[Samba] Problems with migrating users and groups with classicupgrade
Rowland Penny
rowlandpenny241155 at gmail.com
Thu Sep 17 09:52:33 UTC 2015
On 17/09/15 10:36, Robert Moskowitz wrote:
>
>
> On 09/17/2015 03:58 AM, Rowland Penny wrote:
>> On 16/09/15 22:15, Robert Moskowitz wrote:
>>>
>>>
>>> On 09/16/2015 05:03 PM, Rowland Penny wrote:
>>>> On 16/09/15 19:17, Robert Moskowitz wrote:
>>>>> I am assuming that I need to migrate my users and groups if I
>>>>> expect to move my user profiles.
>>>>>
>>>>> Migrating computers is a second question. But on with details.
>>>>>
>>>>> My current setup is a ClearOS server running as a PDC. I get the
>>>>> following information from it:
>>>>>
>>>>> # wbinfo -u
>>>>> winadmin
>>>>> guest
>>>>> rgm
>>>>> abba
>>>>> imma
>>>>> guest2
>>>>> superrgm
>>>>>
>>>>> After running:
>>>>>
>>>>> samba-tool domain classicupgrade --dbdir=/root/samba.PDC/dbdir/
>>>>> --use-xattrs=yes --realm=HOME.HTT --dns-backend=BIND9_DLZ
>>>>> /root/samba.PDC/etc/smb.conf
>>>>>
>>>>> and getting all the services running here I get:
>>>>>
>>>>> # wbinfo -u
>>>>> administrator
>>>>> dns-homebase
>>>>> dhcpduser
>>>>> krbtgt
>>>>> guest
>>>>>
>>>>> So what went wrong? Why did not my users make it through the
>>>>> migration? I am attaching the output of the upgrade. I have
>>>>> already changed the password, so don't yell at me for not blanking
>>>>> that out.
>>>>>
>>>>> # samba-tool domain classicupgrade --dbdir=/root/samba.PDC/dbdir/
>>>>> --use-xattrs=yes --realm=HOME.HTT --dns-backend=BIND9_DLZ
>>>>> /root/samba.PDC/etc/smb.conf
>>>>> Reading smb.conf
>>>>> NOTE: Service printers is flagged unavailable.
>>>>> NOTE: Service print$ is flagged unavailable.
>>>>> Unknown parameter encountered: "force directory security mode"
>>>>> Ignoring unknown parameter "force directory security mode"
>>>>> Provisioning
>>>>> Exporting account policy
>>>>> Exporting groups
>>>>> Exporting users
>>>>> Next rid = 1000
>>>>> Exporting posix attributes
>>>>> Reading WINS database
>>>>> Looking up IPv4 addresses
>>>>> Looking up IPv6 addresses
>>>>> No IPv6 address will be assigned
>>>>> Setting up share.ldb
>>>>> Setting up secrets.ldb
>>>>> Setting up the registry
>>>>> Setting up the privileges database
>>>>> Setting up idmap db
>>>>> Setting up SAM db
>>>>> Setting up sam.ldb partitions and settings
>>>>> Setting up sam.ldb rootDSE
>>>>> Pre-loading the Samba 4 and AD schema
>>>>> Adding DomainDN: DC=home,DC=htt
>>>>> Adding configuration container
>>>>> Setting up sam.ldb schema
>>>>> Setting up sam.ldb configuration data
>>>>> Setting up display specifiers
>>>>> Modifying display specifiers
>>>>> Adding users container
>>>>> Modifying users container
>>>>> Adding computers container
>>>>> Modifying computers container
>>>>> Setting up sam.ldb data
>>>>> Setting up well known security principals
>>>>> Setting up sam.ldb users and groups
>>>>> Setting up self join
>>>>> Setting acl on sysvol skipped
>>>>> Adding DNS accounts
>>>>> Creating CN=MicrosoftDNS,CN=System,DC=home,DC=htt
>>>>> Creating DomainDnsZones and ForestDnsZones partitions
>>>>> Populating DomainDnsZones and ForestDnsZones partitions
>>>>> Unable to find group id for BIND,
>>>>> set permissions to sam.ldb* files manually
>>>>> BIND version unknown, please modify
>>>>> /var/lib/samba/private/named.conf manually.
