samba - Nov 2016 - 4.5.1 Upgrade Breaks Samba [Was: Schema Change Breaks Replication]

On Sun, 2016-11-20 at 16:50 -0500, Adam Tauno Williams via samba
wrote:
> On Sun, 2016-11-20 at 21:11 +0000, Rowland Penny via samba wrote:
> > On Sun, 20 Nov 2016 15:55:08 -0500
> > Adam Tauno Williams via samba <samba at lists.samba.org> wrote:
> > > And it looks like nobody is listening on port 135 -
> > > [root at larkin26 ~]# netstat --listen --inet --program --numeric
> > > Active Internet connections (only servers)
> > > Proto Recv-Q Send-Q Local Address               Foreign
> > > Address State       PID/Program name   
> > 
> > If that is the entire output, not only is nothing listening on port
> > 135, Samba doesn't seem to be listening at all, is it running ?
> 
> That is the entire output;  samba is not listening.
> 
> It is started.
> 
> ....
>  2049 ?        Ss     0:00 sshd: root at pts/0 
>  2051 pts/0    Ss     0:00 -bash
>  2486 ?        S      0:00 /usr/sbin/samba -D
>  2487 ?        Ss     0:00 /usr/sbin/winbindd -D --option=server role
> check:inhibit=yes --foreground
>  2493 ?        S      0:00 /usr/sbin/winbindd -D --option=server role
> check:inhibit=yes --foreground
>  2502 pts/0    R+     0:00 ps ax
> [root at larkin26 sernet]# 
> 
> [2016/11/20 16:50:40.326604,  0]
> ../source4/smbd/server.c:372(binary_smbd_main)
>   samba version 4.5.1-SerNet-RedHat-6.el6 started.
>   Copyright Andrew Tridgell and the Samba Team 1992-2016
> [2016/11/20 16:50:40.970014,  0]
> ../source4/smbd/server.c:479(binary_smbd_main)
>   samba: using 'standard' process model
> [2016/11/20 16:50:40.983383,  0]
> ../source4/rpc_server/dcerpc_server.c:1668(dcesrv_init_context)
>   dcesrv_init_context: failed to find endpoint server = 'winreg'
> [2016/11/20 16:50:40.983724,  0]
> ../source4/smbd/service_task.c:35(task_server_terminate)
>   task_server_terminate: [Failed to startup dcerpc server task]
> [2016/11/20 16:50:40.994293,  0]
> ../source4/smbd/server.c:211(samba_terminate)
>   samba_terminate of 2479: Failed to startup dcerpc server task
> [2016/11/20 16:50:41.033979,  0]
> ../source4/smbd/service.c:98(server_service_startup)
>   Failed to start service 'smb' - NT_STATUS_INVALID_SYSTEM_SERVICE
> [2016/11/20 16:50:41.038319,  0]
> ../lib/util/become_daemon.c:111(exit_daemon)
>   STATUS=daemon failed to start: Samba failed to start services,
> error
> code -1073741796
> 
> Any idea why "smb" is not an invalid service?
We no longer include the ntvfs file server (that is what 'smb' referred
to, it is a historical oddity from before the 4.0 merge) in the default
build.  If you are using bind9, set:
 server services = -dns
if you are not usind bind9 for DNS, remove 'server services'.

Likewise remove any dcerpc endpoint services line. 

Samba will refuse to start up if the smb.conf referred to invalid or
not-built components. 

Finally, in case this is how it happened, never use the output of
testparm -v as an smb.conf file, please only specify options you need
to change, so when we change the defaults you don't need to know about
it.

Thanks,

Andrew Bartlett

-- 
Andrew Bartlett
https://samba.org/~abartlet/
Authentication Developer, Samba Team         https://samba.org
Samba Development and Support, Catalyst IT   
https://catalyst.net.nz/services/samba

On Mon, 2016-11-21 at 13:55 +1300, Andrew Bartlett
wrote:
> On Sun, 2016-11-20 at 16:50 -0500, Adam Tauno Williams via samba
> wrote:
> > On Sun, 2016-11-20 at 21:11 +0000, Rowland Penny via samba wrote:
> > > On Sun, 20 Nov 2016 15:55:08 -0500
> > > Adam Tauno Williams via samba <samba at lists.samba.org>
wrote:
> > > > And it looks like nobody is listening on port 135 -
> > > > [root at larkin26 ~]# netstat --listen --inet --program
--numeric
> > > > Active Internet connections (only servers)
> > > > Proto Recv-Q Send-Q Local Address               Foreign
> > > > Address State       PID/Program name   
> > > 
> > > If that is the entire output, not only is nothing listening on
> > > port
> > > 135, Samba doesn't seem to be listening at all, is it running
?
> > 
> > That is the entire output;  samba is not listening.
> > 
> > It is started.
> > 
> > ....
> >  2049 ?        Ss     0:00 sshd: root at pts/0 
> >  2051 pts/0    Ss     0:00 -bash
> >  2486 ?        S      0:00 /usr/sbin/samba -D
> >  2487 ?        Ss     0:00 /usr/sbin/winbindd -D --option=server
> > role
> > check:inhibit=yes --foreground
> >  2493 ?        S      0:00 /usr/sbin/winbindd -D --option=server
> > role
> > check:inhibit=yes --foreground
> >  2502 pts/0    R+     0:00 ps ax
> > [root at larkin26 sernet]# 
> > 
> > [2016/11/20 16:50:40.326604,  0]
> > ../source4/smbd/server.c:372(binary_smbd_main)
> >   samba version 4.5.1-SerNet-RedHat-6.el6 started.
> >   Copyright Andrew Tridgell and the Samba Team 1992-2016
> > [2016/11/20 16:50:40.970014,  0]
> > ../source4/smbd/server.c:479(binary_smbd_main)
> >   samba: using 'standard' process model
> > [2016/11/20 16:50:40.983383,  0]
> > ../source4/rpc_server/dcerpc_server.c:1668(dcesrv_init_context)
> >   dcesrv_init_context: failed to find endpoint server =
'winreg'
> > [2016/11/20 16:50:40.983724,  0]
> > ../source4/smbd/service_task.c:35(task_server_terminate)
> >   task_server_terminate: [Failed to startup dcerpc server task]
> > [2016/11/20 16:50:40.994293,  0]
> > ../source4/smbd/server.c:211(samba_terminate)
> >   samba_terminate of 2479: Failed to startup dcerpc server task
> > [2016/11/20 16:50:41.033979,  0]
> > ../source4/smbd/service.c:98(server_service_startup)
> >   Failed to start service 'smb' -
NT_STATUS_INVALID_SYSTEM_SERVICE
> > [2016/11/20 16:50:41.038319,  0]
> > ../lib/util/become_daemon.c:111(exit_daemon)
> >   STATUS=daemon failed to start: Samba failed to start services,
> > error
> > code -1073741796
> > 
> > Any idea why "smb" is not an invalid service?
> 
> We no longer include the ntvfs file server (that is what 'smb'
> referred
> to, it is a historical oddity from before the 4.0 merge) in the
> default
> build.  If you are using bind9, set:
>  server services = -dns
> if you are not usind bind9 for DNS, remove 'server services'.
> Likewise remove any dcerpc endpoint services line. 
Excellent!  Thanks, that resolved the startup problem.  

These DCs have been upgraded every since pre-release...  I am
reasonably confident those are largely the configuration files as they
were generated by the migration [but I am not the only person who has
been in there].

Now on to the dbcheck...  wow, that finds a lot of stuff. :)
> Samba will refuse to start up if the smb.conf referred to invalid or
> not-built components. 
Will replication errors correct themselves 'automatically' after
upgrade [particularly ones related to schema]?

-- 
Adam Tauno Williams <mailto:awilliam at whitemice.org> GPG D95ED383
Systems Administrator, Python Developer, LPI / NCLA

On Sun, 20 Nov 2016 20:12:11 -0500
Adam Tauno Williams via samba <samba at lists.samba.org> wrote:
> On Mon, 2016-11-21 at 13:55 +1300, Andrew Bartlett wrote:
> > On Sun, 2016-11-20 at 16:50 -0500, Adam Tauno Williams via samba
> > wrote:
> > > On Sun, 2016-11-20 at 21:11 +0000, Rowland Penny via samba wrote:
> > > > On Sun, 20 Nov 2016 15:55:08 -0500
> > > > Adam Tauno Williams via samba <samba at
lists.samba.org> wrote:
> > > > > And it looks like nobody is listening on port 135 -
> > > > > [root at larkin26 ~]# netstat --listen --inet --program
--numeric
> > > > > Active Internet connections (only servers)
> > > > > Proto Recv-Q Send-Q Local Address               Foreign
> > > > > Address State       PID/Program name   
> > > > 
> > > > If that is the entire output, not only is nothing listening
on
> > > > port
> > > > 135, Samba doesn't seem to be listening at all, is it
running ?
> > > 
> > > That is the entire output;  samba is not listening.
> > > 
> > > It is started.
> > > 
> > > ....
> > >  2049 ?        Ss     0:00 sshd: root at pts/0 
> > >  2051 pts/0    Ss     0:00 -bash
> > >  2486 ?        S      0:00 /usr/sbin/samba -D
> > >  2487 ?        Ss     0:00 /usr/sbin/winbindd -D --option=server
> > > role
> > > check:inhibit=yes --foreground
> > >  2493 ?        S      0:00 /usr/sbin/winbindd -D --option=server
> > > role
> > > check:inhibit=yes --foreground
> > >  2502 pts/0    R+     0:00 ps ax
> > > [root at larkin26 sernet]# 
> > > 
> > > [2016/11/20 16:50:40.326604,  0]
> > > ../source4/smbd/server.c:372(binary_smbd_main)
> > >   samba version 4.5.1-SerNet-RedHat-6.el6 started.
> > >   Copyright Andrew Tridgell and the Samba Team 1992-2016
> > > [2016/11/20 16:50:40.970014,  0]
> > > ../source4/smbd/server.c:479(binary_smbd_main)
> > >   samba: using 'standard' process model
> > > [2016/11/20 16:50:40.983383,  0]
> > > ../source4/rpc_server/dcerpc_server.c:1668(dcesrv_init_context)
> > >   dcesrv_init_context: failed to find endpoint server =
'winreg'
> > > [2016/11/20 16:50:40.983724,  0]
> > > ../source4/smbd/service_task.c:35(task_server_terminate)
> > >   task_server_terminate: [Failed to startup dcerpc server task]
> > > [2016/11/20 16:50:40.994293,  0]
> > > ../source4/smbd/server.c:211(samba_terminate)
> > >   samba_terminate of 2479: Failed to startup dcerpc server task
> > > [2016/11/20 16:50:41.033979,  0]
> > > ../source4/smbd/service.c:98(server_service_startup)
> > >   Failed to start service 'smb' -
NT_STATUS_INVALID_SYSTEM_SERVICE
> > > [2016/11/20 16:50:41.038319,  0]
> > > ../lib/util/become_daemon.c:111(exit_daemon)
> > >   STATUS=daemon failed to start: Samba failed to start services,
> > > error
> > > code -1073741796
> > > 
> > > Any idea why "smb" is not an invalid service?
> > 
> > We no longer include the ntvfs file server (that is what 'smb'
> > referred
> > to, it is a historical oddity from before the 4.0 merge) in the
> > default
> > build.  If you are using bind9, set:
> >  server services = -dns
> > if you are not usind bind9 for DNS, remove 'server services'.
> > Likewise remove any dcerpc endpoint services line. 
> 
> Excellent!  Thanks, that resolved the startup problem.  
> 
> These DCs have been upgraded every since pre-release...  I am
> reasonably confident those are largely the configuration files as they
> were generated by the migration [but I am not the only person who has
> been in there].
> 
> Now on to the dbcheck...  wow, that finds a lot of stuff. :)
> 
> > Samba will refuse to start up if the smb.conf referred to invalid or
> > not-built components. 
> 
> Will replication errors correct themselves 'automatically' after
> upgrade [particularly ones related to schema]?
> 
Andrew beat me to it, mainly because I went to bed after posting my
last post LOL

Can I also recommend removing these lines:

        winbind use default domain = Yes
        winbind nss info = rfc2307
        wins support = yes

The first two do nothing on a DC and the last one, well you should be
using dns instead.

Rowland