Bug 11020 - freshly added samba AD DC can replicate INBOUND, but not OUTBOUND
Summary: freshly added samba AD DC can replicate INBOUND, but not OUTBOUND
Status: RESOLVED WORKSFORME
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: AD: LDB/DSDB/SAMDB (show other bugs)
Version: 4.1.14
Hardware: x64 Linux
: P5 normal (vote)
Target Milestone: ---
Assignee: Andrew Bartlett
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-12-20 02:49 UTC by James David Howard
Modified: 2020-01-06 11:43 UTC (History)
1 user (show)

See Also:


Attachments
.TGZ of command-line transcript, my smb.conf and log.samba (20.60 KB, application/gzip)
2014-12-20 02:49 UTC, James David Howard
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description James David Howard 2014-12-20 02:49:09 UTC
Created attachment 10552 [details]
.TGZ of command-line transcript, my smb.conf and log.samba

A freshly-built samba 4.1.14 has been added to a existing AD - a single Win2k12R2 DC. (After patches per bug id # 11006)  Testing operation with:
   samba-tool drs showrepl
shows:
-- "INBOUND NEIGHBORS" as expected: this server "dc-02" has neighbor "dc-01"
   -- successful transfers have occurred!
-- empty "OUTBOUND NEIGHBORS" list
-- non-empty "KCC CONNECTION" list
Examples in the Samba Wiki indicate the empty OUTBOUND list is NOT expected.

Using Windows AD MMC snap-in, both
-- dc-01 (Win2k12R2, running in Win2k8r2 mode) and
-- dc-01 (Fedora Linux 21, running just built samba 4.1.14)
each have records referring to the other for replication, and identical permissions in the security property page tab.

Attached, please find (as one compressed tarball .tgz):
-- transcript of running "samba-tool drs showrepl --debuglevel=5"
-- log.samba (re-started moments before the showrepl attempt)
-- my smb.conf file

Is there a config detail I'm missing?
Comment 1 James David Howard 2015-01-07 03:55:20 UTC
(In reply to James David Howard from comment #0)
Please note error/typo in report: the Fedora 21 server is named "dc-02" - not dc-01 as mentioned in one paragraph.
Comment 2 Björn Jacke 2020-01-06 11:43:35 UTC
there have been a lot of improvemnts and pitfalls for getting initial replication set up correctly being removed since 4.1. If you still have issues with 4.11, please discuss this on the mailing list.