Editing SAMBA CLUSTER PUNJAB GOVT IFMS-IWDMS PROJECT (section)

== Migrating Samba groups and populating 389-DS with Samba Users ==
This is where the openldap migration scripts are going to come in handy. Run these on any one of the Samba servers:


First install the scripts- 

<nowiki># yum install migrationtools </nowiki>


Lets modify the file /usr/share/openldap/migration/migrate_common.ph to apply our default domain and base. 


Search for the following OrganizationalUnit : 


$NAMINGCONTEXT{'group'} <nowiki>= "ou=Group"; </nowiki>


Default install of 389-DS will require this to be 'Groups', please change as follows : 


$NAMINGCONTEXT{'group'} <nowiki>= "ou=Groups"; </nowiki>


The rest can be modified as seen below : 


<nowiki># Default DNS domain </nowiki>

$DEFAULT_MAIL_DOMAIN = "pbifmsiwdms.pjb"; 


<nowiki># Default base </nowiki>

$DEFAULT_BASE = "dc=pbifmsiwdms,dc=pjb"; 


<nowiki># turn this on to support more general object clases </nowiki>

<nowiki># such as person.</nowiki>

$EXTENDED_SCHEMA = 1; 


Once complete we are now going to create our Samba Domain Groups. Open up a new file /tmp/sambaGroups and add the following : 


Domain Admins:x:5122: 

Domain Users:x:11503: 

Domain Guests:x:11504: 

Domain Computers:x:11505: 


Note: These are your UNIX groups, created in LDAP! They must exist on the Directory Server group list first! (if you do not have PAM setup) 


Next convert /tmp/sambaGroups into an ldif to be imported into 389-DS : 


<nowiki># /usr/share/openldap/migration/migrate_group.pl \</nowiki>

/tmp/sambaGroups > /tmp/sambaGroups.ldif 

<nowiki># cat /tmp/sambaGroups.ldif </nowiki>


dn: cn=Domain Admins,ou=Groups,dc=pbifmsiwdms,dc=pjb 

objectClass: posixGroup 

objectClass: top 

cn: Domain Admins 

userPassword: {crypt}x 

gidNumber: 5122 


dn: cn=Domain Users,ou=Groups,dc=pbifmsiwdms,dc=pjb 

objectClass: posixGroup 

objectClass: top 

cn: Domain Users 

userPassword: {crypt}x 

gidNumber: 11503 


dn: cn=Domain Guests,ou=Groups,dc=pbifmsiwdms,dc=pjb 

objectClass: posixGroup 

objectClass: top 

cn: Domain Guests 

userPassword: {crypt}x 

gidNumber: 11504 


dn: cn=Domain Computers,ou=Groups,dc=pbifmsiwdms,dc=pjb 

objectClass: posixGroup 

objectClass: top 

cn: Domain Computers 

userPassword: {crypt}x 

gidNumber: 11505 


Now rsync the sambaGroups file to one of the 389-DS servers and import /tmp/sambaGroups.ldif into 389-DS : 


<nowiki># /usr/lib64/dirsrv/slapd-<server>/ldif2ldap "cn=Directory manager" password /tmp/sambaGroups.ldif </nowiki>


Map the Samba groups to the Linux groups (Run on the Samba server): 


<nowiki># net groupmap add rid=512 ntgroup='Domain Admins' </nowiki>\

unixgroup='Domain Admins' 

<nowiki># net groupmap add rid=513 ntgroup='Domain Users' \</nowiki>

unixgroup='Domain Users' 

<nowiki># net groupmap add rid=514 ntgroup='Domain Guests' \</nowiki>

unixgroup='Domain Guests' 

<nowiki># net groupmap add rid=515 ntgroup='Domain Computers'\</nowiki>

unixgroup='Domain Computers' 


Verify : 


<nowiki># net groupmap list </nowiki>


Lets create a Samba Administrator account with an RID of 500. Create a file /tmp/sambaAdmin with the following : 


Administrator:x:0:0:Samba Admin:/root:/bin/bash 


Migrate /tmp/sambaAdmin to the formatted ldif and import into 389-DS : 


<nowiki># /usr/share/openldap/migration/migrate_passwd.pl /tmp/sambaAdmin > /tmp/sambaAdmin.ldif </nowiki>

<nowiki># /usr/lib64/dirsrv/slapd-<server>/ldif2ldap "cn=Directory manager" password /tmp/sambaAdmin.ldif </nowiki>


Create a Samba Administrator account and modify the account to use the correct Samba SID : 


<nowiki># smbpasswd -a Administrator</nowiki>

<nowiki># pdbedit -U $( net getlocalsid | \</nowiki>

sed 's/SID for domain PUNJABGOVT is: //' )-500 -u Administrator -r