View source for Samba 4.18 Features added/changed

Samba 4.18 is [[Samba_Release_Planning#Security_Fixes_Only_Mode|''''Security Fixes_Only Mode'']].
==Samba 4.18.11==
:Release Notes for Samba 4.18.11
March 13, 2024

===This is the latest stable release of the Samba 4.18 release series.===

===Changes since 4.18.10===
*  Martin Schwenke <mschwenke@ddn.com>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15580 BUG 15580]: Packet marshalling push support missing for CTDB_CONTROL_TCP_CLIENT_DISCONNECTED and CTDB_CONTROL_TCP_CLIENT_PASSED

 [https://www.samba.org/samba/history/samba-4.18.10.html Release Notes Samba 4.18.11]

==Samba 4.18.10==
:Release Notes for Samba 4.18.10
:January 31, 2024

===This is the latest stable release of the Samba 4.18 release series.===

===Changes since 4.18.9===

*  Ralph Boehme <slow@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=13688 BUG 13688]: Windows 2016 fails to restore previous version of a file from a shadow_copy2 snapshot.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15549 BUG 15549]: Symlinks on AIX are broken in 4.19 (and a few version beforethat).
*  Samuel Cabrero <scabrero@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=13577 BUG 13577]: net changesecretpw cannot set the machine account password if secrets.tdb is empty.
*  Bjoern Jacke <bj@sernet.de>
:* [https://bugzilla.samba.org/show_bug.cgi?id=12421 BUG 12421]: Fake directory create times has no effect.
*  Björn Jacke <bjacke@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15540 BUG 15540]: For generating doc, take, if defined, env XML_CATALOG_FILES.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15541 BUG 15541]: Trivial C typo in nsswitch/winbind_nss_netbsd.c.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15542 BUG 15542]: vfs_linux_xfs is incorrectly named.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15550 BUG 15550]: ctime mixed up with mtime by smbd.

*  Volker Lendecke <vl@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15523 BUG 15523]: ctdb RELEASE_IP causes a crash in release_ip if a connection to a non-public address disconnects first.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15544 BUG 15544]: shadow_copy2 broken when current fileset's directories are removed.
*  Stefan Metzmacher <metze@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15523 BUG 15523]: ctdb RELEASE_IP causes a crash in release_ip if a connection to a non-public address disconnects first.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15534 BUG 15534]: smbd does not detect ctdb public ipv6 addresses for multichannel exclusion.
*  Martin Schwenke <mschwenke@ddn.com>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15523 BUG 15523]: ctdb RELEASE_IP causes a crash in release_ip if a connection to a non-public address disconnects first.
*  Shachar Sharon <ssharon@redhat.com>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15440 BUG 15440]: Unable to copy and write files from clients to Ceph cluster via SMB Linux gateway with Ceph VFS module.
*  Jones Syue <jonessyue@qnap.com>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15547 BUG 15547]: Multichannel refresh network information.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15555 BUG 15555]: smbpasswd reset permissions only if not 0600.

 [https://www.samba.org/samba/history/samba-4.18.10.html Release Notes Samba 4.18.10]

==Samba 4.18.9==
:Release Notes for Samba 4.18.9
:November 29, 2023

===This is the latest stable release of the Samba 4.18 release series.===

It contains the security-relevant bugfix [https://www.samba.org/samba/security/CVE-2018-14628.html CVE-2018-14628]:

:Wrong ntSecurityDescriptor values for "CN=Deleted Objects" allow read of object tombstones over LDAP (Administrator action required!) 

===Description of CVE-2018-14628===

All versions of Samba from 4.0.0 onwards are vulnerable to an information leak (compared with the established behaviour of Microsoft's Active Directory) when Samba is an Active Directory Domain Controller.

When a domain was provisioned with an unpatched Samba version, the ntSecurityDescriptor is simply inherited from Domain/Partition-HEAD-Object instead of being very strict (as on a Windows provisioned domain).

This means also non privileged users can use the LDAP_SERVER_SHOW_DELETED_OID control in order to view, the names and preserved attributes of deleted objects.

No information that was hidden before the deletion is visible, but in with the correct ntSecurityDescriptor value in place the whole object is also not visible without administrative rights.

There is no further vulnerability associated with this error, merely an information disclosure.

===Action required in order to resolve CVE-2018-14628!===

The patched Samba does NOT protect existing domains!

The administrator needs to run the following command (on only one domain controller) in order to apply the protection to an existing domain:

  samba-tool dbcheck --cross-ncs --attrs=nTSecurityDescriptor --fix

The above requires manual interaction in order to review the changes before they are applied. Typicall question look like this:

  Reset nTSecurityDescriptor on CN=Deleted Objects,DC=samba,DC=org back to provision default?
        Owner mismatch: SY (in ref) DA(in current)
        Group mismatch: SY (in ref) DA(in current)
        Part dacl is different between reference and current here is the detail:
                (A;;LCRPLORC;;;AU) ACE is not present in the reference
                (A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY) ACE is not present in the reference
                (A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;DA) ACE is not present in the reference
                (A;;CCDCLCSWRPWPSDRCWDWO;;;SY) ACE is not present in the current
                (A;;LCRP;;;BA) ACE is not present in the current
   [y/N/all/none] y
  Fixed attribute 'nTSecurityDescriptor' of 'CN=Deleted Objects,DC=samba,DC=org'

The change should be confirmed with 'y' for all objects starting with 'CN=Deleted Objects'.

===Changes since 4.18.8===

*  Michael Adam <obnox@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15497 BUG 15497]: Add make command for querying Samba version.
*  Ralph Boehme <slow@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15487 BUG 15487]: smbd crashes if asked to return full information on close of a stream handle with delete on close disposition set.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15521 BUG 15521]: smbd: fix close order of base_fsp and stream_fsp in smb_fname_fsp_destructor().
*  Björn Jacke <bj@sernet.de>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15093 BUG 15093]: Files without "read attributes" NFS4 ACL permission are not listed in directories.
*  Stefan Metzmacher <metze@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=13595 BUG 13595]: [https://www.samba.org/samba/security/CVE-2018-14628.html CVE-2018-14628] [SECURITY] Deleted Object tombstones visible in AD LDAP to normal users.
*  Christof Schmitt <cs@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15507 BUG 15507]: vfs_gpfs stat calls fail due to file system permissions.
*  Christof Schmitt <christof.schmitt@us.ibm.com>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15497 BUG 15497]: Add make command for querying Samba version.
*  Martin Schwenke <mschwenke@ddn.com>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15479 BUG 15479]: ctdbd: setproctitle not initialized messages flooding logs.

 [https://www.samba.org/samba/history/samba-4.18.9.html Release Notes Samba 4.18.9]

==Samba 4.18.8==
:Release Notes for Samba 4.18.8
:October 10, 2023

===This is a security release in order to address the following defects:===

* [https://www.samba.org/samba/security/CVE-2023-3961.html CVE-2023-3961]:
:Unsanitized pipe names allow SMB clients to connect as root to existing unix domain sockets on the file system.

* [https://www.samba.org/samba/security/CVE-2023-4091.html CVE-2023-4091]:
:SMB client can truncate files to 0 bytes by opening files with OVERWRITE disposition when using the acl_xattr Samba VFS module with the smb.conf setting "acl_xattr:ignore system acls = yes"

* [https://www.samba.org/samba/security/CVE-2023-4154.html CVE-2023-4154]:
:An RODC and a user with the GET_CHANGES right can view all attributes, including secrets and passwords.  Additionally, the access check fails open on error conditions.

* [https://www.samba.org/samba/security/CVE-2023-42669.html CVE-2023-42669]:
:Calls to the rpcecho server on the AD DC can request that the server block for a user-defined amount of time, denying service.

* [https://www.samba.org/samba/security/CVE-2023-42670.html CVE-2023-42670]: 
:Samba can be made to start multiple incompatible RPC listeners, disrupting service on the AD DC.

