diff options
Diffstat (limited to 'docs/htmldocs/Samba3-HOWTO/upgrading-to-3.0.html')
| -rw-r--r-- | docs/htmldocs/Samba3-HOWTO/upgrading-to-3.0.html | 295 |
1 files changed, 295 insertions, 0 deletions
diff --git a/docs/htmldocs/Samba3-HOWTO/upgrading-to-3.0.html b/docs/htmldocs/Samba3-HOWTO/upgrading-to-3.0.html new file mode 100644 index 0000000000..d7d63ccd8d --- /dev/null +++ b/docs/htmldocs/Samba3-HOWTO/upgrading-to-3.0.html @@ -0,0 +1,295 @@ +<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 35. Upgrading from Samba-2.x to Samba-3.0.23</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="The Official Samba-3 HOWTO and Reference Guide"><link rel="up" href="migration.html" title="Part IV. Migration and Updating"><link rel="prev" href="migration.html" title="Part IV. Migration and Updating"><link rel="next" href="NT4Migration.html" title="Chapter 36. Migration from NT4 PDC to Samba-3 PDC"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 35. Upgrading from Samba-2.x to Samba-3.0.23</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="migration.html">Prev</a> </td><th width="60%" align="center">Part IV. Migration and Updating</th><td width="20%" align="right"> <a accesskey="n" href="NT4Migration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="upgrading-to-3.0"></a>Chapter 35. Upgrading from Samba-2.x to Samba-3.0.23</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><code class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a href="mailto:jerry@samba.org">jerry@samba.org</a>></code></p></div></div></div></div><div><p class="pubdate">June 30, 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="upgrading-to-3.0.html#id432254">Quick Migration Guide</a></span></dt><dt><span class="sect1"><a href="upgrading-to-3.0.html#id432380">New Features in Samba-3</a></span></dt><dt><span class="sect1"><a href="upgrading-to-3.0.html#id432649">Configuration Parameter Changes</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrading-to-3.0.html#id432688">Removed Parameters</a></span></dt><dt><span class="sect2"><a href="upgrading-to-3.0.html#id432854">New Parameters</a></span></dt><dt><span class="sect2"><a href="upgrading-to-3.0.html#id433402">Modified Parameters (Changes in Behavior)</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrading-to-3.0.html#id433530">New Functionality</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrading-to-3.0.html#id433554">TDB Data Files</a></span></dt><dt><span class="sect2"><a href="upgrading-to-3.0.html#id433892">Changes in Behavior</a></span></dt><dt><span class="sect2"><a href="upgrading-to-3.0.html#id433980">Passdb Backends and Authentication</a></span></dt><dt><span class="sect2"><a href="upgrading-to-3.0.html#id434143">LDAP</a></span></dt></dl></dd></dl></div><p> +<a class="indexterm" name="id432231"></a> +<a class="indexterm" name="id432238"></a> +<a class="indexterm" name="id432244"></a> +This chapter deals exclusively with the differences between Samba-3.0.23 and Samba-2.2.8a. +It points out where configuration parameters have changed, and provides a simple guide for +the move from 2.2.x to 3.0.23. +</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id432254"></a>Quick Migration Guide</h2></div></div></div><p> +Samba-3.0.23 default behavior should be approximately the same as Samba-2.2.x. +The default behavior when the new parameter <a class="indexterm" name="id432263"></a>passdb backend +is not defined in the <code class="filename">smb.conf</code> file provides the same default behavior as Samba-2.2.x +with <a class="indexterm" name="id432277"></a>encrypt passwords = Yes and +will use the <code class="filename">smbpasswd</code> database. +</p><p> +<a class="indexterm" name="id432293"></a> +<a class="indexterm" name="id432300"></a> +So why say that <span class="emphasis"><em>behavior should be approximately the same as Samba-2.2.x</em></span>? Because +Samba-3.0.23 can negotiate new protocols, such as support for native Unicode, that may result in +differing protocol code paths being taken. The new behavior under such circumstances is not +exactly the same as the old one. The good news is that the domain and machine SIDs will be +preserved across the upgrade. +</p><p> +<a class="indexterm" name="id432317"></a> +<a class="indexterm" name="id432324"></a> +<a class="indexterm" name="id432331"></a> +<a class="indexterm" name="id432337"></a> +If the Samba-2.2.x system is using an LDAP backend, and there is no time to