Hallo zusammen,
ich habe Probleme damit, den DC Backup wieder in die Domäne zu joinen. Das ganze System ohne Probleme, bis ich versucht habe, einen neuen Share anzulegen (s. unten)
Der DC Master (dhcp-server=12.0 mailserver=12.0 nagios=4.3 self-service=4.0 4.3/horde=5.2.17-2) und DC Backup ( samba4=4.10) sind beide auf UCS 4.4-0 errata186
Zur Vorgeschichte:
vor 3 Tagen habe ich einen neuen Share anlegen wollen, dieser tauchte aber nicht in der Netzwerkumgebung auf. Grund dafür war scheinbar, dass die share.conf.d nicht angelegt wurde. So weit so harmlos.
Nach der Ursachensuche konnte ich jedoch sämtliche shares nicht mehr im Netzwerk finden - weder tauchten die Ordnericons auf, noch konnte ich mich direkt Verbinden. Das gilt allerdings nur für die Shares, der Server selbst sowie Homeverzeichnis, sysvol und netlogon sind da.
Könnte der Grund dafür sein, dass ich versucht habe, die shares mit
univention-directory-listener-ctrl resync samba-shares
zu syncronisieren?
Jedenfalls ist nun scheinbar der komplette DC Backup nicht mehr gejoint, zumindest waren sämtliche Join-scripte ausstehend (Web UI) bzw. nicht konfiguriert.
Bisher getestet habe ich folgendes:
- Replikation (ist complete)
- udm shares/share list: ist vollständig
- 3.Join Status ergibt folgendes:
root@vader:~# univention-check-join-status
Warning: 'univention-directory-listener' is not configured.
Warning: 'univention-ldap-client' is not configured.
Warning: 'univention-bind' is not configured.
Warning: 'univention-apache' is not configured.
Warning: 'univention-ldap-server' is not configured.
Warning: 'univention-heimdal-init' is not configured.
Warning: 'univention-pam' is not configured.
Warning: 'univention-directory-notifier-post' is not configured.
Warning: 'univention-heimdal-kdc' is not configured.
Warning: 'python-univention-directory-manager' is not configured.
Warning: 'univention-directory-policy' is not configured.
Warning: 'univention-join' is not configured.
Warning: 'univention-nagios-common' is not configured.
Warning: 'univention-appcenter' is not configured.
Warning: 'univention-nagios-client' is not configured.
Warning: 'univention-nagios-raid' is not configured.
Warning: 'univention-nagios-s4-connector' is not configured.
Warning: 'univention-nagios-samba' is not configured.
Warning: 'univention-nagios-smart' is not configured.
Warning: 'univention-portal' is not configured.
Warning: 'univention-management-console-server' is not configured.
Warning: 'univention-appcenter-docker' is not configured.
Warning: 'univention-management-console-module-appcenter' is not configured.
Warning: 'univention-management-console-module-diagnostic' is not configured.
Warning: 'univention-management-console-module-ipchange' is not configured.
Warning: 'univention-management-console-module-join' is not configured.
Warning: 'univention-management-console-module-lib' is not configured.
Warning: 'univention-management-console-module-mrtg' is not configured.
Warning: 'univention-management-console-module-quota' is not configured.
Warning: 'univention-management-console-module-reboot' is not configured.
Warning: 'univention-management-console-module-services' is not configured.
Warning: 'univention-management-console-module-setup' is not configured.
Warning: 'univention-management-console-module-sysinfo' is not configured.
Warning: 'univention-management-console-module-top' is not configured.
Warning: 'univention-management-console-module-ucr' is not configured.
Warning: 'univention-management-console-module-udm' is not configured.
Warning: 'univention-management-console-module-updater' is not configured.
Warning: 'univention-server-overview' is not configured.
Warning: 'univention-management-console-module-apps' is not configured.
Warning: 'univention-virtual-machine-manager-schema' is not configured.
Warning: 'univention-nfs-server' is not configured.
Warning: 'univention-bind-post' is not configured.
Warning: 'univention-saml' is not configured.
Warning: 'univention-management-console-web-server' is not configured.
Warning: 'univention-samba4' is not configured.
Warning: 'univention-s4-connector' is not configured.
Warning: 'univention-pkgdb-tools' is not configured.
Warning: 'univention-samba4-dns' is not configured.
Warning: 'univention-samba4-saml-kerberos' is not configured.
Error: Not all install files configured: 49 missing
Der Versuch, die Joinnscripts manuell auszuführen ergab folgendes:
root@vader:~# univention-run-join-scripts
univention-run-join-scripts: runs all join scripts existing on local computer.
copyright (c) 2001-2019 Univention GmbH, Germany
Enter DC Master Account : leoadmin
Enter DC Master Password:
Search LDAP binddn: ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
Insufficient access (50)
**************************************************************************
* Running join scripts failed! *
**************************************************************************
* Message: binddn for user leoadmin not found
**************************************************************************
Habe dann versucht, das ganze zu rejoinen:
root@vader:~# univention-join
univention-join: joins a computer to an ucs domain
copyright (c) 2001-2019 Univention GmbH, Germany
Enter DC Master Account : leoadmin
Enter DC Master Password:
Search DC Master: done
Check DC Master: done
Stop S4-Connector: done
Stop LDAP Server: done
Stop Samba Server: done
Search ldap/base done
Start LDAP Server: done
Search LDAP binddn done
Sync time: done
Running pre-join hook(s): done
Join Computer Account: done
Stopping univention-directory-notifier daemon: done
Stopping univention-directory-listener daemon: done
Sync ldap.secret: done
Sync ldap-backup.secret: done
Sync SSL directory: donsae
Check TLS connection: done
Download host certificate: done
Sync SSL settings: done
Purging translog database: done
Restart LDAP Server: done
Sync Kerberos settings: done
Not updating kerberos/adminserver
Running pre-joinscripts hook(s): done
Configure 01univention-ldap-server-init.inst done
Configure 02univention-directory-notifier.inst done
Configure 03univention-directory-listener.inst done
**************************************************************************
* Join failed! *
* Contact your system administrator *
**************************************************************************
* Message: Please visit https://help.univention.com/t/8842 for common problems during the join and how to fix them -- FAILED: failed to copy /var/lib/univention-ldap/notify/transaction from the dc master. Please try again.
**************************************************************************
Das Ausfüren von Configure 03univention-directory-listener.inst dauert relativ lange (5 - 10 Minuten).
Danach lässt sich auch der Server nicht über das Netzwerk erreichen, das funktioniert erst nachdem Restart von samba-ad-dc.
Die join.log ( das vollständige findet sich im Anhang, da zu groß) zeigt scheinbar fehlende Berechtigungen. Ic. Hat jemand eine Idee, wieso die Berechtigungen fehlen könnten? Zudem scheinen die Pfade der share ordner Blacklisted zu sein:
28.07.19 12:39:07.741 LISTENER ( ERROR ) : samba-shares: rename/create of sharePath for cn=ag_werkstatt,cn=shares,dc=ihf,dc=ing,dc=tu-bs,dc=de failed (WARNING: the path '/var/flexshares/ag_werkstatt' for the share 'ag_werkstatt' matches a blacklisted path. The whitelist can be extended via the URC variables listener/shares/whitelist/.)
Auch dort habe ich keine Idee, warum das auf einmal so sein sollte…
Hat vielleicht jemand eine Idee, wie ich das wieder hinbekomme?
Vielen Dank im vorraus,
Florian Jakobs
File: /etc/ldap/ldap.conf
rsync: opendir "/etc/univention/ssl/horde-30690051.ihf.ing.tu-bs.de" failed: Permission denied (13)
rsync: opendir "/etc/univention/ssl/ihf-vmhost2.ihf.ing.tu-bs.de" failed: Permission denied (13)
rsync: opendir "/etc/univention/ssl/sidious.ihf.ing.tu-bs.de" failed: Permission denied (13)
rsync: opendir "/etc/univention/ssl/svnserver.ihf.ing.tu-bs.de" failed: Permission denied (13)
rsync: opendir "/etc/univention/ssl/ucs-sso.ihf.ing.tu-bs.de" failed: Permission denied (13)
rsync: opendir "/etc/univention/ssl/ucsCA/certs" failed: Permission denied (13)
rsync: opendir "/etc/univention/ssl/ucsCA/crl" failed: Permission denied (13)
rsync: opendir "/etc/univention/ssl/ucsCA/newcerts" failed: Permission denied (13)
rsync: opendir "/etc/univention/ssl/ucsCA/private" failed: Permission denied (13)
rsync: opendir "/etc/univention/ssl/vader.ihf.ing.tu-bs.de" failed: Permission denied (13)
rsync: send_files failed to open "/etc/univention/ssl/openssl.cnf": Permission denied (13)
rsync: send_files failed to open "/etc/univention/ssl/password": Permission denied (13)
rsync: send_files failed to open "/etc/univention/ssl/ucsCA/CAreq.pem": Permission denied (13)
rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1668) [generator=3.1.2]
Clearing symlinks in /etc/ssl/certs...
done.
2019-07-28_Join.log.txt (68.9 KB)