Re: [SAGE] LDAP Migration Question

[Richard Chycoski <rskiadmin@chycoski.com>]

This is a very real problem. When we integrate a nonstandard system (say, 
from an acquisition), our script first extracts all of the existing files' 
uid and gid data, then the script can rationally flip uids and gids for all 
files, including those with conflicts.


There are other issues in mixed environments - default GIDs, default shells, 
and home directory locations may not be cross-compatible (or only somewhat 
compatible). You also need to ensure that user 'jsmith' really means the 
same person on every machine. If no one has been controlling username 
creation centrally, you're in for a very large task indeed.

For generic accounts (e.g. 'oracle' or other vendor-specific accounts) you 
need to decide if you're going to allow direct signon to the ID, and whether 
having access to a facility like Oracle on one machine should necessarily 
give access to Oracle everywhere.  If you're not using sudo for access to 
such generics now, you should really consider doing it now to give you finer 
grained control over generic user accounts.

- Richard

Sean Kelly wrote:
> On Fri, Jun 29, 2007 at 11:43:51AM -0500, Chris St. Pierre wrote:
> ...
>> #!/bin/bash
>> # invoke as fixerator.sh username new-uid
>> # this is untested, and probably won't work, but you get the idea
>> old_uid=`getent passwd $1 | awk -F: '{print $3}'
>> usermod -u $2 $1
>> find / -owner $old_uid | xargs chown $2
> 
> This is the approach I'd use as well, however be very careful. Lets say
> you've got something like this:
> 
> Old UID   New UID
> --------- ---------
>   1000      2000
>   2000      2001
> 
> WHen you use the template script above, you could potentially end up with
> all files being owned by uid 2001. To be more clear (maybe), be careful you
> don't map old to new where the new is equal to other old that havne't yet
> been remapped.
> 
> If you have a backup of the entire system and you've got a long enough
> chunk of downtime, it might be better to make a script that makes a list of
> all files with their uid and gid, then make changes based on that stored
> list rather than doing another `find` for every iteration. Going further,
> it might be best to do it all at once instead of incrementally assuming
> you're fairly sure you've got it right and can fairly easily roll back.
>