Chapter 4. Migrating from NIS to Identity Management
Chapter 4. Migrating from NIS to Identity Management A Network Information Service (NIS) server can contain information about users, groups, hosts, netgroups and automount maps. As a system administrator you can migrate these entry types, authentication, and authorization from NIS server to an Identity Management (IdM) server so that all user management operations are performed on the IdM server. Migrating from NIS to IdM will also allow you access to more secure protocols such as Kerberos. 4.1. Enabling NIS in IdM To allow communication between NIS and Identity Management (IdM) server, you must enable NIS compatibility options on IdM server. Prerequisites You have root access on IdM server. Procedure Enable the NIS listener and compatibility plug-ins on IdM server: Optional: For a more strict firewall configuration, set a fixed port. For example, to set the port to unused port 514 : Warning To avoid conflict with other services do not use any port number above 1024. Enable and start the port mapper service: Restart Directory Server: 4.2. Migrating user entries from NIS to IdM The NIS passwd map contains information about users, such as names, UIDs, primary group, GECOS, shell, and home directory. Use this data to migrate NIS user accounts to Identity Management (IdM): Prerequisites You have root access on NIS server. NIS is enabled in IdM. The NIS server is enrolled into IdM. You have ID ranges that can store UIDs of importing users. Procedure Install the yp-tools package: On the NIS server create the /root/nis-users.sh script with the following content: #!/bin/sh # USD1 is the NIS domain, USD2 is the primary NIS server ypcat -d USD1 -h USD2 passwd > /dev/shm/nis-map.passwd 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.passwd) ; do IFS=' ' username=USD(echo USDline | cut -f1 -d:) # Not collecting encrypted password because we need cleartext password # to create kerberos key uid=USD(echo USDline | cut -f3 -d:) gid=USD(echo USDline | cut -f4 -d:) gecos=USD(echo USDline | cut -f5 -d:) homedir=USD(echo USDline | cut -f6 -d:) shell=USD(echo USDline | cut -f7 -d:) # Now create this entry echo passw0rd1 | ipa user-add USDusername --first=NIS --last=USER \ --password --gidnumber=USDgid --uid=USDuid --gecos="USDgecos" --homedir=USDhomedir \ --shell=USDshell ipa user-show USDusername done Authenticate as the IdM admin user: Run the script. For example: Important This script uses hard-coded values for first name, last name, and sets the password to passw0rd1 . The user must change the temporary password at the login. 4.3. Migrating user group from NIS to IdM The NIS group map contains information about groups, such as group names, GIDs, or group members. Use this data to migrate NIS groups to Identity Management (IdM): Prerequisites You have root access on NIS server. NIS is enabled in IdM. The NIS server is enrolled into IdM. Procedure Install the yp-tools package: Create the /root/nis-groups.sh script with the following content on the NIS server: #!/bin/sh # USD1 is the NIS domain, USD2 is the primary NIS server ypcat -d USD1 -h USD2 group > /dev/shm/nis-map.group 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.group); do IFS=' ' groupname=USD(echo USDline | cut -f1 -d:) # Not collecting encrypted password because we need cleartext password # to create kerberos key gid=USD(echo USDline | cut -f3 -d:) members=USD(echo USDline | cut -f4 -d:) # Now create this entry ipa group-add USDgroupname --desc=NIS_GROUP_USDgroupname --gid=USDgid if [ -n "USDmembers" ]; then ipa group-add-member USDgroupname --users={USDmembers} fi ipa