diff options
Diffstat (limited to 'docs/docbook/projdoc/upgrading-to-3.0.xml')
| -rw-r--r-- | docs/docbook/projdoc/upgrading-to-3.0.xml | 300 |
1 files changed, 170 insertions, 130 deletions
diff --git a/docs/docbook/projdoc/upgrading-to-3.0.xml b/docs/docbook/projdoc/upgrading-to-3.0.xml index 74af0cbb9e..4461f0fdcb 100644 --- a/docs/docbook/projdoc/upgrading-to-3.0.xml +++ b/docs/docbook/projdoc/upgrading-to-3.0.xml @@ -8,83 +8,123 @@ <title>Upgrading from Samba-2.x to Samba-3.0.0</title> +<para> +This chapter deals exclusively with the differences between Samba-3.0.0 and Samba-2.2.8a. +It points out where configuration parameters have changed, and provides a simple guide for +the move from 2.2.x to 3.0.0. +</para> + +<sect1> +<title>Quick Migration Guide</title> + +<para> +Samba-3.0.0 default behavior should be approximately the same as Samba-2.2.x. +The default behavior when the new parameter <smbconfoption><name>passdb backend</name></smbconfoption> +is not defined in the &smb.conf; file provides the same default behviour as Samba-2.2.x +with <smbconfoption><name>encrypt passwords</name><value>Yes</value></smbconfoption>, and +will use the <filename>smbpasswd</filename> database. +</para> + +<para> +So why say that <emphasis>behavior should be approximately the same as Samba-2.2.x?</emphasis> Because +Samba-3.0.0 can negotiate new protocols, such as support for native Unicode, that may result in +differing protocol code paths being taken. The new behavior under such circumstances is not +exactly the same as the old one. The good news is that the domain and machine SIDs will be +preserved across the upgrade. +</para> + +<para> +If the Samba-2.2.x system was using an LDAP backend, and there is no time to update the LDAP +database, then make sure that <smbconfoption><name>passdb backend</name><value>ldapsam_compat</value></smbconfoption> +is specified in the &smb.conf; file. For the rest, behavior should remain more or less the same. +At a later date, when there is time to implement a new Samba-3 compatible LDAP backend, it is possible +to migrate the old LDAP database to the new one through use of the <command>pdbedit</command>. +See <link linkend="pdbeditthing"/>. +</para> + +</sect1> <sect1> <title>New Features in Samba-3</title> <para> -Major new features: +The major new features are: </para> -<orderedlist> +<orderedlist numberation="arabic"> <listitem><para> - Active Directory support. This release is able to join a ADS realm + Active Directory support. This release is able to join an ADS realm as a member server and authenticate users using LDAP/kerberos. </para></listitem> <listitem><para> - Unicode support. Samba will now negotiate UNICODE on the wire and - internally there is now a much better infrastructure for multi-byte - and UNICODE character sets. + Unicode support. Samba will now negotiate unicode on the wire and + internally there is a much better infrastructure for multi-byte + and unicode character sets. </para></listitem> <listitem><para> New authentication system. The internal authentication system has been almost completely rewritten. Most of the changes are internal, - but the new auth system is also very configurable. + but the new authoring system is also very configurable. </para></listitem> <listitem><para> New filename mangling system. The filename mangling system has been completely rewritten. An internal database now stores mangling maps - persistently. This needs lots of testing. + persistently. </para></listitem> <listitem><para> - New "net" command. A new "net" command has been added. It is - somewhat similar to the "net" command in windows. Eventually we + New <quote>net</quote> command. A new <quote>net</quote> command has been added. It is + somewhat similar to the <quote>net</quote> command in Windows. Eventually, we plan to replace a bunch of other utilities (such as smbpasswd) - with subcommands in "net", at the moment only a few things are - implemented. + with subcommands in <quote>net</quote>. </para></listitem> <listitem><para> Samba now negotiates NT-style status32 codes on the wire. This - improves error handling a lot. + considerably improves error handling. </para></listitem> <listitem><para> - Better Windows 2000/XP/2003 printing support including publishing - printer attributes in active directory + Better Windows 200x/XP printing support including publishing + printer attributes in Active Directory. </para></listitem> <listitem><para> - New loadable RPC modules + New loadable RPC modules for passdb backends and character sets. </para></listitem> <listitem><para> - New dual-daemon winbindd support (-B) for better performance + New default dual-daemon winbindd support for better performance. </para></listitem> <listitem><para> Support for migrating from a Windows NT 4.0 domain to a Samba - domain and maintaining user, group and domain SIDs + domain and maintaining user, group and domain SIDs. </para></listitem> <listitem><para> Support for establishing trust relationships with Windows NT 4.0 - domain controllers + Domain Controllers. </para></listitem> <listitem><para> Initial support for a distributed Winbind architecture using - an LDAP directory for storing SID to uid/gid mappings + an LDAP directory for storing SID to UID/GID mappings. </para></listitem> <listitem><para> Major updates to the Samba documentation tree. </para></listitem> + + <listitem><para> + Full support for client and server SMB signing to ensure + compatibility with default Windows 2003 security settings. + </para></listitem> </orderedlist> + <para> Plus lots of other improvements! </para> @@ -95,15 +135,15 @@ Plus lots of other improvements! <title>Configuration Parameter Changes</title> <para> -This section contains a brief listing of changes to smb.conf options -in the 3.0.0 release. Please refer to the smb.conf(5) man page for +This section contains a brief listing of changes to &smb.conf; options +in the 3.0.0 release. Please refer to the smb.conf(5) man page for complete descriptions of new or modified parameters. </para> <sect2> <title>Removed Parameters</title> -<para>(order alphabetically):</para> +<para>(Ordered Alphabetically):</para> <itemizedlist> <listitem><para>admin log </para></listitem> @@ -121,6 +161,7 @@ complete descriptions of new or modified parameters. <listitem><para>printer driver file </para></listitem> <listitem><para>printer driver location </para></listitem> <listitem><para>status </para></listitem> + <listitem><para>stip dot </para></listitem> <listitem><para>total print jobs </para></listitem> <listitem><para>use rhosts </para></listitem> <listitem><para>valid chars </para></listitem> @@ -132,16 +173,16 @@ complete descriptions of new or modified parameters. <sect2> <title>New Parameters</title> -<para>(new parameters have been grouped by function):</para> +<para>(New parameters have been grouped by function):</para> -<para>Remote management</para> +<para>Remote Management</para> <itemizedlist> <listitem><para>abort shutdown script </para></listitem> <listitem><para>shutdown script </para></listitem> </itemizedlist> -<para>User and Group Account Management</para> +<para>User and Group Account Management:</para> <itemizedlist> <listitem><para>add group script </para></listitem> @@ -154,15 +195,14 @@ complete descriptions of new or modified parameters. <listitem><para>set primary group script </para></listitem> </itemizedlist> -<para>Authentication</para> +<para>Authentication:</para> <itemizedlist> <listitem><para>auth methods </para></listitem> - <listitem><para>ads server </para></listitem> <listitem><para>realm </para></listitem> </itemizedlist> -<para>Protocol Options</para> +<para>Protocol Options:</para> <itemizedlist> <listitem><para>client lanman auth </para></listitem> @@ -174,11 +214,12 @@ complete descriptions of new or modified parameters. <listitem><para>ntlm auth </para></listitem> <listitem><para>paranoid server security </para></listitem> <listitem><para>server schannel </para></listitem> + <listitem><para>server signing </para></listitem> <listitem><para>smb ports </para></listitem> <listitem><para>use spnego </para></listitem> </itemizedlist> -<para>File Service</para> +<para>File Service:</para> <itemizedlist> <listitem><para>get quota command </para></listitem> @@ -187,38 +228,42 @@ complete descriptions of new or modified parameters. <listitem><para>hostname lookups </para></listitem> <listitem><para>kernel change notify </para></listitem> <listitem><para>mangle prefix </para></listitem> + <listitem><para>map acl inherit </para></listitem> <listitem><para>msdfs proxy </para></listitem> <listitem><para>set quota command </para></listitem> <listitem><para>use sendfile </para></listitem> <listitem><para>vfs objects </para></listitem> </itemizedlist> -<para>Printing</para> +<para>Printing:</para> <itemizedlist> <listitem><para>max reported print jobs </para></listitem> </itemizedlist> -<para>UNICODE and Character Sets</para> +<para>Unicode and Character Sets:</para> <itemizedlist> <listitem><para>display charset </para></listitem> <listitem><para>dos charset </para></listitem> <listitem><para>unicode </para></listitem> - <listitem><para>unix charset </para></listitem> + <listitem><para>UNIX charset </para></listitem> </itemizedlist> -<para>SID to uid/gid Mappings</para> +<para>SID to UID/GID Mappings:</para> <itemizedlist> <listitem><para>idmap backend </para></listitem> <listitem><para>idmap gid </para></listitem> - <listitem><para>idmap only </para></listitem> <listitem><para>idmap uid </para></listitem> + <listitem><para>winbind enable local accounts </para></listitem> + <listitem><para>winbind trusted domains only </para></listitem> + <listitem><para>template primary group </para></listitem> + <listitem><para>enable rid algorithm </para></listitem> </itemizedlist> -<para>LDAP</para> +<para>LDAP:</para> <itemizedlist> <listitem><para>ldap delete dn </para></listitem> @@ -230,7 +275,7 @@ complete descriptions of new or modified parameters. <listitem><para>ldap user suffix </para></listitem> </itemizedlist> -<para>General Configuration</para> +<para>General Configuration:</para> <itemizedlist> <listitem><para>preload modules </para></listitem> @@ -240,19 +285,20 @@ complete descriptions of new or modified parameters. </sect2> <sect2> -<title>Modified Parameters (changes in behavior):</title> +<title>Modified Parameters (Changes in Behavior):</title> <itemizedlist> <listitem><para>encrypt passwords (enabled by default) </para></listitem> - <listitem><para>mangling method (set to 'hash2' by default) </para></listitem> + <listitem><para>mangling method (set to hash2 by default) </para></listitem> <listitem><para>passwd chat </para></listitem> <listitem><para>passwd program </para></listitem> + <listitem><para>password server </para></listitem> <listitem><para>restrict anonymous (integer value) </para></listitem> - <listitem><para>security (new 'ads' value) </para></listitem> + <listitem><para>security (new ads value) </para></listitem> <listitem><para>strict locking (enabled by default) </para></listitem> <listitem><para>winbind cache time (increased to 5 minutes) </para></listitem> - <listitem><para>winbind uid (deprecated in favor of 'idmap uid') </para></listitem> - <listitem><para>winbind gid (deprecated in favor of 'idmap gid') </para></listitem> + <listitem><para>winbind uid (deprecated in favor of idmap uid) </para></listitem> + <listitem><para>winbind gid (deprecated in favor of idmap gid) </para></listitem> </itemizedlist> </sect2> @@ -267,17 +313,21 @@ complete descriptions of new or modified parameters. <para> This section contains brief descriptions of any new databases - introduced in Samba 3.0. Please remember to backup your existing - ${lock directory}/*tdb before upgrading to Samba 3.0. Samba will + introduced in Samba-3. Please remember to backup your existing + ${lock directory}/*tdb before upgrading to Samba-3. Samba will upgrade databases as they are opened (if necessary), but downgrading from 3.0 to 2.2 is an unsupported path. </para> + <para> + The new tdb files are described in <link linkend="tdbfiledesc"/>. + </para> + - <table frame='all'><title>TDB File Descriptions</title> + <table frame='all' id="tdbfiledesc"><title>TDB File Descriptions</title> <tgroup cols='3'> <colspec align="left"/> - <colspec align="justify"/> + <colspec align="justify" width="1*"/> <colspec align="left"/> <thead> <row> @@ -299,12 +349,12 @@ complete descriptions of new or modified parameters. </row> <row> <entry>group_mapping</entry> - <entry><para>Mapping table from Windows groups/SID to unix groups</para></entry> + <entry><para>Mapping table from Windows groups/SID to UNIX groups</para></entry> <entry>yes</entry> </row> <row> <entry>idmap</entry> - <entry><para>new ID map table from SIDS to UNIX uids/gids</para></entry> + <entry><para>new ID map table from SIDS to UNIX UIDs/GIDs</para></entry> <entry>yes</entry> </row> <row> @@ -320,14 +370,14 @@ complete descriptions of new or modified parameters. </row> <row> <entry>printing/*.tdb</entry> - <entry><para>Cached output from 'lpq command' created on a per print + <entry><para>Cached output from `lpq command' created on a per print service basis</para></entry> <entry>no</entry> </row> <row> <entry>registry</entry> - <entry><para>Read-only samba registry skeleton that provides support for + <entry><para>Read-only Samba registry skeleton that provides support for exporting various db tables via the winreg RPCs</para></entry> <entry>no</entry> </row> @@ -341,26 +391,26 @@ complete descriptions of new or modified parameters. <title>Changes in Behavior</title> <para> - The following issues are known changes in behavior between Samba 2.2 and - Samba 3.0 that may affect certain installations of Samba. + The following issues are known changes in behavior between Samba-2.2 and + Samba-3 that may affect certain installations of Samba. </para> <orderedlist> <listitem><para> - When operating as a member of a Windows domain, Samba 2.2 would - map any users authenticated by the remote DC to the 'guest account' - if a uid could not be obtained via the getpwnam() call. Samba 3.0 - rejects the connection as NT_STATUS_LOGON_FAILURE. There is no - current work around to re-establish the 2.2 behavior. + When operating as a member of a Windows domain, Samba-2.2 would + map any users authenticated by the remote DC to the <quote>guest account</quote> + if a uid could not be obtained via the getpwnam() call. Samba-3 + rejects the connection as <?latex \linebreak ?>NT_STATUS_LOGON_FAILURE. There is no + current work around to re-establish the Samba-2.2 behavior. </para></listitem> <listitem><para> - When adding machines to a Samba 2.2 controlled domain, the - 'add user script' was used to create the UNIX identity of the - machine trust account. Samba 3.0 introduces a new 'add machine - script' that must be specified for this purpose. Samba 3.0 will - not fall back to using the 'add user script' in the absence of - an 'add machine script' + When adding machines to a Samba-2.2 controlled domain, the + <quote>add user script</quote> was used to create the UNIX identity of the + Machine Trust Account. Samba-3 introduces a new <quote>add machine + script</quote> that must be specified for this purpose. Samba-3 will + not fall back to using the <quote>add user script</quote> in the absence of + an <quote>add machine script</quote>. </para></listitem> </orderedlist> @@ -371,8 +421,7 @@ complete descriptions of new or modified parameters. <para> You might experience problems with special characters when communicating with old DOS - clients. Codepage support has changed in samba 3.0. Read the chapter - <link linkend="unicode">Unicode support</link> for details. + clients. Codepage support has changed in Samba-3. Read <link linkend="unicode"/>, for details. </para> </sect2> @@ -382,52 +431,41 @@ complete descriptions of new or modified parameters. <para> There have been a few new changes that Samba administrators should be - aware of when moving to Samba 3.0. + aware of when moving to Samba-3. </para> <orderedlist> <listitem><para> Encrypted passwords have been enabled by default in order to - inter-operate better with out-of-the-box Windows client - installations. This does mean that either (a) a samba account - must be created for each user, or (b) 'encrypt passwords = no' - must be explicitly defined in smb.conf. + interoperate better with out-of-the-box Windows client + installations. This does mean that either (a) a Samba account + must be created for each user, or (b) <quote>encrypt passwords = no</quote> + must be explicitly defined in &smb.conf;. </para></listitem> <listitem><para> - Inclusion of new <smbconfoption><name>security</name><value>ads</value></smbconfoption> option for integration - with an Active Directory domain using the native Windows - Kerberos 5 and LDAP protocols. + Inclusion of new <smbconfoption><name>security</name><value>ads</value></smbconfoption> option for integration + with an Active Directory domain using the native Windows Kerberos 5 and LDAP protocols. </para></listitem> </orderedlist> <para> - Samba 3.0 also includes the possibility of setting up chains + Samba-3 also includes the possibility of setting up chains of authentication methods (<smbconfoption><name>auth methods</name></smbconfoption>) and account storage backends (<smbconfoption><name>passdb backend</name></smbconfoption>). Please refer to the &smb.conf; - man page and <link linkend="passdb">the chapter about account information databases</link> for details. While both parameters assume sane default + man page and <link linkend="passdb"/>, for details. While both parameters assume sane default values, it is likely that you will need to understand what the values actually mean in order to ensure Samba operates correctly. </para> <para> - Certain functions of the smbpasswd(8) tool have been split between the - new smbpasswd(8) utility, the net(8) tool, and the new pdbedit(8) - utility. See the respective man pages for details. - </para> - - </sect2> - - <sect2> - <title>Charsets</title> - - <para> - You might experience problems with special characters when communicating with old DOS - clients. Codepage support has changed in samba 3.0. Read the chapter - <link linkend="unicode">Unicode support</link> for details. +<indexterm><primary>pdbedit</primary></indexterm> + Certain functions of the <command>smbpasswd</command> tool have been split between the + new <command>smbpasswd</command> utility, the <command>net</command> tool and the new <command>pdbedit</command> + utility. See the respective man pages for details. </para> </sect2> @@ -436,7 +474,7 @@ complete descriptions of new or modified parameters. <title>LDAP</title> <para> - This section outlines the new features affecting Samba / LDAP integration. + This section outlines the new features effecting Samba/LDAP integration. </para> <sect3> @@ -444,14 +482,14 @@ complete descriptions of new or modified parameters. <para> A new object class (sambaSamAccount) has been introduced to replace - the old sambaAccount. This change aids us in the renaming of attributes - to prevent clashes with attributes from other vendors. There is a - conversion script (examples/LDAP/convertSambaAccount) to modify and LDIF + the old sambaAccount. This change aids us in the renaming of attributes + to prevent clashes with attributes from other vendors. There is a + conversion script (examples/LDAP/convertSambaAccount) to modify an LDIF file to the new schema. </para> <para> - Example: + Example: </para> <para><screen> &prompt;ldapsearch .... -b "ou=people,dc=..." > old.ldif @@ -459,17 +497,20 @@ complete descriptions of new or modified parameters. </screen></para> <para> - The <DOM SID> can be obtained by running 'net getlocalsid <DOMAINNAME> + The <DOM SID> can be obtained by running +<screen> +&prompt;<userinput>net getlocalsid <DOMAINNAME></userinput> +</screen> on the Samba PDC as root. </para> <para> The old sambaAccount schema may still be used by specifying the - "ldapsam_compat" passdb backend. However, the sambaAccount and + <parameter>ldapsam_compat</parameter> passdb backend. However, the sambaAccount and associated attributes have been moved to the historical section of the schema file and must be uncommented before use if needed. - The 2.2 object class declaration for a sambaAccount has not changed - in the 3.0 samba.schema file. + The Samba-2.2 object class declaration for a sambaAccount has not changed + in the Samba-3 samba.schema file. </para> <para> @@ -478,29 +519,29 @@ complete descriptions of new or modified parameters. <itemizedlist> <listitem><para> - sambaDomain - domain information used to allocate rids - for users and groups as necessary. The attributes are added - in 'ldap suffix' directory entry automatically if - an idmap uid/gid range has been set and the 'ldapsam' + sambaDomain &smbmdash; domain information used to allocate RIDs + for users and groups as necessary. The attributes are added + in <quote>ldap suffix</quote> directory entry automatically if + an idmap UID/GID range has been set and the <quote>ldapsam</quote> passdb backend has been selected. </para></listitem> <listitem><para> - sambaGroupMapping - an object representing the + sambaGroupMapping &smbmdash; an object representing the relationship between a posixGroup and a Windows - group/SID. These entries are stored in the 'ldap - group suffix' and managed by the 'net groupmap' command. + group/SID. These entries are stored in the <quote>ldap + group suffix</quote> and managed by the <quote>net