update the LDAP +database, then make sure that <a class="indexterm" name="id432346"></a>passdb backend = ldapsam_compat +is specified in the <code class="filename">smb.conf</code> file. For the rest, behavior should remain more or less the same. +At a later date, when there is time to implement a new Samba-3-compatible LDAP backend, it is possible +to migrate the old LDAP database to the new one through use of the <code class="literal">pdbedit</code>. +See <a href="passdb.html#pdbeditthing" title="The pdbedit Tool">The <span class="emphasis"><em>pdbedit</em></span> Command</a>. +</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id432380"></a>New Features in Samba-3</h2></div></div></div><p> +The major new features are: +</p><div class="orderedlist"><ol type="1"><li><p> +<a class="indexterm" name="id432401"></a> +<a class="indexterm" name="id432408"></a> + Active Directory support. This release is able to join an ADS realm + as a member server and authenticate users using LDAP/Kerberos. + </p></li><li><p> +<a class="indexterm" name="id432420"></a> +<a class="indexterm" name="id432427"></a> + Unicode support. Samba will now negotiate Unicode on the wire, and + internally there is a much better infrastructure for multibyte + and Unicode character sets. + </p></li><li><p> +<a class="indexterm" name="id432439"></a> + New authentication system. The internal authentication system has + been almost completely rewritten. Most of the changes are internal, + but the new authoring system is also very configurable. + </p></li><li><p> +<a class="indexterm" name="id432452"></a> + New filename mangling system. The filename mangling system has been + completely rewritten. An internal database now stores mangling maps + persistently. + </p></li><li><p> +<a class="indexterm" name="id432465"></a> + New “<span class="quote">net</span>” command. A new “<span class="quote">net</span>” command has been added. It is + somewhat similar to the “<span class="quote">net</span>” command in Windows. Eventually, we + plan to replace a bunch of other utilities (such as smbpasswd) + with subcommands in “<span class="quote">net</span>”. + </p></li><li><p> +<a class="indexterm" name="id432491"></a> + Samba now negotiates NT-style status32 codes on the wire. This + considerably improves error handling. + </p></li><li><p> +<a class="indexterm" name="id432503"></a> + Better Windows 200x/XP printing support, including publishing + printer attributes in Active Directory. + </p></li><li><p> +<a class="indexterm" name="id432515"></a> +<a class="indexterm" name="id432522"></a> +<a class="indexterm" name="id432529"></a> + New loadable RPC modules for passdb backends and character sets. + </p></li><li><p> +<a class="indexterm" name="id432541"></a> + New default dual-daemon winbindd support for better performance. + </p></li><li><p> +<a class="indexterm" name="id432552"></a> +<a class="indexterm" name="id432559"></a> +<a class="indexterm" name="id432566"></a> + Support for migrating from a Windows NT 4.0 domain to a Samba + domain and maintaining user, group, and domain SIDs. + </p></li><li><p> +<a class="indexterm" name="id432578"></a> +<a class="indexterm" name="id432585"></a> + Support for establishing trust relationships with Windows NT 4.0 + domain controllers. + </p></li><li><p> +<a class="indexterm" name="id432597"></a> +<a class="indexterm" name="id432604"></a> +<a class="indexterm" name="id432610"></a> + Initial support for a distributed Winbind architecture using + an LDAP directory for storing SID to UID/GID mappings. + </p></li><li><p> + Major updates to the Samba documentation tree. + </p></li><li><p> +<a class="indexterm" name="id432627"></a> +<a class="indexterm" name="id432634"></a> + Full support for client and server SMB signing to ensure + compatibility with default Windows 2003 security settings. + </p></li></ol></div><p> +Plus lots of other improvements! +</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id432649"></a>Configuration Parameter Changes</h2></div></div></div><p> +This section contains a brief listing of changes to <code class="filename">smb.conf</code> options since the Samba-2.2.x series up to and +including Samba-3.0.23. +</p><p> +Please refer to the smb.conf(5) man page for complete descriptions of new or modified +parameters. +</p><p> +Whenever a Samba update or upgrade is performed it is highly recommended to read the file called +<span class="emphasis"><em>WHATSNEW.txt</em></span> that is part of the Samba distribution tarball. This file may also +be obtain on-line from the Samba <a href="http://www.samba.org/samba/" target="_top">web site</a>, in +the right column, under Current Stable Release, by clicking on <span class="emphasis"><em>Release Notes</em></span>. +</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id432688"></a>Removed Parameters</h3></div></div></div><a class="indexterm" name="id432693"></a><p> +In alphabetical order, these are the parameters eliminated from Samba-2.2.x through 3.0.23. +</p><div class="itemizedlist"><ul type="disc"><li><p>admin log</p></li><li><p>alternate permissions</p></li><li><p>character set</p></li><li><p>client codepage</p></li><li><p>code page directory</p></li><li><p>coding system</p></li><li><p>domain admin group</p></li><li><p>domain guest group</p></li><li><p>enable rid algorithm</p></li><li><p>enable svcctl</p></li><li><p>force unknown acl user</p></li><li><p>hosts equiv</p></li><li><p>ldap filter</p></li><li><p>min password length</p></li><li><p>nt smb support</p></li><li><p>post script</p></li><li><p>printer admin</p></li><li><p>printer driver</p></li><li><p>printer driver file</p></li><li><p>printer driver location</p></li><li><p>read size</p></li><li><p>source environment</p></li><li><p>status </p></li><li><p>strip dot </p></li><li><p>total print jobs</p></li><li><p>unicode</p></li><li><p>use rhosts</p></li><li><p>valid chars</p></li><li><p>vfs options</p></li><li><p>winbind enable local accounts</p></li><li><p>winbind max idle children</p></li><li><p>wins partners</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id432854"></a>New Parameters</h3></div></div></div><p>The following new parameters have been released up to and including Samba 3.0.23 (grouped by function:)</p><p>Remote Management</p><a class="indexterm" name="id432867"></a><div class="itemizedlist"><ul type="disc"><li><p>abort shutdown script</p></li><li><p>shutdown script</p></li></ul></div><p>User and Group Account Management</p><div class="itemizedlist"><ul type="disc"><li><p>add group script</p></li><li><p>add machine script</p></li><li><p>add user to group script</p></li><li><p>algorithmic rid base</p></li><li><p>delete group script</p></li><li><p>delete user from group script</p></li><li><p>passdb backend</p></li><li><p>rename user script</p></li><li><p>set primary group script</p></li><li><p>username map script</p></li></ul></div><p>Authentication</p><div class="itemizedlist"><ul type="disc"><li><p>auth methods</p></li><li><p>ldap password sync</p></li><li><p>passdb expand explicit</p></li><li><p>realm</p></li></ul></div><p>Protocol Options</p><div class="itemizedlist"><ul type="disc"><li><p>add port command</p></li><li><p>afs token lifetime</p></li><li><p>client lanman auth</p></li><li><p>client NTLMv2 auth</p></li><li><p>client schannel</p></li><li><p>client signing</p></li><li><p>client use spnego</p></li><li><p>defer sharing violations</p></li><li><p>disable netbios</p></li><li><p>dmapi support</p></li><li><p>enable privileges</p></li><li><p>use kerberos keytab</p></li><li><p>log nt token command</p></li><li><p>ntlm auth</p></li><li><p>paranoid server security </p></li><li><p>sendfile</p></li><li><p>server schannel</p></li><li><p>server signing</p></li><li><p>smb ports</p></li><li><p>svcctl list</p></li><li><p>use spnego</p></li></ul></div><p>File Service</p><div class="itemizedlist"><ul type="disc"><li><p>allocation roundup size</p></li><li><p>acl check permissions</p></li><li><p>acl group control</p></li><li><p>acl map full control</p></li><li><p>aio read size</p></li><li><p>aio write size</p></li><li><p>dfree cache time</p></li><li><p>dfree command</p></li><li><p>ea support</p></li><li><p>enable asu support</p></li><li><p>fam change notify</p></li><li><p>force unknown acl user</p></li><li><p>get quota command</p></li><li><p>hide special files</p></li><li><p>hide unwriteable files</p></li><li><p>inherit owner</p></li><li><p>hostname lookups</p></li><li><p>kernel change notify</p></li><li><p>mangle prefix</p></li><li><p>map acl inherit</p></li><li><p>map read only</p></li><li><p>max stat cache size</p></li><li><p>msdfs proxy</p></li><li><p>open files database hash size</p></li><li><p>set quota command</p></li><li><p>store dos attributes</p></li><li><p>use sendfile</p></li><li><p>usershare allow guests</p></li><li><p>usershare max shares</p></li><li><p>usershare owner only</p></li><li><p>usershare path</p></li><li><p>usershare prefix allow