===Changes since 4.18.7===

*  Jeremy Allison <jra@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15422 BUG 15422]: [https://www.samba.org/samba/security/CVE-2023-3961.html CVE-2023-3961].
*  Andrew Bartlett <abartlet@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15424 BUG 15424]: [https://www.samba.org/samba/security/CVE-2023-4154.html CVE-2023-4154].
:* [https://bugzilla.samba.org/show_bug.cgi?id=15473 BUG 15473]: [https://www.samba.org/samba/security/CVE-2023-42670.html CVE-2023-42670].
:* [https://bugzilla.samba.org/show_bug.cgi?id=15474 BUG 15474]: [https://www.samba.org/samba/security/CVE-2023-42669.html CVE-2023-42669].
*  Ralph Boehme <slow@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15439 BUG 15439]: [https://www.samba.org/samba/security/CVE-2023-4091.html CVE-2023-4091].
*  Stefan Metzmacher <metze@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15424 BUG 15424]: [https://www.samba.org/samba/security/CVE-2023-4154.html CVE-2023-4154].
*  Joseph Sutton <josephsutton@catalyst.net.nz>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15424 BUG 15424]: [https://www.samba.org/samba/security/CVE-2023-4154.html CVE-2023-4154].

 [https://www.samba.org/samba/history/samba-4.18.8.html Release Notes Samba 4.18.8]

==Samba 4.18.7==
:Release Notes for Samba 4.18.7
:September 27, 2023

===This is the latest stable release of the Samba 4.18 release series.===

===Changes since 4.18.6===

*  Jeremy Allison <jra@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15419 BUG 15419]: Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink().
:* [https://bugzilla.samba.org/show_bug.cgi?id=15423 BUG 15423]: use-after-free in aio_del_req_from_fsp during smbd shutdown after failed IPC FSCTL_PIPE_TRANSCEIVE.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15432 BUG 15432]: TREE_CONNECT without SETUP causes smbd to use uninitialized pointer.
*  Andrew Bartlett <abartlet@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15401 BUG 15401]: Avoid infinite loop in initial user sync with Azure AD Connect.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15407 BUG 15407]: Samba replication logs show (null) DN.
*  Ralph Boehme <slow@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15463 BUG 15463]: macOS mdfind returns only 50 results.
*  Remi Collet <rcollet@redhat.com>
:* [https://bugzilla.samba.org/show_bug.cgi?id=14808 BUG 14808]: smbc_getxattr() return value is incorrect.
*  Volker Lendecke <vl@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15481 BUG 15481]: GETREALFILENAME_CACHE can modify incoming new filename with previous cache entry value.
*  Stefan Metzmacher <metze@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15464 BUG 15464]: libnss_winbind causes memory corruption since samba-4.18, impacts sendmail, zabbix, potentially more.
*  MikeLiu <mikeliu@qnap.com>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15453 BUG 15453]: File doesn't show when user doesn't have permission if aio_pthread is loaded.
*  Martin Schwenke <mschwenke@ddn.com>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15451 BUG 15451]: ctdb_killtcp fails to work with --enable-pcap and libpcap >= 1.9.1.
*  Joseph Sutton <josephsutton@catalyst.net.nz>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15476 BUG 15476]: The KDC in 4.18 (and older) is not able to accept tickets with empty claims pac blobs (from Samba 4.19 or Windows).
:* [https://bugzilla.samba.org/show_bug.cgi?id=15477 BUG 15477]: The heimdal KDC doesn't detect s4u2self correctly when fast is in use.

 [https://www.samba.org/samba/history/samba-4.18.6.html Release Notes Samba 4.18.6]

==Samba 4.18.6==
:Release Notes for Samba 4.18.6
:August 16, 2023

===This is the latest stable release of the Samba 4.18 release series.===

===Changes since 4.18.5===

*  Jeremy Allison <jra@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15420 BUG 15420]: reply_sesssetup_and_X() can dereference uninitialized tmp pointer.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15430 BUG 15430]: Missing return in reply_exit_done().
*  Andrew Bartlett <abartlet@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15289 BUG 15289]: post-exec password redaction for samba-tool is more reliable for fully random passwords as it no longer uses regular expressions containing the password value itself.
:* [https://bugzilla.samba.org/show_bug.cgi?id=9959 BUG 9959]: Windows client join fails if a second container CN=System exists somewhere.
*  Ralph Boehme <slow@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15342 BUG 15342]: Spotlight sometimes returns no results on latest macOS.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15417 BUG 15417]: Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15427 BUG 15427]: Spotlight results return wrong date in result list.
*  Günther Deschner <gd@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15414 BUG 15414]: "net offlinejoin provision" does not work as non-root user.
*  Pavel Filipenský <pfilipensky@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15400 BUG 15400]: rpcserver no longer accepts double backslash in dfs pathname.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15433 BUG 15433]: cm_prepare_connection() calls close(fd) for the second time.
*  Stefan Metzmacher <metze@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15346 BUG 15346]: 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15441 BUG 15441]: samba-tool ntacl get segfault if aio_pthread appended. 
:* [https://bugzilla.samba.org/show_bug.cgi?id=15446 BUG 15446]: DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed.
*  Noel Power <noel.power@suse.com>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15390 BUG 15390]: Python tarfile extraction needs change to avoid a warning (CVE-2007-4559 mitigation).
:* [https://bugzilla.samba.org/show_bug.cgi?id=15435 BUG 15435]: Regression DFS not working with widelinks = true.
*  Arvid Requate <requate@univention.de>
:* [https://bugzilla.samba.org/show_bug.cgi?id=9959 BUG 9959]: Windows client join fails if a second container CN=System exists somewhere.
*  Jones Syue <jonessyue@qnap.com>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15441 BUG 15441]: samba-tool ntacl get segfault if aio_pthread appended.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15449 BUG 15449]: mdssvc: Do an early talloc_free() in _mdssvc_open().

 [https://www.samba.org/samba/history/samba-4.18.6.html Release Notes Samba 4.18.6]

==Samba 4.18.5==
:Release Notes for Samba 4.18.5
:July 19, 2023

===This is a security release in order to address the following defects:===

* [https://www.samba.org/samba/security/CVE-2022-2127.html CVE-2022-2127]
:When winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in winbind and possibly crash it.

* [https://www.samba.org/samba/security/CVE-2023-3347.html CVE-2023-3347]
:SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory.

* [https://www.samba.org/samba/security/CVE-2023-34966.html CVE-2023-34966]
:An infinite loop bug in Samba's mdssvc RPC service for Spotlight can be triggered by an unauthenticated attacker by issuing a malformed RPC request.

* [https://www.samba.org/samba/security/CVE-2023-34967.html CVE-2023-34967]
:Missing type validation in Samba's mdssvc RPC service for Spotlight can be used by an unauthenticated attacker to trigger a process crash in a shared RPC mdssvc worker process.

* [https://www.samba.org/samba/security/CVE-2023-34968.html CVE-2023-34968]
:As part of the Spotlight protocol Samba discloses the server-side absolute path of shares and files and directories in search results. 

===Changes since 4.18.4===
*  Ralph Boehme <slow@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15072 BUG 15072]: [https://www.samba.org/samba/security/CVE-2022-2127.html CVE-2022-2127]: lm_resp_len not checked properly in winbindd_pam_auth_crap_send.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15340 BUG 15340]: [https://www.samba.org/samba/security/CVE-2023-34966.html CVE-2023-34966]: Samba Spotlight mdssvc RPC Request Infinite Loop.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15341 BUG 15341]: [https://www.samba.org/samba/security/CVE-2023-34967.html CVE-2023-34967]: Samba Spotlight mdssvc RPC Request Type Confusion.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15388 BUG 15388]: [https://www.samba.org/samba/security/CVE-2023-34968.html CVE-2023-34968]: Spotlight server-side Share Path Disclosure.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15397 BUG 15397]: [https://www.samba.org/samba/security/CVE-2023-3347.html CVE-2023-3347]: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set.
*  Samuel Cabrero <scabrero@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15072 BUG 15072]: [https://www.samba.org/samba/security/CVE-2022-2127.html CVE-2022-2127]: lm_resp_len not checked properly in winbindd_pam_auth_crap_send.
*  Volker Lendecke <vl@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15072 BUG 15072]: [https://www.samba.org/samba/security/CVE-2022-2127.html CVE-2022-2127]: lm_resp_len not checked properly in winbindd_pam_auth_crap_send.
*  Stefan Metzmacher <metze@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15418 BUG 15418]: Secure channel faulty since Windows 10/11 update 07/2023.

