Samba Features added/changed

From SambaWiki

Samba 4.11

Release Notes for Samba 4.11.0
September 17, 2019

Release Announcements

This is the first stable release of the Samba 4.11 release series. Please read the release notes carefully before upgrading.


UPGRADING

AD Database compatibility

Samba 4.11 has changed how the AD database is stored on disk. AD users should not really be affected by this change when upgrading to 4.11. However, AD users should be extremely careful if they need to downgrade from Samba 4.11 to an older release.

Samba 4.11 maintains database compatibility with older Samba releases. The database will automatically get rewritten in the new 4.11 format when you first start the upgraded samba executable.

However, when downgrading from 4.11 you will need to manually downgrade the AD database yourself. Note that you will need to do this step before you install the downgraded Samba packages. For more details, see:

Downgrading_an_Active_Directory_DC

When either upgrading or downgrading, users should also avoid making any database modifications between installing the new Samba packages and starting the samba executable.

SMB1 is disabled by default

The defaults of 'client min protocol' and 'server min protocol' have been changed to SMB2_02.

This means clients without support for SMB2 or SMB3 are no longer able to connect to smbd (by default).

It also means client tools like smbclient and other, as well as applications making use of libsmbclient are no longer able to connect to servers without SMB2 or SMB3 support (by default).

It's still possible to allow SMB1 dialects, e.g. NT1, LANMAN2 and LANMAN1 for client and server, as well as CORE and COREPLUS on the client.

Note: that most commandline tools e.g. smbclient, smbcacls and others also support the '--option' argument to overwrite smb.conf options, e.g. --option='client min protocol=NT1' might be useful.

As Microsoft no longer installs SMB1 support in recent releases or uninstalls it after 30 days without usage, the Samba Team tries to get remove the SMB1 usage as much as possible.

SMB1 is officially deprecated and might be removed step by step in the following years. If you have a strong requirement for SMB1 (except for supporting old Linux Kernels), please file a bug at https://bugzilla.samba.org and let us know about the details.

LanMan and plaintext authentication deprecated

The "lanman auth" and "encrypt passwords" parameters are deprecated with this release as both are only applicable to SMB1 and are quite insecure. NTLM, NTLMv2 and Kerberos authentication are unaffected, as "encrypt passwords = yes" has been the default since Samba 3.0.0.

If you have a strong requirement for these authentication protocols, please file a bug at https://bugzilla.samba.org and let us know about the details.


BIND9_FLATFILE deprecated

The BIND9_FLATFILE DNS backend is deprecated in this release and will be removed in the future. This was only practically useful on a single domain controller or under expert care and supervision.

This release therefore deprecates the "rndc command" smb.conf parameter, which is used to support this configuration. After writing out a list of DCs permitted to make changes to the DNS Zone "rndc command" is called with reload to tell the 'named' server if a DC was added/removed to to the domain.

NEW FEATURES/CHANGES

Default samba process model

The default for the '--model' argument passed to the samba executable has changed from 'standard' to 'prefork'. This means a difference in the number of samba child processes that are created to handle client connections. The previous default would create a separate process for every LDAP or NETLOGON client connection. For a network with a lot of persistent client connections, this could result in significant memory overhead. Now, with the new default of 'prefork', the LDAP, NETLOGON, and KDC services will create a fixed number of worker processes at startup and share the client connections amongst these workers. The number of worker processes can be configured by the 'prefork children' setting in the smb.conf (the default is 4).

Authentication Logging.

Winbind now logs PAM_AUTH and NTLM_AUTH events, a new attribute "logonId" has been added to the Authentication JSON log messages. This contains a random logon id that is generated for each PAM_AUTH and NTLM_AUTH request and is passed to SamLogon, linking the windbind and SamLogon requests.

The serviceDescription of the messages is set to "winbind", the authDescriptionis set to one of:

  "PASSDB, <command>, <pid>"
  "PAM_AUTH, <command>, <pid>"
  "NTLM_AUTH, <command>, <pid>"

where:

  <command> is the name of the command makinmg the winbind request i.e. wbinfo
  <pid>     is the process id of the requesting process.

The version of the JSON Authentication messages has been changed to 1.1 from 1.2

LDAP referrals

The scheme of returned LDAP referrals now reflects the scheme of the original request, i.e. referrals received via ldap are prefixed with "ldap://" and those over ldaps are prefixed with "ldaps://".

Previously all referrals were prefixed with "ldap://".

Bind9 logging

It is now possible to log the duration of DNS operations performed by Bind9. This should aid future diagnosis of performance issues and could be used to monitor DNS performance. The logging is enabled by setting log level to "dns:10" in smb.conf.

The logs are currently Human readable text only, i.e. no JSON formatted output.

Log lines are of the form:

   <function>: DNS timing: result: [<result>] duration: (<duration>)
   zone: [<zone>] name: [<name>] data: []
   durations are in microseconds.

Default schema updated to 2012_R2

Default AD schema changed from 2008_R2 to 2012_R2. 2012_R2 functional level is not yet available. Older schemas can be used by provisioning with the '--base-schema' argument. Existing installations can be updated with the samba-tool command "domain schemaupgrade".

Samba's replication code has also been improved to handle replication with the 2012 schema (the core of this replication fix has also been backported to 4.9.11 and will be in a 4.10.x release).

For more about how the AD schema relates to overall Windows compatibility, please read:

Windows_2012_Server_compatibility

GnuTLS 3.2 required

Samba is making efforts to remove in-tree cryptographic functionality, and to instead rely on externally maintained libraries. To this end, Samba has chosen GnuTLS as our standard cryptographic provider.

Samba now requires GnuTLS 3.2 to be installed (including development headers at build time) for all configurations, not just the Samba AD DC.

NOTE WELL: The use of GnuTLS means that Samba will honour the system-wide 'FIPS mode' (a reference to the US FIPS-140 cryptographic standard) and so will not operate in many still common situations if this system-wide parameter is in effect, as many of our protocols rely on outdated cryptography.

A future Samba version will mitigate this to some extent where good cryptography effectively wraps bad cryptography, but for now that above applies.

samba-tool improvements

A new "samba-tool contact" command has been added to allow the command-line manipulation of contacts, as used for address book lookups in LDAP.

The "samba-tool [user|group|computer|group|contact] edit" command has been improved to operate more pleasantly on international character sets.

100,000 USER and LARGER Samba AD DOMAINS

Extensive efforts have been made to optimise Samba for use in organisations (for example) targeting 100,000 users, plus 120,000 computer objects, as well as large number of group memberships.

Many of the specific efforts are detailed below, but the net results is to remove barriers to significantly larger Samba deployments compared to previous releases.

Reindex performance improvements

The performance of samba-tool dbcheck --reindex has been improved, especially for large domains.

join performance improvements

The performance of samba-tool domain join has been improved, especially for large domains.

LDAP Server memory improvements

The LDAP server has improved memory efficiency, ensuring that large LDAP responses (for example a search for all objects) is not copied multiple times into memory.

Setting lmdb map size

It is now possible to set the lmdb map size (The maximum permitted size for the database). "samba-tool" now accepts the "--backend-store-size" i.e. --backend-store-size=4Gb. If not specified it defaults to 8Gb.

This option is avaiable for the following sub commands:

  • domain provision
  • domain join
  • domain dcpromo
  • drs clone-dc-database

LDB "batch_mode"

To improve performance during batch operations i.e. joins, ldb now accepts a "batch_mode" option. However to prevent any index or database inconsistencies if an operation fails, the entire transaction will be aborted at commit.

New LDB pack format

On first use (startup of 'samba' or the first transaction write) Samba's sam.ldb will be updated to a new more efficient pack format. This will take a few moments.

New LDB <= and >= index mode to improve replication performance

As well as a new pack format, Samba's sam.ldb uses a new index format allowing Samba to efficiently select objects changed since the last replication cycle. This in turn improves performance during replication of large domains.

LDB_Greater_than_and_Less_than_indexing

Improvements to ldb search performance

Search performance on large LDB databases has been improved by reducing memory allocations made on each object.

Improvements to subtree rename performance

Improvements have been made to Samba's handling of subtree renames, for example of containers and organisational units, however large renames are still not recommended.

CTDB changes

  • nfs-linux-kernel-callout now defaults to using systemd service names
The Red Hat service names continue to be the default.
Other distributions should patch this file when packaging it.
  • The onnode -o option has been removed
  • ctdbd logs when it is using more than 90% of a CPU thread
ctdbd is single threaded, so can become saturated if it uses the full capacity of a CPU thread. To help detect this situation, ctdbd now logs messages when CPU utilisation exceeds 90%. Each change in CPU utilisation over 90% is logged. A message is also logged when CPU utilisation drops below the 90% threshold.
  • Script configuration variable CTDB_MONITOR_SWAP_USAGE has been removed
05.system.script now monitors total memory (i.e. physical memory + swap) utilisation using the existing CTDB_MONITOR_MEMORY_USAGE script configuration variable.

CephFS Snapshot Integration


CephFS snapshots can now be exposed as previous file versions using the new ceph_snapshots VFS module. See the vfs_ceph_snapshots(8) man page for details.

REMOVED FEATURES

Web server

As a leftover from work related to the Samba Web Administration Tool (SWAT), Samba still supported a Python WSGI web server (which could still be turned on from the 'server services' smb.conf parameter). This service was unused and has now been removed from Samba.

samba-tool join subdomain

The subdomain role has been removed from the join command. This option did not work and has no tests.

Python2 support

Samba 4.11 will not have any runtime support for Python 2.

If you are building Samba using the '--disable-python' option (i.e. you're excluding all the run-time Python support), then this will continue to work on a system that supports either python2 or python3.

To build Samba with python2 you *must* set the 'PYTHON' environment variable for both the 'configure' and 'make' steps, i.e.

  'PYTHON=python2 ./configure'
  'PYTHON=python2 make'

This will override the python3 default.

Except for this specific build-time use of python2, Samba now requires Python 3.4 as a minimum.

Samba 4.10

Release Notes for Samba 4.10.0
March 19, 2019

Release Announcements

This is the first stable release of the Samba 4.10 release series. Please read the release notes carefully before upgrading.

NEW FEATURES/CHANGES

GPO Improvements

A new 'samba-tool gpo backup' command has been added that can export a set of Group Policy Objects from a domain in a generalised XML format.

A corresponding 'samba-tool gpo restore' command has been added to rebuild the Group Policy Objects from the XML after generalization. (The administrator needs to correct the values of XML entities between the backup and restore to account for the change in domain).

KDC prefork

The KDC now supports the pre-fork process model and worker processes will be forked for the KDC when the pre-fork process model is selected for samba.

Prefork 'prefork children'

The default value for this smdb.conf parameter has been increased from 1 to 4.

Netlogon prefork

DCERPC now supports pre-forked NETLOGON processes. The netlogon processes are pre-forked when the prefork process model is selected for samba.

Offline domain backups

The 'samba-tool domain backup' command has been extended with a new 'offline' option. This safely creates a backup of the local DC's database directly from disk. The main benefits of an offline backup are it's quicker, it stores more database details (for forensic purposes), and the samba process does not have to be running when the backup is made. Refer to the samba-tool help for more details on using this command.

Group membership statistics

A new 'samba-tool group stats' command has been added. This provides summary information about how the users are spread across groups in your domain. The 'samba-tool group list --verbose' command has also been updated to include the number of users in each group.

Paged results LDAP control

The behaviour of the paged results control (1.2.840.113556.1.4.319, RFC2696) has been changed to more closely match Windows servers, to improve memory usage. Paged results may be used internally (or is requested by the user) by LDAP libraries or tools that deal with large result sizes, for example, when listing all the objects in the database.

Previously, results were returned as a snapshot of the database but now, some changes made to the set of results while paging may be reflected in the responses. If strict inter-record consistency is required in answers (which is not possible on Windows with large result sets), consider avoiding the paged results control or alternatively, it might be possible to enforce restrictions using the LDAP filter expression.

For further details see Paged_Results

Prefork process restart

The pre-fork process model now restarts failed processes. The delay between restart attempts is controlled by the "prefork backoff increment" (default = 10) and "prefork maximum backoff" (default = 120) smbd.conf parameters. A linear back off strategy is used with "prefork backoff increment" added to the delay between restart attempts up until it reaches "prefork maximum backoff".

Using the default sequence the restart delays (in seconds) are:

0, 10, 20, ..., 120, 120, ...

Standard process model

When using the standard process model samba forks a new process to handle ldap and netlogon connections. Samba now honours the 'max smbd processes' smb.conf parameter. The default value of 0, indicates there is no limit. The limit is applied individually to netlogon and ldap. When the process limit is exceeded Samba drops new connections immediately.

python3 support

This is the first release of Samba which has full support for Python 3. Samba 4.10 still has support for Python 2, however, Python 3 will be used by default, i.e. 'configure' & 'make' will execute using python3.

To build Samba with python2 you *must* set the 'PYTHON' environment variable for both the 'configure' and 'make' steps, i.e.

  'PYTHON=python2 ./configure'
  'PYTHON=python2 make'

This will override the python3 default.

Alternatively, it is possible to produce Samba Python bindings for both Python 2 and Python 3. To do so, specify '--extra-python=/usr/bin/python2' as part of the 'configure' command. Note that python3 will still be used as the default in this case.

Note:Samba 4.10 supports Python 3.4 onwards.

Future Python support

Samba 4.10 will be the last release that comes with full support for Python 2. Unfortunately, the Samba Team doesn't have the resources to support both Python 2 and Python 3 long-term.

Samba 4.11 will not have any runtime support for Python 2. This means if you use Python 2 bindings it is time to migrate to Python 3 now.

If you are building Samba using the '--disable-python' option (i.e. you're excluding all the run-time Python support), then this will continue to work on a system that supports either python2 or python3.

Note:Samba 4.11 will most likely only support Python 3.6 onwards.

JSON logging

Authentication messages now contain the Windows Event Id "eventId" and logon type "logonType". The supported event codes and logon types are:

Event codes:
4624 Successful logon
4625 Unsuccessful logon
Logon Types:
2 Interactive
3 Network
8 NetworkCleartext

The version number for Authentication messages is now 1.1, changed from 1.0

Password change messages now contain the Windows Event Id "eventId", the supported event Id's are:

4723 Password changed
4724 Password reset

The version number for PasswordChange messages is now 1.1, changed from 1.0

Group membership change messages now contain the Windows Event Id "eventId", the supported event Id's are:

4728 A member was added to a security enabled global group
4729 A member was removed from a security enabled global group
4732 A member was added to a security enabled local group
4733 A member was removed from a security enabled local group
4746 A member was added to a security disabled local group
4747 A member was removed from a security disabled local group
4751 A member was added to a security disabled global group
4752 A member was removed from a security disabled global group
4756 A member was added to a security enabled universal group
4757 A member was removed from a security enabled universal group
4761 A member was added to a security disabled universal group
4762 A member was removed from a security disabled universal group


The version number for GroupChange messages is now 1.1, changed from 1.0. Also A GroupChange message is generated when a new user is created to log that the user has been added to their primary group.

The leading "JSON <message type>:" and source file prefix of the JSON formatted log entries has been removed to make the parsing of the JSON log messages easier. JSON log entries now start with 2 spaces followed by an opening brace i.e. " {"

SMBv2 samba-tool support

On previous releases, some samba-tool commands would not work against a remote DC that had SMBv1 disabled. SMBv2 support has now been added for samba-tool. The affected commands are 'samba-tool domain backup|rename' and the 'samba-tool gpo' set of commands. Refer also BUG #13676.

New glusterfs_fuse VFS module

The new vfs_glusterfs_fuse module improves performance when Samba accesses a glusterfs volume mounted via FUSE (Filesystem in Userspace as part of the Linux kernel). It achieves that by leveraging a mechanism to retrieve the appropriate case of filenames by querying a specific extended attribute in the filesystem. No extra configuration is required to use this module, only glusterfs_fuse needs to be set in the "vfs objects" parameter. Further details can be found in the vfs_glusterfs_fuse(8) manpage. This new vfs_glusterfs_fuse module does not replace the existing vfs_glusterfs module, it just provides an additional, alternative mechanism to access a Gluster volume.

REMOVED FEATURES

MIT Kerberos build of the AD DC

While not removed, the MIT Kerberos build of the Samba AD DC is still considered experimental. Because Samba will not issue security patches for this configuration, such builds now require the explicit configure option: --with-experimental-mit-ad-dc

For further details see Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC

samba_backup

The samba_backup script has been removed. This has now been replaced by the 'samba-tool domain backup offline' command.


SMB client Python bindings

The SMB client python bindings are now deprecated and will be removed in future Samba releases. This will only affects users that may have used the Samba Python bindings to write their own utilities, i.e. users with a custom Python script that includes the line 'from samba import smb'.

smb.conf changes

 Parameter Name                     Description                Default
 --------------                     -----------                -------
 prefork backoff increment   Delay added to process restart    10 (seconds)
                             between attempts.
 prefork maximum backoff     Maximum delay for process between 120 (seconds)
                             process restart attempts
 smbd search ask sharemode   Name changed, old name was
                             "smbd:search ask sharemode"
 smbd async dosmode          Name changed, old name was
                             "smbd:async dosmode"
 smbd max async dosmode      Name changed, old name was
                             "smbd:max async dosmode"
 smbd getinfo ask sharemode  New: similar to "smbd search ask yes
                             sharemode" but for SMB getinfo

Samba 4.9

Release Notes for Samba 4.9.0
September 13, 2018

Release Announcements

This is the first stable release of the Samba 4.9 release series. Please read the release notes carefully before upgrading.

NEW FEATURES/CHANGES

'net ads setspn'

There is a new 'net ads setspn' sub command for managing Windows SPN(s) on the AD. This command aims to give the basic functionality that is provided on windows by 'setspn.exe' e.g. ability to add, delete and list Windows SPN(s) stored in a Windows AD Computer object.

The format of the command is:

net ads setspn list [machine]
net ads setspn [add | delete ] SPN [machine]

'machine' is the name of the computer account on the AD that is to be managed. If 'machine' is not specified the name of the 'client' running the command is used instead.

The format of a Windows SPN is

 'serviceclass/host:port/servicename' (servicename and port are optional)

serviceclass/host is generally sufficient to specify a host based service.

'net ads keytab' changes

net ads keytab add no longer attempts to convert the passed serviceclass (e.g. nfs, html etc.) into a Windows SPN which is added to the Windows AD computer object. By default just the keytab file is modified.

A new keytab subcommand 'add_update_ads' has been added to preserve the legacy behaviour. However the new 'net ads setspn add' subcommand should really be used instead.

net ads keytab create no longer tries to generate SPN(s) from existing entries in a keytab file. If it is required to add Windows SPN(s) then 'net ads setspn add' should be used instead.

Local authorization plugin for MIT Kerberos

This plugin controls the relationship between Kerberos principals and AD accounts through winbind. The module receives the Kerberos principal and the local account name as inputs and can then check if they match. This can resolve issues with canonicalized names returned by Kerberos within AD. If the user tries to log in as 'alice', but the samAccountName is set to ALICE (uppercase), Kerberos would return ALICE as the username. Kerberos would not be able to map 'alice' to 'ALICE' in this case and auth would fail. With this plugin account names can be correctly mapped. This only applies to GSSAPI authentication, not for getting the initial ticket granting ticket.

VFS audit modules

The vfs_full_audit module has changed its default set of monitored successful and failed operations from "all" to "none". That helps to prevent potential denial of service caused by simple addition of the module to the VFS objects.

Also, modules vfs_audit, vfs_ext_audit and vfs_full_audit now accept any valid syslog(3) facility, in accordance with the manual page.

Database audit support

Changes to the Samba AD's sam.ldb database are now logged to Samba's debug log under the "dsdb_audit" debug class and "dsdb_json_audit" for JSON formatted log entries.

Transaction commits and roll backs are now logged to Samba's debug logs under the "dsdb_transaction_audit" debug class and "dsdb_transaction_json_audit" for JSON formatted log entries.

Password change audit support

Password changes in the AD DC are now logged to Samba's debug logs under the "dsdb_password_audit" debug class and "dsdb_password_json_audit" for JSON formatted log entries.

Group membership change audit support

Group membership changes on the AD DC are now logged to Samba's debug log under the "dsdb_group_audit" debug class and "dsdb_group_json_audit" for JSON formatted log entries.

Log Authentication duration

For NTLM and Kerberos KDC authentication, the authentication duration is now logged. Note that the duration is only included in the JSON formatted log entries.

JSON library Jansson required for the AD DC

By default, the Jansson JSON library is required for Samba to build. It is strictly required for the Samba AD DC, and is optional for builds "--without-ad-dc" by specifying "--without-json-audit" at configure time.

New Experimental LMDB LDB backend

A new Experimental LDB backend using LMDB is now available. This allows databases larger than 4Gb (Currently the limit is set to 6Gb, but this will be increased in a future release). To enable lmdb, provision or join a domain using the "--backend-store=mdb" option.

This requires that a version of lmdb greater than 0.9.16 is installed and that samba has not been built with the "--without-ldb-lmdb" option.

Please note this is an experimental feature and is not recommended for production deployments.

Password Settings Objects

Support has been added for Password Settings Objects (PSOs). This AD feature is also known as Fine-Grained Password Policies (FGPP).

PSOs allow AD administrators to override the domain password policy settings for specific users, or groups of users. For example, PSOs can force certain users to have longer password lengths, or relax the complexity constraints for other users, and so on. PSOs can be applied to groups or to individual users. When multiple PSOs apply to the same user, essentially the PSO with the best precedence takes effect.

PSOs can be configured and applied to users/groups using the 'samba-tool domain passwordsettings pso' set of commands.

Domain backup and restore

A new 'samba-tool' command has been added that allows administrators to create a backup-file of their domain DB. In the event of a catastrophic failure of the domain, this backup-file can be used to restore Samba services.

The new 'samba-tool domain backup online' command takes a snapshot of the domain DB from a given DC. In the event of a catastrophic DB failure, all DCs in the domain should be taken offline, and the backup-file can then be used to recreate a fresh new DC, using the 'samba-tool domain backup restore' command. Once the backed-up domain DB has been restored on the new DC, other DCs can then subsequently be joined to the new DC, in order to repopulate the Samba network.

Domain rename tool

Basic support has been added for renaming a Samba domain. The rename feature is designed for the following cases:

  1. Running a temporary alternate domain, in the event of a catastrophic failure of the regular domain. Using a completely different domain name and realm means that the original domain and the renamed domain can both run at the same time, without interfering with each other. This is an advantage over creating a regular 'online' backup - it means the renamed/alternate domain can provide core Samba network services, while trouble-shooting the fault on the original domain can be done in parallel.
  2. Creating a realistic lab domain or pre-production domain for testing.

Note that the renamed tool is currently not intended to support a long-term rename of the production domain. Currently renaming the GPOs is not supported and would need to be done manually.

The domain rename is done in two steps:

first, the 'samba-tool domain backup rename' command will clone the domain DB, renaming it in the process, and producing a backup-file.
Then, the 'samba-tool domain backup restore' command takes the backup-file and restores the renamed DB to disk on a fresh DC.

New samba-tool options for diagnosing DRS replication issues

The 'samba-tool drs showrepl' command has two new options controlling the output. With --summary, the command says very little when DRS replication is working well. With --json, JSON is produced. These options are intended for human and machine audiences, respectively.

The 'samba-tool visualize uptodateness' visualizes replication lag as a heat-map matrix based on the DRS uptodateness vectors. This will show you if (but not why) changes are failing to replicate to some DCs.

Automatic site coverage and GetDCName improvements

Samba's AD DC now automatically claims otherwise empty sites based on which DC is the nearest in the replication topology.

This, combined with efforts to correctly identify the client side in the GetDCName Netlogon call will improve service to sites without a local DC.

Improved 'samba-tool computer' command

The 'samba-tool computer' command allow manipulation of computer accounts including creating a new computer and resetting the password. This allows an 'offline join' of a member server or workstation to the Samba AD domain.

New 'samba-tool ou' command

The new 'samba-tool ou' command allows to manage organizational units.

Available subcommands are:

 create       - Create an organizational unit.
 delete       - Delete an organizational unit.
 list         - List all organizational units
 listobjects  - List all objects in an organizational unit.
 move         - Move an organizational unit.
 rename       - Rename an organizational unit.

In addition to the ou commands, there are new subcommands for the user and group management, which can make use of the organizational units:

 group move   - Move a group to an organizational unit/container.
 user move    - Move a user to an organizational unit/container.
 user show    - Display a user AD object.

Samba performance tool now operates against Microsoft Windows AD

The Samba AD performance testing tool 'traffic_reply' can now operate against a Windows based AD domain. Previously it only operated correctly against Samba.

DNS entries are now cleaned up during DC demote

DNS records are now cleaned up as part of the 'samba-tool domain demote' including both the default and '--remove-other-dead-server' modes.

Additionally, DNS records can be automatically cleaned up for a given name with the 'samba-tool dns cleanup' command, which aids in cleaning up partially removed DCs.

samba-tool ntacl sysvolreset is now much faster

The 'samba-tool ntacl sysvolreset' command, used on the Samba AD DC, is now much faster than in previous versions, after an internal rework.

Samba now tested with CI GitLab

Samba developers now have pre-commit testing available in GitLab, giving reviewers confidence that the submitted patches pass a full CI before being submitted to the Samba Team's own autobuild system.

Dynamic DNS record scavenging support

It is now possible to enable scavenging of DNS Zones to remove DNS records that were dynamically created and have not been touched in some time.

This support should however only be enabled on new zones or new installations. Sadly old Samba versions suffer from BUG #12451 and mark dynamic DNS records as static and static records as dynamic. While a dbcheck rule may be able to find these in the future, currently a reliable test has not been devised.

Finally, there is not currently a command-line tool to enable this feature, currently it should be enabled from the DNS Manager tool from Windows. Also the feature needs to have been enabled by setting the smb.conf parameter "dns zone scavenging = yes".

Improved support for trusted domains (as AD DC)

The support for trusted domains/forests has been further improved.

External domain trusts, as well a transitive forest trusts, are supported in both directions (inbound and outbound) for Kerberos and NTLM authentication.

The following features are new in 4.9 (compared to 4.8):

  • It's now possible to add users/groups of a trusted domain into domain groups. The group memberships are expanded on trust boundaries.
  • foreignSecurityPrincipal objects (FPO) are now automatically created when members (as SID) of a trusted domain/forest are added to a group.
  • The 'samba-tool group *members' commands allow members to be specified as foreign SIDs.

However there are currently still a few limitations:

  • Both sides of the trust need to fully trust each other!
  • No SID filtering rules are applied at all!
  • This means DCs of domain A can grant domain admin rights in domain B.
  • Selective (CROSS_ORGANIZATION) authentication is not supported. It's possible to create such a trust, but the KDC and winbindd ignore them.
  • Samba can still only operate in a forest with just one single domain.

