diff options
Diffstat (limited to 'docs/docbook/projdoc/NT4Migration.xml')
| -rw-r--r-- | docs/docbook/projdoc/NT4Migration.xml | 372 |
1 files changed, 200 insertions, 172 deletions
diff --git a/docs/docbook/projdoc/NT4Migration.xml b/docs/docbook/projdoc/NT4Migration.xml index 8c2d0e19f3..36bafee2af 100644 --- a/docs/docbook/projdoc/NT4Migration.xml +++ b/docs/docbook/projdoc/NT4Migration.xml @@ -38,25 +38,24 @@ pressure to return to a Microsoft based platform solution at the first sign of t </para> <para> -It is strongly advised that before attempting a migration to a Samba-3 controlled network -that every possible effort be made to gain all-round commitment to the change. Firstly, you -should know precisely <emphasis>why</emphasis> the change is important for the organisation. -Possible motivations to make a change include: +Before attempting a migration to a Samba-3 controlled network make every possible effort to +gain all-round commitment to the change. Know precisely <emphasis>why</emphasis> the change +is important for the organisation. Possible motivations to make a change include: </para> -<simplelist> - <member>Improve network manageability</member> - <member>Obtain better user level functionality</member> - <member>Reduce network operating costs</member> - <member>Reduce exposure caused by Microsoft withdrawal of NT4 support</member> - <member>Avoid MS License 6 implications</member> - <member>Reduce organisation's dependency on Microsoft</member> -</simplelist> +<itemizedlist> + <listitem><para>Improve network manageability</para></listitem> + <listitem><para>Obtain better user level functionality</para></listitem> + <listitem><para>Reduce network operating costs</para></listitem> + <listitem><para>Reduce exposure caused by Microsoft withdrawal of NT4 support</para></listitem> + <listitem><para>Avoid MS License 6 implications</para></listitem> + <listitem><para>Reduce organisation's dependency on Microsoft</para></listitem> +</itemizedlist> <para> -It is vital that it be well recognised that Samba-3 is NOT MS Windows NT4. Samba-3 offers -an alternative solution that is both different from MS Windows NT4 and that offers some -advantages compared with it. It should also be recognised that Samba-3 lacks many of the +Make sure that everyone knows that Samba-3 is NOT MS Windows NT4. Samba-3 offers +an alternative solution that is both different from MS Windows NT4 and that offers +advantages compared with it. Gain recognition that Samba-3 lacks many of the features that Microsoft has promoted as core values in migration from MS Windows NT4 to MS Windows 2000 and beyond (with or without Active Directory services). </para> @@ -65,37 +64,37 @@ MS Windows 2000 and beyond (with or without Active Directory services). What are the features that Samba-3 can NOT provide? </para> -<simplelist> - <member>Active Directory Server</member> - <member>Group Policy Objects (in Active Directory)</member> - <member>Machine Policy objects</member> - <member>Logon Scripts in Active Directory</member> - <member>Software Application and Access Controls in Active Directory</member> -</simplelist> +<itemizedlist> + <listitem><para>Active Directory Server</para></listitem> + <listitem><para>Group Policy Objects (in Active Directory)</para></listitem> + <listitem><para>Machine Policy objects</para></listitem> + <listitem><para>Logon Scripts in Active Directory</para></listitem> + <listitem><para>Software Application and Access Controls in Active Directory</para></listitem> +</itemizedlist> <para> The features that Samba-3 DOES provide and that may be of compelling interest to your site includes: </para> -<simplelist> - <member>Lower Cost of Ownership</member> - <member>Global availability of support with no strings attached</member> - <member>Dynamic SMB Servers (ie:Can run more than one server per Unix/Linux system)</member> - <member>Creation of on-the-fly logon scripts</member> - <member>Creation of on-the-fly Policy Files</member> - <member>Greater Stability, Reliability, Performance and Availability</member> - <member>Manageability via an ssh connection</member> - <member>Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam)</member> - <member>Ability to implement a full single-sign-on architecture</member> - <member>Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand</member> -</simplelist> +<itemizedlist> + <listitem><para>Lower Cost of Ownership</para></listitem> + <listitem><para>Global availability of support with no strings attached</para></listitem> + <listitem><para>Dynamic SMB Servers (ie:Can run more than one server per Unix/Linux system)</para></listitem> + <listitem><para>Creation of on-the-fly logon scripts</para></listitem> + <listitem><para>Creation of on-the-fly Policy Files</para></listitem> + <listitem><para>Greater Stability, Reliability, Performance and Availability</para></listitem> + <listitem><para>Manageability via an ssh connection</para></listitem> + <listitem><para>Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam)</para></listitem> + <listitem><para>Ability to implement a full single-sign-on architecture</para></listitem> + <listitem><para>Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand</para></listitem> +</itemizedlist> <para> -Before migrating a network from MS Windows NT4 to Samba-3 it is vital that all necessary factors are -considered. Users should be educated about changes they may experience so that the change will be a -welcome one and not become an obstacle to the work they need to do. The following are some of the -factors that will go into a successful migration: +Before migrating a network from MS Windows NT4 to Samba-3 consider all necessary factors. Users +should be educated about changes they may experience so that the change will be a welcome one +and not become an obstacle to the work they need to do. The following are factors that will +help ensure a successful migration: </para> <sect3> @@ -106,26 +105,25 @@ Samba-3 can be configured as a domain controller, a back-up domain controller (p a secondary controller), a domain member, or as a stand-alone server. The Windows network security domain context should be sized and scoped before implementation. Particular attention needs to be paid to the location of the primary domain controller (PDC) as well as backup controllers (BDCs). -It should be noted that one way in which Samba-3 differs from Microsoft technology is that if one -chooses to use an LDAP authentication backend then the same database can be used by several different -domains. This means that in a complex organisation there can be a single LDAP database, that itself -can be distributed, that can simultaneously serve multiple domains (that can also be widely distributed). +One way in which Samba-3 differs from Microsoft technology is that if one chooses to use an LDAP +authentication backend then the same database can be used by several different domains. In a +complex organisation there can be a single LDAP database, which itself can be distributed (ie: Have +a master server and multiple slave servers) that can simultaneously serve multiple domains. </para> <para> -It is recommended that from a design perspective, the number of users per server, as well as the number -of servers, per domain should be scaled according to needs and should also consider server capacity -and network bandwidth. +From a design perspective, the number of users per server, as well as the number of servers, per +domain should be scaled taking into consideration server capacity and network bandwidth. </para> <para> -A physical network segment may house several domains, each of which may span multiple network segments. -Where domains span routed network segments it is most advisable to consider and test the performance -implications of the design and layout of a network. A Centrally located domain controller that is being -designed to serve multiple routed network segments may result in severe performance problems if the -response time (eg: ping timing) between the remote segment and the PDC is more than 100 ms. In situations -where the delay is too long it is highly recommended to locate a backup controller (BDC) to serve as -the local authentication and access control server. +A physical network segment may house several domains. Each may span multiple network segments. +Where domains span routed network segments, consider and test the performance implications of +the design and layout of a network. A Centrally located domain controller that is designed to +serve multiple routed network segments may result in severe performance problems. Check the +response time (eg: ping timing) between the remote segment and the PDC. If long (more than 100 ms) +locate a backup controller (BDC) on the remote segmanet to serve as the local authentication and +access control server. </para> </sect3> @@ -133,18 +131,17 @@ the local authentication and access control server. <title>Server Share and Directory Layout</title> <para> -There are few cardinal rules to effective network design that can be broken with impunity. -The most important rule of effective network management is that simplicity is king in every -well controlled network. Every part of the infrastructure must be managed, the more complex -it is, the greater will be the demand of keeping systems secure and functional. +There are cardinal rules to effective network design. These can not be broken with impunity. +The most important rule: Simplicity is king in every well controlled network. Every part of +the infrastructure must be managed, the more complex it is, the greater will be the demand +of keeping systems secure and functional. </para> <para> -The nature of the data that must be