From 571a4b6cd29a38d90d269871d7c4698a2a0b1d38 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 22 Jun 2012 16:32:59 +0200 Subject: doc: Remove documentation for obsolete ldapsam_compat. --- docs-xml/Samba3-ByExample/SBE-UpgradingSamba.xml | 62 -- docs-xml/Samba3-HOWTO/TOSHARG-Passdb.xml | 23 - docs-xml/Samba3-HOWTO/TOSHARG-upgrading-to-3.0.xml | 966 --------------------- docs-xml/Samba3-HOWTO/index.xml | 2 - 4 files changed, 1053 deletions(-) delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-upgrading-to-3.0.xml diff --git a/docs-xml/Samba3-ByExample/SBE-UpgradingSamba.xml b/docs-xml/Samba3-ByExample/SBE-UpgradingSamba.xml index b41cea9cc1..239ad3e7c3 100644 --- a/docs-xml/Samba3-ByExample/SBE-UpgradingSamba.xml +++ b/docs-xml/Samba3-ByExample/SBE-UpgradingSamba.xml @@ -827,73 +827,11 @@ The recommended passdb backends at this time are replacement for stand alone servers * ldapsam - attribute rich account storage and retrieval backend utilizing an LDAP directory. - * ldapsam_compat - a 2.2 backward compatible LDAP account - backend Certain functions of the smbpasswd(8) tool have been split between the new smbpasswd(8) utility, the net(8) tool, and the new pdbedit(8) utility. See the respective man pages for details. -###################################################################### -LDAP -#### - -This section outlines the new features affecting Samba / LDAP -integration. - -New Schema ----------- - -A new object class (sambaSamAccount) has been introduced to replace -the old sambaAccount. This change aids us in the renaming of -attributes to prevent clashes with attributes from other vendors. -There is a conversion script (examples/LDAP/convertSambaAccount) to -modify and LDIF file to the new schema. - -Example: - - $ ldapsearch .... -b "ou=people,dc=..." > sambaAcct.ldif - $ convertSambaAccount --sid=<Domain SID> \ - --input=sambaAcct.ldif --output=sambaSamAcct.ldif \ - --changetype=[modify|add] - -The <DOM SID> can be obtained by running 'net getlocalsid -<DOMAINNAME>' on the Samba PDC as root. The changetype determines -the format of the generated LDIF output--either create new entries -or modify existing entries. - -The old sambaAccount schema may still be used by specifying the -"ldapsam_compat" passdb backend. However, the sambaAccount and -associated attributes have been moved to the historical section of -the schema file and must be uncommented before use if needed. -The 2.2 object class declaration for a sambaAccount has not changed -in the 3.0 samba.schema file. - -Other new object classes and their uses include: - - * sambaDomain - domain information used to allocate rids - for users and groups as necessary. The attributes are added - in 'ldap suffix' directory entry automatically if - an idmap uid/gid range has been set and the 'ldapsam' - passdb backend has been selected. - - * sambaGroupMapping - an object representing the - relationship between a posixGroup and a Windows - group/SID. These entries are stored in the 'ldap - group suffix' and managed by the 'net groupmap' command. - - * sambaUnixIdPool - created in the 'ldap idmap suffix' entry - automatically and contains the next available 'idmap uid' and - 'idmap gid' - - * sambaIdmapEntry - object storing a mapping between a - SID and a UNIX uid/gid. These objects are created by the - idmap_ldap module as needed. - - * sambaSidEntry - object representing a SID alone, as a Structural - class on which to build the sambaIdmapEntry. - - New Suffix for Searching ------------------------ diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-Passdb.xml b/docs-xml/Samba3-HOWTO/TOSHARG-Passdb.xml index b3879c4282..c1738e397d 100644 --- a/docs-xml/Samba3-HOWTO/TOSHARG-Passdb.xml +++ b/docs-xml/Samba3-HOWTO/TOSHARG-Passdb.xml @@ -67,14 +67,6 @@ entities. Features and Benefits - -Samba-3 provides for complete backward compatibility with Samba-2.2.x functionality -as follows: -SAM backendsmbpasswd -SAM backendldapsam_compat -encrypted passwords - - Backward Compatibility Account Storage Systems @@ -120,21 +112,6 @@ as follows: - - ldapsam_compat (Samba-2.2 LDAP Compatibility) - - -ldapsam_compat -Samba-2.2.x LDAP schema -OpenLDAP backend - There is a password backend option that allows continued operation with - an existing OpenLDAP backend that uses the Samba-2.2.x LDAP schema extension. - This option is provided primarily as a migration tool, although there is - no reason to force migration at this time. This tool will eventually - be deprecated. - - - diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-upgrading-to-3.0.xml b/docs-xml/Samba3-HOWTO/TOSHARG-upgrading-to-3.0.xml deleted file mode 100644 index 8ef0c705b3..0000000000 --- a/docs-xml/Samba3-HOWTO/TOSHARG-upgrading-to-3.0.xml +++ /dev/null @@ -1,966 +0,0 @@ - - - - - &author.jelmer; - &author.jht; - &author.jerry; - August 16, 2007 - - -Updating and Upgrading Samba - -This chapter provides a detailed record of changes made during the 3.x series releases. At this time this -series consists of the 3.0.x series that is under the GNU GPL version 2 license, and the Samba 3.2.x series -that is being released under the terms of the GNU GPL version 3 license. - - - -Key Update Requirements - -Samba is a fluid product in which there may be significant changes between releases. Some of these changes are -brought about as a result of changes in the protocols that are used by Microsoft Windows network clients as a -result of security or functionality updates through official Microsoft patches and updates. Samba must track -such changes, particularly where they affect the internal operation of Samba itself. - - - -Please refer to any notes below that make explicit mention of the version of Samba you are using. In general, -all changes that apply to a new release will apply to follow-on releases also. For example, changes to Samba -3.0.23 affect all releases up to an including 3.0.25 and later. Samba 3.2.x was originaly cut from Samba -3.0.25 before 3.2.0-specific changes were applied. Unless a 3.0.x series feature is specifically revoked, the -behavior of the 3.2.x series can be expected to follow the earlier pattern. - - - -Upgrading from Samba-3.0.x to Samba-3.2.0 - - - - - -Upgrading from Samba-2.x to Samba-3.0.25 - -Samba differences -changed parameters -simple guide -This chapter deals exclusively with the differences between Samba-3.0.25 and Samba-2.2.8a. -It points out where configuration parameters have changed, and provides a simple guide for -the move from 2.2.x to 3.0.25. - - - - -Quick Migration Guide - - -Samba-3.0.25 default behavior should be approximately the same as Samba-2.2.x. -The default behavior when the new parameter -is not defined in the &smb.conf; file provides the same default behavior as Samba-2.2.x -with Yes and -will use the smbpasswd database. - - - -behavior approximately same -differing protocol -So why say that behavior should be approximately the same as Samba-2.2.x? Because -Samba-3.0.25 can negotiate new protocols, such as support for native Unicode, that may result in -differing protocol code paths being taken. The new behavior under such circumstances is not -exactly the same as the old one. The good news is that the domain and machine SIDs will be -preserved across the upgrade. - - - -LDAP backend -database -pdbedit -Samba-3-compatible LDAP backend -If the Samba-2.2.x system is using an LDAP backend, and there is no time to update the LDAP -database, then make sure that ldapsam_compat -is specified in the &smb.conf; file. For the rest, behavior should remain more or less the same. -At a later date, when there is time to implement a new Samba-3-compatible LDAP backend, it is possible -to migrate the old LDAP database to the new one through use of the pdbedit. -See The pdbedit Command. - - - - - - -New Features in Samba-3.x Series - - - - -New Features in Samba-3.2.x Series - -Samba is now distributed under the version 3 -of the new GNU General Public License. - - - -The major new features are: - - - - - -File Service -limit - Removal of the 1024 byte limit on pathnames and 256 byte limit on - filename components to honor the MAX_PATH setting from the host OS. - - - -Registory -Configuration - Introduction of a registry based configuration system. - - - -cluster - Experimental support for file serving clusters. - - - -IPv6 - Support for IPv6 in the server, and client tools and libraries. - - - -alternate data streams - Support for storing alternate data streams in xattrs. - - - -Encrypted SMB transport - Encrypted SMB transport in client tools and libraries, and server. - - - -Windows Vista - Support for Vista clients authenticating via Kerberos. - - - -Winbind -forest - Full support for Windows 2003 cross-forest, transitive trusts - and one-way domain trusts. - - - -pam_winbind - Support for userPrincipalName logons via pam_winbind and NSS lookups. - - - -LDAP -Active Directory -Signing - Support for Active Directory LDAP Signing policy. - - - -Licence -GPL - New LGPL Winbind client library (libwbclient.so). - - - -domain -domain trust - Support for establishing interdomain trust relationships with Windows 2008. - - - -joining - New client and server support for remotely joining and unjoining Domains. - - - - -joining - Support for joining into Windows 2008 domains. - - - - - -Plus lots of other improvements! - - - - - - -New Features in Samba-3.0.x - - -The major new features are: - - - - -ADS -LDAP/Kerberos - Active Directory support. This release is able to join an ADS realm - as a member server and authenticate users using LDAP/Kerberos. - - - -Unicode -multibyte character sets - Unicode support. Samba will now negotiate Unicode on the wire, and - internally there is a much better infrastructure for multibyte - and Unicode character sets. - - - -authentication system - New authentication system. The internal authentication system has - been almost completely rewritten. Most of the changes are internal, - but the new authoring system is also very configurable. - - - -filename mangling - New filename mangling system. The filename mangling system has been - completely rewritten. An internal database now stores mangling maps - persistently. - - - -net command - New net command. A new net command has been added. It is - somewhat similar to the net command in Windows. Eventually, we - plan to replace a bunch of other utilities (such as smbpasswd) - with subcommands in net. - - - -status32 codes - Samba now negotiates NT-style status32 codes on the wire. This - considerably improves error handling. - - - -printer attributes publishing - Better Windows 200x/XP printing support, including publishing - printer attributes in Active Directory. - - - -RPC modules -passdb backends -character sets - New loadable RPC modules for passdb backends and character sets. - - - -dual-daemon winbindd - New default dual-daemon winbindd support for better performance. - - - -migrating -maintaining ids -SID - Support for migrating from a Windows NT 4.0 domain to a Samba - domain and maintaining user, group, and domain SIDs. - - - -trust relationships -domain controllers - Support for establishing trust relationships with Windows NT 4.0 - domain controllers. - - - -Winbind architecture -LDAP directory -ID mapping - Initial support for a distributed Winbind architecture using - an LDAP directory for storing SID to UID/GID mappings. - - - - Major updates to the Samba documentation tree. - - - -SMB signing -security settings - Full support for client and server SMB signing to ensure - compatibility with default Windows 2003 security settings. - - - - -Plus lots of other improvements! - - - - -Configuration Parameter Changes - - -This section contains a brief listing of changes to &smb.conf; options since the Samba-2.2.x series up to and -including Samba-3.0.25. - - - -Please refer to the smb.conf(5) man page for complete descriptions of new or modified -parameters. - - - -Whenever a Samba update or upgrade is performed it is highly recommended to read the file called -WHATSNEW.txt that is part of the Samba distribution tarball. This file may also -be obtain on-line from the Samba web site, in -the right column, under Current Stable Release, by clicking on Release Notes. - - - - - -Removed Parameters - -deleted parameters - -In alphabetical order, these are the parameters eliminated from Samba-2.2.x through 3.0.25. - - - - admin log - alternate permissions - character set - client codepage - code page directory - coding system - domain admin group - domain guest group - enable rid algorithm - enable svcctl - force