samba - Aug 2023 - Classic Upgrade changes domain SID

On Sun, 2023-08-27 at 22:37 +0200, Peter Koch via samba
wrote:
> Hi Roland,
> 
> I did some investigations about why the classic upgrade
> script creates an AD-DC with a domain SID different from
> my old NT4-DC.
> 
> .../samba/lib64/python3.9/site-packages/samba/upgrade.py
> reads variable domainsid in line 494 via:
> domainsid = passdb.get_global_sam_sid()
> 
> I inserted line 495 into upgrade.py, namely:
> raise Exception(domainsid);
> 
> Now classic upgrade script fails with:
> 
>  >ERROR(exception): uncaught exception - 
> S-1-5-352321536-3589954388-2200284306-183212708
> My NT4 domains SID is:
> 
>  ># net getdomainsid
>  >SID for local machine SERV00 is: S-1-5-21-1415314133-2460755331-
> 2761616138
>  >SID for domain NAV is: S-1-5-21-1415314133-2460755331-2761616138
> 
> So why in the world does passdb.get_global_sam_sid()
> reads a different domain SID from passwd.tlb?
Thanks so much for doing this deep debugging Peter.  

I can't explain it, but I agree this is the nub of the problem.  I
wonder if they are reading different databases?

Some work with strace might help confirm which files are being
opened.  Both of these calls are very thin wrappers around the C
get_global_sam_sid() function. 

So I suspect the issue with paths, reading a different private dir.

Are you upgrading from LDAP?   The pdb_ldap code reads the SID from
LDAP.  Does the SID in LDAP match either of these values?

I'm sorry, I've not read the entire thread closely, but which of these
is the correct one?

Andrew Bartlett


-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/
Samba Team Member (since 2001) https://samba.org
Samba Team Lead                https://catalyst.net.nz/services/samba
Catalyst.Net Ltd

Proudly developing Samba for Catalyst.Net Ltd - a Catalyst IT group
company

Samba Development and Support: https://catalyst.net.nz/services/samba

Catalyst IT - Expert Open Source Solutions

Hi Andrew, Hi Roland

Current status of my problem:

- Domain SID of my old samba 3.6.14 NT4-DC is:
S-1-5-21-1415314133-2460755331-2761616138
- I confirmed that this SID is contained in
 ? secrets.tdb (by running tdbdump on the samba3 server)
- the correct secrets.tdb file was transfered to
 ? the new server.
- upgrade script does open the correct secrets.tdb
 ? file (checked with strace-output)
- upgrade.py calls passdb.get_global_sam_sid() in
 ? line 494 and this call returns a different SID, namely
S-1-5-352321536-3589954388-2200284306-183212708
- This is not a randomly generated SID as upgrade.py
 ? uses this SID on every invocation. It must be stored
 ? somewhere.
- There's no LDAP involved. Our samba3 server uses
 ? the passdb backend and the samba4-LDAP is not
 ? yet running while upgrade.py does NT4-AD-migration.

I will debug get_global_sam_sid() ASAP to find out
how the wrong? domain SID ist determined. So far
I'm clueless.

I would like to try a very quick and dirty hack, namely
replace lines 491-495 of upgrade.py:

 ??? # Get domain sid
 ??? try:
 ??????? domainsid = passdb.get_global_sam_sid()
 ??? except passdb.error:
 ??????? raise Exception("Can't find domain sid for '%s',
Exiting." %
domainname)

by:

 ??? # Get domain sid
 ??? try:
 ??????? domainsid = passdb.get_global_sam_sid()
 ??????? domainsid = "S-1-5-21-1415314133-2460755331-2761616138"
 ??? except passdb.error:
 ??????? raise Exception("Can't find domain sid for '%s',
Exiting." %
domainname)

Of course this does not work as domainsid must be a
variable of type dom_sid and the above changes domainsid
into a string.

Unfortunately I know nothing about Phython. How would I store
the correct SID-value in variable domainsid in Python-syntax?

Peter