Re: replication broken, can't contact local ldap server on one dc

Am 27.03.26 um 12:39 schrieb Rowland Penny via samba:
> On Fri, 27 Mar 2026 11:59:12 +0100
> Thorsten Marquardt via samba <[email protected]> wrote:
>
>> Hi,
>>
>> I use a samba domain (4.22.6-Debian-4.22.6+dfsg-0+deb13u1) with two
>> dc's (srv-kb-dc1 and srv-kb-dc2) and have trouble with drs
>> replication:
>>
>> root@srv-kb-dc1:/usr/local/share/ca-certificates# samba-tool drs
>> uptodateness
>> DOMAIN          maximum: 0  median: 0.0  failure: 0
>> CONFIGURATION   maximum: 0  median: 0.0  failure: 0
>> SCHEMA          maximum: 0  median: 0.0  failure: 0
>> DNSDOMAIN       maximum: 0  median: 0.0  failure: 0
>> DNSFOREST       maximum: 0  median: 0.0  failure: 0
>>
>> samba-tool drs uptodateness
>> Failed to connect to ldap URL 'ldap://srv-kb-dc2.local' - LDAP client
>> internal error: NT_STATUS_CONNECTION_REFUSED
>> Failed to connect to 'ldap://srv-kb-dc2.local' with backend 'ldap':
>> LDAP client internal error: NT_STATUS_CONNECTION_REFUSED
>> [...]
>> missing dn
>> CN=SRV-KB-DC2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=local
>> from UTD vector list
>> DOMAIN          maximum: -231585  median: -231585.0  failure: 1
>> CONFIGURATION   maximum: -231585  median: -231585.0  failure: 1
>> SCHEMA          maximum: -231585  median: -231585.0  failure: 1
>> DNSDOMAIN       maximum: -231585  median: -231585.0  failure: 1
>> DNSFOREST       maximum: -231585  median: -231585.0  failure: 1
>>
>> I can ldapsearch both host from srv-kb-dc1 and any other host but
>> srv-kb-dc2
>>
>>   From srv-kb-l02 ldapsearch fails with:
>>
>> root@srv-kb-dc2:ldapsearch -H ldap://srv-kb-dc2.local  -b
>> dc=domain,dc=local -D
>> "cn=administrator,cn=users,dc=domain,dc=local=de" -W -Z
>> ldap_start_tls: Can't contact LDAP server (-1)
>>
>> Thanks
>>
>> Thorsten
>>
> Have you tried running 'samba-tool dbcheck' on srv-kb-dc2 ?
>
> Also 'cn=administrator,cn=users,dc=domain,dc=local=de' is wrong , a
> typo ?
>
> Rowland
>
yes i did:

root@srv-kb-dc2:~# samba-tool dbcheck
Checking 379 objects
Checked 379 objects (0 errors)

and:

root@srv-kb-dc1:~# samba-tool dbcheck
Checking 379 objects
Checked 379 objects (0 errors)


and yes the bind dn was a typo within the mail.
Currently I don't see any issues other the drs ones.



-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba