[Samba] setting up a RODC

[Stefan Kania]

Hi Andrej,

then it works, but on a "normal" addc it works without "-U ".

One more Question:
When I do a "host -t srv _ldap._tcp.example.net" I only see my writeable
DCs but not my RODC. So I tested with:
------
ldbsearch -H /var/lib/samba/private/sam.ldb '(invocationid=*)'
--cross-ncs objectguid
------
Found a objectguid for my RODC

-------
host -t CNAME ab4da5a2-2755-45b4-9d83-1dec1f869477._msdcs.example.net
-------
The CNAME is there
Then I did a:
--------
samba_dnsupdate --verbose --all-names
--------
Still no entry for any of the srv-records on my rodc.


Adding Users for password-caching works.
Next Question :-)
Is there any way to see which users loaded with "samba-tool rodc preload
<user> --server=addc01"

I think, thats all (for the moment)

Stefan

Am 07.08.2018 um 17:13 schrieb Andrej Gessel via samba:
> Hello Stefan,
> 
> you need to use "-U" with user from Domain Admin group(maybe it works
> with other users too, but I didn't test it).
> 
> 
> Andrej
> 
> 
> Am 07.08.2018 um 17:00 schrieb Stefan Kania via samba:
>> When I start the replication from the other DC it works as you can see:
>> -------
>> root at addc-01:~# samba-tool drs replicate rodc-01 addc-01
>> dc=example,dc=net
>> Replicate from addc-01 to rodc-01 was successful.
>> -------
>>
>> Am 07.08.2018 um 15:26 schrieb Stefan Kania via samba:
>>> Hello,
>>>
>>> I just start testing the setup of an RODC with 4.8.3 (I use the packages
>>> from Louis). The join works fine. After a reboot of the rodc I can see
>>> all Objcts with:
>>> ldbsearch --url=/var/lib/samba/private/sam.ldb
>>>
>>> and all users and groups with:
>>> wbinfo -u
>>> wbinfo -g
>>>
>>> But as soon as I try to test the replication I got this message:
>>> -----------
>>> root at rodc-01:/var/lib/samba/private# samba-tool drs showrepl
>>> offsite\RODC-01
>>> DSA Options: 0x00000025
>>> DSA object GUID: ab4da5a2-2755-45b4-9d83-1dec1f869477
>>> DSA invocationId: 92ae0aeb-beea-4944-b65b-61ad4564a87b
>>>
>>> ==== INBOUND NEIGHBORS ====
>>>
>>> ERROR(runtime): DsReplicaGetInfo of type 0 failed - (8453,
>>> 'WERR_DS_DRA_ACCESS_DENIED')
>>> -----------
>>>
>>> If I try to do a replication I see the following messages:
>>> -----------
>>> root at rodc-01:/var/lib/samba/private# samba-tool drs replicate rodc-01
>>> addc-01 dc=example,dc=net
>>> ERROR(<class 'samba.drs_utils.drsException'>): DsReplicaSync failed -
>>> drsException: DsReplicaSync failed (8453, 'WERR_DS_DRA_ACCESS_DENIED')
>>>    File "/usr/lib/python2.7/dist-packages/samba/netcmd/drs.py", line
>>> 389,
>>> in run
>>>      drs_utils.sendDsReplicaSync(server_bind, server_bind_handle,
>>> source_dsa_guid, NC, req_options)
>>>    File "/usr/lib/python2.7/dist-packages/samba/drs_utils.py", line 87,
>>> in sendDsReplicaSync
>>>      raise drsException("DsReplicaSync failed %s" % estr)
>>>
>>> -----------
>>>
>>> With "journalctl -f" open I see:
>>> -----------
>>> Aug 07 15:16:34 rodc-01 samba[518]: task[dcesrv][518]: [2018/08/07
>>> 15:16:34.805062,  0]
>>> ../source4/rpc_server/drsuapi/drsutil.c:109(drs_security_level_check)
>>> Aug 07 15:16:34 rodc-01 samba[518]: task[dcesrv][518]:   DsReplicaSync
>>> refused for security token (level=10)
>>> -----------
>>>
>>> I use Samba together with bind9 everything is running on Debian9
>>> Systems.
>>> Here is the smb.conf from the RODC
>>> -----------
>>> # Global parameters
>>> [global]
>>>          netbios name = RODC-01
>>>          realm = EXAMPLE.NET
>>>          server role = active directory domain controller
>>>          server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc,
>>> drepl, winbindd, ntp_signd, kcc, dnsupdate
>>>          workgroup = EXAMPLE
>>>
>>> [netlogon]
>>>          path = /var/lib/samba/sysvol/example.net/scripts
>>>          read only = No
>>>
>>> [sysvol]
>>>          path = /var/lib/samba/sysvol
>>>          read only = No
>>> -----------
>>> I checked all the permissions for the bind9. The Bind is running and can
>>> access the DNS-DBs
>>> Did I miss someting? The section inside Samba-wiki is not very good at
>>> the moment and I could not find any other how to :-(
>>>
>>> Any help is welcome :-)
>>>
>>> Stefan

>>



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: OpenPGP digital signature
URL: <http://lists.samba.org/pipermail/samba/attachments/20180807/3997a130/signature.sig>