[Samba] samba-tool domain backup offline fails

[Stefan Bellon]

Hi all,

I'm about to set up disaster recovery for the domain and followed
https://wiki.samba.org/index.php/Back_up_and_Restoring_a_Samba_AD_DC
(as I am using Samba 4.13.5).

First I went for the online backup (which works), but AFAICS it requires
administrator authentication and is thus not really suited for
automated backups via a cronjob.

When I tried "samba-tool domain backup offline" however, this fails:

root at dc1:~# samba-tool domain backup offline --targetdir=/root/samba-backup
running backup on dirs: /var/lib/samba/private /var/lib/samba /etc/samba
Starting transaction on /var/lib/samba/private/secrets
Starting transaction on /var/lib/samba/private/sam.ldb
   backing up /var/lib/samba/private/sam.ldb
   backing up locked/related file /var/lib/samba/private/sam.ldb.d/CN=CONFIGURATION,DC=XXX.ldb
   backing up locked/related file /var/lib/samba/private/sam.ldb.d/CN=SCHEMA,CN=CONFIGURATION,DC=XXX.ldb
   copying locked/related file /var/lib/samba/private/sam.ldb.d/metadata.tdb
   backing up locked/related file /var/lib/samba/private/sam.ldb.d/DC=XXX.ldb
   backing up locked/related file /var/lib/samba/private/sam.ldb.d/DC=FORESTDNSZONES,DC=XXX.ldb
   backing up locked/related file /var/lib/samba/private/sam.ldb.d/DC=DOMAINDNSZONES,DC=XXX.ldb
running tdbbackup on lone tdb file /var/lib/samba/private/netlogon_creds_cli.tdb
tdb_mutex_open_ok[/var/lib/samba/private/netlogon_creds_cli.tdb]: Can use mutexes only with MUTEX_LOCKING or NOLOCK
Failed to open /var/lib/samba/private/netlogon_creds_cli.tdb
Starting transaction on solo db: /var/lib/samba/private/privilege.ldb
   running tdbbackup on the same file
Starting transaction on solo db: /var/lib/samba/private/share.ldb
   running tdbbackup on the same file
Starting transaction on solo db: /var/lib/samba/private/hklm.ldb
   running tdbbackup on the same file
running tdbbackup on lone tdb file /var/lib/samba/private/schannel_store.tdb
Starting transaction on solo db: /var/lib/samba/private/idmap.ldb
   running tdbbackup on the same file
running tdbbackup on lone tdb file /var/lib/samba/registry.tdb
running tdbbackup on lone tdb file /var/lib/samba/share_info.tdb
running tdbbackup on lone tdb file /var/lib/samba/account_policy.tdb
running tdbbackup on lone tdb file /var/lib/samba/winbindd_cache.tdb
running tdbbackup on lone tdb file /var/lib/samba/private/netlogon_creds_cli.tdb
tdb_mutex_open_ok[/var/lib/samba/private/netlogon_creds_cli.tdb]: Can use mutexes only with MUTEX_LOCKING or NOLOCK
Failed to open /var/lib/samba/private/netlogon_creds_cli.tdb
Starting transaction on solo db: /var/lib/samba/bind-dns/dns/sam.ldb
module samba_dsdb initialization failed : Operations error
Unable to load modules for /var/lib/samba/bind-dns/dns/sam.ldb: partition_metadata: Migrating partition metadata: create of metadata.tdb gave: partition_metadata: Unable to create /var/lib/samba/bind-dns/dns/sam.ldb.d/metadata.tdb: Device or resource busy

ERROR(ldb): uncaught exception - partition_metadata: Migrating partition metadata: create of metadata.tdb gave: partition_metadata: Unable to create /var/lib/samba/bind-dns/dns/sam.ldb.d/metadata.tdb: Device or resource busy

  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 186, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/domain_backup.py", line 1082, in run
    ldb_obj = Ldb(path, lp=lp)
  File "/usr/lib/python3/dist-packages/samba/__init__.py", line 115, in __init__
    self.connect(url, flags, options)

The wiki says:

  Note that despite this option's name, the DC does not actually need to
  be offline when running this command

Is that still true? Should I be doing it differently?

Greetings,
Stefan

-- 
Stefan Bellon