[Samba] WG: HOWTO samba4 centos5.5 named dnsupdate drbd simple failover

Daniel Müller mueller at tropenklinik.de
Tue Oct 5 01:26:34 MDT 2010


centOs5.5/samba4/named  here is a short guide setting it up to work.
I added TSIG for bind-master amd bind-slave. Update to samba4 alpha13 added (installing git on CentOs 5.5).
If you do this howto right now you will start with samba4 alpha13. You do not need the update section. But you need
git for your installation because the rsync-thing is broken!!!!!!
First of all do not install the bind package coming with centos 5.5!!

Install needs for samba

yum install libacl*  gnutls* readline* python* gdb* autoconf* 

Named installation:
Here is a description on what to do:
http://jason.roysdon.net/2009/10/16/building-bind-9-6-on-rhel5-centos5-for-d
nssec-nsec3-support/
The steps,

yum -y install make gcc rpm-build libtool autoconf openssl-devel libcap-devel libidn-devel libxml2-devel openldap-devel postgresql-devel sqlite-devel mysql-devel krb5-devel xmlto

For named to compile correctly you need this 2 packages too:

yum -y install curl*

download.fedora.redhat.com/pub/fedora/epel/5/i386/python-dns-1.7.1-1.el5.noa
rch.rpm

cd /usr/src/redhat/SRPMS
wget -c
ftp://mirrors.kernel.org/pub/fedora/updates/11/SRPMS/bind-9.6.*.src.rpm
wget -c
ftp://mirrors.kernel.org/pub/fedora/updates/11/SRPMS/dnssec-conf-*.src.rpm


cd /usr/src/redhat/SRPMS
wget -c
ftp://mirrors.kernel.org/pub/fedora/updates/12/SRPMS/bind-9.6.*.src.rpm
wget -c
ftp://mirrors.kernel.org/pub/fedora/releases/12/Fedora/source/SRPMS/dnssec-c
onf-*.src.rpm

rpm -ivh --nomd5 bind-9.6.*.src.rpm dnssec-conf-*.src.rpm

cd /usr/src/redhat/SPECS
rpmbuild -ba ./bind.spec

The built bind RPM is now in /usr/src/redhat/RPMS/i386/ or /usr/src/redhat/RPMS/x86_64/ depending on your Arch.

rpmbuild --ba ./dnssec-conf.spec 

The built dnssec-conf RPM is now in /usr/src/redhat/RPMS/noarch/

cd /usr/src/redhat/RPMS/*86*
rpm -Uvh bind-9.6.*.rpm bind-utils-9.6.*.rpm bind-libs-9.6.*.rpm ../noarch/dnssec-conf-1.21-*.noarch.rpm

Now bind is installed Config-File in /etc/named.conf I disabled in options:
//dnssec-enable yes;
//dnssec-validation yes;
//dnssec-lookaside . trust-anchor dlv.isc.org.;

To make bind work you have to add user named to the group named.
Set the rights to make named work correctly 
chmod 770 /etc/named.conf 
chmod 770 /etc/named.rfc1912.zones
chown root:named /etc/named.conf 
chown named:named /etc/named.rfc1912.zones
chmod -R 770 /var/named 
chown -R named:named /var/named
chown named:named /etc/rndc.key
chown named:named /var/run/named/


Now download and install samba:
url: http://wiki.samba.org/index.php/Samba4/HOWTO

mkdir samba4
cd samba4

rsync -avz samba.org::ftp/unpacked/samba_4_0_test/ .

cd /source4
./autogen.sh
./configure.devloper
make
make install
Samba4 is now installed in /usr/local/samba


Provision it:
Cd /samba4/source4

./setup/provision --realm=samdom.example.com --domain=SAMDOM --adminpass=SOMEPASSWORD --server-role='domain controller'
In my case:

./setup/provision --realm=tuebingen.tst.loc --domain=TUEBINGEN--adminpass=SOMEPASSWORD --server-role='domain controller'


Now you nedd to add the PATH to roots .bash_profile in /root
--> PATH=$PATH:$HOME/bin:/usr/local/samba/bin:/usr/local/samba/sbin
ldconfig
which samba must answer: /usr/local/samba/sbin/samba
 Now you must set the lib paths:
echo "/usr/local/samba/lib" > /etc/ld.so.conf.d/samba4.conf
The next things to do( named should have read and write) :
Cd /usr/local/samba/private
Chown named:named krb5.conf
Chown -R named:named /usr/local/samba/private/dns
Chown named:named named.conf 
Chown named:named named.conf.update 
Chown named:named dns.keytab 
Cp krb5.conf /etc  # this will overwrite the org. krb5.conf
cd /etc/sysconfig
Vi named There add a line at the bootom:
KEYTAB_FILE="/usr/local/samba/private/dns.keytab"
export KEYTAB_FILE

Now you must update your /etc/named.conf , Be sure to have em listen on a IP not only 127.0.0.1:
Here is mine

options {
        listen-on port 53 { 127.0.0.1;192.168.134.27; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { localhost;allyoursubnetshere; };
        recursion yes;
        forwarders { 192.168.134.253; };##put here your first dns if you have };

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};
include "/usr/local/samba/private/named.conf";####samba4 link include "/etc/named.rfc1912.zones";

In your /etc/resolv.conf you have one single entry: → nameserver localhost

Now you have to put in your globals /usr/local/smba/etc/smb.conf

Interfaces=eth0 # or Ipaddress

Now samba -I -M single
And you are done!!!
Samba_dnsupdate --verbose will give you:



[root at node1 etc]# samba_dnsupdate --verbose Looking for DNS entry A tuebingen.tst.loc 192.168.134.27 as tuebingen.tst.loc.
Looking for DNS entry A node1.tuebingen.tst.loc 192.168.134.27 as node1.tuebingen.tst.loc.
Looking for DNS entry CNAME
365d2a9f-bfe6-462d-965e-8622bfefc190._msdcs.tuebingen.tst.loc
node1.tuebingen.tst.loc as
365d2a9f-bfe6-462d-965e-8622bfefc190._msdcs.tuebingen.tst.loc.
Looking for DNS entry SRV
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc
node1.tuebingen.tst.loc 88 as
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc.
Checking 0 100 88 node1.tuebingen.tst.loc. against SRV _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc
node1.tuebingen.tst.loc 88
Looking for DNS entry SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc
node1.tuebingen.tst.loc 389 as
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc.

The next step setting up the second samba4 on a centOs 5.5 and do replication:
links:http://wiki.samba.org/index.php/Samba4_joining_a_domain

First of all do all the same as for the first centOS samba4 but do not
provision, no smb.conf in /usr/local/samba/etc. Important things: both servers must new each other.
So if named is installed on the second (node2)you need to tell em in his named.conf 
that the first server(node1) is a forwarder to search for example “tuebingen.tst.loc”:
Example my named.conf on node2 - 192.168.135.27 is node1,


options {
        listen-on port 53 { 127.0.0.1;192.168.134.28; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { localhost; 192.168.135.0/24; 192.168.134.0/24; };
        recursion yes;
        forwarders { 192.168.134.253;192.168.134.27; };
        
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";

On node2 your /etc/hosts have entries like this:

# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1               localhost.localdomain localhost
::1             localhost6.localdomain6 localhost6
192.168.134.28          node2.local node2
192.168.134.27          node1.tuebingen.tst.loc node1





Now you try ping tuebingen.tst.loc. If it is possible you are on the right way:
 ping tuebingen.tst.loc
PING tuebingen.tst.loc (192.168.134.27) 56(84) bytes of data.
64 bytes from node1.tuebingen.tst.loc (192.168.134.27): icmp_seq=1 ttl=64 time=0.138 ms

Now you have to copy your /etc/krb5.conf from node1 to node2 /etc/krb5.conf
scp krb5.conf root at node2:/etc

edit krb5.conf. Make it look like that:

[root at node2 ~]# cat /etc/krb5.conf
[libdefaults]
        default_realm = TUEBINGEN.TST.LOC
        dns_lookup_realm = true
        dns_lookup_kdc = true
        ticket_lifetime = 24h
        forwardable = yes

[realms]
        TUEBINGEN.TST.LOC = {
                kdc = node1.tuebingen.tst.loc:88
                admin_server = node1.tuebingen.tst.loc:749
                default_domain = tuebingen.tst.loc
        }

[domain_realm]
        .tuebingen.tst.loc = TUEBINGEN.TST.LOC
        tuebingen.tst.loc = TUEBINGEN.TST.LOC
 
Important is setting dns_lookup_realm=true; dns_lookup_kdc=true

Now a very important thing. On both servers the time must be equal.
So do on both servers: date -s hhmm, ex: date-s 1952.
Then try : 
 kinit administrator
Password for administrator at TUEBINGEN.TST.LOC:
Must give you this:
Warning: Your password will expire in 34 days on Fri Sep  3 11:11:06 2010


Now change to join domain:
The place to join as dc to your domain is /samba4/source4. There type:
 
 bin/net vampire tuebingen.tst.loc -Uadministrator --realm=tuebingen.tst.loc

If this is successful start samba .


Now return no node1 the first server.
Change to /samba4/source4

Now type:   bin/ldbsearch -H /usr/local/samba/private/sam.ldb objectclass=ntdsdsa objectguid --cross-ncs
This must be the result of two dcs:
[root at node1 source4]#  bin/ldbsearch -H /usr/local/samba/private/sam.ldb objectclass=ntdsdsa objectguid --cross-ncs
# record 1
dn: CN=NTDS Settings,CN=NODE1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=tuebingen,DC=tst,DC=loc
objectGUID: 365d2a9f-bfe6-462d-965e-8622bfefc190

# record 2
dn: CN=NTDS Settings,CN=NODE2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=tuebingen,DC=tst,DC=loc
objectGUID: d6160c39-0810-4026-aa24-91c91797d892

# returned 2 records
# 2 entries
# 0 referrals

So record 2 is the new dc in the forest.
Now you must update your /usr/local/samba/private/dns/yourzone.list .

Mine after change:


; -*- zone -*-
; generated by provision.pl
$ORIGIN tuebingen.tst.loc.
$TTL 1W
@               IN SOA  @   hostmaster (
                                2010072311   ; serial
                                2D              ; refresh
                                4H              ; retry
                                6W              ; expiry
                                1W )            ; minimum
                        IN NS   node1

            IN A    192.168.134.27
;

node1        IN A    192.168.134.27
node2        IN A    192.168.134.28  #<----new dc entry
gc._msdcs               IN A    192.168.134.27

365d2a9f-bfe6-462d-965e-8622bfefc190._msdcs     IN CNAME        node1
d6160c39-0810-4026-aa24-91c91797d892._msdcs     IN CNAME        node2 <---new dc entry
;
; global catalog servers
_gc._tcp                IN SRV 0 100 3268       node1
_gc._tcp.Default-First-Site-Name._sites IN SRV 0 100 3268       node1
_ldap._tcp.gc._msdcs    IN SRV 0 100 3268       node1
_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs     IN SRV 0 100 3268 node1
;
; ldap servers
_ldap._tcp              IN SRV 0 100 389        node1
_ldap._tcp.dc._msdcs    IN SRV 0 100 389        node1
_ldap._tcp.pdc._msdcs   IN SRV 0 100 389        node1
_ldap._tcp.e67cd6da-dbd0-492d-96e2-2dc778abaebe.domains._msdcs          IN SRV 0 100 389 node1
_ldap._tcp.Default-First-Site-Name._sites               IN SRV 0 100 389 node1
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs     IN SRV 0 100 389 node1
;
; krb5 servers
_kerberos._tcp          IN SRV 0 100 88         node1
_kerberos._tcp.dc._msdcs        IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites   IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 node1
_kerberos._udp          IN SRV 0 100 88         node1
; MIT kpasswd likes to lookup this name on password change
_kerberos-master._tcp           IN SRV 0 100 88         node1
_kerberos-master._udp           IN SRV 0 100 88         node1
;
; kpasswd
_kpasswd._tcp           IN SRV 0 100 464        node1
_kpasswd._udp           IN SRV 0 100 464        node1
;
; heimdal 'find realm for host' hack
_kerberos               IN TXT  TUEBINGEN.TST.LOC
(END)

Now you have to put two new entries on node1 /usr/local/samba/etc/smb.conf in the global section:
dreplsrv:periodic_interval = 10 .
dreplsrv:periodic_startup_interval = 5.

Then ssh in node2 to /usr/local/samba/etc. net vampire has placed there a
smb.conf. There in the global section set this above entries too:
dreplsrv:periodic_interval = 10 .
dreplsrv:periodic_startup_interval = 5.

My globals on node1:

[globals]
        netbios name    = NODE1
        workgroup       = TUEBINGEN
        realm           = TUEBINGEN.TST.LOC
        server role     = domain controller
        interfaces      = 192.168.134.27
        dreplsrv:periodic_interval = 10
        dreplsrv:periodic_startup_interval = 5

My globals on node2:


[globals]
        netbios name    = NODE2
        workgroup       = TUEBINGEN
        realm           = TUEBINGEN.TST.LOC
        server role     = domain controller
        dreplsrv:periodic_interval=10
        dreplsrv:periodic_startup_interval=5


Then on Both Servers:
Restart samba
service named restart. 
rndc flush.

A litle bit testing:
I put the a user Sammler to my domain using the win7 Domain-Tools:

On second server node2 cd /samba4/source4
then:

 bin/ldbsearch -H ldap://node2 -Uadministrator%tornado_11 name='sam*' dn
# record 1
dn: CN=Sammler sm. Sammler,OU=Keine Systemsteuerung,DC=tuebingen,DC=tst,DC=loc

# Referral
ref: ldap://tuebingen.tst.loc/CN=Configuration,DC=tuebingen,DC=tst,DC=loc

# returned 2 records
# 1 entries
# 1 referrals


Step 3: Configure home shares of the users.
This was the greatest try and error. Since samba3 this changed. And it is not the same in samba4!!!
A simple:

[homes]
       path= /home
       read only=no

This is all.
All other ACLS is setting from the tool Active Directory Users and Groups
within windows.
Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers. 
In the Details pane, right-click the applicable user account, and then click Properties. 
In the Properties dialog box, click the Profile tab. 
Under Home folder, type the directory information: In my case 
\\tuebingen.tst.loc\homes and the tool will make  the users directory setting 
 the correct rights.

Shares: The same for shares you do in your smb.conf
[test]
	path= /windows/test
	read only= no
Then login as administrator on your win-client. Head to your \\server\test and give the rights you want for groups or users. This is all. 

Password Policy Settings!!

Along with Samba4 the Password Policy you can only set from console, with 
'net  pwsettings ' command.
net  pwsettings  –help:

usage: (show | set <options>)

options:
  -h, --help            show this help message and exit
  -H H                  LDB URL for database or target server
  --quiet               Be quiet
  --complexity=COMPLEXITY
                        The password complexity (on | off | default). Default
                        is 'on'
  --history-length=HISTORY_LENGTH
                        The password history length (<integer> | default).
                        Default is 24.
  --min-pwd-length=MIN_PWD_LENGTH
                        The minimum password length (<integer> | default).
                        Default is 7.
  --min-pwd-age=MIN_PWD_AGE
                        The minimum password age (<integer in days> |
                        default).  Default is 1.
  --max-pwd-age=MAX_PWD_AGE
                        The maximum password age (<integer in days> |
                        default).  Default is 43.

  Samba Common Options:
    -s FILE, --configfile=FILE
                        Configuration file
    -d DEBUGLEVEL, --debuglevel=DEBUGLEVEL
                        debug level
    --option=OPTION     set smb.conf option from command line
    --realm=REALM       set the realm name

  Credentials Options:
    --simple-bind-dn=DN
                        DN to use for a simple bind
    --password=PASSWORD
                        Password
    -U USERNAME, --username=USERNAME
                        Username
    -W WORKGROUP, --workgroup=WORKGROUP
                        Workgroup
    -N, --no-pass       Don't ask for a password
    -k KERBEROS, --kerberos=KERBEROS
                        Use Kerberos

  Version Options:
    --version           Display version number

So I set my Password Policy:

net  pwsettings  set –--complexity=off
net  pwsettings  set ---max-pwd-age=60 #<---60 Days
net  pwsettings  set –min-pwd-length=5

net  pwsettings  show:

[root at node1 ~]# net pwsettings show
Password informations for domain 'DC=tuebingen,DC=tst,DC=loc'

Password complexity: off
Password history length: 24
Minimum password length: 5
Minimum password age (days): 1
Maximum password age (days): 60

Make profiles ready:

In your smb.conf:

[profiles]
path= /windows/users/profiles
read only= no

mkdir /windows/users/profiles

On your windows client start Active Directory Users and Comupters. Right click,properties, then profil tab: Profile path: Your path to the profiles along with %Username%
EX: \\tuebingen.tst.loc\profiles\%USERNAME%


Step 4. Want some more: make the DATA accessible from both samba PDCs. In case one is down. This will be real failover while dns is running
#########
We need a second nic for cluster device and drbd
On node1 this will be: 192.168.130.6
On nide2 this will be: 192.168.130.5 
You need a second hardisk in my case it will be /dev/hdc
Set on both node1 und node2

mkdir /windows.

Fdisk /dev/hdc
Chose n, then p, then 1, then always enter.

Leave with w.



You nedd to install drbd83-8.3.8-1.el5.centos. and kmod-drbd83-8.3.8-1.el5.centos

yum install *drbd83*

And
yum install cman lvm2-cluster gfs-utils gfs2-utils kmod-gfs

Set up your /etc/drbd.conf:


#drbd.conf dm
global {

    usage-count yes;
}

common {
  syncer { rate 20M;
  al-extents 257;
 }
}

resource r0 {

 protocol C;

  startup {
    become-primary-on both;
    degr-wfc-timeout 120;    # 1 minute.
        #wfc-timeout 30;
  }

  disk {

    on-io-error   detach;

  }

  net {

        allow-two-primaries;
    cram-hmac-alg "sha1";
    shared-secret "yourpasswd";
 after-sb-0pri  discard-least-changes;
#after-sb-0pri discard-zero-changes;
  after-sb-1pri violently-as0p;
    after-sb-2pri violently-as0p;
#rr-conflict violently;

  }

  on node2.local {
    device     /dev/drbd0;
    disk       /dev/hdc1;
    address    192.168.130.5:7788;
    flexible-meta-disk  internal;

  }

  on node1.local {
    device    /dev/drbd0;
    disk      /dev/hdc1;
    address   192.168.130.6:7788;
    flexible-meta-disk internal;
  }
}


The drbd.conf need to be the same on both hosts!!
Imortant!—with “on” in your drbd.conf you name your hosts, ex: on node1.local.
After on you must set there the name that gives you “uname –n” on your machine.
“r0” ist the resource we are using
According to the /etc/drbd.conf you need to initiate your resource first before you can use it like: drbdadm create-md r0.

