21.5. Migrating from NIS to IdM Migrating from an existing NIS server to Identity Management (IdM) requires the following steps: Enable the NIS Listener in Identity Management Export and import the existing data from NIS 21.5.1. Preparing Netgroup Entries in IdM Before migrating, identify what kind of identities are being managed in the current NIS server: User Entries Determine what applications are using the user information provided by NIS. While some utilities, such as sudo , require NIS netgroups, several others can use regular UNIX groups. To migrate: Create the corresponding user accounts in IdM. See Section 21.5.3.1, "Migrating User Entries" . If you additionally require netgroups: Add the netgroups. See Section 21.3.1, "Adding a Netgroup" . Add the users to the netgroups. See Section 21.5.3.4, "Migrating Netgroup Entries" . Host Entries When you create a host group in IdM, a corresponding shadow NIS group is automatically created. Do not use the ipa netgroup-* commands on these shadow NIS groups. Use the ipa netgroup-* commands only to manage native netgroups created via the netgroup-add command. For a Direct Conversion If every user and host entry must use the same name, you can create the entries using the same names in IdM: Create an entry for every user referenced in a netgroup. Create an entry for every host referenced in a netgroup. Create a netgroup with the same name as the original netgroup. Add the users and hosts as direct members of the netgroup. If the users and hosts are members of groups or host groups, you can alternatively add these groups to the netgroup. 21.5.2. Enabling the NIS Listener in Identity Management See Section 21.2, "Enabling NIS in Identity Management" . 21.5.3. Exporting and Importing the Existing NIS Data A NIS server can contain information about users, groups, hosts, netgroups, and automount maps. You can migrate these entry types to IdM. In the following sections, we export the data from the current NIS server using the ypcat command, and use the output to import the entries to IdM using the corresponding ipa *-add commands. Make sure you install the yp-tools package, since it provides the ypcat command used in the migration script: 21.5.3.1. Migrating User Entries The NIS passwd map contains information about users, such as names, UIDs, primary group, GECOS, shell, and home directory. Use this data to migrate NIS user accounts to IdM: Optional : If you require weak password support, see Section 21.5.4, "Enabling Weak Password Hashing for NIS User Authentication" . Create the /root/nis-users.sh script with the following content: #!/bin/sh # USD1 is the NIS domain, USD2 is the NIS master server ypcat -d USD1 -h USD2 passwd > /dev/shm/nis-map.passwd 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.passwd) ; do IFS=' ' username=USD(echo USDline | cut -f1 -d:) # Not collecting encrypted password because we need cleartext password # to create kerberos key uid=USD(echo USDline | cut -f3 -d:) gid=USD(echo USDline | cut -f4 -d:) gecos=USD(echo USDline | cut -f5 -d:) homedir=USD(echo USDline | cut -f6 -d:) shell=USD(echo USDline | cut -f7 -d:) # Now create this entry echo passw0rd1 | ipa user-add USDusername --first=NIS --last=USER \ --password --gidnumber=USDgid --uid=USDuid --gecos="USDgecos" --homedir=USDhomedir \ --shell=USDshell ipa user-show USDusername done Authenticate as the IdM admin user: Run the script. For example: Note This script uses hard-coded values for first name, last name, and sets the password to passw0rd1 . The user must change the temporary password at the log in. 21.5.3.2. Migrating Group Entries The NIS group map contains information about groups, such as group names, GIDs, or group members. Use this data to migrate NIS groups to IdM: Create the /root/nis-groups.sh script with the following content: #!