CTDB changes

There are many changes to CTDB in this release.

  • Configuration has been completely overhauled
  • Daemon and tool options are now specified in a new ctdb.conf Samba-style configuration file. See ctdb.conf(5) for details.
  • Event script configuration is no longer specified in the top-level configuration file. It can now be specified per event script. For example, configuration options for the 50.samba event script can be placed alongside the event script in a file called 50.samba.options. Script options can also be specified in a new script.options file. See ctdb-script.options(5) for details.
  • Options that affect CTDB startup should be configured in the distribution-specific configuration file. See ctdb.sysconfig(5) for details.
  • Tunable settings are now loaded from ctdb.tunables. Using CTDB_SET_TunableVariable=<value> in the main configuration file is no longer supported. See ctdb-tunables(7) for details.
A example script to migrate an old-style configuration to the new style is available in ctdb/doc/examples/config_migrate.sh.
  • The following configuration variables and corresponding ctdbd command-line options have been removed and not replaced with counterparts in the new configuration scheme:
   CTDB_PIDFILE                      --pidfile
   CTDB_SOCKET			     --socket
   CTDB_NODES			     --nlist
   CTDB_PUBLIC_ADDRESSES	     --public-addresses
   CTDB_EVENT_SCRIPT_DIR	     --event-script-dir
   CTDB_NOTIFY_SCRIPT		     --notification-script
   CTDB_PUBLIC_INTERFACE	     --public-interface
   CTDB_MAX_PERSISTENT_CHECK_ERRORS  --max-persistent-check-errors
  • ify.d/ subdirectory of the configuration directory are now run by unconditionally.
  • Interfaces for public IP addresses must always be specified in the
public_addresses file using the currently supported format.
Some related items that have been removed are:
  • The ctdb command's --socket command-line option
  • The ctdb command's CTDB_NODES environment variable
When writing tests there are still mechanisms available to change the locations of certain directories and files.
  • The following ctdbd.conf and ctdbd options have been replaced by new ctdb.conf options:
   CTDB_LOGGING/--logging                     logging  -> location
   CTDB_DEBUGLEVEL/-d                         logging  -> log level
   CTDB_TRANSPORT/--transport                 cluster  -> transport
   CTDB_NODE_ADDRESS/--listen                 cluster  -> node address
   CTDB_RECOVERY_LOCK/--reclock               cluster  -> recovery lock
   CTDB_DBDIR/--dbdir                         database -> volatile database directory
   CTDB_DBDIR_PERSISTENT/--dbdir-persistent   database -> peristent database directory
   CTDB_DBDIR_STATE/--dbdir-state             database -> state database directory
   CTDB_DEBUG_LOCKS                           database -> lock debug script
   CTDB_DEBUG_HUNG_SCRIPT                     event    -> debug script
   CTDB_NOSETSCHED/--nosetsched               legacy   -> realtime scheduling
   CTDB_CAPABILITY_RECMASTER/--no-recmaster   legacy   -> recmaster capability
   CTDB_CAPABILITY_LMASTER/--no-lmaster       legacy   -> lmaster capability
   CTDB_START_AS_STOPPED/--start-as-stopped   legacy   -> start as stopped
   CTDB_START_AS_DISABLED/--start-as-disabled legacy   -> start as disabled
   CTDB_SCRIPT_LOG_LEVEL/--script-log-level   legacy   -> script log level
  • Event scripts have moved to the scripts/legacy subdirectory of the configuration directory
Event scripts must now end with a ".script" suffix.
  • The "ctdb event" command has changed in 2 ways:
  • A component is now required for all commands
In this release the only valid component is "legacy".
  • There is no longer a default event when running "ctdb event status"
Listing the status of the "monitor" event is now done via:
ctdb event status legacy monitor
See ctdb(1) for details.
  • The following service-related event script options have been removed:
   CTDB_MANAGES_SAMBA
   CTDB_MANAGES_WINBIND
   CTDB_MANAGES_CLAMD
   CTDB_MANAGES_HTTPD
   CTDB_MANAGES_ISCSI
   CTDB_MANAGES_NFS
   CTDB_MANAGES_VSFTPD
   CTDB_MANAGED_SERVICES
Event scripts for services are now disabled by default. To enable an event script and, therefore, manage a service use a command like the following:
   ctdb event script enable legacy 50.samba
  • Notification scripts have moved to the scripts/notification subdirectory of the configuration directory
Notification scripts must now end with a ".script" suffix.
  • Support for setting CTDB_DBDIR=tmpfs has been removed
This feature has not been implemented in the new configuration system. If this is desired then a tmpfs filesystem should be manually mounted on the directory pointed to by the "volatile database directory" option. See ctdb.conf(5) for more details.
  • The following tunable options are now ctdb.conf options:
   DisabledIPFailover    failover -> disabled
   TDBMutexEnabled       database -> tdb mutexes
  • Support for the NoIPHostOnAllDisabled tunable has been removed
If all nodes are unhealthy or disabled then CTDB will not host public IP addresses. That is, CTDB now behaves as if NoIPHostOnAllDisabled were set to 1.
  • The onnode command's CTDB_NODES_FILE environment variable has been removed
The -f option can still be used to specify an alternate node file.
  • The 10.external event script has been removed
  • The CTDB_SHUTDOWN_TIMEOUT configuration variable has been removed
As with other daemons, if ctdbd does not shut down when requested then manual intervention is required. There is no safe way of automatically killing ctdbd after a failed shutdown.
  • CTDB_SUPPRESS_COREFILE and CTDB_MAX_OPEN_FILES configuration variable have been removed
These should be setup in the systemd unit/system file or, for SYSV init, in the distribution-specific configuration file for the ctdb service.
  • CTDB_PARTIALLY_ONLINE_INTERFACES incompatibility no longer enforced
11.natgw and 91.lvs will no longer fail if CTDB_PARTIALLY_ONLINE_INTERFACES=yes. The incompatibility is, however, well documented. This option will be removed in future and replaced by sensible behaviour where public IP addresses simply switch interfaces or become unavailable when interfaces are down.
  • Configuration file /etc/ctdb/sysconfig/ctdb is no longer supported

GPO Improvements

The 'samba_gpoupdate' command (used in applying Group Policies to the samba machine itself) has been renamed to 'samba_gpupdate' and had the syntax changed to better match the same tool on Windows.

REMOVED FEATURES

smb.conf changes

As the most popular Samba install platforms (Linux and FreeBSD) both support extended attributes by default, the parameters "map readonly", "store dos attributes" and "ea support" have had their defaults changed to allow better Windows fileserver compatibility in a default install.

 Parameter Name                     Description             Default
 --------------                     -----------             -------
 map readonly                       Default changed              no
 store dos attributes               Default changed             yes
 ea support                         Default changed             yes
 full_audit:success                 Default changed            none
 full_audit:failure                 Default changed            none

VFS interface changes

The VFS ABI interface version has changed to 39. Function changes are:

SMB_VFS_FSYNC: Removed: Only async versions are used.
SMB_VFS_READ: Removed: Only PREAD or async versions are used.
SMB_VFS_WRITE: Removed: Only PWRITE or async versions are used.
SMB_VFS_CHMOD_ACL: Removed: Only CHMOD is used.
SMB_VFS_FCHMOD_ACL: Removed: Only FCHMOD is used.

Any external VFS modules will need to be updated to match these changes in order to work with 4.9.x.

Samba 4.8

Release Notes for Samba 4.8.0
March 13, 2018

Release Announcements

This is the first stable release of the Samba 4.8 release series. Please read the release notes carefully before upgrading.

UPGRADING

New GUID Index mode in sam.ldb for the AD DC

Users who upgrade a Samba AD DC in-place will experience a short delay in the first startup of Samba while the sam.ldb is re-indexed.

Unlike in previous releases a transparent downgrade is not possible. If you wish to downgrade such a DB to a Samba 4.7 or earlier version, please run the source4/scripting/bin/sambaundoguididx script first.

Domain member setups require winbindd

Setups with "security = domain" or "security = ads" require a running 'winbindd' now. The fallback that smbd directly contacts domain controllers is gone.

smbclient reparse point symlink parameters reversed

See the more detailed description below.

Changed trusted domains listing with wbinfo -m --verbose

See the more detailed description below.

NEW FEATURES/CHANGES

New GUID Index mode in sam.ldb for the AD DC

The new layout used for sam.ldb is GUID, rather than DN oriented. This provides Samba's Active Directory Domain Controller with a faster database, particularly at larger scale.

The underlying DB is still TDB, simply the choice of key has changed.

The new mode is not optional, so no configuration is required. Older Samba versions cannot read the new database (see the upgrade note above).

KDC GPO application

Adds Group Policy support for the Samba kdc. Applies password policies (minimum/maximum password age, minimum password length, and password complexity) and kerberos policies (user/service ticket lifetime and renew lifetime).

Adds the samba_gpoupdate script for applying and unapplying policy. Can be applied automatically by setting

'apply group policies = yes'.

Time Machine Support with vfs_fruit

Samba can be configured as a Time Machine target for Apple Mac devices through the vfs_fruit module. When enabling a share for Time Machine support the relevant Avahi records to support discovery will be published for installations that have been built against the Avahi client library.

Shares can be designated as a Time Machine share with the following setting:

 'fruit:time machine = yes'

Support for lower casing the MDNS Name

Allows the server name that is advertised through MDNS to be set to the hostname rather than the Samba NETBIOS name. This allows an administrator to make Samba registered MDNS records match the case of the hostname rather than being in all capitals.

This can be set with the following settings:

 'mdns name = mdns'

Encrypted secrets

Attributes deemed to be sensitive are now encrypted on disk. The sensitive values are currently: pekList msDS-ExecuteScriptPassword currentValue dBCSPwd initialAuthIncoming initialAuthOutgoing lmPwdHistory ntPwdHistory priorValue supplementalCredentials trustAuthIncoming trustAuthOutgoing unicodePwd clearTextPassword

This encryption is enabled by default on a new provision or join, it can be disabled at provision or join time with the new option '--plaintext-secrets'.

However, an in-place upgrade will not encrypt the database.

Once encrypted, it is not possible to do an in-place downgrade (eg to 4.7) of the database. To obtain an unencrypted copy of the database a new DC join should be performed, specifying the '--plaintext-secrets' option.

The key file "encrypted_secrets.key" is created in the same directory as the database and should NEVER be disclosed. It is included by the samba_backup script.

Active Directory replication visualisation

To work out what is happening in a replication graph, it is sometimes helpful to use visualisations. We introduce a samba-tool subcommand to write Graphviz dot output and generate text-based heatmaps of the distance in hops between DCs.

There are two subcommands, two graphical modes, and (roughly) two modes of operation with respect to the location of authority.

  • 'samba-tool visualize ntdsconn' looks at NTDS Connections.
  • 'samba-tool visualize reps' looks at repsTo and repsFrom objects.

In '--distance' mode (default), the distances between DCs are shown in a matrix in the terminal. With '--color=yes', this is depicted as a heatmap. With '--utf8' it is a lttle prettier.

In '--dot' mode, Graphviz dot output is generated. When viewed using dot or xdot, this shows the network as a graph with DCs as vertices and connections edges. Certain types of degenerate edges are shown in different colours or line-styles.

smbclient reparse point symlink parameters reversed

A bug in smbclient caused the 'symlink' command to reverse the meaning of the new name and link target parameters when creating a reparse point symlink against a Windows server. As this is a little used feature the ordering of these parameters has been reversed to match the parameter ordering of the UNIX extensions 'symlink' command. The usage message for this command has also been improved to remove confusion.

Winbind changes

The dependency to global list of trusted domains within the winbindd processes has been reduced a lot.

The construction of that global list is not reliable and often incomplete in complex trust setups. In most situations the list is not needed any more for winbindd to operate correctly. E.g. for plain file serving via SMB using a simple idmap setup with autorid, tdb or ad. However some more complex setups require the list, e.g. if you specify idmap backends for specific domains. Some pam_winbind setups may also require the global list.

If you have a setup that doesn't require the global list, you should set "winbind scan trusted domains = no".

Improved support for trusted domains (as AD DC)

The support for trusted domains/forests has improved a lot.

External domain trusts, as well a transitive forest trusts, are supported in both directions (inbound and outbound) for Kerberos and NTLM authentication now.

The LSA LookupNames and LookupSids implementations support resolving names and sids from trusts domains/forest now. This is important in order to allow Samba based domain members to make use of the trust.

However there are currently still a few limitations:

  • It's not possible to add users/groups of a trusted domainvinto domain groups. So group memberships are not expanded on trust boundaries.
See https://bugzilla.samba.org/show_bug.cgi?id=13300
  • Both sides of the trust need to fully trust each other!
  • No SID filtering rules are applied at all!
  • This means DCs of domain A can grant domain admin rights in domain B.
  • Selective (CROSS_ORIGANIZATION) authentication is not supported. It's possible to create such a trust, but the KDC and winbindd ignore them.

Changed trusted domains listing with wbinfo -m --verbose

The trust properties printed by wbinfo -m --verbose have been changed to correctly reflect the view of the system where wbinfo is executed.

The trust type field in particular can show additional values that correctly reflect the type of the trust: "Local" for the local SAM and BUILTIN, "Workstation" for a workstation trust to the primary domain, "RWDC" for the SAM on a AD DC, "RODC" for the SAM on a read-only DC, "PDC" for the SAM on a NT4-style DC, "Forest" for a AD forest trust and "External" for quarantined, external or NT4-style trusts.

Indirect trusts are shown as "Routed" including the routing domain.

