Hello, how are you?
We installed a new RODC server with Samba DNS backend (ucsrodc).
dns/backend: samba4
As mentioned in the documentation:
Univention Documentation
When joining the server to the domain, the initial synchronization is performed and the existing records appear in Samba.
However, when we create new DNS records on the master, they are not replicated to the RODC DNS. (They do appear in LDAP, but not in Samba.)
Running the following queries on the RODC (ucsrodc) gives us:
samba-tool dns query ucsrodc.mydomain.com mydomain.com dnstest A -U Administrator
Password for [MYDOMAIN\Administrator]:
ERROR: Record or zone does not exist.
univention-ldapsearch -LLL “(zoneName=mydomain.com )” dn | grep dnstest
dn: relativeDomainName=dnstest,zoneName=mydomain.com ,cn=dns,dc=mydomain,dc=com
Is this the expected behavior, or should the record also appear in Samba?
thanks very much,
best regards.
Hi @carlitostevez ,
maybe this knowledge base articles could help you, to understand if the drs replication works in you environment and solve the issue.
Problem
The command:
dig axfr @'dns ip address' "domain fqdn"
is used to initiate a DNS zone transfer (DNS zone replication) between DNS servers. DNS zone transfers should only be allowed between authorized DNS servers. If this command can successfully execute from any IP address, it constitutes a significant security vulnerability, as it allows unauthorized users to obtain sensitive information about the domain. This information may include:
A list of all machines in the domain
IP addresses
…
Samba 4 Troubleshooting Guide
DRS Replication
Further Articles for Replication issues are samba-tool-drs-showrepl-shows-werr-gen-failure
and drs-replication-fails
samba-tool drs showrepl
To get an overview of the current drs replication status you can use this command at every UCS Samba 4 DC which is joined to the domain:
samba-tool drs showrepl
Sitename\Servername
DSA Options: 0x00000001
DSA object GUID: ffad9f19-0e90-457b-b733-469e4b2280a1
DSA invocationId: 908dbb52-12a6-47a2-ae03-1a71014c…
Best regards,
Mirac