Upgrade paths to ns7

[davidep (Davide Principi)]

I know from past requests in this forum that many of you are interested in this topic

My goals are (in order of precedence)

1. restore from backup of ns6
2. support for the migration-import procedure for SME Server 8 (and 9?) / Nethesis NethService 8
3. in-place upgrade of ns6 (that could benefit from reaching goal 1)

I wrote down some notes on the wiki, and I would very happy to receive your feedback and contributions along with further requirements!

http://wiki.nethserver.org/doku.php?id=developer:ns7_upgrade

[davidep (Davide Principi)]

1. restore from backup of ns6

Well, there are some things to fix, but I succeeded on restoring a backup-config from ns6 to Samba Active Directory!

The challenging part is the User and Group module. I started with a “do-nothing” strategy

The restore procedure installs all modules listed by the backup, including nethserver-directory. In the end, ns7 has a running OpenLDAP instance with old accounts. That’s fine if OpenLDAP is the desired account provider. But I did something more:

1. removed nethserver-directory: rpm -e nethserver-directory
2. install nethserver-dc and configure things by hand to avoid initial domain provision
3. copy secrets.tdb and smb.conf from ns6 into nsdc, under a temporary location, say /srv
4. delete any primary group node from the ou=Groups branch, in LDAP. Samba does not accept a group that is named like an user!
5. adjust LDAP ACLs, to allow samba access from nsdc IP
6. log on nsdc and run classic upgrade with custom smb.conf and secrets.tdb
7. run sssd join procedure manually

The users’ passwords and groups compositions were migrated correctly. I still have to check workstation accounts.

I listed this procedure as “Solution 3” on

http://wiki.nethserver.org/doku.php?id=developer:ns7_upgrade#issue_2_-_nethserver-dc

[davidep (Davide Principi)]

1. restore from backup of ns6 (part II)

The user name format changed from the traditional ns6 username format, to the sssd upstream default username@domain format. As we’ve seen here, this is an issue for everyone trying to log on the machine with samba or ssh, or even the server-manager: the @domain suffix is frequently omitted and nothing works as expected.

Moreover, when migrating from an existing ns6 environment, any network client is configured with the traditional username format, and for this reason it should be reconfigured

Luckily there’s a workaround for this! My first experiments with, ssh, postfix, dovecot, ejabberd and webtop4 are encouraging!

http://wiki.nethserver.org/doku.php?id=developer:ns7_upgrade#issue_5_-_pam-based_services

The configuration seems compatible with ns6 and ns7 (OpenLDAP). The nethserver-dc module still requires testing.

[mark_nl (Mark Verlinde)]

For nethserver-sogo the MySQl db still indexes users on the short username (ie Ldap:uid AD: sAMAccountName)

This makes migration less complicated, user entry’s for SOGo in MySQL don’t have to be renamed.
Can be done if necessary.

[EddieA (Eddie Atherton)]

Slightly off topic, but it fits in with the comments by @davidep above about handling users.

The change to the sssd format is possibly going to cause issues to people like me, and others, who run Plex, plus possibly @rolf, who asked some questions about running squeezebox, where the software assumes it can add a user, then runs as that user and access it’s data, which quite possibly is on a Samba shared location, where access has been granted.

Cheers.

[davidep (Davide Principi)]

where the software assumes it can add a user

If the added user has /etc/passwd as backend, there should not be any big issue as long as the filesystem owner is preserved on the Samba shared folder.

[EddieA (Eddie Atherton)]

But the filesystem owner isn’t the user added to /etc/passwd.

It relies on that owner being part of a filesharing group that is given permissions.

Cheers.

[davidep (Davide Principi)]

Sorry we’re going too far, I don’t get you: probably I’m missing something important!

Would you mind opening a new topic or pointing me to an existing one?

[davidep (Davide Principi)]

The nethserver-dc module still requires testing.

Good news! I confirm we can use “short usernames” on nethserver-dc, too: @EddieA

[root@nethservice ~]# getent passwd administrator
administrator:*:408400500:408400513:Administrator:/var/lib/nethserver/home/administrator:/usr/libexec/openssh/sftp-server
[root@nethservice ~]# getent passwd administrator@nethesis.it
administrator@nethesis.it:*:408400500:408400513:Administrator:/var/lib/nethserver/home/administrator:/usr/libexec/openssh/sftp-server

[EddieA (Eddie Atherton)]

Do I need to wait for an update to test this:

[root@Nethserver-Beta ~]# getent passwd eddie
[root@Nethserver-Beta ~]# getent passwd eddie@bogolinux.net
eddie@BogoLinux.net:*:1736601105:1736600513:eddie:/var/lib/nethserver/home/eddie:/bin/bash
[root@Nethserver-Beta ~]#

Cheers.

[davidep (Davide Principi)]

Do I need to wait for an update to test this:

Yes, it has not been released. Meanwhile you could modify sssd.conf by hand and restart sssd daemon, following the example on the wiki page:

http://wiki.nethserver.org/doku.php?id=developer:ns7_upgrade#issue_5_-_pam-based_services

[EddieA (Eddie Atherton)]

@davidep
Thank you. That appears to work perfectly, once I’d convinced the Plex configuration that it’s id really doesn’t have to be, or need to be, in a group called plex in order for systemd to start it. And I can add plex to my filesharing group.

I did see one error thrown though, but it didn’t seem to cause any issues:

Nov  3 10:00:12 Nethserver-Beta esmith::event[2809]: ERROR(exception): Failed to remove members "Domain,Guests,Guest" from group "fileshare" - Unable to find "Domain". Operation cancelled.
Nov  3 10:00:12 Nethserver-Beta esmith::event[2809]:  File "/usr/lib64/python2.7/site-packages/samba/netcmd/group.py", line 278, in run
Nov  3 10:00:12 Nethserver-Beta esmith::event[2809]:    add_members_operation=False)
Nov  3 10:00:12 Nethserver-Beta esmith::event[2809]:  File "/usr/lib64/python2.7/site-packages/samba/samdb.py", line 274, in add_remove_group_members
Nov  3 10:00:12 Nethserver-Beta esmith::event[2809]:    raise Exception('Unable to find "%s". Operation cancelled.' % member)
Nov  3 10:00:13 Nethserver-Beta esmith::event[2809]: Added members to group fileshare
Nov  3 10:00:13 Nethserver-Beta esmith::event[2809]: [ERROR] Failed to update the members list of group fileshare at /etc/e-smith/events/group-modify/S40nethserver-dc-group-modify line 80.
Nov  3 10:00:13 Nethserver-Beta esmith::event[2809]: Action: /etc/e-smith/events/group-modify/S40nethserver-dc-group-modify FAILED: 1 [3.679111]

Cheers.

[stephdl (Stéphane de Labrusse)]

Yes, it has not been released. Meanwhile you could modify sssd.conf by hand and restart sssd daemon, following the example on the wiki page:

do you have planned something when it could be released, it might change a lot for me

[davidep (Davide Principi)]

If everything is fine, we’ll ship it with rc2. A testing package next week I hope!

it might change a lot for me

Did you already check out the workaround?

[stephdl (Stéphane de Labrusse)]

Did you already check out the workaround?

I did it but it doesn’t work as expected.

[root@NS7DEV2 ~]# rpm -qa nethserver-sssd
nethserver-sssd-1.0.6-1.17.gdac664a.ns7.noarch

[root@NS7DEV2 ~]# rpm -qa nethserver-directory
nethserver-directory-3.0.2-1.ns7.noarch

does it should work only with nethserver-dc

[root@NS7DEV2 ~]# getent passwd stephane
[root@NS7DEV2 ~]# getent passwd stephane@stephdl.xxx.org
stephane@stephdl.xxx.org:*:1001:1001:stephane:/var/lib/nethserver/home/stephane:/usr/libexec/openssh/sftp-server

EDIT: in fact the rpm is not the good one

[davidep (Davide Principi)]

There’s no rpm yet! The workaround is a cut-paste to sssd.conf!

[stephdl (Stéphane de Labrusse)]

Yep it was what I discovered myself

In fact no errors in logs, I can authenticate with tt-rss which relies on pam also.

It should be added ASAP

[stephdl (Stéphane de Labrusse)]

Luckily there’s a workaround for this! My first experiments with, ssh, postfix, dovecot, ejabberd and webtop4 are encouraging!

Nextcloud also works with nethserver-directory and the sssd trick

[davidep (Davide Principi)]

when it could be released

A package is available from testing!

yum localinstall http://packages.nethserver.org/nethserver/7.2.1511/testing/x86_64/Packages/nethserver-sssd-1.0.6-1.9.g67cc734.ns7.noarch.rpm

Issue: Legacy short user name support

[dnutan (Marc)]

As a side note a clear statement on deprecated/replaced packages, and migration between them might be helpful when the final version is released, extending the present release notes.

Upgrade from v6.x to v7, and maintenance period of current packages (this might already been answered somewhere).

This will fill the gaps on common questions like, for instance,

Migrating from owncloud to nextcloud

NethServer Version: 6.8 Module: owncloud Hello everyone. From what i've seen NS7 will support nextcloud. If i get it right that means owncloud support will be droped. I'm currently on version 6.8 which uses owncloud so does that mean that when the update to 7 comes it will automatically switch to nextcloud? Will i have to do something manually? Will it keep owncloud without any more updates? I haven't figured out yet from searching around how this is going to happen exactly.