<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 04/30/2012 05:06 PM, David Copperfield wrote:
<blockquote
cite="mid:1335820007.33988.YahooMailNeo@web125702.mail.ne1.yahoo.com"
type="cite">
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255,
255); font-family: times new roman,new york,times,serif;
font-size: 12pt;">
<div class="yui_3_2_0_22_133581777564454" style="font-family:
times new roman,new york,times,serif; font-size: 12pt;"> </div>
<span>Hi folks,<br>
<br>
We have quite a bunch of netgroups which are hosted on
openldap server presently, and now it is time to migrate them
into freeIPA. The NIS triples are in the format:<br>
<br>
(-, username, - ) <br>
<br>
or <br>
<br>
(hostname001, - , - )<br>
<br>
And these openldap netgroups are used for variable purposes,
host listing for ssh/gssh, access control, sudoers, etc.<br>
<br>
So after user accounts and groups are migrated, netgroups
needs to be migrated too for openldap/IPA migration/cutover.
There is no Redhat documents on this part though. Has any one
tried netgroup migration before? Or we have to input by hand
into IPA (host, hostgroup, user-group) and replace netgroup
with hostgroup(which will create respective netgroups in the
background), and replace NIS user groups and real posix user
groups?<br>
<br>
Please advice. Thanks a lot.<br>
<br>
--David<br>
</span></div>
</blockquote>
We do not provide migration script for netgroups however it is very
simple to create a script that would recreate netgroups using IPA
command line.<br>
The reason why we do not do netgroup migration automatically is
because it is a good time to reconsider now netgroups are used in
your environment.<br>
For example if you use netgroups to group hosts we recommend you
creating a host group for those hosts. Each host group by default
has an automatically created netgroup with the same name. This can
be turned off but out of box every host group creates a netgroup. <br>
If you use netgroups for users consider switching to user groups
rather than using netgroups for users. Using user groups is more
flexible and preferred method.<br>
<br>
Also see chapter 7. It has examples of the scripts that can help you
to migrate netgroups.<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>