Re: [gentoo-server] Advice for LDAP migration

[Thomas Smith]

Kerin Millar wrote:

>On Mon, 2003-11-17 at 16:44, aechols@××××××××××××.edu wrote:
>
>
>>>Any insights or additional advice will be gratefully received as I would
>>>like to get this just so before fully populating the directory and
>>>attempting to configure nss_ldap and such :)
>>>
>>>
>>In my experience, migrating user data was one of the worst parts of the whole
>>thing.  The smbldap-migration tools really didn't do the job right, and in the
>>
>>
>Yes, the tools were useful in so far as gaining some insights into how
>the data should manifest itself, but I would probably enter most of the
>data from scratch in any case.
>
Have you had a look at "migrationtools"? These tools allowed me to 
easily move all of my system accounts into LDAP. You simply run the 
script to export your account data (users, groups, shadow, and hosts) to 
LDIF files and import the LDIF files into LDAP. Simply "emerge 
migrationtools".

(I haven't dealt with moving SMB accounts (yet) as I'm just starting to 
get into LDAP but there may also be similar from this package.)

>>Finally, there's the management issue.  For a while I was doing it by hand using
>>LDIF files, and then we got LDAP Administrator.  It's simplified the process,
>>but on the down side it's a Windows program.  Currently we're developing a new
>>website as a front end to the LDAP, with user administration for us, and
>>personal information entry amond other things for the users.
>>
>I've been using a combination of phpldapadmin (now in portage) and gq to
>do the trick. I find gq to be very nice as a general LDAP management
>tool, and phpldapadmin is looking quite promising also - might be worth
>investigating the templates that it provides. I believe it is quite
>trivial to adapt them or create new ones. There is also something called
>gosa (haven't tried, but the screenshots look nice).
>
Yes, this package does look promising--I hadn't heard of it before. The 
one I've been looking at is Directory Administrator. I believe it's 
written in GTK--the authors have Gnome as a prerequisite for installation.

I have plans to evaluate Webmin, too, as I've heard it has a pretty nice 
LDAP interface--plus you get the added bonus of the other administration 
tools that are built into it.

>>As bad as I've made it sound by now, I do think it has been worth the trouble.
>>I still like it better than NIS.  If you have any other questions or I left
>>something out, let me know, I'll try to answer.
>>
>>
>Much obliged, I will certainly take you up on that offer should I have
>any further queries. To be honest, NIS isn't a huge issue here as the
>clients consist mostely of Windows boxen but that doesn't deter me from
>wanting to master the method :) The most important thing for me
>initially is making it play with qmail (might move to postfix), samba,
>courier-imap and several others. In any case, I shall see how I get on
>over this week.
>
This is a bit off-topic but I was using qmail for production servers 
(hosting many virtuals) and it works quite well. Problems arose when 
some of our domains started receives *huge* amounts of spam. With qmail, 
you're stuck aplying several patches to implement different types of 
functionality--some creating more restrictive policies in and of 
themselves (goodrcptto, for example, allows you to protect against 
joe-job attacks but now you have to know /exactly/ which email address 
to receive mail for--this doesn't work well for TMDA).

In either case, qmail was becoming more of a management nightmare in our 
environment. We push a lot of email and deal with large numbers of 
spammers. qmail has effectively limited our functionality and 
effectiveness for stopping spam whereas Postfix has provided us with 
/all/ the features (so far, anyway) to implement flexible spam stopping 
policies with the lowest amount of administration.

Both qmail and Postfix support LDAP, though. I've not seen any howtos 
for qmail but there's one for Postfix in their Documentation 
section--this is intended, though, to support virtual domains. If you're 
not doing virtual, you should simply be able to point Postfix at the 
LDAP server and give it the context within which to search for email 
accounts--this is my understanding from reading thePostfix READMEs. I'll 
be setting this up in the next week or two and will have a much better 
idea of the process afterwards.