Bug 43280 - 98univention-samba4-dns.inst creates invalid DNS alias causing join to fail and UDM to break
98univention-samba4-dns.inst creates invalid DNS alias causing join to fail a...
Product: UCS
Classification: Unclassified
Component: Samba4
UCS 4.1
Other Linux
: P5 normal (vote)
: UCS 4.2-0-errata
Assigned To: Arvid Requate
Felix Botner
Depends on:
  Show dependency treegraph
Reported: 2017-01-03 13:21 CET by Florian Best
Modified: 2017-06-15 17:58 CEST (History)
2 users (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 6: Setup Problem: Issue for the setup process
Who will be affected by this bug?: 2: Will only affect a few installed domains
How will those affected feel about the bug?: 5: Blocking further progress on the daily work
User Pain: 0.343
Enterprise Customer affected?: Yes
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number: 2017010321002465
Bug group (optional): Cleanup, Error handling, External feedback, Workaround is available
Max CVSS v3 score:


Note You need to log in before you can comment on or make changes to this bug.
Description Florian Best univentionstaff 2017-01-03 13:21:19 CET
The script "services/univention-samba4/scripts/setup-dns-in-ucsldap.sh" which is called by the joinscripts "96univention-samba4.inst" and "98univention-samba4-dns.inst" contains the following lines:

121 if [ -n "$dc" ] || [ -n "$rodc" ]; then»»   ### determine NTDS_objectGUID
122 »   server_object_dn=$(ldbsearch -H /var/lib/samba/private/sam.ldb samAccountName="${hostname}\$" serverReferenceBL | ldapsearch-wrapper | sed -n 's/^serverReferenceBL: //p')
123 »   NTDS_objectGUID=$(ldbsearch -H /var/lib/samba/private/sam.ldb -b "$server_object_dn" "CN=NTDS Settings" objectGUID | sed -n 's/^objectGUID: //p')
124 fi

Executing this reveals on the DC Backup the following output of $server_object_dn which matches two objects, which is obviously wrong:
# ldbsearch -H /var/lib/samba/private/sam.ldb sAMAccountName="${hostname}\$" serverReferenceBL | ldapsearch-wrapper | sed -n 's/^serverReferenceBL: //p'

This causes the next issue which creates a invalid DNS alias named "._msdcs":

# /usr/share/univention-directory-manager-tools/univention-dnsedit "$@" --ignore-exists "$domainname" add cname "._msdcs" "$hostname.$domainname."
Adding CNAME record "._msdcs ucs-master-412.foobar.local." to zone foobar.local...

→ With the latest unreleased errata updates this is fixed, thanks to Philipp, Bug #25354:
~# /usr/share/univention-directory-manager-tools/univention-dnsedit "$@" --ignore-exists "$domainname" add cname "._msdcs" "$hostname.$domainname."                                                                                                                    
Adding CNAME record "._msdcs xen7.school.local." to zone school.local...
E: failed Alias: Labels must be between 1 and 63 characters long!
Traceback (most recent call last):
  File "/usr/share/univention-directory-manager-tools/univention-dnsedit", line 400, in <module>
  File "/usr/share/univention-directory-manager-tools/univention-dnsedit", line 371, in main
  File "/usr/share/univention-directory-manager-tools/univention-dnsedit", line 282, in add_cname_record
    record['name'] = name
  File "/usr/lib/pymodules/python2.7/univention/admin/handlers/__init__.py", line 261, in __setitem__
    raise univention.admin.uexceptions.valueInvalidSyntax, "%s: %s" % (self.descriptions[key].short_description, err)
univention.admin.uexceptions.valueInvalidSyntax: Alias: Labels must be between 1 and 63 characters long!

But having this invalid alias record causes, that UDM is broken:
# udm computers/domaincontroller_backup list
This is not a valid DNS entry name. A valid name can only consist of numbers, letters, dots and hyphens.

And this results in that the server can not join the domain anymore.
Comment 2 Florian Best univentionstaff 2017-01-03 15:16:05 CET
See also Bug #40457 which should be fixed as well, so that the joinscript fails and doesn't ignore such errors.
Comment 3 Arvid Requate univentionstaff 2017-04-24 19:55:45 CEST
setup-dns-in-ucsldap.sh now ignores links to '\0ACNF:' object DNs.

Advisory: univention-samba4.yaml
Comment 4 Felix Botner univentionstaff 2017-05-08 17:15:55 CEST
OK - setup-dns-in-ucsldap.sh
Comment 5 Janek Walkenhorst univentionstaff 2017-06-15 17:58:01 CEST