Difference between revisions of "Samba 4.17 Features added/changed"

From SambaWiki
 
 
(12 intermediate revisions by the same user not shown)
Line 1: Line 1:
Samba 4.17 is [[Samba_Release_Planning#Upcoming_Release|'''Upcoming Release''']].
+
Samba 4.17 is [[Samba_Release_Planning#Current_Stable_Release|'''Current Stable Release''']].
==Samba 4.17.0rc1 ==
+
==Samba 4.17.3==
  +
:Release Notes for Samba 4.17.3
  +
:November 15, 2022
  +
  +
===This is a security release in order to address the following defects:===
  +
* [https://www.samba.org/samba/security/CVE-2022-42898.html CVE-2022-42898]
  +
:: Samba's Kerberos libraries and AD DC failed to guard against integer overflows when parsing a PAC on a 32-bit system, which allowed an attacker with a forged PAC to corrupt the heap.
  +
  +
===Changes since 4.17.2===
  +
* Joseph Sutton <josephsutton@catalyst.net.nz>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15203 BUG 15203]: [https://www.samba.org/samba/security/CVE-2022-42898.html CVE-2022-42898]
  +
* Nicolas Williams <nico@twosigma.com>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15203 BUG 15203]: [https://www.samba.org/samba/security/CVE-2022-42898.html CVE-2022-42898]
  +
  +
[https://www.samba.org/samba/history/samba-4.17.3.html Release Notes Samba 4.17.3]
  +
==Samba 4.17.2==
  +
:Release Notes for Samba 4.16.6
  +
:October 25, 2022
  +
  +
===This is a security release in order to address the following defect:===
  +
  +
* [https://www.samba.org/samba/security/CVE-2022-3437.html CVE-2022-3437]: There is a limited write heap buffer overflow in the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal (included in Samba).
  +
* [https://www.samba.org/samba/security/CVE-2022-3592.html CVE-2022-3592]: A malicious client can use a symlink to escape the exported directory.
  +
  +
===Changes since 4.17.2===
  +
* Volker Lendecke <vl@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15207 BUG 15207]: [https://www.samba.org/samba/security/CVE-2022-3592.html CVE-2022-3592].
  +
* Joseph Sutton <josephsutton@catalyst.net.nz>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15134 BUG 15134]: [https://www.samba.org/samba/security/CVE-2022-3437.html CVE-2022-3437].
  +
  +
[https://www.samba.org/samba/history/samba-4.17.2.html Release Notes Samba 4.17.2]
  +
  +
==Samba 4.17.1==
  +
:Release Notes for Samba 4.17.1
  +
:October 19, 2022
  +
  +
===This is the latest stable release of the Samba 4.17 release series.===
  +
  +
===Changes since 4.17.0===
  +
* Jeremy Allison <jra@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=14611 BUG #14611]: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20251 CVE-2021-20251][SECURITY] Bad password count not incremented atomically.
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15174 BUG #15174]: smbXsrv_connection_shutdown_send result leaked.
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15182 BUG #15182]: Flush on a named stream never completes.
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15195 BUG #15195]: Permission denied calling SMBC_getatr when file not exists.
  +
* Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15189 BUG #15189]: Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC.
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15191 BUG #15191]: pytest: add file removal helpers for TestCaseInTempDir.
  +
* Andrew Bartlett <abartlet@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=14611 BUG #14611]: [[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20251 CVE-2021-20251][SECURITY] Bad password count not incremented atomically.
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15182 BUG #15182]: Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later. over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC.
  +
* Ralph Boehme <slow@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15126 BUG #15182]: Flush on a named stream never completes.
  +
* Volker Lendecke <vl@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15151 BUG #15151]: vfs_gpfs silently garbles timestamps > year 2106.
  +
* Gary Lockyer <gary@catalyst.net.nz>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=14611 BUG #14611]: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20251 CVE-2021-20251][SECURITY] Bad password count not incremented atomically.
  +
* Stefan Metzmacher <metze@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15200 BUG #15200]: multi-channel socket passing may hit a race if one of the involved processes already existed.
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15201 BUG #15201]: memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others).
  +
* Noel Power <noel.power@suse.com>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15205 BUG #15205]: Since popt1.19 various use after free errors using result of poptGetArg are now exposed.
  +
* Anoop C S <anoopcs@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15192 BUG #15192]: Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs.
  +
* Andreas Schneider <asn@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15169 BUG #15169]: GETPWSID in memory cache grows indefinetly with each NTLM auth.
  +
* Joseph Sutton <josephsutton@catalyst.net.nz>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=14611 BUG #14611]: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20251 CVE-2021-20251][SECURITY] Bad password count not incremented atomically.
  +
  +
[https://www.samba.org/samba/history/samba-4.17.1.html Release Notes Samba 4.17.1]
  +
  +
==Samba 4.17.0 ==
 
