Re: [Samba] Issues with RODC
- Date: Sun, 5 May 2019 10:13:07 -0300
- From: Emerson Kfuri via samba <samba@xxxxxxxxxxxxxxx>
- Subject: Re: [Samba] Issues with RODC
On Sun, May 5, 2019 at 9:52 AM Rowland Penny via samba <
> On Sun, 5 May 2019 09:20:37 -0300
> Emerson Kfuri via samba <samba@xxxxxxxxxxxxxxx> wrote:
> > Hello,
> > Recently I started using RODC servers on my environment and noticed a
> > few issues with it:
> > - lack of LDAP SPNs
> > - "samba_dnsupdate" not working with "insufficient access rights" (it
> > works from RWDCs)
> Probably because you cannot write to an RODC
Yes! That's the idea! But if these records are not automatically
registered, means admin always have to add them manually. This should be
> > - "samba-tool dbcheck" changes instancetype of basically all objects
> > from 4 to 0.
> '4' means 'The object is writeable on this directory.', well it isn't on
> an RODC, so '0' is probably correct.
> > New replicated objects continues being created with instancetype 4
> > and dbcheck continues to change them
> See above.
So why not create these objects already with instancetype 0?
> > - "samba-tool drs showrepl" exiting with WERR_DS_DRA_ACCESS_DENIED
> Replication is one way into the RODC
> > - "samba-tool domain tombstones expunge" is unable to expunge expired
> > deleted objects
> This may be a problem, but then again it might not be, to 'delete' you
> have to have 'write', but you cannot write to an RODC.
And how to prevent the database from accumulating garbage?
> Are you using the RODC's in the same site as your RWDC's ?
> If so, why ?
> RODC's are meant to be used where there are security and/or other
> concerns, so if you have RWDC's at the same place, why use RODC's ?
I have 3 sites and all of them has an RWDC and at least one RODC. I use
multiple RWDCs to balance write load and multiples RODCs to reduce
replication flow. Because of my database size and number of simultaneous
clients, I needed to grow the number of controllers to balance LDAP queries
since servers became unresponsive due to LDAP memory leaks.
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba
To unsubscribe from this list go to the following URL and read the