samba - Oct 2019 - dns replication error due to deleted records

On 11/10/2019 14:58, Luca Olivetti via samba wrote:
> El 10/10/19 a les 20:23, Luca Olivetti via samba ha escrit:
>> Today I noticed something that has been going on for some weeks:
>>
>> I have 2 dc, (dc1 and dc2) both debian buster with the distro 
>> provided samba (4.9.5), recently upgraded from stretch.
>>
>> samba-tool drs showrepl on dc2 says
>>
>> DC=DomainDnsZones,DC=samba,DC=wetron,DC=es
>> ???????? Default-First-Site-Name\DC1 via RPC
>> ???????????????? DSA object GUID: 89812346-9037-43b0-86ab-c5052f55125d
>> ???????????????? Last attempt @ Thu Oct 10 20:05:28 2019 CEST failed, 
>> result 58 (WERR_BAD_NET_RESP)
>> ???????????????? 273 consecutive failure(s).
>> ???????????????? Last success @ Thu Oct 10 12:05:27 2019 CEST
>>
>> (the rest of the incoming replications are fine, only the 
>> DomainDnsZone fails).
>>
>> It turns out that dc2 chokes on "\0ADEL" dns records,
supposedly
>> deleted objects.
>>
>> I found a "solution" here:
>>
>> https://www.dotnetcatch.com/2018/06/19/samba-replication-failures/
>>
>> The procedure to solve it is not exactly the same but it put me on 
>> the, hopefully, right track. I scripted it since it got tiresome and 
>> it solved the replication problem, for a while, but now it reappeared 
>> (that's the message above).
>>
>> This started on September 25, when I upgraded dc2 from stretch to 
>> buster. A few days later I also upgraded dc1 (it was still running 
>> jessie).
>>
>> I'm using internal dns and the dhcp server talks to dc1 to update
the
>> dns records, that would explain why there are records to replicate 
>> but doesn't explain why samba fails (when it didn't before).
>
> The problem persists :-(
>
> DC=DomainDnsZones,DC=samba,DC=wetron,DC=es
> ??????? Default-First-Site-Name\DC1 via RPC
> ??????????????? DSA object GUID: 89812346-9037-43b0-86ab-c5052f55125d
> ??????????????? Last attempt @ Fri Oct 11 15:50:30 2019 CEST failed, 
> result 58 (WERR_BAD_NET_RESP)
> ??????????????? 283 consecutive failure(s).
> ??????????????? Last success @ Fri Oct 11 08:35:30 2019 CEST
>
> samba-tool dbcheck --cross-ncs gives no error on both DCs (though dc1 
> is reporting 20276 objects and dc2 20180, after cleaning the bad 
> entries the count is 20272 on dc1 and 20208 on dc2)
>
>
> The strange thing is that this is happening now with both DCs running 
> buster with the same samba version and never happened when dc1 was 
> running jessie and dc2 stretch.
>
> Bye
Try running this on a DC:

samba-tool ldapcmp ldap://DC1 ldap://DC2 
--filter='whenChanged,dc,DC,cn,CN,ou,OU'

Replace 'DC1' and 'DC2' with your actual DC short hostnames

It should tell you the differences.

Rowland

El 11/10/19 a les 16:12, Rowland penny via samba ha
escrit:
> Try running this on a DC:
> 
> samba-tool ldapcmp ldap://DC1 ldap://DC2 
> --filter='whenChanged,dc,DC,cn,CN,ou,OU'
> 
> Replace 'DC1' and 'DC2' with your actual DC short hostnames
> 
> It should tell you the differences.
The list is too long to post here.

There are 3 difference in versionNumber for the [DOMAIN] context, one 
for pwdLastSet in the same domain.

The big issue is the [DNSDOMAIN] context:

* DN lists have different size: 753 != 865

and then a big list, I suppose of the records that are in one dc and not 
in the other.
Of the remaining objects one is different

The question is, why there are so many differences and how do I fix it?

Bye
-- 
Luca Olivetti
Wetron Automation Technology http://www.wetron.es/
Tel. +34 93 5883004 (Ext.3010)  Fax +34 93 5883007

El 11/10/19 a les 16:59, Luca Olivetti via samba ha
escrit:
> El 11/10/19 a les 16:12, Rowland penny via samba ha escrit:
>> Try running this on a DC:
>>
>> samba-tool ldapcmp ldap://DC1 ldap://DC2 
>> --filter='whenChanged,dc,DC,cn,CN,ou,OU'
>>
>> Replace 'DC1' and 'DC2' with your actual DC short
hostnames
>>
>> It should tell you the differences.
> 
> The list is too long to post here.
it's here:

https://pastebin.com/UFEPvgjX
> 
> There are 3 difference in versionNumber for the [DOMAIN] context, one 
> for pwdLastSet in the same domain.
> 
> The big issue is the [DNSDOMAIN] context:
> 
> * DN lists have different size: 753 != 865
> 
> and then a big list, I suppose of the records that are in one dc and not 
> in the other.
> Of the remaining objects one is different
> 
> The question is, why there are so many differences and how do I fix it?
> 
> Bye

-- 
Luca Olivetti
Wetron Automation Technology http://www.wetron.es/
Tel. +34 93 5883004 (Ext.3010)  Fax +34 93 5883007