group-show USDgroupname done Authenticate as the IdM admin user: Run the script. For example: 4.4. Migrating host entries from NIS to IdM The NIS hosts map contains information about hosts, such as host names and IP addresses. Use this data to migrate NIS host entries to Identity Management (IdM): Note When you create a host group in IdM, a corresponding shadow NIS group is automatically created. Do not use the ipa netgroup-* commands on these shadow NIS groups. Use the ipa netgroup-* commands only to manage native netgroups created via the netgroup-add command. Prerequisites You have root access on NIS server. NIS is enabled in IdM. The NIS server is enrolled into IdM. Procedure Install the yp-tools package: Create the /root/nis-hosts.sh script with the following content on the NIS server: #!/bin/sh # USD1 is the NIS domain, USD2 is the primary NIS server ypcat -d USD1 -h USD2 hosts | egrep -v "localhost|127.0.0.1" > /dev/shm/nis-map.hosts 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.hosts); do IFS=' ' ipaddress=USD(echo USDline | awk '{print USD1}') hostname=USD(echo USDline | awk '{print USD2}') primary=USD(ipa env xmlrpc_uri | tr -d '[:space:]' | cut -f3 -d: | cut -f3 -d/) domain=USD(ipa env domain | tr -d '[:space:]' | cut -f2 -d:) if [ USD(echo USDhostname | grep "\." |wc -l) -eq 0 ] ; then hostname=USD(echo USDhostname.USDdomain) fi zone=USD(echo USDhostname | cut -f2- -d.) if [ USD(ipa dnszone-show USDzone 2>/dev/null | wc -l) -eq 0 ] ; then ipa dnszone-add --name-server=USDprimary --admin-email=root.USDprimary fi ptrzone=USD(echo USDipaddress | awk -F. '{print USD3 "." USD2 "." USD1 ".in-addr.arpa."}') if [ USD(ipa dnszone-show USDptrzone 2>/dev/null | wc -l) -eq 0 ] ; then ipa dnszone-add USDptrzone --name-server=USDprimary --admin-email=root.USDprimary fi # Now create this entry ipa host-add USDhostname --ip-address=USDipaddress ipa host-show USDhostname done Authenticate as the IdM admin user: Run the script. For example: Note This script does not migrate special host configurations, such as aliases. 4.5. Migrating netgroup entries from NIS to IdM The NIS netgroup map contains information about netgroups. Use this data to migrate NIS netgroups to Identity Management (IdM): Prerequisites You have root access on NIS server. NIS is enabled in IdM. The NIS server is enrolled into IdM. Procedure Install the yp-tools package: Create the /root/nis-netgroups.sh script with the following content on the NIS server: #!/bin/sh # USD1 is the NIS domain, USD2 is the primary NIS server ypcat -k -d USD1 -h USD2 netgroup > /dev/shm/nis-map.netgroup 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.netgroup); do IFS=' ' netgroupname=USD(echo USDline | awk '{print USD1}') triples=USD(echo USDline | sed "s/^USDnetgroupname //") echo "ipa netgroup-add USDnetgroupname --desc=NIS_NG_USDnetgroupname" if [ USD(echo USDline | grep "(," | wc -l) -gt 0 ]; then echo "ipa netgroup-mod USDnetgroupname --hostcat=all" fi if [ USD(echo USDline | grep ",," | wc -l) -gt 0 ]; then echo "ipa netgroup-mod USDnetgroupname --usercat=all" fi for triple in USDtriples; do triple=USD(echo USDtriple | sed -e 's/-//g' -e 's/(//' -e 's/)//') if [ USD(echo USDtriple | grep ",.*," | wc -l) -gt 0 ]; then hostname=USD(echo USDtriple | cut -f1 -d,) username=USD(echo USDtriple | cut -f2 -d,) domain=USD(echo USDtriple | cut -f3 -d,) hosts=""; users=""; doms=""; [ -n "USDhostname" ] && hosts="--hosts=USDhostname" [ -n "USDusername" ] && users="--users=USDusername" [ -n "USDdomain" ] && doms="--nisdomain=USDdomain" echo "ipa netgroup-add-member USDnetgroup USDhosts USDusers USDdoms" else netgroup=USDtriple echo "ipa netgroup-add USDnetgroup --desc=<NIS_NG>_USDnetgroup" fi done done Authenticate as the IdM admin user: Run the script. For example: 4.6. Migrating automount maps from NIS to IdM Automount maps are a series of nested and interrelated entries that define the location (the parent entry), the associated keys, and maps. To migrate NIS automount maps to Identity Management (IdM): Prerequisites You have root access on NIS server. NIS is enabled in IdM. The NIS server is enrolled into IdM. Procedure Install the yp-tools package: Create the /root/nis-automounts.sh script with the following content on the NIS server: #!/bin/sh # USD1 is for the automount entry in ipa ipa automountlocation-add USD1 # USD2 is the NIS domain, USD3 is the primary NIS server, USD4 is the map name ypcat -k -d USD2 -h USD3 USD4 > /dev/shm/nis-map.USD4 2>&1 ipa automountmap-add USD1 USD4 basedn=USD(ipa env basedn | tr -d '[:space:]' | cut -f2 -d:) cat > /tmp/amap.ldif <<EOF dn: nis-domain=USD2+nis-map=USD4,cn=NIS Server,cn=plugins,cn=config objectClass: extensibleObject nis-domain: USD2 nis-map: USD4 nis-base: automountmapname=USD4,cn=USD1,cn=automount,USDbasedn nis-filter: (objectclass=\*) nis-key-format: %{automountKey} nis-value-format: %{automountInformation} EOF # USD5 is the LDAP server ldapadd -x -h USD5 -D "cn=Directory Manager" -W -f /tmp/amap.ldif IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.USD4); do IFS=" " key=USD(echo "USDline" | awk '{print USD1}') info=USD(echo "USDline" | sed -e "s^USDkey[ \t]*") ipa automountkey-add nis USD4 --key="USDkey" --info="USDinfo" done Note The script exports the NIS automount information, generates an LDAP Data Interchange Format (LDIF) for the automount location and associated map, and imports the LDIF file into the IdM Directory Server. Authenticate as the IdM admin user: Run the script. For example:
ipa-nis-manage enable ipa-compat-manage enable ldapmodify -x -D 'cn=directory manager' -W dn: cn=NIS Server,cn=plugins,cn=config changetype: modify add: nsslapd-pluginarg0 nsslapd-pluginarg0: 514 systemctl enable rpcbind.service systemctl start rpcbind.service systemctl restart dirsrv.target dnf install yp-tools -y #!/bin/sh USD1 is the NIS domain, USD2 is the primary NIS server ypcat -d USD1 -h USD2 passwd > /dev/shm/nis-map.passwd 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.passwd) ; do IFS=' ' username=USD(echo USDline | cut -f1 -d:) # Not collecting encrypted password because we need cleartext password # to create kerberos key uid=USD(echo USDline | cut -f3 -d:) gid=USD(echo USDline | cut -f4 -d:) gecos=USD(echo USDline | cut -f5 -d:) homedir=USD(echo USDline | cut -f6 -d:) shell=USD(echo USDline | cut -f7 -d:) # Now create this entry echo passw0rd1 | ipa user-add USDusername --first=NIS --last=USER --password --gidnumber=USDgid --uid=USDuid --gecos="USDgecos" --homedir=USDhomedir --shell=USDshell ipa user-show USDusername done kinit admin sh /root/nis-users.sh nisdomain nis-server.example.com dnf install yp-tools -y #!/bin/sh USD1 is the NIS domain, USD2 is the primary NIS server ypcat -d USD1 -h USD2 group > /dev/shm/nis-map.group 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.group); do IFS=' ' groupname=USD(echo USDline | cut -f1 -d:) # Not collecting encrypted password because we need cleartext password # to create kerberos key gid=USD(echo USDline | cut -f3 -d:) members=USD(echo USDline | cut -f4 -d:) # Now create this entry ipa group-add USDgroupname --desc=NIS_GROUP_USDgroupname --gid=USDgid if [ -n "USDmembers" ]; then ipa group-add-member USDgroupname --users={USDmembers} fi ipa group-show USDgroupname done kinit admin sh /root/nis-groups.sh nisdomain nis-server.example.com dnf install yp-tools -y #!