search for: encrypted_secret

...from v 4.6x and the > > secrets database was not encrypted (as far as I know). I decided to downgrade > > one of the samba DCs to v 4.7.4. > > > > On re-starting samba after the downgrade the log shows: > > > > ldb: unable to dlopen /usr/local/samba/lib/ldb/encrypted_secrets.so : > > /usr/local/samba/lib/private/libdsdb-module-samba4.so: version `SAMBA_4.8.0RC2' > > not found (required by /usr/local/samba/lib/ldb/encrypted_secrets.so) > > when you are doing your downgrade, did you clean up all the > /usr/local/samba directory or did you make...

...indows Server 2008R2 DC. The samba DCs had been upgraded from v 4.6x and the secrets database was not encrypted (as far as I know). I decided to downgrade one of the samba DCs to v 4.7.4. On re-starting samba after the downgrade the log shows: ldb: unable to dlopen /usr/local/samba/lib/ldb/encrypted_secrets.so : /usr/local/samba/lib/private/libdsdb-module-samba4.so: version `SAMBA_4.8.0RC2' not found (required by /usr/local/samba/lib/ldb/encrypted_secrets.so) and the samba daemons are left in a failed state. So I removed this failed DC (dc1) from the domain, using the (working) 4.8.0rc2 samba m...

...e samba DCs had been upgraded > from v 4.6x and the secrets database was not encrypted (as far as I > know). I decided to downgrade one of the samba DCs to v 4.7.4. > > On re-starting samba after the downgrade the log shows: > > ldb: unable to dlopen /usr/local/samba/lib/ldb/encrypted_secrets.so : > /usr/local/samba/lib/private/libdsdb-module-samba4.so: version > `SAMBA_4.8.0RC2' not found (required > by /usr/local/samba/lib/ldb/encrypted_secrets.so) > > and the samba daemons are left in a failed state. > > So I removed this failed DC (dc1) from the domain, u...

...100508}} ldb: unable to open modules directory '/usr/local/samba/lib/ldb' - Too many open files ldb: unable to open modules directory '/usr/local/samba/lib/ldb' - Too many open files [2023/04/10 10:02:25.524087,? 0] ../../lib/ldb-samba/ldb_wrap.c:79(ldb_wrap_debug) ? ldb: module encrypted_secrets initialization failed : Operations error [2023/04/10 10:02:25.524160,? 0] ../../lib/ldb-samba/ldb_wrap.c:79(ldb_wrap_debug) ? ldb: module group_audit_log initialization failed : Operations error [2023/04/10 10:02:25.524203,? 0] ../../lib/ldb-samba/ldb_wrap.c:79(ldb_wrap_debug) ? ldb: module re...

...The samba DCs had been upgraded from v 4.6x and the > secrets database was not encrypted (as far as I know). I decided to downgrade > one of the samba DCs to v 4.7.4. > > On re-starting samba after the downgrade the log shows: > > ldb: unable to dlopen /usr/local/samba/lib/ldb/encrypted_secrets.so : > /usr/local/samba/lib/private/libdsdb-module-samba4.so: version `SAMBA_4.8.0RC2' > not found (required by /usr/local/samba/lib/ldb/encrypted_secrets.so) when you are doing your downgrade, did you clean up all the /usr/local/samba directory or did you make && make install...

...ldb/extended_dn_out.so(+0x2a83) [0x7f1cd4602a83] #10 /usr/lib64/samba/libldb.so.2(ldb_next_request+0x3da) [0x7f1cefc02238] #11 /usr/lib64/samba/ldb/operational.so(+0x5bb4) [0x7f1cd1d86bb4] #12 /usr/lib64/samba/libldb.so.2(ldb_next_request+0x3da) [0x7f1cefc02238] #13 /usr/lib64/samba/ldb/encrypted_secrets.so(+0x2c5b) [0x7f1cd4a0cc5b] #14 /usr/lib64/samba/libldb.so.2(ldb_next_request+0x3da) [0x7f1cefc02238] #15 /usr/lib64/samba/ldb/rdn_name.so(+0x15f1) [0x7f1cd0d0c5f1] #16 /usr/lib64/samba/libldb.so.2(ldb_next_request+0x3da) [0x7f1cefc02238] #17 /usr/lib64/samba/ldb/aclread.so(+0x23e5) [...

