[Samba] Upgrading samba from jessie (4.2) to stretch (4.5) in AD mode...

[Rowland Penny]

On Sun, 23 Jul 2017 16:16:24 -0400
gimili17--- via samba <samba at lists.samba.org> wrote:

> I am also trying to upgrade from Debian Jessie to Stretch.  Things 
> worked perfectly before the upgrade.  The upgrade fails as per
> below.  I followed this thread and did a lot of googling but I can't
> seem to figure this out.    The only purpose of this machine is an
> active directory domain controller. Any help/advice/tips would be
> appreciated.
> 
> apt dist-upgrade
> Reading package lists... Done
> Building dependency tree
> Reading state information... Done
> Calculating upgrade... Done
> 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
> 2 not fully installed or removed.
> After this operation, 0 B of additional disk space will be used.
> Do you want to continue? [Y/n]
> 
> Setting up winbind (2:4.5.8+dfsg-2+deb9u1+b1) ...
> Job for winbind.service failed because the control process exited
> with error code.
> See "systemctl status winbind.service" and "journalctl -xe" for
> details. invoke-rc.d: initscript winbind, action "start" failed.
> ● winbind.service - Samba Winbind Daemon
>     Loaded: loaded (/lib/systemd/system/winbind.service; enabled;
> vendor preset: enabled)
>     Active: failed (Result: exit-code) since Sat 2017-07-22 12:07:27 
> EDT; 6ms ago
>       Docs: man:winbindd(8)
>             man:samba(7)
>             man:smb.conf(5)
>    Process: 2670 ExecStart=/usr/sbin/winbindd $WINBINDOPTIONS 
> (code=exited, status=1/FAILURE)
>   Main PID: 2670 (code=exited, status=1/FAILURE)
> 
> Jul 22 12:07:27 bob systemd[1]: Starting Samba Winbind Daemon...
> Jul 22 12:07:27 bob systemd[1]: winbind.service: Main process exited, 
> code=exited, status=1/FAILURE
> Jul 22 12:07:27 bob systemd[1]: Failed to start Samba Winbind Daemon.
> Jul 22 12:07:27 bob systemd[1]: winbind.service: Unit entered failed
> state. Jul 22 12:07:27 bob systemd[1]: winbind.service: Failed with
> result 'exit-code'.
> dpkg: error processing package winbind (--configure):
>   subprocess installed post-installation script returned error exit
> status 1 Setting up samba (2:4.5.8+dfsg-2+deb9u1+b1) ...
> Job for smbd.service failed because the control process exited with 
> error code.
> See "systemctl status smbd.service" and "journalctl -xe" for details.
> invoke-rc.d: initscript smbd, action "start" failed.
> 
> ● smbd.service - Samba SMB Daemon
>     Loaded: loaded (/lib/systemd/system/smbd.service; enabled; vendor 
> preset: enabled)
>     Active: failed (Result: exit-code) since Sat 2017-07-22 12:07:28 
> EDT; 6ms ago
>       Docs: man:smbd(8)
>             man:samba(7)
>             man:smb.conf(5)
>    Process: 2731 ExecStart=/usr/sbin/smbd $SMBDOPTIONS (code=exited, 
> status=1/FAILURE)
>   Main PID: 2731 (code=exited, status=1/FAILURE)
> 
> Jul 22 12:07:28 bob systemd[1]: Starting Samba SMB Daemon...
> Jul 22 12:07:28 bob smbd[2731]: [2017/07/22 12:07:28.296957,  0] 
> ../source3/smbd/server.c:1698(main)
> Jul 22 12:07:28 bob smbd[2731]:   server role = 'active directory
> domain controller' not compatible with running smbd standalone.
> Jul 22 12:07:28 bob systemd[1]: smbd.service: Main process exited, 
> code=exited, status=1/FAILURE
> Jul 22 12:07:28 bob systemd[1]: Failed to start Samba SMB Daemon.
> Jul 22 12:07:28 bob systemd[1]: smbd.service: Unit entered failed
> state. Jul 22 12:07:28 bob systemd[1]: smbd.service: Failed with
> result 'exit-code'.
> dpkg: error processing package samba (--configure):
>   subprocess installed post-installation script returned error exit
> status 1 Processing triggers for libc-bin (2.24-11+deb9u1) ...
> Errors were encountered while processing:
>   winbind
>   samba
> E: Sub-process /usr/bin/dpkg returned an error code (1)
> 
> _*Before the upgrade my smb.conf looked like:
> 
> *_ # Global parameters
> [global]
>          netbios name = BOB
>          realm = AD.mycompany.ORG
>          workgroup = AD
>          server role = active directory domain controller
>          idmap_ldb:use rfc2307 = yes
>          printcap name = cups
>          bind interfaces only = Yes
>          interfaces = lo eth0.17
>          ldap server require strong auth = allow_sasl_over_tls
>          dns forwarder = 192.168.10.2
>          logon script = logon.bat
>          security = user
>          map to guest = Bad User
> 
> [netlogon]
>          path = /var/lib/samba/sysvol/ad.mycompany.org/scripts
>          read only = No
> 
> [sysvol]
>          path = /var/lib/samba/sysvol
>          read only = No

If I remember correctly, there is a Debian bug about this, winbind
doesn't upgraded correctly (or something like that).

You should also remove the 'security = user' line, you should be using
the default setting of 'auto'

Rowland