samba - Nov 2017 - Problem with not fixable dangling forward links

Hello List,

In preparation to update my samba ad-dc's running debian wheezy with 
backported samba 4.6.8 to 4.7.3.
I'd like to fix two errors showing up in dbcheck whom hab been reported 
by dbckech --cross-ncs for an long time but without causing any issues 
so far.

I'm getting this error on my main dc

root at server:~# samba-tool dbcheck --cross-ncs
Checking 4188 objects
ERROR: no target object found for GUID component for siteList in object 
CN=DEFAULTIPSITELINK,CN=IP,CN=Inter-Site 
Transports,CN=Sites,CN=Configuration,DC=samba-list,DC=loc - 
<GUID=d4f41749a1595a43871ab1d72f24fe6b>;<RMD_ADDTIME=130015150890000000>;<RMD_CHANGETIME=130015150890000000>;<RMD_FLAGS=0>;<RMD_INVOCID=af301252bb781543b57dbd7cb773d46f>;<RMD_LOCAL_USN=4762>;<RMD_ORIGINATING_USN=4762>;<RMD_VERSION=0>;CN=Test,CN=Sites,CN=Configuration,DC=samba-list,DC=loc
Not removing dangling forward link
ERROR: no target object found for GUID component for siteList in object 
CN=DEFAULTIPSITELINK,CN=IP,CN=Inter-Site 
Transports,CN=Sites,CN=Configuration,DC=samba-list,DC=loc - 
<GUID=596bd8ae9e8bc94eab99ad3c12e22132>;<RMD_ADDTIME=130739077850000000>;<RMD_CHANGETIME=130739077850000000>;<RMD_FLAGS=0>;<RMD_INVOCID=af301252bb781543b57dbd7cb773d46f>;<RMD_LOCAL_USN=453494>;<RMD_ORIGINATING_USN=453494>;<RMD_VERSION=0>;CN=Grafing,CN=Sites,CN=Configuration,DC=samba-list,DC=loc
Not removing dangling forward link
Please use --fix to fix these errors
Checked 4188 objects (2 errors)

Running dbcheck with --fix does not fix the errors.

root at server:~# samba-tool dbcheck --cross-ncs --fix
Checking 4188 objects
ERROR: no target object found for GUID component for siteList in object 
CN=DEFAULTIPSITELINK,CN=IP,CN=Inter-Site 
Transports,CN=Sites,CN=Configuration,DC=samba-list,DC=loc - 
<GUID=d4f41749a1595a43871ab1d72f24fe6b>;<RMD_ADDTIME=130015150890000000>;<RMD_CHANGETIME=130015150890000000>;<RMD_FLAGS=0>;<RMD_INVOCID=af301252bb781543b57dbd7cb773d46f>;<RMD_LOCAL_USN=4762>;<RMD_ORIGINATING_USN=4762>;<RMD_VERSION=0>;CN=Test,CN=Sites,CN=Configuration,DC=samba-list,DC=loc
Not removing dangling forward link
ERROR: no target object found for GUID component for siteList in object 
CN=DEFAULTIPSITELINK,CN=IP,CN=Inter-Site 
Transports,CN=Sites,CN=Configuration,DC=samba-list,DC=loc - 
<GUID=596bd8ae9e8bc94eab99ad3c12e22132>;<RMD_ADDTIME=130739077850000000>;<RMD_CHANGETIME=130739077850000000>;<RMD_FLAGS=0>;<RMD_INVOCID=af301252bb781543b57dbd7cb773d46f>;<RMD_LOCAL_USN=453494>;<RMD_ORIGINATING_USN=453494>;<RMD_VERSION=0>;CN=Grafing,CN=Sites,CN=Configuration,DC=samba-list,DC=loc
Not removing dangling forward link
Checked 4188 objects (2 errors)

Looking into siteList CN=DEFAULTIPSITELINK,CN=IP,CN=Inter-Site 
Transports,CN=Sites,CN=Configuration,DC=samba-list,DC=loc with ADSI 
editor or the attribute tab in the "Sites and Services" Gui,

I see CN=Grafing,CN=Sites,CN=Configuration,DC=samba-list,DC=locbut not 
CN=Test,CN=Sites,CN=Configuration,DC=samba-list,DC=locin the siteList 
object.

On all the brach office ad-dc's there is only the error for 
CN=Grafing,CN=Sites,CN=Configuration,DC=samba-list,DC=loc but not for 
CN=Test.....

The site Grafing is existing and i n use with replication working proper 
the site Test existed only temporary.


Now if i us ldbedit -H CN=Configuration,DC=samba-list,DC=loc.ldb.bak 
(using an backup to be save) I see the Grafing site listed twice (I 
assume the one with GUID=596bd8ae9e8bc94eab99ad3c12e22132 is old) and 
also the Test site object in the siteList object.

Since these only show up in ldbedit can i use ldbedit to remove these 
entries?

 From an other discussion here it seems this should work

ldbedit --cross-ncs -H CN=Configuration,DC=samba-list,DC=loc.ldb

But i get  thsi error

search failed - Unsupported critical extension 1.2.840.113556.1.4.1340

Can I remove these two entries on my main office dc first using?

ldbedit -H CN=Configuration,DC=samba-list,DC=loc.ldb
samba-tool dbcheck --reindex

And should i do the same on my branch dc's or force an full replication 
of the CN=Configuration,DC=samba-list,DC=loc.ldb branch for all these dc's?

Thanks in advance,
Achim~

On Tue, 2017-11-21 at 11:21 +0100, Achim Gottinger via samba
wrote:
> Hello List,
> 
> In preparation to update my samba ad-dc's running debian wheezy with 
> backported samba 4.6.8 to 4.7.3.
> I'd like to fix two errors showing up in dbcheck whom hab been reported
> by dbckech --cross-ncs for an long time but without causing any issues 
> so far.
> 
> I'm getting this error on my main dc
> 
> root at server:~# samba-tool dbcheck --cross-ncs
> Checking 4188 objects
> ERROR: no target object found for GUID component for siteList in object 
> CN=DEFAULTIPSITELINK,CN=IP,CN=Inter-Site 
> Transports,CN=Sites,CN=Configuration,DC=samba-list,DC=loc - 
>
<GUID=d4f41749a1595a43871ab1d72f24fe6b>;<RMD_ADDTIME=130015150890000000>;<RMD_CHANGETIME=130015150890000000>;<RMD_FLAGS=0>;<RMD_INVOCID=af301252bb781543b57dbd7cb773d46f>;<RMD_LOCAL_USN=4762>;<RMD_ORIGINATING_USN=4762>;<RMD_VERSION=0>;CN=Test,CN=Sites,CN=Configuration,DC=samba-list,DC=loc
> Not removing dangling forward link
> ERROR: no target object found for GUID component for siteList in object 
> CN=DEFAULTIPSITELINK,CN=IP,CN=Inter-Site 
> Transports,CN=Sites,CN=Configuration,DC=samba-list,DC=loc - 
>
<GUID=596bd8ae9e8bc94eab99ad3c12e22132>;<RMD_ADDTIME=130739077850000000>;<RMD_CHANGETIME=130739077850000000>;<RMD_FLAGS=0>;<RMD_INVOCID=af301252bb781543b57dbd7cb773d46f>;<RMD_LOCAL_USN=453494>;<RMD_ORIGINATING_USN=453494>;<RMD_VERSION=0>;CN=Grafing,CN=Sites,CN=Configuration,DC=samba-list,DC=loc
> Not removing dangling forward link
> Please use --fix to fix these errors
> Checked 4188 objects (2 errors)
If these issues don't cause you replication failures or any other
issue, then you can ignore them.  In general, don't edit the backend
DB. 

However we have patches the fix some of this currently under review,
which will then be backported. 

I hope this helps.

Andrew Bartlett

-- 
Andrew Bartlett
https://samba.org/~abartlet/
Authentication Developer, Samba Team         https://samba.org
Samba Development and Support, Catalyst IT   
https://catalyst.net.nz/services/samba

On Fri, 2017-11-24 at 11:55 +1300, Andrew Bartlett via samba
wrote:
> On Tue, 2017-11-21 at 11:21 +0100, Achim Gottinger via samba wrote:
> > Hello List,
> > 
> > In preparation to update my samba ad-dc's running debian wheezy
with
> > backported samba 4.6.8 to 4.7.3.
> > I'd like to fix two errors showing up in dbcheck whom hab been
reported
> > by dbckech --cross-ncs for an long time but without causing any issues
> > so far.
> > 
> > I'm getting this error on my main dc
> > 
> > root at server:~# samba-tool dbcheck --cross-ncs
> > Checking 4188 objects
> > ERROR: no target object found for GUID component for siteList in
object
> > CN=DEFAULTIPSITELINK,CN=IP,CN=Inter-Site 
> > Transports,CN=Sites,CN=Configuration,DC=samba-list,DC=loc - 
> >
<GUID=d4f41749a1595a43871ab1d72f24fe6b>;<RMD_ADDTIME=130015150890000000>;<RMD_CHANGETIME=130015150890000000>;<RMD_FLAGS=0>;<RMD_INVOCID=af301252bb781543b57dbd7cb773d46f>;<RMD_LOCAL_USN=4762>;<RMD_ORIGINATING_USN=4762>;<RMD_VERSION=0>;CN=Test,CN=Sites,CN=Configuration,DC=samba-list,DC=loc
> > Not removing dangling forward link
> > ERROR: no target object found for GUID component for siteList in
object
> > CN=DEFAULTIPSITELINK,CN=IP,CN=Inter-Site 
> > Transports,CN=Sites,CN=Configuration,DC=samba-list,DC=loc - 
> >
<GUID=596bd8ae9e8bc94eab99ad3c12e22132>;<RMD_ADDTIME=130739077850000000>;<RMD_CHANGETIME=130739077850000000>;<RMD_FLAGS=0>;<RMD_INVOCID=af301252bb781543b57dbd7cb773d46f>;<RMD_LOCAL_USN=453494>;<RMD_ORIGINATING_USN=453494>;<RMD_VERSION=0>;CN=Grafing,CN=Sites,CN=Configuration,DC=samba-list,DC=loc
> > Not removing dangling forward link
> > Please use --fix to fix these errors
> > Checked 4188 objects (2 errors)
> 
> If these issues don't cause you replication failures or any other
> issue, then you can ignore them.  In general, don't edit the backend
> DB. 
> 
> However we have patches the fix some of this currently under review,
> which will then be backported. 
> 
> I hope this helps.
These patches are now in master and I see metze already has a branch
for 4.7 so I expect those to be backported soon.

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba