We're trying to bring a new 2.7GHz G5 Tiger server online to replace our
current older G5 Panther (10.3.8) server. I wanted to bring accounts
and data across without having to recreate all 1800 users. I'm stymied
now with passwords.
I used the methodology described in afp548.com, "Migrating LDAP Users
and Passwords to a Clean 10.4 Server":
I used slapcat to create and ldif file, then slapadd to add them to the
new server's LDAP database. I did all the tweaks that the article
recommended, such as removing old root and admin accounts, replacing
every instance of "structuralObjectClass: inetOrgPerson" with "sn: 99",
and replacing every instance of the old RSA key with the new one
cut-and-pasted from "mkpasswd -dump" on the new server.
I copied all the user directories from the old server to the new one.
Retrospect turned out to be a failure, and I ended up using rsyncx (a
tweaked rsync that handles resource forks), though it too crashed
frequently and crashed my Panther server a couple of times. I found I
had to sync one main subdirectory at a time to make it work -- rsync'ing
onto a 1TB external FW drive, then moving the drive to the new server
and again rsync'ing onto the new server.
Now none of the new accounts can authenticate on the new server.
One possible problem: the afp548 article talks about having Kerberos
running first on the new server or it won't work. I assumed this would
only apply if Kerberos was running on the old server, too. It wasn't,
so I ignored this warning; I didn't intend to use Kerberos on the new
server either.
I'm also finding that the passwd command doesn't work at all on the new
server, for either new accounts or for accounts I create via WGM. Very odd.
Does Tiger actually require Kerberos? I'd just as soon not use it if
possible; it adds an extra layer of complication in an environment that
probably doesn't really need it.
Does the fact that I'm running 10.3.8 rather than .9 on the old server
make a difference?
I've been thrashing on this thing for WAY too long. Any advice on
getting passwords to sync up with the users would be greatly appreciated.
Doug Riddels Technology Support Technician
360.596.7315 Olympia High School
mailto:email@hidden Olympia, WA
______________________________________________________
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Macos-x-server mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/macos-x-server/email@hidden
