Bind9 and samba4 services do not start after upgrade from UCS 4.4.8 / 1118 to 5.0.0

UCS - Univention Corporate Server
,
#1

Hello,
I have a problem after UCS Upgrade from 4.4.8 errata 1118 to UCS 5.
I have two UCS server: one is our dc, the second is backup-system.
Before the upgrade I checked all services, system diagnosis, latest version on both systems: everything was fine.
I had to uninstall two apps (not supported on UCS 5), after long time waiting both servers were on UCS 5.0.0.
I check the services, ran the system diagnosis: everything was fine on both systems.
After that I looked for package updates and started to update the dc to version 5.0.0 errata 164 (more then 200 packages). I got the message “please reboot” - and then the bind9 and samba4 service did not start anymore.

sudo systemctl status bind9.service
● bind9.service - BIND Domain Name Server with samba4 backend
   Loaded: loaded (/lib/systemd/system/bind9.service; enabled; vendor preset: enabled)
  Drop-In: /etc/systemd/system/bind9.service.d
           └─10-configure-backend.conf
   Active: failed (Result: signal) since Sat 2021-12-04 19:27:06 CET; 23s ago
     Docs: man:named(8)
  Process: 19889 ExecStart=/usr/lib/univention-bind/samba4 start (code=killed, signal=SEGV)
  Process: 19890 ExecStartPost=/usr/lib/univention-bind/samba4 wait-for-startup (code=exited, status=124)
 Main PID: 19889 (code=killed, signal=SEGV)

Dez 04 19:26:59 dc samba4[19890]: rndc: connect failed: 127.0.0.1#953: connection refused
(...in summary 7 times that line...)
Dez 04 19:27:06 dc systemd[1]: bind9.service: Control process exited, code=exited, status=124/n/a
Dez 04 19:27:06 dc systemd[1]: bind9.service: Failed with result 'signal'.
Dez 04 19:27:06 dc systemd[1]: Failed to start BIND Domain Name Server with samba4 backend.

The same on backup-system

sudo service bind9 status
● bind9.service - BIND Domain Name Server with samba4 backend
   Loaded: loaded (/lib/systemd/system/bind9.service; enabled; vendor preset: enabled)
  Drop-In: /etc/systemd/system/bind9.service.d
           └─10-configure-backend.conf
   Active: active (running) since Sat 2021-12-04 18:18:10 CET; 1h 12min ago
     Docs: man:named(8)
  Process: 991 ExecStartPost=/usr/lib/univention-bind/samba4 wait-for-startup (code=exited, status=0/SUCCESS)
 Main PID: 990 (named)
    Tasks: 7 (limit: 4665)
   Memory: 67.3M
   CGroup: /system.slice/bind9.service
           └─990 /usr/sbin/named -c /etc/bind/named.conf.samba4 -f -d 0

and the 7 lines with errors on dc show here information about the configuration (but instead of “dc samba4[19890]” there is now “backup-system named[990]”) .

So I tried
sudo /usr/sbin/named -c /etc/bind/named.conf.samba4 -f -d 0
on dc and got the error “Speicherzugriffsfehler”.
I looked for further information and got

journalctl -xe
(...)
Dez 04 19:42:33 dc kernel: isc-worker0000[26187]: segfault at 8 ip 1122334455667788 sp 9900aabbccddeeff error 4 in ld-2.28.so[7f5c64ef8000+1

followed by a line with code.

What can I do so I can start both bind9 and samba4 services?

#2

After update to version 5.0.1 errata 187 samba4 starts without problems, bind9 has to start manually (automatic start fails). But there are some new errors when running system diagnosis: letsencrypt reports failing signed_chain (old “friend”) and the following samba replication error

samba-tool drs showrepl gibt ein Problem mit der Replikation zurück.
In eingehend b’CN=Schema,CN=Configuration,DC=abc,DC=here-is-our-domain-name,DC=de’: Fehler während der DRS Replikation von Default-First-Site-Name/NAME-OF-BACKUP-SYSTEM (WERR_GEN_FAILURE).
In eingehend b’DC=DomainDnsZones,DC=abc,DC=here-is-our-domain-name,DC=de’: Fehler während der DRS Replikation von Default-First-Site-Name/NAME-OF-BACKUP-SYSTEM (WERR_GEN_FAILURE).
In eingehend b’DC=abc,DC=here-is-our-domain-name,DC=de’: Fehler während der DRS Replikation von Default-First-Site-Name/NAME-OF-BACKUP-SYSTEM (WERR_GEN_FAILURE).
In eingehend b’CN=Configuration,DC=abc,DC=here-is-our-domain-name,DC=de’: Fehler während der DRS Replikation von Default-First-Site-Name/NAME-OF-BACKUP-SYSTEM (WERR_GEN_FAILURE).
In eingehend b’DC=ForestDnsZones,DC=abc,DC=here-is-our-domain-name,DC=de’: Fehler während der DRS Replikation von Default-First-Site-Name/NAME-OF-BACKUP-SYSTEM (WERR_GEN_FAILURE).
In ausgehend b’CN=Schema,CN=Configuration,DC=abc,DC=here-is-our-domain-name,DC=de’: Fehler während der DRS Replikation nach Default-First-Site-Name/NAME-OF-BACKUP-SYSTEM (WERR_GEN_FAILURE).
In ausgehend b’DC=DomainDnsZones,DC=abc,DC=here-is-our-domain-name,DC=de’: Fehler während der DRS Replikation nach Default-First-Site-Name/NAME-OF-BACKUP-SYSTEM (WERR_GEN_FAILURE).
In ausgehend b’DC=abc,DC=here-is-our-domain-name,DC=de’: Fehler während der DRS Replikation nach Default-First-Site-Name/NAME-OF-BACKUP-SYSTEM (WERR_GEN_FAILURE).
In ausgehend b’CN=Configuration,DC=abc,DC=here-is-our-domain-name,DC=de’: Fehler während der DRS Replikation nach Default-First-Site-Name/NAME-OF-BACKUP-SYSTEM (WERR_GEN_FAILURE).
In ausgehend b’DC=ForestDnsZones,DC=abc,DC=here-is-our-domain-name,DC=de’: Fehler während der DRS Replikation nach Default-First-Site-Name/NAME-OF-BACKUP-SYSTEM (WERR_GEN_FAILURE).

#3

Some searching on the univention sites brought the solution of the samba problem Problem: samba-tool drs showrepl shows WERR_GEN_FAILURE - many many thanks!

#4

letsencrypt reports failing signed_chain

is now also fixed (see System diagnostic suddenly gives me: Found invalid certificate '/etc/univention/letsencrypt/signed_chain.crt')

Mastodon