Samba 4.0 Features added/changed
Samba 4.0.1
- Release Notes for Samba 4.0.1
- January 15, 2013
This is a security release in order to address CVE-2013-0172.
- CVE-2013-0172:
- Samba 4.0.0 as an AD DC may provide authenticated users with write access to LDAP directory objects.
- In AD, Access Control Entries can be assigned based on the objectClass of the object. If a user or a group the user is a member of has any access based on the objectClass, then that user has write access to that object.
- Additionally, if a user has write access to any attribute on the object, they may have access to write to all attributes.
- An important mitigation is that anonymous access is totally disabled by default. The second important mitigation is that normal users are typically only given the problematic per-objectClass right via the "pre-windows 2000 compatible access" group, and Samba 4.0.0 incorrectly does not make "authenticated users" part of this group.
Changes since 4.0.0:
- Andrew Bartlett <abartlet at samba.org>
- Bug 9554 - CVE-2013-0172 - Samba 4.0 as an AD DC may provide authenticated users with write access to LDAP directory objects.
http://www.samba.org/samba/history/samba-4.0.1.html
Samba 4.0
- Release Notes for Samba 4.0
- December 11, 2012
Release Announcements
This is is the first stable release of Samba 4.0.
This release contains the best of all of Samba's technology parts, both a file server (that you can reasonably expect to upgrade existing Samba 3.x releases to) and the AD domain controller work previously known as 'Samba4'.
Major enhancements in Samba 4.0.0 include:
Active Directory services
Samba 4.0 supports the server-side of the Active Directory logon environment used by Windows 2000 and later, so we can do full domain join and domain logon operations with these clients.
Our Domain Controller (DC) implementation includes our own built-in LDAP server and Kerberos Key Distribution Center (KDC) as well as the Samba3-like logon services provided over CIFS. We correctly generate the infamous Kerberos PAC, and include it with the Kerberos tickets we issue.
When running an AD DC, you only need to run 'samba' (not smbd/nmbd/winbindd), as the required services are co-coordinated by this master binary. The tool to administer the Active Directory services is called 'samba-tool'.
A short guide to setting up Samba 4 as an AD DC can be found on the wiki:
File Services
Samba 4.0.0 ships with two distinct file servers. We now use the file server from the Samba 3.x series 'smbd' for all file serving by default.
Samba 4.0 also ships with the 'NTVFS' file server. This file server is what was used prior to the beta2 release of Samba 4.0, and is tuned to match the requirements of an AD domain controller. We continue to support this, not only to provide continuity to installations that have deployed it as part of an AD DC, but also as a running example of the NT-FSA architecture we expect to move smbd to in the longer term.
For pure file server work, the binaries users would expect from that series (smbd, nmbd, winbindd, smbpasswd) continue to be available.
DNS
As DNS is an integral part of Active Directory, we also provide two DNS solutions, a simple internal DNS server for 'out of the box' configurations and a more elaborate BIND plugin using the BIND DLZ mechanism in versions 9.8 and 9.9. During the provision, you can select which backend to use. With the internal backend, your DNS server is good to go. If you chose the BIND_DLZ backend, a configuration file will be generated for bind to make it use this plugin, as well as a file explaining how to set up bind.
NTP
To provide accurate timestamps to Windows clients, we integrate with the NTP project to provide secured NTP replies. To use you need to start ntpd and configure it with the 'restrict ... ms-sntp' and ntpsigndsocket options.
Python Scripting Interface
A new scripting interface has been added to Samba 4, allowing Python programs to interface to Samba's internals, and many tools and internal workings of the DC code is now implemented in python.
Known Issues
- Replication of DNS data from one AD server to another may not work. The DNS data used by the internal DNS server and bind9_dlz is stored in an application partition in our directory. The replication of this partition is not yet reliable.
- Replication may fail on FreeBSD due to getaddrinfo() rejecting names containing _. A workaround will be in a future release.
- samba_upgradeprovision should not be run when upgrading to this release from a recent release. No important database format changes have been made since alpha16.
- Installation on systems without a system iconv (and developer headers at compile time) is known to cause errors when dealing with non-ASCII characters.
- Domain member support in the 'samba' binary is in its infancy, and is not comparable to the support found in winbindd. As such, do not use the 'samba' binary (provided for the AD server) on a member server.
- There is no NetBIOS browsing support (network neighbourhood) available for the AD domain controller. (Support in nmbd and smbd for classic domains and member/standalone servers is unchanged).
- Clock Synchronisation is critical. Many 'wrong password' errors are actually due to Kerberos objecting to a clock skew between client and server. (The NTP work in the previous alphas are partly to assist with this problem).
- The DRS replication code may fail. Please contact the team if you experience issues with DRS replication, as we have fixed many issues here in response to feedback from our production users.
- Linux inotify will now only be supported on systems where glibc also supports it (for details, please refer to bug #8850).
Upgrading
Users upgrading from Samba 3.x domain controllers and wanting to use Samba 4.0 as an AD DC should use the 'samba-tool domain classicupgrade' command. See the wiki for more details: https://wiki.samba.org/index.php/Samba4/samba3upgrade/HOWTO.
Users upgrading from Samba 4.0 alpha and beta releases since alpha15 should run 'samba-tool dbcheck --cross-ncs --fix' before re-starting Samba. Users upgrading from earlier alpha releases should contact the team for advice.
Users upgrading an AD DC from any previous release should run 'samba-tool ntacl sysvolreset' to re-sync ACLs on the sysvol share with those matching the GPOs in LDAP and the defaults from an initial provision. This will set an underlying POSIX ACL if required (eg not using the NTVFS file server).
If you used the BIND9_FLATFILE or BIND9_DLZ features, you'll have to add '-dns' to the 'server services' option, as the internal dns server (SAMBA_INTERNAL) is the default now.
Supported features
A whitepaper of currently (un-)supported features is available on the wiki:
smb.conf changes
Parameter Name Description -------------- ----------- acl compatibility Removed allow dns updates New announce as Removed announce version Removed cldap port New client max protocol New client min protocol New client signing Changed default dcerpc endpoint servers New dgram port New directory security mask Removed display charset Removed dns forwarder New dns update command New force security mode Removed force directory security mode Removed homedir map Changed default kernel oplocks Changed default kernel share modes New kpasswd port New krb5 port New nbt client socket address New nbt port New nsupdate command New ntp signd socket directory New ntvfs handler New paranoid server security Removed pid directory New printer admin Removed rndc command New rpc big endian New samba kcc command New security mask Removed send spnego principal Removed server max protocol New server min protocol New server role New server services New server signing Changed default share backend New share modes Removed smb2 max read Changed default smb2 max write Changed default smb2 max trans Changed default socket address Removed spn update command New time offset Removed tls cafile New tls certfile New tls crlfile New tls dh params file New tls enabled New tls keyfile New unicode New web port New winbindd privileged socket directory New winbind sealed pipes New winbindd socket directory New
CHANGES SINCE 4.0.0rc6
- Michael Adam <obnox at samba.org>
- BUG 9414: Honor password complexity settings.
- BUG 9456: developer-build: Fix panic when acl_xattr fails with access denied.
- BUG 9457: Fix "map username script" with "security=ads" and Winbind.
- Jeremy Allison <jra at samba.org>
- BUG 9462: Users can not be given write permissions any more by default.
- Andrew Bartlett <abartlet at samba.org>
- BUG 9415: Install SWAT *.msg files with waf.
- Alexander Bokovoy <ab at samba.org>
- BUG 9479: Support FIPS mode when building Samba.
- Günther Deschner <gd at samba.org>
- BUG 9438: Fix netr_ServerPasswordSet2, netr_LogonSamLogon with netlogon AES.
- Tsukasa Hamano <hamano at osstech.co.jp>
- BUG 9471: Fix SEGV when using second vfs module.
- Stefan Metzmacher <metze at samba.org>
- BUG 9414: Honor password complexity settings.
- BUG 9470: Fix MMC crashes.
- BUG 9481: Fix ACL on "cn=partitions,cn=configuration".
- Andreas Schneider <asn at samba.org>
- BUG 9459: Install manpages only if we install the target.
- Richard Sharpe <realrichardsharpe at gmail.com>
- BUG 9460: Respond correctly to FILE_STREAM_INFO requests.
for older changes please take a look at: