[Samba] Samba Upgrade-iad

[Rowland Penny]

On 04/11/14 19:18, ray klassen wrote:
>
> Back when I was first exploring samba4, the debian packages were 
> expressly without the active directory component. From your question, 
> I assume that has changed?
>
>
> The bind9 thing was to enable dlopen which the stock debian bind 
> didn't come with. Again, are you saying that the backports version has 
> that?
>
>
> I don't go to backports as the first choice, generally. Especially 
> when the wiki seems to describe the compile process as the main 
> install method.
>
>
>
>
> On Thursday, 30 October 2014, 6:34, Rowland Penny 
> <repenny241155 at gmail.com> wrote:
>
>
> On 29/10/14 22:13, ray klassen wrote:
> > First of all let me congratulate the wiki writers. The step by step 
> classic-upgrade guide is very helpful. Here are my notes on the 
> various steps of the upgrade.
> >
> > -- created a vanilla debian wheezy install, installed all the 
> prerequisites as well as "devscripts,"
> > --compiled, installed samba using samba-4.1.2
> > -- created symbolic links from /usr/local/samba/bin to 
> /usr/local/bin and /usr/local/samba/sbin to /usr/local/sbin because 
> those directories are in $PATH and from /usr/local/samba/etc/ to 
> /etc/samba and from /usr/local/samba/var/log.* to /var/log/samba/* so 
> that those files will be where I expect.
> > -- installed slapd, copied over the current ldap files, configured 
> slapd to load them-- copied smb.conf and various *db files to a 
> directory-- downloaded the debian bind9 source deb, added  
> --with-dlopen=yes to EXTRA_FEATURES= in the debian/rules file
> > --ran debuild -us -uc  from bind9 source dir -- created debs with 
> dlopen support (this is what devscripts was for.
> > --ran samba-tool doman classicupgrade... with --dns-backend=BIND_DLZ 
> etc.
>
> Can I ask why you compiled samba4 & Bind9 ?, bearing in mind that samba
> 4.1.11 (soon to be 4.1.13) and bind 9.9.5 are both available from
> backports ?
>
> Rowland
>
>
> > --several colisions had to be edited out of the ldap directory 
> before the upgrade would complete -- a trusted domain account had to 
> be removed-- an early phase of the classicupgrade script warned me 
> that it would not be imported, but a later phase choked apparently 
> because it hadn't been imported. Bug? -- two groups had different 
> groupnames but the same DisplayName. that had to be changed.
> >  -- played around with dns. Found that windows boxes really like to 
> talk to the domain controller itself and not a slave.
> >
> > ONGOING MOP-UP
> > -- have been busy reconnecting all the services that depended on 
> ldap to active directory, learning kerberos
> >
> > -----------------
> > Some things did not work as expected. 1) all the computers did not 
> automatically join the new domain. Some did and some did not. The 
> computers that were at the head office presumably in the same 
> broadcast domain all joined automatically, once I configured the 
> domain controller as DNS server assigned by DHCP. The computers at our 
> satellite offices (approximately 30) did not. This maybe because I had 
> LMHOSTS files on all those machines, except that after delete and 
> reboot, (DNS still pointed at the DC -- I didn't forget) they didn't 
> autoconnect. I have manually had to move them from OURDOMAIN to 
> OURDOMAIN.sample.com and then they function normally as domain members.
> > THE SHOW STOPPER (not addressed anywhere although I would think it a 
> fairly obvious course of action): Our main production file server is 
> still running samba 3 and I didn't see any reason to upgrade it at 
> this point, as from my experiments earlier I found that the permission 
> semantics would now be NTFSish and I had a fair amount of data being 
> shared in numerous shares with the assumption of unix permissions -- 
> lots of "force group" and "create mask" directives. So I would think 
> that having created an AD DC I could load up winbind and just connect 
> to the new domain controller and it successfully did join. And Then... 
> nothing. Winbind could not download any list of users. wbinfo -u gave 
> me nothing. after a lot of searching I found that "wbinfo -t" would 
> test your your connection (not having used much winbind before, I 
> didn't know) and it appeared that the secrets.tdb file did not have 
> the right info for winbind to use. Not knowing anything else to do I 
> shut down samba and winbind, deleted secrets.tdb and performed a net 
> join again. After that wbinfo -t was successful and wbinfo -u gave the 
> standard list of users. reconfiguring nss from ldap to winbind, etc. 
> is documented elsewhere.
> >
> > !!!  if fhis is a standard method (i.e. if simply deleting 
> secrets.tdb is acceptable)  I'll put something on the wiki (I can) in 
> the classic upgrade page about repurposing an existing samba3/LDAP 
> domain controller. Because it really is a showstopper when you can't 
> actually connect back to your data.
> > -- The other thing that had to be done was any shares in smb.conf on 
> the repurposed file server with limited access based on user or group 
> had to be changed to "ourdomain\user" or "ourdomain\group" but this, 
> though painful was just par for the course.
> >
> > Anyhow, the wiki seems to indicate that you want accounts of 
> upgrades. here's mine with emphasis on the stuff that wasn't covered 
> as well as it might have been
> >
> >
> >
> >
> >
> >
> >
> >
>
>
>
Hi, I am running Debian 7.5 AD DC with samba 4.1.11 & bind 9.9.5 from 
backports without problem, does that answer your question ?

Rowland