Re: Samba RODC 4.22.6 (debian 13) seems writeable...

On Thu, 26 Mar 2026 16:48:01 +0000
Antoine ALBERTINI via samba <[email protected]> wrote:

> Hello,
> 
> We are testing a small samba DC deployment. The target will be to
> provide RODCs to our subsidiaries, possibly running Samba on linux.

Why RODCs ? Are you expecting them to be stolen ?

> 
> It consists of a Windows DC (2016), a couple of Samba RWDC (Debian
> 13, samba 4.22.6-Debian-4.22.6+dfsg-0+deb13u1) and a single Samba
> RODC (same version).

You might want to investigate Samba from backports, that will get you
4.23.6 and a newer Samba is always better.

> 
> (Note: each Samba is in a Debian 13 virtual machine, but installed as
> a docker app, with a docker image built "by hand" starting with a
> debian:trixie and then an apt-get install samba )
> 
> Everything is in the same subnet, in the same Active Directory site
> for simplicity.
> 
> Everything works fine, it replicates ok, sysvols are ok, DNS is ok,
> either in windows or in linux samba. Kerberos is ok. FSMO are all on
> a Samba RWDC. Functional level is windows 2016. 1 single forest with
> a single domain, created first in the Windows DC , then I joined the
> Sambas.
> 
> My issue is that when connected to a Windows client (either a win11
> PC or in RDP on the windows DC), when I do modifications / creations
> / deletions with ADUC pointing to the RODC, I have an error message
> (for example "windows cannot delete object XXX because there is no
> such object on the server"), but the modification / deletion /
> creation is applied...

Are you sure it isn't getting passed to an RWDC and replicated back ?

> 
> The RODC has been joined to the domain with a DOCKER JOIN RODC,
> pointing on the windows server. It appears a RODC in windows.
> 
> The smb.conf on the RODC, the only difference is that I put read-only
> in sysvol and netlogon.
> 
> [global]
>   workgroup = SAMBADEV
>   realm = sambadev.vccs
>   netbios name = samba-rodc2
>   server role = active directory domain controller
>   ad dc functional level = 2016
> 
> 
> [sysvol]
>   path = /var/lib/samba/sysvol
>   read only = yes
> 
> 
> [netlogon]
>   path = /var/lib/samba/sysvol/sambadev.vccs/scripts
>   read only = yes
> 
> Have I missed something to prevent writing to it?

Not that I can see.

> 
> If docker is an issue, no problem, I can remove the docker rodc and
> apt-get install directly in the VM, but it was to be able to remove
> it a bit cleaner.
> 

I cannot see docker being the problem.

Rowland


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba