for the last few days I have been looking into migrating an old linux server running a OpenLDAP/Samba 3 configuration with about 100 users to a new SBS Server running Samba 4 (like Zentyal or UCS). Services provided will be Shares, Mail, Webmail, Calendar.

The question, which already has been asked, is how to migrate the user accounts and passwords. I do not care for automatic migration (anymore), so I will recreate all Users and Groups and settings manually.

Ideas for migrating the passwords are so far:

  1. Automatic migration with a distribution upgrade -> No SBS linux distribution offers an automatic upgrade path (shame!)
  2. Manually copying over the passwords to Samba 4 -> Does not work as OpenLDAP stores them as {SHA}
  3. Letting all users choose a new password at the help desk -> Users will kill me
  4. Upgrading the samba part with samba-tool classicuprade -> Does not work for the configuration, users are not created and resulting configuration is broken for Web Administration
  5. Reading the Passwords with Apache Directory Studio and reimplanting them into Samba 4 LDAP -> Does not work for same reason as 2
  6. Using MS Active Directory Migration Tool -> No users found on the internet running this on OpenLDAP

The best idea so far is to create a middle layer as a webservice which will be propagated by a userguide or something, where the users can change their passwords using a local account on their computers ( this exists, as Domain Integration is not very tight here ). This will only need to get the old password from the user, compare that to the OpenLDAP hash and set a new password ( new passwords are not enforced right now, so it is a good time to do that too ) on the Samba 4 (using smbpassword or sth.).

Integrating/Migrating all computers into the AD is a different task, as crucial services are listed in the intro.

I found https://code.google.com/p/pwm/, which provides a user interface for changing passwords, but no usecase for migrating passwords is available.

Does anyone have a better idea?



I am working for Univention, the manufacturer of UCS, which you mentioned, and yes, we have a solution for migrating the passwords to Samba 4 with UCS.

You can achieve this in two steps: First install UCS with Samba 3 and migrate the sambaNTPassword hashes from your OpenLDAP to the new UCS-OpenLDAP (ldapsearch and ldapmodify seems to be the most comfortable way). In a second step, you can update the UCS system from Samba 3 to Samba 4 (inplace).

Go to the Univention wiki. There is an instruction about how to migrate an existing Samba 3 installation to UCS 3 with Samba 3 at:

Univention Wiki-Migration from Samba 3 to UCS 3 with Samba 3

This procedure will also migrate all computers, so you will have both objectives cleared.

The link to the instruction about the update from Samba 3 to 4 is at:

Univention Wiki-Migration from Samba 3 to Samba 4

Regards Maren


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.