samba - Dec 2015 - Authentication to Secondary Domain Controller initially fails when PDC is offline

Am 17.12.2015 um 14:32 schrieb Rowland penny:
> On 17/12/15 12:50, Ole Traupe wrote:
>>
>> I somehow doubt that. Still it seems that no one here has an idea of 
>> why log-on from member servers isn't working properly (for me). 
>> However, in the meantime I have created all the necessary DNS 
>> records. This can't be the issue anymore.
>>
>>
>
> If you are sure that you now have all the dns records for both DCs in 
> AD, then I would agree that this is probably not the issue (there is 
> just the 0.1% chance you are still missing something)
>
> Can your domain members find the DCs ?
> Do your domain members have a FQDN ?
> Are they joined to the domain ?
> What have got in smb.conf on the domain members ?
>
> You may have posted all or some of this before, but lets start again.
>
> Rowland
>
Ok, there were still records missing (according to "samba_dnsupdate 
--verbose"). I added them manually, and now I get "No DNS updates 
needed" on both my DCs.

Still/again: "kinit" takes more than a minute on member servers, and 
login via ssh is impossible now (times out eventually).

Some questions:

- what about that corrupted record I mentioned earlier, how can I get 
rid if it?
- why does "samba_dnsupdate --verbose" on DC1 check records only
against
1 instance (record from DC1), while the same command issued on DC2 
checks records against both existing instances (records from DC1 and DC2)?
- why does the dns update fail in the first place? will I have the same 
problem again with the next DC I set up?
- why do I still have the login problems?

Ole

On 17/12/15 14:46, Ole Traupe wrote:
>
>
> Am 17.12.2015 um 14:32 schrieb Rowland penny:
>> On 17/12/15 12:50, Ole Traupe wrote:
>>>
>>> I somehow doubt that. Still it seems that no one here has an idea
of
>>> why log-on from member servers isn't working properly (for me).
>>> However, in the meantime I have created all the necessary DNS 
>>> records. This can't be the issue anymore.
>>>
>>>
>>
>> If you are sure that you now have all the dns records for both DCs in 
>> AD, then I would agree that this is probably not the issue (there is 
>> just the 0.1% chance you are still missing something)
>>
>> Can your domain members find the DCs ?
>> Do your domain members have a FQDN ?
>> Are they joined to the domain ?
>> What have got in smb.conf on the domain members ?
>>
>> You may have posted all or some of this before, but lets start again.
>>
>> Rowland
>>
>
> Ok, there were still records missing (according to "samba_dnsupdate 
> --verbose"). I added them manually, and now I get "No DNS updates
> needed" on both my DCs.
>
> Still/again: "kinit" takes more than a minute on member servers,
and
> login via ssh is impossible now (times out eventually).
>
> Some questions:
>
> - what about that corrupted record I mentioned earlier, how can I get 
> rid if it?
Have you tried using samba-tool ?
> - why does "samba_dnsupdate --verbose" on DC1 check records only 
> against 1 instance (record from DC1), while the same command issued on 
> DC2 checks records against both existing instances (records from DC1 
> and DC2)?
Don't know, if you understand python, you could try looking at the script.
>
> - why does the dns update fail in the first place? 
I am not sure that it does fail. When you provision the first DC, all 
the required dns entries are added by the provision, but when you join a 
DC, a lot of the dns entries are only added by the samba_dnsupdate 
script and this is only run when you start samba on the newly joined DC. 
It does print a lot of error messages, but it seems to work anyway.
If you check the dns on the first DC before starting the second, you 
will find missing dns entries, but these should be filled once the 
samba_dnsupdate script is run.
> will I have the same problem again with the next DC I set up?
Again, I am unsure why you are having the problems, so I do not know if 
you will have the same problems. If you have done some thing incorrectly 
and do this again when you join another DC, then you are likely to again 
have problems.
> - why do I still have the login problems?
>
Don't know, can you answer the questions I asked earlier.

Rowland
> Ole
>
>

Am 17.12.2015 um 16:21 schrieb Rowland penny:
> On 17/12/15 14:46, Ole Traupe wrote:
>>
>>
>> Am 17.12.2015 um 14:32 schrieb Rowland penny:
>>> On 17/12/15 12:50, Ole Traupe wrote:
>>>>
>>>> I somehow doubt that. Still it seems that no one here has an
idea
>>>> of why log-on from member servers isn't working properly
(for me).
>>>> However, in the meantime I have created all the necessary DNS 
>>>> records. This can't be the issue anymore.
>>>>
>>>>
>>>
>>> If you are sure that you now have all the dns records for both DCs 
>>> in AD, then I would agree that this is probably not the issue
(there
>>> is just the 0.1% chance you are still missing something)
>>>
>>> Can your domain members find the DCs ?
>>> Do your domain members have a FQDN ?
>>> Are they joined to the domain ?
>>> What have got in smb.conf on the domain members ?
>>>
>>> You may have posted all or some of this before, but lets start
again.
>>>
>>> Rowland
>>>
>>
>> Ok, there were still records missing (according to
"samba_dnsupdate
>> --verbose"). I added them manually, and now I get "No DNS
updates
>> needed" on both my DCs.
>>
>> Still/again: "kinit" takes more than a minute on member
servers, and
>> login via ssh is impossible now (times out eventually).
>>
>> Some questions:
>>
>> - what about that corrupted record I mentioned earlier, how can I get 
>> rid if it?
>
> Have you tried using samba-tool ?
That's what I posted earlier:

"I accidentally  created a record with a false port. I then updated the 
port but was afraid of any consequences. So I deleted that record again 
and wanted to re-create it. But I can't: "The record already
exists."
Although I can't see it in the gui. And I also can't delete it (EDIT: 
although this worked with the corresponding record for the 1st DC; so 
the command is ok):

# samba-tool dns delete DC1 _msdcs.my.domain.tld 
_ldap._tcp.gc._msdcs.my.domain.tld SRV "dc2.my.domain.tld 3268 0 100"
ERROR: Record does not exist

But it can be found with dig:

# dig @DC1 _ldap._tcp.gc._msdcs.my.domain.tld SRV

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.37.rc1.el6_7.4 <<>>
@DC1
_ldap._tcp.gc._msdcs.my.domain.tld SRV
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28612
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;_ldap._tcp.gc._msdcs.my.domain.tld. IN SRV

;; ANSWER SECTION:
_ldap._tcp.gc._msdcs.my.domain.tld. 180 IN SRV 0 100 3268 
dc1.my.domain.tld.
_ldap._tcp.gc._msdcs.my.domain.tld. 180 IN SRV 0 100 3268 
dc2.my.domain.tld.

;; Query time: 1 msec
;; SERVER: IP_of_1stDC#53(IP_of_1stDC)
;; WHEN: Thu Dec 17 13:28:06 2015
;; MSG SIZE  rcvd: 103"

>
>> - why does "samba_dnsupdate --verbose" on DC1 check records
only
>> against 1 instance (record from DC1), while the same command issued 
>> on DC2 checks records against both existing instances (records from 
>> DC1 and DC2)?
>
> Don't know, if you understand python, you could try looking at the 
> script.
Does it behave the same way on your 1st (one check) and 2nd DC (two checks)?
>
>>
>> - why does the dns update fail in the first place? 
>
> I am not sure that it does fail. When you provision the first DC, all 
> the required dns entries are added by the provision, but when you join 
> a DC, a lot of the dns entries are only added by the samba_dnsupdate 
> script and this is only run when you start samba on the newly joined 
> DC. It does print a lot of error messages, but it seems to work anyway.
> If you check the dns on the first DC before starting the second, you 
> will find missing dns entries, but these should be filled once the 
> samba_dnsupdate script is run.
And this is what is not happening here. I can't say whether it is run 
when samba restarts, but when run manually, it fails. That's why I 
created the records by hand.
>
>> will I have the same problem again with the next DC I set up?
>
> Again, I am unsure why you are having the problems, so I do not know 
> if you will have the same problems. If you have done some thing 
> incorrectly and do this again when you join another DC, then you are 
> likely to again have problems.
>
>> - why do I still have the login problems?
>>
>
> Don't know, can you answer the questions I asked earlier.
>
> Rowland
>
>> Ole
>>
>>
>
>