>>>>> See /var/lib/samba/private/named.conf for an example configuration
>>>>> include file for BIND
>>>>> and /var/lib/samba/private/named.txt for further documentation
>>>>> required for secure DNS updates
>>>>> Setting up sam.ldb rootDSE marking as synchronized
>>>>> Fixing provision GUIDs
>>>>> A Kerberos configuration suitable for Samba 4 has been generated
>>>>> at /var/lib/samba/private/krb5.conf
>>>>> Setting up fake yp server settings
>>>>> Once the above files are installed, your Samba4 server will be
>>>>> ready to use
>>>>> Admin password: ~G6;C~ojZ3<elpCAx[MH
>>>>> Server Role: active directory domain controller
>>>>> Hostname: homebase
>>>>> NetBIOS Domain: HOME
>>>>> DNS Domain: home.htt
>>>>> DOMAIN SID: S-1-5-21-4240919292-2417995422-4236335894
>>>>> Importing WINS database
>>>>> Importing Account policy
>>>>> Importing idmap database
>>>>> Cannot open idmap database, Ignoring: [Errno 2] No such file or
>>>>> directory
>>>>> Adding groups
>>>>> Importing groups
>>>>> Committing 'add groups' transaction to disk
>>>>> Adding users
>>>>> Importing users
>>>>> Committing 'add users' transaction to disk
>>>>> Adding users to groups
>>>>> Committing 'add users to groups' transaction to disk
>>>>>
>>>>>
>>>>>
>>>>
>>>> what version of Clearos, where were the users & groups stored, can
>>>> you post the smb.conf from the Clearos server
>>>
>>> # cat /etc/clearos-release
>>> ClearOS Community release 6.6.0 (Final)
>>>
>>> But I built it on 6.0. Back in Dec 2013.
>>>
>>> I am using linux users:
>>>
>>> # ls /home/ -ls
>>> total 216
>>> 4 drwx------. 3 abba allusers 4096 Jun 10 22:48 abba
>>> 4 drwx------ 2 guest2 allusers 4096 Apr 13 2013 guest2
>>> 184 drwx------ 120 imma allusers 184320 Sep 13 18:25 imma
>>> 16 drwx------. 2 root root 16384 Apr 11 2013 lost+found
>>> 4 drwx------. 2 rgm allusers 4096 Apr 11 2013 rgm
>>> 4 drwx------ 2 superrgm allusers 4096 Apr 13 2013 superrgm
>>>
>>>
>>> # cat /etc/samba/smb.conf
>>> [global]
>>> # General
>>> netbios name = HOMEBASE
>>> workgroup = HOME
>>> server string = home
>>> security = user
>>>
>>> # Logging
>>> syslog = 0
>>> log level = 1
>>> log file = /var/log/samba/%L-%m
>>> max log size = 0
>>> utmp = Yes
>>>
>>> # Network
>>> bind interfaces only = No
>>> interfaces = lo eth0
>>> smb ports = 139
>>>
>>> # Printing
>>> printcap name = /etc/printcap
>>> load printers = Yes
>>>
>>> # Security settings
>>> guest account = guest
>>> #restrict anonymous = 2
>>>
>>> # WINS
>>> wins support = Yes
>>> wins server =
>>>
>>> # PDC/BDC
>>> domain logons = Yes
>>> add machine script = /usr/sbin/samba-add-machine "%u"
>>> logon drive = H:
>>> logon script = %U.cmd
>>> logon path = \\%L\profiles\%U
>>> logon home = \\%L\%U
>>>
>>> # Winbind
>>> idmap config * : backend = ldap
>>> idmap config * : range = 20000000-29999999
>>> winbind enum users = Yes
>>> winbind enum groups = Yes
>>> winbind offline logon = false
>>> winbind use default domain = true
>>> winbind separator = +
>>> template homedir = /home/%U
>>> template shell = /sbin/nologin
