thr3ads.net - samba - [Samba] samba-tool domain backup ERROR [Mar 2019]

If this information is useful, please help other people find it:
Share via:

Stefan Kania

2019-Feb-28 12:46 UTC

[Samba] samba-tool domain backup ERROR

Hello,

we want to backup the AD-database with the samba-tool backup-option. We 
use Sernet-packages 4.9.4 we have two DCs if I do the backup on the same 
DC I got the following messages:
-----------------
root at dc-ste-01:~# samba-tool domain backup online --server=dc-ste-01 
--targetdir=. -U administrator
Password for [LF\administrator]:
....
Committing SAM database
Setting isSynchronized and dsServiceName
Cloned domain LF (SID S-1-5-21-2842440679-1648109622-3732055899)
ERROR(<type 'exceptions.IndexError'>): uncaught exception - list
index
out of range
   File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
line
177, in _run
     return self.run(*args, **kwargs)
   File
"/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py",
line 237, in run
     new_sid = get_sid_for_restore(remote_sam)
   File
"/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py",
line 73, in get_sid_for_restore
     rid = int(res[0].get('rIDNextRID')[0])

-----------------

If we do it on the other DC we got the following messages:
-----------------
root at dc-ste-01:~# samba-tool domain backup online --server=dc-ibb-01 
--targetdir=. -U administrator
Password for [LF\administrator]:
Committing SAM database
Setting isSynchronized and dsServiceName
Cloned domain LF (SID S-1-5-21-2842440679-1648109622-3732055899)
ERROR(runtime): uncaught exception - (3221225506, '{Access Denied} A 
process has requested access to an object but has not been granted those 
access rights.')
   File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
line
177, in _run
     return self.run(*args, **kwargs)
   File
"/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py",
line 243, in run
     backup_online(smb_conn, sysvol_tar, remote_sam.get_domain_sid())
   File "/usr/lib/python2.7/dist-packages/samba/ntacls.py", line 508,
in
backup_online
     ntacl_sddl_str = smb_helper.get_acl(r_name, as_sddl=True)
   File "/usr/lib/python2.7/dist-packages/samba/ntacls.py", line 331,
in
get_acl
     smb_path, SECURITY_SECINFO_FLAGS, SECURITY_SEC_FLAGS)

-----------------
the package "lmdb-utils" is installed on both DCs.

Any tip?

Stefan

L.P.H. van Belle

2019-Feb-28 13:18 UTC

head link

[Samba] samba-tool domain backup ERROR

Hmm. 

Hai stefan, 

I hadnt use the : samba-tool domain backup online --server=dc1 --targetdir=./ 
option yet.
I've run the command on the same dc as im backing up and i did a kinit
Administrator before it.
Also tried it with -UNTDOM\\Administrator  and -Uadministrator 
All three  resulted in a good backup. 

... More logging here.....  
Pre-loading the Samba 4 and AD schema
Unable to determine the DomainSID, can not enforce uniqueness constraint on
local domainSIDs
...
A Kerberos configuration suitable for Samba AD has been generated at
/root/tmpvMsnbF/private/krb5.conf
Merge the contents of this file with your system krb5.conf or replace it with
this one. Do not create a symlink!
Provision OK for domain DN DC=rotterdam,DC=bazuin,DC=nl
Starting replication
Using DS_BIND_GUID_W2K3
...
Cloned domain NTDOM (SID S-1-5-21-123415564-252352352)
...

Creating backup file
./samba-backup-internal.domain.tld-2019-02-28T13-51-25.864257.tar.bz2...

Our difference. 
In running backend AD, i assum you run with rid backend. 

Hmm, i have to think about this, i know there was an bugreport on the backup
option..
I'll see if i can find it. 

@Rowland, do you know if the SID/RID of Administrator is the same on the
DC's when using RID backend?

Last @Stefan, i noticed also : IndexError 
Run on both DC's : samba-tool dbcheck --reindex
Try again. 


Greetz, 

Louis


> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Stefan Kania via samba
> Verzonden: donderdag 28 februari 2019 13:47
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] samba-tool domain backup ERROR
> 
> 
> Hello,
> 
> we want to backup the AD-database with the samba-tool 
> backup-option. We 
> use Sernet-packages 4.9.4 we have two DCs if I do the backup 
> on the same 
> DC I got the following messages:
> -----------------
> root at dc-ste-01:~# samba-tool domain backup online --server=dc-ste-01 
> --targetdir=. -U administrator
> Password for [LF\administrator]:
> ....
> Committing SAM database
> Setting isSynchronized and dsServiceName
> Cloned domain LF (SID S-1-5-21-2842440679-1648109622-3732055899)
> ERROR(<type 'exceptions.IndexError'>): uncaught exception - 
> list index 
> out of range
>    File 
> "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line
> 177, in _run
>      return self.run(*args, **kwargs)
>    File 
> "/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py",
> line 237, in run
>      new_sid = get_sid_for_restore(remote_sam)
>    File 
> "/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py",
> line 73, in get_sid_for_restore
>      rid = int(res[0].get('rIDNextRID')[0])
> 
> -----------------
> 
> If we do it on the other DC we got the following messages:
> -----------------
> root at dc-ste-01:~# samba-tool domain backup online --server=dc-ibb-01 
> --targetdir=. -U administrator
> Password for [LF\administrator]:
> Committing SAM database
> Setting isSynchronized and dsServiceName
> Cloned domain LF (SID S-1-5-21-2842440679-1648109622-3732055899)
> ERROR(runtime): uncaught exception - (3221225506, '{Access Denied} A 
> process has requested access to an object but has not been 
> granted those 
> access rights.')
>    File 
> "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line
> 177, in _run
>      return self.run(*args, **kwargs)
>    File 
> "/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py",
> line 243, in run
>      backup_online(smb_conn, sysvol_tar, remote_sam.get_domain_sid())
>    File "/usr/lib/python2.7/dist-packages/samba/ntacls.py", 
> line 508, in 
> backup_online
>      ntacl_sddl_str = smb_helper.get_acl(r_name, as_sddl=True)
>    File "/usr/lib/python2.7/dist-packages/samba/ntacls.py", 
> line 331, in 
> get_acl
>      smb_path, SECURITY_SECINFO_FLAGS, SECURITY_SEC_FLAGS)
> 
> -----------------
> the package "lmdb-utils" is installed on both DCs.
> 
> Any tip?
> 
> Stefan
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