Example:
[root at node2 etc]# drbdadm create-md r0
md_offset 500105211904
al_offset 500105179136
bm_offset 500089913344

Found some data

 ==> This might destroy existing data! <==

Do you want to proceed?
[need to type 'yes' to confirm] yes

You want me to create a v08 style flexible-size internal meta data block.
There appears to be a v08 flexible-size internal meta data block
already in place on /dev/hdc1 at byte offset 500105211904
Do you really want to overwrite the existing v08 meta-data?
[need to type 'yes' to confirm] yes

Writing meta data...
initializing activity log
NOT initialized bitmap
New drbd meta data block successfully created.

On both nodes: service drbd start
Then: cat /proc/drbd.
[root at node1 ~]# cat /proc/drbd
version: 8.3.8 (api:88/proto:86-94)
GIT-hash: d78846e52224fd00562f7c225bcc25b2d422321d build by mockbuild at builder10.centos.org, 2010-06-04 08:04:31
 0: cs:Connected ro:Secondary/Secondary ds:Inconsistent/Inconsistent C r----
    ns:0 nr:0 dw:0 dr:0 al:0 bm:0 lo:0 pe:0 ua:0 ap:0 ep:1 wo:b oos:488369056

Then on node1:
drbdadm -- --overwrite-data-of-peer primary all

/cat/proc/drbd  will show you:

[root at node1 ~]# cat /proc/drbd
version: 8.3.8 (api:88/proto:86-94)
GIT-hash: d78846e52224fd00562f7c225bcc25b2d422321d build by mockbuild at builder10.centos.org, 2010-06-04 08:04:31
 0: cs:SyncSource ro:Primary/Secondary ds:UpToDate/Inconsistent C r----
    ns:121460 nr:0 dw:0 dr:129632 al:0 bm:7 lo:1 pe:62 ua:256 ap:0 ep:1 wo:b oos:488249568
        [>....................] sync'ed:  0.1% (476804/476920)M delay_probe: 8
        finish: 22:36:14 speed: 5,632 (11,948) K/sec

Now you must wait until both devices synced the first time.
You can “watch cat /proc/drbd” to see it progress.
After the first sync has finished you will see:
  cat /proc/drbd
version: 8.3.8 (api:88/proto:86-94)
GIT-hash: d78846e52224fd00562f7c225bcc25b2d422321d build by mockbuild at builder10.centos.org, 2010-06-04 08:04:31
 0: cs:Connected ro:Primary/Secondary ds:UpToDate/UpToDate C r----
    ns:488369056 nr:0 dw:0 dr:488369056 al:0 bm:29808 lo:0 pe:0 ua:0 ap:0 ep:1 wo:b oos:0

Now we can configure cluster. This is needed to run both drbd-nodes in primary mode.
First of all we have to write our /etc/cluster/cluster.conf
 

<?xml version="1.0" ?>
<cluster config_version="3" name="samba-cluster">
        <fence_daemon post_fail_delay="0" post_join_delay="3"/>
        <clusternodes>
                <clusternode name="node2" nodeid="1" votes="1">
                <fence>
                <method name="single">
                <device name="human" ipaddr="192.168.130.4"/>
                </method>
                        </fence>
                </clusternode>
                <clusternode name="node1" nodeid="2" votes="1">
                <fence>
                <method name="single">
                <device name="human" ipaddr="192.168.130.6"/>
                </method>
        </fence>

                </clusternode>
        </clusternodes>
        <cman expected_votes="1" two_node="1"/>
        <fencedevices>
        <fenve_device name="human" agent="fence_manual"/>
        </fencedevices>
        <rm>
                <failoverdomains/>
                <resources/>
        </rm>
</cluster>

This cluster.conf must be the same on both node1 and node2. So copy it over:
Ex: scp /etc/cluster/cluster.conf root at node1:/etc/cluster.
Now  start cam on both nodes:
cman start.
Now expect this:

[root at node1 cluster]# service cman start
Starting cluster:
   Enabling workaround for Xend bridged networking... done
   Loading modules... done
   Mounting configfs... done
   Starting ccsd... done
   Starting cman... done
   Starting daemons... done
   Starting fencing... done
                                                           [  OK  ]
Now check if all is running well:
Check nodes like this: cman_tool nodes
[root at node1 cluster]# cman_tool nodes
Node  Sts   Inc   Joined               Name
   1   M     12   2010-08-05 08:37:22  node2
   2   M      4   2010-08-05 08:37:22  node1

Now we make our clustered filesystem.
Do it exactly like that:
Now first on node1:
For this we need the name of our cluster in cluster.conf, “samba-cluster”, and ‘/dev/drbd0’.
mkfs.gfs2 -t samba-cluster:gfs2 -p lock_dlm -j 2 /dev/drbd0.

[root at node1 cluster]# mkfs.gfs2 -t samba-cluster:gfs2 -p lock_dlm -j 2 /dev/drbd0
This will destroy any data on /dev/drbd0.

Are you sure you want to proceed? [y/n]
Device:                    /dev/drbd0
Blocksize:                 4096
Device Size                465.75 GB (122092264 blocks)
Filesystem Size:           465.75 GB (122092262 blocks)
Journals:                  2
Resource Groups:           1863
Locking Protocol:          "lock_dlm"
Lock Table:                "samba-cluster:gfs2"
UUID:                      BBAF2EC1-B0B8-0F82-DB5C-CA9273859610

Then service gfs start.
Then change on node2. Remember this node runs in drbd “secondary”. So we have to put it on primary.
On node2:
drbdadm primary r0.
A cat /proc/drbd must show us:
cat /proc/drbd
version: 8.3.8 (api:88/proto:86-94)
GIT-hash: d78846e52224fd00562f7c225bcc25b2d422321d build by mockbuild at builder10.centos.org, 2010-06-04 08:04:31
 0: cs:Connected ro:Primary/Primary ds:UpToDate/UpToDate C r----
    ns:0 nr:488671336 dw:488671336 dr:0 al:0 bm:29808 lo:0 pe:0 ua:0 ap:0 ep:1 wo:b oos:0

Now we can make on node2 our clustered filesystem:

[root at node2 ~]#  mkfs.gfs2 -t samba-cluster:gfs2 -p lock_dlm -j 2 /dev/drbd0

This will destroy any data on /dev/drbd0.
  It appears to contain a gfs2 filesystem.

