Re: [gentoo-server] Advice for LDAP migration

[Kerin Millar]

On Mon, 2003-11-17 at 16:44, aechols@××××××××××××.edu wrote:
> It sounds like your setup is (or will be) nearly identical to ours or at least
> trying to achieve the same thing.
>

Ah, very good!

> Your structure looks fine in general, but I think nss_ldap wants it a certain
> way.  Our setup looks like this
>
> dc=physics,dc=tamu,dc=edu
>         ou=People
>                 (Users with uid as the RDN, contain posixAccount,
>                  sambaAccount, and shadowAccount)
>         ou=Group
>                 (Groups with cn as the RDN, contain posixGroup)
>         ou=Computers
>                 (Samba machine trust accounts, uid as the RDN, which is
>                  the hostname and a $ at the end, i.e. ATLAS$ for
>                  atlas.physics.tamu.edu, contain posixAccount and sambaAccount)
>         ou=Hosts
>                 (Not using this one, but it can be used to replace the hosts
>                  file, contains ipHost)
>

Interesting. I shall experiment accordingly in due course.

> > Any insights or additional advice will be gratefully received as I would
> > like to get this just so before fully populating the directory and
> > attempting to configure nss_ldap and such :)
>
> In my experience, migrating user data was one of the worst parts of the whole
> thing.  The smbldap-migration tools really didn't do the job right, and in the

Yes, the tools were useful in so far as gaining some insights into how
the data should manifest itself, but I would probably enter most of the
data from scratch in any case.

> Also, I should probably warn you that we've been having problems with some
> little bug somewhere that causes nscd to crash on occasion after we got all this
> set up.  I have not been able to track it down because of the lack of debug
> information in the glibc libraries.  Since I installed non-stripped glibc libs,
> it has stopped crashing, so I'm not sure what exactly was going on.  (Yes, I
> tried rebuilding glibc without the debug first.)

I would never run a stripped glibc in any case - but thanks for the
heads up.

>
> Finally, there's the management issue.  For a while I was doing it by hand using
> LDIF files, and then we got LDAP Administrator.  It's simplified the process,
> but on the down side it's a Windows program.  Currently we're developing a new
> website as a front end to the LDAP, with user administration for us, and
> personal information entry amond other things for the users.
>

I've been using a combination of phpldapadmin (now in portage) and gq to
do the trick. I find gq to be very nice as a general LDAP management
tool, and phpldapadmin is looking quite promising also - might be worth
investigating the templates that it provides. I believe it is quite
trivial to adapt them or create new ones. There is also something called
gosa (haven't tried, but the screenshots look nice).

> As bad as I've made it sound by now, I do think it has been worth the trouble.
> I still like it better than NIS.  If you have any other questions or I left
> something out, let me know, I'll try to answer.

Much obliged, I will certainly take you up on that offer should I have
any further queries. To be honest, NIS isn't a huge issue here as the
clients consist mostely of Windows boxen but that doesn't deter me from
wanting to master the method :) The most important thing for me
initially is making it play with qmail (might move to postfix), samba,
courier-imap and several others. In any case, I shall see how I get on
over this week.

Regards,

--Kerin Francis Millar (kerframil)