samba - Mar 2019 - samba 4.9.5 - joining Samba DC to existing Samba AD failed

On Wed, 27 Mar 2019 09:45:18 +0100
"L.P.H. van Belle via samba" <samba at lists.samba.org> wrote:
> Hai, 
> 
> 
> I dont think one noticed this.. 
> 
> ldbsearch -H ldap://dc4 -UAdministrator 
> ldbsearch -H ldap://dc1 -U Administrator 
> 
> So whats the difference when you see this responce of the command: 
>  Invalid option -U: unknown ... 
> 
> The " " between -U Admin... 
> Try again without the space or use --user=Administrator 
> 
> 
> Greetz, 
> 
> Louis
The space doesn't make any difference '-U Administrator' or
'-UAdministrator' both work, as does '-U administrator' or
'-Uadministrator'

I just wonder where '-U' went ?

Rowland

On Wed, 27 Mar 2019 09:01:39 +0000
Rowland Penny via samba <samba at lists.samba.org> wrote:
> On Wed, 27 Mar 2019 09:45:18 +0100
> "L.P.H. van Belle via samba" <samba at lists.samba.org>
wrote:
> 
> > Hai, 
> > 
> > 
> > I dont think one noticed this.. 
> > 
> > ldbsearch -H ldap://dc4 -UAdministrator 
> > ldbsearch -H ldap://dc1 -U Administrator 
> > 
> > So whats the difference when you see this responce of the command: 
> >  Invalid option -U: unknown ... 
> > 
> > The " " between -U Admin... 
> > Try again without the space or use --user=Administrator 
> > 
> > 
> > Greetz, 
> > 
> > Louis
> 
> The space doesn't make any difference '-U Administrator' or
> '-UAdministrator' both work, as does '-U administrator' or
> '-Uadministrator'
> 
> I just wonder where '-U' went ?
> 
> Rowland
> 
I have been looking at the 'Administrator' object that the OP posted.

The failure in his original post was this:

ERROR(ldb): uncaught exception - descriptor_modify on
CN=Administrator,CN=Users,DC=zamecek,DC=home failed: operations error
at ../source4/dsdb/samdb/ldb_modules/descriptor.c:819

lines 816 - 820 in descriptor.c are these:

	objectclass = dsdb_get_last_structural_class(schema,
						     objectclass_element);
	if (objectclass == NULL) {
		return ldb_operr(ldb);
	}

So, it looks like (to me anyway) that it is looking for the objectclass
for 'nTSecurityDescriptor' and trying to match it to the last
objectclass found in the list:

objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: posixAccount

I may be barking up the wrong tree here, but I would remove all the
rfc2307 attributes and objectclass from 'Administrator':

objectClass: posixAccount
gidNumber: 1103
uidNumber: 0
loginShell: /bin/bash
unixHomeDirectory: /root

They are definitely not required and could be causing the problem.

Rowland

On Wed, 27 Mar 2019 09:01:39 +0000
Rowland Penny via samba <samba at lists.samba.org> wrote:
> On Wed, 27 Mar 2019 09:45:18 +0100
> "L.P.H. van Belle via samba" <samba at lists.samba.org>
wrote:
> 
> > Hai, 
> > 
> > 
> > I dont think one noticed this.. 
> > 
> > ldbsearch -H ldap://dc4 -UAdministrator 
> > ldbsearch -H ldap://dc1 -U Administrator 
> > 
> > So whats the difference when you see this responce of the command: 
> >  Invalid option -U: unknown ... 
> > 
> > The " " between -U Admin... 
> > Try again without the space or use --user=Administrator 
> > 
> > 
> > Greetz, 
> > 
> > Louis  
> 
> The space doesn't make any difference '-U Administrator' or
> '-UAdministrator' both work, as does '-U administrator' or
> '-Uadministrator'
> 
> I just wonder where '-U' went ?
Yes, is no difference between '-UAdministrator' and '-U
Administrator'.
But it seems, as ldbsearch in 4.9.5 is different than 4.9.4-.
(I was furious with that, because I found lot articles on net, where
-U _username_ was stated.

My ldbsearch is from pure Samba-4.9.5, self compiled on Fedora 29 x86_64.
And now I see it even has not '-V' switch:

[root at dc1 bind-dns]# ldbsearch --usage
Usage: [-?viraS] [-?|--help] [--usage] [-H|--url=URL] [-b|--basedn=DN]
[-e|--editor=PROGRAM] [-s|--scope=SCOPE] [-v|--verbose] [--trace]
[-i|--interactive] [-r|--recursive] [--modules-path=PATH]
        [--num-searches=INT] [--num-records=INT] [-a|--all] [--nosync]
[-S|--sorted] [-o=OPTION] [--controls=STRING] [--show-binary] [--paged]
[--show-deleted] [--show-recycled] [--show-deactivated-link]
        [--reveal] [--relax] [--cross-ncs] [--extended-dn]
[root at dc1 bind-dns]# ldbsearch -V
Invalid option -V: unknown option
Usage: ldbsearch <options> <expression> <attrs...>
Usage: [OPTION...]
  -H, --url=URL                   database URL
  -b, --basedn=DN                 base DN
  -e, --editor=PROGRAM            external editor
  -s, --scope=SCOPE               search scope
  -v, --verbose                   increase verbosity
      --trace                     enable tracing
  -i, --interactive               input from stdin
  -r, --recursive                 recursive delete
      --modules-path=PATH         modules path
      --num-searches=INT          number of test searches
      --num-records=INT           number of test records
  -a, --all                       (|(objectClass=*)(distinguishedName=*))
      --nosync                    non-synchronous transactions
  -S, --sorted                    sort attributes
  -o=OPTION                       ldb_connect option
      --controls=STRING           controls
      --show-binary               display binary LDIF
      --paged                     use a paged search
      --show-deleted              show deleted objects
      --show-recycled             show recycled objects
      --show-deactivated-link     show deactivated links
      --reveal                    reveal ldb internals
      --relax                     pass relax control
      --cross-ncs                 search across NC boundaries
      --extended-dn               show extended DNs

Help options:
  -?, --help                      Show this help message
      --usage                     Display brief usage message
-- 
Franta

On Wed, 27 Mar 2019 13:00:42 +0100
Franta Hanzlík <franta at hanzlici.cz> wrote:
> Yes, is no difference between '-UAdministrator' and '-U
> Administrator'. But it seems, as ldbsearch in 4.9.5 is different than
> 4.9.4-. (I was furious with that, because I found lot articles on
> net, where -U _username_ was stated.
> 
> My ldbsearch is from pure Samba-4.9.5, self compiled on Fedora 29
> x86_64. And now I see it even has not '-V' switch:
> 
> [root at dc1 bind-dns]# ldbsearch --usage
> Usage: [-?viraS] [-?|--help] [--usage] [-H|--url=URL]
> [-b|--basedn=DN] [-e|--editor=PROGRAM] [-s|--scope=SCOPE]
> [-v|--verbose] [--trace] [-i|--interactive] [-r|--recursive]
> [--modules-path=PATH] [--num-searches=INT] [--num-records=INT]
> [-a|--all] [--nosync] [-S|--sorted] [-o=OPTION] [--controls=STRING]
> [--show-binary] [--paged] [--show-deleted] [--show-recycled]
> [--show-deactivated-link] [--reveal] [--relax] [--cross-ncs]
> [--extended-dn] [root at dc1 bind-dns]# ldbsearch -V Invalid option -V:
> unknown option Usage: ldbsearch <options> <expression>
<attrs...>
> Usage: [OPTION...] -H, --url=URL                   database URL -b,
> --basedn=DN                 base DN -e, --editor=PROGRAM
> external editor -s, --scope=SCOPE               search scope -v,
> --verbose                   increase verbosity
> --trace                     enable tracing -i,
> --interactive               input from stdin -r,
> --recursive                 recursive delete
> --modules-path=PATH         modules path --num-searches=INT
> number of test searches --num-records=INT           number of test
> records -a, --all
> (|(objectClass=*)(distinguishedName=*)) --nosync
> non-synchronous transactions -S, --sorted                    sort
> attributes -o=OPTION                       ldb_connect option
>       --controls=STRING           controls
>       --show-binary               display binary LDIF
>       --paged                     use a paged search
>       --show-deleted              show deleted objects
>       --show-recycled             show recycled objects
>       --show-deactivated-link     show deactivated links
>       --reveal                    reveal ldb internals
>       --relax                     pass relax control
>       --cross-ncs                 search across NC boundaries
>       --extended-dn               show extended DNs
> 
> Help options:
>   -?, --help                      Show this help message
>       --usage                     Display brief usage message
How did you compile Samba ?

You seem to have lost a lot of the options :-)

on Debian 4.9.5, you get this:

ldbsearch --usage
Usage: [-?viraSNPeV] [-?|--help] [--usage] [-H|--url=URL] [-b|--basedn=DN]
        [-e|--editor=PROGRAM] [-s|--scope=SCOPE] [-v|--verbose] [--trace]
        [-i|--interactive] [-r|--recursive] [--modules-path=PATH]
        [--num-searches=INT] [--num-records=INT] [-a|--all] [--nosync]
        [-S|--sorted] [-o=OPTION] [--controls=STRING] [--show-binary]
        [--paged] [--show-deleted] [--show-recycled]
        [--show-deactivated-link] [--reveal] [--relax] [--cross-ncs]
        [--extended-dn] [-d|--debuglevel=DEBUGLEVEL] [--debug-stderr]
        [-s|--configfile=CONFIGFILE] [--option=name=value]
        [-l|--log-basename=LOGFILEBASE] [--leak-report] [--leak-report-full]
        [-U|--user=[DOMAIN/]USERNAME[%PASSWORD]] [-N|--no-pass]
        [--password=STRING] [-A|--authentication-file=FILE]
        [-P|--machine-pass] [--simple-bind-dn=STRING] [-k|--kerberos=STRING]
        [--krb5-ccache=STRING] [-S|--sign] [-e|--encrypt]
        [-R|--name-resolve=NAME-RESOLVE-ORDER]
        [-O|--socket-options=SOCKETOPTIONS] [-n|--netbiosname=NETBIOSNAME]
        [-S|--signing=on|off|required] [-W|--workgroup=WORKGROUP]
        [--realm=REALM] [-i|--scope=SCOPE] [-m|--maxprotocol=MAXPROTOCOL]
        [-V|--version]

It looks like you have lost these:

Usage: [-NPeV]         
        [--reveal] [--relax] [--cross-ncs]
        [--extended-dn] [-d|--debuglevel=DEBUGLEVEL] [--debug-stderr]
        [-s|--configfile=CONFIGFILE] [--option=name=value]
        [-l|--log-basename=LOGFILEBASE] [--leak-report] [--leak-report-full]
        [-U|--user=[DOMAIN/]USERNAME[%PASSWORD]] [-N|--no-pass]
        [--password=STRING] [-A|--authentication-file=FILE]
        [-P|--machine-pass] [--simple-bind-dn=STRING] [-k|--kerberos=STRING]
        [--krb5-ccache=STRING] [-S|--sign] [-e|--encrypt]
        [-R|--name-resolve=NAME-RESOLVE-ORDER]
        [-O|--socket-options=SOCKETOPTIONS] [-n|--netbiosname=NETBIOSNAME]
        [-S|--signing=on|off|required] [-W|--workgroup=WORKGROUP]
        [--realm=REALM] [-i|--scope=SCOPE] [-m|--maxprotocol=MAXPROTOCOL]
        [-V|--version]

Rowland

On Wed, 27 Mar 2019 09:36:55 +0000
Rowland Penny via samba <samba at lists.samba.org> wrote:
> On Wed, 27 Mar 2019 09:01:39 +0000
> Rowland Penny via samba <samba at lists.samba.org> wrote:
> 
> > On Wed, 27 Mar 2019 09:45:18 +0100
> > "L.P.H. van Belle via samba" <samba at
lists.samba.org> wrote:
> >   
> > > Hai, 
> > > 
> > > 
> > > I dont think one noticed this.. 
> > > 
> > > ldbsearch -H ldap://dc4 -UAdministrator 
> > > ldbsearch -H ldap://dc1 -U Administrator 
> > > 
> > > So whats the difference when you see this responce of the
command:
> > >  Invalid option -U: unknown ... 
> > > 
> > > The " " between -U Admin... 
> > > Try again without the space or use --user=Administrator 
> > > 
> > > 
> > > Greetz, 
> > > 
> > > Louis  
> > 
> > The space doesn't make any difference '-U Administrator'
or
> > '-UAdministrator' both work, as does '-U
administrator' or
> > '-Uadministrator'
> > 
> > I just wonder where '-U' went ?
> > 
> > Rowland
> >   
> 
> I have been looking at the 'Administrator' object that the OP
posted.
> 
> The failure in his original post was this:
> 
> ERROR(ldb): uncaught exception - descriptor_modify on
> CN=Administrator,CN=Users,DC=zamecek,DC=home failed: operations error
> at ../source4/dsdb/samdb/ldb_modules/descriptor.c:819
> 
> lines 816 - 820 in descriptor.c are these:
> 
> 	objectclass = dsdb_get_last_structural_class(schema,
> 						     objectclass_element);
> 	if (objectclass == NULL) {
> 		return ldb_operr(ldb);
> 	}
> 
> So, it looks like (to me anyway) that it is looking for the objectclass
> for 'nTSecurityDescriptor' and trying to match it to the last (
> objectclass found in the list:
> 
> objectClass: top
> objectClass: person
> objectClass: organizationalPerson
> objectClass: user
> objectClass: posixAccount
> 
> I may be barking up the wrong tree here, but I would remove all the
> rfc2307 attributes and objectclass from 'Administrator':
> 
> objectClass: posixAccount
> gidNumber: 1103
> uidNumber: 0
> loginShell: /bin/bash
> unixHomeDirectory: /root
> 
> They are definitely not required and could be causing the problem.
I remove these attributes (via
LDB_MODULES_PATH="/usr/lib64/samba/ldb/" ldbedit -e joe  -H
/var/lib/samba/private/sam.ldb -s sub '(CN=Administrator)'
).
I also deleted some orphaned/abandoned SSS words from /etc/nsswitch (Fedora
by default is installed with sssd support, and it seems even when is system
switching to winbind, some sss stuff remain there - concretely:
shadow:     files sss
services:   files sss
netgroup:   sss
automount:  files sss
) - it caused problem, when I tried join other Samba machine (fileserver)
into domain, this SSS parts caused DNS errors as:

[root at lynx samba]# net ads join -U Administrator
Using short domain name -- SSUPS-ZAMECEK
Joined 'LYNX' to dns domain 'zamecek.home'
DNS Update for lynx.zamecek.home failed: ERROR_DNS_INVALID_MESSAGE
DNS update failed: NT_STATUS_UNSUCCESSFUL

[root at lynx samba]# net ads join -U Administrator
Using short domain name -- SSUPS-ZAMECEK
Joined 'LYNX' to dns domain 'zamecek.home'
DNS Update for lynx.zamecek.home failed: ERROR_DNS_GSS_ERROR
DNS update failed: NT_STATUS_UNSUCCESSFUL

and after removing, all was OK.


_And joind second DC now seems be now finally also good! :

[root at dc2-lynx etc]# samba-tool domain join zamecek.home DC
-U"SSUPS-ZAMECEK\administrator" --option='idmap_ldb:use rfc2307 =
yes' --dns-backend=BIND9_DLZ
Finding a writeable DC for domain 'zamecek.home'
Found DC dc1.zamecek.home
Password for [SSUPS-ZAMECEK\administrator]:
workgroup is SSUPS-ZAMECEK
realm is zamecek.home
Adding CN=DC2-LYNX,OU=Domain Controllers,DC=zamecek,DC=home
Adding
CN=DC2-LYNX,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=zamecek,DC=home
Adding CN=NTDS
Settings,CN=DC2-LYNX,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=zamecek,DC=home
Adding SPNs to CN=DC2-LYNX,OU=Domain Controllers,DC=zamecek,DC=home
Setting account password for DC2-LYNX$
Enabling account
Adding DNS account CN=dns-DC2-LYNX,CN=Users,DC=zamecek,DC=home with dns/ SPN
Setting account password for dns-DC2-LYNX
Calling bare provision
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
Unable to determine the DomainSID, can not enforce uniqueness constraint on
local domainSIDs

A Kerberos configuration suitable for Samba AD has been generated at
/var/lib/samba/private/krb5.conf
Merge the contents of this file with your system krb5.conf or replace it with
this one. Do not create a symlink!
Provision OK for domain DN DC=zamecek,DC=home
Starting replication
Schema-DN[CN=Schema,CN=Configuration,DC=zamecek,DC=home] objects[402/1550]
linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=zamecek,DC=home] objects[804/1550]
linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=zamecek,DC=home] objects[1206/1550]
linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=zamecek,DC=home] objects[1550/1550]
linked_values[0/0]
Analyze and apply schema objects
Partition[CN=Configuration,DC=zamecek,DC=home] objects[402/1632]
linked_values[0/1]
Partition[CN=Configuration,DC=zamecek,DC=home] objects[804/1632]
linked_values[0/1]
Partition[CN=Configuration,DC=zamecek,DC=home] objects[1206/1632]
linked_values[0/1]
Partition[CN=Configuration,DC=zamecek,DC=home] objects[1608/1632]
linked_values[0/1]
Partition[CN=Configuration,DC=zamecek,DC=home] objects[1632/1632]
linked_values[46/46]
Failed to commit objects: DOS code 0x000021bf
Missing target object - retrying with DRS_GET_TGT
Partition[CN=Configuration,DC=zamecek,DC=home] objects[2034/1632]
linked_values[1/1]
Partition[CN=Configuration,DC=zamecek,DC=home] objects[2436/1632]
linked_values[0/1]
Partition[CN=Configuration,DC=zamecek,DC=home] objects[2838/1632]
linked_values[0/1]
Partition[CN=Configuration,DC=zamecek,DC=home] objects[3240/1632]
linked_values[0/1]
Partition[CN=Configuration,DC=zamecek,DC=home] objects[3264/1632]
linked_values[45/46]
Replicating critical objects from the base DN of the domain
Partition[DC=zamecek,DC=home] objects[98/97] linked_values[141/141]
Partition[DC=zamecek,DC=home] objects[500/711] linked_values[0/22]
Partition[DC=zamecek,DC=home] objects[809/711] linked_values[657/657]
Done with always replicated NC (base, config, schema)
Replicating DC=DomainDnsZones,DC=zamecek,DC=home
Partition[DC=DomainDnsZones,DC=zamecek,DC=home] objects[60/60]
linked_values[0/0]
Replicating DC=ForestDnsZones,DC=zamecek,DC=home
Partition[DC=ForestDnsZones,DC=zamecek,DC=home] objects[18/18]
linked_values[0/0]
Exop on[CN=RID Manager$,CN=System,DC=zamecek,DC=home] objects[3]
linked_values[0]
Committing SAM database
Adding 1 remote DNS records for DC2-LYNX.zamecek.home
Adding DNS A record DC2-LYNX.zamecek.home for IPv4 IP: 192.168.64.253
Adding DNS CNAME record c23dcb8b-6817-4576-9acd-e9b9f7d9fdcd._msdcs.zamecek.home
for DC2-LYNX.zamecek.home
All other DNS records (like _ldap SRV records) will be created samba_dnsupdate
on first startup
Replicating new DNS records in DC=DomainDnsZones,DC=zamecek,DC=home
Partition[DC=DomainDnsZones,DC=zamecek,DC=home] objects[2/2] linked_values[0/0]
Replicating new DNS records in DC=ForestDnsZones,DC=zamecek,DC=home
Partition[DC=ForestDnsZones,DC=zamecek,DC=home] objects[2/2] linked_values[0/0]
Sending DsReplicaUpdateRefs for all the replicated partitions
Setting isSynchronized and dsServiceName
Setting up secrets database
See /var/lib/samba/bind-dns/named.conf for an example configuration include file
for BIND
and /var/lib/samba/bind-dns/named.txt for further documentation required for
secure DNS updates
Joined domain SSUPS-ZAMECEK (SID S-1-5-21-9998-9997-9996) as a DC


Many, many thanks for Your valuable help!
-- 
Franta Hanzlik