/bin/sh USD1 is the NIS domain, USD2 is the primary NIS server ypcat -d USD1 -h USD2 hosts | egrep -v "localhost|127.0.0.1" > /dev/shm/nis-map.hosts 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.hosts); do IFS=' ' ipaddress=USD(echo USDline | awk '{print USD1}') hostname=USD(echo USDline | awk '{print USD2}') primary=USD(ipa env xmlrpc_uri | tr -d '[:space:]' | cut -f3 -d: | cut -f3 -d/) domain=USD(ipa env domain | tr -d '[:space:]' | cut -f2 -d:) if [ USD(echo USDhostname | grep "\." |wc -l) -eq 0 ] ; then hostname=USD(echo USDhostname.USDdomain) fi zone=USD(echo USDhostname | cut -f2- -d.) if [ USD(ipa dnszone-show USDzone 2>/dev/null | wc -l) -eq 0 ] ; then ipa dnszone-add --name-server=USDprimary --admin-email=root.USDprimary fi ptrzone=USD(echo USDipaddress | awk -F. '{print USD3 "." USD2 "." USD1 ".in-addr.arpa."}') if [ USD(ipa dnszone-show USDptrzone 2>/dev/null | wc -l) -eq 0 ] ; then ipa dnszone-add USDptrzone --name-server=USDprimary --admin-email=root.USDprimary fi # Now create this entry ipa host-add USDhostname --ip-address=USDipaddress ipa host-show USDhostname done kinit admin sh /root/nis-hosts.sh nisdomain nis-server.example.com dnf install yp-tools -y #!/bin/sh USD1 is the NIS domain, USD2 is the primary NIS server ypcat -k -d USD1 -h USD2 netgroup > /dev/shm/nis-map.netgroup 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.netgroup); do IFS=' ' netgroupname=USD(echo USDline | awk '{print USD1}') triples=USD(echo USDline | sed "s/^USDnetgroupname //") echo "ipa netgroup-add USDnetgroupname --desc=NIS_NG_USDnetgroupname" if [ USD(echo USDline | grep "(," | wc -l) -gt 0 ]; then echo "ipa netgroup-mod USDnetgroupname --hostcat=all" fi if [ USD(echo USDline | grep ",," | wc -l) -gt 0 ]; then echo "ipa netgroup-mod USDnetgroupname --usercat=all" fi for triple in USDtriples; do triple=USD(echo USDtriple | sed -e 's/-//g' -e 's/(//' -e 's/)//') if [ USD(echo USDtriple | grep ",.*," | wc -l) -gt 0 ]; then hostname=USD(echo USDtriple | cut -f1 -d,) username=USD(echo USDtriple | cut -f2 -d,) domain=USD(echo USDtriple | cut -f3 -d,) hosts=""; users=""; doms=""; [ -n "USDhostname" ] && hosts="--hosts=USDhostname" [ -n "USDusername" ] && users="--users=USDusername" [ -n "USDdomain" ] && doms="--nisdomain=USDdomain" echo "ipa netgroup-add-member USDnetgroup USDhosts USDusers USDdoms" else netgroup=USDtriple echo "ipa netgroup-add USDnetgroup --desc=<NIS_NG>_USDnetgroup" fi done done kinit admin sh /root/nis-netgroups.sh nisdomain nis-server.example.com dnf install yp-tools -y #!/bin/sh USD1 is for the automount entry in ipa ipa automountlocation-add USD1 USD2 is the NIS domain, USD3 is the primary NIS server, USD4 is the map name ypcat -k -d USD2 -h USD3 USD4 > /dev/shm/nis-map.USD4 2>&1 ipa automountmap-add USD1 USD4 basedn=USD(ipa env basedn | tr -d '[:space:]' | cut -f2 -d:) cat > /tmp/amap.ldif <<EOF dn: nis-domain=USD2+nis-map=USD4,cn=NIS Server,cn=plugins,cn=config objectClass: extensibleObject nis-domain: USD2 nis-map: USD4 nis-base: automountmapname=USD4,cn=USD1,cn=automount,USDbasedn nis-filter: (objectclass=\*) nis-key-format: %{automountKey} nis-value-format: %{automountInformation} EOF USD5 is the LDAP server ldapadd -x -h USD5 -D "cn=Directory Manager" -W -f /tmp/amap.ldif IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.USD4); do IFS=" " key=USD(echo "USDline" | awk '{print USD1}') info=USD(echo "USDline" | sed -e "s^USDkey[ \t]*") ipa automountkey-add nis USD4 --key="USDkey" --info="USDinfo" done kinit admin sh /root/nis-automounts.sh location nisdomain nis-server.example.com map_name