[Samba] Repacking database from v1 to v2 / Samba failed to prime database, error code 22

[Andrew Bartlett]

On Wed, 2022-10-05 at 10:21 +0200, Arnaud FLORENT via samba wrote:
> Hi
> 
> Le 04/10/2022 à 22:15, Andrew Bartlett a écrit :
> > Yes.  First try with unpatched Samba 4.13 (or much better a
> > supported
> > version please!), but if that fails then grab Samba 'git master'
> > and
> > build that for testing, as my patch is now merged there.
> > 
> > Backported patches will appear at
> > https://bugzilla.samba.org/show_bug.cgi?id=15189
> > 
> 
> 
> so i ran  samba-tool drs clone-dc-database with debug level 3
> 
> it helped me to find 3 entries with weird (bad encoding?) values on 
> attribute (defined in updated LDAP schema)
> 
> 
> after fixing those values on samba 4.3 AD, samba-tool drs 
> clone-dc-database run successfully

Great.

> and samba-tool dbcheck on targetdir report only 1 error with  SID 
> conflicts with our current RID set in CN=RID Set,

Awesome!

> 
> > > > We can also look into why the in-place upgrade fails.
> > > > 
> > > > Running 'samba-tool dbcheck --reindex' using the modern version
> > > > should
> > > > allow the error to be seen in a more controlled circumstance,
> > > > and
> > > > allow
> > > > raising the debug level etc.
> > > 
> > > samba-tool dbcheck (without --reindex) on 4.13 returns
> > > 
> > > Checked 4287 objects (6449 errors)
> > > 
> > > mainly
> > > 
> > > ERROR: incorrect attributeID values in replPropertyMetaData on
> > > ...
> > > ERROR: unsorted attributeID values in replPropertyMetaData on ...
> > > ERROR: unsorted attributeID values in replPropertyMetaData on ...
> > > 
> > > 
> > > but may be it is because db repacking failed?
> > 
> > No, this is a different thing.   These are real bugs at a higher
> > layer,
> > and while the unsorted attributeIDs are harmless (to samba, will
> > break
> > windows), the incorrect attributeID may impact on the attempted
> > replication.
> > 
> > What happens with the --reindex?  (This opens a transaction, which
> > triggers the re-index, otherwise we just read the old format).
> 
> reindex failed on same attribute as samba-tool drs clone-dc-database
> 
> re-indexed database : (1, "reindexing failed: 
> ../../ldb_key_value/ldb_kv_index.c:3048: Failed to re-index
> kwartzExtID 
> in CN=someuser,CN=Users,DC=my,DC=domaine - Failed to create index
> key 
> for attribute 'kwartzExtID':Unknown error:Entry @ATTRIBUTES already
> exists")
> 
> 
> so i did this:
> 
> - fixed this attribute values values on samba 4.3 server
> 
> - copy private dir backup to samba 4.13 test server
> 
> - samba 4.13 then starts successfully with 5 "ldb: Repacking
> database 
> from v1 to v2 " message in log.samba
> 
> - directory returns all users and groups (via wbinfo or ldap)
> 
> 
> BUT
> 
> samba-tool dbcheck still reports Checked 4204 objects (6365 errors)
> with 
> in log 3 types of errors:
> 
> ERROR: incorrect attributeID values in replPropertyMetaData
> 
> ERROR: unsorted attributeID values in replPropertyMetaData
> 
> ERROR: linked attribute 'member' is present on deleted object
> 
> 
> but samba-tool dbcheck --reindex runs successfully [completed re-
> index OK]
> 

So now run 'samba-tool dbcheck --cross-ncs --fix --yes' to fix those
errors. 

> 
> do you think AD will be fully functionnal with this copied data (as
> for 
> in place upgrade)?

To be clear, this is an in-place upgrade, as far as Samba is concerned,
as you copied over the private directory files.   So yes, it shows that
an in-place upgrade on the original server would work. 

Just make sure you run that 'samba-tool dbcheck --cross-ncs --fix --
yes' to tidy up our historical errors in replPropertyMetaData and avoid
a future duplicate allocation of that rouge SID. 

I wish you all the best with your upgrade and encourage a move to a
fully supported version ASAP, as there are a number of security issues
still in 4.13 (unless someone other than Samba has been backporting). 

Andrew Bartlett

-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/
Samba Team Member (since 2001) https://samba.org
Samba Team Lead, Catalyst IT   https://catalyst.net.nz/services/samba

Samba Development and Support, Catalyst IT - Expert Open Source
Solutions