samba - Nov 2022 - Testing replication between 4 DCs

On 23/11/2022 19:10, Michael Tokarev via samba wrote:
> 23.11.2022 20:02, Rowland Penny via samba wrote:
>> On 23/11/2022 16:04, Michael Tokarev via samba wrote:
>>
>>> Are you sure DC3 and DC4 *have* to replicate between each other?
>>
>> Yes, all DC's have to replicate to all other DC's
>>
>>> I'm new to this stuff, but I had to add extra links 
>>
>> You shouldn't have to, Samba should add them for you.
> 
> Does it add all to all links, ie, one link with two DCs,
> 3 links with 3 DCs, 6 links with 4 DCs and so on (hopefully
> I counted it correctly), so every DC is connected to every
> other DC (provided everything is on the same site)?
> 
>>> (how is that,
>>> NTDS? I forgot) between two out of 3 DCs here in order to enable
>>> replication between them. In "Sites and Subnets" snap,
under each
>>> DC, there's one more level with the links. Some links are
created
>>> automatically, some have to be created explicitly.? I don't
know
>>> if that's how it is supposed to work, but this is what I've
seen
>>> when doing experiments here.
>>
>> You seem to be having problems, oh yes, aren't you the person using
>> unbound ?
> 
> Yeah, I did have problems. For example, Windows explorer crashes
> when opening "Security" tab of a file located on a DC.? Is it due
> to unbound, are you sure?
> 
> The rest was no problem, just minor annoyances.? For example, user IDs
> were different on different servers because I didn't copy idmap.tdb,
> and bug in samba-tool ntacl sysvolcheck vs sysvolreset.? Is this due
> to unbound too?
> 
> SPN must be unique, - I didn't know this.? Is it due to unbound?
> 
> ..
>>> - I'd
>>> avoid this one because of a very simple reason: if replication to
>>> this DC doesn't work for some reason, DNS replication
doesn't work
>>> too, so it wont see new names in the net (which might be required
>>> for the replication to work).? This is one of the reasons I
don't
>>> use samba-provided DNS, 
>>
>> No, that is one of the reasons you are having problems with
replication.
> 
> Which problems? I don't know problems I have with replication.
> So far, replication works here fine, multiple sities, multiple
> DCs in each. Changes are propagated to all the network quite
> rapidly.
> 
>>> - to keep it simple and avoid such sort
>>> of issues.? DNS is already well set up with replication and
>>> reservation to ensure it is always working.? YMMV.
>>
>> It does, my domain works.
> 
> What it and what it does? The fact that your domain work - this
> is excellent. My domain works too, quite well. This too is
> excellent.
> 
> /mjt
> 
Samba stores dns records in AD and when you join a new DC, at first 
start (and every 10 minutes after that) a python script is run 
'samba_dnsupdate', this adds any missing records found in the file 
'dns_update_list'. Because you are using unbound, your records are 
incomplete, they are very probably in AD, but unbound doesn't read the 
records in AD. Because unbound doesn't know all the records, it is very 
probable that this is causing some of your problems.

I cannot make you use the recommended method, but would urge you to do 
so. You are not the first to use an external dns server in the way you 
are and you are not the first to have problems because you do.

Rowland

23.11.2022 22:31, Rowland Penny via samba wrote:
> Samba stores dns records in AD and when you join a new DC, at first start
(and every 10 minutes after that) a python script is run
'samba_dnsupdate',
> this adds any missing records found in the file 'dns_update_list'.
Because you are using unbound, your records are incomplete, they are very
probably
> in AD, but unbound doesn't read the records in AD. Because unbound
doesn't know all the records, it is very probable that this is causing some
of your
> problems.
Rowland, you sipped actual question and returned to speculations.
I don't know why you're doing this.  But I'm okay with this too,
people are different, that's normal.

Too bad you also skipped a question about inter-DC links which - as
you wrote before - should be created by samba. I'll take a look at
the actual code which does that. It smells like you're wrong here
and there wont be all-to-all links created (so each DC is linked to
each other DC) - only a few of them. And this has absolutely nothing
to do with DNS either, it seems like, because when the links gets
created, DNS isn't consulted yet, only when they being actually used.

Constantly running samba_dnsupdate is a wrong solution to a wrong problem.
If your DNS is incapable of storing names in a more or less permanent basis
and needs constant updates (without any changes in actual data) just to
keep records in there, because maybe there's some chance these records will
be lost somewhere, the solution is to fix you DNS so it become reliable,
instead of constantly pushing stuff into a leaking tank. Fix the leak and
there's no need to add more fuel, that's actually very easy.
> I cannot make you use the recommended method, but would urge you to do so.
You are not the first to use an external dns server in the way you are and
> you are not the first to have problems because you do.
I will *never* delegate something as important as DNS to something as
unreliable and buggy as samba, at least not in its current form.
It is exactly backwards.  And once again, no, I'm *not* having a
problem.

And still, you never answered to a simple question:  Which DNS
records Samba keeps or updates which can't be managed by any other
nameserver?  Which records needs updating after the server (DC
or member) is set up?  Where these records are hidden, why a dump
of the zone or samba_dnsupdate tool does not show them?

*That* would be real answer, - to describe the actual stuff samba
does which can't be (trivially!) replicated into any nameserver
out there.  You never gave anything remotely resembling an answer
to the *why* question.

Unless there's some real data to show, or the code which does
that, all the rest is just a speculation.

Thanks,

/mjt