[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Migrate from AD



--On Donnerstag, 28. März 2002 08:49 -0500 "Mark H. Wood" <mwood@IUPUI.Edu> wrote:

I don't believe that anyone has ever made a fully-functional replacement
for an AD server, because the ADS domain security model uses a proprietary
TDATA attached to the Kerberos principal record to connect the NT security
model to the Kerberos model, and they won't reveal the details of that
TDATA's format.

The PAC format has been published. See http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnkerb/htm
l/MSDN_PAC.asp

I suppose it might be possible to extract the necessary
data from a working AD server and stuff it into another Kerberos KDC
without knowing how the data were created, but I've not heard of anyone
doing it.*  Without this, Windows hosts will not be able to use domain
accounts.

If you want to dismantle your AD tree and replace it with an all-Linux
network, then the job is both easier and more difficult.  Easier because
you don't have to figure out how to work with AD's quirks, but harder
because there may be no way to transfer the passwords.  (You'd have to
extract the password hashes from an AD DC and stuff them into your new
KDC, just as in the previous paragraph.)

You can use pwdump2 to extract the password hashes and then use the lmhash support I wrote to authenticate ldap_simple_binds of those. See http://www.daasi.de/staff/norbert/thesis/

--
Norbert Klasen, Dipl.-Inform.
DAASI International GmbH                 phone: +49 7071 29 70336
Wilhelmstr. 106                          fax:   +49 7071 29 5114
72074 Tübingen                           email: norbert.klasen@daasi.de
Germany                                  web:   http://www.daasi.de