list</p></li><li><p>usershare prefix deny list</p></li><li><p>usershare template share</p></li><li><p>vfs objects</p></li></ul></div><p>Printing</p><div class="itemizedlist"><ul type="disc"><li><p>cups options</p></li><li><p>cups server</p></li><li><p>force printername</p></li><li><p>iprint server</p></li><li><p>max reported print jobs</p></li><li><p>printcap cache time</p></li></ul></div><p>Unicode and Character Sets</p><div class="itemizedlist"><ul type="disc"><li><p>display charset</p></li><li><p>dos charset</p></li><li><p>UNIX charset</p></li></ul></div><p>SID to UID/GID Mappings</p><div class="itemizedlist"><ul type="disc"><li><p>idmap backend</p></li><li><p>idmap gid</p></li><li><p>idmap uid</p></li><li><p>username map script</p></li><li><p>winbind nss info</p></li><li><p>winbind offline logon</p></li><li><p>winbind refresh tickets</p></li><li><p>winbind trusted domains only</p></li><li><p>template primary group</p></li></ul></div><p>LDAP</p><div class="itemizedlist"><ul type="disc"><li><p>ldap delete dn</p></li><li><p>ldap group suffix</p></li><li><p>ldap idmap suffix</p></li><li><p>ldap machine suffix</p></li><li><p>ldap passwd sync</p></li><li><p>ldap replication sleep</p></li><li><p>ldap timeout</p></li><li><p>ldap user suffix</p></li></ul></div><p>General Configuration</p><div class="itemizedlist"><ul type="disc"><li><p>eventlog list</p></li><li><p>preload modules</p></li><li><p>reset on zero vc</p></li><li><p>privatedir</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id433402"></a>Modified Parameters (Changes in Behavior)</h3></div></div></div><div class="itemizedlist"><ul type="disc"><li><p>acl group control (new default is No, deprecated parameter)</p></li><li><p>change notify timeout (scope changed)</p></li><li><p>dos filemode (disabled by default)</p></li><li><p>dos filetimes (enabled by default)</p></li><li><p>enable asu support (disabled by default)</p></li><li><p>enable privileges (enabled by default)</p></li><li><p>encrypt passwords (enabled by default) </p></li><li><p>host msdfs (enabled by default)</p></li><li><p>mangling method (set to hash2 by default) </p></li><li><p>map to guest</p></li><li><p>only user (deprecated)</p></li><li><p>passwd chat</p></li><li><p>passwd program</p></li><li><p>password server</p></li><li><p>restrict anonymous (integer value)</p></li><li><p>security (new ads value)</p></li><li><p>strict locking (auto by default)</p></li><li><p>winbind cache time (increased to 5 minutes)</p></li><li><p>winbind enum groups (disabled by default)</p></li><li><p>winbind enum users (disabled by default)</p></li><li><p>winbind nested groups (enabled by default)</p></li><li><p>winbind uid (deprecated in favor of idmap uid)</p></li><li><p>winbind gid (deprecated in favor of idmap gid)</p></li><li><p>winbindd nss info</p></li><li><p>write cache (deprecated)</p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id433530"></a>New Functionality</h2></div></div></div><p> +<a class="indexterm" name="id433538"></a> + The major changes in behavior since that Samba-2.2.x series are documented in this section. + Please refer to the <code class="filename">WHATSNEW.txt</code> file that ships with every release of + Samba to obtain detailed information regarding the changes that have been made during the + life of the current Samba release. + </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id433554"></a>TDB Data Files</h3></div></div></div><a class="indexterm" name="id433560"></a><p> + Refer to <a href="install.html" title="Chapter 1. How to Install and Test SAMBA">Installation, Chapter 1</a>, <a href="install.html#tdbdocs" title="TDB Database File Information">Chapter 1</a> + for information pertaining to the Samba-3 data files, their location and the information that must be + preserved across server migrations, updates and upgrades. + </p><p> +<a class="indexterm" name="id433588"></a> + Please remember to back up your existing ${lock directory}/*tdb before upgrading to Samba-3. If necessary, Samba will + upgrade databases as they are opened. Downgrading from Samba-3 to 2.2, or reversion to an earlier version + of Samba-3 from a later release, is an unsupported path. + </p><p> +<a class="indexterm" name="id433600"></a> + The old Samba-2.2.x tdb files are described in <a href="upgrading-to-3.0.html#oldtdbfiledesc" title="Table 35.1. Samba-2.2.x TDB File Descriptions">the next table</a>. + </p><div class="table"><a name="oldtdbfiledesc"></a><p class="title"><b>Table 35.1. Samba-2.2.x TDB File Descriptions</b></p><div class="table-contents"><table summary="Samba-2.2.x TDB File Descriptions" border="1"><colgroup><col align="left"><col align="justify"><col align="left"></colgroup><thead><tr><th align="left">Name</th><th align="justify">Description</th><th align="center">Backup?