Example, on a AD DC (SDOM1):

Domain Name DNS Domain          Trust Type  Transitive  In   Out
BUILTIN                         Local
SDOM1       sdom1.site          RWDC
WDOM3       wdom3.site          Forest      Yes         No   Yes
WDOM2       wdom2.site          Forest      Yes         Yes  Yes
SUBDOM31    subdom31.wdom3.site Routed (via WDOM3)
SUBDOM21    subdom21.wdom2.site Routed (via WDOM2)

Same setup, on a member of WDOM2:

Domain Name DNS Domain          Trust Type  Transitive  In   Out
BUILTIN                         Local
TITAN                           Local
WDOM2       wdom2.site          Workstation Yes         No   Yes
WDOM1       wdom1.site          Routed (via WDOM2)
WDOM3       wdom3.site          Routed (via WDOM2)
SUBDOM21    subdom21.wdom2.site Routed (via WDOM2)
SDOM1       sdom1.site          Routed (via WDOM2)
SUBDOM11    subdom11.wdom1.site Routed (via WDOM2)

The list of trusts may be incomplete and additional domains may appear as "Routed" if a user of an unknown domain is successfully authenticated.

VirusFilter VFS module

This new module integrates with Sophos, F-Secure and ClamAV anti-virus software to provide scanning and filtering of files on a Samba share.

REMOVED FEATURES

'net serverid' commands removed

The two commands 'net serverid list' and 'net serverid wipe' have been removed, because the file serverid.tdb is not used anymore.

'net serverid list' can be replaced by listing all files in the subdirectory "msg.lock" of Samba's "lock directory". The unique id listed by 'net serverid list' is stored in every process' lockfile in "msg.lock".

'net serverid wipe' is not necessary anymore. It was meant primarily for clustered environments, where the serverid.tdb file was not properly cleaned up after single node crashes. Nowadays smbd and winbind take care of cleaning up the msg.lock and msg.sock directories automatically.

NT4-style replication based net commands removed

The following commands and sub-commands have been removed from the "net" utility:

  • net rpc samdump
  • net rpc vampire ldif

Also, replicating from a real NT4 domain with "net rpc vampire" and "net rpc vampire keytab" has been removed.

The NT4-based commands were accidentally broken in 2013, and nobody noticed the breakage. So instead of fixing them including tests (which would have meant writing a server for the protocols, which we don't have) we decided to remove them.

For the same reason, the "samsync", "samdeltas" and "database_redo" commands have been removed from rpcclient.

"net rpc vampire keytab" from Active Directory domains continues to be supported.

vfs_aio_linux module removed

The current Linux kernel aio does not match what Samba would do. Shipping code that uses it leads people to false assumptions. Samba implements async I/O based on threads by default, there is no special module required to see benefits of read and write request being sent do the disk in parallel.

smb.conf changes

 Parameter Name                     Description             Default
 --------------                     -----------             -------
 apply group policies               New                     no
 auth methods                       Removed
 binddns dir                        New
 client schannel                    Default changed/        yes
                                    Deprecated
 gpo update command                 New
 ldap ssl ads                       Deprecated
 map untrusted to domain            Removed
 oplock contention limit            Removed
 prefork children                   New                     1
 mdns name                          New                     netbios
 fruit:time machine                 New                     false
 profile acls                       Removed
 use spnego                         Removed
 server schannel                    Default changed/        yes
                                    Deprecated
 unicode                            Deprecated
 winbind scan trusted domains       New                     yes
 winbind trusted domains only       Removed

Samba 4.7

Release Notes for Samba 4.7.0
September 20, 2017

Release Announcements

This is the first stable release of Samba 4.7.

Please read the release notes carefully before upgrading.

UPGRADING

smbclient changes

'smbclient' no longer prints a 'Domain=[...] OS=[Windows 6.1] Server=[...]' banner when connecting to the first server. With SMB2 and Kerberos there's no way to print this information reliable. Now we avoid it at all consistently. In interactive session the following banner is now presented to the user: 'Try "help" do get a list of possible commands.'.

The default for "client max protocol" has changed to "SMB3_11", which means that 'smbclient' (and related commands) will work against servers without SMB1 support.

It's possible to use the '-m/--max-protocol' option to overwrite the "client max protocol" option temporarily.

Note that the '-e/--encrypt' option also works with most SMB3 servers (e.g. Windows >= 2012 and Samba >= 4.0.0), so the SMB1 unix extensions are not required for encryption.

The change to SMB3_11 as default also means smbclient no longer negotiates SMB1 unix extensions by default, when talking to a Samba server with "unix extensions = yes". As a result, some commands are not available, e.g. 'posix_encrypt', 'posix_open', 'posix_mkdir', 'posix_rmdir', 'posix_unlink', posix_whoami', 'getfacl' and 'symlink'. Using "-mNT1" reenabled them, if the server supports SMB1.

Note: the default ("CORE") for "client min protocol" hasn't changed, so it's still possible to connect to SMB1-only servers by default.

'smbclient' learned a new command 'deltree' that is able to do a recursive deletion of a directory tree.

NEW FEATURES/CHANGES

Whole DB read locks: Improved LDAP and replication consistency

Prior to Samba 4.7 and ldb 1.2.0, the LDB database layer used by Samba erroneously did not take whole-DB read locks to protect search and DRS replication operations.

While each object returned remained subject to a record-level lock (so would remain consistent to itself), under a race condition with a rename or delete, it and any links (like the member attribute) to it would not be returned.

The symptoms of this issue include:

Replication failures with this error showing in the client side logs:

error during DRS repl ADD: No objectClass found in replPropertyMetaData for Failed to commit objects:
WERR_GEN_FAILURE/NT_STATUS_INVALID_NETWORK_RESPONSE

A crash of the server, in particular the rpc_server process with

INTERNAL ERROR: Signal 11

LDAP read inconsistency

A DN subject to a search at the same time as it is being renamed may not appear under either the old or new name, but will re-appear for a subsequent search.

See BUG #12858 for more details and updated advise on database recovery for affected installations.

Samba AD with MIT Kerberos

After four years of development, Samba finally supports compiling and running Samba AD with MIT Kerberos. You can enable it with:

   ./configure --with-system-mitkrb5

Samba requires version 1.15.1 of MIT Kerberos to build with AD DC support. The krb5-devel and krb5-server packages are required. The feature set is not on par with with the Heimdal build but the most important things, like forest and external trusts, are working. Samba uses the KDC binary provided by MIT Kerberos.

Missing features, compared to Heimdal, are:

  • PKINIT support
  • S4U2SELF/S4U2PROXY support
  • RODC support (not fully working with Heimdal either)

The Samba AD process will take care of starting the MIT KDC and it will load a KDB (Kerberos Database) driver to access the Samba AD database. When provisioning an AD DC using 'samba-tool' it will take care of creating a correct kdc.conf file for the MIT KDC.

For further details, see:

Running_a_Samba_AD_DC with_MIT_Kerberos_KDC

Dynamic RPC port range

The dynamic port range for RPC services has been changed from the old default value "1024-1300" to "49152-65535". This port range is not only used by a Samba AD DC but also applies to all other server roles including NT4-style domain controllers. The new value has been defined by Microsoft in Windows Server 2008 and newer versions. To make it easier for Administrators to control those port ranges we use the same default and make it configurable with the option: "rpc server dynamic port range".

The "rpc server port" option sets the first available port from the new "rpc server dynamic port range" option. The option "rpc server port" only applies to Samba provisioned as an AD DC.

Authentication and Authorization audit support

Detailed authentication and authorization audit information is now logged to Samba's debug logs under the "auth_audit" debug class, including in particular the client IP address triggering the audit line. Additionally, if Samba is compiled against the jansson JSON library, a JSON representation is logged under the "auth_json_audit" debug class.

Audit support is comprehensive for all authentication and authorisation of user accounts in the Samba Active Directory Domain Controller, as well as the implicit authentication in password changes. In the file server and classic/NT4 domain controller, NTLM authentication, SMB and RPC authorization is covered, however password changes are not at this stage, and this support is not currently backed by a testsuite.

For further details, see:

Setting_up_Audit_Logging

Multi-process LDAP Server

The LDAP server in the AD DC now honours the process model used for the rest of the 'samba' process, rather than being forced into a single process. This aids in Samba's ability to scale to larger numbers of AD clients and the AD DC's overall resiliency, but will mean that there is a fork()ed child for every LDAP client, which may be more resource intensive in some situations. If you run Samba in a resource-constrained VM, consider allocating more RAM and swap space.

Improved Read-Only Domain Controller (RODC) Support

Support for RODCs in Samba AD until now has been experimental. With this latest version, many of the critical bugs have been fixed and the RODC can be used in DC environments requiring no writable behaviour. RODCs now correctly support bad password lockouts and password disclosure auditing through the msDS-RevealedUsers attribute.

The fixes made to the RWDC will also allow Windows RODC to function more correctly and to avoid strange data omissions such as failures to replicate groups or updated passwords. Password changes are currently rejected at the RODC, although referrals should be given over LDAP. While any bad passwords can trigger domain-wide lockout, good passwords which have not been replicated yet for a password change can only be used via NTLM on the RODC (and not Kerberos).

The reliability of RODCs locating a writable partner still requires some improvements and so the 'password server' configuration option is generally recommended on the RODC.

Samba 4.7 is the first Samba release to be secure as an RODC or when hosting an RODC. If you have been using earlier Samba versions to host or be an RODC, please upgrade.

In particular see https://bugzilla.samba.org/show_bug.cgi?id=12977 for details on the security implications for password disclosure to an RODC using earlier versions.

Additional password hashes stored in supplementalCredentials

A new config option 'password hash userPassword schemes' has been added to enable generation of SHA-256 and SHA-512 hashes (without storing the plaintext password with reversible encryption). This builds upon previous work to improve password sync for the AD DC (originally using GPG).

The user command of 'samba-tool' has been updated in order to be able to extract these additional hashes, as well as extracting the (HTTP) WDigest hashes that we had also been storing in supplementalCredentials.

Improvements to DNS during Active Directory domain join

The 'samba-tool' domain join command will now add the A and GUID DNS records (on both the local and remote servers) during a join if possible via RPC. This should allow replication to proceed more smoothly post-join.

The mname element of the SOA record will now also be dynamically generated to point to the local read-write server. 'samba_dnsupdate' should now be more reliable as it will now find the appropriate name server even when resolv.conf points to a forwarder.

Significant AD performance and replication improvements

Previously, replication of group memberships was been an incredibly expensive process for the AD DC. This was mostly due to unnecessary CPU time being spent parsing member linked attributes. The database now stores these linked attributes in sorted form to perform efficient searches for existing members. In domains with a large number of group memberships, a join can now be completed in half the time compared with Samba 4.6.

LDAP search performance has also improved, particularly in the unindexed search case. Parsing and processing of security descriptors should now be more efficient, improving replication but also overall performance.

Query record for open file or directory

The record attached to an open file or directory in Samba can be queried through the 'net tdb locking' command. In clustered Samba this can be useful to determine the file or directory triggering corresponding "hot" record warnings in ctdb.

Removal of lpcfg_register_defaults_hook()

The undocumented and unsupported function lpcfg_register_defaults_hook() that was used by external projects to call into Samba and modify smb.conf default parameter settings has been removed. If your project was using this call please raise the issue on samba-technical@lists.samba.org in order to design a supported way of obtaining the same functionality.

Change of loadable module interface

The _init function of all loadable modules in Samba has changed from:

NTSTATUS _init(void);

to:

NTSTATUS _init(TALLOC_CTX *);

This allows a program loading a module to pass in a long-lived talloc context (which must be guaranteed to be alive for the lifetime of the module). This allows modules to avoid use of the talloc_autofree_context() (which is inherently thread-unsafe) and still be valgrind-clean on exit. Modules that don't need to free long-lived data on exit should use the NULL talloc context.

Parameter changes

The "strict sync" global parameter has been changed from a default of "no" to "yes". This means smbd will by default obey client requests to synchronize unwritten data in operating system buffers safely onto disk. This is a safer default setting for modern SMB1/2/3 clients.

The 'ntlm auth' option default is renamed to 'ntlmv2-only', reflecting the previous behaviour. Two new values have been provided, 'mschapv2-and-ntlmv2-only' (allowing MSCHAPv2 while denying NTLMv1) and 'disabled', totally disabling NTLM authentication and password changes.

SHA256 LDAPS Certificates

The self-signed certificate generated for use on LDAPS will now be generated with a SHA256 self-signature, not a SHA1 self-signature.

Replacing this certificate with a certificate signed by a trusted CA is still highly recommended.

CTDB changes

  • CTDB no longer allows mixed minor versions in a cluster
See the AllowMixedVersions tunable option in ctdb-tunables(7) and also Upgrading_a_CTDB_cluster#Policy
  • CTDB now ignores hints from Samba about TDB flags when attaching to databases
CTDB will use the correct flags depending on the type of database. For clustered databases, the smb.conf setting dbwrap_tdb_mutexes:*=true will be ignored. Instead, CTDB continues to use the TDBMutexEnabled tunable.
  • New configuration variable CTDB_NFS_CHECKS_DIR
See ctdbd.conf(5) for more details.
  • The CTDB_SERVICE_AUTOSTARTSTOP configuration variable has been removed
To continue to manage/unmanage services while CTDB is running:
  • Start service by hand and then flag it as managed
  • Mark service as unmanaged and shut it down by hand
  • In some cases CTDB does something fancy - e.g. start Samba under "nice", so care is needed. One technique is to disable the eventscript, mark as managed, run the startup event by hand and then re-enable the eventscript.
  • The CTDB_SCRIPT_DEBUGLEVEL configuration variable has been removed
  • The example NFS Ganesha call-out has been improved
  • A new "replicated" database type is available
Replicated databases are intended for CTDB's internal use to replicate state data across the cluster, but may find other uses. The data in replicated databases is valid for the lifetime of CTDB and cleared on first attach.


Using x86_64 Accelerated AES Crypto Instructions

Samba on x86_64 can now be configured to use the Intel accelerated AES instruction set, which has the potential to make SMB3 signing and encryption much faster on client and server. To enable this, configure Samba using the new option --accel-aes=intelaesni.

This is a temporary solution that is being included to allow users to enjoy the benefits of Intel accelerated AES on the x86_64 platform, but the longer-term solution will be to move Samba to a fully supported external crypto library.

The third_party/aesni-intel code will be removed from Samba as soon as external crypto library performance reaches parity.

The default is to build without setting --accel-aes, which uses the existing Samba software AES implementation.

smb.conf changes

 Parameter Name                     Description             Default
 --------------                     -----------             -------
 allow unsafe cluster upgrade       New parameter           no
 auth event notification            New parameter           no
 auth methods                       Deprecated
 client max protocol                Effective               SMB3_11
                                    default changed
 map untrusted to domain            New value/              auto
                                    Default changed/
                                    Deprecated
 mit kdc command                    New parameter
 profile acls                       Deprecated
 rpc server dynamic port range      New parameter           49152-65535
 strict sync                        Default changed         yes
 password hash userPassword schemes New parameter
 ntlm auth                          New values              ntlmv2-only

Samba 4.6

Release Notes for Samba 4.6.0
March 7, 2017

Release Announcements

This is the first stable release of Samba 4.6.

Please read the release notes carefully before upgrading.

UPGRADING

ID Mapping

We discovered that the majority of users have an invalid or incorrect ID mapping configuration. We implemented checks in the 'testparm' tool to validate the ID mapping configuration. You should run it and check if it prints any warnings or errors after upgrading! If it does you should fix them. See the 'IDENTITY MAPPING CONSIDERATIONS' section in the smb.conf manpage. There are some ID mapping backends which are not allowed to be used for the default backend. Winbind will no longer start if an invalid backend is configured as the default backend.

To avoid problems in future we advise all users to run 'testparm' after changing the smb.conf file!

vfs_fruit option "fruit:resource" spelling correction

Due to a spelling error in the vfs_fruit option parsing for the "fruit:resource" option, users who have set this option in their smb.conf were still using the default setting "fruit:resource = file" as the parser was looking for the string "fruit:ressource" (two "s").

After upgrading to this Samba version 4.6, you MUST either remove the option from your smb.conf or set it to the default "fruit:resource = file", otherwise your macOS clients will not be able to access the resource fork data.

This version Samba 4.6 accepts both the correct and incorrect spelling, but the next Samba version 4.7 will not accept the wrong spelling.

Users who were using the wrong spelling "ressource" with two "s" can keep the setting, but are advised to switch to the correct spelling.

vfs_fruit Netatalk metadata xattr name on *BSD

Users on *BSD must rename the metadata xattr used by vfs_fruit when using the default setting "fruit:metadata = netatalk".

Due to a glitch in the Samba xattr API compatibility layer for FreeBSD and a mistake in vfs_fruit, vfs_fruit ended up using the wrong xattr name when configured with "fruit:metadata = netatalk" (default). Instead of the correct

 org.netatalk.Metadata

it used

 netatalk.Metadata

Starting with Samba 4.6 vfs_fruit will use the correct "org.netatalk.Metadata" which means existing installations must rename this xattrs. For this purpose Samba now includes a new tool `mvxattr`. See below for further details.

NEW FEATURES/CHANGES

Kerberos client encryption types

Some parts of Samba (most notably winbindd) perform Kerberos client operations based on a Samba-generated krb5.conf file. A new parameter, "kerberos encryption types" allows configuring the encryption types set in this file, thereby allowing the user to enforce strong or legacy encryption in Kerberos exchanges.

The default value of "all" is compatible with previous behavior, allowing all encryption algorithms to be negotiated. Setting the parameter to "strong" only allows AES-based algorithms to be negotiated. Setting the parameter to "legacy" allows only RC4-HMAC-MD5 - the legacy algorithm for Active Directory. This can solves some corner cases of mixed environments with Server 2003R2 and newer DCs.

Printing

Support for uploading printer drivers from newer Windows clients (Windows 10) has been added until our implementation of [MS-PAR] protocol is ready. Several issues with uploading different printing drivers have been addressed.

The OS Version for the printing server has been increased to announce Windows Server 2003 R2 SP2. If a driver needs a newer version then you should check the smb.conf manpage for details.

New option for owner inheritance

The "inherit owner" smb.conf parameter instructs smbd to set the owner of files to be the same as the parent directory's owner. Up until now, this parameter could be set to "yes" or "no". A new option, "unix only", enables this feature only for the UNIX owner of the file, not affecting the SID owner in the Windows NT ACL of the file. This can be used to emulate something very similar to folder quotas.

Multi-process Netlogon support

The Netlogon server in the Samba AD DC can now run as multiple processes. The Netlogon server is a part of the AD DC that handles NTLM authentication on behalf of domain members, including file servers, NTLM-authenticated web servers and 802.1x gateways. The previous restriction to running as a single process has been removed, and it will now run in the same process model as the rest of the 'samba' binary.

As part of this change, the NETLOGON service will now run on a distinct TCP port, rather than being shared with all other RPC services (LSA, SAMR, DRSUAPI etc).

New options for controlling TCP ports used for RPC services

The new 'rpc server port' option controls the default port used for RPC services other than Netlogon. The Netlogon server honours instead the 'rpc server port:netlogon' option. The default value for both these options is the first available port including or after 1024.

AD LDAP and replication performance improvements

Samba's LDB (the database holding the AD directory tree, as seen via LDAP) and our DRSUAPI replication code continues to improve, particularly in respect to the handling of large numbers of objects or linked attributes.

  • We now respect an 'uptodateness vector' which will dramatically reduce the over-replication of links from new DCs.
  • We have also made the parsing of on-disk linked attributes much more efficient.
  • We rely on ldb 1.1.28. This ldb version has improved memory handling for ldb search results, improving poorly indexed and unindexed search result processing speed by around 20%.

DNS improvements

The samba-tool dns subcommand is now much more robust and can delete records in a number of situations where it was not possible to do so in the past.

On the server side, DNS names are now more strictly validated.

CTDB changes

  • "ctdb event" is a new top-level command for interacting with event scripts
"ctdb event status" replaces "ctdb scriptstatus" - the latter is maintained for backward compatibility but the output format has been cleaned up
"ctdb event run" replaces "ctdb eventscript"
"ctdb event script enable" replaces "ctdb enablescript"
"ctdb event script disable" replaces "ctdb disablescript"

The new command "ctdb event script list" lists event scripts.

  • CTDB's back-end for running event scripts has been replaced by a separate, long-running daemon ctdbd_eventd.
  • Running ctdb interactively will log to stderr
  • CTDB logs now include process id for each process
  • CTDB tags log messages differently. Changes include:
ctdb-recoverd: Messages from CTDB's recovery daemon
ctdb-recovery: Messages from CTDB database recovery
ctdb-eventd: Messages from CTDB's event daemon
ctdb-takeover: Messages from CTDB's public IP takeover subsystem
  • The mapping between symbolic and numeric debug levels has changed
Configurations containing numeric debug levels should be updated. Symbolic debug levels are recommended. See the DEBUG LEVEL section of ctdb(7) for details.
  • Tunable IPAllocAlgorithm replaces LCP2PublicIPs, DeterministicIPs
See ctdb-tunables(7) for details.
  • CTDB's configuration tunables should be consistently set across a cluster
This has always been the cases for most tunables but this fact is now documented.
  • CTDB ships with recovery lock helper call-outs for etcd and Ceph RADOS
To build/install these, use the
"--enable-etcd-reclock" and
"--enable-ceph-reclock" configure options.

winbind changes

winbind contains code that tries to emulate the group membership calculation that domain controllers do when a user logs in. This group membership calculation is a very complex process, in particular for domain trust relationship situations. Also, in many scenarios it is impossible for winbind to correctly do this calculation due to access restrictions in the domains: winbind using its machine account simply does not have the rights to ask for an arbitrary user's group memberships.

When a user logs in to a Samba server, the domain controller correctly calculates the user's group memberships authoritatively and makes the information available to the Samba server. This is the only reliable way Samba can get informed about the groups a user is member of.

Because of its flakiness, the fallback group membership code is unwished, and our code pathes try hard to only use of the group memberships calculated by the domain controller.

However, a lot of admins rely on the fallback behavior in order to support access for nfs access, ssh public key authentication and passwordless sudo.

That's the reason for changing this back between 4.6.0rc4 and 4.6.0 (See BUG #12612).

The winbind change to simplify the calculation of supplementary groups to make it more reliable and predictable has been deferred to 4.7 or later.

This means that "id <username>" without the user having logged in previously stops showing any supplementary groups. Also, it will show "DOMAIN\Domain Users" as the primary group. Once the user has logged in, "id <username>" will correctly show the primary group and supplementary group list.

winbind primary group and nss info

With 4.6, it will be possible to optionally use the primary group as set in the "Unix Attributes" tab for the local unix token of a domain user. Before 4.6, the Windows primary group was always chosen as primary group for the local unix token.

To activate the unix primary group, set

idmap config <DOMAIN> : unix_primary_group = yes

Similarly, set

idmap config <DOMAIN> : unix_nss_info = yes

to retrieve the home directory and login shell from the "Unix Attributes" of the user. This supersedes the "winbind nss info" parameter with a per-domain configuration option.

mvxattr

mvxattr is a simple utility to recursively rename extended attributes of all files and directories in a directory tree.

 Usage: mvxattr -s STRING -d STRING PATH [PATH ...]
   -s, --from=STRING         xattr source name
   -d, --to=STRING           xattr destination name
   -l, --follow-symlinks     follow symlinks, the default is to ignore them
   -p, --print               print files where the xattr got renamed
   -v, --verbose             print files as they are checked
   -f, --force               force overwriting of destination xattr
 Help options:
   -?, --help                Show this help message
   --usage                   Display brief usage message

idmap_hash

The idmap_hash module is marked as deprecated with this release and will be removed in a future version. See the manpage of the module for details.

smb.conf changes

 Parameter Name                Description             Default
 --------------                -----------             -------
 kerberos encryption types     New                     all
 inherit owner                 New option
 fruit:resource                Spelling correction
 lsa over netlogon             New (deprecated)        no
 rpc server port               New                     0

Samba 4.5

Release Notes for Samba 4.5.0
September 7, 2016

Release Announcements

This is the first stable release of the Samba 4.5 release series.

UPGRADING

NTLMv1 authentication disabled by default

In order to improve security we have changed the default value for the "ntlm auth" option from "yes" to "no". This may have impact on very old clients which doesn't support NTLMv2 yet.

The primary user of NTLMv1 is MSCHAPv2 for VPNs and 802.1x.

By default, Samba will only allow NTLMv2 via NTLMSSP now, as we have the following default "lanman auth = no", "ntlm auth = no" and "raw NTLMv2 auth = no".

NEW FEATURES/CHANGES

Support for LDAP_SERVER_NOTIFICATION_OID

The ldap server has support for the LDAP_SERVER_NOTIFICATION_OID control. This can be used to monitor the Active Directory database for changes.

KCC improvements for sparse network replication

The Samba KCC will now be the default knowledge consistency checker in Samba AD. Instead of using full mesh replication between every DC, the KCC will set up connections to optimize replication latency and cost (using site links to calculate the routes). This change should allow larger domains to function significantly better in terms of replication traffic and the time spent performing DRS replication.

VLV - Virtual List View

The VLV Control allows applications to page the LDAP directory in the way you might expect a live phone book application to operate, without first downloading the entire directory.

DRS Replication for the AD DC

DRS Replication in Samba 4.5 is now much more efficient in handling linked attributes, particularly in large domains with over 1000 group memberships or other links.

Replication is also much more reliable in the handling of tree renames, such as the rename of an organizational unit containing many users. Extensive tests have been added to ensure this code remains reliable, particularly in the case of conflicts between objects added with the same name on different servers.

Schema updates are also handled much more reliably.

samba-tool drs replicate with new options

'samba-tool drs replicate' got two new options:

  • The option '--local-online' will do the DsReplicaSync() via IRPC to the local dreplsrv service.
  • The option '--async-op' will add DRSUAPI_DRS_ASYNC_OP to the DsReplicaSync(), which won't wait for the replication result.

replPropertyMetaData Changes

During the development of the DRS replication, tests showed that Samba stores the replPropertyMetaData object incorrectly. To address this, be aware that 'dbcheck' will now detect and offer to fix all objects in the domain for this error.

For further information and instructions how to fix the problem, see https://wiki.samba.org/index.php/Updating_Samba#Fixing_replPropertyMetaData_Attributes

Linked attributes on deleted objects

In Active Directory, an object that has been tombstoned or recycled has no linked attributes. However, Samba incorrectly maintained such links, slowing replication and run-time performance. 'dbcheck' now offers to remove such links, and they are no longer kept after the object is tombstoned or recycled.

Improved AD DC performance

Many other improvements have been made to our LDAP database layer in the AD DC, to improve performance, both during 'samba-tool domain provision' and at runtime.

