Zentyal Forum, Linux Small Business Server
Zentyal Server => Installation and Upgrades => Topic started by: ian on January 31, 2009, 09:17:38 pm
-
Hello,
I have an eBox server with several windows xp client computers, it works fine.
The problem now, when i build a new eBox server from scratch and i restore my backup taken from the old server, every thing is restored exept the windows client computer accounts it means that the windows xp clients could not connect to the eBox domain controller anymore.
How could this be solved ? Where are the client computer accounts stored on the server ?
I could work it out by putting every windows xp client workstation back in the domain again, but it is not a nice solution.
Is there a solution for this problem ?
Thanks
-
Same problem here.
The restore imports the machine accounts only in posix but all entries with samba (like sambaNTpassword etc) fail.
i checked it with phpldapadmin.....
have anyone a solution?
-
ok, after a lot of hours, i think i have a workaround....
it seems, that some parts of the syntax of the ldap.ldif file, created by ebox, are wrong.
i had to delete 3 user entries in the ldif, before it worked.
the export of one of the passwords (only numbers) failed too. instead of the password, ebox exported the hash.
my scenario:
i ported an ebox from ubuntu 8.04 32bit to ubuntu 8.04 64bit, with 12 users and some network shares.
i have installed "ebox-samba" with his dependencies.
as the configuration restore failed, i got a little desperated, so i tried the 32bit version again, because i thought "maybe there are 2 different versions of ldap in 32bit and 64bit" but it wasn't - the restore failed too.
so i got a nice weekend to get the server running again...
At first, it's the ldif file, created by ebox causes the problems.
its a "try and error" routine, to find out, whats wrong in the ldif file.
you have to pass the next following steps until "slapadd -l"
if slapadd tells you something like "error line xxx"you must delete this entry in the ldif file (the whole section of the user, not only the line)
i also deleted the first entry in the ldif file:
dn: dc=ebox
objectClass: top
objectClass: dcObject
objectClass: organization
o: warp
dc: ebox
structuralObjectClass: organization
entryUUID: 9a79842c-088d-102d-8807-35d6366187c8
creatorsName: cn=admin,dc=ebox
createTimestamp: 20080827141010Z
entryCSN: 20080827141010.204442Z#000000#000#000000
modifiersName: cn=admin,dc=ebox
modifyTimestamp: 20080827141010Z
after restoring ebox you must add the deleted users by hand....
you find the ldif file in the tar archive in files.tgz -> users.bak
there is also a list of backuped modules in the tar archive under "modules"
if your ldif file seems to be ok, it's a good idea to setup the machine again (FIRST, SAVE THE FILE TO ANOTHER COMPUTER!!!)
here is the workaround (i had a fresh ubuntu 8.04 64bit):
i installed "ebox-samba"
aptitude install ebox-samba
i installed phpldapadmin to check the entries in ldap and delete it, if something went wrong
aptitude install phpldapadmin
i found an interesting article in the ebox trac, what to do, when ebox restore fails:
http://trac.ebox-platform.com/wiki/Document/HowTo/WhatToDoWhenRestoringABackupFails (http://trac.ebox-platform.com/wiki/Document/HowTo/WhatToDoWhenRestoringABackupFails)
stop the slapd
/etc/init.d/slapd stop
now, use the cleaned up ldif file and restore the users, groups and computers to ldap
slapadd -l file.ldif
start the slapd again
/etc/init.d/slapd start
then you have to restore the modules except the modules "users"
in my case i restored:
/usr/share/ebox/ebox-restore-backup --module sysinfo --module network --module samba --module objects --module apache --module services --module global --module events eboxbackup.tar
now check your entries with phpldapadmin (eg: under Computers the sambaNTpassword)
http://yourserver/phpldapadmin
you will find the password for ldap in
/etc/ldap/slapd.confand look for the entry
rootpw
copy and paste the password to your phpldapadmin login.
if there are some problems delete with phpldapadmin ALL entries, except of "dc=ebox"
and do the following steps again:
stop the slapd
/etc/init.d/slapd stop
now, use the cleaned up ldif file and restore the users, groups and computers to ldap
slapadd -l file.ldif
start the slapd again
/etc/init.d/slapd start
so, thats it!
i hope this can help somebody else....
-
Any chance you could send me that ldif to juruen at ebox-platform dot com ? It would help us a lot to track down the issue :)
Oh, and tell us the exact eBox version you are using :)
-
the ebox version was 0.12.4
and ebox-samba 0.12.6.101
this was the last version from the ppa repository
-
Hi,
We have just figured out what the problem was with the password. It seems that your user changed his password through windows.
If you were using an old version of eBox in your original machine, there was a bug related to password synchronization between windows and passwords stored in ldap.
This misconfiguration made ldap store the password using a different algorithm. So when the user changed his password through windows, its password got changed with another algorithm and its length was longer than expected.
Backups coming from new eBox version shouldn't have this issue.
Thanks a lot for sending all the info. It's been very helpful :)
-
The problem now, when i build a new eBox server from scratch and i restore my backup taken from the old server, every thing is restored exept the windows client computer accounts it means that the windows xp clients could not connect to the eBox domain controller anymore.
Thanks for your report Ian. We have a bug i nthe restore process and we left out some of the neccesay data. We will try to fix it soon
-
Hi,
We have just figured out what the problem was with the password. It seems that your user changed his password through windows.
If you were using an old version of eBox in your original machine, there was a bug related to password synchronization between windows and passwords stored in ldap.
This misconfiguration made ldap store the password using a different algorithm. So when the user changed his password through windows, its password got changed with another algorithm and its length was longer than expected.
Backups coming from new eBox version shouldn't have this issue.
Thanks a lot for sending all the info. It's been very helpful :)
ah, ok!
thx for the information and for the fast answer!
good to know, what happened.....
if you need further information, please contact me.
also thx for this great project. it makes administration much more easier....
-
Hi,
I think that the answers are near the question.
Th problem is only with computer accounts, the backup does not include the windows Xp computer accounts included when an Xp workstation is put in the domain.
There is no problem with the normal user accounts or there password, in case of a backup and restore.
If y use f.e " mondorescue "open source software on an eBox PDC server, than the computer accounts are corectly backupped and restored. The difference between the backup utility from eBox and mondorescue is that mondo recue works with backup on bit level. So if the eBox backup utility was changed with the correct level of backup for the computer accounts ( bit level ) than the problem is solved.
The backup tools of eBox gives some times an error even the backup and restore works correct and the backupped files are correctly restored.
-
I have the same problem. :-[
i don't know if it's because i forgot to update ebox before running the backup, or if this bug still hasn't been repaired, but what it means is that I must rejoin all the pcs to the domain if i restore from backup on a new server.
What should be done, report as a bug?
-
kerridge0,
We are working on it :)
-
Thanks, Javi
I just had a thought - since i've still got access to the old server (I just backup/restore to move into kvm on a proxmox host) is there a way to export/import this machine account info into the new server and save me trudging around the office giving a three finger salute to 30-odd PCs this weekend?
for example using some ldap tools mentioned upstream?
-
Hi again,
I just had a thought - since i've still got access to the old server (I just backup/restore to move into kvm on a proxmox host) is there a way to export/import this machine account info into the new server and save me trudging around the office giving a three finger salute to 30-odd PCs this weekend?
If you only problem is that the machine accounts have not been restored properly but the user accounts have, there's an easy solution.
1. Get the ldif file you will find within the eBox backup.
2. sudo /etc/init.d/slapd stop
3. sudo rm -rf /var/lib/ldap/*
4. sudo slapadd < ldap.ldif
5. sudo /etc/init.d/slapd start
That should restore all the machine accounts unless we are missing something :)
Hope this works and you dont have to salute the 30 PCs :)
-
Hi
when importing i did get the following warning(?)
/etc/ldap/slapd.conf: line 98: rootdn is always granted unlimited privileges.
and now when I check users or groups I get the following:
"An internal error has ocurred. This is most probably a bug, relevant information can be found in the logs"
..
-
the logs state:
Feb 28 16:52:29 brighton1 slapd[25622]: /etc/ldap/slapd.conf: line 98: rootdn is always granted unlimited privileges.
