Editing Migration-MS-AD-to-SAMBA4

[[Category:Capital Bank]]


== '''[Migration From Microsoft AD R2 from MS server 2003 to Samba 4.1.9 on RHEL 6.4 64bit ]''' ==


== '''Capital Local Area Bank''' ==
 

 '''Project Migration from Microsoft Windows 2003 Ad to Linux Samba 4 '''

'''Installation Of Samba 4 on linux Machine'''

 1. Download tar package from samba site, we have downloaded samba 4.1.9
 
 2. for the Installation full fill the basic requirement  of required library files.

 3. Cd /download/samba4.1; ./configure --enable-debug –enable-selftest ; make && make install

 4. Before creating a domain of before joining the domain make the environment ready .

 hostname : entry in /etc/sysconfig/network 

 define host : entry in /etc/hosts

 network IP : setup : ip address and nameserver is important

 disable selinux : entry in /etc/sysconfig/selinux : requires restart of the machine : init 6

 disable iptables : /etc/init.d/iptables stop; chkconfig iptables off

 5. Here comes the turning point, decide whether to make a testing enviroment with independent full funtionality or need to join in already running PDC

 '''To make independent environment :'''

 Provision the New domain with the below command 
 # samba-tool domain provision –use-rfc2307 –interactive –use-ntvfs

 '''To Join in already running PDC as an ADC:'''

 Remove the smb.conf or just rename the file 
 
 # mv -vf /usr/local/samba/etc/smb.conf mv -vf /usr/local/samba/etc/smb.conf.org

 # samba-tool domain join domainname.rootdn DC -Uadministrator --realm=domainname.rootdn –use-ntvfs

 # domainname.rootdn : capitalbank.co.in
 
 # realm : preferred to be as same as domain name but we can modify it if required.
 The above will join the two computers with there computer name and give the output Joined domain DOMAINNAME (SID S-1-5-21-53190096-2129939875-608521123) as a DC

 The new domain is joined with SID.
 To check hit the below command

 # ldbsearch -H /usr/local/samba/private/sam.ldb '(invocationid=*)' --cross-ncs objectguid

 This will provide the two SID one of the joined one and one of the already existing one now check whether both of them is resolvable or not by running below command.

 # host -t CNAME SID._msdcs.domain.rootdn
 # host -t CNAME  S-1-5-21-53190096-2129939875-608521123._msdcs.capitalbank.co.in

 Copy the krb5.conf from samba to /etc/
 # cp -vf /usr/local/samba/private/krb5.conf /etc/

 Now start the samba, to do so hit the already implemented init script as below.
 # /etc/init.d/samba start

 Now check the samba process to confirm that its running properly
 # ps -elf | grep samba | grep -v grep 
 The above process count should be 14 
 # ps -elf | grep samba | grep -v grep | wc -l

 check whether administrator is able to login or not with the cli This check to authenticate via kerbrose 
 # kinit administrator@DOMAIN.ROOTDN
 # kinit administrator@CAPITAL.COM

 Check things got Replicated or not by the below command
 # samba-tool drs showrepl

 Now Test the DNS its working properly or not
 # host -t SRV _ldap._tcp.capitalbank.co.in.

 # host -t SRV _kerberos._udp.capitalbank.co.in.

 # host -t A pdc.capitalbank.co.in.

 Now Check GPO’s got replicated or not by hitting below command :
 # samba-tool gpo listall 
 This will show’s the all policies

 Now First Check roles by hitting below command
 # samba-tool fsmo show

 To transfer the role hit the below command
 # samba-tool fsmo transfer –role=all

 Now confirm the transferred role by below command
 # samba-tool fsmo show

 Note : If we seize the role the server will take over as a PDC forcefully to do so hit below
 # samba-tool fsmo seize –roll=all ( suggested not to do if again want to use windows as a PDC)

 Now Copy the sysvol from already running PDC to new AD just to take over apart from seize the role by this process PDC is reversible.

 Now we can edit the policies on samba to do so do the below :
 Login as an administrator on windows PC with the domain.

 Now Install the RSAT update according to the machine 64 bit or 32 bit, packages were avaiable on share directory just have to re enable them and restart the samba
 After installation of the update go to controle panel --> program and features --> turn windows feature on & off --> 
 You will get the Screen having section Remote Server Administration Tool now enable the all the packages which required and want to use.
 Now Press Windows --> all programs --> administrative tool and here you have all the required things to manage like DNS, GPO, USERS, GROUP and all the feature as vailable on MS AD

 1. Now One more requirement was there to '''Implement DHCP Server''' with below Requirement
 '''Users must get Dynamic IP'''
 '''Dynamic Ip to be provided only when MAC address is allowed'''
 '''Different Mac Group with different gateways.'''
 The above will done by below configuration in dhcpd.conf
 # vim /etc/dhcp/dhcpd.conf
 subnet 10.0.0.0 netmask 255.255.255.0 {
		option routers			10.0.0.69;	# default router for all
		option subnet-mask		255.255.255.0;
		option domain-name	“capital.com”;
		option domain-name-servers	10.0.0.26; # IP of doimain name server
		option ntp-servers		10.0.028; 	#Already Running NTP server
		range					10.0.0.50	10.0.0.254; # IP range to be used }
 deny unknown-clients;
 group	{
			host cap1 {	hardware ethernet		00:18:F3:1D:53:E9; } # Windows 7 Machine Test
			host cap2 { hardware ethernet		00:18:F3:1F:53:W9; } # Description ANY
			option routers		10.0.0.61; # Specific gateways for the above MAC address }
 group 	{
			host capd1 { hardware ethernet		F8:0F:41:A6:62:A0; } # joined Machine 1 test
			host capd2 { hardware ethernet		F8:0F:4E:A6:6G:A0; } # joined Machine 2 test }

 :wq # to save and exit
 '''Note''' : Be careful before doing any change on the above file as this is very imortant file befor editing always take a backup then edit save and restart the server and check if no issues then remove the backup , if having any issue you have done something wrong revert back with backup file and check to understand what you have done wrong is still having Issue let us know will take the remote session and help you out.
 '''Note''' : Data will Migrate once all The Users Login to the new server it will automatically create the folders of the respective users then will Migrate the data to the respective user directory.