand what
 592         the values actually mean in order to ensure Samba operates correctly.
 593         </para>
 594
 595         <para>
 596 <indexterm><primary>pdbedit</primary></indexterm>
 597 <indexterm><primary>smbpasswd</primary></indexterm>
 598 <indexterm><primary>net tool</primary></indexterm>
 599         Certain functions of the <command>smbpasswd</command> tool have been split between the
 600         new <command>smbpasswd</command> utility, the <command>net</command> tool, and the new <command>pdbedit</command>
 601         utility. See the respective man pages for details.
 602         </para>
 603
 604         </sect2>
 605
 606         <sect2>
 607         <title>LDAP</title>
 608
 609         <para>
 610         This section outlines the new features effecting Samba/LDAP integration.
 611         </para>
 612
 613                 <sect3>
 614                 <title>New Schema</title>
 615
 616                 <para>
 617 <indexterm><primary>object class</primary></indexterm>
 618 <indexterm><primary>sambaSamAccount</primary></indexterm>
 619 <indexterm><primary>LDIF</primary></indexterm>
 620 <indexterm><primary>attributes</primary></indexterm>
 621                 A new object class (sambaSamAccount) has been introduced to replace
 622                 the old sambaAccount. This change aids in the renaming of attributes
 623                 to prevent clashes with attributes from other vendors. There is a
 624                 conversion script (examples/LDAP/convertSambaAccount) to modify an LDIF
 625                 file to the new schema.
 626                 </para>
 627
 628                 <para>
 629                 Example:
 630 <indexterm><primary>ldapsearch</primary></indexterm>
 631                 </para>
 632                 <para><screen>
 633                 &prompt;ldapsearch .... -LLL -b "ou=people,dc=..." &gt; old.ldif
 634                 &prompt;convertSambaAccount --sid &lt;DOM SID&gt; --input old.ldif --output new.ldif
 635                 </screen></para>
 636
 637                 <para>
 638 <indexterm><primary>net</primary><secondary>getlocalsid</secondary></indexterm>
 639                 The &lt;DOM SID&gt; can be obtained by running
 640 <screen>
 641 &prompt;<userinput>net getlocalsid &lt;DOMAINNAME&gt;</userinput>
 642 </screen>
 643 <indexterm><primary>PDC</primary></indexterm>
 644                 on the Samba PDC as root.
 645                 </para>
 646
 647                 <para>
 648                 Under Samba-2.x the domain SID can be obtained by executing:
 649 <indexterm><primary>smbpasswd</primary></indexterm>
 650 <screen>
 651 &prompt;<userinput>smbpasswd -S &lt;DOMAINNAME&gt;</userinput>
 652 </screen>
 653                 </para>
 654
 655                 <para>
 656 <indexterm><primary>old sambaAccount</primary></indexterm>
 657 <indexterm><primary>ldapsam_compat</primary></indexterm>
 658 <indexterm><primary>object class declaration</primary></indexterm>
 659 <indexterm><primary>samba.schema</primary></indexterm>
 660                 The old <literal>sambaAccount</literal> schema may still be used by specifying the
 661                 <parameter>ldapsam_compat</parameter> passdb backend. However, the sambaAccount and
 662                 associated attributes have been moved to the historical section of
 663                 the schema file and must be uncommented before use if needed.
 664                 The Samba-2.2 object class declaration for a <literal>sambaAccount</literal> has not changed
 665                 in the Samba-3 <filename>samba.schema</filename> file.
 666                 </para>
 667
 668                 <para>
 669                 Other new object classes and their uses include:
 670                 </para>
 671
 672                 <itemizedlist>
 673                         <listitem><para>
 674 <indexterm><primary>sambaDomain</primary></indexterm>
 675 <indexterm><primary>domain information</primary></indexterm>
 676 <indexterm><primary>RID</primary></indexterm>
 677 <indexterm><primary>ldap suffix</primary></indexterm>
 678 <indexterm><primary>ldapsam</primary></indexterm>
 679 <indexterm><primary>idmap</primary></indexterm>
 680                         <literal>sambaDomain</literal> &smbmdash; domain information used to allocate RIDs
 681                         for users and groups as necessary. The attributes are added
 682                         in <quote>ldap suffix</quote> directory entry automatically if
 683                         an idmap UID/GID range has been set and the <quote>ldapsam</quote>
 684                         passdb backend has been selected.
 685                         </para></listitem>
 686
 687                         <listitem><para>
 688 <indexterm><primary>sambaGroupMapping</primary></indexterm>
 689 <indexterm><primary>ldap group suffix</primary></indexterm>
 690 <indexterm><primary>net groupmap</primary></indexterm>
 691                         sambaGroupMapping &smbmdash; an object representing the
 692                         relationship between a posixGroup and a Windows
 693                         group/SID. These entries are stored in the <quote>ldap
 694                         group suffix</quote> and managed by the <quote>net groupmap</quote> command.
