How-to: Configuring Multi-Site Samba AD in Nubus for UCS 5.2

MiracErde · June 10, 2026, 12:09pm

Configuring Multi-Site Samba AD in Nubus for UCS 5.2

Summary

This article describes how to design, implement, and validate a multi-site Samba Active Directory topology in a Nubus for UCS 5.2 environment. It covers the underlying Active Directory site concept, the required LDAP and DNS configuration, step-by-step implementation instructions, validation procedures, troubleshooting, and ongoing operations.

The example topology consists of two sites: a headquarters site (Default-First-Site-Name) containing a Primary Node and a Backup Node, and a remote site (Berlin) containing a Replica Node.

1. Concept: What Are Sites?

1.1 Core Idea

In Active Directory (and therefore in Samba AD), sites represent the physical network topology — locations and well-connected network segments — while the domain represents the logical structure containing users, groups, and policies.

Layer	Represents
Domain / Forest	Logical structure (users, groups, policies)
Sites	Physical structure (locations, subnets, available bandwidth)

Sites address a fundamental challenge in distributed environments: how to minimize replication and authentication traffic across slow or expensive WAN links.

1.2 Purpose of Sites

Purpose	Description
Client affinity	Clients locate the nearest domain controller via DNS SRV records (`_sites` namespace).
Replication control	Intra-site replication is fast and uncompressed; inter-site replication is scheduled and compressed.
Authentication performance	Local Key Distribution Centers (KDCs) are used instead of WAN round trips.
Topology control	The Knowledge Consistency Checker (KCC) automatically builds replication connections based on the site topology.

1.3 LDAP Structure

All site-related objects reside under CN=Sites,CN=Configuration,DC=<domain>:

CN=Sites,CN=Configuration,DC=<domain>
 ├── CN=<SiteName>
 │    ├── CN=Servers
 │    │    └── CN=<DCName> → NTDS Settings
 │    └── CN=NTDS Site Settings
 ├── CN=Subnets
 │    └── CN=<subnet> → siteObject: <Site>
 └── CN=Inter-Site Transports
      └── CN=IP
           └── CN=<SiteLink>

1.4 UCS-Specific Considerations

The Univention Directory Listener and Notifier replicate OpenLDAP independently of AD sites.
Samba AD replication (DRS) is controlled by the site topology.
Site configuration is not performed through the Univention Management Console (UMC). Use samba-tool and ldbmodify instead.
A default site named Default-First-Site-Name is created during UCS installation.

2. Architecture Overview

2.1 Example Production Topology

╔════════════════════════════════════════╗   ╔══════════════════════════════════╗
║  SITE: Default-First-Site-Name (HQ)    ║   ║  SITE: Berlin (Remote)           ║
║  Subnet: 10.200.30.0/24                ║   ║  Subnet: 10.200.60.0/24          ║
║  Reverse: 30.200.10.in-addr.arpa       ║   ║  Reverse: 60.200.10.in-addr.arpa ║
║                                        ║   ║                                  ║
║  ucs5primary   10.200.30.100  (FSMO)   ║   ║  ucs5replica   10.200.60.102     ║
║  ucs5backup    10.200.30.101           ║   ║                                  ║
║                                        ║   ║                                  ║
║  Intra-site replication                ║   ║  Local authentication            ║
║  fast, uncompressed                    ║   ║  via local DC                    ║
╚════════════════════════════════════════╝   ╚══════════════════════════════════╝
                    │                                       │
                    └──── DEFAULTIPSITELINK ────────────────┘
                         cost: 100, replInterval: 180 min
                         Inter-site: compressed, scheduled

2.2 Domain Parameters

Parameter	Value
DNS domain	`miro.intranet`
NetBIOS domain	`MIRO`
Base DN	`DC=miro,DC=intranet`

2.3 Domain Controller Inventory

Hostname	Role	IP address	Site
`ucs5primary`	Primary (FSMO holder)	`10.200.30.100`	`Default-First-Site-Name`
`ucs5backup`	Backup	`10.200.30.101`	`Default-First-Site-Name`
`ucs5replica`	Replica	`10.200.60.102`	`Berlin`

3. Preparation

3.1 Prerequisites

Before starting, ensure that:

Snapshots or backups of all domain controllers are available.
A maintenance window is scheduled (DNS records will change).
Routing between the IP networks is functional.
Firewall rules permit AD ports between sites (see section 8.2).
Console access is available as a fallback if SSH is interrupted.

3.2 Create a Backup Before Beginning

Execute the following on every domain controller:

samba-tool domain backup offline --targetdir=/root/samba-backup-$(date +%F)

3.3 Inventory the Current State

# List existing sites
samba-tool sites list

Example output:

Default-First-Site-Name
Heisenberg

# List DCs and their site assignment
ldbsearch -H /var/lib/samba/private/sam.ldb \
  -b "CN=Sites,CN=Configuration,DC=miro,DC=intranet" \
  "(objectClass=server)" dn

Example output:

dn: CN=UCS5REPLICA,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=miro,DC=intranet
dn: CN=UCS5BACKUP,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=miro,DC=intranet
dn: CN=UCS5PRIMARY,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=miro,DC=intranet

# List existing subnets
ldbsearch -H /var/lib/samba/private/sam.ldb \
  -b "CN=Subnets,CN=Sites,CN=Configuration,DC=miro,DC=intranet" \
  "(objectClass=subnet)" cn siteObject

# List existing site links
ldbsearch -H /var/lib/samba/private/sam.ldb \
  -b "CN=IP,CN=Inter-Site Transports,CN=Sites,CN=Configuration,DC=miro,DC=intranet" \
  "(objectClass=siteLink)" cn siteList cost replInterval

# Review the current replication status
samba-tool drs showrepl

4. Step-by-Step Configuration

Step 1: Create the New Site

On ucs5primary:

samba-tool sites create Berlin

Expected output:

Site Berlin created !

Explanation: This command creates an empty site Berlin under CN=Sites,CN=Configuration,.... The site contains no DCs or subnets yet.

Validation:

samba-tool sites list

Expected output:

Berlin
Default-First-Site-Name

Step 2: Create Subnets and Assign Them to Sites

# Headquarters subnet → Default-First-Site-Name
samba-tool sites subnet create 10.200.30.0/24 Default-First-Site-Name

# Remote site subnet → Berlin
samba-tool sites subnet create 10.200.60.0/24 Berlin

Expected output:

Subnet 10.200.30.0/24 created !
Subnet 10.200.60.0/24 created !

Explanation: Subnet-to-site mappings drive the DC-locator logic. Clients in these subnets are automatically associated with their respective site.

Validation:

ldbsearch -H /var/lib/samba/private/sam.ldb \
  -b "CN=Subnets,CN=Sites,CN=Configuration,DC=miro,DC=intranet" \
  "(objectClass=subnet)" cn siteObject

Expected output:

dn: CN=10.200.60.0/24,CN=Subnets,CN=Sites,CN=Configuration,DC=miro,DC=intranet
cn: 10.200.60.0/24
siteObject: CN=Berlin,CN=Sites,CN=Configuration,DC=miro,DC=intranet

dn: CN=10.200.30.0/24,CN=Subnets,CN=Sites,CN=Configuration,DC=miro,DC=intranet
cn: 10.200.30.0/24
siteObject: CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=miro,DC=intranet

Step 3: Change the IP Address of the Replica DC (If Required)

If the DC must be moved into a different IP network:

# On ucs5replica:
ucr set \
  interfaces/eth0/address=10.200.60.102 \
  interfaces/eth0/netmask=255.255.255.0 \
  interfaces/eth0/network=10.200.60.0 \
  interfaces/eth0/broadcast=10.200.60.255 \
  gateway=10.200.60.1

# Restart networking. SSH connections will be dropped.
systemctl restart networking

Explanation: UCS regenerates the network configuration automatically after UCR variables change.

Important: Before performing this step, verify that:

Console access is available as a fallback.

Routing between the old and new networks is functional.

A DNS reverse zone for the new network exists (otherwise complete Step 5.1 first).

Step 4: Move the DC Server Object to the New Site

On ucs5primary:

ldbmodify -H /var/lib/samba/private/sam.ldb <<'EOF'
dn: CN=UCS5REPLICA,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=miro,DC=intranet
changetype: modrdn
newrdn: CN=UCS5REPLICA
deleteoldrdn: 1
newsuperior: CN=Servers,CN=Berlin,CN=Sites,CN=Configuration,DC=miro,DC=intranet
EOF

Explanation: This LDAP modrdn operation moves (renames) the Replica’s server object from Default-First-Site-Name to Berlin.

Validation:

ldbsearch -H /var/lib/samba/private/sam.ldb \
  -b "CN=Sites,CN=Configuration,DC=miro,DC=intranet" \
  "(objectClass=server)" dn

Expected output:

dn: CN=UCS5REPLICA,CN=Servers,CN=Berlin,CN=Sites,CN=Configuration,DC=miro,DC=intranet
dn: CN=UCS5BACKUP,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=miro,DC=intranet
dn: CN=UCS5PRIMARY,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=miro,DC=intranet

Step 5: Configure the Site Link

Add the Berlin site to the default site link so that the KCC can build inter-site replication connections:

ldbmodify -H /var/lib/samba/private/sam.ldb <<'EOF'
dn: CN=DEFAULTIPSITELINK,CN=IP,CN=Inter-Site Transports,CN=Sites,CN=Configuration,DC=miro,DC=intranet
changetype: modify
add: siteList
siteList: CN=Berlin,CN=Sites,CN=Configuration,DC=miro,DC=intranet
-
EOF

Explanation: DEFAULTIPSITELINK is the default inter-site replication transport. Both sites must be members of this link for the KCC to establish replication.

Parameters:

cost: 100 (default) — lower values indicate preferred paths.
replInterval: 180 (minutes) — the minimum supported value is 15 minutes. Reducing this can be appropriate if the WAN link is sufficient.

Validation:

ldbsearch -H /var/lib/samba/private/sam.ldb \
  -b "CN=IP,CN=Inter-Site Transports,CN=Sites,CN=Configuration,DC=miro,DC=intranet" \
  "(objectClass=siteLink)" cn siteList cost replInterval

Expected output:

dn: CN=DEFAULTIPSITELINK,...
cn: DEFAULTIPSITELINK
cost: 100
replInterval: 180
siteList: CN=Berlin,CN=Sites,CN=Configuration,DC=miro,DC=intranet
siteList: CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=miro,DC=intranet

Step 6: Configure DNS Resolvers on the Replica DC

On ucs5replica:

ucr set nameserver1=10.200.60.102      # local Samba DNS preferred
ucr set nameserver2=10.200.30.100      # ucs5primary as cross-site fallback

Validation:

cat /etc/resolv.conf

Expected output:

domain  miro.intranet
nameserver  10.200.60.102
nameserver  10.200.30.100
options timeout:2

Explanation:

nameserver1 points to the local Samba DNS service.
nameserver2 provides a cross-site fallback in case of a local DNS failure.

Step 7: Register DNS Records on All DCs

On every DC:

samba_dnsupdate --verbose --all-names
/etc/init.d/samba restart

Expected output:

Stopping samba-ad-dc (via systemctl): samba-ad-dc.service.
Stopping nmbd (via systemctl): nmbd.service.
Starting nmbd (via systemctl): nmbd.service.
Starting samba-ad-dc (via systemctl): samba-ad-dc.service.

Explanation: samba_dnsupdate registers the SRV records for the site (_ldap._tcp.<Site>._sites...). After restarting Samba, the records are fully active.

Step 8: Recalculate the KCC Topology

On every DC:

samba-tool drs kcc

Verify inter-site replication explicitly:

samba-tool drs replicate ucs5replica.miro.intranet ucs5primary.miro.intranet DC=miro,DC=intranet
samba-tool drs replicate ucs5primary.miro.intranet ucs5replica.miro.intranet DC=miro,DC=intranet

Expected output:

Replicate from ucs5primary.miro.intranet to ucs5replica.miro.intranet was successful.
Replicate from ucs5replica.miro.intranet to ucs5primary.miro.intranet was successful.

Explanation: The Knowledge Consistency Checker calculates the replication topology based on the sites and site links.

5. DNS Configuration

5.1 Create Reverse Zones

UCS does not create reverse lookup zones automatically. Create them manually on ucs5primary:

# Reverse zone for the headquarters subnet
samba-tool dns zonecreate localhost 30.200.10.in-addr.arpa -P

# Reverse zone for the Berlin subnet
samba-tool dns zonecreate localhost 60.200.10.in-addr.arpa -P

Validation:

samba-tool dns zonelist localhost -P

Expected output (excerpt):

root@ucs5primary:~# samba-tool dns zonelist localhost -P
  4 zone(s) found

  pszZoneName                 : miro.intranet
  Flags                       : DNS_RPC_ZONE_DSINTEGRATED DNS_RPC_ZONE_UPDATE_SECURE 
  ZoneType                    : DNS_ZONE_TYPE_PRIMARY
  Version                     : 50
  dwDpFlags                   : DNS_DP_AUTOCREATED DNS_DP_DOMAIN_DEFAULT DNS_DP_ENLISTED 
  pszDpFqdn                   : DomainDnsZones.miro.intranet

  pszZoneName                 : 30.200.10.in-addr.arpa
  Flags                       : DNS_RPC_ZONE_DSINTEGRATED DNS_RPC_ZONE_UPDATE_SECURE 
  ZoneType                    : DNS_ZONE_TYPE_PRIMARY
  Version                     : 50
  dwDpFlags                   : DNS_DP_AUTOCREATED DNS_DP_DOMAIN_DEFAULT DNS_DP_ENLISTED 
  pszDpFqdn                   : DomainDnsZones.miro.intranet

  pszZoneName                 : 60.200.10.in-addr.arpa
  Flags                       : DNS_RPC_ZONE_DSINTEGRATED DNS_RPC_ZONE_UPDATE_SECURE 
  ZoneType                    : DNS_ZONE_TYPE_PRIMARY
  Version                     : 50
  dwDpFlags                   : DNS_DP_AUTOCREATED DNS_DP_DOMAIN_DEFAULT DNS_DP_ENLISTED 
  pszDpFqdn                   : DomainDnsZones.miro.intranet

  pszZoneName                 : _msdcs.miro.intranet
  Flags                       : DNS_RPC_ZONE_DSINTEGRATED DNS_RPC_ZONE_UPDATE_SECURE 
  ZoneType                    : DNS_ZONE_TYPE_PRIMARY
  Version                     : 50
  dwDpFlags                   : DNS_DP_AUTOCREATED DNS_DP_FOREST_DEFAULT DNS_DP_ENLISTED 
  pszDpFqdn                   : ForestDnsZones.miro.intranet

Naming convention: For a subnet of 10.200.X.0/24, the reverse zone name is X.200.10.in-addr.arpa (octets in reverse order).

5.2 Create PTR Records

# Headquarters DCs
samba-tool dns add localhost 30.200.10.in-addr.arpa 100 PTR ucs5primary.miro.intranet. -P
samba-tool dns add localhost 30.200.10.in-addr.arpa 101 PTR ucs5backup.miro.intranet. -P

# Replica
samba-tool dns add localhost 60.200.10.in-addr.arpa 102 PTR ucs5replica.miro.intranet. -P

Important: Append a trailing dot (.) to the FQDN in PTR records. Without it, the FQDN is interpreted relative to the zone.

5.3 Apply DNS Changes

samba_dnsupdate --verbose --all-names
/etc/init.d/samba restart

5.4 Replicate DNS Partitions Between Sites

Ensure that the DomainDnsZones and ForestDnsZones partitions are replicated:

samba-tool drs replicate ucs5replica.miro.intranet ucs5primary.miro.intranet \
  DC=DomainDnsZones,DC=miro,DC=intranet

samba-tool drs replicate ucs5replica.miro.intranet ucs5primary.miro.intranet \
  DC=ForestDnsZones,DC=miro,DC=intranet

Expected output:

Replicate from ucs5primary.miro.intranet to ucs5replica.miro.intranet was successful.

6. Validation and Testing

6.1 Verify the Site Overview

samba-tool sites list

Expected output:

Berlin
Default-First-Site-Name
Heisenberg

ldbsearch -H /var/lib/samba/private/sam.ldb \
  -b "CN=Subnets,CN=Sites,CN=Configuration,DC=miro,DC=intranet" \
  "(objectClass=subnet)" cn siteObject

ldbsearch -H /var/lib/samba/private/sam.ldb \
  -b "CN=Sites,CN=Configuration,DC=miro,DC=intranet" \
  "(objectClass=server)" dn

6.2 Test the DC Locator

On ucs5primary:

samba-tool domain info 10.200.30.100

Expected output:

Forest           : miro.intranet
Domain           : miro.intranet
Netbios domain   : MIRO
DC name          : ucs5primary.miro.intranet
DC netbios name  : UCS5PRIMARY
Server site      : Default-First-Site-Name
Client site      : Default-First-Site-Name

On ucs5replica:

samba-tool domain info 10.200.60.102

Expected output:

Forest           : miro.intranet
Domain           : miro.intranet
Netbios domain   : MIRO
DC name          : ucs5replica.miro.intranet
DC netbios name  : UCS5REPLICA
Server site      : Berlin
Client site      : Berlin

6.3 Verify DNS SRV Records

# Berlin site
host -t SRV _ldap._tcp.Berlin._sites.dc._msdcs.miro.intranet
host -t SRV _kerberos._tcp.Berlin._sites.dc._msdcs.miro.intranet

# Headquarters site
host -t SRV _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.miro.intranet
host -t SRV _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.miro.intranet

Expected results:

Berlin SRV records resolve to ucs5replica.miro.intranet.
Default-First-Site-Name SRV records resolve to ucs5primary.miro.intranet. and ucs5backup.miro.intranet.

6.4 Verify Forward and Reverse Resolution

# Forward lookups
host ucs5replica.miro.intranet
host ucs5primary.miro.intranet

# Reverse lookups (three equivalent syntaxes)
host 10.200.60.102
dig -x 10.200.60.102 +short
host -t PTR 102.60.200.10.in-addr.arpa

6.5 Verify Replication

samba-tool drs showrepl
samba-tool drs showrepl --summary

Expected output:

[ALL GOOD]

# Force inter-site replication
samba-tool drs replicate ucs5replica.miro.intranet ucs5primary.miro.intranet DC=miro,DC=intranet

Expected output:

Replicate from ucs5primary.miro.intranet to ucs5replica.miro.intranet was successful.

7. Troubleshooting

7.1 Common Issues and Solutions

Issue	Cause	Resolution
`WERR_DNS_ERROR_NAME_DOES_NOT_EXIST` returned by `samba-tool dns query`	Site DNS records have not been registered.	Run `samba_dnsupdate --all-names` and restart Samba (`systemctl restart samba`).
`wbinfo --dc-info <FQDN>` fails	Command expects the NetBIOS domain name.	Use `wbinfo --dc-info $(ucr get windows/domain)`.
`Client site` is empty	No subnet covers the client IP.	Create the appropriate subnet with `samba-tool sites subnet create`.
`Client site` is incorrect	DC IP falls within a subnet of a different site.	Move the DC to the correct IP range, or use a /32 mapping (test environments only).
DNS timeouts after IP change	Resolver still points to old IP.	Update with `ucr set nameserverX=<new IP>`.
Reverse lookup returns external host	Local reverse zone is missing.	Create the zone with `samba-tool dns zonecreate`.
`Replicate ... was not successful`	Firewall blocks AD ports between sites.	Verify the firewall rules listed in section 8.2.

7.2 Diagnostic Commands

# Full replication topology
samba-tool drs showrepl

# Replication failures summary
samba-tool drs showrepl --summary

# List DNS zones
samba-tool dns zonelist localhost -P

# Inspect records of a zone
samba-tool dns query localhost miro.intranet @ ALL -P

# View site configuration
samba-tool sites view <SiteName>

# View a DC computer object
samba-tool computer show <hostname>

7.3 Emergency Rollback

In case of major issues, restore from backup:

# Stop services
/etc/init.d/samba stop

# Create an additional safety backup of the current state
samba-tool domain backup offline --targetdir=/root/samba-backup-$(date +%F)

# Restore (only in emergencies)
samba-tool domain backup restore --backup-file=/root/samba-backup-<date>/...

8. Operations and Maintenance

8.1 Monitoring Recommendations

Check	Command	Frequency
DRS replication	`samba-tool drs showrepl --summary`	Every 15 minutes
Samba service	`systemctl is-active samba-ad-dc`	Every 5 minutes
UCS Listener	`systemctl is-active univention-directory-listener`	Every 5 minutes
UCS Notifier	`systemctl is-active univention-directory-notifier`	Every 5 minutes
Site affinity	`samba-tool domain info <IP>`	Daily
DNS SRV records	`host -t SRV _ldap._tcp.<Site>._sites.dc._msdcs.<Domain>`	Daily

8.2 Firewall Rules Between Sites

Port	Protocol	Service
53	TCP/UDP	DNS
88	TCP/UDP	Kerberos
135	TCP	RPC Endpoint Mapper
137–139	TCP/UDP	NetBIOS
389	TCP/UDP	LDAP
445	TCP	SMB
464	TCP/UDP	Kerberos password change
636	TCP	LDAPS
3268–3269	TCP	Global Catalog
6669	TCP	UCS Notifier
7389	TCP	UCS OpenLDAP
49152–65535	TCP	Dynamic RPC ports

9. Command Reference

9.1 Managing Sites

# List sites
samba-tool sites list

# Create a site
samba-tool sites create <SiteName>

# View a site
samba-tool sites view <SiteName>

# Rename a site (impacts DNS — use with caution)
samba-tool sites rename <Old> <New>

# Remove a site (must be empty)
samba-tool sites remove <SiteName>

9.2 Managing Subnets

# Create a subnet
samba-tool sites subnet create <CIDR> <Site> --description="<Text>"

# List subnets per site
samba-tool sites subnet list <Site>

# Remove a subnet
samba-tool sites subnet remove <CIDR>

9.3 Moving a DC Between Sites

ldbmodify -H /var/lib/samba/private/sam.ldb <<EOF
dn: CN=<DCNAME>,CN=Servers,CN=<OLD_SITE>,CN=Sites,CN=Configuration,<BASE_DN>
changetype: modrdn
newrdn: CN=<DCNAME>
deleteoldrdn: 1
newsuperior: CN=Servers,CN=<NEW_SITE>,CN=Sites,CN=Configuration,<BASE_DN>
EOF

9.4 Managing Replication

# Status
samba-tool drs showrepl
samba-tool drs showrepl --summary

# Recalculate replication topology
samba-tool drs kcc

# Manual replication
samba-tool drs replicate <DEST_DC> <SRC_DC> <NamingContext>

Naming contexts:

Context	DN
Domain partition	`DC=miro,DC=intranet`
Configuration	`CN=Configuration,DC=miro,DC=intranet`
Schema	`CN=Schema,CN=Configuration,DC=miro,DC=intranet`
Domain DNS Zones	`DC=DomainDnsZones,DC=miro,DC=intranet`
Forest DNS Zones	`DC=ForestDnsZones,DC=miro,DC=intranet`

9.5 Managing DNS

# List zones
samba-tool dns zonelist localhost -P

# Create a zone
samba-tool dns zonecreate localhost <ZONE> -P

# Add a record
samba-tool dns add localhost <ZONE> <NAME> <TYPE> <DATA> -P

# Delete a record
samba-tool dns delete localhost <ZONE> <NAME> <TYPE> <DATA> -P

# Show records in a zone
samba-tool dns query localhost <ZONE> @ ALL -P

# Re-register DNS records
samba_dnsupdate --verbose --all-names

9.6 Validation Commands

# Site affinity
samba-tool domain info <IP>
wbinfo --dsgetdcname=<NETBIOS_DOMAIN>

# Forward and reverse resolution
host <hostname>
host <ip>
dig -x <ip> +short

# Domain information
wbinfo --own-domain
wbinfo --all-domains

root@ucs5primary:~# wbinfo --dsgetdcname=MIRO
\\ucs5primary.miro.intranet
\\10.200.30.100
1
d5bea94a-c6f3-4478-8c9e-6f7c20498f2b
miro.intranet
miro.intranet
0xe001d37d
Default-First-Site-Name
Berlin

9.7 UCR Variables

# Display variables
ucr search --brief 'nameserver|dns/|interfaces/'

# Set a variable
ucr set nameserver1=<Host IP>

9.8 Backup and Recovery

# Samba backup
samba-tool domain backup offline --targetdir=<DIR>

# UCS Samba backup
/var/univention-backup/samba/

# Restore (emergency only)
samba-tool domain backup restore --backup-file=<FILE>

10. Extending the Topology: Adding a New Site

The following workflow adds an additional remote site (Hamburg) with subnet 10.200.70.0/24:

# 1. Create the new site
samba-tool sites create Hamburg

# 2. Assign the subnet
samba-tool sites subnet create 10.200.70.0/24 Hamburg \
  --description="Hamburg site"

# 3. Create the reverse zone
samba-tool dns zonecreate localhost 70.200.10.in-addr.arpa -P

# 4. Extend the site link
ldbmodify -H /var/lib/samba/private/sam.ldb <<'EOF'
dn: CN=DEFAULTIPSITELINK,CN=IP,CN=Inter-Site Transports,CN=Sites,CN=Configuration,DC=miro,DC=intranet
changetype: modify
add: siteList
siteList: CN=Hamburg,CN=Sites,CN=Configuration,DC=miro,DC=intranet
-
EOF

# 5. Join a new DC with an IP from 10.200.70.0/24 via the standard UCS join process
univention-join

# 6. Move the server object to the correct site
ldbmodify -H /var/lib/samba/private/sam.ldb <<'EOF'
dn: CN=NEW_DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=miro,DC=intranet
changetype: modrdn
newrdn: CN=NEW_DC
deleteoldrdn: 1
newsuperior: CN=Servers,CN=Hamburg,CN=Sites,CN=Configuration,DC=miro,DC=intranet
EOF

# 7. Update DNS on the new DC
samba_dnsupdate --verbose --all-names
systemctl restart samba

# 8. Recalculate the topology and verify replication
samba-tool drs kcc
samba-tool drs showrepl

# 9. Validate site affinity
samba-tool domain info <NEW_DC_IP>

11. Join into new Site

After you created a new Site you have the option, to join into this Site with an fresh installed and unjoined UCS Node.
For that, you have to set the following UCR variable on that Node, which you want to join:

ucr set samba4/join/site=”<site>”
univention-join

UCS offers a UCR variable samba4/join/site that can be set on the joining system to point it to the desired Active Directory site. The site needs to be created in advance, either using samba-tool or /usr/share/univention-samba4/scripts/univention-samba4-site-tool.py or via the Microsoft Windows GUI Sites and Services.

For more Info:

12. Further Reading

Samba Wiki — Active Directory Sites and Subnets
https://wiki.samba.org/index.php/Active_Directory_Sites_and_Subnets
Microsoft Docs — Active Directory Replication Topology (concepts apply directly to Samba AD)
https://learn.microsoft.com/
Univention Manual UCS 5.2
https://docs.software-univention.de/manual/5.2/

How-to: Configuring Multi-Site Samba AD in Nubus for UCS 5.2

Configuring Multi-Site Samba AD in Nubus for UCS 5.2

Summary

Table of Contents

1. Concept: What Are Sites?

1.1 Core Idea

1.2 Purpose of Sites

1.3 LDAP Structure

1.4 UCS-Specific Considerations

2. Architecture Overview

2.1 Example Production Topology

2.2 Domain Parameters

2.3 Domain Controller Inventory

3. Preparation

3.1 Prerequisites

3.2 Create a Backup Before Beginning

3.3 Inventory the Current State

4. Step-by-Step Configuration

Step 1: Create the New Site

Step 2: Create Subnets and Assign Them to Sites

Step 3: Change the IP Address of the Replica DC (If Required)

Step 4: Move the DC Server Object to the New Site

Step 5: Configure the Site Link

Step 6: Configure DNS Resolvers on the Replica DC

Step 7: Register DNS Records on All DCs

Step 8: Recalculate the KCC Topology

5. DNS Configuration

5.1 Create Reverse Zones

5.2 Create PTR Records

5.3 Apply DNS Changes

5.4 Replicate DNS Partitions Between Sites

6. Validation and Testing

6.1 Verify the Site Overview

6.2 Test the DC Locator

6.3 Verify DNS SRV Records

6.4 Verify Forward and Reverse Resolution

6.5 Verify Replication

7. Troubleshooting

7.1 Common Issues and Solutions

7.2 Diagnostic Commands

7.3 Emergency Rollback

8. Operations and Maintenance

8.1 Monitoring Recommendations

8.2 Firewall Rules Between Sites

9. Command Reference

9.1 Managing Sites

9.2 Managing Subnets

9.3 Moving a DC Between Sites

9.4 Managing Replication

9.5 Managing DNS

9.6 Validation Commands

9.7 UCR Variables

9.8 Backup and Recovery

10. Extending the Topology: Adding a New Site

11. Join into new Site

12. Further Reading