 [https://www.samba.org/samba/history/samba-4.18.5.html Release Notes Samba 4.18.5]

==Samba 4.18.4==
:Release Notes for Samba 4.18.4
:July 05, 2023

===This is the latest stable release of the Samba 4.18 release series.===


===Changes since 4.18.3===
*  Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15404 BUG 15404]: Backport --pidl-developer fixes.
*  Samuel Cabrero <scabrero@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=14030 BUG 14030]: Named crashes on DLZ zone update.
*  Björn Jacke <bj@sernet.de>
:* [https://bugzilla.samba.org/show_bug.cgi?id=2312 BUG 2312]: smbcacls and smbcquotas do not check // before the server.
*  Volker Lendecke <vl@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15382 BUG 15382]: cli_list loops 100% CPU against pre-lanman2 servers.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15391 BUG 15391]: smbclient leaks fds with showacls.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15402 BUG 15402]: smbd returns NOT_FOUND when creating files on a r/o filesystem.
*  Stefan Metzmacher <metze@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15355 BUG 15355]: NSS_WRAPPER_HOSTNAME doesn't match NSS_WRAPPER_HOSTS entry and causes test timeouts.
*  Noel Power <noel.power@suse.com>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15384 BUG 15384]: net ads lookup (with unspecified realm) fails.
*  Christof Schmitt <cs@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15381 BUG 15381]: Register Samba processes with GPFS.
*  Andreas Schneider <asn@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15390 BUG 15390]: Python tarfile extraction needs change to avoid a warning ([https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4559 CVE-2007-4559] mitigation).
:* [https://bugzilla.samba.org/show_bug.cgi?id=15398 BUG 15398]: The winbind child segfaults when listing users with `winbind scan trusted domains = yes`.
*  Jones Syue <jonessyue@qnap.com>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15383 BUG 15383]: Remove comments about deprecated 'write cache size'.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15403 BUG 15403]: smbget memory leak if failed to download files recursively.

 [https://www.samba.org/samba/history/samba-4.18.4.html Release Notes Samba 4.18.4]

==Samba 4.18.3==
:Release Notes for Samba 4.18.3
:May 31, 2023

===This is the latest stable release of the Samba 4.18 release series.===

===Changes since 4.18.2===

* Ralph Boehme <slow@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15375 BUG 15375]: Symlinks to files can have random DOS mode information in a directory listing.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15378 BUG 15378]: vfs_fruit might cause a failing open for delete.

* Volker Lendecke <vl@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15361 BUG 15361]: winbind recurses into itself via rpcd_lsad.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15366 BUG 15366]: wbinfo -u fails on ad dc with >1000 users.

* Stefan Metzmacher <metze@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15338 BUG 15338]: DS ACEs might be inherited to unrelated object classes.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15362 BUG 15362]: a lot of messages: get_static_share_mode_data: get_static_share_mode_data_fn failed: NT_STATUS_NOT_FOUND.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15374 BUG 15374]: aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse().

* Andreas Schneider <asn@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15360 BUG 15360]: Setting veto files = /.*/ break listing directories.

* Joseph Sutton <josephsutton@catalyst.net.nz>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15363 BUG 15363]: "samba-tool domain provision" does not run interactive mode if no arguments are given.

* Nathaniel W. Turner <nturner@exagrid.com>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15325 BUG 15325]: dsgetdcname: assumes local system uses IPv4.

  [https://www.samba.org/samba/history/samba-4.18.3.html Release Notes Samba 4.18.3]

==Samba 4.18.2==
:Release Notes for Samba 4.18.2
:April 19, 2023

===This is the latest stable release of the Samba 4.18 release series.===

===Changes since 4.18.1===

*  Jeremy Allison <jra@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15302 BUG 15302]: Log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15306 BUG 15306]: Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c.
*  Andrew Bartlett <abartlet@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15328 BUG 15328]: test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15329 BUG 15329]: Reduce flapping of ridalloc test.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15351 BUG 15351]: large_ldap test is unreliable.
*  Ralph Boehme <slow@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15143 BUG 15143]: New filename parser doesn't check veto files smb.conf parameter.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15354 BUG 15354]: mdssvc may crash when initializing.
*  Volker Lendecke <vl@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15313 BUG 15313]: large directory optimization broken for non-lcomp path elements.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15357 BUG 15357]: streams_depot fails to create streams.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15358 BUG 15358]: shadow_copy2 and streams_depot don't play well together.
*  Rob van der Linde <rob@catalyst.net.nz>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15316 BUG 15316]: Flapping tests in samba_tool_drs_show_repl.py.
*  Stefan Metzmacher <metze@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15317 BUG 15317]: winbindd idmap child contacts the domain controller without a need.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15318 BUG 15318]: idmap_autorid may fail to map sids of trusted domains for the first time.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15319 BUG 15319]: idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15323 BUG 15323]: net ads search -P doesn't work against servers in other domains.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15353 BUG 15353]: Temporary smbXsrv_tcon_global.tdb can't be parsed.
*  Joseph Sutton <josephsutton@catalyst.net.nz>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15316 BUG 15316]: Flapping tests in samba_tool_drs_show_repl.py.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15343 BUG 15343]: Tests use depricated and removed methods like assertRegexpMatches.