stored needs to be born in mind when deciding how many -shares must be created. The physical disk space layout should also be taken into account -when designing where share points will be created. Keep in mind that all data needs to be -backed up, thus the simpler the disk layout the easier it will be to keep track of what must -be backed up to tape or other off-line storage medium. Always plan and implement for minimum +Keep in mind the nature of how data must be share. Physical disk space layout should be considered +carefully. Some data must be backed up. The simpler the disk layout the easier it will be to +keep track of backed needs. Identify what back media will be meet needs, consider backup to tape +, CD-ROM or (DVD-ROM), or other off-line storage medium. Plan and implement for minimum maintenance. Leave nothing to chance in your design, above all, do not leave backups to chance: Backup and test, validate every backup, create a disaster recovery plan and prove that it works. </para> @@ -156,13 +153,14 @@ directories may substantially avoid file access complaints from samba share user </para> <para> -Many network administrators who are new to the game will attempt to use elaborate techniques -to set access controls, on files, directories, shares, as well as in share definitions. -There is the ever present danger that that administrator's successor will not understand the -complex mess that has been inherited. Remember, apparent job security through complex design -and implementation may ultimately cause loss of operations and downtime to users as the new -administrator learns to untangle your web. Keep access controls simple and effective and -make sure that users will never be interrupted by the stupidity of complexity. +Inexperienced network administrators often attempt elaborate techniques to set access +controls on files, directories, shares, as well as in share definitions. +Keep your design and implementation simple and document your design extensively. Have others +audit your documentation. Do not create a complex mess that your successor will not understand. +Remember, job security through complex design and implementation may cause loss of operations +and downtime to users as the new administrator learns to untangle your knots. Keep access +controls simple and effective and make sure that users will never be interrupted by stupid +complexity. </para> </sect3> @@ -170,16 +168,14 @@ make sure that users will never be interrupted by the stupidity of complexity. <title>Logon Scripts</title> <para> -Please refer to the section of this document on Advanced Network Administration for information -regarding the network logon script options for Samba-3. Logon scripts can help to ensure that -all users gain share and printer connections they need. +Logon scripts can help to ensure that all users gain share and printer connections they need. </para> <para> -Logon scripts can be created on-the-fly so that all commands executed are specific to the -rights and privileges granted to the user. The preferred controls should be affected through +Logon scripts can be created 'on-the-fly' so that all commands executed are specific to the +rights and priviliges granted to the user. The preferred controls should be affected through group membership so that group information can be used to custom create a logon script using -the <parameter>root preexec</parameter> parameters to the <filename>NETLOGON</filename> share. +the <smbconfoption><name>root preexec</name></smbconfoption> parameters to the <smbconfsection>NETLOGON</smbconfsection> share. </para> <para> @@ -211,8 +207,8 @@ to be changed to the SID of the Samba-3 domain. <para> It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before attempting to migrate user and group accounts it is STRONGLY advised to create in Samba-3 the -groups that are present on the MS Windows NT4 domain <emphasis>AND</emphasis> to connect these to -suitable Unix/Linux groups. Following this simple advice will mean that all user and group attributes +groups that are present on the MS Windows NT4 domain <emphasis>AND</emphasis> to map these to +suitable Unix/Linux groups. By following this simple advice all user and group attributes should migrate painlessly. </para> </sect3> @@ -232,7 +228,8 @@ You will have an NT4 PDC that has the users, groups, policies and profiles to be </para></listitem> <listitem><para> -Samba-3 set up as a DC with netlogon share, profile share, etc. +Samba-3 set up as a DC with netlogon share, profile share, etc. Configure the &smb.conf; file +to fucntion as a BDC. ie: <parameter>domain master = No</parameter>. </para></listitem> </itemizedlist> @@ -240,23 +237,6 @@ Samba-3 set up as a DC with netlogon share, profile share, etc. <step><para>Create a BDC account for the samba server using NT Server Manager</para> <substeps><step><para>Samba must NOT be running</para></step></substeps></step> - <step> - <para><userinput>rpcclient <replaceable>NT4PDC</replaceable> -U Administrator%<replaceable>passwd</replaceable></userinput></para> - <substeps><step><para>lsaquery</para></step> - <step><para>Note the SID returned</para></step> - </substeps> - </step> - - <step><para><userinput>net getsid -S <replaceable>NT4PDC</replaceable> -w <replaceable>DOMNAME</replaceable> -U Administrator%<replaceable>passwd</replaceable></userinput></para> - <substeps><step><para>Note the SID</para></step></substeps> - </step> - - <step><para><userinput>net getlocalsid</userinput></para> - <substeps> - <step><para>Note the SID, now check that all three SIDS reported are the same!