/bin/sh # USD1 is the NIS domain, USD2 is the NIS master server ypcat -d USD1 -h USD2 group > /dev/shm/nis-map.group 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.group); do IFS=' ' groupname=USD(echo USDline | cut -f1 -d:) # Not collecting encrypted password because we need cleartext password # to create kerberos key gid=USD(echo USDline | cut -f3 -d:) members=USD(echo USDline | cut -f4 -d:) # Now create this entry ipa group-add USDgroupname --desc=NIS_GROUP_USDgroupname --gid=USDgid if [ -n "USDmembers" ]; then ipa group-add-member USDgroupname --users={USDmembers} fi ipa group-show USDgroupname done Authenticate as the IdM admin user: Run the script. For example: 21.5.3.3. Migrating Host Entries The NIS hosts map contains information about hosts, such as host names and IP addresses. Use this data to migrate NIS host entries to IdM: Create the /root/nis-hosts.sh script with the following content: #!/bin/sh # USD1 is the NIS domain, USD2 is the NIS master server ypcat -d USD1 -h USD2 hosts | egrep -v "localhost|127.0.0.1" > /dev/shm/nis-map.hosts 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.hosts); do IFS=' ' ipaddress=USD(echo USDline | awk '{print USD1}') hostname=USD(echo USDline | awk '{print USD2}') master=USD(ipa env xmlrpc_uri | tr -d '[:space:]' | cut -f3 -d: | cut -f3 -d/) domain=USD(ipa env domain | tr -d '[:space:]' | cut -f2 -d:) if [ USD(echo USDhostname | grep "\." |wc -l) -eq 0 ] ; then hostname=USD(echo USDhostname.USDdomain) fi zone=USD(echo USDhostname | cut -f2- -d.) if [ USD(ipa dnszone-show USDzone 2>/dev/null | wc -l) -eq 0 ] ; then ipa dnszone-add --name-server=USDmaster --admin-email=root.USDmaster fi ptrzone=USD(echo USDipaddress | awk -F. '{print USD3 "." USD2 "." USD1 ".in-addr.arpa."}') if [ USD(ipa dnszone-show USDptrzone 2>/dev/null | wc -l) -eq 0 ] ; then ipa dnszone-add USDptrzone --name-server=USDmaster --admin-email=root.USDmaster fi # Now create this entry ipa host-add USDhostname --ip-address=USDipaddress ipa host-show USDhostname done Authenticate as the IdM admin user: Run the script. For example: Note This script does not migrate special host configurations, such as aliases. 21.5.3.4. Migrating Netgroup Entries The NIS netgroup map contains information about netgroups. Use this data to migrate NIS netgroups to IdM: Create the /root/nis-netgroups.sh script with the following content: #!/bin/sh # USD1 is the NIS domain, USD2 is the NIS master server ypcat -k -d USD1 -h USD2 netgroup > /dev/shm/nis-map.netgroup 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.netgroup); do IFS=' ' netgroupname=USD(echo USDline | awk '{print USD1}') triples=USD(echo USDline | sed "s/^USDnetgroupname //") echo "ipa netgroup-add USDnetgroupname --desc=NIS_NG_USDnetgroupname" if [ USD(echo USDline | grep "(," | wc -l) -gt 0 ]; then echo "ipa netgroup-mod USDnetgroupname --hostcat=all" fi if [ USD(echo USDline | grep ",," | wc -l) -gt 0 ]; then echo "ipa netgroup-mod USDnetgroupname --usercat=all" fi for triple in USDtriples; do triple=USD(echo USDtriple | sed -e 's/-//g' -e 's/(//' -e 's/)//') if [ USD(echo USDtriple | grep ",.*," | wc -l) -gt 0 ]; then hostname=USD(echo USDtriple | cut -f1 -d,) username=USD(echo USDtriple | cut -f2 -d,) domain=USD(echo USDtriple | cut -f3 -d,) hosts=""; users=""; doms=""; [ -n "USDhostname" ] && hosts="--hosts=USDhostname" [ -n "USDusername" ] && users="--users=USDusername" [ -n "USDdomain" ] && doms="--nisdomain=USDdomain" echo "ipa netgroup-add-member USDnetgroup USDhosts USDusers USDdoms" else netgroup=USDtriple echo "ipa netgroup-add USDnetgroup --desc=NIS_NG_USDnetgroup" fi done done Authenticate as the IdM admin user: Run the script. For example: 21.5.3.5. Migrating Automount Maps Automount maps are a series of nested and interrelated entries that define the location (the parent entry), the associated keys, and maps. To migrate NIS automount maps to IdM: Create the /root/nis-automounts.sh script with the following content: #!/bin/sh # USD1 is for the automount entry in ipa ipa automountlocation-add USD1 # USD2 is the NIS domain, USD3 is the NIS master server, USD4 is the map name ypcat -k -d USD2 -h USD3 USD4 > /dev/shm/nis-map.USD4 2>&1 ipa automountmap-add USD1 USD4 basedn=USD(ipa env basedn | tr -d '[:space:]' | cut -f2 -d:) cat > /tmp/amap.ldif <<EOF dn: nis-domain=USD2+nis-map=USD4,cn=NIS Server,cn=plugins,cn=config objectClass: extensibleObject nis-domain: USD2 nis-map: USD4 nis-base: automountmapname=USD4,cn=USD1,cn=automount,USDbasedn nis-filter: (objectclass=*) nis-key-format: %{automountKey} nis-value-format: %{automountInformation} EOF ldapadd -x -h USD3 -D "cn=Directory Manager" -W -f /tmp/amap.ldif IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.USD4); do IFS=" " key=USD(echo "USDline" | awk '{print USD1}') info=USD(echo "USDline" | sed -e "s#^USDkey[ \t]*##") ipa automountkey-add nis USD4 --key="USDkey" --info="USDinfo" done The script exports the NIS automount information, generates an LDAP Data Interchange Format (LDIF) for the automount location and associated map, and imports the LDIF file into the IdM Directory Server. For further details, see Section 21.4, "Exposing Automount Maps to NIS Clients" . Authenticate as the IdM admin user: Run the script. For example: 21.5.4. Enabling Weak Password Hashing for NIS User Authentication Using the Directory Server component's default setting, passwords stored in the userPassword attribute are hashed using the salted secure hash algorithm (SSHA). If your NIS clients require a weak hashing algorithm for passwords, update the password storage scheme setting. Enabling a weak password hashing scheme affects only passwords stored in userPassword attribute. Note that Kerberos does not use this attribute and therefore Kerberos encryption is not affected by this setting. For example, to enable CRYPT hashed passwords: Note Because password hashes cannot be decrypted, Directory Server does not convert existing password hashes. The server applies the new password storage only to passwords set after you changed the storage scheme.

Commands:
yum install yp-tools -y
#!/bin/sh USD1 is the NIS domain, USD2 is the NIS master server ypcat -d USD1 -h USD2 passwd > /dev/shm/nis-map.passwd 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.passwd) ; do IFS=' ' username=USD(echo USDline | cut -f1 -d:) # Not collecting encrypted password because we need cleartext password # to create kerberos key uid=USD(echo USDline | cut -f3 -d:) gid=USD(echo USDline | cut -f4 -d:) gecos=USD(echo USDline | cut -f5 -d:) homedir=USD(echo USDline | cut -f6 -d:) shell=USD(echo USDline | cut -f7 -d:) # Now create this entry echo passw0rd1 | ipa user-add USDusername --first=NIS --last=USER --password --gidnumber=USDgid --uid=USDuid --gecos="USDgecos" --homedir=USDhomedir --shell=USDshell ipa user-show USDusername done
kinit admin
sh /root/nis-users.sh nisdomain nis-master.example.com
#!/bin/sh USD1 is the NIS domain, USD2 is the NIS master server ypcat -d USD1 -h USD2 group > /dev/shm/nis-map.group 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.group); do IFS=' ' groupname=USD(echo USDline | cut -f1 -d:) # Not collecting encrypted password because we need cleartext password # to create kerberos key gid=USD(echo USDline | cut -f3 -d:) members=USD(echo USDline | cut -f4 -d:) # Now create this entry ipa group-add USDgroupname --desc=NIS_GROUP_USDgroupname --gid=USDgid if [ -n "USDmembers" ]; then ipa group-add-member USDgroupname --users={USDmembers} fi ipa group-show USDgroupname done
kinit admin
sh /root/nis-groups.sh nisdomain nis-master.example.com
#!/bin/sh USD1 is the NIS domain, USD2 is the NIS master server ypcat -d USD1 -h USD2 hosts | egrep -v "localhost|127.0.0.1" > /dev/shm/nis-map.hosts 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.hosts); do IFS=' ' ipaddress=USD(echo USDline | awk '{print USD1}') hostname=USD(echo USDline | awk '{print USD2}') master=USD(ipa env xmlrpc_uri | tr -d '[:space:]' | cut -f3 -d: | cut -f3 -d/) domain=USD(ipa env domain | tr -d '[:space:]' | cut -f2 -d:) if [ USD(echo USDhostname | grep "\." |wc -l) -eq 0 ] ; then hostname=USD(echo USDhostname.USDdomain) fi zone=USD(echo USDhostname | cut -f2- -d.) if [ USD(ipa dnszone-show USDzone 2>/dev/null | wc -l) -eq 0 ] ; then ipa dnszone-add --name-server=USDmaster --admin-email=root.USDmaster fi ptrzone=USD(echo USDipaddress | awk -F. '{print USD3 "." USD2 "." USD1 ".in-addr.arpa."}') if [ USD(ipa dnszone-show USDptrzone 2>/dev/null | wc -l) -eq 0 ] ; then ipa dnszone-add USDptrzone --name-server=USDmaster --admin-email=root.USDmaster fi # Now create this entry ipa host-add USDhostname --ip-address=USDipaddress ipa host-show USDhostname done
kinit admin
sh /root/nis-hosts.sh nisdomain nis-master.example.com
#!/bin/sh USD1 is the NIS domain, USD2 is the NIS master server ypcat -k -d USD1 -h USD2 netgroup > /dev/shm/nis-map.netgroup 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.netgroup); do IFS=' ' netgroupname=USD(echo USDline | awk '{print USD1}') triples=USD(echo USDline | sed "s/^USDnetgroupname //") echo "ipa netgroup-add USDnetgroupname --desc=NIS_NG_USDnetgroupname" if [ USD(echo USDline | grep "(," | wc -l) -gt 0 ]; then echo "ipa netgroup-mod USDnetgroupname --hostcat=all" fi if [ USD(echo USDline | grep ",," | wc -l) -gt 0 ]; then echo "ipa netgroup-mod USDnetgroupname --usercat=all" fi for triple in USDtriples; do triple=USD(echo USDtriple | sed -e 's/-//g' -e 's/(//' -e 's/)//') if [ USD(echo USDtriple | grep ",.*," | wc -l) -gt 0 ]; then hostname=USD(echo USDtriple | cut -f1 -d,) username=USD(echo USDtriple | cut -f2 -d,) domain=USD(echo USDtriple | cut -f3 -d,) hosts=""; users=""; doms=""; [ -n "USDhostname" ] && hosts="--hosts=USDhostname" [ -n "USDusername" ] && users="--users=USDusername" [ -n "USDdomain" ] && doms="--nisdomain=USDdomain" echo "ipa netgroup-add-member USDnetgroup USDhosts USDusers USDdoms" else netgroup=USDtriple echo "ipa netgroup-add USDnetgroup --desc=NIS_NG_USDnetgroup" fi done done
kinit admin
sh /root/nis-netgroups.sh nisdomain nis-master.example.com
#!/bin/sh USD1 is for the automount entry in ipa ipa automountlocation-add USD1 USD2 is the NIS domain, USD3 is the NIS master server, USD4 is the map name ypcat -k -d USD2 -h USD3 USD4 > /dev/shm/nis-map.USD4 2>&1 ipa automountmap-add USD1 USD4 basedn=USD(ipa env basedn | tr -d '[:space:]' | cut -f2 -d:) cat > /tmp/amap.ldif <<EOF dn: nis-domain=USD2+nis-map=USD4,cn=NIS Server,cn=plugins,cn=config objectClass: extensibleObject nis-domain: USD2 nis-map: USD4 nis-base: automountmapname=USD4,cn=USD1,cn=automount,USDbasedn nis-filter: (objectclass=*) nis-key-format: %{automountKey} nis-value-format: %{automountInformation} EOF ldapadd -x -h USD3 -D "cn=Directory Manager" -W -f /tmp/amap.ldif IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.USD4); do IFS=" " key=USD(echo "USDline" | awk '{print USD1}') info=USD(echo "USDline" | sed -e "s#^USDkey[ \t]*##") ipa automountkey-add nis USD4 --key="USDkey" --info="USDinfo" done
kinit admin
sh /root/nis-automounts.sh location nisdomain nis-master.example.com map_name
ldapmodify -D "cn=Directory Manager" -W -p 389 -h ipaserver.example.com -x dn: cn=config changetype: modify replace: passwordStorageScheme passwordStorageScheme: crypt