  [https://www.samba.org/samba/history/samba-4.18.2.html Release Notes Samba 4.18.2]

==Samba 4.18.1==
:Release Notes for Samba 4.18.1
:March 29, 2023

===This is a security release in order to address the following defects:===

* [https://www.samba.org/samba/security/CVE-2023-0922.html CVE-2023-0922] 
:The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection. 
                 
* [https://www.samba.org/samba/security/CVE-2023-0614.html CVE-2023-0614]
:The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure via LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC. Installations with such secrets in their Samba AD should assume they have been obtained and need replacing.
                 

===Changes since 4.18.0===

*  Andrew Bartlett <abartlet@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15270 BUG 15270]: [https://www.samba.org/samba/security/CVE-2023-0614.html CVE-2023-0614].
:* [https://bugzilla.samba.org/show_bug.cgi?id=15331 BUG 15331]: ldb wildcard matching makes excessive allocations.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15332 BUG 15332]: large_ldap test is inefficient.
*  Rob van der Linde <rob@catalyst.net.nz>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15315 BUG 15315]: [https://www.samba.org/samba/security/CVE-2023-0922.html CVE-2023-0922].
* Joseph Sutton <josephsutton@catalyst.net.nz>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15270 BUG 15270]: [https://www.samba.org/samba/security/CVE-2023-0614.html CVE-2023-0614]
:* [https://bugzilla.samba.org/show_bug.cgi?id=15276 BUG 15276]: [https://www.samba.org/samba/security/CVE-2023-0922.html CVE-2023-0922]

  [https://www.samba.org/samba/history/samba-4.18.1.html Release Notes Samba 4.18.1]

==Samba 4.18.0 ==
<onlyinclude>
===Release Announcements===
:Release Notes for 4.18.0
:March 8, 2023

This is the first stable release of the Samba 4.18 release series.
Please read the release notes carefully before upgrading.

===NEW FEATURES/CHANGES===
====SMB Server performance improvements====

The security improvements in recent releases (4.13, 4.14, 4.15, 4.16), mainly as protection against symlink races, caused performance regressions for metadata heavy workloads.

While 4.17 already improved the situation quite a lot, with 4.18 the locking overhead for contended path based operations is reduced by an additional factor of ~ 3 compared to 4.17. It means the throughput of open/close operations reached the level of 4.12 again.

====More succinct samba-tool error messages====

Historically samba-tool has reported user error or misconfiguration by means of a Python traceback, showing you where in its code it noticed something was wrong, but not always exactly what is amiss. Now it tries harder to identify the true cause and restrict its output to describing that. Particular cases include:

* a username or password is incorrect
* an ldb database filename is wrong (including in smb.conf)
* samba-tool dns: various zones or records do not exist
* samba-tool ntacl: certain files are missing
* the network seems to be down
* bad --realm or --debug arguments

=====Accessing the old samba-tool messages=====

This is not new, but users are reminded they can get the full Python stack trace, along with other noise, by using the argument '-d3'. This may be useful when searching the web.

The intention is that when samba-tool encounters an unrecognised problem (especially a bug), it will still output a Python traceback. If you encounter a problem that has been incorrectly identified by samba-tool, please report it on https://bugzilla.samba.org.

=====Colour output with samba-tool --color=====

For some time a few samba-tool commands have had a --color=yes|no|auto option, which determines whether the command outputs ANSI colour codes. Now all samba-tool commands support this option, which now also accepts 'always' and 'force' for 'yes', 'never' and 'none' for 'no', and 'tty' and 'if-tty' for 'auto' (this more closely matches convention). With --color=auto, or when --color is omitted, colour codes are only used when output is directed to a terminal.

