In general we do not allow the removal of schema. In particular, because records in samba are stored under the attribute name, removing schema or renaming schema items describing those attributes and objectclasses can mean records cannot be processed correctly. However, if you confirm you really have exactly the entry already in the schema, you could edit the new schema not to add that particular entry. Ideally we could update the tool (let me know if you would prefer this option) to detect this and recover, but for now that would be the best option. Andrew Bartlett On Tue, 2020-11-10 at 22:27 +0000, Matthew Delfino Samba List via samba wrote:> Hello, > > Since responses were not forthcoming, I started looking for plausible > explanations that might be unique to my company's setup. A few years > ago, we imported ldif schema files to support directory integrations > with Kerio Connect server. The attribute "msDS- > MembersOfResourcePropertyList" was included in one of those ldif > files. > > Since we no longer require directory integration with Kerio Connect, > my inclination is to remove this custom schema. If anyone has > suggestions on how to safely remove schema alterations from Samba, > I'd greatly appreciate it. Otherwise, I'll do my own research, see if > and how I can remove this custom schema from my installation. > > Whatever I find I'll be sure to report back to the forum in case, > however unlikely, another administrator finds themselves in a similar > situation. > > Thanks, > Matthew > > > ?On 2020.11.06, 8:48 PM, "Matthew Delfino Samba List via samba" < > samba at lists.samba.org> wrote: > > Thanks for taking a shot at helping me, Rowland. I found that > someone had made this suggestion for another person in the past, so I > ran this command before reaching out on Monday: > > > ldbsearch -H /var/lib/samba/private/sam.ldb -b > "CN=Schema,CN=Configuration,$(echo "DC=$(hostname -d)" | sed > 's/\./,DC=/g')" -s base objectVersion | grep 'objectVersion' | awk > '{print $NF}' > > (Which is just a fancier way to precisely carve down to the > version number.) > > Back then, it gave me "47." > > I ran it again today, and now it says, "My value is still 47... > alas." > > Any other suggestions? > > Again, I appreciate your time. > > Matthew > > > On 2020.11.06, 9:26 AM, "samba on behalf of Rowland penny via > samba" <samba-bounces at lists.samba.org on behalf of > samba at lists.samba.org> wrote: > > On 06/11/2020 14:43, Matthew Delfino Samba List via samba > wrote: > > Hello! > > > > I just upgraded from Samba v4.10.9 to v4.11.15. The > upgrade seems to have gone smoothly. As part of major release > maintenance, I ran the following command on my schema master DC: > > > > > samba-tool domain schemaupgrade > > > > Do you have any suggestions on how to troubleshoot? My > schema is already on version 47. > > > It looks like your schema is already at '69', try running > this: > > ldbsearch -H /var/lib/samba/private/sam.ldb -b > 'cn=Schema,cn=Configuration,dc=samdom,dc=example,dc=com' -s > base > objectVersion > > Altered for your setup. > > Rowland > > > > -- > To unsubscribe from this list go to the following URL and > read the > instructions: https://lists.samba.org/mailman/options/samba > > > ? 2020 KNOCK, inc. All rights reserved. KNOCK, inc, is a > registered trademark of KNOCK, inc. This message and any attachments > contain information, which is confidential and/or privileged. If you > are not the intended recipient, please refrain from any disclosure, > copying, distribution or use of this information. Please be aware > that such actions are prohibited. If you have received this > transmission in error, kindly notify the sender by e-mail. Your > cooperation is appreciated. > -- > To unsubscribe from this list go to the following URL and read > the > instructions: https://lists.samba.org/mailman/options/samba > > ? 2020 KNOCK, inc. All rights reserved. KNOCK, inc, is a registered > trademark of KNOCK, inc. This message and any attachments contain > information, which is confidential and/or privileged. If you are not > the intended recipient, please refrain from any disclosure, copying, > distribution or use of this information. Please be aware that such > actions are prohibited. If you have received this transmission in > error, kindly notify the sender by e-mail. Your cooperation is > appreciated.-- Andrew Bartlett https://samba.org/~abartlet/ Authentication Developer, Samba Team https://samba.org Samba Developer, Catalyst IT https://catalyst.net.nz/services/samba
Andrew,
I feel that it is your prerogative to determine how many odd possibilities you
want your tools to account for, so that they might know what to do rather than
exit with an error. You have a better sense for how likely it is that someone in
the wild is altering their schema and might have changed an already existing
attribute, as it seems I did.
If you'd allow me to impose upon your generosity, can you tell me how I
might be able to find out if the 4.11.x `samba-tool domain schemaupgrade`
option's new schema has any content that matches the ones I imported? I *do*
have copies of the original ldif files I imported, so I know how to check what I
used. But where is the new schema that the schemaupgrade option uses?
I'll go looking, but perhaps your advice will help me to avoid any pitfalls.
Thanks,
Matthew
?On 2020.11.10, 4:33 PM, "Andrew Bartlett" <abartlet at
samba.org> wrote:
In general we do not allow the removal of schema.
In particular, because records in samba are stored under the attribute
name, removing schema or renaming schema items describing those
attributes and objectclasses can mean records cannot be processed
correctly.
However, if you confirm you really have exactly the entry already in
the schema, you could edit the new schema not to add that particular
entry.
Ideally we could update the tool (let me know if you would prefer this
option) to detect this and recover, but for now that would be the best
option.