Feb 28 16:52:29 brighton1 slapd[25623]: hdb_db_open: database "dc=ebox": alock package is unstable.
Feb 28 16:52:29 brighton1 slapd[25623]: backend_startup_one: bi_db_open failed! (-1)
Feb 28 16:52:29 brighton1 slapd[25623]: slapd stopped.
Feb 28 16:52:29 brighton1 slapd[25623]: connections_destroy: nothing to destroy.
I did follow the above instructions after winscp'ing the ldif file into /root
Should I restore my backup i made after reinstalling ebox and restore the whole backup again?
-
Sorry, I'm telling you this without testing in my machine :(. I think i forgot two extra steps.
1. In your new machine get the new ldap password stored in /var/lib/ebox/conf/ebox-ldap.passwd
2. Get the ldif file you will find within the eBox backup and change the userPassword line of dn: cn=admin,dc=ebox to userPassword: NEW_PASSWORD. Note that you must only leave one ':'
3. sudo /etc/init.d/slapd stop
4. sudo rm -rf /var/lib/ldap/*
5. sudo slapadd < ldap.ldif
6. sudo chown -R openldap.openldap /var/lib/ldap <- New step
7. sudo /etc/init.d/slapd start
-
funilly enough i've actually been here before with openldap.. solution was to
sudo chown openldap.openldap /var/lib/ldap/*
now i'll be able to check if this was resolved when i pop into the office.
aha <edit> got your new reply.. will update password..
thanks!
-
So if the eBox backup utility was changed with the correct level of backup for the computer accounts ( bit level ) than the problem is solved.
In previous version we copied the ldif file, as Javi has explained below, however sometimes we had ldap compabilities between eBox versions and to avoid those problems now we parse th ldap file and recreate the data.
However when I developed the restore process for users and computer accounts I forgot that some data must be copied verbatim because is introduced by the windows clients.
-
well i changed the password line to read:
userPassword: ebox****96841436164
and repeated the same process but now i get a new error,
to be honest I'm not sure whether I have introduced these problems via this procedure, i might have had it earlier, as i didn't test directly before or after the restore, (and the reason i am moving vm is because i was also running fog [fogproject.org] in this machine which had it's own web interface which seemed to break only images on ebox but that's all- but i'm not sure whether i'd had this problem..) when i try and edit the user/group via eg https://192.168.8.2/ebox/UsersAndGroups/Groups, i get the listing fine but as soon as i click the pencil to edit the group I get: An internal error has ocurred. This is most probably a bug, relevant information can be found in the logs.
An internal error related to a template has occurred. This is a bug, relevant information can be found in the logs.
the /var/log/ebox/error.log shows that for groups
this error is:
[Sat Feb 28 18:12:52 2009] [error] [client 10.10.0.2] File does not exist: /usr/share/ebox/www/images/thead-b.png, referer: https://192.168.8.2/ebox/UsersAndGroups/Groups
and for users:
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/EBox/MailAliasLdap.pm line 291.
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/EBox/MailAliasLdap.pm line 291.
creating a new user gives this error:
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/HTML/Mason/Component/Subcomponent.pm line 34.
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/HTML/Mason/Component/Subcomponent.pm line 34.
Hmmm.
:-\
<edit> given latest response I can see that maybe i'll need to re-run the restore officially due to version mismatches? should i do that and then maybe do a slightly different slapcat stripping out some windows client stuff? would that even be possible?
-
maybe i should load up the old ebox installation, update it to the latest, then save a backup, and then follow javi's 7 steps on the diff in there? Would that sort me out?
-
Maybe it's better if you wait a few days till we fix this issue and you go back to the old installation in the meanwhile?
We are going to be working on this real soon. It should be fixed during next week.
-
That's great, i'll watch the thread, thanks!
-
Hi is there any follow up to this/ has the script been updated? as i'm planning to migrate another server tonight if you've sorted it.
-
Hi,
Hi is there any follow up to this/ has the script been updated? as i'm planning to migrate another server tonight if you've sorted it.
I've just uploaded a new version to our unstable repository. I've tested it with two windows machines I have here, and it has worked.
Note that those packages in our unstable repository will make it to stable very soon. It would be fantastic if you can try them and tell us if it restored your machine accounts successfully.
Please, don't install ebox-egroupware to do this for now. There's an issue with the backup we are fixing.
-
if i do this shall i backup/restore as normal and after that get the "unstable" ldap import script.
where iis the parse script? I had a search but couldn't find on the forum
I then need to run that on the ldif i extract from the backup tar, right, after deleting the ldap directory. and i can test after resetting permissions etc.
-
if i do this shall i backup/restore as normal and after that get the "unstable" ldap import scrip
Javi (the other) has uploaded the new package, not a script. So if you want to give it a try you must install it and proceed as normal
Here you have the repository (https://launchpad.net/~ebox-unstable/+archive/ppa) and the package is ebox-samba - 0.12.102-0ubuntu1~ppa1~hardy1
-
so install unstable on the new server, and restore backup to that.
These are production servers, but you're saying that they are very close to stable,
Can I then get back on to the stable track after that?
because if not i could just do it for a test and then wait for it to become stable.
-
Well the fix was only in one source file so if you want to play it safr we could try to install only th file that has changed.
To do so,
1) make a backup copy of /usr/share/perl5/EBox/Samba/ImportFromLdif.pm
2) overwrite the file which this one (http://trac.ebox-platform.com/export/12748/trunk/client/samba/src/EBox/Samba/ImportFromLdif.pm)
3) restart ebox web server with: /etc/init.d/ebox apache restart
Try the resotre process now and if it fails you could alway undo the changes copyng back the old file and restarting apache
-
great, the new restore script worked perfectly!!! thanks for your work.
Also, I have a couple of interesting experiences i just had, to report:
* the first being that I for some reason assumed you could scp the backup tar to the backups folder and restore that. When that failed i assumed the installation was corrupt and proceeded to reinstall ebox. This was because I was trying to avoid crashing my browser waiting for it to upload a 1 gig file to the server - perhaps this second way of scp'ing the tar file behind the scenes could be allowed? anyway it's a user error but maybe you could do something there- perhaps warn that the backup seems to be from another installation and ask whether user wanted to restore from it anyway.
* to conveniently trim down the user profiles on the donor machine prior to backup/restore, I created a new share called "profiles". unfortunately, this overrode the standard "profiles" share which is used to enable user profiles in an MS network. For a minute on restoring i thought something new was broken because user profiles couldn't be loaded. then i remembered what i had done, and turned it off, and everything worked again.. So really this stupid behaviour needs to be forbidden i guess :) check while creating?
anyway i'm on my new hardware running as a kvm machine on a proxmox host and would like to thank again for support getting through this.
Kerry
-
* about your backup from anothet installation... I had to see the error log to see what were wrong. We try to make the backups compatible between machines.
* as for the profiles thing, in newer versions the porfiles will only be stored on 'full backups' to avoid space probelms and bz they are not essential to the configuration of the server
Thnks a lot for your comments
-
Well i like the fact that profiles are backed up with a configuration backup, but not all the shares, I found it very convenient and i just rsync'ed the shares seperately. Perhaps the updated script could let you tick off whatever you wanted to backup/restore from a list?
The backup i made worked between versions, but only using the "Restore backup from file" option, and uploading, rather than by scp'ing the backup file into /var/lib/ebox/conf/backups, refreshing the page and restoring that backup which appeared there. I couldn't clearly identify the log entry but i attach both logs.
-
Thank a lot for post your logs. In your ebox.log I saw only one restore process so I think I misunderstood you and maybe your problem were that the backup weren't listed after reloading the page?.
In that case maybe it hadn't the right permissions, the backups should be readeable by the 'ebox' user, otherwise they aren't listed and couldn't be restored.
This were the problem or I am missing something?
-
Hi-
I did change the ownership to match, but not permissions (ie still readonly group and other) and try again, to be the same as the other. I got a red error come up:-
"Your request could not be processed because it lacked some required parameters"
yet with the same backup file uploaded through web interface, i didn't get that error.
-
can i confirm that this is still true, you can't scp the backup file and then change permissions and restore it, you have to do it via web interface.
also, the netlogon share isn't backed up- this would be handy as login scripts and default profile can go here for a domain setup...
-
Thanks again for your report, kerridge. I think I have found where is the error and I am working to fix it.
In the meantime yo ucan try this to restore your backup:
- put in the backup directory
- make sure is readeable by user 'ebox'
- change its name to 1111.tar (or another number)
- reload the page
I think that with this recipe the backup should appear on the list
-
well the backup always does appear on the list - I will try this when i migrate the second server - but is there a way for me to look in to where the logic is failing? nothing appears in the logs with that "request cannot be processed" message it seems...
-
Well, the error is that the inernal code does not manage well filenames, instead of trying to quote them, it raises error if some characters are present in the filename...
Until it is fixed, simpel filenames like the one I suggested should do the trick
-
maybe it's if there is already a backup there with a description that isn't just numbers? because before i restore, i create a backup first. i'll try creating a backup that consists of numbers in it's description first...
-
it didn't work, but when i created tha backup i gave it the description "movetoday" i'm going to try it again with the description "11111"
filename always comes out as numbers.tar
-
ok tried again, still no go, here are my supporting screenshots in case you think i'm insane.
(http://kerchan.com/images/eboxRestoreErrorIe.JPG)
(http://kerchan.com/images/eboxBackupDirWinscp.JPG)
-
You're right the names are correct so it must be another thing. If there is not sensible data in your backup you could mail it to me so I can look at it.
-
before i try and set this up, I should say that i'm personally very happy about this backup/restore because i've been able to restore using the web interface upload feature.
Have you tried to do this on the latest version? scp backup from from another ebox and then restore from list using ui. If it works then maybe it's just a quirk of the old -> new version that we don't need to worry about.
(otherwise i don't really fancy sending you a 223 Meg file which is the smallest old backup i have, would have to set up another example :) )
-
Hi,
Is there already a good solution for the backup problem ?
As a work around i have made a backup of the map /etc with the utility " mondoarchive " and restored this map with the sam utility " mondorstore" , then the computer accounts of the windows Xp workstations are working again.
Still the backup utility of eBox is not working corectly, somtimes not all the shares and there content are bakupped, and thus also not restored.
Is this an option ?:
Install webmin on the eBox file and print server, then make a backup of the configuration ( users accounts groups share definitions etc. ) with the backup tool of eBox and all the data and shares backupped by webmin.
Is a nested share also be backupped ?
Share : rapporten with sub maps rapporten1LA, rapporten1LB etc, where rapporten is ahared and the sub maps are also individual shared. The goal is to give a user access to rapporten with the two submaps, an a user giev acces only to the submap rapporten1LA. ?
I am trying to setup an operational server for our elemantery school , but solong the backup system is not relyable, it is a risc so i hope to have a good backup solution asap.
Thans
-
I don't think anyone here is having any problems with the backups like you describe?
The only problems I have had are:
* restoring onto a new server which had a different version of ebox meant that (windows domain) machine accounts weren't retored - this was resolved by the methods described above
* you have to use the web interface to upload the restore file which can take a while if there are lots of files to restore.
Regarding your problem with the file shares and nested file shares not being backed up/restored, I personally would use another method to back these up, perhaps backuppc? because you also probably want historical backups of this data (grandfather/father/son?) and this can't be provided by ebox backup.
Kerry
<edited because i said something inappropriate because it was Ian's thread in the first place :-[>
-
Hello kerridgeo,
There is still aproblem with the backup of eBox, like i first posted end of januari.
I have done the following tests:
Installed eBox on Ubuntu server 8.04, on a intel P4 platform.
Configured several users, groups and shares ( also nested shares ), the server is configured as a primary domain controller and there are several windows Xp computers added to the domain.
Then i made a full backup, using the backup utility of eBox. saved the backup file on a external hard disk.
Next i installed a new server from scratch, on the same hardware platform as above. Same ubuntu server version 8.04 and same eBox version. So the second server was indentical to the first server.
I restored the backup file to the new server, at that monent the users groups and shares where restored but the windows computer accounts are not restored. So here is a problem.
Running the same test severeal times, results some times with not correct restored shares.
Then i installed " mondo " open source on the server ( this application make a archive and restore of files on bit level possible ).
When i make a mondoarchive of the map /etc from the server ( as you now all the configuration files are in that map ), en on the second server i did a mondorestore of the /etc map ( afther the configuration of the new eBox server and restore of the ebox backup file on the second server ) then the computer accounts of the domain are restored on the second server and all functions work correct now.The windows xp computers can connect to the domain again on the new server.
So far the only possibility to backup and restore of computer accounts was with the " Mondo " software.
It happends several time that the eBox backup restore give some errors while every think has no problems and the the restore was correct done, some times the shares are not backupped correctly with eBox several shares are not in the backup file.
Is there sinds end of januari a correction for this problem and where can i find the approved file ?
As long that the backup/restore utility is not relliable, there is a risc to use the server in an operational environment.
I hope soon to have a good solution, because eBox is a verry good system for use as a schoolserver, and it has a user friendly administrator interface.
Hav you some experience with " backuppc " ? can it be used for a complte backup of the eBox server ( data and configurartion ) ?
Thanks,
Ian
-
Hi Ian
well i think backuppc can make a full backup but as i say personally I use it just to backup the shared folders (actually /home/samba/shares because i only use those shares created via file sharing - shares and keep them all in there..). I run backuppc on another server, following it's documentation, it was surprisingly easy to set up.
I use the ebox backup facility to backup the whole system state including computer accounts.
In order to get the computer accounts bit to work you need to replace
/usr/share/perl5/EBox/Samba/ImportFromLdif.pm
with this file
http://trac.ebox-platform.com/export/12748/trunk/client/samba/src/EBox/Samba/ImportFromLdif.pm
once you've replaced that file, then run your restore, it should work fine- although i can't guarantee that the shares will be restored if you backed those up because i haven't tested that part...
-
Hi guys,
I wouldn't recommend the use of the "Full backup" feature of eBox on production if you are using Samba. Instead of that, use eBox to backup the configuration, and use another method to backup your data.
Ian, I'll try to reproduce your issue tomorrow.
I'll get back to you soon :)
-
Hello,
I have done some tests with the latest eBox version 1.0,
The backup of the configuration is now ok, all the settings, accounts, acl's , refences of the server, and the computer accounts aswell are backupped, and afther a reinstallation of a brand new system the restore works correct now all the settings accounts etc. are restored.
I have used only the configuration backup of eBox, for the backup of the data Webmin was installed, and works correctly for backup and restore of the data ( inclusif the shares and there content and the user file rights ). In Webmin the data backup could be automated.
Installing extra software on an eBox server could be handy:
Install Webmin ( extra tool, and backup/restore utility, not for eBox configuration information use only).
Install gparted ( to handle extra harddrive's ).
Install phpmyadmin ( Mysql database tool )
Install xorg , lxde , gnome terminal, firefox , smb4k ( usefull verry small desktop with webbrowser, terminal windows etc ), anly active by manualy intervenstion on the server ( startx, command ) .
[bSome questions:][/b]
On an eBox version 0.12, is the file " ImportFromLdif.pm " automaticaly replaced with the corected file by the execute of the eBox " Software management " utility system update, or is it always needed to download and replace the file manualy ?
Suggestion,
By eBox install, implement the option to make a choise of the modukes you wich to install, depending on the type of eBox server installation you prefered ( only file and print server, DHCP or withouth DHCP etc . ).
I think that the server is ready for practical use now.
Thanks for the help, for me the backup/restore post could be closed as solved.
Best regards,
Ian
-
I have done some tests with the latest eBox version 1.0.
Thanks for your report. I'm wondering, is it possible to backup using v0.12 and restore to a newly installed v1.0?
-
Steph,
I have tried out, upgrade from v0.12 to v1.0.
It works fine whithout any problems, all the settings ( configuration, users passwords shares etc. )are still ok afther the upgrade.
Finaly your system hase all the new features of v 1.0.
Best regards,
Ian