Are you sure you want to proceed? [y/n]
Device:                    /dev/drbd0
Blocksize:                 4096
Device Size                465.75 GB (122092264 blocks)
Filesystem Size:           465.75 GB (122092262 blocks)
Journals:                  2
Resource Groups:           1863
Locking Protocol:          "lock_dlm"
Lock Table:                "samba-cluster:gfs2"
UUID:                      885E2E87-90CE-B916-8A73-D66336CD98C0

Now start on node2 gfs: service gfs start.
No make on both nodes in / the directory windows: mkdir windows.
Then mount on both nodes the gfs filesystem to windows:
mount -t gfs2 /dev/drbd0 /windows.
Now lets do testing, on nod1:
cd /windows.
touch test.txt
[root at node1 windows]# ls
test.txt
On node2 you must see in /windows:
  [root at node2 windows]# ls
test.txt.
On node2: vim test.txt, i, this is a test from node2,:, wq.

On node1: /cat/windows/test.txt

[root at node1 windows]# cat /windows/test.txt
this is a test from node2
So you did it. Everything is synchronized.
So you point hour home-directories and your shares in /usr/local/samba/etc/smb.conf to a directory in windows and you have a failover Data for your both samba4 controllers.

The next thing to do is to add entries into fstab on both nodes :
vim /etc/fstab
Enter: /dev/drbd0         /windows                gfs2  _netdev            0 0
At the end.

This is my fstab:
/dev/VolGroup00/LogVol00 /                       ext3    defaults        1 1
LABEL=/boot             /boot                   ext3    defaults        1 2
tmpfs                   /dev/shm                tmpfs   defaults        0 0
devpts                  /dev/pts                devpts  gid=5,mode=620  0 0
sysfs                   /sys                    sysfs   defaults        0 0
proc                    /proc                   proc    defaults        0 0
/dev/VolGroup00/LogVol01 swap                    swap    defaults        0 0
/dev/drbd0              /windows                gfs2  _netdev            0 0


The next step is to make shure DRBD is started on boot before GFS2. In my case I tried several hours befor I succeeded. You must do this on both nodes.
You find the startup scripts in /etc/rc.d/init.d.
First drbd: vim drbd. You find the start and stop option at #chkconfig_ - start stop.
The original line here: #chkconfig: - 70 08. I changed it to: # chkconfig: - 55 08

#!/bin/bash
#
# chkconfig: - 55 08
# description: Loads and unloads the drbd module
#
# Copyright 2001-2010 LINBIT
#
# Philipp Reisner, Lars Ellenberg
#
### BEGIN INIT INFO
# Provides: drbd
# Required-Start: $local_fs $network $syslog
# Required-Stop:  $local_fs $network $syslog
# Should-Start:   sshd multipathd
# Should-Stop:    sshd multipathd
# Default-Start:  2 3 4 5
# Default-Stop:   0 1 6
# X-Start-Before: heartbeat corosync
# X-Stop-After:   heartbeat corosync
# Short-Description:    Control drbd resources.
### END INIT INFO 

Now vim gfs2:
The original line here: #chkconfig: - 26 74. I changed it to: # chkconfig: - 70 07


#!/bin/bash
#
#
#
# chkconfig: - 70 07
# description: mount/unmount gfs2 filesystems configured in /etc/fstab
#
#
### BEGIN INIT INFO
# Provides:
### END INIT INFO
:q
:

Now cd /etc/rc.d/rc5.d.

mv S26gfs2  S70gfs2
mv S70drbd  S55drbd
in all other rc0.d-rc4.d and rc.6.d, mv K74gfs2 K07gfs2

Now restart both nodes.
Mkdir /windows/homes on both nodes.Point your [homes] in /usr/local/samba/etc/smb.conf to path= /windows/homes:

[homes]
       path= /windows/homes
       read only=no

Make as described in Step3: Add home derictories and rights. You will find your files synchronized on both node1 und node2


Now important to make your simple failover work you have to tune your named server  on node1:
This are the entries for your  /usr/local/samba/private/dns/yourdomianzone

EX mine : /usr/local/samba/private/dns/tuebingen.tst.loc.zone
Change it according your settings:

; -*- zone -*-
; generated by provision.pl
$ORIGIN tuebingen.tst.loc.
$TTL 1W
@               IN SOA  @   hostmaster (
                                2010080911   ; serial
                                2D              ; refresh
                                4H              ; retry
                                6W              ; expiry
                                1W )            ; minimum
                        IN NS   node1
				
            IN A    192.168.134.27
            IN A    192.168.134.28
;192.168.134.28 eingefuegt
;

node1        IN A    192.168.134.27
node2        IN A    192.168.134.28
gc._msdcs               IN A    192.168.134.27

13ff0be8-50f6-45b8-858e-9a38872906e0._msdcs     IN CNAME        node1
aaf6380d-162e-4263-86b2-c4119457342c._mscds     IN CNAME        node2
;
; global catalog servers
_gc._tcp                IN SRV 0 100 3268       node1
_gc._tcp.Default-First-Site-Name._sites IN SRV 0 100 3268       node1
_ldap._tcp.gc._msdcs    IN SRV 0 100 3268       node1
_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs     IN SRV 0 100 3268 node1
;
; ldap servers
_ldap._tcp              IN SRV 0 100 389        node1
_ldap._tcp              IN SRV 0 100 389        node2

_ldap._tcp.dc._msdcs    IN SRV 0 100 389        node1
_ldap._tcp.dc._msdcs    IN SRV 0 100 389        node2

_ldap._tcp.pdc._msdcs   IN SRV 0 100 389        node1
;von mir eingefuegt
_ldap._tcp.pdc._msdcs   IN SRV 0 100 389        node2
;ende

_ldap._tcp.fac1d707-a9a9-44a2-8b02-4ab6dda8cec7.domains._msdcs          IN SRV 0 100 389 node1
_ldap._tcp.fac1d707-a9a9-44a2-8b02-4ab6dda8cec7.domains._msdcs          IN SRV 0 100 389 node2

_ldap._tcp.Default-First-Site-Name._sites               IN SRV 0 100 389 node1
_ldap._tcp.Default-First-Site-Name._sites               IN SRV 0 100 389 node2

_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs     IN SRV 0 100 389 node1
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs     IN SRV 0 100 389 node2

;
; krb5 servers
_kerberos._tcp          IN SRV 0 100 88         node1
_kerberos._tcp          IN SRV 0 100 88         node2

_kerberos._tcp.dc._msdcs        IN SRV 0 100 88 node1
_kerberos._tcp.dc._msdcs        IN SRV 0 100 88 node2



_kerberos._tcp.Default-First-Site-Name._sites   IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites   IN SRV 0 100 88 node2

_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 node2

_kerberos._udp          IN SRV 0 100 88         node1
_kerberos._udp          IN SRV 0 100 88         node2

; MIT kpasswd likes to lookup this name on password change
_kerberos-master._tcp           IN SRV 0 100 88         node1
_kerberos-master._tcp           IN SRV 0 100 88         node2

_kerberos-master._udp           IN SRV 0 100 88         node1
_kerberos-master._udp           IN SRV 0 100 88         node2

;
; kpasswd
_kpasswd._tcp           IN SRV 0 100 464        node1
_kpasswd._tcp           IN SRV 0 100 464        node2

_kpasswd._udp           IN SRV 0 100 464        node1
_kpasswd._udp           IN SRV 0 100 464        node2

;
; heimdal 'find realm for host' hack
_kerberos               IN TXT  TUEBINGEN.TST.LOC


Now make your Netlogon failover:
On node1:
This will sync scripts to node2 on the fly.
Put your logins script there ex: login.cmd
My netlogon resides here:
Attention be shure to put the right rights here to the sysvol directory
On both nodes this has to be root:wheel!!!!!!!!!!!!!!
Cd /usr/local/samba/var/locks/sysvol/tuebingen.tst.loc
Cp –r scripts /windows
Chown –R root:wheel /windows/scripts.
mv  scripts scripts.org.
ln –s /windows/scipts scripts.
Chown –R root:wheel scripts.
On node2:
Important on node2, I had to do a chown –R root:wheel to /usr/local/samba/var/locks/sysvol
In /usr/local/samba/var/locks/sysvol/tuebingen.tst.loc
Mv scripts scripts.org
Ln –s /windows/scripts scripts
Chown root:wheel scripts

Next step about Policies:
node1:
/usr/local/samba/var/locks/sysvol/tuebingen.tst.loc/Policies.
On node1: cd /usr/local/samba/var/locks/sysvol/tuebingen.tst.loc/
cp –r Policies /windows
chown –R  root:wheel  /windows/Policies
mv Policies Policies.org
ln –s /windows/Policies Policies
chown –R root:wheel Policies
node2:
If you have not done it before:
chown –R root:wheel /usr/local/samba/var/locks/sysvol
cd /usr/local/samba/var/locks/sysvol/tuebingen.tst.loc:
On node2 as the 2nd dc there was done no Policies-directory.
Now: ln –s /windows/Policies Policies
Chown –R root:wheel Policies


[root at node2 tuebingen.tst.loc]# ls -la
insgesamt 12
drwxr-xr-x 3 root wheel 4096 12. Aug 11:22 .
drwxr-xr-x 3 root wheel 4096 11. Aug 15:37 ..
lrwxrwxrwx 1 root wheel   17 12. Aug 11:22 Policies -> /windows/Policies
lrwxrwxrwx 1 root wheel   16 11. Aug 15:46 scripts -> /windows/scripts
drwxr-xr-x 2 root wheel 4096 11. Aug 15:37 scripts.old

Step 5 Making dns available Master/Slave- Server:

The next step will be making the DNS-Server on node1 the master and the one on node2 the secondary (slave) server. And we create a reverse Zone.
So when you put to your windows clients: node1 as your first dns and node 2 as your second your domain will always be found as long one of the server are running.

Now on node1: Remember we point in our /etc/named.conf to our dns-samba-file in /usr/local/samba/private/named.conf. We have to change a little in this /usr/local/samba/private/named.conf:

# This file should be included in your main BIND configuration file
#
# For example with
# include "/usr/local/samba/private/named.conf";

zone "tuebingen.tst.loc." IN {
        type master;
        file "/usr/local/samba/private/dns/tuebingen.tst.loc.zone";
        /*
         * the list of principals and what they can change is created
         * dynamically by Samba, based on the membership of the domain controllers
         * group. The provision just creates this file as an empty file.
         */
        include "/usr/local/samba/private/named.conf.update";

        /* we need to use check-names ignore so _msdcs A records can be created */
        check-names ignore;
        allow-transfer { 192.168.134.28;   };#<----------------
};

# The reverse zone configuration#<--------------reverse starts here 

zone "134.168.192.in-addr.arpa" in {
        type master;
        file "/usr/local/samba/private/dns/134.168.192.in-addr.arpa.zone";
         allow-transfer { 192.168.134.28;   };
        update-policy {
                grant *.TST.LOC wildcard *.134.168.192.in-addr.arpa. PTR;
        };
};



Look at my file: allow-transfer { 192.168.134.28;   };. Allow –transfer here you must fit to your node2. This IP is allowed to pull a copy of the zone files.

The  reverse zone configuration, take it as example. I choosed a 192.168.134 subnet here, and I put the file exactly where the sama-dns-file was created.

[root at node1 dns]# ls -la
insgesamt 28
drwxrwxr-x 2 named named 4096 14. Aug 10:48 .
drwxr-xr-x 7 root  root  4096 16. Aug 09:15 ..
-rwxrwxrwx 1 named named  626 13. Aug 09:34 134.168.192.in-addr.arpa.zone
-rwxrwxrwx 1 named named 2977 13. Aug 12:25 tuebingen.tst.loc.zone
There goes all the Clients in this Subnet. You have to do it manually.

EX: My 134.168.192.in-addr.arpa.zone:


$ORIGIN 134.168.192.in-addr.arpa.
$TTL    1W
@                       IN SOA  tuebingen.tst.loc. root.tuebingen.tst.loc. (
                                01              ; serial
                                2D              ; refresh
                                4H              ; retry
                                6W              ; expiry
                                1W )            ; minimum

                        IN NS                   node1.tuebingen.tst.loc.
		            IN NS		           node2.tuebingen.tst.loc.   
27                     IN PTR                 node1.tuebingen.tst.loc.
28                     IN PTR                 node2.tuebingen.tst.loc.


Now my samba-dns-file: We have two dns!!!

[root at node1 dns]# cat tuebingen.tst.loc.zone
; -*- zone -*-
; generated by provision.pl
$ORIGIN tuebingen.tst.loc.
$TTL 1W
@               IN SOA  @   hostmaster (
                                2010081113   ; serial
                                2D              ; refresh
                                4H              ; retry
                                6W              ; expiry
                                1W )            ; minimum
                        IN NS   node1
;secondary eintrag
                        IN NS   node2   #<---secondary dns
            IN A    192.168.134.27
            IN A    192.168.134.28

;

node1        IN A    192.168.134.27
node2        IN A    192.168.134.28
gc._msdcs               IN A    192.168.134.27

02284f45-de16-4125-a795-3b614f540ef7._msdcs     IN CNAME        node1
a441f8f9-629d-43c4-bce6-a5dfba1e4ad9._mscds     IN CNAME        node2
;
; global catalog servers
_gc._tcp                IN SRV 0 100 3268       node1
_gc._tcp.Default-First-Site-Name._sites IN SRV 0 100 3268       node1
_ldap._tcp.gc._msdcs    IN SRV 0 100 3268       node1
_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs     IN SRV 0 100 3268 node1
;
; ldap servers
_ldap._tcp              IN SRV 0 100 389        node1
_ldap._tcp              IN SRV 0 100 389        node2

_ldap._tcp.dc._msdcs    IN SRV 0 100 389        node1
_ldap._tcp.dc._msdcs    IN SRV 0 100 389        node2

_ldap._tcp.pdc._msdcs   IN SRV 0 100 389        node1
_ldap._tcp.pdc._msdcs   IN SRV 0 100 389        node2
;Eintrag fuer pdc

_ldap._tcp.3d718df6-359c-4eb4-a0de-5a7aaf5b0d26.domains._msdcs          IN SRV 0 100 389 node1
_ldap._tcp.3d718df6-359c-4eb4-a0de-5a7aaf5b0d26.domains._msdcs          IN SRV 0 100 389 node2

_ldap._tcp.Default-First-Site-Name._sites               IN SRV 0 100 389 node1
_ldap._tcp.Default-First-Site-Name._sites               IN SRV 0 100 389 node2

_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs     IN SRV 0 100 389 node1
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs     IN SRV 0 100 389 node2

;
; krb5 servers
_kerberos._tcp          IN SRV 0 100 88         node1
_kerberos._tcp          IN SRV 0 100 88         node2

_kerberos._tcp.dc._msdcs        IN SRV 0 100 88 node1
_kerberos._tcp.dc._msdcs        IN SRV 0 100 88 node2

_kerberos._tcp.Default-First-Site-Name._sites   IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites   IN SRV 0 100 88 node2

_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 node2

_kerberos._udp          IN SRV 0 100 88         node1
_kerberos._udp          IN SRV 0 100 88         node2

; MIT kpasswd likes to lookup this name on password change
_kerberos-master._tcp           IN SRV 0 100 88         node1
_kerberos-master._tcp           IN SRV 0 100 88         node2

_kerberos-master._udp           IN SRV 0 100 88         node1
_kerberos-master._udp           IN SRV 0 100 88         node2

;
; kpasswd
_kpasswd._tcp           IN SRV 0 100 464        node1
_kpasswd._tcp           IN SRV 0 100 464        node2

_kpasswd._udp           IN SRV 0 100 464        node1
_kpasswd._udp           IN SRV 0 100 464        node2

;
; heimdal 'find realm for host' hack
_kerberos               IN TXT  TUEBINGEN.TST.LOC


Now we switch over to node2:

We have to create the dns directory in /usr/local/samba/private:
 mkdir /usr/local/samba/private/dns.
Chown –R named:named /usr/local/samba/private/dns.
Chmod –R 770 /usr/local/samba/private/dns.
Copy over /usr/local/samba/private/named.conf to your node2.
scp /usr/local/samba/private/named.conf root at node2:/usr/local/samba/private.
Then we have to edit this file. It should look like this:

zone "tuebingen.tst.loc." IN {
        type slave;  #<----------we mark it as slave
        file "/usr/local/samba/private/dns/tuebingen.tst.loc.zone";
        masters { 192.168.134.27; };#<---we tell him were to pull the zone
        /*
         * the list of principals and what they can change is created
         * dynamically by Samba, based on the membership of the domain controllers
         * group. The provision just creates this file as an empty file.
         */
        //and we had to remove the update section because a slave cannot.
        //include "/usr/local/samba/private/named.conf.update";

        /* we need to use check-names ignore so _msdcs A records can be created */
        check-names ignore;
};

# The reverse zone configuration is optional.  The following example assumes a
# subnet of 192.168.123.0/24:


zone "134.168.192.in-addr.arpa" in {
        type slave;
        file "/usr/local/samba/private/dns/134.168.192.in-addr.arpa.zone";
         masters  { 192.168.134.27;   };
};
 
Now make shure /usr/local/samba/private/named.conf has the rights, named:named.
Chown named:named /usr/local/samba/private/named.conf.
And also your /etc/named.conf points to that file:
// named.conf
options {
        listen-on port 53 { 127.0.0.1;192.168.134.28; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { localhost; 192.168.135.0/24; 192.168.134.0/24; };
        recursion yes;
        forwarders { 192.168.134.253; };
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/usr/local/samba/private/named.conf";  #<---make it point the right way
include "/etc/named.rfc1912.zones";

Now restart both dns-servers.

On node2 you will find now in /usr/local/samba/private/dns:

-rw-r--r-- 1 named   500  406 15. Aug 00:51 134.168.192.in-addr.arpa.zone
-rw-r--r-- 1 named   500 2680 15. Aug 08:46 tuebingen.tst.loc.zone


Making Bind (Secure)Transaction Signatures (TSIG):

In /etc on node1:
[root at node1 etc]# dnssec-keygen -a HMAC-MD5 -b 128 -n HOST rndc-key
This will give you:
Krndc-key.+157+42092

The new keys are stored in /etc
[root at node1 etc]# ls K*
Krndc-key.+157+42092.key  Krndc-key.+157+42092.private

Krndc-key.+157+42092.key = Public key. The Key file contains a DNS KEY record that can de inserted into a zone file!!!
 
Krndc-key.+157+42092.private = The private key. This file contains algorithm fields.

Now you need the key. So do:
cat /etc/Krndc-key.+157+42092.private


[root at node1 etc]# cat Krndc-key.+157+42092.key
rndc-key. IN KEY 512 3 157 XVPzLYeEgmaG57IXg7eHrA==
[root at node1 etc]# cat Krndc-key.+157+42092.private
Private-key-format: v1.2
Algorithm: 157 (HMAC_MD5)
Key: XVPzLYeEgmaG57IXg7eHrA==
Bits: AAA=

You need the part after Key:,in my case: XVPzLYeEgmaG57IXg7eHrA==

Now I made a file in /var/named called tsig.key

vim /var/named/tsig.key
IN my case:
key "TRANSFER" {
        algorithm hmac-md5;
        secret "XVPzLYeEgmaG57IXg7eHrA==";
};
#Your Slave Server IP
server 192.168.134.28 {
        keys {
                TRANSFER;
        };

};

Chown named:named /var/named/tsig.key.

