samba_dnsupgrade --dns-backend=BIND9_DLZ creates hardlink /var/lib/samba/bind-dns/dns/sam.ldb.d/{DC=DOMAINDNSZONES,DC=FORESTDNSZONES},DC=TESTING,DC=LAN for LDB DNS partition files, but it does not create them for *-lock files. I have had a few time corrupted DNS partition with BIND-DLZ along LMDB. [root@srvads.testing.lan ~]# ls -li /var/lib/samba/private/sam.ldb.d/ total 375340 525701 -rw-r--r-- 1 root root 8552448 août 5 09:05 CN=CONFIGURATION,DC=TESTING,DC=LAN.ldb 525681 -rw-r--r-- 1 root root 6400128 nov. 14 17:24 CN=CONFIGURATION,DC=TESTING,DC=LAN.ldb-lock 525654 -rw-r--r-- 1 root root 8843264 févr. 5 2019 CN=SCHEMA,CN=CONFIGURATION,DC=TESTING,DC=LAN.ldb 525653 -rw-r--r-- 1 root root 6400128 nov. 14 17:24 CN=SCHEMA,CN=CONFIGURATION,DC=TESTING,DC=LAN.ldb-lock 525770 -rw-r--r-- 1 root root 354435072 nov. 14 17:23 DC=TESTING,DC=LAN.ldb 525704 -rw-r--r-- 1 root root 6400128 nov. 14 17:24 DC=TESTING,DC=LAN.ldb-lock 525798 -rw-rw---- 2 root bind 10674176 nov. 14 16:58 DC=DOMAINDNSZONES,DC=TESTING,DC=LAN.ldb 525782 -rw-r--r-- 1 root root 6400128 nov. 14 17:24 DC=DOMAINDNSZONES,DC=TESTING,DC=LAN.ldb-lock 525810 -rw-rw---- 2 root bind 1368064 févr. 5 2019 DC=FORESTDNSZONES,DC=TESTING,DC=LAN.ldb 525800 -rw-r--r-- 1 root root 6400128 nov. 14 17:24 DC=FORESTDNSZONES,DC=TESTING,DC=LAN.ldb-lock 525470 -rw-rw---- 2 root bind 421888 nov. 14 16:58 metadata.tdb [root@srvads.testing.lan ~]# ls -li /var/lib/samba/bind-dns/dns/sam.ldb.d/ total 29224 525141 -rw-rw---- 1 root bind 8552448 oct. 22 18:58 CN=CONFIGURATION,DC=TESTING,DC=LAN.ldb 524808 -rw-r--r-- 1 bind bind 6400128 nov. 14 17:23 CN=CONFIGURATION,DC=TESTING,DC=LAN.ldb-lock 525144 -rw-rw---- 1 root bind 8843264 oct. 22 18:58 CN=SCHEMA,CN=CONFIGURATION,DC=TESTING,DC=LAN.ldb 524382 -rw-r--r-- 1 bind bind 6400128 nov. 14 17:23 CN=SCHEMA,CN=CONFIGURATION,DC=TESTING,DC=LAN.ldb-lock 524980 -rw-rw---- 1 root bind 40960 oct. 22 18:58 DC=TESTING,DC=LAN.ldb 524981 -rw-rw---- 1 root bind 6400128 nov. 14 17:23 DC=TESTING,DC=LAN.ldb-lock 525798 -rw-rw---- 2 root bind 10674176 nov. 14 16:58 DC=DOMAINDNSZONES,DC=TESTING,DC=LAN.ldb 524866 -rw-r--r-- 1 bind bind 6400128 nov. 14 17:23 DC=DOMAINDNSZONES,DC=TESTING,DC=LAN.ldb-lock 525810 -rw-rw---- 2 root bind 1368064 févr. 5 2019 DC=FORESTDNSZONES,DC=TESTING,DC=LAN.ldb 524941 -rw-r--r-- 1 bind bind 6400128 nov. 14 17:23 DC=FORESTDNSZONES,DC=TESTING,DC=LAN.ldb-lock 525470 -rw-rw---- 2 root bind 421888 nov. 14 16:58 metadata.tdb The *-lock file is not handled in the script /usr/lib64/python3.6/site-packages/samba/provision/sambadns.py:856 : try: os.link(os.path.join(samldb_dir, metadata_file), os.path.join(dns_samldb_dir, metadata_file)) os.link(os.path.join(private_dir, domainzone_file), os.path.join(dns_dir, domainzone_file)) if forestzone_file: os.link(os.path.join(private_dir, forestzone_file), os.path.join(dns_dir, forestzone_file))
Created attachment 15723 [details] Proposed patch apples to V4.11 CI run: https://gitlab.com/samba-team/devel/samba/pipelines/108226370
Created attachment 15724 [details] Proposed patch applies to V4.10 CI run: https://gitlab.com/samba-team/devel/samba/pipelines/108246724
Comment on attachment 15723 [details] Proposed patch apples to V4.11 Thanks. We should probably come up with some explanatory text to put in WHATSNEW at least suggesting a dbcheck and how to fix existing databases. However avoiding issues on any new domains is an important start so I've approved this.
Assigning to Karolin for 4.10.next and 4.11.next
Created attachment 15725 [details] Proposed patch applies to V4.9 CI run: https://gitlab.com/samba-team/devel/samba/pipelines/108246200
(In reply to Andrew Bartlett from comment #4) Pushed to autobuild-v4-11-test.
(In reply to Karolin Seeger from comment #6) Pushed to v4-11-test. Closing out bug report. Thanks!
We still need to work out some robust steps to fix existing installations. I've confirmed running the script ./source4/scripting/bin/samba_upgradedns --dns-backend=BIND9_DLZ WILL create the correct lock files. Of course, BIND9 must be stopped at the time this is done otherwise it will still have the old, seperate lock files open. It is important to confirm that the -lock files, like the DNS partition .ldb files, have 2 (hard) links, per the second column of: [abartlet@labdc samba]$ ls -la st/labdc/bind-dns/dns/sam.ldb.d/ 777;preexectotal 45204 drwxrwxr-x. 2 abartlet abartlet 4096 Jan 23 20:00 . drwxrwx---. 3 abartlet abartlet 4096 Jan 23 20:00 .. -rw-rw-r--. 1 abartlet abartlet 14127104 Jan 23 20:00 'CN=CONFIGURATION,DC=LABDOM,DC=SAMBA,DC=EXAMPLE,DC=COM.ldb' -rw-rw-r--. 1 abartlet abartlet 17866752 Jan 23 20:00 'CN=SCHEMA,CN=CONFIGURATION,DC=LABDOM,DC=SAMBA,DC=EXAMPLE,DC=COM.ldb' -rw-r--r--. 2 abartlet abartlet 647168 Jan 23 19:58 'DC=DOMAINDNSZONES,DC=LABDOM,DC=SAMBA,DC=EXAMPLE,DC=COM.ldb' -rw-r--r--. 2 abartlet abartlet 6400128 Jan 23 20:00 'DC=DOMAINDNSZONES,DC=LABDOM,DC=SAMBA,DC=EXAMPLE,DC=COM.ldb-lock' -rw-r--r--. 2 abartlet abartlet 368640 Jan 23 19:58 'DC=FORESTDNSZONES,DC=LABDOM,DC=SAMBA,DC=EXAMPLE,DC=COM.ldb' -rw-r--r--. 2 abartlet abartlet 6400128 Jan 23 20:00 'DC=FORESTDNSZONES,DC=LABDOM,DC=SAMBA,DC=EXAMPLE,DC=COM.ldb-lock' -rw-rw-r--. 1 abartlet abartlet 40960 Jan 23 20:00 'DC=LABDOM,DC=SAMBA,DC=EXAMPLE,DC=COM.ldb' -rw-r--r--. 1 abartlet abartlet 6400128 Jan 23 20:00 'DC=LABDOM,DC=SAMBA,DC=EXAMPLE,DC=COM.ldb-lock' -rw-rw----. 2 abartlet abartlet 421888 Jan 23 19:58 metadata.tdb However, this will not resolve any existing corruption, for that it is best to re-join from whichever DC has not been impacted by this issue.