Andrew Bartlett
On Tue, 2020-11-10 at 22:27 +0000, Matthew Delfino Samba List via samba
wrote:
> Hello,
>
> Since responses were not forthcoming, I started looking for plausible
> explanations that might be unique to my company's setup. A few
years
> ago, we imported ldif schema files to support directory integrations
> with Kerio Connect server. The attribute "msDS-
> MembersOfResourcePropertyList" was included in one of those ldif
> files.
>
> Since we no longer require directory integration with Kerio Connect,
> my inclination is to remove this custom schema. If anyone has
> suggestions on how to safely remove schema alterations from Samba,
> I'd greatly appreciate it. Otherwise, I'll do my own research,
see if
> and how I can remove this custom schema from my installation.
>
> Whatever I find I'll be sure to report back to the forum in case,
> however unlikely, another administrator finds themselves in a similar
> situation.
>
> Thanks,
> Matthew
>
>
> On 2020.11.06, 8:48 PM, "Matthew Delfino Samba List via
samba" <
> samba at lists.samba.org> wrote:
>
> Thanks for taking a shot at helping me, Rowland. I found that
> someone had made this suggestion for another person in the past, so I
> ran this command before reaching out on Monday:
>
> > ldbsearch -H /var/lib/samba/private/sam.ldb -b
> "CN=Schema,CN=Configuration,$(echo "DC=$(hostname -d)" |
sed
> 's/\./,DC=/g')" -s base objectVersion | grep
'objectVersion' | awk
> '{print $NF}'
>
> (Which is just a fancier way to precisely carve down to the
> version number.)
>
> Back then, it gave me "47."
>
> I ran it again today, and now it says, "My value is still
47...
> alas."
>
> Any other suggestions?
>
> Again, I appreciate your time.
>
> Matthew
>
>
> On 2020.11.06, 9:26 AM, "samba on behalf of Rowland penny via
> samba" <samba-bounces at lists.samba.org on behalf of
> samba at lists.samba.org> wrote:
>
> On 06/11/2020 14:43, Matthew Delfino Samba List via samba
> wrote:
> > Hello!
> >
> > I just upgraded from Samba v4.10.9 to v4.11.15. The
> upgrade seems to have gone smoothly. As part of major release
> maintenance, I ran the following command on my schema master DC:
> >
> > > samba-tool domain schemaupgrade
> >
> > Do you have any suggestions on how to troubleshoot?
My
> schema is already on version 47.
> >
> It looks like your schema is already at '69', try
running
> this:
>
> ldbsearch -H /var/lib/samba/private/sam.ldb -b
>
'cn=Schema,cn=Configuration,dc=samdom,dc=example,dc=com' -s
> base
> objectVersion
>
> Altered for your setup.
>
> Rowland
>
>
>
> --
> To unsubscribe from this list go to the following URL and
> read the
> instructions: https://lists.samba.org/mailman/options/samba
>
>
> ? 2020 KNOCK, inc. All rights reserved. KNOCK, inc, is a
> registered trademark of KNOCK, inc. This message and any attachments
> contain information, which is confidential and/or privileged. If you
> are not the intended recipient, please refrain from any disclosure,
> copying, distribution or use of this information. Please be aware
> that such actions are prohibited. If you have received this
> transmission in error, kindly notify the sender by e-mail. Your
> cooperation is appreciated.
> --
> To unsubscribe from this list go to the following URL and read
> the
> instructions: https://lists.samba.org/mailman/options/samba
>
> ? 2020 KNOCK, inc. All rights reserved. KNOCK, inc, is a registered
> trademark of KNOCK, inc. This message and any attachments contain
> information, which is confidential and/or privileged. If you are not
> the intended recipient, please refrain from any disclosure, copying,
> distribution or use of this information. Please be aware that such
> actions are prohibited. If you have received this transmission in
> error, kindly notify the sender by e-mail. Your cooperation is
> appreciated.
--
Andrew Bartlett https://samba.org/~abartlet/
Authentication Developer, Samba Team https://samba.org
Samba Developer, Catalyst IT
https://catalyst.net.nz/services/samba
? 2020 KNOCK, inc. All rights reserved. KNOCK, inc, is a registered trademark of
KNOCK, inc. This message and any attachments contain information, which is
confidential and/or privileged. If you are not the intended recipient, please
refrain from any disclosure, copying, distribution or use of this information.
Please be aware that such actions are prohibited. If you have received this
transmission in error, kindly notify the sender by e-mail. Your cooperation is
appreciated.
On 10/11/2020 22:47, Matthew Delfino Samba List via samba wrote:> Andrew, > > I feel that it is your prerogative to determine how many odd possibilities you want your tools to account for, so that they might know what to do rather than exit with an error. You have a better sense for how likely it is that someone in the wild is altering their schema and might have changed an already existing attribute, as it seems I did. > > If you'd allow me to impose upon your generosity, can you tell me how I might be able to find out if the 4.11.x `samba-tool domain schemaupgrade` option's new schema has any content that matches the ones I imported? I *do* have copies of the original ldif files I imported, so I know how to check what I used. But where is the new schema that the schemaupgrade option uses? > > I'll go looking, but perhaps your advice will help me to avoid any pitfalls. >The Samba schema upgrade script uses this: /usr/share/samba/setup/adprep/WindowsServerDocs/Schema-Updates.md This path is on Debian, so yours may differ. The script reads 'Schema-Updates.md' and creates the required ldif's from it, so I think you need to remove anything from that list that is already in AD. Rowland