Migrazione da NethServer 7

Migration is the process to convert a NethServer 7 machine (source NS7) into a NethServer 8 (destination NS8).

Prima di iniziare avrete bisogno di:

• SSH and Cockpit access to the source NS7 machine.

• A new server containing a freshly installed NS8 cluster.

Also check the following requirements:

1. The NS8 cluster VPN address must be resolved correctly by NS7 and the VPN port must not be blocked by intermediate network appliances. The VPN address and port were configured during the cluster creation: by default the address is the leader node FQDN and the port number is 55820.

2. If NS7 is connected to an external account provider, you must configure NS8 with the same account provider, as explained in Account provider.

3. You must be granted access to your authoritative DNS server. Applications in NS8 have a dedicated virtual host name, a FQDN that must be registered in the DNS. You will need to add or change a DNS CNAME for each of them.

4. The nethforge repository must be enabled in NS8 to migrate SOGo.

Connect to NS8

The migration procedure will add NS7 as special node of the NethServer 8 cluster.

1. Install the migration tool on the source machine. Access Cockpit on the source server and install «Migration to NS8» from the Software Center.

2. Open the just installed NS8 migration application.

3. Connect the NethServer 7 server to an existing new NethServer 8 cluster by entering the following fields:

   • NS8 leader node: il nome host o l’indirizzo IP del nodo leader NethServer 8

   • NS8 admin username and NS8 admin password: administrator credentials for the leader node. As a best practice, create a dedicated user from the Amministratori page and delete the user once the migration has been completed. Please note that the user must have 2FA disabled.

   • deselezionare l’opzione TLS validation se il nodo leader non ha un certificato TLS valido

4. Click the Connect button.

Migrate an application

The web interface will display the list of all applications installed inside NethServer 7.

Suggerimento

If NS7 has a remote account provider and an error message is displayed instead, see Account provider.

1. Choose an application and click on the Start migration button. In this phase the migration process will install the application into the NethServer 8 cluster and start the first data synchronization. If the NethServer 8 cluster is composed by 2 or more nodes, you will be asked to select a destination node.

2. Click the Sync data button multiple time to keep in sync the application data between NethServer 7 and NethServer 8. If something goes wrong at this point, click the Abort migration button to remove the NS8 application instance and start over with it.

3. When you are ready for the final migration, click the Finish migration button. If the migrated application requires extra parameters, the system will display a dialog box before proceeding.

Please note that most web application will need a dedicated FQDN (virtual host) after finishing the migration. Make sure the DNS record points to the NS8 node. In NS8, you can still configure custom HTTP routes for the migrated applications.

At the end of each application migration the following happens:

• The application in NS8 is configured and started with the migrated data.

• The application in NS7 is stopped and disabled.

• The migration tool configures an HTML page with a link pointing to the new application virtual host name served by NS8. End-users will see that link instead of the old application. See also Rotte HTTP manuali.

• If the NS7 application was connected to the local account provider, the NS8 application still uses it, through a temporary external account provider and the cluster VPN. See Account provider for more information.

As alternative, the migration of an application can be skipped with the Skip migration button.

Complete the migration

When the account provider is finally migrated, the migration procedure disconnects NS7 from the NS8 cluster and the initial connection page appears again.

If NS7 needs to use NS8 as remote account provider, read carefully the section Account provider.

Log

• La UI dello strumento di migrazione ha una pagina Logs per la lettura del log /var/log/ns8-migration.log. La procedura di migrazione di ogni applicazione invia una traccia della sua attività a quel file.

• Inoltre, quando ci si unisce o si abbandona il cluster NS8 e quando i servizi NS7 vengono modificati, alcune informazioni possono essere registrate in /var/log/messages come al solito.

• Lato NS8, il log delle applicazioni contiene la traccia dell’attività import-module.

Account provider

Your action is required if the NS7 system is configured with a remote account provider. The migration tool expects to find in NS8 an external user domain matching the BaseDN value of the remote account provider. For example, in NS7 under the Users & Groups page, look at the Account provider details: if the BaseDN value is dc=directory,dc=nh, then the NS8 external user domain name must be set to directory.nh. Apart from the matching name, the external user domain of NS8 must point to the same LDAP database of NS7 (regardless its implementation). Bear in mind that every node of the NS8 cluster must reach the same LDAP database, now and in the future.

On the contrary, if the NS7 system is configured with a local account provider, ensure that its BaseDN does not match any NS8 user domain name. After connecting to the NS8 cluster, a temporary external user domain is created so that migrated applications can access the NS7 local account provider until it is migrated, too. The local account provider is migrated at the end of the procedure: at that point the temporary external user domain is automatically removed.

Refer to the next sections for specific information about the local account provider migration.

Samba DC

Completa la migrazione DC facendo clic sul pulsante: Finish migrazione . La procedura chiede di selezionare un indirizzo IP: diventerà l’IP della destinazione DC.

Avvertimento

Windows clients might not know how to reach the new DC

1. If DNS configuration of Windows clients is controlled by a DHCP server, set the NS8 DC IP address as the new DNS server.

2. If Windows clients use an external DNS, it must be configured to forward the requests for the Active Directory DNS zone to the NS8 DC IP address.

3. If Windows clients have a manual DNS configuration and use the NS7 DC IP address as DNS and authentication server, consider to transfer the NS7 DC IP address to the NS8 DC.

In the last case, transferring the IP avoids the reconfiguration of DNS settings for each Windows client. This can be preferable over an external DNS server, if it blocks dynamic DNS update requests (DDNS).

Per trasferire l’indirizzo IP del DC sorgente al DC destinazione, alcuni passaggi devono essere effettuati manualmente dopo il completamento della migrazione.

1. Controllare che la migrazione degli account abbia avuto successo. Gli utenti e i gruppi devono essere elencati correttamente nella pagina Domains and users.

2. Al termine della migrazione l’indirizzo IP del DC sorgente è libero e può essere assegnato al nodo di destinazione. Fare riferimento alla documentazione del sistema operativo del nodo per assegnare un indirizzo IP secondario (alias) al nodo di destinazione.

3. Modificare l’indirizzo IP della DC. Ad esempio, se l’istanza DC è samba1 e il nuovo IP è ``192.168.1.123`, eseguire il seguente comando:

   api-cli run module/samba1/set-ip-address --data '{"ipaddress":"192.168.1.123"}'
   

Il Samba DC di NS8 può essere configurato come account provider esterno per NS7. Tenere presente che NS7 deve essere in grado di accedere all”IP address legato all’account provider Samba cui è destinato. Questa configurazione potrebbe essere utile se si dispone ancora di moduli in esecuzione su NS7 che richiedono l’accesso all’account provider.

Le impostazioni di scadenza della password sono conservate durante la migrazione. La politica di forza della password, se abilitata, viene convertita per la compliancy con i requisiti di complessità del server Windows 2003+ [1] ed è applicata per le modifiche future della password. Vedi anche: ref: password-policy-sezione.

[1]

Le password devono soddisfare i requisiti di complessità <https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc786468(v=ws.10)#password-must-meet-complexity-requirements `_ dal sito web learn.microsoft.com.

OpenLDAP

Complete the OpenLDAP migration by clicking on the Finish migration button.

Avvertimento

L’istanza OpenLDAP in esecuzione in NS8 non è attualmente accessibile come account provider esterno per NS7 e altri dispositivi di rete.

Le impostazioni dei criteri di password (forza e scadenza) non vengono migrate. Essi devono essere abilitati sotto le impostazioni di dominio della pagina Domains and users. Vedi anche: ref: password-policy-sezione.

Mail

The Migration Procedure preserves both data and configurations of NS7 Email application, unless stated differently in this section or in Configurazioni escluse dalla migrazione.

Mail messages are copied to NS8 with Rsync. After Finish migration is clicked, some time-consuming operations are executed.

• IMAP ACL Format Conversion: The user and group name format in IMAP ACLs is modified by removing the domain suffix. For example, an ACL entry referring to IMAP user john.doe@server.example.org becomes john.doe. IMAP login still accepts both formats.

• Quota Recalculation: If IMAP quota is enabled, mailbox sizes are recalculated in the background. During this time, disk usage of mailboxes might not be available.

• Messages and Attachments Reindexing: The full-text search engine of NS8 runs in the background to reindex all messages and attachments. During this time, full-text searches might not work. To check if the reindexing process is still running, use the command pgrep dovecot-index.

Remember to update the DNS records or transfer the IP address to the NS8 node at the end of the migration.

Smart host

The NS7 system smart host configuration is converted to a default relay rule. The NS8 Mail application is then configured as the SMTP server for every application in the cluster: see Email notifications.

Connettore POP3

The migration involves transferring POP3 Connector settings to NS8 Imapsync module, together with Email application. Configurations of accounts using the IMAP protocol are translated to working Imapsync tasks. For accounts using POP3, it is necessary to review the settings and commence synchronization manually.

Rotte HTTP manuali

In NethServer 7, la maggior parte delle applicazioni web erano accessibili utilizzando rotte in stile percorso. Per esempio, dato un server chiamato server.nethserver.org l’installazione WebTop era disponibile presso https://server.nethserver.org/webtop.

Dall’altra parte, quando l’applicazione viene migrata, verrà chiesto di inserire un FQDN in modo che WebTop sarà disponibile su un URL del tipo https://webtop.nethserver.org.

Se hai già migrato il record DNS FQDN al nuovo server, puoi anche ricreare manualmente i vecchi percorsi HTTP da:ref:proxy page <traefik-section>.

Esempio per l’aggiunta di percorsi WebTop:

1. aprire la sezione HTTP routes dalla pagina Impostazioni

2. cliccare sul nome dell’istanza WebTop, tipo webtop1, una finestra di dialogo modale mostrerà i dettagli del percorso

3. copiare il valore dal campo URL, tipo http://127.0.0.1:20033

4. cliccare sul pulsante :guilabel: Create route

5. scegliere un Name per la radice e selezionare il Node dove l’istanza WebTop è in esecuzione

6. incollare il valore copiato prima (http://127.0.0.1:20033`) dentro il campo URL

7. lasciare il campo Host vuoto e inserire /webtop all’interno del campo Path

8. ripetere i passaggi da 4 a 7 per tutti gli altri percorsi WebTop:

   • ``/Microsoft-Server-ActiveSync ``

   • /.well-known

   • /webtop-dav

Configurazioni escluse dalla migrazione

Le seguenti configurazioni non verranno migrate:

• Custom templates.

• Account provider password policy settings (see Account provider).

• System smart host, if the NS7 Email app is not installed or is not migrated.

• In NS7 Email app, the setting Forward a copy of all messages, formerly known as Always send a copy (Bcc), is not migrated.