Samba 4.0 Features added/changed

From SambaWiki

Samba 4.0.1

Release Notes for Samba 4.0.1
January 15, 2013


This is a security release in order to address CVE-2013-0172.

Samba 4.0.0 as an AD DC may provide authenticated users with write access to LDAP directory objects.
In AD, Access Control Entries can be assigned based on the objectClass of the object. If a user or a group the user is a member of has any access based on the objectClass, then that user has write access to that object.
Additionally, if a user has write access to any attribute on the object, they may have access to write to all attributes.
An important mitigation is that anonymous access is totally disabled by default. The second important mitigation is that normal users are typically only given the problematic per-objectClass right via the "pre-windows 2000 compatible access" group, and Samba 4.0.0 incorrectly does not make "authenticated users" part of this group.

Changes since 4.0.0:

  • Andrew Bartlett <abartlet at samba.org>
  • Bug 9554 - CVE-2013-0172 - Samba 4.0 as an AD DC may provide authenticated users with write access to LDAP directory objects.
http://www.samba.org/samba/history/samba-4.0.1.html

Samba 4.0

Release Notes for Samba 4.0
December 11, 2012

Release Announcements

This is is the first stable release of Samba 4.0.

This release contains the best of all of Samba's technology parts, both a file server (that you can reasonably expect to upgrade existing Samba 3.x releases to) and the AD domain controller work previously known as 'Samba4'.

Major enhancements in Samba 4.0.0 include:
Active Directory services

Samba 4.0 supports the server-side of the Active Directory logon environment used by Windows 2000 and later, so we can do full domain join and domain logon operations with these clients.

Our Domain Controller (DC) implementation includes our own built-in LDAP server and Kerberos Key Distribution Center (KDC) as well as the Samba3-like logon services provided over CIFS. We correctly generate the infamous Kerberos PAC, and include it with the Kerberos tickets we issue.

When running an AD DC, you only need to run 'samba' (not smbd/nmbd/winbindd), as the required services are co-coordinated by this master binary. The tool to administer the Active Directory services is called 'samba-tool'.

A short guide to setting up Samba 4 as an AD DC can be found on the wiki:

Samba4/HOWTO
File Services

Samba 4.0.0 ships with two distinct file servers. We now use the file server from the Samba 3.x series 'smbd' for all file serving by default.

Samba 4.0 also ships with the 'NTVFS' file server. This file server is what was used prior to the beta2 release of Samba 4.0, and is tuned to match the requirements of an AD domain controller. We continue to support this, not only to provide continuity to installations that have deployed it as part of an AD DC, but also as a running example of the NT-FSA architecture we expect to move smbd to in the longer term.

For pure file server work, the binaries users would expect from that series (smbd, nmbd, winbindd, smbpasswd) continue to be available.

DNS

As DNS is an integral part of Active Directory, we also provide two DNS solutions, a simple internal DNS server for 'out of the box' configurations and a more elaborate BIND plugin using the BIND DLZ mechanism in versions 9.8 and 9.9. During the provision, you can select which backend to use. With the internal backend, your DNS server is good to go. If you chose the BIND_DLZ backend, a configuration file will be generated for bind to make it use this plugin, as well as a file explaining how to set up bind.

NTP

To provide accurate timestamps to Windows clients, we integrate with the NTP project to provide secured NTP replies. To use you need to start ntpd and configure it with the 'restrict ... ms-sntp' and ntpsigndsocket options.

Python Scripting Interface

A new scripting interface has been added to Samba 4, allowing Python programs to interface to Samba's internals, and many tools and internal workings of the DC code is now implemented in python.

Known Issues
  • Replication of DNS data from one AD server to another may not work. The DNS data used by the internal DNS server and bind9_dlz is stored in an application partition in our directory. The replication of this partition is not yet reliable.
  • Replication may fail on FreeBSD due to getaddrinfo() rejecting names containing _. A workaround will be in a future release.
  • samba_upgradeprovision should not be run when upgrading to this release from a recent release. No important database format changes have been made since alpha16.
  • Installation on systems without a system iconv (and developer headers at compile time) is known to cause errors when dealing with non-ASCII characters.
  • Domain member support in the 'samba' binary is in its infancy, and is not comparable to the support found in winbindd. As such, do not use the 'samba' binary (provided for the AD server) on a member server.
  • There is no NetBIOS browsing support (network neighbourhood) available for the AD domain controller. (Support in nmbd and smbd for classic domains and member/standalone servers is unchanged).
  • Clock Synchronisation is critical. Many 'wrong password' errors are actually due to Kerberos objecting to a clock skew between client and server. (The NTP work in the previous alphas are partly to assist with this problem).
  • The DRS replication code may fail. Please contact the team if you experience issues with DRS replication, as we have fixed many issues here in response to feedback from our production users.
  • Linux inotify will now only be supported on systems where glibc also supports it (for details, please refer to bug #8850).
Upgrading

Users upgrading from Samba 3.x domain controllers and wanting to use Samba 4.0 as an AD DC should use the 'samba-tool domain classicupgrade' command. See the wiki for more details: https://wiki.samba.org/index.php/Samba4/samba3upgrade/HOWTO.

Samba4/samba3upgrade/HOWTO

Users upgrading from Samba 4.0 alpha and beta releases since alpha15 should run 'samba-tool dbcheck --cross-ncs --fix' before re-starting Samba. Users upgrading from earlier alpha releases should contact the team for advice.

Users upgrading an AD DC from any previous release should run 'samba-tool ntacl sysvolreset' to re-sync ACLs on the sysvol share with those matching the GPOs in LDAP and the defaults from an initial provision. This will set an underlying POSIX ACL if required (eg not using the NTVFS file server).

If you used the BIND9_FLATFILE or BIND9_DLZ features, you'll have to add '-dns' to the 'server services' option, as the internal dns server (SAMBA_INTERNAL) is the default now.

Supported features

A whitepaper of currently (un-)supported features is available on the wiki:

Samba_4.0_Whitepaper

smb.conf changes
  Parameter Name    		Description
  --------------			-----------
  acl compatibility			Removed
  allow dns updates			New
  announce as				Removed
  announce version			Removed
  cldap port				New
  client max protocol			New
  client min protocol			New
  client signing			Changed default
  dcerpc endpoint servers		New
  dgram port				New
  directory security mask		Removed
  display charset			Removed
  dns forwarder			New
  dns update command			New
  force security mode			Removed
  force directory security mode	Removed
  homedir map				Changed default
  kernel oplocks			Changed default
  kernel share modes			New
  kpasswd port				New
  krb5 port				New
  nbt client socket address		New
  nbt port				New
  nsupdate command			New
  ntp signd socket directory		New
  ntvfs handler			New
  paranoid server security		Removed
  pid directory			New
  printer admin			Removed
  rndc command 			New
  rpc big endian			New
  samba kcc command			New
  security mask			Removed
  send spnego principal		Removed
  server max protocol			New
  server min protocol			New
  server role				New
  server services			New
  server signing			Changed default
  share backend			New
  share modes				Removed
  smb2 max read			Changed default
  smb2 max write			Changed default
  smb2 max trans			Changed default
  socket address			Removed
  spn update command			New
  time offset				Removed
  tls cafile				New
  tls certfile				New
  tls crlfile				New
  tls dh params file			New
  tls enabled				New
  tls keyfile				New
  unicode				New
  web port				New
  winbindd privileged socket directory	New
  winbind sealed pipes			New
  winbindd socket directory		New
CHANGES SINCE 4.0.0rc6
  • Michael Adam <obnox at samba.org>
  • BUG 9414: Honor password complexity settings.
  • BUG 9456: developer-build: Fix panic when acl_xattr fails with access denied.
  • BUG 9457: Fix "map username script" with "security=ads" and Winbind.
  • Jeremy Allison <jra at samba.org>
  • BUG 9462: Users can not be given write permissions any more by default.
  • Andrew Bartlett <abartlet at samba.org>
  • BUG 9415: Install SWAT *.msg files with waf.
  • Alexander Bokovoy <ab at samba.org>
  • BUG 9479: Support FIPS mode when building Samba.
  • Günther Deschner <gd at samba.org>
  • BUG 9438: Fix netr_ServerPasswordSet2, netr_LogonSamLogon with netlogon AES.
  • Tsukasa Hamano <hamano at osstech.co.jp>
  • BUG 9471: Fix SEGV when using second vfs module.
  • Stefan Metzmacher <metze at samba.org>
  • BUG 9414: Honor password complexity settings.
  • BUG 9470: Fix MMC crashes.
  • BUG 9481: Fix ACL on "cn=partitions,cn=configuration".
  • Andreas Schneider <asn at samba.org>
  • BUG 9459: Install manpages only if we install the target.
  • Richard Sharpe <realrichardsharpe at gmail.com>
  • BUG 9460: Respond correctly to FILE_STREAM_INFO requests.

for older changes please take a look at: