samba - Dec 2019 - Replication issues samba 4.10.11-SerNet-Debian-10.buster

Hello,

We added a new samba DC with 4.10.11-SerNet-Debian-10.buster? to our
existing 5 ones and can?t obtain replication.

Comparing configuration with other functioning DCs did not show any
relevant difference.

The only difference during the configuration procedure was that DNS PTR
and A records were added after joining the domain and not before.

The sernet-samba-ad service is running but throws the following warnings:
> [2019/12/12 17:52:55.375238,? 0]
> ../../lib/util/util_runcmd.c:327(samba_runcmd_io_handler)
> Dec 12 17:52:55 dchost samba[489]:?? /usr/sbin/samba_kcc:????
> self.schedule = ndr_unpack(drsblobs.schedule, value)
> Dec 12 17:52:55 dchost samba[489]: [2019/12/12 17:52:55.375467,? 0]
> ../../lib/util/util_runcmd.c:327(samba_runcmd_io_handler)
> Dec 12 17:52:55 dchost samba[489]:?? /usr/sbin/samba_kcc:?? File
> "/usr/lib/python2.7/dist-packages/samba/ndr.py", line 48, in
ndr_unpack
> Dec 12 17:52:55 dchost samba[489]: [2019/12/12 17:52:55.375704,? 0]
> ../../lib/util/util_runcmd.c:327(samba_runcmd_io_handler)
> Dec 12 17:52:55 dchost samba[489]:?? /usr/sbin/samba_kcc:????
> ndr_unpack(data, allow_remaining=allow_remaining)
> Dec 12 17:52:55 dchost samba[489]: [2019/12/12 17:52:55.375955,? 0]
> ../../lib/util/util_runcmd.c:327(samba_runcmd_io_handler)
> Dec 12 17:52:55 dchost samba[489]:?? /usr/sbin/samba_kcc:
> RuntimeError: (12, 'Allocation Error')
> Dec 12 17:52:55 dchost samba[489]: [2019/12/12 17:52:55.387666,? 0]
> ../../source4/dsdb/kcc/kcc_periodic.c:768(samba_kcc_done)
> Dec 12 17:52:55 dchost samba[489]:??
> ../../source4/dsdb/kcc/kcc_periodic.c:768: Failed samba_kcc -
> NT_STATUS_ACCESS_DENIED
The replication check output is "all good" though
> root at dchost:~# samba-tool drs showrepl --summary
> [ALL GOOD]
The replication command seems giving an OK output:
> samba-tool drs replicate dchost sourcedc dc=DC,dc=example,dc=com
> Replicate from sourcedc to dchost was successful.
Checking DNS seems to prove that replication was not instead succesful:
> host -t SRV _ldap._tcp.dc.example.com
> _ldap._tcp.dc.example.com has SRV record 0 100 389 addc01.dc.example.com
> _ldap._tcp.dc.example.com has SRV record 0 100 389 addc02.dc.example.com
> _ldap._tcp.dc.example.com has SRV record 0 100 389 addc3.dc.example.com
> _ldap._tcp.dc.example.com has SRV record 0 100 389 addc2.dc.example.com
> _ldap._tcp.dc.example.com has SRV record 0 100 389 addc03.dc.example.com
Authentication on new DC actually fails (so we suppose no replication
took place anyway).


-- 
?forumZFD
Entschieden f?r Frieden|Committed to Peace

Ilias Chasapakis
IT-Systemadministrator

Forum Ziviler Friedensdienst e.V.|Forum Civil Peace Service
Am K?lner Brett 8 | 50825 K?ln | Germany

Tel 0221 91273233 | Fax 0221 91273299 |
http://www.forumZFD.de

Vorstand nach ? 26 BGB, einzelvertretungsberechtigt|Executive Board:
Oliver Knabe (Vorsitz|Chair), Sonja Wiekenberg-Mlalandle, Alexander Mauz
VR 17651 Amtsgericht K?ln

Spenden|Donations: IBAN DE37 3702 0500 0008 2401 01 BIC BFSWDE33XXX