<onlyinclude>
 
<onlyinclude>
 
===Release Announcements===
 
===Release Announcements===
:Release Notes for 4.17.0rc1
+
:Release Notes for 4.17.0
:August 9, 2022
+
:September 13, 2022
   
  +
This is the first stable release of the Samba 4.17 release series.
This is the first release candidate of Samba 4.17. This is *not* intended for production environments and is designed for testing purposes only. Please report any defects via the Samba bug reporting system at https://bugzilla.samba.org/.
 
   
  +
Please read the release notes carefully before upgrading.
Samba 4.17 will be the next version of the Samba suite.
 
 
===UPGRADING===
 
   
 
===NEW FEATURES/CHANGES===
 
===NEW FEATURES/CHANGES===
  +
====SMB Server performance improvements====
  +
The security improvements in recent releases (4.13, 4.14, 4.15, 4.16), mainly as protection against symlink races, caused performance regressions for meta data heavy workloads.
   
  +
With 4.17 the situation improved a lot again:
====Configure without the SMB1 Server====
 
   
  +
* Pathnames given by a client are devided into dirname and basename. The amount of syscalls to validate dirnames is reduced to 2 syscalls (openat, close) per component. On modern Linux kernels (>= 5.6) smbd makes use of the openat2() syscall with SOLVE_NO_SYMLINKS, in order to just use 2 syscalls (openat2, close) for the whole dirname.
  +
  +
* Contended path based operations used to generate a lot of unsolicited wakeup events causing thundering herd problems, which lead to masive latencies for some clients. These events are now avoided in order to provide stable latencies and much higher throughput of open/close operations.
  +
  +
====Configure without the SMB1 Server====
 
It is now possible to configure Samba without support for the SMB1 protocol in smbd. This can be selected at configure time with either of the options:
 
It is now possible to configure Samba without support for the SMB1 protocol in smbd. This can be selected at configure time with either of the options:
   
Line 27: Line 102:
 
This option allows sites, OEMs and integrators to configure Samba to remove the old and insecure SMB1 protocol from their products.
 
This option allows sites, OEMs and integrators to configure Samba to remove the old and insecure SMB1 protocol from their products.
   
Note that the Samba client libraries still support SMB1 connections even when Samba is configured as --without-smb1-server. This is to ensure maximum compatibility with environments containing old SMB1 servers.
+
:Note: that the Samba client libraries still support SMB1 connections even when Samba is configured as --without-smb1-server. This is to ensure maximum compatibility with environments containing old SMB1 servers.
   
====Bronze bit and S4U support with MIT Kerberos 1.20====
+
====Bronze bit and S4U support now also with MIT Kerberos 1.20====
   
In 2020 Microsoft Security Response Team received another Kerberos-related report. Eventually, that led to a security update of the CVE-2020-17049, Kerberos KDC Security Feature Bypass Vulnerability, also known as a ‘Bronze Bit’. With this vulnerability, a compromised service that is configured to use Kerberos constrained delegation feature could tamper with a service ticket that is not valid for delegation to force the KDC to accept it.
+
In 2020 Microsoft Security Response Team received another Kerberos-related report. Eventually, that led to a security update of the [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17049 CVE-2020-17049], Kerberos KDC Security Feature Bypass Vulnerability, also known as a 'Bronze Bit'. With this vulnerability, a compromised service that is configured to use Kerberos constrained delegation feature could tamper with a service ticket that is not valid for delegation to force the KDC to accept it.
   
 
With the release of MIT Kerberos 1.20, Samba AD DC is able able to mitigate the 'Bronze Bit' attack. MIT Kerberos KDC's KDB (Kerberos Database Driver) API was changed to allow passing more details between KDC and KDB components. When built against MIT Kerberos, Samba AD DC supports MIT Kerberos 1.19 and 1.20 versions but 'Bronze Bit' mitigation is provided only with MIT Kerberos 1.20.
 
With the release of MIT Kerberos 1.20, Samba AD DC is able able to mitigate the 'Bronze Bit' attack. MIT Kerberos KDC's KDB (Kerberos Database Driver) API was changed to allow passing more details between KDC and KDB components. When built against MIT Kerberos, Samba AD DC supports MIT Kerberos 1.19 and 1.20 versions but 'Bronze Bit' mitigation is provided only with MIT Kerberos 1.20.
Line 37: Line 112:
 
In addition to fixing the 'Bronze Bit' issue, Samba AD DC now fully supports S4U2Self and S4U2Proxy Kerberos extensions.
 
In addition to fixing the 'Bronze Bit' issue, Samba AD DC now fully supports S4U2Self and S4U2Proxy Kerberos extensions.
   
  +
:Note: the default (Heimdal-based) KDC was already fixed in 2021, see [https://bugzilla.samba.org/show_bug.cgi?id=14642 BUG #14642]
====Resource Based Constrained Delegation (RBCD) support====
 
   
  +
====Resource Based Constrained Delegation (RBCD) support====
 
Samba AD DC built with MIT Kerberos 1.20 offers RBCD support now. With MIT Kerberos 1.20 we have complete RBCD support passing Sambas S4U testsuite.
 
Samba AD DC built with MIT Kerberos 1.20 offers RBCD support now. With MIT Kerberos 1.20 we have complete RBCD support passing Sambas S4U testsuite.
  +
:Note: that samba-tool lacks support for setting this up yet!
 
  +
samba-tool delegation got the 'add-principal' and 'del-principal' subcommands in order to manage RBCD.
   
 
To complete RBCD support and make it useful to Administrators we added the Asserted Identity [1] SID into the PAC for constrained delegation. This is available for Samba AD compiled with MIT Kerberos 1.20.
 
To complete RBCD support and make it useful to Administrators we added the Asserted Identity [1] SID into the PAC for constrained delegation. This is available for Samba AD compiled with MIT Kerberos 1.20.
  +
  +
:Note: the default (Heimdal-based) KDC does not support RBCD yet.
   
 
:[https://docs.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview Kerberos Constrained Delegation Overview]
 
:[https://docs.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview Kerberos Constrained Delegation Overview]
   
 
====Customizable DNS listening port====
 
====Customizable DNS listening port====
 
 
It is now possible to set a custom listening port for the builtin DNS service, making easy to host another DNS on the same system that would bind to the default port and forward the domain-specific queries to Samba using the custom port. This is the opposite configuration of setting a forwarder in Samba.
 
It is now possible to set a custom listening port for the builtin DNS service, making easy to host another DNS on the same system that would bind to the default port and forward the domain-specific queries to Samba using the custom port. This is the opposite configuration of setting a forwarder in Samba.
   
Line 55: Line 133:
   
 
====CTDB changes====
 
====CTDB changes====
 
 
* When Samba is configured with both --with-cluster-support and --systemd-install-services then a systemd service file for CTDB will be installed.
 
* When Samba is configured with both --with-cluster-support and --systemd-install-services then a systemd service file for CTDB will be installed.
 
* ctdbd_wrapper has been removed. ctdbd is now started directly from a systemd service file or init script.
 
* ctdbd_wrapper has been removed. ctdbd is now started directly from a systemd service file or init script.
Line 61: Line 138:
   
 
====Operation without the (unsalted) NT password hash====
 
====Operation without the (unsalted) NT password hash====
 
 
When Samba is configured with 'nt hash store = never' then Samba will no longer store the (unsalted) NT password hash for users in Active Directory. (Trust accounts, like computers, domain controllers and inter-domain trusts are not impacted).
 
When Samba is configured with 'nt hash store = never' then Samba will no longer store the (unsalted) NT password hash for users in Active Directory. (Trust accounts, like computers, domain controllers and inter-domain trusts are not impacted).
   
Line 76: Line 152:
 
There is one small limitation of this workaround: Changing the sAMAccountName, userAccountControl or userPrincipalName of an account can cause the Kerberos password salt to change. This means that after *both* an account rename and a password change, only the current password will be recognised for password history purposes.
 
There is one small limitation of this workaround: Changing the sAMAccountName, userAccountControl or userPrincipalName of an account can cause the Kerberos password salt to change. This means that after *both* an account rename and a password change, only the current password will be recognised for password history purposes.
   
  +
====Python API for smbconf====
  +
Samba's smbconf library provides a generic frontend to various configuration backends (plain text file, registry) as a C library. A new Python wrapper, importable as 'samba.smbconf' is available. An additional module, 'samba.samba3.smbconf', is also available to enable registry backend support. These libraries allow Python programs to read, and optionally write, Samba configuration natively.
  +
  +
====JSON support for smbstatus====
  +
It is now possible to print detailed information in JSON format in the smbstatus program using the new option --json. The JSON output covers all the existing text output including sessions, connections, open files, byte-range locks, notifies and profile data with all low-level information maintained by Samba in the respective databases.
  +
  +
====Protected Users security group====
  +
  +
Samba AD DC now includes support for the Protected Users security group introduced in Windows Server 2012 R2. The feature reduces the attack surface of user accounts by preventing the use of weak encryption types. It also mitigates the effects of credential theft by limiting credential lifetime and scope.
  +
  +
The protections are intended for user accounts only, and service or computer accounts should not be added to the Protected Users group. User accounts added to the group are granted the following security protections:
  +
  +
* NTLM authentication is disabled.
  +
* Kerberos ticket-granting tickets (TGTs) encrypted with RC4 are not issued to or accepted from affected principals. Tickets encrypted with AES, and service tickets encrypted with RC4, are not affected by this restriction.
  +
* The lifetime of Kerberos TGTs is restricted to a maximum of four hours.
  +
* Kerberos constrained and unconstrained delegation is disabled.
  +
  +
If the Protected Users group is not already present in the domain, it can be created with 'samba-tool group add'. The new '--special' parameter must be specified, with 'Protected Users' as the name of the group. An example command invocation is:
  +
  +
samba-tool group add 'Protected Users' --special
  +
  +
or against a remote server:
  +
  +
samba-tool group add 'Protected Users' --special -H ldap://dc1.example.com -U Administrator
  +
  +
The Protected Users group is identified in the domain by its having a RID of 525. Thus, it should only be created with samba-tool and the '--special' parameter, as above, so that it has the required RID to function correctly.
   
 
===REMOVED FEATURES===
 
===REMOVED FEATURES===
Line 88: Line 190:
 
-------------- ----------- -------
 
-------------- ----------- -------
 
dns port New default 53
 
dns port New default 53
  +
fruit:zero_file_id New default yes
nt hash store New parameter always
 
  +
nt hash store New parameter always
  +
smb1 unix extensions Replaces "unix extensions"
  +
volume serial number New parameter -1
  +
winbind debug traceid New parameter no
 
</onlyinclude>
 
</onlyinclude>
  +
  +
===CHANGES SINCE 4.17.0rc4===
  +
  +
* Ralph Boehme <slow@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15126 BUG #15126]: acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr.
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15153 BUG #15153]: Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1.
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15161 BUG #15161]: assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197.
  +
* Volker Lendecke <vl@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15126 BUG #15126]: acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr.
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15161 BUG #15161]: assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197.
  +
* Stefan Metzmacher <metze@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15159 BUG #15159]: Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED.
  +
* Noel Power <noel.power@suse.com>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15160 BUG #15160]: winbind at info level debug can coredump when processing
  +
wb_lookupusergroups.
  +
  +
===CHANGES SINCE 4.17.0rc3===
  +
  +
* Anoop C S <anoopcs@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15157 BUG #15157]: Make use of glfs_*at() API calls in vfs_glusterfs.
  +
  +
===CHANGES SINCE 4.17.0rc2===
  +
  +
* Jeremy Allison <jra@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15128 BUG #15128]: Possible use after free of connection_struct when iterating smbd_server_connection->connections.
  +
* Christian Ambach <ambi@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15145 BUG #15145]: `net usershare add` fails with flag works with --long but fails with -l.
  +
* Ralph Boehme <slow@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15126 BUG #15126]: acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr.
  +
* Stefan Metzmacher <metze@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15125 BUG #15125]: Performance regression on contended path based operations.
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15148 BUG #15148]: Missing READ_LEASE break could cause data corruption.
  +
* Andreas Schneider <asn@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15141 BUG #15141]: libsamba-errors uses a wrong version number.
  +
* Joseph Sutton <josephsutton@catalyst.net.nz>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15152 BUG #15152]: SMB1 negotiation can fail to handle connection errors.
  +
  +
===CHANGES SINCE 4.17.0rc1===
  +
  +
* Jeremy Allison <jra@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15143 BUG #15143]: New filename parser doesn't check veto files smb.conf parameter.
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15144 BUG #15144]: 4.17.rc1 still uses symlink-race prone unix_convert()
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15146 BUG #15146]: Backport fileserver related changed to 4.17.0rc2
  +
* Jule Anger <janger@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15147 BUG #15147]: Manpage for smbstatus json is missing
  +
* Volker Lendecke <vl@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15146 BUG #15146]: Backport fileserver related changed to 4.17.0rc2
  +
* Stefan Metzmacher <metze@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15125 BUG #15125]: Performance regression on contended path based operations
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15146 BUG #15146]: Backport fileserver related changed to 4.17.0rc2
  +
* Andreas Schneider <asn@samba.org>
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15140 BUG #15140]: Fix issues found by coverity in smbstatus json code
  +
:* [https://bugzilla.samba.org/show_bug.cgi?id=15146 BUG #15146]: Backport fileserver related changed to 4.17.0rc2
   
 
===KNOWN ISSUES===
 
===KNOWN ISSUES===
Line 96: Line 255:
 
[[Release_Planning_for_Samba_4.17#Release_blocking_bugs]]
 
[[Release_Planning_for_Samba_4.17#Release_blocking_bugs]]
   
https://download.samba.org/pub/samba/rc/samba-4.17.0rc1.WHATSNEW.txt
+
https://www.samba.org/samba/history/samba-4.17.0.html

Latest revision as of 17:38, 24 November 2022

Samba 4.17 is Current Stable Release.

Samba 4.17.3

Release Notes for Samba 4.17.3
November 15, 2022

This is a security release in order to address the following defects:

Samba's Kerberos libraries and AD DC failed to guard against integer overflows when parsing a PAC on a 32-bit system, which allowed an attacker with a forged PAC to corrupt the heap.

Changes since 4.17.2

  • Joseph Sutton <josephsutton@catalyst.net.nz>
  • Nicolas Williams <nico@twosigma.com>
Release Notes Samba 4.17.3

Samba 4.17.2

Release Notes for Samba 4.16.6
October 25, 2022

This is a security release in order to address the following defect:

  • CVE-2022-3437: There is a limited write heap buffer overflow in the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal (included in Samba).
  • CVE-2022-3592: A malicious client can use a symlink to escape the exported directory.

Changes since 4.17.2

  • Volker Lendecke <vl@samba.org>
  • Joseph Sutton <josephsutton@catalyst.net.nz>
 Release Notes Samba 4.17.2

Samba 4.17.1

Release Notes for Samba 4.17.1
October 19, 2022

This is the latest stable release of the Samba 4.17 release series.

Changes since 4.17.0

  • Jeremy Allison <jra@samba.org>
  • Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
  • BUG #15189: Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC.
  • BUG #15191: pytest: add file removal helpers for TestCaseInTempDir.
  • Andrew Bartlett <abartlet@samba.org>
  • BUG #14611: [CVE-2021-20251[SECURITY] Bad password count not incremented atomically.
  • BUG #15182: Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later. over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC.
  • Ralph Boehme <slow@samba.org>
  • BUG #15182: Flush on a named stream never completes.
  • Volker Lendecke <vl@samba.org>
  • BUG #15151: vfs_gpfs silently garbles timestamps > year 2106.
  • Gary Lockyer <gary@catalyst.net.nz>
  • Stefan Metzmacher <metze@samba.org>
  • BUG #15200: multi-channel socket passing may hit a race if one of the involved processes already existed.
  • BUG #15201: memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others).
  • Noel Power <noel.power@suse.com>
  • BUG #15205: Since popt1.19 various use after free errors using result of poptGetArg are now exposed.
  • Anoop C S <anoopcs@samba.org>
  • BUG #15192: Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs.
  • Andreas Schneider <asn@samba.org>
  • BUG #15169: GETPWSID in memory cache grows indefinetly with each NTLM auth.
  • Joseph Sutton <josephsutton@catalyst.net.nz>
   Release Notes Samba 4.17.1

Samba 4.17.0

Release Announcements

Release Notes for 4.17.0
September 13, 2022

This is the first stable release of the Samba 4.17 release series.

Please read the release notes carefully before upgrading.

NEW FEATURES/CHANGES

SMB Server performance improvements

The security improvements in recent releases (4.13, 4.14, 4.15, 4.16), mainly as protection against symlink races, caused performance regressions for meta data heavy workloads.

With 4.17 the situation improved a lot again:

  • Pathnames given by a client are devided into dirname and basename. The amount of syscalls to validate dirnames is reduced to 2 syscalls (openat, close) per component. On modern Linux kernels (>= 5.6) smbd makes use of the openat2() syscall with SOLVE_NO_SYMLINKS, in order to just use 2 syscalls (openat2, close) for the whole dirname.
  • Contended path based operations used to generate a lot of unsolicited wakeup events causing thundering herd problems, which lead to masive latencies for some clients. These events are now avoided in order to provide stable latencies and much higher throughput of open/close operations.

Configure without the SMB1 Server

It is now possible to configure Samba without support for the SMB1 protocol in smbd. This can be selected at configure time with either of the options:

--with-smb1-server
--without-smb1-server

By default (without either of these options set) Samba is configured to include SMB1 support (i.e. --with-smb1-server is the default). When Samba is configured without SMB1 support, none of the SMB1 code is included inside smbd except the minimal stub code needed to allow a client to connect as SMB1 and immediately negotiate the selected protocol into SMB2 (as a Windows server also allows).

None of the SMB1-only smb.conf parameters are removed when configured without SMB1, but these parameters are ignored by the smbd server. This allows deployment without having to change an existing smb.conf file.

This option allows sites, OEMs and integrators to configure Samba to remove the old and insecure SMB1 protocol from their products.

Note: that the Samba client libraries still support SMB1 connections even when Samba is configured as --without-smb1-server. This is to ensure maximum compatibility with environments containing old SMB1 servers.

Bronze bit and S4U support now also with MIT Kerberos 1.20

In 2020 Microsoft Security Response Team received another Kerberos-related report. Eventually, that led to a security update of the CVE-2020-17049, Kerberos KDC Security Feature Bypass Vulnerability, also known as a 'Bronze Bit'. With this vulnerability, a compromised service that is configured to use Kerberos constrained delegation feature could tamper with a service ticket that is not valid for delegation to force the KDC to accept it.

With the release of MIT Kerberos 1.20, Samba AD DC is able able to mitigate the 'Bronze Bit' attack. MIT Kerberos KDC's KDB (Kerberos Database Driver) API was changed to allow passing more details between KDC and KDB components. When built against MIT Kerberos, Samba AD DC supports MIT Kerberos 1.19 and 1.20 versions but 'Bronze Bit' mitigation is provided only with MIT Kerberos 1.20.

In addition to fixing the 'Bronze Bit' issue, Samba AD DC now fully supports S4U2Self and S4U2Proxy Kerberos extensions.

Note: the default (Heimdal-based) KDC was already fixed in 2021, see BUG #14642

Resource Based Constrained Delegation (RBCD) support

Samba AD DC built with MIT Kerberos 1.20 offers RBCD support now. With MIT Kerberos 1.20 we have complete RBCD support passing Sambas S4U testsuite.

samba-tool delegation got the 'add-principal' and 'del-principal' subcommands in order to manage RBCD.

To complete RBCD support and make it useful to Administrators we added the Asserted Identity [1] SID into the PAC for constrained delegation. This is available for Samba AD compiled with MIT Kerberos 1.20.

Note: the default (Heimdal-based) KDC does not support RBCD yet.
Kerberos Constrained Delegation Overview

Customizable DNS listening port

It is now possible to set a custom listening port for the builtin DNS service, making easy to host another DNS on the same system that would bind to the default port and forward the domain-specific queries to Samba using the custom port. This is the opposite configuration of setting a forwarder in Samba.

It makes possible to use another DNS server as a front and forward to Samba.

Dynamic DNS updates may not be proxied by the front DNS server when forwarding to Samba. Dynamic DNS update proxying depends on the features of the other DNS server used as a front.

CTDB changes

  • When Samba is configured with both --with-cluster-support and --systemd-install-services then a systemd service file for CTDB will be installed.
  • ctdbd_wrapper has been removed. ctdbd is now started directly from a systemd service file or init script.
  • The syntax for the ctdb.tunables configuration file has been relaxed. However, trailing garbage after the value, including comments, is no longer permitted. Please see ctdb-tunables(7) for more details.

Operation without the (unsalted) NT password hash

When Samba is configured with 'nt hash store = never' then Samba will no longer store the (unsalted) NT password hash for users in Active Directory. (Trust accounts, like computers, domain controllers and inter-domain trusts are not impacted).

In the next version of Samba the default for 'nt hash store' will change from 'always' to 'auto', where it will follow (behave as 'nt hash store = never' when 'ntlm auth = disabled' is set.

Security-focused deployments of Samba that have eliminated NTLM from their networks will find setting 'ntlm auth = disabled' with 'nt hash store = always' as a useful way to improve compliance with best-practice guidance on password storage (which is to always use an interated hash).

Note: that when 'nt hash store = never' is set, then arcfour-hmac-md5 Kerberos keys will not be available for users who subsequently change their password, as these keys derive their values from NT hashes. AES keys are stored by default for all deployments of Samba with Domain Functional Level 2008 or later, are supported by all modern clients, and are much more secure.

Finally, also note that password history in Active Directory is stored in nTPwdHistory using a series of NT hash values. Therefore the full password history feature is not available in this mode.

To provide some protection against password re-use previous Kerberos hash values (the current, old and older values are already stored) are used, providing a history length of 3.

There is one small limitation of this workaround: Changing the sAMAccountName, userAccountControl or userPrincipalName of an account can cause the Kerberos password salt to change. This means that after *both* an account rename and a password change, only the current password will be recognised for password history purposes.

Python API for smbconf

Samba's smbconf library provides a generic frontend to various configuration backends (plain text file, registry) as a C library. A new Python wrapper, importable as 'samba.smbconf' is available. An additional module, 'samba.samba3.smbconf', is also available to enable registry backend support. These libraries allow Python programs to read, and optionally write, Samba configuration natively.

JSON support for smbstatus

It is now possible to print detailed information in JSON format in the smbstatus program using the new option --json. The JSON output covers all the existing text output including sessions, connections, open files, byte-range locks, notifies and profile data with all low-level information maintained by Samba in the respective databases.

Protected Users security group

Samba AD DC now includes support for the Protected Users security group introduced in Windows Server 2012 R2. The feature reduces the attack surface of user accounts by preventing the use of weak encryption types. It also mitigates the effects of credential theft by limiting credential lifetime and scope.

The protections are intended for user accounts only, and service or computer accounts should not be added to the Protected Users group. User accounts added to the group are granted the following security protections:

  • NTLM authentication is disabled.
  • Kerberos ticket-granting tickets (TGTs) encrypted with RC4 are not issued to or accepted from affected principals. Tickets encrypted with AES, and service tickets encrypted with RC4, are not affected by this restriction.
  • The lifetime of Kerberos TGTs is restricted to a maximum of four hours.
  • Kerberos constrained and unconstrained delegation is disabled.

If the Protected Users group is not already present in the domain, it can be created with 'samba-tool group add'. The new '--special' parameter must be specified, with 'Protected Users' as the name of the group. An example command invocation is:

samba-tool group add 'Protected Users' --special

or against a remote server:

samba-tool group add 'Protected Users' --special -H ldap://dc1.example.com -U Administrator

The Protected Users group is identified in the domain by its having a RID of 525. Thus, it should only be created with samba-tool and the '--special' parameter, as above, so that it has the required RID to function correctly.

REMOVED FEATURES

LanMan Authentication and password storage removed from the AD DC

The storage and authentication with LanMan passwords has been entirely removed from the Samba AD DC, even when "lanman auth = yes" is set.

smb.conf changes

 Parameter Name                          Description     Default
 --------------                          -----------     -------
 dns port                                New default     53
 fruit:zero_file_id                      New default     yes
 nt hash store                           New parameter   always
 smb1 unix extensions                    Replaces "unix extensions"
 volume serial number                    New parameter   -1
 winbind debug traceid                   New parameter   no


CHANGES SINCE 4.17.0rc4

  • Ralph Boehme <slow@samba.org>
  • BUG #15126: acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr.
  • BUG #15153: Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1.
  • BUG #15161: assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197.
  • Volker Lendecke <vl@samba.org>
  • BUG #15126: acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr.
  • BUG #15161: assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197.
  • Stefan Metzmacher <metze@samba.org>
  • BUG #15159: Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED.
  • Noel Power <noel.power@suse.com>
  • BUG #15160: winbind at info level debug can coredump when processing
    wb_lookupusergroups.

CHANGES SINCE 4.17.0rc3

  • Anoop C S <anoopcs@samba.org>
  • BUG #15157: Make use of glfs_*at() API calls in vfs_glusterfs.

CHANGES SINCE 4.17.0rc2

  • Jeremy Allison <jra@samba.org>
  • BUG #15128: Possible use after free of connection_struct when iterating smbd_server_connection->connections.
  • Christian Ambach <ambi@samba.org>
  • BUG #15145: `net usershare add` fails with flag works with --long but fails with -l.
  • Ralph Boehme <slow@samba.org>
  • BUG #15126: acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr.
  • Stefan Metzmacher <metze@samba.org>
  • BUG #15125: Performance regression on contended path based operations.
  • BUG #15148: Missing READ_LEASE break could cause data corruption.
  • Andreas Schneider <asn@samba.org>
  • BUG #15141: libsamba-errors uses a wrong version number.
  • Joseph Sutton <josephsutton@catalyst.net.nz>
  • BUG #15152: SMB1 negotiation can fail to handle connection errors.

CHANGES SINCE 4.17.0rc1

  • Jeremy Allison <jra@samba.org>
  • BUG #15143: New filename parser doesn't check veto files smb.conf parameter.
  • BUG #15144: 4.17.rc1 still uses symlink-race prone unix_convert()
  • BUG #15146: Backport fileserver related changed to 4.17.0rc2
  • Jule Anger <janger@samba.org>
  • Volker Lendecke <vl@samba.org>
  • BUG #15146: Backport fileserver related changed to 4.17.0rc2
  • Stefan Metzmacher <metze@samba.org>
  • BUG #15125: Performance regression on contended path based operations
  • BUG #15146: Backport fileserver related changed to 4.17.0rc2
  • Andreas Schneider <asn@samba.org>
  • BUG #15140: Fix issues found by coverity in smbstatus json code
  • BUG #15146: Backport fileserver related changed to 4.17.0rc2

KNOWN ISSUES

Release_Planning_for_Samba_4.17#Release_blocking_bugs

https://www.samba.org/samba/history/samba-4.17.0.html