</para></step> - </substeps> - </step> - <step><para><userinput>net rpc join -S <replaceable>NT4PDC</replaceable> -w <replaceable>DOMNAME</replaceable> -U Administrator%<replaceable>passwd</replaceable></userinput></para></step> <step><para><userinput>net rpc vampire -S <replaceable>NT4PDC</replaceable> -U administrator%<replaceable>passwd</replaceable></userinput></para></step> @@ -265,24 +245,33 @@ Samba-3 set up as a DC with netlogon share, profile share, etc. <substeps><step><para>Note - did the users migrate?</para></step></substeps> </step> - <step><para><userinput>initGrps.sh <replaceable>DOMNAME</replaceable></userinput></para></step> + <step><para> + Now assign each of the UNIX groups to NT groups: + (Note: It may be useful to copy this text to a script called + <filename>initGroups.sh</filename>) + <programlisting> +#!/bin/bash +#### Keep this as a shell script for future re-use + +# First assign well known domain global groups +net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmins +net groupmap modify ntgroup="Domain Guests" unixgroup=nobody +net groupmap modify ntgroup="Domain Users" unixgroup=users + +# Now for our added domain global groups +net groupmap add ntgroup="Designers" unixgroup=designers type=d rid=3200 +net groupmap add ntgroup="Engineers" unixgroup=engineers type=d rid=3210 +net groupmap add ntgroup="QA Team" unixgroup=qateam type=d rid=3220 +</programlisting> + </para></step> <step><para><userinput>net groupmap list</userinput></para> <substeps><step><para>Now check that all groups are recognised</para></step></substeps> </step> - - <step><para><userinput>net rpc vampire -S <replaceable>NT4PDC</replaceable> -U administrator%<replaceable>passwd</replaceable></userinput></para></step> - - <step><para><userinput>pdbedit -Lv</userinput></para> - <substeps><step> - <para>Note - check that all group membership has been migrated</para> - </step></substeps> - </step> </procedure> <para> -Now it is time to migrate all the profiles, then migrate all policy files. -More later. +Now migrate all the profiles, then migrate all policy files. </para> </sect2> @@ -292,13 +281,14 @@ More later. <title>Migration Options</title> <para> -Based on feedback from many sites as well as from actual installation and maintenance -experience sites that wish to migrate from MS Windows NT4 Domain Control to a Samba -based solution fit into three basic categories. +Sites that wish to migrate from MS Windows NT4 Domain Control to a Samba based solution +generally fit into three basic categories. </para> <table frame="all"><title>The 3 Major Site Types</title> <tgroup cols="2"> + <colspec align="left"/> + <colspec align="justify"/> <thead> <row><entry>Number of Users</entry><entry>Description</entry></row> </thead> @@ -333,7 +323,7 @@ to Samba-3. </itemizedlist> <para> -No matter what choice you make, the following rules will minimise down-stream problems: +Minimise down-stream problems by: </para> <itemizedlist> @@ -354,8 +344,11 @@ No matter what choice you make, the following rules will minimise down-stream pr </para></listitem> </itemizedlist> -<table frame="top"><title>Nature of the Conversion Choices</title> +<table frame="all"><title>Nature of the Conversion Choices</title> <tgroup cols="3"> + <colspec align="justify"/> + <colspec align="justify"/> + <colspec align="justify"/> <thead> <row><entry>Simple</entry><entry>Upgraded</entry><entry>Redesign</entry></row> </thead> @@ -396,68 +389,103 @@ No matter what choice you make, the following rules will minimise down-stream pr </sect2> <sect2> -<title>Samba Implementation Choices</title> - -<!-- FIXME: Either a better layout or more written-out text--> -<para><programlisting> -Authentication database back end - Winbind (external Samba or NT4/200x server) - Can use pam_mkhomedir.so to auto-create home dirs - External server could use Active Directory or NT4 Domain - -Database type - smbpasswd, tdbsam, ldapsam, mysqlsam - -Access Control Points - On the Share itself (Use NT4 Server Manager) - On the file system - Unix permissions on files and directories - Enable Posix ACLs in file system? - Through Samba share parameters - Not recommended - except as only resort - -Policies (migrate or create new ones) - Group Policy Editor (NT4) - Watch out for Tattoo effect - -User and Group Profiles - Platform specific so use platform tool to change from a Local - to a Roaming profile Can use new profiles tool to change SIDs - (NTUser.DAT) - -Logon Scripts (Know how they work) - -User and Group mapping to Unix/Linux - username map facility may be needed - Use 'net groupmap' to connect NT4 groups to Unix groups - Use pdbedit to set/change user configuration -NOTE: -If migrating to LDAP back end it may be easier to dump initial LDAP database -to LDIF, then edit, then reload into LDAP - - OS specific scripts / programs may be needed - Add / delete Users - Note OS limits on size of name (Linux 8 chars) - NT4 up to 254 chars - Add / delete machines - Applied only to domain members (note up to 16 chars) - Add / delete Groups - Note OS limits on size and nature - Linux limit is 16 char, - no spaces and no upper case chars (groupadd) - -Migration Tools - Domain Control (NT4 Style) - Profiles, Policies, Access Controls, Security - -Migration Tools - Samba: net, rpcclient, smbpasswd, pdbedit, profiles - Windows: NT4 Domain User Manager, Server Manager (NEXUS) - -Authentication - New SAM back end (smbpasswd, tdbsam, ldapsam, mysqlsam) -</programlisting> -</para> +<title>Samba-3 Implementation Choices</title> + +<variablelist> + <varlistentry><term>Authentication database/back end:</term><listitem> + <para> + Samba-3 can use an external authentication backend: + </para> + + <para> + <itemizedlist> + <listitem><para>Winbind (external Samba or NT4/200x server)</para></listitem> + <listitem><para>External server could use Active Directory or NT4 Domain</para></listitem> + <listitem><para>Can use pam_mkhomedir.so to auto-create home dirs</para></listitem> + </itemizedlist> + </para> + + <para> + Samba-3 can use a local authentication backend: + <itemizedlist> + <listitem><para>smbpasswd, tdbsam, ldapsam, mysqlsam</para></listitem> + </itemizedlist> + </para> + </listitem> + </varlistentry> + + <varlistentry><term>Access Control Points:</term><listitem> + <itemizedlist> + <listitem><para>On the Share itself - using Share ACLs</para></listitem> + <listitem><para>On the file system - using UNIX permissions on files and directories</para> + <para>Note: Can Enable Posix ACLs in file system also</para></listitem> + <listitem><para>Through Samba share parameters - Not recommended - except as last resort</para></listitem> + </itemizedlist> + </listitem> + </varlistentry> + + <varlistentry><term>Policies (migrate or create new ones):</term><listitem> + <itemizedlist> + <listitem><para>Using Group Policy Editor (NT4)</para></listitem> + <listitem><para>- Watch out for Tattoo effect</para></listitem> + </itemizedlist> + </listitem> + </varlistentry> + + <varlistentry><term>User and Group Profiles:</term><listitem> + <para> + Platform specific so use platform tool to change from a Local to a Roaming profile + Can use new profiles tool to change SIDs (NTUser.DAT) + </para> + </listitem> + </varlistentry> + + <varlistentry><term>Logon Scripts:</term><listitem> + <para> + Know how they work + </para> + </listitem> + </varlistentry> + + <varlistentry><term>User and Group mapping to Unix/Linux:</term><listitem> + <itemizedlist> + <listitem><para>username map facility may be needed</para></listitem> + <listitem><para>Use 'net groupmap' to connect NT4 groups to Unix groups</para></listitem> + <listitem><para>Use pdbedit to set/change user configuration</para> + + <para> + NOTE: When migrating to LDAP back, end it may be easier to dump initial + LDAP database to LDIF, then edit, then reload into LDAP + </para> + </listitem> + </itemizedlist> + </listitem> + </varlistentry> + + <varlistentry><term>OS specific scripts/programs may be needed:</term><listitem> + <itemizedlist> + <listitem><para>Add/Delete Users: Note OS limits on size of name + (Linux 8 chars) NT4 up to 254 chars</para></listitem> + <listitem><para>Add/Delete Machines: Applied only to domain members + (Note: Machine names may be limited to 16 characters)</para></listitem> + <listitem><para>Use 'net groupmap' to connect NT4 groups to Unix groups</para></listitem> + <listitem><para>Add/Delete Groups: Note OS limits on size and nature. + Linux limit is 16 char, no spaces and no upper case chars (groupadd)</para></listitem> + </itemizedlist> + </listitem> + </varlistentry> + + <varlistentry><term>Migration Tools:</term><listitem> + <para> + Domain Control (NT4 Style) Profiles, Policies, Access Controls, Security + <itemizedlist> + <listitem><para>Samba: net, rpcclient, smbpasswd, pdbedit, profiles</para></listitem> + <listitem><para>Windows: NT4 Domain User Manager, Server Manager (NEXUS)</para></listitem> + </itemizedlist> + </para> + </listitem> + </varlistentry> +</variablelist> </sect2> |