Wiki

• FrontPage
• RecentChanges
• FindPage
• HelpContents
• SambaLDAP

Samba has changed its LDAP usage between Etch and Lenny. Some new attributes where added. For the users updating from Etch to Lenny we need to provide an script which adds the needed attributes automatically.

• Odd: Wrote some comments, click on comments in edit bar to toggle comments visibility.

New attributes

A diff between a LDAP tree of an Etch (terra) install of Debian Edu and a Lenny system where Samba modified the LDAP tree freely. The modifications where done on a convert from dbsam to ldap by pdbedit -i tdbsam -e ldapsam.
I'm not sure this is a valid method, it seems that pdbedit fill in the default value where an attribute is not defined. See pdbedit -Lvu <Etch_User> Where Etch_User is one with "missing" attributes, though this too may be invalid if pdbedit behaves differently with the -L option.

Only the attributes not found on Edu Etch are listed:
The comments in the table represent the attribute description as appears in The Official Samba 3.2.x HOWTO and Reference Guide and my personal view on it's implementation.

Update script of Etch -> Lenny updates

This is about a proposed update script, which needs to be written.

• The update script connects to the running LDAP daemon and walks through the tree.

  • Needs to ask for admin password.

• On every user node found it adds the missing attributes.
• Prints a short statistic on how many changes where done.

One way to add the ' sambaPwdLastSet ' attribute to all Samba users is:

 ldapsearch -xZLLLWD 'cn=admin,ou=People,dc=skole,dc=skolelinux,dc=no' \
            -b 'ou=People,dc=skole,dc=skolelinux,dc=no' \
            -s one '(&(objectClass=sambaSamAccount)(!(sambaPwdLastSet=*)))' dn \
  | sed '/.\+/a\changetype: modify\nadd:sambaPwdLastSet\nsambaPwdLastSet: 2\n-' \
  > /etc/ldap/fixamba.ldif

 ldapmodify -xZWD 'cn=admin,ou=People,dc=skole,dc=skolelinux,dc=no' \
            -f /etc/ldap/fixamba.ldif

Official docs

This section lists issues and solutions appearing in the samba official documents.

• Samba HOWTO: Chapter 9. Important and Critical Change Notes for the Samba 3.x Series

  • LDAP Changes in Samba-3.0.23

    • addition of index sambaSID sub to the slapd.conf configuration file.

  • Essential Group Mappings

    • Mappings for Windows domain groups Domain Admins, Domain Users, Domain Guests need to be created by the Samba administrator.

• Samba HOWTO: Chapter 35. Updating and Upgrading Samba

  • Quick Migration Guide

    • If there is no time to update the LDAP database, then make sure that passdb backend = ldapsam_compat is specified in the smb.conf file.

    • It is possible to migrate the old LDAP database to the new one through use of the pdbedit.

  • New Parameters
    Some of many newly introduced smb.conf options that maybe of interest.

    • ldap password sync
    • hide special files
    • hide unwriteable files
    • map read only

  • Modified Parameters (Changes in Behavior)
    Some of the changed parameters that may affect our system.

    • mangling method (set to hash2 by default)
    • passwd program

  • New Functionality

    • Changes in Behavior
      When adding machines to a Samba-2.2 controlled domain, the “add user script” was used to create the UNIX identity of the machine trust account. Samba-3 introduces a new “add machine script” that must be specified for this purpose. Samba-3 will not fall back to using the “add user script” in the absence of an “add machine script”.

    • LDAP
      This section outlines the new features effecting Samba/LDAP integration, it is relevant as a whole and is not reproduced here. It includes these topics New Schema and schema conversion, New Suffix for Searching (already implemented) and IdMap LDAP Support.