groupmap</quote> command. </para></listitem> <listitem><para> - sambaUnixIdPool - created in the 'ldap idmap suffix' entry - automatically and contains the next available 'idmap uid' and - 'idmap gid' + sambaUNIXIdPool &smbmdash; created in the <quote>ldap idmap suffix</quote> entry + automatically and contains the next available <quote>idmap UID</quote> and + <quote>idmap GID</quote>. </para></listitem> <listitem><para> - sambaIdmapEntry - object storing a mapping between a - SID and a UNIX uid/gid. These objects are created by the + sambaIdmapEntry &smbmdash; object storing a mapping between a + SID and a UNIX UID/GID. These objects are created by the idmap_ldap module as needed. </para></listitem> </itemizedlist> @@ -512,55 +553,54 @@ complete descriptions of new or modified parameters. <para> The following new smb.conf parameters have been added to aid in directing - certain LDAP queries when 'passdb backend = ldapsam://...' has been + certain LDAP queries when <parameter>passdb backend = ldapsam://...</parameter> has been specified. </para> <itemizedlist> - <listitem><para>ldap suffix - used to search for user and computer accounts</para></listitem> - <listitem><para>ldap user suffix - used to store user accounts</para></listitem> - <listitem><para>ldap machine suffix - used to store machine trust accounts</para></listitem> - <listitem><para>ldap group suffix - location of posixGroup/sambaGroupMapping entries</para></listitem> - <listitem><para>ldap idmap suffix - location of sambaIdmapEntry objects</para></listitem> + <listitem><para>ldap suffix &smbmdash; used to search for user and computer accounts.</para></listitem> + <listitem><para>ldap user suffix &smbmdash; used to store user accounts.</para></listitem> + <listitem><para>ldap machine suffix &smbmdash; used to store Machine Trust Accounts.</para></listitem> + <listitem><para>ldap group suffix &smbmdash; location of posixGroup/sambaGroupMapping entries.</para></listitem> + <listitem><para>ldap idmap suffix &smbmdash; location of sambaIdmapEntry objects.</para></listitem> </itemizedlist> <para> - If an 'ldap suffix' is defined, it will be appended to all of the - remaining sub-suffix parameters. In this case, the order of the suffix - listings in smb.conf is important. Always place the 'ldap suffix' first + If an <parameter>ldap suffix</parameter> is defined, it will be appended to all of the + remaining sub-suffix parameters. In this case, the order of the suffix + listings in smb.conf is important. Always place the <parameter>ldap suffix</parameter> first in the list. </para> <para> - Due to a limitation in Samba's smb.conf parsing, you should not surround - the DN's with quotation marks. + Due to a limitation in Samba's &smb.conf; parsing, you should not surround + the DNs with quotation marks. </para> </sect3> <sect3> - <title>IdMap LDAP support</title> + <title>IdMap LDAP Support</title> <para> - Samba 3.0 supports an ldap backend for the idmap subsystem. The - following options would inform Samba that the idmap table should be - stored on the directory server onterose in the "ou=idmap,dc=plainjoe, - dc=org" partition. + Samba-3 supports an ldap backend for the idmap subsystem. The + following options inform Samba that the idmap table should be + stored on the directory server onterose in the "ou=idmap,dc=quenya,dc=org" partition. </para> <smbconfblock> <smbconfsection>[global]</smbconfsection> <member>...</member> <smbconfoption><name>idmap backend</name><value>ldap:ldap://onterose/</value></smbconfoption> - <smbconfoption><name>ldap idmap suffix</name><value>ou=idmap,dc=plainjoe,dc=org</value></smbconfoption> + <smbconfoption><name>ldap idmap suffix</name><value>ou=idmap,dc=quenya,dc=org</value></smbconfoption> <smbconfoption><name>idmap uid</name><value>40000-50000</value></smbconfoption> <smbconfoption><name>idmap gid</name><value>40000-50000</value></smbconfoption> </smbconfblock> <para> - This configuration allows winbind installations on multiple servers to - share a uid/gid number space, thus avoiding the interoperability problems - with NFS that were present in Samba 2.2. + This configuration allows Winbind installations on multiple servers to + share a UID/GID number space, thus avoiding the interoperability problems + with NFS that were present in Samba-2.2. </para> </sect3> |