 695                         </para></listitem>
 696
 697                         <listitem><para>
 698 <indexterm><primary>sambaUNIXIdPool</primary></indexterm>
 699 <indexterm><primary>ldap idmap suffix</primary></indexterm>
 700 <indexterm><primary>idmap UID</primary></indexterm>
 701 <indexterm><primary>idmap GID</primary></indexterm>
 702                         <literal>sambaUNIXIdPool</literal> &smbmdash; created in the <quote>ldap idmap suffix</quote> entry
 703                         automatically and contains the next available <quote>idmap UID</quote> and
 704                         <quote>idmap GID</quote>.
 705                         </para></listitem>
 706
 707                         <listitem><para>
 708 <indexterm><primary>sambaIdmapEntry</primary></indexterm>
 709 <indexterm><primary>idmap_ldap module</primary></indexterm>
 710                         <literal>sambaIdmapEntry</literal> &smbmdash; object storing a mapping between a
 711                         SID and a UNIX UID/GID. These objects are created by the
 712                         idmap_ldap module as needed.
 713                         </para></listitem>
 714                 </itemizedlist>
 715
 716                 </sect3>
 717
 718                 <sect3>
 719                 <title>New Suffix for Searching</title>
 720
 721                 <para>
 722 <indexterm><primary>LDAP queries</primary></indexterm>
 723 <indexterm><primary>passdb backend</primary></indexterm>
 724 <indexterm><primary>ldap suffix</primary></indexterm>
 725 <indexterm><primary>ldap user suffix</primary></indexterm>
 726 <indexterm><primary>ldap machine suffix</primary></indexterm>
 727 <indexterm><primary>ldap group suffix</primary></indexterm>
 728 <indexterm><primary>ldap idmap suffix</primary></indexterm>
 729                 The following new &smb.conf; parameters have been added to aid in directing
 730                 certain LDAP queries when <parameter>passdb backend = ldapsam://...</parameter> has been
 731                 specified.
 732                 </para>
 733
 734                 <itemizedlist>
 735                         <listitem><para>ldap suffix         &smbmdash; used to search for user and computer accounts.</para></listitem>
 736                         <listitem><para>ldap user suffix    &smbmdash; used to store user accounts.</para></listitem>
 737                         <listitem><para>ldap machine suffix &smbmdash; used to store machine trust accounts.</para></listitem>
 738                         <listitem><para>ldap group suffix   &smbmdash; location of posixGroup/sambaGroupMapping entries.</para></listitem>
 739                         <listitem><para>ldap idmap suffix   &smbmdash; location of sambaIdmapEntry objects.</para></listitem>
 740                 </itemizedlist>
 741
 742                 <para>
 743 <indexterm><primary>ldap suffix</primary></indexterm>
 744 <indexterm><primary>subsuffix parameters</primary></indexterm>
 745                 If an <parameter>ldap suffix</parameter> is defined, it will be appended to all of the
 746                 remaining subsuffix parameters. In this case, the order of the suffix
 747                 listings in &smb.conf; is important. Always place the <parameter>ldap suffix</parameter> first
 748                 in the list.
 749                 </para>
 750
 751                 <para>
 752                 Due to a limitation in Samba's &smb.conf; parsing, you should not surround
 753                 the domain names with quotation marks.
 754                 </para>
 755
 756                 </sect3>
 757
 758                 <sect3>
 759                 <title>IdMap LDAP Support</title>
 760
 761                 <para>
 762 <indexterm><primary>idmap backend</primary></indexterm>
 763                 Samba-3 supports an LDAP backend for the idmap subsystem. The
 764                 following options inform Samba that the idmap table should be
 765                 stored on the directory server <emphasis>onterose</emphasis> in the ou=idmap,dc=quenya,dc=org partition.
 766                 </para>
 767
 768                 <smbconfblock>
 769                 <smbconfsection name="[global]"/>
 770                 <member>...</member>
 771                 <smbconfoption name="idmap backend">ldap:ldap://onterose/</smbconfoption>
 772                 <smbconfoption name="ldap idmap suffix">ou=idmap,dc=quenya,dc=org</smbconfoption>
 773                 <smbconfoption name="idmap uid">40000-50000</smbconfoption>
 774                 <smbconfoption name="idmap gid">40000-50000</smbconfoption>
 775                 </smbconfblock>
 776
 777                 <para>
 778 <indexterm><primary>NFS</primary></indexterm>
 779                 This configuration allows Winbind installations on multiple servers to
 780                 share a UID/GID number space, thus avoiding the interoperability problems
 781                 with NFS that were present in Samba-2.2.
 782                 </para>
 783
 784                 </sect3>
 785
 786         </sect2>
 787
 788 </sect1>
 789
 790 </chapter>