>>>
>>> # Other
>>> preferred master = Yes
>>> domain master = Yes
>>> passwd program = /usr/sbin/userpasswd %u
>>> passwd chat = *password:* %n\n *password:* %n\n *successfully.*
>>> passwd chat timeout = 10
>>> username map = /etc/samba/smbusers
>>> wide links = No
>>>
>>> # LDAP settings
>>> include = /etc/samba/smb.ldap.conf
>>>
>>> # Winbind LDAP settings
>>> include = /etc/samba/smb.winbind.conf
>>>
>>> #============================ Share Definitions
>>> ==============================
>>>
>>> # Flexshare
>>> # include = /etc/samba/flexshare.conf
>>>
>>> include = /etc/samba/flexshare.conf
>>>
>>> include = /etc/samba/extras.conf
>>>
>>> [homes]
>>> comment = Home Directories
>>> path = /home/%U
>>> valid users = %D\%S, %D+%S, %S
>>> read only = No
>>> browseable = No
>>> available = Yes
>>>
>>> [printers]
>>> comment = Print Spool
>>> path = /var/spool/samba
>>> printing = cups
>>> cups options = raw
>>> use client driver = Yes
>>> printable = Yes
>>> read only = No
>>> browseable = No
>>> available = No
>>>
>>> [print$]
>>> comment = Printer Drivers
>>> path = /var/samba/drivers
>>> read only = No
>>> browseable = No
>>> available = No
>>>
>>> [netlogon]
>>> comment = Network Logon Service
>>> path = /var/samba/netlogon
>>> read only = No
>>> locking = No
>>> browseable = No
>>> available = Yes
>>>
>>> [profiles]
>>> comment = Profile Share
>>> path = /var/samba/profiles
>>> read only = No
>>> profile acls = Yes
>>> browseable = No
>>> available = Yes
>>> force group = domain_users
>>> force directory mode = 02775
>>> force directory security mode = 02775
>>>
>>>
>>>
>>
>> What is in the include files, it looks like the user & group info is
>> stored in ldap
>
> # more /etc/samba/smb.ldap.conf
> # Please do not edit - this file is automatically generated.
>
> passdb backend = ldapsam:ldap://127.0.0.1
> ldap admin dn = cn=manager,ou=Internal,dc=home,dc=htt
> ldap group suffix = ou=Groups,ou=Accounts
> ldap idmap suffix = ou=Idmap
> ldap machine suffix = ou=Computers,ou=Accounts
> ldap passwd sync = No
> ldap suffix = dc=home,dc=htt
> ldap user suffix = ou=Users,ou=Accounts
> ldap connection timeout = 8
> ldap ssl = Off
>
> # more /etc/samba/smb.winbind.conf
> # Please do not edit - this file is automatically generated.
>
>
> idmap config * : ldap_url = ldap://127.0.0.1
> idmap config * : ldap_base_dn = ou=Idmap,dc=home,dc=htt
> idmap config * : ldap_user_dn = cn=manager,ou=Internal,dc=home,dc=htt
>
> Other interesting files under /etc/samba are:
>
> # more localsid
> S-1-5-21-4240919292-2417995422-4236335894
> # more domainsid
> S-1-5-21-4240919292-2417995422-4236335894
> # more smbusers
> # Unix_name = SMB_name1 SMB_name2 ...
> root = administrator admin
> nobody = guest pcguest smbguest
> # more lmhosts
> 127.0.0.1 localhost
>
>
OK, did you read this page on the wiki?
https://wiki.samba.org/index.php/Migrating_a_Samba_NT4_domain_to_a_Samba_AD_domain_%28classic_upgrade%29
Specifically, the part with the heading 'LDAP' ?
Rowland
More information about the samba
mailing list