.../ldb/ranged_results.so(+0x15dc) [0x7f3ddfab65dc] #8 /usr/lib64/samba/libldb.so.1(ldb_module_send_entry+0x144) [0x7f3dfd9497dc] #9 /usr/lib64/samba/ldb/acl.so(+0x74ed) [0x7f3de43f14ed] #10 /usr/lib64/samba/libldb.so.1(ldb_module_send_entry+0x144) [0x7f3dfd9497dc] #11 /usr/lib64/samba/ldb/encrypted_secrets.so(+0x3cc6) [0x7f3de31aacc6] #12 /usr/lib64/samba/libldb.so.1(ldb_module_send_entry+0x144) [0x7f3dfd9497dc] #13 /usr/lib64/samba/ldb/operational.so(+0x3a5b) [0x7f3de092aa5b] #14 /usr/lib64/samba/libldb.so.1(ldb_module_send_entry+0x144) [0x7f3dfd9497dc] #15 /usr/lib64/samba/ldb/extended...

..., an in-place upgrade will not encrypt the database. Once encrypted, it is not possible to do an in-place downgrade (eg to 4.7) of the database. To obtain an unencrypted copy of the database a new DC join should be performed, specifying the '--plaintext-secrets' option. The key file "encrypted_secrets.key" is created in the same directory as the database and should NEVER be disclosed. It is included by the samba_backup script. Active Directory replication visualisation ------------------------------------------ To work out what is happening in a replication graph, it is sometimes helpfu...

..., an in-place upgrade will not encrypt the database. Once encrypted, it is not possible to do an in-place downgrade (eg to 4.7) of the database. To obtain an unencrypted copy of the database a new DC join should be performed, specifying the '--plaintext-secrets' option. The key file "encrypted_secrets.key" is created in the same directory as the database and should NEVER be disclosed. It is included by the samba_backup script. Active Directory replication visualisation ------------------------------------------ To work out what is happening in a replication graph, it is sometimes helpfu...

...le to dlopen /usr/lib/x86_64-linux-gnu/samba/ldb/dsdb_notification.so : /usr/lib/x86_64-linux-gnu/samba/libdsdb-module.so.0: version `SAMBA_4.11.14_DEBIAN' not found (required by /usr/lib/x86_64-linux-gnu/samba/ldb/dsdb_notification.so) ldb: unable to dlopen /usr/lib/x86_64-linux-gnu/samba/ldb/encrypted_secrets.so : /usr/lib/x86_64-linux-gnu/samba/libreplace.so.0: version `SAMBA_4.11.14_DEBIAN' not found (required by /usr/lib/x86_64-linux-gnu/samba/ldb/encrypted_secrets.so) ldb: unable to dlopen /usr/lib/x86_64-linux-gnu/samba/ldb/extended_dn_in.so : /usr/lib/x86_64-linux-gnu/samba/libsamdb-common.s...

...to all the team for the work on this. On 1 March 2018 at 20:26, Karolin Seeger via samba <samba at lists.samba.org> wrote: > [...] > > Encrypted secrets > ----------------- > > Attributes deemed to be sensitive are now encrypted on disk. > [...] > The key file "encrypted_secrets.key" is created in the same directory > as the database and should NEVER be disclosed. It is included by the > samba_backup script. > Can I ask (genuine question) - what is the gain from encrypting the secrets, but also keeping the key in the same directory? I am all for encryptin...

...) > >>> [0x7f3dfd9497dc] > >>> #9 /usr/lib64/samba/ldb/acl.so(+0x74ed) [0x7f3de43f14ed] > >>> #10 > >>> /usr/lib64/samba/libldb.so.1(ldb_module_send_entry+0x144) > >>> [0x7f3dfd9497dc] > >>> #11 /usr/lib64/samba/ldb/encrypted_secrets.so(+0x3cc6) > >>> [0x7f3de31aacc6] > >>> #12 > >>> /usr/lib64/samba/libldb.so.1(ldb_module_send_entry+0x144) > >>> [0x7f3dfd9497dc] > >>> #13 /usr/lib64/samba/ldb/operational.so(+0x3a5b) > [0x7f3de092aa5b] > >>>...

...samba.org> * BUG 13465: examples: Fix the smb2mount build. * BUG 13629: libtevent: Fix build due to missing open_memstream on Illiumos. * BUG 13662: winbindd_cache: Fix timeout calculation for sid<->name cache. o Gary Lockyer <gary at catalyst.net.nz> * BUG 13653: dsdb encrypted_secrets: Allow "ldb:// and "mdb://" in file path. o Stefan Metzmacher <metze at samba.org> * BUG 13418: Extended DN SID component missing for member after switching group membership. * BUG 13624: Return STATUS_SESSION_EXPIRED error encrypted, if the request was encry...

...samba.org> * BUG 13465: examples: Fix the smb2mount build. * BUG 13629: libtevent: Fix build due to missing open_memstream on Illiumos. * BUG 13662: winbindd_cache: Fix timeout calculation for sid<->name cache. o Gary Lockyer <gary at catalyst.net.nz> * BUG 13653: dsdb encrypted_secrets: Allow "ldb:// and "mdb://" in file path. o Stefan Metzmacher <metze at samba.org> * BUG 13418: Extended DN SID component missing for member after switching group membership. * BUG 13624: Return STATUS_SESSION_EXPIRED error encrypted, if the request was encry...

...ation failed : Operations error module extended_dn_out_ldb initialization failed : Operations error module linked_attributes initialization failed : Operations error module unique_object_sids initialization failed : Operations error module operational initialization failed : Operations error module encrypted_secrets initialization failed : Operations error module group_audit_log initialization failed : Operations error module repl_meta_data initialization failed : Operations error module subtree_delete initialization failed : Operations error module aclread initialization failed : Operations error module acl...

...+0x482) [0x7fda74b80eb0] Jul 24 16:39:20 dc1 samba[29071]: #26 /usr/lib64/samba/ldb/extended_dn_in.so(+0x2755) [0x7fda5a1da755] Jul 24 16:39:20 dc1 samba[29071]: #27 /usr/lib64/samba/libldb.so.1(ldb_module_done+0x144) [0x7fda74b80a25] Jul 24 16:39:20 dc1 samba[29071]: #28 /usr/lib64/samba/ldb/encrypted_secrets.so(+0x3cfb) [0x7fda5a3e1cfb] Jul 24 16:39:20 dc1 samba[29071]: #29 /usr/lib64/samba/libldb.so.1(ldb_module_done+0x144) [0x7fda74b80a25] Jul 24 16:39:20 dc1 samba[29071]: #30 /usr/lib64/samba/ldb/operational.so(+0x3a2e) [0x7fda57b61a2e] Jul 24 16:39:20 dc1 samba[29071]: #31 /usr/lib64/samba/l...

...ation failed : Operations error module extended_dn_out_ldb initialization failed : Operations error module linked_attributes initialization failed : Operations error module unique_object_sids initialization failed : Operations error module operational initialization failed : Operations error module encrypted_secrets initialization failed : Operations error module group_audit_log initialization failed : Operations error module repl_meta_data initialization failed : Operations error module subtree_delete initialization failed : Operations error module aclread initialization failed : Operations error module acl...

...64/samba/libldb.so.1(ldb_module_send_entry+0x144) > > [0x7f3dfd9497dc] > > #9 /usr/lib64/samba/ldb/acl.so(+0x74ed) [0x7f3de43f14ed] > > #10 > > /usr/lib64/samba/libldb.so.1(ldb_module_send_entry+0x144) > > [0x7f3dfd9497dc] > > #11 /usr/lib64/samba/ldb/encrypted_secrets.so(+0x3cc6) > > [0x7f3de31aacc6] > > #12 > > /usr/lib64/samba/libldb.so.1(ldb_module_send_entry+0x144) > > [0x7f3dfd9497dc] > > #13 /usr/lib64/samba/ldb/operational.so(+0x3a5b) [0x7f3de092aa5b] > > #14 > > /usr/lib64/samba/libldb.so.1(ldb_modu...

...Jul 24 16:39:20 dc1 samba[29071]: #26 > /usr/lib64/samba/ldb/extended_dn_in.so(+0x2755) [0x7fda5a1da755] > Jul 24 16:39:20 dc1 samba[29071]: #27 > /usr/lib64/samba/libldb.so.1(ldb_module_done+0x144) [0x7fda74b80a25] > Jul 24 16:39:20 dc1 samba[29071]: #28 > /usr/lib64/samba/ldb/encrypted_secrets.so(+0x3cfb) [0x7fda5a3e1cfb] > Jul 24 16:39:20 dc1 samba[29071]: #29 > /usr/lib64/samba/libldb.so.1(ldb_module_done+0x144) [0x7fda74b80a25] > Jul 24 16:39:20 dc1 samba[29071]: #30 > /usr/lib64/samba/ldb/operational.so(+0x3a2e) [0x7fda57b61a2e] > Jul 24 16:39:20 dc1 samba[29071]:...

...;> [0x7f3dfd9497dc] >>>>> #9 /usr/lib64/samba/ldb/acl.so(+0x74ed) [0x7f3de43f14ed] >>>>> #10 >>>>> /usr/lib64/samba/libldb.so.1(ldb_module_send_entry+0x144) >>>>> [0x7f3dfd9497dc] >>>>> #11 /usr/lib64/samba/ldb/encrypted_secrets.so(+0x3cc6) >>>>> [0x7f3de31aacc6] >>>>> #12 >>>>> /usr/lib64/samba/libldb.so.1(ldb_module_send_entry+0x144) >>>>> [0x7f3dfd9497dc] >>>>> #13 /usr/lib64/samba/ldb/operational.so(+0x3a5b) >> [0x7f3de092aa5b]...