9.3. Implementation From feedback on the Samba mailing lists, it seems that most Windows NT4 migrations to Samba-3 are being performed using a new server or a new installation of a Linux or UNIX server. If you contemplate doing this, please note that the steps that follow in this chapter assume familiarity with the information that has been previously covered in this book. You are particularly encouraged to be familiar with Chapter 3, "Secure Office Networking", Chapter 4, "The 500-User Office" and Chapter 5, "Making Happy Users". We present here the steps and example output for two NT4 to Samba-3 domain migrations. The first uses an LDAP-based backend, and the second uses a tdbsam backend. In each case the scripts you specify in the smb.conf file for the add user script collection of parameters are used to effect the addition of accounts into the passdb backend. Before proceeding to NT4 migration using either a tdbsam or ldapsam, it is most strongly recommended to review Section 4.3.1 for DNS and DHCP configuration. The importance of correctly functioning name resolution must be recognized. This applies equally for both hostname and NetBIOS names (machine names, computer names, domain names, workgroup names ALL names!). The migration process involves the following steps: - Prepare the target Samba-3 server. This involves configuring Samba-3 for migration to either a tdbsam or an ldapsam backend.
- Clean up the source NT4 PDC. Delete all accounts that need not be migrated. Delete all files that should not be migrated. Where possible, change NT group names so there are no spaces or uppercase characters. This is important if the target UNIX host insists on POSIX-compliant all lowercase user and group names.
- Step through the migration process.
- Remove the NT4 PDC from the network.
- Upgrade the Samba-3 server from a BDC to a PDC, and validate all account information.
It may help to use the above outline as a pre-migration checklist. 9.3.1. NT4 Migration Using LDAP Backend In this example, the migration is of an NT4 PDC to a Samba-3 PDC with an LDAP backend. The accounts about to be migrated are shown in Figure 9.2. In this example use is made of the smbldap-tools scripts to add the accounts that are migrated into the ldapsam passdb backend. Four scripts are essential to the migration process. Other scripts will be required for daily management, but these are not critical to migration. The critical scripts are dependant on which passdb backend is being used. Refer to Table 9.1 to see which scripts must be provided so that the migration process can complete. Figure 9.2. View of Accounts in NT4 Domain User Manager 
Table 9.1. Samba smb.conf Scripts Essential to Samba OperationEntity | ldapsam Script | tdbsam Script |
|---|
Add User Accounts | smbldap-useradd | useradd | Delete User Accounts | smbldap-userdel | userdel | Add Group Accounts | smbldap-groupadd | groupadd | Delete Group Accounts | smbldap-groupdel | groupdel | Add User to Group | smbldap-groupmod | usermod (See Note) | Add Machine Accounts | smbldap-useradd | useradd |
Verify that you have correctly specified in the smb.conf file the scripts and arguments that should be passed to them before attempting to perform the account migration. Note also that the deletion scripts must be commented out during migration. These should be uncommented following successful migration of the NT4 Domain accounts. Warning  | Under absolutely no circumstances should the Samba daemons be started until instructed to do so. Delete the /etc/samba/secrets.tdb file and all Samba control tdb files before commencing the following configuration steps. |
Note  | The UNIX/Linux usermod utility does not permit simple user addition to (or deletion of users from) groups. This is a feature provided by the smbldap-tools scripts. If you want this capability, you must create your own tool to do this. Alternately, you can search the Web to locate a utility called groupmem (by George Kraft) that provides this functionality. The groupmem utility was contributed to the shadow package but has not surfaced in the formal commands provided by Linux distributions (March 2004). |
Note | The tdbdump utility is a utility that you can build from the Samba source-code tree. Not all Linux binary distributions include this tool. If it is missing from your Linux distribution, you will need to build this yourself or else forgo its use. |
Before starting the migration, all dead accounts were removed from the NT4 domain using the User Manager for Domains. USER MIGRATION STEPS 1. | Configure the Samba smb.conf file to create a BDC. An example configuration is given in Example 9.3.1. The delete scripts are commented out so that during the process of migration no account information can be deleted.
| 2. | Configure OpenLDAP in preparation for the migration. An example sladp.conf file is shown in Example 9.3.3. The rootpw value is an encrypted password string that can be obtained by executing the slappasswd command.
| 3. | Install the PADL nss_ldap tool set, then configure the /etc/ldap.conf as shown in Example 9.3.5.
| 4. | Edit the /etc/nsswitch.conf file so it has the entries shown in Example 9.3.6. Note that the LDAP entries have been commented out. This is deliberate. If these entries are active (not commented out), and the /etc/ldap.conf file has been configured, when the LDAP server is started, the process of starting the LDAP server will cause LDAP lookups. This causes the LDAP server slapd to hang because it finds port 389 open and therefore cannot gain exclusive control of it. By commenting these entries out, it is possible to avoid this gridlock situation and thus the overall installation and configuration will progress more smoothly.
| 5. | Validate the the target NT4 PDC name is being correctly resolved to its IP address by executing the following:
root# ping transgression PING transgression.terpstra-world.org (192.168.1.5) 56(84) bytes of data. 64 bytes from (192.168.1.5): icmp_seq=1 ttl=128 time=0.159 ms 64 bytes from (192.168.1.5): icmp_seq=2 ttl=128 time=0.192 ms 64 bytes from (192.168.1.5): icmp_seq=3 ttl=128 time=0.141 ms --- transgression.terpstra-world.org ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2000ms rtt min/avg/max/mdev = 0.141/0.164/0.192/0.021 ms
Do not proceed to the next step if this step fails. It is imperative that the name of the PDC can be resolved to its IP address. If this is broken, fix it.
| 6. | Pull the domain SID from the NT4 domain that is being migrated as follows:
root# net rpc getsid -S TRANGRESSION -U Administrator%not24get Storing SID S-1-5-21-1385457007-882775198-1210191635 \ for Domain DAMNATION in secrets.tdb
Another way to obtain the domain SID from the target NT4 domain that is being migrated to Samba-3 is by executing the following:
root# net rpc info -S TRANSGRESSION
If this method is used, do not forget to store the SID obtained into the secrets.tdb file. This can be done by executing:
root# net setlocalsid S-1-5-21-1385457007-882775198-1210191635
| 7. | Install the Idealx smbldap-tools software package, following the instructions given in Section 5.4.4. The resulting perl scripts should be located in the /opt/IDEALX/sbin directory. Change into that location, or wherever the scripts have been installed. Execute the configure.pl script to configure the Idealx package for use. Note: Use the domain SID obtained from the step above. The following is an example configuration session:
root# ./configure.pl -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= smbldap-tools script configuration -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Before starting, check . if your samba controller is up and running. . if the domain SID is defined (you can get it with the 'net getlocalsid') . you can leave the configuration using the Crtl-c key combination . empty value can be set with the "." character -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Looking for configuration files... Samba Config File Location [/etc/samba/smb.conf] > smbldap Config file Location (global parameters) [/etc/smbldap-tools/smbldap.conf] > smbldap Config file Location (bind parameters) [/etc/smbldap-tools/smbldap_bind.conf] > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Let's start configuring the smbldap-tools scripts ... . workgroup name: name of the domain Samba act as a PDC workgroup name [DAMNATION] > . netbios name: netbios name of the samba controller netbios name [MERLIN] > . logon drive: local path to which the home directory will be connected (for NT Workstations). Ex: 'H:' logon drive [X:] > H: . logon home: home directory location (for Win95/98 or NT Workstation) (use %U as username) Ex:'\\MERLIN\home\%U' logon home (leave blank if you don't want homeDirectory) [\\MERLIN\home\%U] > \\%L\%U . logon path: directory where roaming profiles are stored. Ex:'\\MERLIN\profiles\%U' logon path (leave blank if you don't want roaming profile) [\\MERLIN\profiles\%U] > \\%L\profiles\%U . home directory prefix (use %U as username) [/home/%U] > /home/users/%U . default user netlogon script (use %U as username) [%U.cmd] > scripts\logon.cmd default password validation time (time in days) [45] > 180 . ldap suffix [dc=terpstra-world,dc=org] > . ldap group suffix [ou=Groups] > . ldap user suffix [ou=People] > . ldap machine suffix [ou=People] > . Idmap suffix [ou=Idmap] > . sambaUnixIdPooldn: object where you want to store the next uidNumber and gidNumber available for new users and groups sambaUnixIdPooldn object (relative to ${suffix}) [sambaDomainName=DAMNATION] > . ldap master server: IP address or DNS name of the master (writable) ldap server ldap master server [] > 127.0.0.1 . ldap master port [389] > . ldap master bind dn [cn=Manager,dc=terpstra-world,dc=org] > . ldap master bind password [] > . ldap slave server: IP address or DNS name of the slave ldap server: can also be the master one ldap slave server [] > 127.0.0.1 . ldap slave port [389] > . ldap slave bind dn [cn=Manager,dc=terpstra-world,dc=org] > . ldap slave bind password [] > . ldap tls support (1/0) [0] > . SID for domain DAMNATION: SID of the domain (can be obtained with 'net getlocalsid MERLIN') SID for domain DAMNATION [] > S-1-5-21-1385457007-882775198-1210191635 . unix password encryption: encryption used for unix passwords unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA) [SSHA] > MD5 . default user gidNumber [513] > . default computer gidNumber [515] > . default login shell [/bin/bash] > . default domain name to append to mail address [] > terpstra-world.org -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= backup old configuration files: /etc/smbldap-tools/smbldap.conf-> /etc/smbldap-tools/smbldap.conf.old /etc/smbldap-tools/smbldap_bind.conf-> /etc/smbldap-tools/smbldap_bind.conf.old writing new configuration file: /etc/smbldap-tools/smbldap.conf done. /etc/smbldap-tools/smbldap_bind.conf done.
Note that the NT4 domain SID that was previously obtained was entered above. Also, the sambaUnixIdPooldn object was specified as sambaDomainName=DAMNATION. This is the location into which the Idealx smbldap-tools store the next available UID/GID information. It is also where Samba stores domain specific information such as the next RID, the SID, and so on. In older version of the smbldap-tools this information was stored in the sambaUnixIdPooldn DIT location cn=NextFreeUnixId. Where smbldap-tools are being upgraded to version 0.9.1 it is appropriate to update this to the new location only if the directory information is also relocated.
| 8. | Start the LDAP server using the system interface script. On Novell SLES9 this is done as shown here:
root# rcldap start
| 9. | Edit the /etc/nsswitch.conf file so it has the entries shown in Example 9.3.7. Note that the LDAP entries have now been uncommented.
| 10. | The LDAP management password must be installed into the secrets.tdb file as follows:
root# smbpasswd -w not24get Setting stored password for "cn=Manager,dc=terpstra-world,dc=org" in secrets.tdb
| 11. | Populate the LDAP directory as shown here:
root# /opt/IDEALX/sbin/smbldap-populate -a root -k 0 -m 0 Using workgroup name from sambaUnixIdPooldn (smbldap.conf): sambaDomainName=DAMNATION Using builtin directory structure adding new entry: dc=terpstra-world,dc=org adding new entry: ou=People,dc=terpstra-world,dc=org adding new entry: ou=Groups,dc=terpstra-world,dc=org entry ou=People,dc=terpstra-world,dc=org already exist. adding new entry: ou=Idmap,dc=terpstra-world,dc=org adding new entry: sambaDomainName=DAMNATION,dc=terpstra-world,dc=org adding new entry: uid=root,ou=People,dc=terpstra-world,dc=org adding new entry: uid=nobody,ou=People,dc=terpstra-world,dc=org adding new entry: cn=Domain Admins,ou=Groups,dc=terpstra-world,dc=org adding new entry: cn=Domain Users,ou=Groups,dc=terpstra-world,dc=org adding new entry: cn=Domain Guests,ou=Groups,dc=terpstra-world,dc=org adding new entry: cn=Domain Computers,ou=Groups,dc=terpstra-world,dc=org adding new entry: cn=Administrators,ou=Groups,dc=terpstra-world,dc=org adding new entry: cn=Print Operators,ou=Groups,dc=terpstra-world,dc=org adding new entry: cn=Backup Operators,ou=Groups,dc=terpstra-world,dc=org adding new entry: cn=Replicators,ou=Groups,dc=terpstra-world,dc=org
The script tries to add the ou=People container twice, hence the error message. This is expected behavior.
| 12. | Restart the LDAP server following initialization of the LDAP directory. Execute the system control script provided on your system. The following steps can be used on Novell SUSE SLES 9:
root# rcldap restart root# chkconfig ldap on
| 13. | Verify that the new user accounts that have been added to the LDAP directory can be resolved as follows:
root# getent passwd ... nobody:x:65534:65533:nobody:/var/lib/nobody:/bin/bash man:x:13:62:Manual pages viewer:/var/cache/man:/bin/bash news:x:9:13:News system:/etc/news:/bin/bash uucp:x:10:14:Unix-to-Unix CoPy system:/etc/uucp:/bin/bash +::0:0::: root:x:0:0:Netbios Domain Administrator:/home/users/root:/bin/false nobody:x:999:514:nobody:/dev/null:/bin/false
Now repeat this for the group accounts as shown here:
root# getent group ... nobody:x:65533: nogroup:x:65534:nobody users:x:100: +::0: Domain Admins:x:512:root Domain Users:x:513: Domain Guests:x:514: Domain Computers:x:515: Administrators:x:544: Print Operators:x:550: Backup Operators:x:551: Replicators:x:552:
In both cases the LDAP accounts follow the "+::0:" entry.
| 14. | Now it is time to join the Samba BDC to the target NT4 domain that is being migrated to Samba-3 by executing the following:
root# net rpc join -S TRANSGRESSION -U Administrator%not24get merlin:/opt/IDEALX/sbin # net rpc join -S TRANSGRESSION \ -U Administrator%not24get Joined domain DAMNATION.
| 15. | Set the new domain administrator (root) password for both UNIX and Windows as shown here:
root# /opt/IDEALX/sbin/smbldap-passwd root Changing password for root New password : ******** Retype new password : ********
Note: During account migration, the Windows Administrator account will not be migrated to the Samba server.
| 16. | Now validate that these accounts can be resolved using Samba's tools as shown here for user accounts:
root# pdbedit -Lw root:0:84B0D8E14D158FF8417EAF50CFAC29C3: AF6DD3FD4E2EA8BDE1695A3F05EFBF52:[U ]:LCT-425F6467: nobody:65534:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX: NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:[NU ]:LCT-00000000:
Now complete the following step to validate that group account mappings have been correctly set:
root# net groupmap list Domain Admins (S-1-5-21-1385457007-882775198-1210191635-512) -> Domain Admins Domain Users (S-1-5-21-1385457007-882775198-1210191635-513) -> Domain Users Domain Guests (S-1-5-21-1385457007-882775198-1210191635-514) -> Domain Guests Domain Computers (S-1-5-21-1385457007-882775198-1210191635-515) -> Domain Computers Administrators (S-1-5-32-544) -> Administrators Print Operators (S-1-5-32-550) -> Print Operators Backup Operators (S-1-5-32-551) -> Backup Operators Replicators (S-1-5-32-552) -> Replicators
These are the expected results for a correctly configured system.
| 17. | Commence migration as shown here:
root# net rpc vampire -S TRANSGRESSION \ -U Administrator%not24get > /tmp/vampire.log 2>1
Check the vampire log to confirm that only expected errors have been reported. See Section 9.3.1.1.
| 18. | The migration of user accounts can be quickly validated as follows:
root# pdbedit -Lw root:0:84B0D8E14D158FF8417EAF50CFAC29C3:... nobody:65534:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:... Administrator:0:84B0D8E14D158FF8417EAF50CFAC29C3:... Guest:1:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:... TRANSGRESSION$:2:CC044B748CEE294CE76B6B0D1B86C1A8:... IUSR_TRANSGRESSION:3:64046AC81B056C375F9537FC409085F8:... MIDEARTH$:4:E93186E5819706D2AAD3B435B51404EE:... atrickhoffer:5:DC08CFE0C12B2867352502E32A407F23:... barryf:6:B829BCDE01FF24376E45D5F10408CFBD:... fsellerby:7:6A97CBEBE8F9826B417EAF50CFAC29C3:... gdaison:8:48F6A8C8A900024351DA8C2061C5F1D3:... hrambotham:9:7330D9EA0964465EAAD3B435B51404EE:... jrhapsody:10:ACBA7D207E2BA35D9BD41A26B01626BD:... maryk:11:293B5A4CA41F6CA1A7D80430B8342B73:... jacko:12:8E8982D86BD037C364BBD09A598E07AD:... bridge:13:0D2CA7D2BE67FE2193BE3A377C968336:... sharpec:14:8841A75CAC19D2855D8B73B1F4D430F8:... jimbo:15:6E8BDC904FD9EC5C17306D272A9441BB:... dhenwick:16:D1694A03C33584BDAAD3B435B51404EE:... dork:17:69E2D19E69A593D5AAD3B435B51404EE:... blue:18:E355EBF9559979FEAAD3B435B51404EE:... billw:19:EE35C3481CF7F7DB484448BC86A641A5:... rfreshmill:20:7EC033B58661B60CAAD3B435B51404EE:... MAGGOT$:21:A3B9334765AD30F7AAD3B435B51404EE:... TRENTWARE$:22:1D92C8DD5E7F0DDF93BE3A377C968336:... MORTON$:23:89342E69DCA9D3F8AAD3B435B51404EE:... NARM$:24:2B93E2D1D25448BDAAD3B435B51404EE:... LAPDOG$:25:14AA535885120943AAD3B435B51404EE:... SCAVENGER$:26:B6288EB6D147B56F8963805A19B0ED49:... merlin$:27:820C50523F368C54AB9D85AE603AD09D:...
| 19. | The mapping of UNIX and Windows groups can be validated as show here:
root# net groupmap list Domain Admins (S-1-5-21-1385457007-882775198-1210191635-512) -> Domain Admins Domain Users (S-1-5-21-1385457007-882775198-1210191635-513) -> Domain Users Domain Guests (S-1-5-21-1385457007-882775198-1210191635-514) -> Domain Guests Domain Computers (S-1-5-21-1385457007-882775198-1210191635-515) -> Domain Computers Administrators (S-1-5-32-544) -> Administrators Print Operators (S-1-5-32-550) -> Print Operators Backup Operators (S-1-5-32-551) -> Backup Operators Replicator (S-1-5-32-552) -> Replicators Engineers (S-1-5-21-1385457007-882775198-1210191635-1020) -> Engineers Marketoids (S-1-5-21-1385457007-882775198-1210191635-1022) -> Marketoids Gnomes (S-1-5-21-1385457007-882775198-1210191635-1023) -> Gnomes Catalyst (S-1-5-21-1385457007-882775198-1210191635-1024) -> Catalyst Recieving (S-1-5-21-1385457007-882775198-1210191635-1025) -> Recieving Rubberboot (S-1-5-21-1385457007-882775198-1210191635-1026) -> Rubberboot Sales (S-1-5-21-1385457007-882775198-1210191635-1027) -> Sales Accounting (S-1-5-21-1385457007-882775198-1210191635-1028) -> Accounting Shipping (S-1-5-21-1385457007-882775198-1210191635-1029) -> Shipping Account Operators (S-1-5-32-548) -> Account Operators Guests (S-1-5-32-546) -> Guests Server Operators (S-1-5-32-549) -> Server Operators Users (S-1-5-32-545) -> Users
It is of vital importance that the domain SID portions of all group accounts are identical.
| 20. | The final responsibility in the migration process is to create identical shares and printing resources on the new Samba-3 server, copy all data across, set up privileges, and set share and file/directory access controls.
| 21. | Edit the smb.conf file to reset the parameter domain master = Yes so that the Samba server functions as a PDC for the purpose of migration. Also, uncomment the deletion scripts so they will now be fully functional, enable the wins support = yes parameter and comment out the wins server. Validate the configuration with the testparm utility as shown here:
root# testparm Load smb config files from /etc/samba/smb.conf Processing section "[apps]" Processing section "[media]" Processing section "[homes]" Processing section "[printers]" Processing section "[netlogon]" Processing section "[profiles]" Processing section "[profdata]" Processing section "[print$]" Loaded services file OK. Server role: ROLE_DOMAIN_PDC Press enter to see a dump of your service definitions
| 22. | Now shut down the old NT4 PDC. Only when the old NT4 PDC and all NT4 BDCs have been shut down can the Samba-3 PDC be started.
| 23. | All workstations should function as they did with the old NT4 PDC. All interdomain trust accounts should remain in place and fully functional. All machine accounts and user logon accounts should also function correctly.
| 24. | The configuration of Samba-3 BDC servers can be accomplished now or at any convenient time in the future. Please refer to the carefully detailed process for doing so is outlined in Section 5.5.
|
9.3.1.1 Migration Log Validation The following vampire.log file is typical of a valid migration. adding user Administrator to group Domain Admins adding user atrickhoffer to group Engineers adding user dhenwick to group Engineers adding user dork to group Engineers adding user rfreshmill to group Marketoids adding user jacko to group Gnomes adding user jimbo to group Gnomes adding user maryk to group Gnomes adding user gdaison to group Gnomes adding user dhenwick to group Catalyst adding user jacko to group Catalyst adding user jacko to group Recieving adding user blue to group Recieving adding user hrambotham to group Rubberboot adding user billw to group Sales adding user bridge to group Sales adding user jrhapsody to group Sales adding user maryk to group Sales adding user rfreshmill to group Sales adding user fsellerby to group Sales adding user sharpec to group Sales adding user jimbo to group Accounting adding user gdaison to group Accounting adding user jacko to group Shipping adding user blue to group Shipping Fetching DOMAIN database Creating unix group: 'Engineers' Creating unix group: 'Marketoids' Creating unix group: 'Gnomes' Creating unix group: 'Catalyst' Creating unix group: 'Recieving' Creating unix group: 'Rubberboot' Creating unix group: 'Sales' Creating unix group: 'Accounting' Creating unix group: 'Shipping' Creating account: Administrator Creating account: Guest Creating account: TRANSGRESSION$ Creating account: IUSR_TRANSGRESSION Creating account: MIDEARTH$ Creating account: atrickhoffer Creating account: barryf Creating account: fsellerby Creating account: gdaison Creating account: hrambotham Creating account: jrhapsody Creating account: maryk Creating account: jacko Creating account: bridge Creating account: sharpec Creating account: jimbo Creating account: dhenwick Creating account: dork Creating account: blue Creating account: billw Creating account: rfreshmill Creating account: MAGGOT$ Creating account: TRENTWARE$ Creating account: MORTON$ Creating account: NARM$ Creating account: LAPDOG$ Creating account: SCAVENGER$ Creating account: merlin$ Group members of Domain Admins: Administrator, Group members of Domain Users: Administrator(primary), TRANSGRESSION$(primary),IUSR_TRANSGRESSION(primary), MIDEARTH$(primary),atrickhoffer(primary),barryf(primary), fsellerby(primary),gdaison(primary),hrambotham(primary), jrhapsody(primary),maryk(primary),jacko(primary),bridge(primary), sharpec(primary),jimbo(primary),dhenwick(primary),dork(primary), blue(primary),billw(primary),rfreshmill(primary),MAGGOT$(primary), TRENTWARE$(primary),MORTON$(primary),NARM$(primary), LAPDOG$(primary),SCAVENGER$(primary),merlin$(primary), Group members of Domain Guests: Guest(primary), Group members of Engineers: atrickhoffer,dhenwick,dork, Group members of Marketoids: rfreshmill, Group members of Gnomes: jacko,jimbo,maryk,gdaison, Group members of Catalyst: dhenwick,jacko, Group members of Recieving: jacko,blue, Group members of Rubberboot: hrambotham, Group members of Sales: billw,bridge,jrhapsody,maryk, rfreshmill,fsellerby,sharpec, Group members of Accounting: jimbo,gdaison, Group members of Shipping: jacko,blue, Fetching BUILTIN database skipping SAM_DOMAIN_INFO delta for 'Builtin' (is not my domain) Creating unix group: 'Account Operators' Creating unix group: 'Guests' Creating unix group: 'Server Operators' Creating unix group: 'Users'
9.3.2. NT4 Migration Using tdbsam Backend In this example, we change the domain name of the NT4 server from DRUGPREP to MEGANET prior to the use of the vampire (migration) tool. This migration process makes use of Linux system tools (like useradd) to add the accounts that are migrated into the UNIX/Linux /etc/passwd and /etc/group databases. These entries must therefore be present, and correct options specified, in your smb.conf file, or else the migration does not work as it should. MIGRATION STEPS USING TDBSAM 1. | Prepare a Samba-3 server precisely per the instructions shown in Chapter 4, "The 500-User Office". Set the workgroup name to MEGANET.
| 2. | Edit the smb.conf file to temporarily change the parameter domain master = No so the Samba server functions as a BDC for the purpose of migration.
| 3. | Start Samba as you have done previously.
| 4. | Join the NT4 Domain as a BDC, as shown here:
root# net rpc join -S oldnt4pdc -W MEGANET -UAdministrator%not24get Joined domain MEGANET.
| 5. | You may vampire the accounts from the NT4 PDC by executing the command, as shown here:
root# net rpc vampire -S oldnt4pdc -U Administrator%not24get Fetching DOMAIN database SAM_DELTA_DOMAIN_INFO not handled Creating unix group: 'Domain Admins' Creating unix group: 'Domain Users' Creating unix group: 'Domain Guests' Creating unix group: 'Engineers' Creating unix group: 'Marketoids' Creating unix group: 'Account Operators' Creating unix group: 'Administrators' Creating unix group: 'Backup Operators' Creating unix group: 'Guests' Creating unix group: 'Print Operators' Creating unix group: 'Replicator' Creating unix group: 'Server Operators' Creating unix group: 'Users' Creating account: Administrator Creating account: Guest Creating account: oldnt4pdc$ Creating account: jacko Creating account: maryk Creating account: bridge Creating account: sharpec Creating account: jimbo Creating account: dhenwick Creating account: dork Creating account: blue Creating account: billw Creating account: massive$ Group members of Engineers: Administrator, sharpec(primary),bridge,billw(primary),dhenwick Group members of Marketoids: Administrator,jacko(primary), maryk(primary),jimbo,blue(primary),dork(primary) Creating unix group: 'Gnomes' Fetching BUILTIN database SAM_DELTA_DOMAIN_INFO not handled
| 6. | At this point, we can validate our migration. Let's look at the accounts in the form in which they are seen in a smbpasswd file. This achieves that:
root# pdbedit -Lw Administrator:505:84B0D8E14D158FF8417EAF50CFAC29C3: AF6DD3FD4E2EA8BDE1695A3F05EFBF52:[UX ]:LCT-3DF7AA9F: jimbo:512:6E9A2A51F64A1BD5C187B8085FE1D9DF: CDF7E305E639966E489A0CEFB95EE5E0:[UX ]:LCT-3E9362BC: sharpec:511:E4301A7CD8FDD1EC6BBF9BC19CDF8151: 7000255938831D5B948C95C1931534C5:[UX ]:LCT-3E8B42C4: dhenwick:513:DCD8886141E3F892AAD3B435B51404EE: 2DB36465949CB938DD98C312EFDC2639:[UX ]:LCT-3E939F41: bridge:510:3FE6873A43101B46417EAF50CFAC29C3: 891741F481AF111B4CAA09A94016BD01:[UX ]:LCT-3E8B4291: blue:515:256D41D2559BB3D2AAD3B435B51404EE: 9CCADDA4F7D281DD0FAD321478C6F971:[UX ]:LCT-3E939FDC: diamond$:517:6C8E7B64EDCDBC4218B6345447A4454B: 3323AC63C666CFAACB60C13F65D54E9A:[S ]:LCT-00000000: oldnt4pdc$:507:3E39430CDCABB5B09ED320D0448AE568: 95DBAF885854A919C7C7E671060478B9:[S ]:LCT-3DF7AA9F: Guest:506:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[DUX ]:LCT-3E93A008: billw:516:85380CA7C21B6EBE168C8150662AF11B: 5D7478508293709937E55FB5FBA14C17:[UX ]:LCT-3FED7CA1: dork:514:78C70DDEC35A35B5AAD3B435B51404EE: 0AD886E015AC595EC0AF40E6C9689E1A:[UX ]:LCT-3E939F9A: jacko:508:BC472F3BF9A0A5F63832C92FC614B7D1: 0C6822AAF85E86600A40DC73E40D06D5:[UX ]:LCT-3E8B4242: maryk:509:3636AB7E12EBE79AB79AE2610DD89D4C: CF271B744F7A55AFDA277FF88D80C527:[UX ]:LCT-3E8B4270:
| 7. | An expanded view of a user account entry shows more of what was obtained from the NT4 PDC:
sleeth:~ # pdbedit -Lv maryk Unix username: maryk NT username: maryk Account Flags: [UX ] User SID: S-1-5-21-1988699175-926296742-1295600288-1003 Primary Group SID: S-1-5-21-1988699175-926296742-1295600288-1007 Full Name: Mary Kathleen Home Directory: \\diamond\maryk HomeDir Drive: X: Logon Script: scripts\logon.bat Profile Path: \\diamond\profiles\maryk Domain: MEGANET Account desc: Peace Maker Workstations: Munged dial: Logon time: 0 Logoff time: Mon, 18 Jan 2038 20:14:07 GMT Kickoff time: Mon, 18 Jan 2038 20:14:07 GMT Password last set: Wed, 02 Apr 2003 13:05:04 GMT Password can change: 0 Password must change: Mon, 18 Jan 2038 20:14:07 GMT
| 8. | The following command lists the long names of the groups that have been imported (vampired) from the NT4 PDC:
root# net group -l -Uroot%not24get -Smassive Group name Comment ----------------------------- Engineers Snake Oil Engineers Marketoids Untrustworthy Hype Vendors Gnomes Plain Vanilla Garden Gnomes Replicator Supports file replication in a domain Guests Users granted guest access to the computer/domain Administrators Members can fully administer the computer/domain Users Ordinary users
Everything looks well and in order.
| 9. | Edit the smb.conf file to reset the parameter domain master = Yes so the Samba server functions as a PDC for the purpose of migration.
|
9.3.3. Key Points Learned Migration of an NT4 PDC database to a Samba-3 PDC is possible. An LDAP backend is a suitable vehicle for NT4 migrations. A tdbsam backend can be used to perform a migration. Multiple NT4 domains can be merged into a single Samba-3 domain. The net Samba-3 domain most likely requires some administration and updating before going live.
|