unknown acl user - hosts equiv - ldap filter - min password length - nt smb support - post script - printer driver - printer driver file - printer driver location - read size - source environment - status - strip dot - total print jobs - unicode - use rhosts - valid chars - vfs options - winbind enable local accounts - winbind max idle children - wins partners - - - - - -New Parameters - -The following new parameters have been released up to and including Samba 3.0.25 (grouped by function:) - -Remote Management - -new parameters - - - abort shutdown script - shutdown script - - -User and Group Account Management - - - add group script - add machine script - add user to group script - algorithmic rid base - delete group script - delete user from group script - passdb backend - rename user script - set primary group script - username map script - - -Authentication - - - auth methods - ldap password sync - passdb expand explicit - realm - - -Protocol Options - - - add port command - afs token lifetime - client lanman auth - client NTLMv2 auth - client schannel - client signing - client use spnego - defer sharing violations - disable netbios - dmapi support - enable privileges - use kerberos keytab - log nt token command - ntlm auth - paranoid server security - sendfile - server schannel - server signing - smb ports - svcctl list - use spnego - - -File Service - - - allocation roundup size - acl check permissions - acl group control - acl map full control - aio read size - aio write size - dfree cache time - dfree command - ea support - enable asu support - fam change notify - force unknown acl user - get quota command - hide special files - hide unwriteable files - inherit owner - hostname lookups - kernel change notify - mangle prefix - map acl inherit - map read only - max stat cache size - msdfs proxy - open files database hash size - set quota command - store dos attributes - use sendfile - usershare allow guests - usershare max shares - usershare owner only - usershare path - usershare prefix allow list - usershare prefix deny list - usershare template share - vfs objects - - -Printing - - - cups options - cups server - force printername - iprint server - max reported print jobs - printcap cache time - - - -Unicode and Character Sets - - - display charset - dos charset - UNIX charset - - -SID to UID/GID Mappings - - - idmap backend - idmap gid - idmap uid - username map script - winbind nss info - winbind offline logon - winbind refresh tickets - winbind trusted domains only - template primary group - - -LDAP - - - ldap delete dn - ldap group suffix - ldap idmap suffix - ldap machine suffix - ldap passwd sync - ldap replication sleep - ldap timeout - ldap user suffix - - -General Configuration - - - eventlog list - preload modules - reset on zero vc - privatedir - - - - - -Modified Parameters (Changes in Behavior) - - - acl group control (new default is No, deprecated parameter) - change notify timeout (scope changed) - dos filemode (disabled by default) - dos filetimes (enabled by default) - enable asu support (disabled by default) - enable privileges (enabled by default) - encrypt passwords (enabled by default) - host msdfs (enabled by default) - mangling method (set to hash2 by default) - map to guest - only user (deprecated) - passwd chat - passwd program - password server - restrict anonymous (integer value) - security (new ads value) - strict locking (auto by default) - winbind cache time (increased to 5 minutes) - winbind enum groups (disabled by default) - winbind enum users (disabled by default) - winbind nested groups (enabled by default) - winbind uid (deprecated in favor of idmap uid) - winbind gid (deprecated in favor of idmap gid) - winbindd nss info - write cache (deprecated) - - - - - - - -New Functionality - - -major changes - The major changes in behavior since that Samba-2.2.x series are documented in this section. - Please refer to the WHATSNEW.txt file that ships with every release of - Samba to obtain detailed information regarding the changes that have been made during the - life of the current Samba release. - - - - TDB Data Files - -tdb data files - - Refer to Installation, Chapter 1, Chapter 1 - for information pertaining to the Samba-3 data files, their location and the information that must be - preserved across server migrations, updates and upgrades. - - - -tdb file backup - Please remember to back up your existing ${lock directory}/*tdb before upgrading to Samba-3. If necessary, - Samba will upgrade databases as they are opened. Downgrading from Samba-3 to 2.2, or reversion to an earlier - version of Samba-3 from a later release, is an unsupported path. - - - -tdb file descriptions - The old Samba-2.2.x tdb files are described in the next table. - - - - Samba-2.2.x TDB File Descriptions - - - - - - - Name - Description - Backup? - - - - - account_policy - User policy settings - yes - - - brlock - Byte-range file locking information. - no - - - connections - Client connection information - no - - - locking - Temporary file locking data. - no - - - messages - Temporary storage of messages being processed by smbd. - no - - - ntdrivers - Stores per-printer driver information. - yes - - - ntforms - Stores per-printer forms information. - yes - - - ntprinters - Stores the per-printer devmode configuration settings. - yes - - - printing/*.tdb - Cached output from lpq command created on a per-print-service basis. - no - - - - registry - Read-only Samba registry skeleton that provides support for - exporting various database tables via the winreg RPCs. - no - - - sessionid - Temporary cache for miscellaneous session information. - no - - - share_info - Share ACL settings. - yes - - - - unexpected - Packets received for which no process was listening. - no - - - winbindd_cache - Cache of identity information received from an NT4 or an ADS domain. - yes - - - winbindd_idmap - New ID map table from SIDS to UNIX UIDs/GIDs. - yes - - - -
- - - - - Changes in Behavior - - - The following issues are known changes in behavior between Samba-2.2 and - Samba-3 that may affect certain installations of Samba. - - - - -Windows domain -getpwnam() call -NT_STATUS_LOGON_FAILURE - When operating as a member of a Windows domain, Samba-2.2 would map any users authenticated by the remote DC - to the guest account if a UID could not be obtained via the getpwnam() call. Samba-3 rejects - the connection with the error message NT_STATUS_LOGON_FAILURE. There is no current workaround - to re-establish the Samba-2.2 behavior. - - - -add user script -add machine script - When adding machines to a Samba-2.2 controlled domain, the - add user script was used to create the UNIX identity of the - machine trust account. Samba-3 introduces a new add machine - script that must be specified for this purpose. Samba-3 will - not fall back to using the add user script in the absence of - an add machine script. - - - - - - - Passdb Backends and Authentication - - - There have been a few new changes that Samba administrators should be - aware of when moving to Samba-3. - - - - -encrypted passwords - Encrypted passwords have been enabled by default in order to - interoperate better with out-of-the-box Windows client - installations. This does mean that either (a) a Samba account - must be created for each user, or (b) encrypt passwords = no - must be explicitly defined in &smb.conf;. - - - -ADS -Kerberos -LDAP - Inclusion of new ads option for integration - with an Active Directory domain using the native Windows Kerberos 5 and LDAP protocols. - - - - -account storage backends - Samba-3 also includes the possibility of setting up chains of authentication methods () and account storage backends (). Please refer to - the &smb.conf; man page and Account Information Databases, for - details. While both parameters assume sane default values, it is likely that you will need to understand what - the values actually mean in order to ensure Samba operates correctly. - - - -pdbedit -smbpasswd -net tool - Certain functions of the smbpasswd tool have been split between the - new smbpasswd utility, the net tool, and the new pdbedit - utility. See the respective man pages for details. - - - - - - LDAP - - - This section outlines the new features effecting Samba/LDAP integration. - - - - New Schema - - -object class -sambaSamAccount -LDIF -attributes - A new object class (sambaSamAccount) has been introduced to replace - the old sambaAccount. This change aids in the renaming of attributes - to prevent clashes with attributes from other vendors. There is a - conversion script (examples/LDAP/convertSambaAccount) to modify an LDIF - file to the new schema. - - - - Example: -ldapsearch - - - &prompt;ldapsearch .... -LLL -b "ou=people,dc=..." > old.ldif - &prompt;convertSambaAccount --sid <DOM SID> --input old.ldif --output new.ldif - - - -netgetlocalsid - The <DOM SID> can be obtained by running - -&prompt;net getlocalsid <DOMAINNAME> - -PDC - on the Samba PDC as root. - - - - Under Samba-2.x the domain SID can be obtained by executing: -smbpasswd - -&prompt;smbpasswd -S <DOMAINNAME> - - - - -old sambaAccount -ldapsam_compat -object class declaration -samba.schema - The old sambaAccount schema may still be used by specifying the - ldapsam_compat passdb backend. However, the sambaAccount and - associated attributes have been moved to the historical section of - the schema file and must be uncommented before use if needed. - The Samba-2.2 object class declaration for a sambaAccount has not changed - in the Samba-3 samba.schema file. - - - - Other new object classes and their uses include: - - - - -sambaDomain -domain information -RID -ldap suffix -ldapsam -idmap - sambaDomain &smbmdash; domain information used to allocate RIDs - for users and groups as necessary. The attributes are added - in ldap suffix directory entry automatically if - an idmap UID/GID range has been set and the ldapsam - passdb backend has been selected. - - - -sambaGroupMapping -ldap group suffix -net groupmap - sambaGroupMapping &smbmdash; an object representing the - relationship between a posixGroup and a Windows - group/SID. These entries are stored in the ldap - group suffix and managed by the net groupmap command. - - - -sambaUNIXIdPool -ldap idmap suffix -idmap UID -idmap GID - sambaUNIXIdPool &smbmdash; created in the ldap idmap suffix entry - automatically and contains the next available idmap UID and - idmap GID. - - - -sambaIdmapEntry -idmap_ldap module - sambaIdmapEntry &smbmdash; object storing a mapping between a - SID and a UNIX UID/GID. These objects are created by the - idmap_ldap module as needed. - - - - - - - New Suffix for Searching - - -LDAP queries -passdb backend -ldap suffix -ldap user suffix -ldap machine suffix -ldap group suffix -ldap idmap suffix - The following new &smb.conf; parameters have been added to aid in directing - certain LDAP queries when passdb backend = ldapsam://... has been - specified. - - - - ldap suffix &smbmdash; used to search for user and computer accounts. - ldap user suffix &smbmdash; used to store user accounts. - ldap machine suffix &smbmdash; used to store machine trust accounts. - ldap group suffix &smbmdash; location of posixGroup/sambaGroupMapping entries. - ldap idmap suffix &smbmdash; location of sambaIdmapEntry objects. - - - -ldap suffix -subsuffix parameters - If an ldap suffix is defined, it will be appended to all of the - remaining subsuffix parameters. In this case, the order of the suffix - listings in &smb.conf; is important. Always place the ldap suffix first - in the list. - - - - Due to a limitation in Samba's &smb.conf; parsing, you should not surround - the domain names with quotation marks. - - - - - - IdMap LDAP Support - - -idmap backend - Samba-3 supports an LDAP backend for the idmap subsystem. The - following options inform Samba that the idmap table should be - stored on the directory server onterose in the ou=Idmap,dc=quenya,dc=org partition. - - - - - ... - ldap:ldap://onterose/ - ou=Idmap - 40000-50000 - 40000-50000 - - - -NFS - This configuration allows Winbind installations on multiple servers to - share a UID/GID number space, thus avoiding the interoperability problems - with NFS that were present in Samba-2.2. - - - - - - - - - - - diff --git a/docs-xml/Samba3-HOWTO/index.xml b/docs-xml/Samba3-HOWTO/index.xml index 8321714867..ef463d41a1 100644 --- a/docs-xml/Samba3-HOWTO/index.xml +++ b/docs-xml/Samba3-HOWTO/index.xml @@ -173,8 +173,6 @@ The chapters in this part each cover specific Samba features. Migration and Updating - - -- cgit