</th></tr></thead><tbody><tr><td align="left">account_policy</td><td align="justify">User policy settings</td><td align="left">yes</td></tr><tr><td align="left">brlock</td><td align="justify">Byte-range file locking information.</td><td align="left">no</td></tr><tr><td align="left">connections</td><td align="justify"><p>Client connection information</p></td><td align="left">no</td></tr><tr><td align="left">locking</td><td align="justify">Temporary file locking data.</td><td align="left">no</td></tr><tr><td align="left">messages</td><td align="justify"><p>Temporary storage of messages being processed by smbd.</p></td><td align="left">no</td></tr><tr><td align="left">ntdrivers</td><td align="justify"><p>Stores per-printer driver information.</p></td><td align="left">yes</td></tr><tr><td align="left">ntforms</td><td align="justify"><p>Stores per-printer forms information.</p></td><td align="left">yes</td></tr><tr><td align="left">ntprinters</td><td align="justify"><p>Stores the per-printer devmode configuration settings.</p></td><td align="left">yes</td></tr><tr><td align="left">printing/*.tdb</td><td align="justify"><p>Cached output from lpq command created on a per-print-service basis.</p></td><td align="left">no</td></tr><tr><td align="left">registry</td><td align="justify"><p>Read-only Samba registry skeleton that provides support for + exporting various database tables via the winreg RPCs.</p></td><td align="left">no</td></tr><tr><td align="left">sessionid</td><td align="justify"><p>Temporary cache for miscellaneous session information.</p></td><td align="left">no</td></tr><tr><td align="left">share_info</td><td align="justify">Share ACL settings.</td><td align="left">yes</td></tr><tr><td align="left">unexpected</td><td align="justify"><p>Packets received for which no process was listening.</p></td><td align="left">no</td></tr><tr><td align="left">winbindd_cache</td><td align="justify"><p>Cache of identity information received from an NT4 or an ADS domain.</p></td><td align="left">yes</td></tr><tr><td align="left">winbindd_idmap</td><td align="justify"><p>New ID map table from SIDS to UNIX UIDs/GIDs.</p></td><td align="left">yes</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id433892"></a>Changes in Behavior</h3></div></div></div><p> + The following issues are known changes in behavior between Samba-2.2 and + Samba-3 that may affect certain installations of Samba. + </p><div class="orderedlist"><ol type="1"><li><p> +<a class="indexterm" name="id433911"></a> +<a class="indexterm" name="id433918"></a> +<a class="indexterm" name="id433925"></a> + When operating as a member of a Windows domain, Samba-2.2 would map any users authenticated by the remote DC + to the “<span class="quote">guest account</span>” if a UID could not be obtained via the getpwnam() call. Samba-3 rejects + the connection with the error message “<span class="quote">NT_STATUS_LOGON_FAILURE.</span>” There is no current workaround + to re-establish the Samba-2.2 behavior. + </p></li><li><p> +<a class="indexterm" name="id433946"></a> +<a class="indexterm" name="id433953"></a> + When adding machines to a Samba-2.2 controlled domain, the + “<span class="quote">add user script</span>” was used to create the UNIX identity of the + machine trust account. Samba-3 introduces a new “<span class="quote">add machine + script</span>” that must be specified for this purpose. Samba-3 will + not fall back to using the “<span class="quote">add user script</span>” in the absence of + an “<span class="quote">add machine script</span>”. + </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id433980"></a>Passdb Backends and Authentication</h3></div></div></div><p> + There have been a few new changes that Samba administrators should be + aware of when moving to Samba-3. + </p><div class="orderedlist"><ol type="1"><li><p> +<a class="indexterm" name="id434000"></a> + Encrypted passwords have been enabled by default in order to + interoperate better with out-of-the-box Windows client + installations. This does mean that either (a) a Samba account + must be created for each user, or (b) “<span class="quote">encrypt passwords = no</span>” + must be explicitly defined in <code class="filename">smb.conf</code>. + </p></li><li><p> +<a class="indexterm" name="id434023"></a> +<a class="indexterm" name="id434029"></a> +<a class="indexterm" name="id434036"></a> + Inclusion of new <a class="indexterm" name="id434043"></a>security = ads option for integration + with an Active Directory domain using the native Windows Kerberos 5 and LDAP protocols. + </p></li></ol></div><p> +<a class="indexterm" name="id434055"></a> + Samba-3 also includes the possibility of setting up chains of authentication methods (<a class="indexterm" name="id434063"></a>auth methods) and account storage backends (<a class="indexterm" name="id434071"></a>passdb backend). Please refer to + the <code class="filename">smb.conf</code> man page and <a href="passdb.html" title="Chapter 11. Account Information Databases">Account Information Databases</a>, for + details. While both parameters assume sane default values, it is likely that you will need to understand what + the values actually mean in order to ensure Samba operates correctly. + </p><p> +<a class="indexterm" name="id434096"></a> +<a class="indexterm" name="id434102"></a> +<a class="indexterm" name="id434109"></a> + Certain functions of the <code class="literal">smbpasswd</code> tool have been split between the + new <code class="literal">smbpasswd</code> utility, the <code class="literal">net</code> tool, and the new <code class="literal">pdbedit</code> + utility. See the respective man pages for details. + </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id434143"></a>LDAP</h3></div></div></div><p> + This section outlines the new features effecting Samba/LDAP integration. + </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id434152"></a>New Schema</h4></div></div></div><p> +<a class="indexterm" name="id434160"></a> +<a class="indexterm" name="id434167"></a> +<a class="indexterm" name="id434174"></a> +<a class="indexterm" name="id434180"></a> + A new object class (sambaSamAccount) has been introduced to replace + the old sambaAccount. This change aids in the renaming of attributes + to prevent clashes with attributes from other vendors. There is a + conversion script (examples/LDAP/convertSambaAccount) to modify an LDIF + file to the new schema. + </p><p> + Example: +<a class="indexterm" name="id434193"></a> + </p><pre class="screen"> + <code class="prompt">$ </code>ldapsearch .... -LLL -b "ou=people,dc=..." > old.ldif + <code class="prompt">$ </code>convertSambaAccount --sid <DOM SID> --input old.ldif --output new.ldif + </pre><p> +<a class="indexterm" name="id434224"></a> + The <DOM SID> can be obtained by running +</p><pre class="screen"> +<code class="prompt">$ </code><strong class="userinput"><code>net getlocalsid <DOMAINNAME></code></strong> +</pre><p> +<a class="indexterm" name="id434249"></a> + on the Samba PDC as root. + </p><p> + Under Samba-2.x the domain SID can be obtained by executing: +<a class="indexterm" name="id434260"></a> +</p><pre class="screen"> +<code class="prompt">$ </code><strong class="userinput"><code>smbpasswd -S <DOMAINNAME></code></strong> +</pre><p> + </p><p> +<a class="indexterm" name="id434286"></a> +<a class="indexterm" name="id434292"></a> +<a class="indexterm" name="id434299"></a> +<a class="indexterm" name="id434306"></a> + The old <code class="literal">sambaAccount</code> schema may still be used by specifying the + <em class="parameter"><code>ldapsam_compat</code></em> passdb backend. However, the sambaAccount and + associated attributes have been moved to the historical section of + the schema file and must be uncommented before use if needed. + The Samba-2.2 object class declaration for a <code class="literal">sambaAccount</code> has not changed + in the Samba-3 <code class="filename">samba.schema</code> file. + </p><p> + Other new object classes and their uses include: + </p><div class="itemizedlist"><ul type="disc"><li><p> +<a class="indexterm" name="id434350"></a> +<a class="indexterm" name="id434356"></a> +<a class="indexterm" name="id434363"></a> +<a class="indexterm" name="id434370"></a> +<a class="indexterm" name="id434376"></a> +<a class="indexterm" name="id434383"></a> + <code class="literal">sambaDomain</code> domain information used to allocate RIDs + for users and groups as necessary. The attributes are added + in “<span class="quote">ldap suffix</span>” directory entry automatically if + an idmap UID/GID range has been set and the “<span class="quote">ldapsam</span>” + passdb backend has been selected. + </p></li><li><p> +<a class="indexterm" name="id434412"></a> +<a class="indexterm" name="id434419"></a> +<a class="indexterm" name="id434426"></a> + sambaGroupMapping an object representing the + relationship between a posixGroup and a Windows + group/SID. These entries are stored in the “<span class="quote">ldap + group suffix</span>” and managed by the “<span class="quote">net groupmap</span>” command. + </p></li><li><p> +<a class="indexterm" name="id434448"></a> +<a class="indexterm" name="id434455"></a> +<a class="indexterm" name="id434462"></a> +<a class="indexterm" name="id434468"></a> + <code class="literal">sambaUNIXIdPool</code> created in the “<span class="quote">ldap idmap suffix</span>” entry + automatically and contains the next available “<span class="quote">idmap UID</span>” and + “<span class="quote">idmap GID</span>”. + </p></li><li><p> +<a class="indexterm" name="id434500"></a> +<a class="indexterm" name="id434506"></a> + <code class="literal">sambaIdmapEntry</code> object storing a mapping between a + SID and a UNIX UID/GID. These objects are created by the + idmap_ldap module as needed. + </p></li></ul></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id434527"></a>New Suffix for Searching</h4></div></div></div><p> +<a class="indexterm" name="id434534"></a> +<a class="indexterm" name="id434540"></a> +<a class="indexterm" name="id434547"></a> +<a class="indexterm" name="id434554"></a> +<a class="indexterm" name="id434561"></a> +<a class="indexterm" name="id434568"></a> +<a class="indexterm" name="id434574"></a> + The following new <code class="filename">smb.conf</code> parameters have been added to aid in directing + certain LDAP queries when <em class="parameter"><code>passdb backend = ldapsam://...</code></em> has been + specified. + </p><div class="itemizedlist"><ul type="disc"><li><p>ldap suffix used to search for user and computer accounts.</p></li><li><p>ldap user suffix used to store user accounts.</p></li><li><p>ldap machine suffix used to store machine trust accounts.</p></li><li><p>ldap group suffix location of posixGroup/sambaGroupMapping entries.</p></li><li><p>ldap idmap suffix location of sambaIdmapEntry objects.</p></li></ul></div><p> +<a class="indexterm" name="id434638"></a> +<a class="indexterm" name="id434645"></a> + If an <em class="parameter"><code>ldap suffix</code></em> is defined, it will be appended to all of the + remaining subsuffix parameters. In this case, the order of the suffix + listings in <code class="filename">smb.conf</code> is important. Always place the <em class="parameter"><code>ldap suffix</code></em> first + in the list. + </p><p> + Due to a limitation in Samba's <code class="filename">smb.conf</code> parsing, you should not surround + the domain names with quotation marks. + </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id434683"></a>IdMap LDAP Support</h4></div></div></div><p> +<a class="indexterm" name="id434691"></a> + Samba-3 supports an LDAP backend for the idmap subsystem. The + following options inform Samba that the idmap table should be + stored on the directory server <span class="emphasis"><em>onterose</em></span> in the ou=Idmap,dc=quenya,dc=org partition. + </p><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td>...</td></tr><tr><td><a class="indexterm" name="id434722"></a><em class="parameter"><code>idmap backend = ldap:ldap://onterose/</code></em></td></tr><tr><td><a class="indexterm" name="id434735"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id434747"></a><em class="parameter"><code>idmap uid = 40000-50000</code></em></td></tr><tr><td><a class="indexterm" name="id434760"></a><em class="parameter"><code>idmap gid = 40000-50000</code></em></td></tr></table><p> +<a class="indexterm" name="id434774"></a> + This configuration allows Winbind installations on multiple servers to + share a UID/GID number space, thus avoiding the interoperability problems + with NFS that were present in Samba-2.2. + </p></div></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="migration.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="migration.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="NT4Migration.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Part IV. Migration and Updating </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 36. Migration from NT4 PDC to Samba-3 PDC</td></tr></table></div></body></html> |