Matthias Kühne | Ellerhold Aktiengesellschaft
2024-Jun-28 05:41 UTC
[Samba] Online AD Backup fails with "no auth" in 4.20?
Hello Michael, the order of installation is irrelevant, I just posted it to get one point across: you need both samba-ad-provision and samba-dsdb-modules on a member server to do the online backup. With 4.19 both package were installed as dependency of the standard "samba" package. With 4.20.2 the split into "samba" (fileserver) and "samba-ad-dc" happened and these packages got removed from deps from the fileserver - hence I uninstalled them on all my fileservers. That was my understanding ... but looking at samba 2:4.19.7+dfsg-1~mjt-deb12 ... "samba-vfs-modules, samba-ad-provision" are only in the recommends section, not in depends. They were not manually installed (so should be marked auto installed and show be shown as autoremovable). But with "apt autoremove" 0 packages are presented to me? Running apt remove shows me that they are not a dependency of another package?? So they're not depended on by other packages, werent installed manually but wont be removed by autoremove? How is that possible? Thanks for your help! Am 28.06.24 um 07:31 schrieb Michael Tokarev via samba:> On 6/28/24 08:22, Matthias K?hne | Ellerhold Aktiengesellschaft via > samba wrote: >> Hey Luis & Rowland, >> >> this put me on the right track. Ive never had this error (please install >> samba-ad-provision). >> >> First I upgraded to the newest samba version (2:4.20.2+dfsg-2~mjt-deb12 >> to 2:4.20.2+dfsg-4~mjt-deb12). No change. >> >> Then Ive installed samba-ad-provision. No change. >> >> Then I installed samba-dsdb-modules. Now it works!! >> >> Then I uninstalled samba-ad-provision. Now Im getting your error message >> ("Please install samba-ad-provision"). >> >> So from 4.20.2 onwards you need samba-ad-provision AND >> samba-dsdb-modules on a Debian 12 member server. >> >> 4.20.1 did not have the split I think so thats why Rowlands backup works >> atm. > > 4.20.1 in debian (and hence on my repository) has exactly the same > samba-dsdb-modules > and samba-ad-provision packages as current 4.20.2. > > dsdb-modules has been separate package for many years. > samba-ad-provision created in 4.17.3+dfsg-4, it's been quite some time > too. > > The only noticeable recent change was the move of some stuff > from samba to samba-ad-dc (dc-only-related) or to python3-samba > (samba-tool) > in 4.20.1+dfsg-2 which is the version Rowland seems to be using too. > > So I'm a bit confused here. > > *Especially* the order of installation you mentioned - it should not > matter at all. > > I'll take a closer look what's going on here. > > On the other hand, I dodn't expect domain-level operations to work on > a regular member server, to begin with. > > Thanks, > > /mjt >-- Senior Webentwickler Datenschutzbeauftragter Ellerhold Aktiengesellschaft Friedrich-List-Str. 4 01445 Radebeul Telefon: +49 (0) 351 83933-61 Web: www.ellerhold.de Facebook: www.facebook.com/ellerhold.gruppe Instagram: www.instagram.com/ellerhold.gruppe LinkedIn: www.linkedin.com/company/ellerhold-gruppe Amtsgericht Dresden / HRB 23769 Vorstand: Stephan Ellerhold, Maximilian Ellerhold Vorsitzender des Aufsichtsrates: Frank Ellerhold ---Diese E-Mail und Ihre Anlagen enthalten vertrauliche Mitteilungen. Sollten Sie nicht der beabsichtigte Adressat sein, so bitten wir Sie um Mitteilung und um sofortiges l?schen dieser E-Mail und der Anlagen. Unsere Hinweise zum Datenschutz finden Sie hier: http://www.ellerhold.de/datenschutz/ This e-mail and its attachments are privileged and confidential. If you are not the intended recipient, please notify us and immediately delete this e-mail and its attachments. You can find our privacy policy here: http://www.ellerhold.de/datenschutz/
Michael Tokarev
2024-Jun-28 06:50 UTC
[Samba] Online AD Backup fails with "no auth" in 4.20?
On 6/28/24 08:41, Matthias K?hne | Ellerhold Aktiengesellschaft via samba wrote:> Hello Michael, > > the order of installation is irrelevant, I just posted it to get one > point across: you need both samba-ad-provision and samba-dsdb-modules on > a member server to do the online backup. > > With 4.19 both package were installed as dependency of the standard > "samba" package. With 4.20.2 the split into "samba" (fileserver) and > "samba-ad-dc" happened and these packages got removed from deps from the > fileserver - hence I uninstalled them on all my fileservers.Aha. This makes perfect sense. I haven't realized you removed packages which were previously installed. That's when it actually "stopped working". And that's also where I was confused by the order of actions. Thank you, things are clear now.> That was my understanding ... but looking at samba > 2:4.19.7+dfsg-1~mjt-deb12 ... "samba-vfs-modules, samba-ad-provision" > are only in the recommends section, not in depends. They were not > manually installed (so should be marked auto installed and show be shown > as autoremovable). But with "apt autoremove" 0 packages are presented to > me? Running apt remove shows me that they are not a dependency of > another package?? > > So they're not depended on by other packages, werent installed manually > but wont be removed by autoremove? How is that possible?This is exactly how Recommends and Suggests package control fields work in Debian (the difference between the two is that Recommends are installed by default but Suggests are not). If a package is auto-installed, it isn't a subject for auto-removal as long as it is listed in at least one Recommends or Suggests (or, obviously, Depends) of other packages. It only becomes subject for auto-removal if it is not referenced by any other installed package. samba-dsdb-modules and samba-ad-provision are both dependencies of samba-ad-dc in Debian currently. Neither of them is recommended or suggested by other samba packages. samba-ad-provision is only recommended by samba-ad-dc now, it is not a dependency (so once the domain is set up, this package can be removed - and as we learned in this thread, such removal will break domain backup). samba-dsdb-modules is used for auth within domain, - it would be interesting to see which modules are actually required in this context (I'll take a look later). Thanks, /mjt -- GPG Key transition (from rsa2048 to rsa4096) since 2024-04-24. New key: rsa4096/61AD3D98ECDF2C8E 9D8B E14E 3F2A 9DD7 9199 28F1 61AD 3D98 ECDF 2C8E Old key: rsa2048/457CE0A0804465C5 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 Transition statement: http://www.corpit.ru/mjt/gpg-transition-2024.txt