Stefan Kania

2019-Feb-28 13:32 UTC

head link

[Samba] samba-tool domain backup ERROR

Am 28.02.2019 14:18, schrieb L.P.H. van Belle via samba:> Hmm.
> 
> Hai stefan,
> 
> I hadnt use the : samba-tool domain backup online --server=dc1
> --targetdir=./  option yet.
> I've run the command on the same dc as im backing up and i did a kinit
> Administrator before it.
> Also tried it with -UNTDOM\\Administrator  and -Uadministrator
> All three  resulted in a good backup.
> 
> ... More logging here.....
> Pre-loading the Samba 4 and AD schema
> Unable to determine the DomainSID, can not enforce uniqueness
> constraint on local domainSIDs
> ...
> A Kerberos configuration suitable for Samba AD has been generated at
> /root/tmpvMsnbF/private/krb5.conf
> Merge the contents of this file with your system krb5.conf or replace
> it with this one. Do not create a symlink!
> Provision OK for domain DN DC=rotterdam,DC=bazuin,DC=nl
> Starting replication
> Using DS_BIND_GUID_W2K3
> ...
> Cloned domain NTDOM (SID S-1-5-21-123415564-252352352)
> ...
> 
> Creating backup file
> ./samba-backup-internal.domain.tld-2019-02-28T13-51-25.864257.tar.bz2...
> 
> Our difference.
> In running backend AD, i assum you run with rid backend.
> 
> Hmm, i have to think about this, i know there was an bugreport on the
> backup option..
> I'll see if i can find it.
> 
> @Rowland, do you know if the SID/RID of Administrator is the same on
> the DC's when using RID backend?
> 
> Last @Stefan, i noticed also : IndexError
> Run on both DC's : samba-tool dbcheck --reindex
> Try again.I did it, but no change, still the same erorrmessages
:-(> 
> 
> Greetz,
> 
> Louis
> 
> 
> 
>> -----Oorspronkelijk bericht-----
>> Van: samba [mailto:samba-bounces at lists.samba.org] Namens
>> Stefan Kania via samba
>> Verzonden: donderdag 28 februari 2019 13:47
>> Aan: samba at lists.samba.org
>> Onderwerp: [Samba] samba-tool domain backup ERROR
>> 
>> 
>> Hello,
>> 
>> we want to backup the AD-database with the samba-tool
>> backup-option. We
>> use Sernet-packages 4.9.4 we have two DCs if I do the backup
>> on the same
>> DC I got the following messages:
>> -----------------
>> root at dc-ste-01:~# samba-tool domain backup online --server=dc-ste-01
>> --targetdir=. -U administrator
>> Password for [LF\administrator]:
>> ....
>> Committing SAM database
>> Setting isSynchronized and dsServiceName
>> Cloned domain LF (SID S-1-5-21-2842440679-1648109622-3732055899)
>> ERROR(<type 'exceptions.IndexError'>): uncaught exception
-
>> list index
>> out of range
>>    File
>> "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
line
>> 177, in _run
>>      return self.run(*args, **kwargs)
>>    File
>>
"/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py",
>> line 237, in run
>>      new_sid = get_sid_for_restore(remote_sam)
>>    File
>>
"/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py",
>> line 73, in get_sid_for_restore
>>      rid = int(res[0].get('rIDNextRID')[0])
>> 
>> -----------------
>> 
>> If we do it on the other DC we got the following messages:
>> -----------------
>> root at dc-ste-01:~# samba-tool domain backup online --server=dc-ibb-01
>> --targetdir=. -U administrator
>> Password for [LF\administrator]:
>> Committing SAM database
>> Setting isSynchronized and dsServiceName
>> Cloned domain LF (SID S-1-5-21-2842440679-1648109622-3732055899)
>> ERROR(runtime): uncaught exception - (3221225506, '{Access Denied}
A
>> process has requested access to an object but has not been
>> granted those
>> access rights.')
>>    File
>> "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
line
>> 177, in _run
>>      return self.run(*args, **kwargs)
>>    File
>>
"/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py",
>> line 243, in run
>>      backup_online(smb_conn, sysvol_tar, remote_sam.get_domain_sid())
>>    File "/usr/lib/python2.7/dist-packages/samba/ntacls.py",
>> line 508, in
>> backup_online
>>      ntacl_sddl_str = smb_helper.get_acl(r_name, as_sddl=True)
>>    File "/usr/lib/python2.7/dist-packages/samba/ntacls.py",
>> line 331, in
>> get_acl
>>      smb_path, SECURITY_SECINFO_FLAGS, SECURITY_SEC_FLAGS)
>> 
>> -----------------
>> the package "lmdb-utils" is installed on both DCs.
>> 
>> Any tip?
>> 
>> Stefan
>> 
>> --
>> To unsubscribe from this list go to the following URL and read the
>> instructions:  https://lists.samba.org/mailman/options/samba
>> 
>> 
-- 
Stefan Kania
Landweg 13
25693 St. Michaelisdonn


Signieren jeder E-Mail hilft Spam zu reduzieren. Signieren Sie ihre 
E-Mail. Weiter Informationen unter http://www.gnupg.org

Mein Schlüssel liegt auf

hkp://subkeys.pgp.net

Rowland Penny

2019-Feb-28 13:34 UTC

head link

[Samba] samba-tool domain backup ERROR

On Thu, 28 Feb 2019 14:18:05 +0100
"L.P.H. van Belle via samba" <samba at lists.samba.org> wrote:
> Hmm. 
> 
> Hai stefan, 
> 
> I hadnt use the : samba-tool domain backup online --server=dc1
> --targetdir=./  option yet. I've run the command on the same dc as im
> backing up and i did a kinit Administrator before it. Also tried it
> with -UNTDOM\\Administrator  and -Uadministrator All three  resulted
> in a good backup. 
> 
> ... More logging here.....  
> Pre-loading the Samba 4 and AD schema
> Unable to determine the DomainSID, can not enforce uniqueness
> constraint on local domainSIDs ...
You can ignore that (and I do wish whoever added the possibility of it
being printed, hadn't), it appears to be meaningless, you even get this
on provisions & DC joins now.
> A Kerberos configuration suitable for Samba AD has been generated
> at /root/tmpvMsnbF/private/krb5.conf Merge the contents of this file
> with your system krb5.conf or replace it with this one. Do not create
> a symlink! Provision OK for domain DN DC=rotterdam,DC=bazuin,DC=nl
> Starting replication Using DS_BIND_GUID_W2K3
> ...
> Cloned domain NTDOM (SID S-1-5-21-123415564-252352352)
> ...
> 
> Creating backup
> file
./samba-backup-internal.domain.tld-2019-02-28T13-51-25.864257.tar.bz2...
> 
> Our difference. 
> In running backend AD, i assum you run with rid backend. 
> 
> Hmm, i have to think about this, i know there was an bugreport on the
> backup option.. I'll see if i can find it. 
> 
> @Rowland, do you know if the SID/RID of Administrator is the same on
> the DC's when using RID backend? 
Provided you haven't added a uidNumber attribute to Administrator, the
ID is hardcoded to '0' in idmap.ldb

Rowland

Tim Beale

2019-Feb-28 20:53 UTC

head link

[Samba] samba-tool domain backup ERROR

On 1/03/19 1:46 AM, Stefan Kania via samba wrote:>
> ....
> Committing SAM database
> Setting isSynchronized and dsServiceName
> Cloned domain LF (SID S-1-5-21-2842440679-1648109622-3732055899)
> ERROR(<type 'exceptions.IndexError'>): uncaught exception -
list index
> out of range
>   File
"/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
> line 177, in _run
>     return self.run(*args, **kwargs)
>   File
> "/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py",
line
> 237, in run
>     new_sid = get_sid_for_restore(remote_sam)
>   File
> "/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py",
line
> 73, in get_sid_for_restore
>     rid = int(res[0].get('rIDNextRID')[0])
>So, I've seen this before when you try to back up a DC that hasn't
initialized its RID pool yet. I thought it was just a corner-case that
only happens if you try to backup a brand new DC. I'm guessing the same
thing could happen though if all the RID allocations have taken place on
the primary DC and you try to back up the secondary DC.

Creating/deleting a temporary user on that DC should force a RID
allocation. See:
https://wiki.samba.org/index.php/Back_up_and_Restoring_a_Samba_AD_DC#Troubleshooting

Most likely you'll just hit the second sysvol problem though.
> ERROR(runtime): uncaught exception - (3221225506, '{Access Denied} A
> process has requested access to an object but has not been granted
> those access rights.')
>   File
"/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
> line 177, in _run
>     return self.run(*args, **kwargs)
>   File
> "/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py",
line
> 243, in run
>     backup_online(smb_conn, sysvol_tar, remote_sam.get_domain_sid())
>   File "/usr/lib/python2.7/dist-packages/samba/ntacls.py", line
508,
> in backup_online
>     ntacl_sddl_str = smb_helper.get_acl(r_name, as_sddl=True)
>   File "/usr/lib/python2.7/dist-packages/samba/ntacls.py", line
331,
> in get_acl
>     smb_path, SECURITY_SECINFO_FLAGS, SECURITY_SEC_FLAGS)
>We've seen this problem once before, see thread:
https://lists.samba.org/archive/samba/2019-January/220353.html

That thread has got some tips on trying to get debug out about what file
is causing the problem. Note that you need to enable the debug on the
samba server (i.e. smbd).

We need better debug in the tool itself when this happens. I'll try to
improve it.

Another work-around for this sysvol problem would be to upgrade to 4.10
once it's released and use the new 'backup offline' option.

Cheers,
Tim

L. van Belle

2019-Mar-01 09:15 UTC

head link

[Samba] samba-tool domain backup ERROR

Hai Tim,  
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Tim 
> Beale via samba
> Verzonden: donderdag 28 februari 2019 21:53
> Aan: Stefan Kania; samba at lists.samba.org
> Onderwerp: Re: [Samba] samba-tool domain backup ERROR
> 
> On 1/03/19 1:46 AM, Stefan Kania via samba wrote:
> >
> > ....
> > Committing SAM database
> > Setting isSynchronized and dsServiceName
> > Cloned domain LF (SID S-1-5-21-2842440679-1648109622-3732055899)
> > ERROR(<type 'exceptions.IndexError'>): uncaught
exception -
> list index
> > out of range
> >   File
"/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
> > line 177, in _run
> >     return self.run(*args, **kwargs)
> >   File
> > 
> "/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py",
line
> > 237, in run
> >     new_sid = get_sid_for_restore(remote_sam)
> >   File
> > 
> "/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py",
line
> > 73, in get_sid_for_restore
> >     rid = int(res[0].get('rIDNextRID')[0])
> >
> So, I've seen this before when you try to back up a DC that hasn't
> initialized its RID pool yet. I thought it was just a corner-case that
> only happens if you try to backup a brand new DC. I'm 
> guessing the same
> thing could happen though if all the RID allocations have 
> taken place on
> the primary DC and you try to back up the secondary DC.
> 
> Creating/deleting a temporary user on that DC should force a RID
> allocation. See:
> https://wiki.samba.org/index.php/Back_up_and_Restoring_a_Samba
> _AD_DC#Troubleshooting
> 

This backup problem might not be all related to sysvol ACL problems. 

I have currently 1 GPO with errors out but the backup runs fine in my case. 
Stefan's setup and mine differences, RID (stefan) and AD (me) backends.

More liky to me here, that there is an AD-object that is having an incorrect
acl. 

Just my idea about this one, i've compaired my error with stefan's and
these
are diffent. 
Which is good, since our outcome is also different. I did run before the
backup.

samba-tool dbcheck  ( 0 error, --cross-nc 0 errors ) 
samba-tool ntacl sysvolcheck
ERROR(<class 'samba.provision.ProvisioningError'>): uncaught
exception -
ProvisioningError: DB ACL on GPO directory
/var/lib/sysvol/internal.domain.tld/Policies/{AD54EF7F-A136-4A28-95CE-EC2D35
BD7341}
O:LAG:DAD:PAI(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;;0x001f01ff;
;;LA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;
AU)(A;OICI;0x001200a9;;;ED) does not match expected value
O:DAG:DAD:PAR(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001
f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a
9;;;AU)(A;OICI;0x001200a9;;;ED) from GPO object
  File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
line
177, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/samba/netcmd/ntacl.py", line
270,
in run
    lp)
  File "/usr/lib/python2.7/dist-packages/samba/provision/__init__.py",
line
1836, in checksysvolacl
    direct_db_access)
  File "/usr/lib/python2.7/dist-packages/samba/provision/__init__.py",
line
1787, in check_gpos_acl
    domainsid, direct_db_access)
  File "/usr/lib/python2.7/dist-packages/samba/provision/__init__.py",
line
1734, in check_dir_acl
    raise ProvisioningError('%s ACL on GPO directory %s %s does not match
expected value %s from GPO object' % (acl_type(direct_db_access), path,
fsacl_sddl, acl))

samba-tool ntacl sysvolreset 
samba-tool ntacl sysvolcheck same error as above. 

Then i did run the backup again. 
samba-tool domain backup online --server=rtd-dc1 --targetdir=./ 

And this resulted in a good backup. 

> Most likely you'll just hit the second sysvol problem though.
> 
> > ERROR(runtime): uncaught exception - (3221225506, '{Access Denied}
A
> > process has requested access to an object but has not been granted
> > those access rights.')
> >   File
"/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
> > line 177, in _run
> >     return self.run(*args, **kwargs)
> >   File
> > 
> "/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py",
line
> > 243, in run
> >     backup_online(smb_conn, sysvol_tar, remote_sam.get_domain_sid())
> >   File "/usr/lib/python2.7/dist-packages/samba/ntacls.py",
line 508,
> > in backup_online
> >     ntacl_sddl_str = smb_helper.get_acl(r_name, as_sddl=True)
> >   File "/usr/lib/python2.7/dist-packages/samba/ntacls.py",
line 331,
> > in get_acl
> >     smb_path, SECURITY_SECINFO_FLAGS, SECURITY_SEC_FLAGS)
> >
> We've seen this problem once before, see thread:
> https://lists.samba.org/archive/samba/2019-January/220353.html
> 
> That thread has got some tips on trying to get debug out 
> about what file
> is causing the problem. Note that you need to enable the debug on the
> samba server (i.e. smbd).
> 
> We need better debug in the tool itself when this happens. I'll try to
> improve it.
> 
> Another work-around for this sysvol problem would be to 
> upgrade to 4.10
> once it's released and use the new 'backup offline' option.
> 
> Cheers,
> Tim

Greetz, 

Louis

Stefan Kania

2019-Mar-01 13:04 UTC

head link

[Samba] samba-tool domain backup ERROR

Now I dit the following:
- create a dummy-user on both DCs (to gewt the RID-pool)
- check the sysvolacls, everything is fine no error
but the Problem is still the same.

----
ERROR(runtime): uncaught exception - (3221225506, '{Access Denied} A 
process has requested access to an object but has not been granted those 
access rights.')
   File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
line
177, in _run
     return self.run(*args, **kwargs)
   File
"/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py",
line 243, in run
     backup_online(smb_conn, sysvol_tar, remote_sam.get_domain_sid())
   File "/usr/lib/python2.7/dist-packages/samba/ntacls.py", line 508,
in
backup_online
     ntacl_sddl_str = smb_helper.get_acl(r_name, as_sddl=True)
   File "/usr/lib/python2.7/dist-packages/samba/ntacls.py", line 331,
in
get_acl
     smb_path, SECURITY_SECINFO_FLAGS, SECURITY_SEC_FLAGS)
----
If read the thread with the backup-problem and we came to the same point 
:-( I think we wait for samba 4.10
Stefan

Am 28.02.2019 21:53, schrieb Tim Beale:> On 1/03/19 1:46 AM, Stefan Kania via samba wrote:
>> 
>> ....
>> Committing SAM database
>> Setting isSynchronized and dsServiceName
>> Cloned domain LF (SID S-1-5-21-2842440679-1648109622-3732055899)
>> ERROR(<type 'exceptions.IndexError'>): uncaught exception
- list index
>> out of range
>>   File
"/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
>> line 177, in _run
>>     return self.run(*args, **kwargs)
>>   File
>>
"/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py", line
>> 237, in run
>>     new_sid = get_sid_for_restore(remote_sam)
>>   File
>>
"/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py", line
>> 73, in get_sid_for_restore
>>     rid = int(res[0].get('rIDNextRID')[0])
>> 
> So, I've seen this before when you try to back up a DC that hasn't
> initialized its RID pool yet. I thought it was just a corner-case that
> only happens if you try to backup a brand new DC. I'm guessing the same
> thing could happen though if all the RID allocations have taken place 
> on
> the primary DC and you try to back up the secondary DC.
> 
> Creating/deleting a temporary user on that DC should force a RID
> allocation. See:
>
https://wiki.samba.org/index.php/Back_up_and_Restoring_a_Samba_AD_DC#Troubleshooting
> 
> Most likely you'll just hit the second sysvol problem though.
> 
>> ERROR(runtime): uncaught exception - (3221225506, '{Access Denied}
A
>> process has requested access to an object but has not been granted
>> those access rights.')
>>   File
"/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
>> line 177, in _run
>>     return self.run(*args, **kwargs)
>>   File
>>
"/usr/lib/python2.7/dist-packages/samba/netcmd/domain_backup.py", line
>> 243, in run
>>     backup_online(smb_conn, sysvol_tar, remote_sam.get_domain_sid())
>>   File "/usr/lib/python2.7/dist-packages/samba/ntacls.py",
line 508,
>> in backup_online
>>     ntacl_sddl_str = smb_helper.get_acl(r_name, as_sddl=True)
>>   File "/usr/lib/python2.7/dist-packages/samba/ntacls.py",
line 331,
>> in get_acl
>>     smb_path, SECURITY_SECINFO_FLAGS, SECURITY_SEC_FLAGS)
>> 
> We've seen this problem once before, see thread:
> https://lists.samba.org/archive/samba/2019-January/220353.html
> 
> That thread has got some tips on trying to get debug out about what 
> file
> is causing the problem. Note that you need to enable the debug on the
> samba server (i.e. smbd).
> 
> We need better debug in the tool itself when this happens. I'll try to
> improve it.
> 
> Another work-around for this sysvol problem would be to upgrade to 4.10
> once it's released and use the new 'backup offline' option.
> 
> Cheers,
> Tim
-- 
Stefan Kania
Landweg 13
25693 St. Michaelisdonn


Signieren jeder E-Mail hilft Spam zu reduzieren. Signieren Sie ihre 
E-Mail. Weiter Informationen unter http://www.gnupg.org

Mein Schlüssel liegt auf

hkp://subkeys.pgp.net

Seemingly Similar Threads

Search for more reasonably related threads

samba - Mar 2019 - samba-tool domain backup ERROR

[Samba] samba-tool domain backup ERROR

[Samba] samba-tool domain backup ERROR

[Samba] samba-tool domain backup ERROR

[Samba] samba-tool domain backup ERROR

[Samba] samba-tool domain backup ERROR

[Samba] samba-tool domain backup ERROR

[Samba] samba-tool domain backup ERROR

Seemingly Similar Threads