Most commands have very little colour in any case. For those that already used it, the defaults have changed slightly.

* samba-tool drs showrepl: default is now 'auto', not 'no'
* samba-tool visualize: the interactions between --color-scheme, --color, and --output have changed slightly. When --color-scheme is set it overrides --color for the purpose of the output diagram, but not for other output like error messages.

=====No colour with NO_COLOR environment variable=====

With both samba-tool --color=auto (see above) and some other places
where we use ANSI colour codes, the NO_COLOR environment variable will
disable colour output. See https://no-color.org/ for a description of
this variable. `samba-tool --color=always` will use colour regardless
of NO_COLOR.

===New wbinfo option --change-secret-at===

The wbinfo command has a new option, --change-secret-at=<DOMAIN CONTROLLER> which forces the trust account password to be changed at a specified domain controller. If the specified domain controller cannot be contacted the password change fails rather than trying other DCs.

===New option to change the NT ACL default location===

Usually the NT ACLs are stored in the security.NTACL extended attribute (xattr) of files and directories. The new "acl_xattr:security_acl_name" option allows to redefine the default location. The default "security.NTACL" is a protected location, which means the content of the security.NTACL attribute is not accessible from normal users outside of Samba. When this option is set to use a user-defined value, e.g. user.NTACL then any user can potentially access and overwrite this information. The module prevents access to this xattr over SMB, but the xattr may still be accessed by other means (eg local access, SSH, NFS). This option must only be used when this consequence is clearly understood and when specific precautions are taken to avoid compromising the ACL content.

===Azure Active Directory / Office365 synchronisation improvements===

Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment.

===REMOVED FEATURES===

===smb.conf changes===

  Parameter Name                          Description     Default
  --------------                          -----------     -------
  acl_xattr:security_acl_name             New             security.NTACL
  server addresses                        New

</onlyinclude>

===CHANGES SINCE 4.18.0rc4===

*  Jeremy Allison <jra@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15314 BUG 15314]: streams_xattr is creating unexpected locks on folders.
*  Volker Lendecke <vl@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15310 BUG 15310]: New samba-dcerpc architecture does not scale gracefully.

===CHANGES SINCE 4.18.0rc3===

*  Andreas Schneider <asn@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15308 BUG 15308]BUG 15308: Avoid that tests fail because other tests didn't do cleanup on failure.
*  baixiangcpp <baixiangcpp@gmail.com>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15311 BUG 15311]BUG 15311: fd_load() function implicitly closes the fd where it should not.

===CHANGES SINCE 4.18.0rc2===

*  Jeremy Allison <jra@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15301 BUG 15301]: Improve file_modtime() and issues around smb3 unix test.
*  Ralph Boehme <slow@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15299 BUG 15299]: Spotlight doesn't work with latest macOS Ventura.
*  Stefan Metzmacher <metze@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15298 BUG 15298]: Build failure on solaris with tevent 0.14.0 (and ldb 2.7.0). (tevent 0.14.1 and ldb 2.7.1 are already released...)
*  John Mulligan <jmulligan@redhat.com>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15307 BUG 15307]: vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat.
*  Andreas Schneider <asn@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15291 BUG 15291]: test_chdir_cache.sh doesn't work with SMBD_DONT_LOG_STDOUT=1.
:* [https://bugzilla.samba.org/show_bug.cgi?id=15301 BUG 15301]: Improve file_modtime() and issues around smb3 unix test.

===CHANGES SINCE 4.18.0rc1===

*  Andrew Bartlett <abartlet@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=10635 BUG 10635]: Office365 azure Password Sync not working.
*  Stefan Metzmacher <metze@samba.org>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15286 BUG 15286]: auth3_generate_session_info_pac leaks wbcAuthUserInfo.
*  Noel Power <noel.power@suse.com>
:* [https://bugzilla.samba.org/show_bug.cgi?id=15293 BUG 15293]: With clustering enabled samba-bgqd can core dump due to use after free.

===KNOWN ISSUES===


[[Release_Planning_for_Samba_4.18#Release_blocking_bugs]]


  [https://www.samba.org/samba/history/samba-4.18.0.html Release Notes Samba 4.18.0]