Error joining third zentyal v5.0 to existing zentyal 4.2 (PDC and BDC)

[gsukrawan]

Hi,

We already have 2 zentyal server 4.2 that already working well.
We have a plan to upgrade to zentyal 5, by installing third new server based on zentyal 5 then join our existing domain. 

Our machine is using Proxmox Virtual Environment 4.4-13

Some question that I have:
1. At previous setup for our zentyal 4.2, we have set third zentyal for additional BDC, but the replication seems not working, then we decide to remove second BDC, after that everything works well
Is it mean that Zentyal only support 2 server at the moment (1 PDC & 1 BDC)?

2. Is there a way to check if our dead previous zentyal server still affecting our current zentyal 4.2 domain?

2. This new server I started using VM (ubuntu server 16.04) and new Name & IP address.
but since first installation it like not working,


Is anyone have same problem like me at first installation as Additional Domain Controller?

I desperately need to make this Zentyal 5.0 working with my current Domain.
Thanks for all your support

Here are some highlight log from /var/log/zentyal/zentyal.log
for full log, please check attachment

2017/03/27 08:11:44 ERROR> Sudo.pm:240 EBox::Sudo::_rootError - root command /usr/sbin/ntpdate 0.pool.ntp.org failed.
Error output: Exiting, name server cannot be used: Temporary failure in name resolution (-3)27 Mar 08:11:44 ntpdate[9618]: name server cannot be used: Temporary failure in name resolution (-3)

2017/03/27 08:11:45 INFO> Provision.pm:1306 EBox::Samba::Provision::provisionADC - Trying to get a kerberos ticket for principal '[myUser]@[myDomain.net]'
2017/03/27 08:11:45 INFO> Provision.pm:1315 EBox::Samba::Provision::provisionADC - Executing domain join
2017/03/27 08:11:51 ERROR> Sudo.pm:240 EBox::Sudo::_rootError - root command samba-tool domain join [myDomain.net] DC  --username='[myUser]'  --workgroup='[myDomain]'  --password=`cat /var/lib/zentyal/tmp/xxxxx`  --server='[myPDC_IP]'  --dns-backend=BIND9_DLZ  --realm='[myDomain.net]'  --site='Default-First-Site-Name'  failed.
Error output: GENSEC backend 'gssapi_spnego' registered

Replicated 1552 objects (0 linked attributes) for CN=Schema,CN=Configuration,DC=[myDomain],DC=net
 Partition[CN=Configuration,DC=[myDomain],DC=net] objects[402/1677] linked_values[0/0]
 Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=[myDomain],DC=net
 Partition[CN=Configuration,DC=[myDomain],DC=net] objects[804/1677] linked_values[0/0]
 Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=[myDomain],DC=net
 Partition[CN=Configuration,DC=[myDomain],DC=net] objects[1206/1677] linked_values[0/0]
 Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=[myDomain],DC=net
 Partition[CN=Configuration,DC=[myDomain],DC=net] objects[1608/1677] linked_values[0/0]
 Replicated 402 objects (0 linked attributes) for CN=Configuration,DC=[myDomain],DC=net
 Partition[CN=Configuration,DC=[myDomain],DC=net] objects[1677/1677] linked_values[100/0]
 Replicated 69 objects (100 linked attributes) for CN=Configuration,DC=[myDomain],DC=net
 Partition[DC=[myDomain],DC=net] objects[102/102] linked_values[30/0]
 Unxpectedly got mismatching RDN values when checking RDN against name of CN=Guest,CN=Users,DC=[myDomain],DC=netFailed to convert object CN=Guest,CN=Users,DC=[myDomain],DC=net: WERR_GENERAL_FAILURE
 Failed to convert objects: WERR_GENERAL_FAILURE
 ldb_wrap open of secrets.ldb
 Could not find machine account in secrets database: Failed to fetch machine account password for [myDOMAIN] from both secrets.ldb (Could not find entry to match filter: '(&(flatname=[myDOMAIN])(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4575) and from /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
 ERROR(runtime): uncaught exception - (31, "Failed to process 'chunk' of DRS replicated objects: WERR_GENERAL_FAILURE")
   File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line 176, in _run
     return self.run(*args, **kwargs)
   File "/usr/lib/python2.7/dist-packages/samba/netcmd/domain.py", line 652, in run
     machinepass=machinepass, use_ntvfs=use_ntvfs, dns_backend=dns_backend)
   File "/usr/lib/python2.7/dist-packages/samba/join.py", line 1253, in join_DC
     ctx.do_join()
   File "/usr/lib/python2.7/dist-packages/samba/join.py", line 1153, in do_join
     ctx.join_replicate()
   File "/usr/lib/python2.7/dist-packages/samba/join.py", line 890, in join_replicate
     replica_flags=ctx.domain_replica_flags)
   File "/usr/lib/python2.7/dist-packages/samba/drs_utils.py", line 258, in replicate
     schema=schema, req_level=req_level, req=req)

Unxpectedly got mismatching RDN values when checking RDN against name of CN=Guest,CN=Users,DC=[myDomain],DC=netFailed to convert object CN=Guest,CN=Users,DC=[myDomain],DC=net: WERR_GENERAL_FAILURE
 Failed to convert objects: WERR_GENERAL_FAILURE
 ldb_wrap open of secrets.ldb
 Could not find machine account in secrets database: Failed to fetch machine account password for [myDOMAIN] from both secrets.ldb (Could not find entry to match filter: '(&(flatname=[myDOMAIN])(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4575) and from /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO

Starting replication
 Replicating critical objects from the base DN of the domain
 Join failed - cleaning up
 Deleted CN=ZDC3,OU=Domain Controllers,DC=[myDomain],DC=net
 Deleted CN=dns-ZDC3,CN=Users,DC=[myDomain],DC=net
 Deleted CN=NTDS Settings,CN=ZDC3,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=[myDomain],DC=net
 Deleted CN=ZDC3,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=[myDomain],DC=net
.
Exit value: 255 at /usr/share/perl5/EBox/Sudo.pm line 240
EBox::Sudo::_rootError('/usr/bin/sudo -p sudo: /var/lib/zentyal/tmp/6RSG9Qlm_S.cmd 2> /var/lib/zentyal/tmp/stderr', 'samba-tool domain join [myDomain.net] DC  --username=\'[myUser]\'  --workgroup=\'[myDOMAIN]\'  --password=`cat /var/lib/zentyal/tmp/xxx`  --server=\'[myPDC_IP]\'  --dns-backend=BIND9_DLZ  --realm=\'[myDomain.net]\'  --site=\'Default-First-Site-Name\' ', 65280, 'ARRAY(0x8cd5e30)', 'ARRAY(0x8ad73b0)') called at /usr/share/perl5/EBox/Sudo.pm line 210

2017/03/27 08:11:52 ERROR> GlobalImpl.pm:661 EBox::GlobalImpl::saveAllModules - Failed to save changes in module samba: root command samba-tool domain join [myDomain.net] DC  --username='[myUser]'  --workgroup='[myDOMAIN]'  --password=`cat /var/lib/zentyal/tmp/xxx`  --server='[myPDC_IP]'  --dns-backend=BIND9_DLZ  --realm='[myDomain.net]'  --site='Default-First-Site-Name'  failed.
Error output: GENSEC backend 'gssapi_spnego' registered

 Failed to convert objects: WERR_GENERAL_FAILURE
 ldb_wrap open of secrets.ldb
 Could not find machine account in secrets database: Failed to fetch machine account password for [myDOMAIN] from both secrets.ldb (Could not find entry to match filter: '(&(flatname=[myDOMAIN])(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4575) and from /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO

[gsukrawan]

Finally I can join my new Zentyal 5.0

some step that I use

-- edit file /etc/krb5.conf in new BDC
[libdefaults]
        default_realm = MYDOMAIN.NET #<- make sure this allcaps
        dns_default_realm = false
        dns_lookup_kdc = true
        dns_lookup_realm = false
        rdns = no

-- test your login
#kinit myuser
if it not showing warning, then check with
#klist
Credentials cache: FILE:/tmp/XXXXX_0
        Principal: myuser@MYDOMAIN.NET

  Issued                Expires               Principal
Apr 11 14:04:06 2017  Apr 12 00:04:00 2017  xxxxxx/MYDOMAIN.NET@MYDOMAIN.NET

-- Add DNS for new BDC from zentyal PDC web panel, check with nslookup

-- join from terminal
#samba-tool domain join MYDOMAIN.NET DC -U"MYDOMAIN\myuser" --dns-backend=BIND9_DLZ --server='[PDC_IP]'

-- disable and enable "Domain Controller and File Sharing" module status from Zentyal web panel

-- check replication status
#samba-tool drs showrepl

this site help alot
http://www.golinuxhub.com/2014/02/how-to-configure-samba-4-secondary.html
maybe if you find another problem, you can try some step on those website

[gsukrawan]

Forgot to mention, I can successfully joined the domain, but when I test created user in new BDC (server3), the new user is not replicated to PDC and BDC.
but user created in PDC and BDC is replicated to server3.

simple fix:
open zentyal web panel in your PDC
go to DNS > then go to Forwarders section
add your new BDC (server3) ip address.