Now you must include in your /etc/named.conf the tsig.key file.

include "/var/named/tsig.key";

On the SLAVE(NODE2):
Now copy your /var/named/tsig.key to the bind-slave-server.
In my case:
[root at node1 named]# scp tsig.key root at node2:/var/named
root at node2's password:
tsig.key                                      100%  153     0.2KB/s   00:00

Do not forget chown named:named the tsig.key on the slave.
You have to edit the tsig.key on the bind-slave-server:
In my case:

key "TRANSFER" {
        algorithm hmac-md5;
        secret "XVPzLYeEgmaG57IXg7eHrA==";
};
#Your Master Server IP
server 192.168.134.27 {
        keys {
                TRANSFER;
        };

};

The difference between the key files is only the Ip.On the slave fill in the Ip of your Master Server.

Fill in your /etc/named.conf:
include "/var/named/tsig.key";





Now you need to edit your /usr/local/samba/private/named.conf

You must restrict zone transfers to those signed with TRANSFER key as follows:

zone "tuebingen.tst.loc." IN {
        type master;
        file "/usr/local/samba/private/dns/tuebingen.tst.loc.zone";
        /*
         * the list of principals and what they can change is created
         * dynamically by Samba, based on the membership of the domain controllers
         * group. The provision just creates this file as an empty file.
         */
        include "/usr/local/samba/private/named.conf.update";

        /* we need to use check-names ignore so _msdcs A records can be created */
        check-names ignore;
        #allow-transfer { 192.168.134.28;   };##<-- old
        allow-transfer { key TRANSFER;   };## -new
};

zone "134.168.192.in-addr.arpa" in {
        type master;
        file "/usr/local/samba/private/dns/134.168.192.in-addr.arpa.zone";
         allow-transfer { key TRANSFER;   }; ##<-- new
         #  allow-transfer { 192.168.134.28;   };##<--- old
        update-policy {
                grant *.TST.LOC wildcard *.134.168.192.in-addr.arpa. PTR;
        };
};

The restart both master and slave.

Look inside your log if it is working:

In my case the log file resides in /var/named/data/  file named.run:
ON NODE1:

zone tuebingen.tst.loc/IN: sending notifies (serial 2010081113)
zone 134.168.192.in-addr.arpa/IN: sending notifies (serial 1)
client 192.168.134.28#20295: received notify for zone 'tuebingen.tst.loc': TSIG 'transfer'
client 192.168.134.28#25099: received notify for zone '134.168.192.in-addr.arpa': TSIG 'transfer'

ON NODE2:

reloading zones succeeded
client 192.168.134.27#18877: received notify for zone 'tuebingen.tst.loc': TSIG 'transfer'
zone tuebingen.tst.loc/IN: notify from 192.168.134.27#18877: zone is up to date
client 192.168.134.27#37510: received notify for zone '134.168.192.in-addr.arpa': TSIG 'transfer'
zone 134.168.192.in-addr.arpa/IN: notify from 192.168.134.27#37510: zone is up to date


Updating from Samba4 Alpha12 to Alpha13:
This steps take place on node1 and node2:
First of all backup your /usr/local/samba-directory
Mkdir /backup
Cp –r /usr/local/samba/ /backup

The download of the source with rsync won’t work for me at all.

I had to install git from epel: (If you are running 64 bit change i386 to x86_64)
rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/i386/epel-release-5-4.noarch.rpm

yum install git

Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package git.i386 0:1.5.5.6-4.el5 set to be updated
--> Processing Dependency: perl-Git = 1.5.5.6-4.el5 for package: git
--> Processing Dependency: perl(Error) for package: git
--> Processing Dependency: perl(Git) for package: git
--> Running transaction check
---> Package perl-Error.noarch 1:0.17010-1.el5 set to be updated
---> Package perl-Git.i386 0:1.5.5.6-4.el5 set to be updated
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package            Arch           Version                   Repository    Size
================================================================================
Installing:
 git                i386           1.5.5.6-4.el5             epel         3.4 M
Installing for dependencies:
 perl-Error         noarch         1:0.17010-1.el5           epel          26 k
 perl-Git           i386           1.5.5.6-4.el5             epel          16 k

Transaction Summary
================================================================================
Install       3 Package(s)
Upgrade       0 Package(s)

Total download size: 3.4 M
Is this ok [y/N]: y

Mkdir samba413


git clone git://git.samba.org/samba.git  /samba413/samba

cd /samba413/samba

git pull

cd source4
./autogen.sh
This will result in:
[root at node1 source4]# ./autogen.sh
Setting up for waf build
done. Now run ./configure or ./configure.developer then make.

./configure.devloper
Make
--> Now stop all samba processes!!!!
Then: I made a “make install” and it worked.<--
This did not work!!!!!!!!!!!!!!:
./scripting/bin/upgradeprovision –full -s /usr/local/samba/etc/smb.conf 

With error:

[root at node1 source4]# ./scripting/bin/upgradeprovision --full -s /usr/local/samba/etc/smb.conf Found 2 domain controllers, for the moment upgradeprovisionis not able to handle upgrade on domain with more than one DC, please demote the other(s) DC(s) before upgrading Sanity checks for the upgrade fails, checks messages and correct them before rerunning upgradeprovision A transaction is still active in ldb context [0x8bdaae8] on /usr/local/samba/private/sam.ldb A transaction is still active in ldb context [0x9b1b3b8] on /usr/local/samba/private/idmap.ldb
A transaction is still active in ldb context [0x95b4568] on /usr/local/samba/private/secrets.ldb
A transaction is still active in ldb context [0x97ee9d8] on /usr/local/samba/private/privilege.ldb

Start samba

-----------------------------------------------
EDV Daniel Müller

Leitung EDV
Tropenklinik Paul-Lechler-Krankenhaus
Paul-Lechler-Str. 24
72076 Tübingen

Tel.: 07071/206-463, Fax: 07071/206-499
eMail: mueller at tropenklinik.de
Internet: www.tropenklinik.de
-----------------------------------------------



More information about the samba mailing list