Samba Backup Troubleshooting

Hallo,

nach dem Aufsetzen und einigen Tests, gibt es Probleme mit dem Backup auf einem Domaincontroller.
Domäne : my.domain
DC01 (192.168.50.11) via Cron Job

zieht dc02.smb.conf
zieht dc02 backup mit --configfile <smb.conf.loc.dc02>

DC02 (10.0.1.9) via Cron Job

Sysvol Replication via rsync
zieht dc01 smb.conf
zieht dc01 backup mit --configfile <smb.conf.loc.dc01>

Backup Script auf dc02

#!/bin/sh
samba-tool domain backup online \
    --server=dc01.my.domain \
    --configfile=/mnt/backups/dc01/smb.conf.dc01 \
    --realm=MY.DOMAIN \
    --username=administrator@MY.DOMAIN \
    --targetdir=/mnt/backups/dc01/

Ein Auszug des Procederes:

administrator@dc02:/usr/local/bin$ sudo ./samba-db-dc01.sh
GENSEC backend 'gssapi_spnego' registered  
GENSEC backend 'gssapi_krb5' registered  
GENSEC backend 'gssapi_krb5_sasl' registered  
GENSEC backend 'spnego' registered  
GENSEC backend 'schannel' registered  
GENSEC backend 'naclrpc_as_system' registered  
GENSEC backend 'sasl-EXTERNAL' registered  
GENSEC backend 'ntlmssp' registered  
GENSEC backend 'ntlmssp_resume_ccache' registered  
GENSEC backend 'http_basic' registered  
GENSEC backend 'http_ntlm' registered  
GENSEC backend 'http_negotiate' registered  
GENSEC backend 'krb5' registered  
GENSEC backend 'fake_gssapi_krb5' registered  
resolve_lmhosts: Attempting lmhosts lookup for name dc01.my.domain<0x20>
resolve_lmhosts: Attempting lmhosts lookup for name dc01.my.domain<0x20>
Password for [administrator@my.domain]:
INFO 2022-05-02 15:39:52,649 pid:48527 /usr/lib/python3/dist-packages/samba/join.py #1575: workgroup is my
INFO 2022-05-02 15:39:52,650 pid:48527 /usr/lib/python3/dist-packages/samba/join.py #1578: realm is my.domain
Calling bare provision
lpcfg_load: refreshing parameters from /mnt/backups/dc01/tmplx7rxds9/etc/smb.conf
lpcfg_load: refreshing parameters from /mnt/backups/dc01/tmplx7rxds9/etc/smb.conf
INFO 2022-05-02 15:39:52,656 pid:48527 /usr/lib/python3/dist-packages/samba/provision/__init__.py #2122: Looking up IPv4 addresses
INFO 2022-05-02 15:39:52,657 pid:48527 /usr/lib/python3/dist-packages/samba/provision/__init__.py #2139: Looking up IPv6 addresses
WARNING 2022-05-02 15:39:52,657 pid:48527 /usr/lib/python3/dist-packages/samba/provision/__init__.py #2146: No IPv6 address will be assigned
INFO 2022-05-02 15:39:52,895 pid:48527 /usr/lib/python3/dist-packages/samba/provision/__init__.py #2290: Setting up share.ldb
INFO 2022-05-02 15:39:52,922 pid:48527 /usr/lib/python3/dist-packages/samba/provision/__init__.py #2294: Setting up secrets.ldb
INFO 2022-05-02 15:39:52,942 pid:48527 /usr/lib/python3/dist-packages/samba/provision/__init__.py #2299: Setting up the registry
ldb_wrap open of hklm.ldb
Key 'key=SOFTWARE,hive=NONE' not found  
key added: key=SOFTWARE,hive=NONE
Key 'key=Microsoft,key=SOFTWARE,hive=NONE' not found  
key added: key=Microsoft,key=SOFTWARE,hive=NONE
Key 'key=Windows NT,key=Microsoft,key=SOFTWARE,hive=NONE' not found  
key added: key=Windows NT,key=Microsoft,key=SOFTWARE,hive=NONE
Key 'key=CurrentVersion,key=Windows NT,key=Microsoft,key=SOFTWARE,hive=NONE' not found  
key added: key=CurrentVersion,key=Windows NT,key=Microsoft,key=SOFTWARE,hive=NONE
Key 'key=SYSTEM,hive=NONE' not found  
key added: key=SYSTEM,hive=NONE
Key 'key=CurrentControlSet,key=SYSTEM,hive=NONE' not found  
key added: key=CurrentControlSet,key=SYSTEM,hive=NONE
Key 'key=Control,key=CurrentControlSet,key=SYSTEM,hive=NONE' not found  
key added: key=Control,key=CurrentControlSet,key=SYSTEM,hive=NONE
Key 'key=ProductOptions,key=Control,key=CurrentControlSet,key=SYSTEM,hive=NONE' not found  
key added: key=ProductOptions,key=Control,key=CurrentControlSet,key=SYSTEM,hive=NONE
Key 'key=Print,key=Control,key=CurrentControlSet,key=SYSTEM,hive=NONE' not found  
key added: key=Print,key=Control,key=CurrentControlSet,key=SYSTEM,hive=NONE
Key 'key=Terminal Server,key=Control,key=CurrentControlSet,key=SYSTEM,hive=NONE' not found  
key added: key=Terminal Server,key=Control,key=CurrentControlSet,key=SYSTEM,hive=NONE
Key 'key=Services,key=CurrentControlSet,key=SYSTEM,hive=NONE' not found  
key added: key=Services,key=CurrentControlSet,key=SYSTEM,hive=NONE
Key 'key=Netlogon,key=Services,key=CurrentControlSet,key=SYSTEM,hive=NONE' not found  
key added: key=Netlogon,key=Services,key=CurrentControlSet,key=SYSTEM,hive=NONE
Key 'key=Parameters,key=Netlogon,key=Services,key=CurrentControlSet,key=SYSTEM,hive=NONE' not found  
key added: key=Parameters,key=Netlogon,key=Services,key=CurrentControlSet,key=SYSTEM,hive=NONE
Key 'key=Alerter,key=Services,key=CurrentControlSet,key=SYSTEM,hive=NONE' not found  
key added: key=Alerter,key=Services,key=CurrentControlSet,key=SYSTEM,hive=NONE
Key 'key=Parameters,key=Alerter,key=Services,key=CurrentControlSet,key=SYSTEM,hive=NONE' not found  
key added: key=Parameters,key=Alerter,key=Services,key=CurrentControlSet,key=SYSTEM,hive=NONE
INFO 2022-05-02 15:39:53,020 pid:48527 /usr/lib/python3/dist-packages/samba/provision/__init__.py #2302: Setting up the privileges database
INFO 2022-05-02 15:39:53,062 pid:48527 /usr/lib/python3/dist-packages/samba/provision/__init__.py #2305: Setting up idmap db
INFO 2022-05-02 15:39:53,090 pid:48527 /usr/lib/python3/dist-packages/samba/provision/__init__.py #2312: Setting up SAM db
INFO 2022-05-02 15:39:53,098 pid:48527 /usr/lib/python3/dist-packages/samba/provision/__init__.py #897: Setting up sam.ldb partitions and settings
INFO 2022-05-02 15:39:53,098 pid:48527 /usr/lib/python3/dist-packages/samba/provision/__init__.py #909: Setting up sam.ldb rootDSE
INFO 2022-05-02 15:39:53,103 pid:48527 /usr/lib/python3/dist-packages/samba/provision/__init__.py #1322: Pre-loading the Samba 4 and AD schema
partition_metadata: Migrating partition metadata: open of metadata.tdb gave: No such Base DN: @INDEXLIST
Unable to determine the DomainSID, can not enforce uniqueness constraint on local domainSIDs

INFO 2022-05-02 15:39:53,139 pid:48527 /usr/lib/python3/dist-packages/samba/provision/__init__.py #2364: A Kerberos configuration suitable for Samba AD has been generated at /mnt/backups/dc01/tmplx7rxds9/private/krb5.conf
INFO 2022-05-02 15:39:53,139 pid:48527 /usr/lib/python3/dist-packages/samba/provision/__init__.py #2366: Merge the contents of this file with your system krb5.conf or replace it with this one. Do not create a symlink!
Provision OK for domain DN DC=my,DC=domain
Starting replication
Using DS_BIND_GUID_W2K3
Using binding ncacn_ip_tcp:dc01.my.domain[,seal]
resolve_lmhosts: Attempting lmhosts lookup for name dc01.my.domain<0x20>
resolve_lmhosts: Attempting lmhosts lookup for name dc01.my.domain<0x20>
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain] objects[402/1739] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain] objects[804/1739] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain] objects[1206/1739] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain] objects[1608/1739] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=my,DC=domain] objects[1739/1739] linked_values[0/0]
Analyze and apply schema objects
Replicated 1739 objects (0 linked attributes) for CN=Schema,CN=Configuration,DC=my,DC=domain
Partition[CN=Configuration,DC=my,DC=domain] objects[402/1633] linked_values[0/0]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain
Partition[CN=Configuration,DC=my,DC=domain] objects[804/1633] linked_values[0/0]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain
Partition[CN=Configuration,DC=my,DC=domain] objects[1206/1633] linked_values[0/0]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain
Partition[CN=Configuration,DC=my,DC=domain] objects[1608/1633] linked_values[0/0]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain
Partition[CN=Configuration,DC=my,DC=domain] objects[1633/1633] linked_values[36/36]
Missing target while attempting to apply records: Deleted target CN=NTDS Settings\0ADEL:f2c595f2-3658-4be8-b088-2cab0cc4ad6a,CN=dc02\0ADEL:53526794-513d-4979-a472-c44f6be8bd0f,CN=Servers,CN=Gross-Gerau,CN=Sites,CN=Configuration,DC=my,DC=domain GUID f2c595f2-3658-4be8-b088-2cab0cc4ad6a linked from CN=eae38574-1f35-468b-8ffe-87a1ae6e9c74,CN=Partitions,CN=Configuration,DC=my,DC=domain

Failed to commit objects: DOS code 0x000021bf
Missing target object - retrying with DRS_GET_TGT
Partition[CN=Configuration,DC=my,DC=domain] objects[2035/1633] linked_values[36/0]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain
Partition[CN=Configuration,DC=my,DC=domain] objects[2437/1633] linked_values[36/0]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain
Partition[CN=Configuration,DC=my,DC=domain] objects[2839/1633] linked_values[36/0]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain
Partition[CN=Configuration,DC=my,DC=domain] objects[3241/1633] linked_values[36/0]
Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=my,DC=domain
Partition[CN=Configuration,DC=my,DC=domain] objects[3266/1633] linked_values[72/36]
Replicated 25 objects (36 linked attributes) for CN=Configuration,DC=my,DC=domain
Replicating critical objects from the base DN of the domain
Partition[DC=my,DC=domain] objects[98/97] linked_values[24/24]
Replicated 98 objects (24 linked attributes) for DC=my,DC=domain
Partition[DC=my,DC=domain] objects[388/388] linked_values[27/27]
Replicated 388 objects (27 linked attributes) for DC=my,DC=domain
Done with always replicated NC (base, config, schema)
Replicating DC=DomainDnsZones,DC=my,DC=domain
Partition[DC=DomainDnsZones,DC=my,DC=domain] objects[75/75] linked_values[0/0]
Replicated 75 objects (0 linked attributes) for DC=DomainDnsZones,DC=my,DC=domain
Replicating DC=ForestDnsZones,DC=my,DC=domain
Partition[DC=ForestDnsZones,DC=my,DC=domain] objects[26/26] linked_values[0/0]
Replicated 26 objects (0 linked attributes) for DC=ForestDnsZones,DC=my,DC=domain
Committing SAM database
replmd_prepare_commit: Processing linked attributes
Discarding older DRS linked attribute update to msDS-NC-Replica-Locations on CN=eae38574-1f35-468b-8ffe-87a1ae6e9c74,CN=Partitions,CN=Configuration,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to msDS-NC-Replica-Locations on CN=eae38574-1f35-468b-8ffe-87a1ae6e9c74,CN=Partitions,CN=Configuration,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
replmd_allow_missing_target: CN=NTDS Settings\0ADEL:f2c595f2-3658-4be8-b088-2cab0cc4ad6a,CN=dc02\0ADEL:53526794-513d-4979-a472-c44f6be8bd0f,CN=Servers,CN=Gross-Gerau,CN=Sites,CN=Configuration,DC=my,DC=domain is Deleted but up to date. Ignoring link from CN=eae38574-1f35-468b-8ffe-87a1ae6e9c74,CN=Partitions,CN=Configuration,DC=my,DC=domain
replmd_allow_missing_target: CN=NTDS Settings\0ADEL:f2c595f2-3658-4be8-b088-2cab0cc4ad6a,CN=dc02\0ADEL:53526794-513d-4979-a472-c44f6be8bd0f,CN=Servers,CN=Gross-Gerau,CN=Sites,CN=Configuration,DC=my,DC=domain is Deleted but up to date. Ignoring link from CN=f2cc8b1b-5761-447c-b3b0-c4eba0975e3c,CN=Partitions,CN=Configuration,DC=my,DC=domain
Discarding older DRS linked attribute update to member on CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=IIS_IUSRS,CN=Builtin,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Schema Admins,CN=Users,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Administrators,CN=Builtin,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Administrators,CN=Builtin,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Administrators,CN=Builtin,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Administrators,CN=Builtin,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Enterprise Admins,CN=Users,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Domain Admins,CN=Users,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Guests,CN=Builtin,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Guests,CN=Builtin,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Denied RODC Password Replication Group,CN=Users,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Denied RODC Password Replication Group,CN=Users,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Denied RODC Password Replication Group,CN=Users,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Denied RODC Password Replication Group,CN=Users,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Denied RODC Password Replication Group,CN=Users,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Denied RODC Password Replication Group,CN=Users,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Denied RODC Password Replication Group,CN=Users,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Denied RODC Password Replication Group,CN=Users,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Group Policy Creator Owners,CN=Users,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Users,CN=Builtin,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Users,CN=Builtin,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Users,CN=Builtin,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Discarding older DRS linked attribute update to member on CN=Windows Authorization Access Group,CN=Builtin,DC=my,DC=domain from 4acdfe5f-21fc-44cb-92df-e2ce461b2594
Repacking database from v1 to v2 format (first record CN=ms-DS-Failed-Interactive-Logon-Count-At-Last-Successful-Logon,CN=Schema,CN=Configuration,DC=my,DC=domain)
Repack: re-packed 10000 records so far
Repacking database from v1 to v2 format (first record CN=siteLink-Display,CN=404,CN=DisplaySpecifiers,CN=Configuration,DC=my,DC=domain)
Repacking database from v1 to v2 format (first record DC=_gc._tcp.Darmstadt._sites,DC=my.domain,CN=MicrosoftDNS,DC=DomainDnsZones,DC=my,DC=domain)
Repacking database from v1 to v2 format (first record DC=_ldap._tcp.pdc,DC=_msdcs.my.domain,CN=MicrosoftDNS,DC=ForestDnsZones,DC=my,DC=domain)
Repacking database from v1 to v2 format (first record CN=6ada9ff7-c9df-45c1-908e-9fef2fab008a,CN=Operations,CN=DomainUpdates,CN=System,DC=my,DC=domain)
INFO 2022-05-02 15:41:08,163 pid:48527 /usr/lib/python3/dist-packages/samba/join.py #1616: Setting isSynchronized and dsServiceName
INFO 2022-05-02 15:41:08,177 pid:48527 /usr/lib/python3/dist-packages/samba/join.py #1581: Cloned domain my (SID S-1-5-21-3270324153-1113196140-426135491)
resolve_lmhosts: Attempting lmhosts lookup for name dc01.my.domain<0x20>
INFO 2022-05-02 15:41:08,710 pid:48527 /usr/lib/python3/dist-packages/samba/netcmd/domain_backup.py #269: Backing up sysvol files (via SMB)...
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[global]"  
Processing section "[sysvol]"  
Processing section "[netlogon]"  
Processing section "[1]"  
Processing section "[o]"  
Processing section "[p]"  
Processing section "[U]"  
Processing section "[C]"  
Processing section ""  
resolve_hosts: Attempting host lookup for name dc01.my.domain<0x20>
Connecting to 192.168.50.11 at port 445
convert_string_handle: E2BIG: convert_string(UTF-8,CP850): srclen=18 destlen=16 error: No more room
Connecting to 192.168.50.11 at port 139
ERROR(runtime): uncaught exception - (3221225653, '{Device Timeout} The specified I/O operation on %hs was not completed before the time-out period expired.')  
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 186, in _run  
    return self.run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/samba/netcmd/domain_backup.py", line 272, in run  
    backup_online(smb_conn, sysvol_tar, remote_sam.get_domain_sid())
  File "/usr/lib/python3/dist-packages/samba/ntacls.py", line 522, in backup_online  
    data = smb_helper.loadfile(r_name)
  File "/usr/lib/python3/dist-packages/samba/ntacls.py", line 369, in loadfile  
    return self.smb_conn.loadfile(smb_path)

Es erschließt sich mir nicht wo der Fehler liegt. Die Smb.conf ist korrekt, dbcheck, drs replikation, alles erfolgreich. DC01 kann sich alles ziehen. DC02 kriegt die Smb.conf von DC01, scheitert aber wie oben zu sehen am DB Backup. Fehlt hier ggf. die idmap DB auf dc02 ?

Hat hier jemand eine Idee?

Gruß

OpSec

Bitte markiere auch die Kommentare, die zur Lösung des Beitrags beigetragen haben

Content-ID: 2666893533

Url: https://administrator.de/forum/samba-backup-troubleshooting-2666893533.html

Ausgedruckt am: 22.12.2024 um 11:12 Uhr

5 Kommentare

Neuester Kommentar

https://lists.samba.org/archive/samba/2018-July/216824.html
Gleicher Fehler und war am Ende ein Firewall Blocking. Bei dir scheitert ja die Erreichbarkeit von 192.168.50.11 auf Port 139 ebenso.
Oder andere Option: zu kurze RPC Timeout Zeiten: https://forge.univention.org/bugzilla/show_bug.cgi?id=41021
Gibt diverse Posts zu dem Fehler.

Zitat von @aqui:

https://lists.samba.org/archive/samba/2018-July/216824.html
Gleicher Fehler und war am Ende ein Firewall Blocking. Bei dir scheitert ja die Erreichbarkeit von 192.168.50.11 auf Port 139 ebenso.
Oder andere Option: zu kurze RPC Timeout Zeiten: https://forge.univention.org/bugzilla/show_bug.cgi?id=41021
Gibt diverse Posts zu dem Fehler.

Hallo,

und Danke. Ein Firewall Blocking vernachlässige ich, da ein Telnet auf diesem Port visca versa durch geht. Das mit den Timeout Zeiten wäre ziemlich merkwürdig, da die Backups bis dato ohne Probleme liefen. Das probiere ich direkt aus.

Gruß

OpSec

da ein Telnet auf diesem Port visca versa durch geht.

Telnet ist Port TCP 23 was nicht der RPC Port ist, aber nundenn...du kennst deine Firewall und ihre Regeln sicher weitaus besser als wir.

Hallo,

Zitat von @aqui:

da ein Telnet auf diesem Port visca versa durch geht.

Telnet ist Port TCP 23 was nicht der RPC Port ist, aber nundenn...du kennst deine Firewall und ihre Regeln sicher weitaus besser als wir.

Okay also die ufw war grundlegend inactive ich habe die 139 an der es hapert auf beiden dcs freigegeben. Die Verbindung zwischen den Subnetzen 192.168.50.0/24 und 10.0.1.0/24 erfolgt über einen Site2Site VPN. Es sind keine Regeln definiert. Mittlerweile habe ich den DC2 frisch aufgesetzt und rejoined. Das Provisioning ging durch, allerdings stockt die Replikation der Attribute nach DC02. Ich probiere weiter.

Gruß

OpSec