samba - Jul 2018 - Continued Group Policy issues

Hi,
> On Fri, 20 Jul 2018 06:52:06 +0530
> Anantha Raghava via samba <samba at lists.samba.org> wrote:
>
>> Hi,
>>
>> On Mon, 16 Jul 2018 17:37:21 +0530
>>> Anantha Raghava via samba <samba at lists.samba.org> wrote:
>>>
>>>> Hi,
>>>>
>>>> Thanks for clarification.
>>>>
>>>> However, we held back from implementing your suggestion and
>>>> observed that after about 40 odd hours from the initial
publishing
>>>> of the policies, all clients connecting to any of the Domain
>>>> Controllers started to get the policies. No client was throwing
>>>> any error while applying the policies from any of the 4 Domain
>>>> Controllers.
>>> Good, but why the delay ?
>> This is being investigated. Is it something to do with cache,
>> wondering whether running "net cache flush" will help to get
over
>> this behavior.
> Possibly, but I thought that the cache should be consulted first and if
> the user isn't found, then via winbind, ask AD. Just a thought, is nscd
> or similar running ?
Just to clarify, nscd or similar daemons are not running in our 
environment. We use CentOS 7.5 minimal installation.
Coming to using only "net cache flush", we will test it in our 
environment and report back here.
>
>>>> Does it mean that "idmap.ldb" is taking time to
replicate
>>>> automatically?
>>> 'idmap.ldb' never replicates automatically, it must be done
>>> manually.
>> We will include this in our replication script.
>>>> Or is it some other issue? Nothing interesting about
>>>> this is logged in samba. Sysvol is getting replicated as soon
as
>>>> any policy is added or modified or deleted on the first domain
>>>> controller.
>>> How is 'sysvol' being replicated, this again is a manual
procedure
>>> on Samba AD DC's
>> Yes, it is being synchronised using rsync. Basically, we are using
>> "inotify" to watch for changes (add, modify & delete) in
"sysvol" and
>> push the changes to all other DCs. I will share our replication
>> scripts here shortly.
> I have been working on something similar, everytime I think I am
> getting close, I think of another enhancement ;-)
Find the sample script below. We add other DCs as needed to the same 
script. To include, "net cache flush", we will have to modify this 
script that runs on first DC or (DC1 or PDC ;-)

#!/bin/sh
DIR="/usr/local/samba/var/locks/sysvol/test.com/Policies/"
inotifywait -m -r -e moved_to -e modify -e delete -e create "$DIR" | 
while read f
do
     echo $f
     if [[ $f = *.* ]]; then
{
export PATH=/usr/local/samba/bin:/usr/local/samba/sbin:$PATH
samba-tool ntacl sysvolreset &> /dev/null
sleep 5
rsync -XAavz --delete-after /usr/local/samba/var/locks/sysvol/ 
dc1:/usr/local/samba/var/locks/sysvol

  }
  fi
done
>
>>>> Basically we are implementing "Software While
Listing" policies and
>>>> these are defined as computer policies. The error started to
show
>>>> up once the policy was linked.
> Surely, if it works without the policies, but doesn't with them, then
> these could be the problem and deserve a good look at ?
>
>>>> Any hints on this behavior?
>>>>
>>> No, but it might help if you post more info on your setup.
>> What info you need? Find below the smb.conf. It is same on all Domain
>> Controllers.
>>
>> # Global parameters
>> [global]
>>           netbios name = PDC
>>           realm = ****.COM
>>           server role = active directory domain controller
>>           server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc,
>> drepl, winbindd, ntp_signd, kcc, dnsupdate
>>           workgroup = ****
>>           idmap_ldb:use rfc2307 = yes
>>           ldap server require strong auth = No
>> # Logs and events
>>           eventlog list = Security
>>           log level = 3
>>           log file = /var/log/samba/dc1.%T.log
>>           max log size = 1000000
>>
>> [netlogon]
>>       path = /usr/local/samba/var/locks/sysvol/****.com/scripts
>>       read only = No
>>
>> [sysvol]
>>        path = /usr/local/samba/var/locks/sysvol
>>        read only = No
> The only thing wrong with that smb.conf is the netbios name, I take it
> you didn't get the memo ;-)
>
> There is no such thing as a PDC in AD, all DC's are equal, it is just
> that some of them hold FSMO roles.
>
> Rowland
I understand, there is no such thing as PDC. Server is just named that 
way as it handles PDC Emulator role. :-)

Thanks & regards,
Anantha Raghava
>   
>
>

On Fri, 20 Jul 2018 15:22:31 +0530
Anantha Raghava via samba <samba at lists.samba.org> wrote:
> Just to clarify, nscd or similar daemons are not running in our 
> environment. We use CentOS 7.5 minimal installation.
> Coming to using only "net cache flush", we will test it in our 
> environment and report back here.
This is strange, you shouldn't have to run 'net cache flush', you
didn't have to do this before, so it sounds like this could be what
Andrew calls a 'regression' and what I call a bug ;-)
> Find the sample script below. We add other DCs as needed to the same 
> script. To include, "net cache flush", we will have to modify
this
> script that runs on first DC or (DC1 or PDC ;-)
> 
> #!/bin/sh
> DIR="/usr/local/samba/var/locks/sysvol/test.com/Policies/"
> inotifywait -m -r -e moved_to -e modify -e delete -e create
"$DIR" |
> while read f
> do
>      echo $f
>      if [[ $f = *.* ]]; then
> {
> export PATH=/usr/local/samba/bin:/usr/local/samba/sbin:$PATH
> samba-tool ntacl sysvolreset &> /dev/null
> sleep 5
> rsync -XAavz --delete-after /usr/local/samba/var/locks/sysvol/ 
> dc1:/usr/local/samba/var/locks/sysvol
> 
>   }
>   fi
> done
Mine is a bit longer than that, it is over 100 lines of code and it
still isn't finished, but it is using the same basic format.
> I understand, there is no such thing as PDC. Server is just named
> that way as it handles PDC Emulator role. :-)
> 
I sort of thought that was the reason, but it can cause confusion. Some
person posts 'I am having problems with my PDC' without specifying what
it is, an actual PDC or a DC called 'PDC', for this reason, we suggest
not using 'PDC' as a DC name.

Rowland

On 20/07/18 3:44 PM, Rowland Penny via samba wrote:
> On Fri, 20 Jul 2018 15:22:31 +0530
> Anantha Raghava via samba <samba at lists.samba.org> wrote:
>
>> Just to clarify, nscd or similar daemons are not running in our
>> environment. We use CentOS 7.5 minimal installation.
>> Coming to using only "net cache flush", we will test it in
our
>> environment and report back here.
> This is strange, you shouldn't have to run 'net cache flush',
you
> didn't have to do this before, so it sounds like this could be what
> Andrew calls a 'regression' and what I call a bug ;-)
>
>> Find the sample script below. We add other DCs as needed to the same
>> script. To include, "net cache flush", we will have to modify
this
>> script that runs on first DC or (DC1 or PDC ;-)
>>
>> #!/bin/sh
>> DIR="/usr/local/samba/var/locks/sysvol/test.com/Policies/"
>> inotifywait -m -r -e moved_to -e modify -e delete -e create
"$DIR" |
>> while read f
>> do
>>       echo $f
>>       if [[ $f = *.* ]]; then
>> {
>> export PATH=/usr/local/samba/bin:/usr/local/samba/sbin:$PATH
>> samba-tool ntacl sysvolreset &> /dev/null
>> sleep 5
>> rsync -XAavz --delete-after /usr/local/samba/var/locks/sysvol/
>> dc1:/usr/local/samba/var/locks/sysvol
>>
>>    }
>>    fi
>> done
> Mine is a bit longer than that, it is over 100 lines of code and it
> still isn't finished, but it is using the same basic format.
Can we participate in putting this script together? We have a small 
development team who can be used for this.
>
>> I understand, there is no such thing as PDC. Server is just named
>> that way as it handles PDC Emulator role. :-)
>>
> I sort of thought that was the reason, but it can cause confusion. Some
> person posts 'I am having problems with my PDC' without specifying
what
> it is, an actual PDC or a DC called 'PDC', for this reason, we
suggest
> not using 'PDC' as a DC name.
>
> Rowland
Thanks & Regards,
Anantha Raghava