Other dbcheck improvements

  • 'samba-tool dbcheck' can now find and fix a missing or corrupted 'deleted objects' container.
  • BUG #11433: samba-dbcheck no longer offers to resort auxiliary class values in objectClass as these were then re-sorted at the next dbcheck indefinitely.

Tombstone Reanimation

Samba now supports tombstone reanimation, a feature in the AD DC allowing tombstones, that is objects which have been deleted, to be restored with the original SID and GUID still in place.

Multiple DNS Forwarders on the AD DC

Previously, the Samba internal DNS server supported only one DNS forwarder. The "dns forwarder" option has been enhanced and now supports a space-separated list of multiple DNS server IP addresses. As a result, Samba is now able to fall back to alternative DNS servers. In case that a DNS query to the first server timed out, it is sent to the next DNS server listed in the option.

Password quality plugin support in the AD DC

The check password script now operates correctly in the AD DC

pwdLastSet is now correctly honoured

BUG #9654: The pwdLastSet attribute is now correctly handled (this previously permitted passwords that expire next).

net ads dns unregister

It is now possible to remove the DNS entries created with 'net ads register' with the matching 'net ads unregister' command.

samba-tool improvements

Running 'samba-tool' on the command line should now be a lot snappier. The tool now only loads the code specific to the subcommand that you wish to run.

SMB 2.1 Leases enabled by default=

Leasing is an SMB 2.1 (and higher) feature which allows clients to aggressively cache files locally above and beyond the caching allowed by SMB 1 oplocks. This feature was disabled in previous releases, but the SMB2 leasing code is now considered mature and stable enough to be enabled by default.

Open File Description (OFD) Locks

On systems that support them (currently only Linux), the fileserver now uses Open File Description (OFD) locks instead of POSIX locks to implement client byte range locks. As these locks are associated with a specific file descriptor on a file this allows more efficient use when multiple descriptors having file locks are opened onto the same file. An internal tunable "smbd:force process locks = true" may be used to turn off OFD locks if there appear to be problems with them.

Password sync as Active Directory domain controller

The new commands 'samba-tool user getpassword' and 'samba-tool user syncpasswords' provide access and syncing of various password fields.

If compiled with GPGME support (--with-gpgme) it's possible to store cleartext passwords in a PGP/OpenGPG encrypted form by configuring the new "password hash gpg key ids" option. This requires gpgme devel and python packages to be installed (e.g. libgpgme11-dev and python-gpgme on Debian/Ubuntu).

Python crypto requirements

Some samba-tool subcommands require python-crypto and/or python-m2crypto packages to be installed.

SmartCard/PKINIT improvements

'samba-tool user create' accepts --smartcard-required and 'samba-tool user setpassword' accepts "--smartcard-required" and "--clear-smartcard-required".

Specifying "--smartcard-required" results in the UF_SMARTCARD_REQUIRED flags being set in the userAccountControl attribute. At the same time, the account password is reset to a random NTHASH value.

Interactive password logons are rejected, if the UF_SMARTCARD_REQUIRED bit is set in the userAccountControl attribute of a user.

When doing a PKINIT based Kerberos logon the KDC adds the required PAC_CREDENTIAL_INFO element to the authorization data. That means the NTHASH is shared between the PKINIT based client and the domain controller, which allows the client to do NTLM based authentication on behalf of the user. It also allows an offline logon using a smartcard to work on Windows clients.

CTDB changes

  • New improved 'ctdb tool'
'ctdb tool' has been completely rewritten using new client API.
Usage messages are much improved.
  • Sample CTDB configuration file is installed as ctdbd.conf.
  • The use of real-time scheduling when taking locks has been narrowed to limit potential performance impacts on nodes.
  • CTDB_RECOVERY_LOCK now supports specification of an external helper to take and hold the recovery lock.
See the RECOVERY LOCK section in ctdb(7) for details. Documentation for writing helpers is provided in doc/cluster_mutex_helper.txt.
  • "ctdb natgwlist" has been replaced by a top level "ctdb natgw" command that has "master", "list" and "status" subcommands.
  • The 'onnode' command no longer supports the "recmaster", "lvs" and "natgw" node specifications.
  • Faster resetting of TCP connections to public IP addresses during failover.
  • Tunables MaxRedirectCount, ReclockPingPeriod, DeferredRebalanceOnNodeAdd are now obsolete/ignored.
  • "ctdb listvars" now lists all variables, including the first one.
  • "ctdb xpnn", "ctdb rebalanceip" and "ctdb rebalancenode" have been removed.
These are not needed because "ctdb reloadips" should do the correct rebalancing.
  • Output for the following commands has been simplified:
ctdb getdbseqnum
ctdb getdebug
ctdb getmonmode
ctdb getpid
ctdb getreclock
ctdb getpid
ctdb pnn
These now simply print the requested output with no preamble. This means that scripts no longer need to strip part of the output.
"ctdb getreclock" now prints nothing when the recovery lock is not set.
  • Output for the following commands has been improved:
ctdb setdebug
ctdb uptime
  • 'ctdb process-exists' has been updated to only take a PID argument.
The PNN can be specified with -n <PNN>. Output also cleaned up.
  • LVS support has been reworked - related commands and configuration variables have changed
'ctdb lvsmaster' and 'ctdb lvs' have been replaced by a top level
'ctdb lvs' command that has "master", "list" and "status" subcommands.
See the LVS sections in ctdb(7) and ctdbd.conf(5) for details, including configuration changes.
  • Improved sample NFS Ganesha call-out

New shadow_copy2 options

shadow:snapprefix

With growing number of snapshots file-systems need some mechanism to differentiate one set of snapshots from other, e.g. monthly, weekly, manual, special events, etc. Therefore, these file-systems provide different ways to tag snapshots, e.g. provide a configurable way to name snapshots, which is not just based on time. With only shadow:format it is very difficult to filter these snapshots. With this optional parameter, one can specify a variable prefix component for names of the snapshot directories in the file-system. If this parameter is set, together with the shadow:format and shadow:delimiter parameters it determines the possible names of snapshot directories in the file-system. The option only supports Basic Regular Expression (BRE).

shadow:delimiter

This optional parameter is used as a delimiter between "shadow:snapprefix" and "shadow:format" This parameter is used only when "shadow:snapprefix" is set.
Default: shadow:delimiter = "_GMT"

REMOVED FEATURES

"only user" and "username" parameters

These two parameters have long been deprecated and superseded by "valid users" and "invalid users".

Samba 4.4

Release Notes for Samba 4.4.0
March 22, 2016

This is the first stable release of the Samba 4.4 release series.

UPGRADING

Nothing special.


NEW FEATURES/CHANGES

Asynchronous flush requests

Flush requests from SMB2/3 clients are handled asynchronously and do not block the processing of other requests. Note that 'strict sync' has to be set to 'yes' for Samba to honor flush requests from SMB clients.

s3: smbd

Remove '--with-aio-support' configure option. We no longer would ever prefer POSIX-RT aio, use pthread_aio instead.

samba-tool sites

The 'samba-tool sites' subcommand can now be run against another server by specifying an LDB URL using the '-H' option and not against the local database only (which is still the default when no URL is given).

samba-tool domain demote

Add '--remove-other-dead-server' option to 'samba-tool domain demote' subcommand. The new version of this tool now can remove another DC that is itself offline. The '--remove-other-dead-server' removes as many references to the DC as possible.

samba-tool drs clone-dc-database

Replicate an initial clone of domain, but do not join it. This is developed for debugging purposes, but not for setting up another DC.

pdbedit

Add '--set-nt-hash' option to pdbedit to update user password from nt-hash hexstring. 'pdbedit -vw' shows also password hashes.

smbstatus

'smbstatus' was enhanced to show the state of signing and encryption for sessions and shares.

smbget

The -u and -p options for user and password were replaced by the -U option that accepts username[%password] as in many other tools of the Samba suite. Similary, smbgetrc files do not accept username and password options any more, only a single "user" option which also accepts user%password combinations.

s4-rpc_server

Add a GnuTLS based backupkey implementation.

ntlm_auth

Using the '--offline-logon' enables ntlm_auth to use cached passwords when the DC is offline.

Allow '--password' force a local password check for ntlm-server-1 mode.

vfs_offline

A new VFS module called vfs_offline has been added to mark all files in the share as offline. It can be useful for shares mounted on top of a remote file system (either through a samba VFS module or via FUSE).

KCC

The Samba KCC has been improved, but is still disabled by default.

DNS

There were several improvements concerning the Samba DNS server.

Active Directory

There were some improvements in the Active Directory area.

WINS nsswitch module

The WINS nsswitch module has been rewritten to address memory issues and to simplify the code. The module now uses libwbclient to do WINS queries. This means that winbind needs to be running in order to resolve WINS names using the nss_wins module. This does not affect smbd.

CTDB changes

  • CTDB now uses a newly implemented parallel database recovery scheme that avoids deadlocks with smbd.
In certain circumstances CTDB and smbd could deadlock. The new recovery implementation avoid this. It also provides improved recovery performance.
  • All files are now installed into and referred to by the paths configured at build time. Therefore, CTDB will now work properly when installed into the default location at /usr/local.
  • Public CTDB header files are no longer installed, since Samba and CTDB are built from within the same source tree.
  • CTDB_DBDIR can now be set to tmpfs[:<tmpfs-options>]
This will cause volatile TDBs to be located in a tmpfs. This can help to avoid performance problems associated with contention on the disk where volatile TDBs are usually stored. See ctdbd.conf(5) for more details.
  • Configuration variable CTDB_NATGW_SLAVE_ONLY is no longer used.
Instead, nodes should be annotated with the "slave-only" option in the CTDB NAT gateway nodes file. This file must be consistent across nodes in a NAT gateway group. See ctdbd.conf(5) for more details.
  • New event script 05.system allows various system resources to be monitored
This can be helpful for explaining poor performance or unexpected behaviour. New configuration variables are CTDB_MONITOR_FILESYSTEM_USAGE, CTDB_MONITOR_MEMORY_USAGE and CTDB_MONITOR_SWAP_USAGE. Default values cause warnings to be logged. See the SYSTEM RESOURCE MONITORING CONFIGURATION in ctdbd.conf(5) for more information.
The memory, swap and filesystem usage monitoring previously found in 00.ctdb and 40.fs_use is no longer available. Therefore, configuration variables CTDB_CHECK_FS_USE, CTDB_MONITOR_FREE_MEMORY, CTDB_MONITOR_FREE_MEMORY_WARN and CTDB_CHECK_SWAP_IS_NOT_USED are now ignored.
  • The 62.cnfs eventscript has been removed. To get a similar effect just do something like this:
     mmaddcallback ctdb-disable-on-quorumLoss \
       --command /usr/bin/ctdb \
       --event quorumLoss --parms "disable"
     mmaddcallback ctdb-enable-on-quorumReached \
       --command /usr/bin/ctdb \
       --event quorumReached --parms "enable"
  • The CTDB tunable parameter EventScriptTimeoutCount has been renamed to MonitorTimeoutCount
It has only ever been used to limit timed-out monitor events.
Configurations containing CTDB_SET_EventScriptTimeoutCount=<n> will cause CTDB to fail at startup. Useful messages will be logged.
  • The commandline option "-n all" to CTDB tool has been removed.
The option was not uniformly implemented for all the commands. Instead of command "ctdb ip -n all", use "ctdb ip all".
  • All CTDB current manual pages are now correctly installed

EXPERIMENTAL FEATURES

SMB3 Multi-Channel

Samba 4.4.0 adds *experimental* support for SMB3 Multi-Channel. Multi-Channel is an SMB3 protocol feature that allows the client to bind multiple transport connections into one authenticated SMB session. This allows for increased fault tolerance and throughput. The client chooses transport connections as reported by the server and also chooses over which of the bound transport connections to send traffic. I/O operations for a given file handle can span multiple network connections this way. An SMB multi-channel session will be valid as long as at least one of its channels are up.

In Samba, multi-channel can be enabled by setting the new smb.conf option "server multi channel support" to "yes". It is disabled by default.

Samba has to report interface speeds and some capabilities to the client. On Linux, Samba can auto-detect the speed of an interface. But to support other platforms, and in order to be able to manually override the detected values, the "interfaces" smb.conf option has been given an extended syntax, by which an interface specification can additionally carry speed and capability information. The extended syntax looks like this for setting the speed to 1 gigabit per second:

   interfaces = 192.168.1.42;speed=1000000000

This extension should be used with care and are mainly intended for testing. See the smb.conf manual page for details.

CAVEAT: While this should be working without problems mostly, there are still corner cases in the treatment of channel failures that may result in DATA CORRUPTION when these race conditions hit.

It is hence

   NOT RECOMMENDED TO USE MULTI-CHANNEL IN PRODUCTION

at this stage. This situation can be expected to improve during the life-time of the 4.4 release. Feed-back from test-setups is highly welcome.

REMOVED FEATURES

Public headers

Several public headers are not installed any longer. They are made for internal use only. More public headers will very likely be removed in future releases.

The following headers are not installed any longer: dlinklist.h, gen_ndr/epmapper.h, gen_ndr/mgmt.h, gen_ndr/ndr_atsvc_c.h, gen_ndr/ndr_epmapper_c.h, gen_ndr/ndr_epmapper.h, gen_ndr/ndr_mgmt_c.h, gen_ndr/ndr_mgmt.h,gensec.h, ldap_errors.h, ldap_message.h, ldap_ndr.h, ldap-util.h, pytalloc.h, read_smb.h, registry.h, roles.h, samba_util.h, smb2_constants.h, smb2_create_blob.h, smb2.h, smb2_lease.h, smb2_signing.h, smb_cli.h, smb_cliraw.h, smb_common.h, smb_composite.h, smb_constants.h, smb_raw.h, smb_raw_interfaces.h, smb_raw_signing.h, smb_raw_trans2.h, smb_request.h, smb_seal.h, smb_signing.h, smb_unix_ext.h, smb_util.h, torture.h, tstream_smbXcli_np.h.

vfs_smb_traffic_analyzer

The SMB traffic analyzer VFS module has been removed, because it is not maintained any longer and not widely used.

vfs_scannedonly

The scannedonly VFS module has been removed, because it is not maintained any longer.

smb.conf changes

 Parameter Name		Description		Default
 --------------		-----------		-------
 aio max threads               New                     100
 ldap page size		Changed default		1000
 server multi channel support	New			No
 interfaces			Extended syntax

Samba 4.3

Release Notes for Samba 4.3.0
September 8, 2015

This is the first stable release of Samba 4.3.

UPGRADING

Read the "New FileChangeNotify subsystem" and "smb.conf changes" sections (below).


NEW FEATURES

Logging

The logging code now supports logging to multiple backends. In addition to the previously available syslog and file backends, the backends for logging to the systemd-journal, lttng and gpfs have been added. Please consult the section for the 'logging' parameter in the smb.conf manpage for details.

Spotlight

Support for Apple's Spotlight has been added by integrating with Gnome Tracker.

For detailed instructions how to build and setup Samba for Spotlight, please see here.

New FileChangeNotify subsystem

Samba now contains a new subsystem to do FileChangeNotify. The previous system used a central database, notify_index.tdb, to store all notification requests. In particular in a cluster this turned out to be a major bottleneck, because some hot records need to be bounced back and forth between nodes on every change event like a new created file.

The new FileChangeNotify subsystem works with a central daemon per node. Every FileChangeNotify request and every event are handled by an asynchronous message from smbd to the notify daemon. The notify daemon maintains a database of all FileChangeNotify requests in memory and will distribute the notify events accordingly. This database is asynchronously distributed in the cluster by the notify daemons.

The notify daemon is supposed to scale a lot better than the previous implementation. The functional advantage is cross-node kernel change notify: Files created via NFS will be seen by SMB clients on other nodes per FileChangeNotify, despite the fact that popular cluster file systems do not offer cross-node inotify.

Two changes to the configuration were required for this new subsystem:

The parameters "change notify" and "kernel change notify" are not per-share anymore but must be set globally. So it is no longer possible to enable or disable notify per share, the notify daemon has no notion of a share, it only works on absolute paths.

New SMB profiling code

The code for SMB (SMB1, SMB2 and SMB3) profiling uses a tdb instead of sysv IPC shared memory. This avoids performance problems and NUMA effects. The profile stats are a bit more detailed than before.

Improved DCERPC man in the middle detection for kerberos

The gssapi based kerberos backends for gensec have support for DCERPC header signing when using DCERPC_AUTH_LEVEL_PRIVACY.

SMB signing required in winbindd by default

The effective value for "client signing" is required by default for winbindd, if the primary domain uses active directory.

Experimental NTDB was removed

The experimental NTDB library introduced in Samba 4.0 has been removed again.

Improved support for trusted domains (as AD DC)

The support for trusted domains/forests has improved a lot.

samba-tool got "domain trust" subcommands to manage trusts:

 create      - Create a domain or forest trust.
 delete      - Delete a domain trust.
 list        - List domain trusts.
 namespaces  - Manage forest trust namespaces.
 show        - Show trusted domain details.
 validate    - Validate a domain trust.

External trusts between individual domains work in both ways (inbound and outbound). The same applies to root domains of a forest trust. The transitive routing into the other forest is fully functional for kerberos, but not yet supported for NTLMSSP.

While a lot of things are working fine, there are currently a few limitations:

  • Both sides of the trust need to fully trust each other!
  • No SID filtering rules are applied at all!
  • This means DCs of domain A can grant domain admin rights in domain B.
  • It's not possible to add users/groups of a trusted domain into domain groups.

SMB 3.1.1 supported

Both client and server have support for SMB 3.1.1 now.

This is the dialect introduced with Windows 10, it improves the secure negotiation of SMB dialects and features.

There's also a new optinal encryption algorithm aes-gcm-128, but for now this is only selected as fallback and aes-ccm-128 is preferred because of the better performance. This might change in future versions when hardware encryption will be supported.

See BUG #11451

New smbclient subcommands

  • Query a directory for change notifications: notify <dir name>
  • Server side copy: scopy <source filename> <destination filename>

New rpcclient subcommands

 netshareenumall 	- Enumerate all shares
 netsharegetinfo 	- Get Share Info
 netsharesetinfo 	- Set Share Info
 netsharesetdfsflags	- Set DFS flags
 netfileenum		- Enumerate open files
 netnamevalidate	- Validate sharename
 netfilegetsec		- Get File security
 netsessdel		- Delete Session
 netsessenum		- Enumerate Sessions
 netdiskenum		- Enumerate Disks
 netconnenum		- Enumerate Connections
 netshareadd		- Add share
 netsharedel		- Delete share

New modules

 idmap_script 		- see 'man 8 idmap_script'
 vfs_unityed_media	- see 'man 8 vfs_unityed_media'
 vfs_shell_snap	- see 'man 8 vfs_shell_snap'

New sparsely connected replia graph (Improved KCC)

The Knowledge Consistency Checker (KCC) maintains a replication graph for DCs across an AD network. The existing Samba KCC uses a fully connected graph, so that each DC replicates from all the others, which does not scale well with large networks. In 4.3 there is an experimental new KCC that creates a sparsely connected replication graph and closely follows Microsoft's specification. It is turned off by default. To use the new KCC, set "kccsrv:samba_kcc=true" in smb.conf and let us know how it goes. You should consider doing this if you are making a large new network. For small networks there is little benefit and you can always switch over at a later date.

Configurable TLS protocol support, with better defaults

The "tls priority" option can be used to change the supported TLS protocols. The default is to disable SSLv3, which is no longer considered secure.

Samba-tool now supports all 7 FSMO roles

Previously "samba-tool fsmo" could only show, transfer or seize the five well-known FSMO roles:

  • Schema Master
  • Domain Naming Master
  • RID Master
  • PDC Emulator
  • Infrastructure Master

It can now also show, transfer or seize the DNS infrastructure roles:

  • DomainDnsZones Infrastructure Master
  • ForestDnsZones Infrastructure Master

CTDB logging changes

The destination for CTDB logging is now set via a single new configuration variable CTDB_LOGGING. This replaces CTDB_LOGFILE and CTDB_SYSLOG, which have both been removed. See ctdbd.conf(5) for details of CTDB_LOGGING.

CTDB no longer runs a separate logging daemon.

CTDB NFS support changes

CTDB's NFS service management has been combined into a single 60.nfs event script. This updated 60.nfs script now uses a call-out to interact with different NFS implementations. See the CTDB_NFS_CALLOUT option in the ctdbd.conf(5) manual page for details. A default call-out is provided to interact with the Linux kernel NFS implementation. The 60.ganesha event script has been removed - a sample call-out is provided for NFS Ganesha, based on this script.

The method of configuring NFS RPC checks has been improved. See ctdb/config/nfs-checks.d/README for details.

Improved Cross-Compiling Support=

A new "hybrid" build configuration mode is added to improve cross-compilation support.

A common challenge in cross-compilation is that of obtaining the results of tests that have to run on the target, during the configuration phase of the build. The Samba build system already supports the following means to do so:

  • Executing configure tests using the --cross-execute parameter
  • Obtaining the results from an answers file using the --cross-answers parameter

The first method has the drawback of inaccurate results if the tests are run using an emulator, or a need to be connected to a running target while building, if the tests are to be run on an actual target. The second method presents a challenge of figuring out the test results.

The new hybrid mode runs the tests and records the result in an answer file. To activate this mode, use both --cross-execute and --cross-answers in the same configure invocation. This mode can be activated once against a running target, and then the generated answers file can be used in subsequent builds.

Also supplied is an example script that can be used as the cross-execute program. This script copies the test to a running target and runs the test on the target, obtaining the result. The obtained results are more accurate than running the test with an emulator, because they reflect the exact kernel and system libraries that exist on the target.

Improved Sparse File Support


Support for the FSCTL_SET_ZERO_DATA and FSCTL_QUERY_ALLOCATED_RANGES SMB2 requests has been added to the smbd file server.

This allows for clients to deallocate (hole punch) regions within a sparse file, and check which portions of a file are allocated.

Changes

smb.conf changes

 Parameter Name		Description		Default
 logging			New			(empty)
 msdfs shuffle referrals	New			no
 smbd profiling level		New			off
 spotlight			New			no
 tls priority			New 			NORMAL:-VERS-SSL3.0
 use ntdb			Removed
 change notify			Changed to [global]
 kernel change notify		Changed to [global]
 client max protocol		Changed	default		SMB3_11
 server max protocol		Changed default		SMB3_11

Removed modules

vfs_notify_fam - see section 'New FileChangeNotify subsystem'.

Samba 4.2

Release Notes for Samba 4.2.0
March 4, 2015

This is is the first stable release of Samba 4.2.

Samba 4.2 will be the next version of the Samba suite.

IMPORTANT NOTE ABOUT THE SUPPORT END OF SAMBA 3

With the final release of Samba 4.2, the last series of Samba 3 has been discontinued! People still running 3.6.x or earlier, should consider moving to a more recent and maintained version (4.0 - 4.2). One of the common misconceptions is that Samba 4.x automatically means "Active Directory only": This is wrong!

Acting as an Active Directory Domain Controller is just one of the enhancements included in Samba 4.0 and later. Version 4.0 was just the next release after the 3.6 series and contains all the features of the previous ones - including the NT4-style (classic) domain support. This means you can update a Samba 3.x NT4-style PDC to 4.x, just as you've updated in the past (e.g. from 3.4.x to 3.5.x). You don't have to move your NT4-style domain to an Active Directory!

And of course the possibility remains unchanged, to setup a new NT4-style PDC with Samba 4.x, like done in the past (e.g. with openLDAP backend). Active Directory support in Samba 4 is additional and does not replace any of these features. We do understand the difficulty presented by existing LDAP structures and for that reason there isn't a plan to decommission the classic PDC support. It remains tested by the continuous integration system.

The code that supports the classic Domain Controller is also the same code that supports the internal 'Domain' of standalone servers and Domain Member Servers. This means that we still use this code, even when not acting as an AD Domain Controller. It is also the basis for some of the features of FreeIPA and so it gets development attention from that direction as well.

UPGRADING

Read the "Winbindd/Netlogon improvements" section (below) carefully!


NEW FEATURES

Transparent File Compression

Samba 4.2.0 adds support for the manipulation of file and folder compression flags on the Btrfs filesystem. With the Btrfs Samba VFS module enabled, SMB2+ compression flags can be set remotely from the Windows Explorer File->Properties->Advanced dialog. Files flagged for compression are transparently compressed and uncompressed when accessed or modified.

Previous File Versions with Snapper

The newly added Snapper VFS module exposes snapshots managed by Snapper for use by Samba. This provides the ability for remote clients to access shadow-copies via Windows Explorer using the "previous versions" dialog.

Winbindd/Netlogon improvements

The whole concept of maintaining the netlogon secure channel to (other) domain controllers was rewritten in order to maintain global state in a netlogon_creds_cli.tdb. This is the proper fix for a large number of bugs:

 https://bugzilla.samba.org/show_bug.cgi?id=10860
 https://bugzilla.samba.org/show_bug.cgi?id=6563
 https://bugzilla.samba.org/show_bug.cgi?id=7944
 https://bugzilla.samba.org/show_bug.cgi?id=7945
 https://bugzilla.samba.org/show_bug.cgi?id=7568
 https://bugzilla.samba.org/show_bug.cgi?id=8599

In addition a strong session key is now required by default, which means that communication to older servers or clients might be rejected by default.

  • For the client side we have the following new options:
"require strong key" (yes by default), "reject md5 servers" (no by default). E.g. for Samba 3.0.37 you need "require strong key = no" and

for NT4 DCs you need "require strong key = no" and "client NTLMv2 auth = no",

  • On the server side (as domain controller) we have the following new options:
"allow nt4 crypto" (no by default), "reject md5 client" (no by default). E.g. in order to allow Samba < 3.0.27 or NT4 members to work you need "allow nt4 crypto = yes"
  • winbindd does not list group memberships for display purposes (e.g. getent group <domain\<group>) anymore by default.
The new default is "winbind expand groups = 0" now, the reason for this is the same as for "winbind enum users = no" and "winbind enum groups = no". Providing this information is not always reliably possible, e.g. if there are trusted domains.

Please consult the smb.conf manpage for more details on these new options.

Winbindd use on the Samba AD DC

Winbindd is now used on the Samba AD DC by default, replacing the partial rewrite used for winbind operations in Samba 4.0 and 4.1.

This allows more code to be shared, more options to be honoured, and paves the way for support for trusted domains in the AD DC.

If required the old internal winbind can be activated by setting 'server services = +winbind -winbindd'. Upgrading users with a server services parameter specified should ensure they change 'winbind' to 'winbindd' to obtain the new functionality.

The 'samba' binary still manages the starting of this service, there is no need to start the winbindd binary manually.

Winbind now requires secured connections

To improve protection against rogue domain controllers we now require that when we connect to an AD DC in our forest, that the connection be signed using SMB Signing. Set 'client signing = off' in the smb.conf to disable.

Also and DCE/RPC pipes must be sealed, set 'require strong key = false' and 'winbind sealed pipes = false' to disable.

Finally, the default for 'client ldap sasl wrapping' has been set to 'sign', to ensure the integrity of LDAP connections. Set 'client ldap sasl wrapping = plain' to disable.

Larger IO sizes for SMB2/3 by default

The default values for "smb2 max read", "smb2 max write" and "smb2 max trans" have been changed to 8388608 (8MiB) in order to match the default of Windows 2012R2.

SMB2 leases

The SMB2 protocol allows clients to aggressively cache files locally above and beyond the caching allowed by SMB1 and SMB2 oplocks.

Called SMB2 leases, this can greatly reduce traffic on an SMB2 connection. Samba 4.2 now implements SMB2 leases.

It can be turned on by setting the parameter "smb2 leases = yes" in the [global] section of your smb.conf. This parameter is set to off by default until the SMB2 leasing code is declared fully stable.

Improved DCERPC man in the middle detection

The DCERPC header signing has been implemented in addition to the dcerpc_sec_verification_trailer protection.

Overhauled "net idmap" command

The command line interface of the "net idmap" command has been made systematic, and subcommands for reading and writing the autorid idmap database have been added. Note that the writing commands should be used with great care. See the net(8) manual page for details.

tdb improvements

The tdb library, our core mechanism to store Samba-specific data on disk and share it between processes, has been improved to support process shared robust mutexes on Linux. These mutexes are available on Linux and Solaris and significantly reduce the overhead involved with tdb. To enable mutexes for tdb, set

dbwrap_tdb_mutexes:* = yes

in the [global] section of your smb.conf.

Tdb file space management has also been made more efficient. This will lead to smaller and less fragmented databases.

Messaging improvements

Our internal messaging subsystem, used for example for things like oplock break messages between smbds or setting a process debug level dynamically, has been rewritten to use unix domain datagram messages.

Clustering support

Samba's file server clustering component CTDB is now integrated in the Samba tree. This avoids the confusion of compatibility of Samba and CTDB versions as existed previously.

To build the Samba file server with cluster support, use the configure command line option --with-cluster-support. This will build clustered file server against the in-tree ctdb. Building clustered samba with previous versions of CTDB is no longer supported.

Samba Registry Editor

The utitlity to browse the samba registry has been overhauled by our Google Summer of Code student Chris Davis. Now samba-regedit has a Midnight-Commander-like theme and UI experience. You can browse keys and edit the diffent value types. For a data value type a hexeditor has been implemented.

Bad Password Lockout in the AD DC

Samba's AD DC now implements bad password lockout (on a per-DC basis).

That is, incorrect password attempts are tracked, and accounts locked out if too many bad passwords are submitted. There is also a grace period of 60 minutes on the previous password when used for NTLM authentication (matching Windows 2003 SP1: https://support2.microsoft.com/kb/906305).

The relevant settings can be seen using 'samba-tool domain passwordsettings show' (the new settings being highlighted):

Password informations for domain 'DC=samba,DC=example,DC=com'

Password complexity: on
Store plaintext passwords: off
Password history length: 24
Minimum password length: 7
Minimum password age (days): 1
Maximum password age (days): 42
Account lockout duration (mins): 30
Account lockout threshold (attempts): 0
Reset account lockout after (mins): 30

These values can be set using 'samba-tool domain passwordsettings set'.

Correct defaults in the smb.conf manpages

The default values for smb.conf parameters are now correctly specified in the smb.conf manpage, even when they refer to build-time specified paths. Provided Samba is built on a system with the right tools (xsltproc in particular) required to generate our man pages, then these will be built with the exact same embedded paths as used by the configuration parser at runtime. Additionally, the default values read from the smb.conf manpage are checked by our test suite to match the values seen in testparm and used by the running binaries.

Consistent behaviour between samba-tool testparm and testparm

With the exception of the registry backend, which remains only available in the file server, the behaviour of the smb.conf parser and the tools 'samba-tool testparm' and 'testparm' is now consistent, particularly with regard to default values. Except with regard to registry shares, it is no longer needed to use one tool on the AD DC, and another on the file server.

VFS WORM module

A VFS module for basic WORM (Write once read many) support has been added. It allows an additional layer on top of a Samba share, that provides a basic set of WORM functionality on the client side, to control the writeability of files and folders.

As the module is simply an additional layer, share access and permissions work like expected - only WORM functionality is added on top. Removing the module from the share configuration, removes this layer again. The filesystem ACLs are not affected in any way from the module and treated as usual.

The module does not provide complete WORM functions, like some archiving products do! It is not audit-proof, because the WORM function is only available on the client side, when accessing a share through SMB! If the same folder is shared by other services like NFS, the access only depents on the underlaying filesystem ACLs. Equally if you access the content directly on the server.

For additional information, see

vfs_fruit, a VFS module for OS X clients

A new VFS module that provides enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver.

The module features enhanced performance with reliable named streams support, interoperability with special characters commonly used by OS X client (eg '*', '/'), integrated file locking and Mac metadata access with Netatalk 3 and enhanced performance by implementing Apple's SMB2 extension codenamed "AAPL".

The modules behaviour is fully configurable, please refer to the manpage vfs_fruit for further details.

smbclient archival improvements

Archive creation and extraction support in smbclient has been rewritten to use libarchive. This fixes a number of outstanding bugs in Samba's previous custom tar implementation and also adds support for the extraction of zipped archives.

smbclient archive support can be enabled or disabled at build time with corresponding --with[out]-libarchive configure parameters.

Changes

smb.conf changes

  Parameter Name			Description	Default
  allow nt4 crypto                     New             no
  neutralize nt4 emulation             New             no
  reject md5 client                    New             no
  reject md5 servers                   New             no
  require strong key                   New             yes
  smb2 max read                        Changed default 8388608
  smb2 max write                       Changed default 8388608
  smb2 max trans                       Changed default 8388608
  winbind expand groups                Changed default 0

Samba 4.1

Release Notes for Samba 4.1.0
October 11, 2013

This is is the first stable release of Samba 4.1.

Samba 4.1 will be the next version of the Samba suite and includes all the technology found in both the Samba4 series and the stable 3.x series. The primary additional features over Samba 3.6 are support for the Active Directory logon protocols used by Windows 2000 and above.

Major enhancements in Samba 4.1.0 include:

Client tools support SMB2/3

Samba 4.1.0 contains the first release of our client tools and client library that work over the new protocols SMB2 or SMB3. Note that SMB3 only works either to a Samba server version 4.0.0 or above, or to a Windows Server running Windows 2012 or Windows 8.

The default protocol for smbclient and smbcacls is still SMB1 (the NT1 protocol dialect). An SMB2 or SMB3 connection can be selected in one of two ways. The easiest way to test the new protocol connection is to add the -mMAX_PROTOCOL command line switch to either smbclient or smbcacls.

For example, to connect using SMB3 with smbclient a user would type:

smbclient //server/share -Uuser%password -mSMB3

Another example of connecting using SMB2 using smbcacls would be:

smbcacls //server/share -Uuser%password -mSMB2 filename

Note that when connecting using SMB2 or SMB3 protocols the UNIX extensions are no longer available inside the smbclient command set. This is due to UNIX extensions not yet being defined for the SMB2 or SMB3 protocols.

The second way to select SMB2 or SMB3 connections is to set the "client max protocol" parameter in the [global] section of your smb.conf.

Setting this parameter will cause all client connections from Samba and its client tools to offer the requested max protocol to a server on every connection request.

For example, to cause all client tools (including winbindd, rpcclient, and the libsmbclient library) to attempt use SMB3 by default add the line:

client max protocol = SMB3

to the [global] section of your smb.conf. This has not been as widely tested as the -mPROTOCOL options, but is intended to work correctly in the final release of 4.1.0.

Samba3/SMB2
Encrypted transport

Although Samba servers have supported encrypted transport connections using the UNIX extensions for many years, selecting SMB3 transport allows encrypted transport connections to Windows servers that support SMB3, as well as Samba servers.

In order to enable this, add the "-e" option to the smbclient command line.

For example, to connect to a Windows 2012 server over SMB3 and select an encrypted transport you would use the following command line:

smbclient //Win2012Server/share -Uuser%password -mSMB3 -e


Directory database replication (AD DC mode)

Directory replication has been reworked in order to improve the correctness and efficiency.

As a net effect of it, replication with other domain controllers with a heavily modified schema is now possible (ie. Windows 2012 DCs or other Windows DC with exchange installed) and replication didn't fail anymore in such environments.

Server-Side Copy Support

Samba 4.1.0 adds support for server-side copy operations via the SMB2 FSCTL_SRV_COPYCHUNK request. Clients making use of server-side copy support, such as Windows Server 2012, should experience considerable performance improvements for file copy operations, as file data need not traverse the network.

This feature is enabled by default on the smbd file server.

Btrfs Filesystem Integration

The Btrfs VFS module provided with Samba 4.1.0 further improves the performance of server-side copy operations on shares backed by a Btrfs filesystem. It does so by allowing multiple files to share the same on-disk extents, avoiding the unnecessary duplication of source and destination file data during a server-side copy operation.

This feature can be explicitly enabled on smbd shares backed by a Btrfs filesystem with the smb.conf parameter:

vfs objects = btrfs
REMOVED COMPONENTS

The Samba Web Administration Tool (SWAT) has been removed. Details why SWAT has been removed can be found on the samba-technical mailing list:

https://lists.samba.org/archive/samba-technical/2013-February/090572.html


Changes

smb.conf changes
  Parameter Name			Description	Default
  --------------			-----------	-------
  acl allow execute always             New		False
  password level                       Removed
  set directory                        Removed
  use ntdb                             New		No

RUNNING Samba 4.1 as an AD DC

A short guide to setting up Samba as an AD DC can be found on the wiki:

Setting_up_Samba_as_an_Active_Directory_Domain_Controller

Samba 4.0

Release Notes for Samba 4.0
December 11, 2012

Release Announcements

This is is the first stable release of Samba 4.0.

This release contains the best of all of Samba's technology parts, both a file server (that you can reasonably expect to upgrade existing Samba 3.x releases to) and the AD domain controller work previously known as 'Samba4'.

Major enhancements in Samba 4.0.0 include:
Active Directory services

Samba 4.0 supports the server-side of the Active Directory logon environment used by Windows 2000 and later, so we can do full domain join and domain logon operations with these clients.

Our Domain Controller (DC) implementation includes our own built-in LDAP server and Kerberos Key Distribution Center (KDC) as well as the Samba3-like logon services provided over CIFS. We correctly generate the infamous Kerberos PAC, and include it with the Kerberos tickets we issue.

When running an AD DC, you only need to run 'samba' (not smbd/nmbd/winbindd), as the required services are co-coordinated by this master binary. The tool to administer the Active Directory services is called 'samba-tool'.

A short guide to setting up Samba 4 as an AD DC can be found on the wiki:

Setting_up_Samba_as_an_Active_Directory_Domain_Controller
File Services

Samba 4.0.0 ships with two distinct file servers. We now use the file server from the Samba 3.x series 'smbd' for all file serving by default.

Samba 4.0 also ships with the 'NTVFS' file server. This file server is what was used prior to the beta2 release of Samba 4.0, and is tuned to match the requirements of an AD domain controller. We continue to support this, not only to provide continuity to installations that have deployed it as part of an AD DC, but also as a running example of the NT-FSA architecture we expect to move smbd to in the longer term.

For pure file server work, the binaries users would expect from that series (smbd, nmbd, winbindd, smbpasswd) continue to be available.

DNS

As DNS is an integral part of Active Directory, we also provide two DNS solutions, a simple internal DNS server for 'out of the box' configurations and a more elaborate BIND plugin using the BIND DLZ mechanism in versions 9.8 and 9.9. During the provision, you can select which backend to use. With the internal backend, your DNS server is good to go. If you chose the BIND_DLZ backend, a configuration file will be generated for bind to make it use this plugin, as well as a file explaining how to set up bind.

NTP

To provide accurate timestamps to Windows clients, we integrate with the NTP project to provide secured NTP replies. To use you need to start ntpd and configure it with the 'restrict ... ms-sntp' and ntpsigndsocket options.

Python Scripting Interface

A new scripting interface has been added to Samba 4, allowing Python programs to interface to Samba's internals, and many tools and internal workings of the DC code is now implemented in python.

Known Issues
  • Replication of DNS data from one AD server to another may not work. The DNS data used by the internal DNS server and bind9_dlz is stored in an application partition in our directory. The replication of this partition is not yet reliable.
  • Replication may fail on FreeBSD due to getaddrinfo() rejecting names containing _. A workaround will be in a future release.
  • samba_upgradeprovision should not be run when upgrading to this release from a recent release. No important database format changes have been made since alpha16.
  • Installation on systems without a system iconv (and developer headers at compile time) is known to cause errors when dealing with non-ASCII characters.
  • Domain member support in the 'samba' binary is in its infancy, and is not comparable to the support found in winbindd. As such, do not use the 'samba' binary (provided for the AD server) on a member server.
  • There is no NetBIOS browsing support (network neighbourhood) available for the AD domain controller. (Support in nmbd and smbd for classic domains and member/standalone servers is unchanged).
  • Clock Synchronisation is critical. Many 'wrong password' errors are actually due to Kerberos objecting to a clock skew between client and server. (The NTP work in the previous alphas are partly to assist with this problem).
  • The DRS replication code may fail. Please contact the team if you experience issues with DRS replication, as we have fixed many issues here in response to feedback from our production users.
  • Linux inotify will now only be supported on systems where glibc also supports it (for details, please refer to bug #8850).
Upgrading

Users upgrading from Samba 3.x domain controllers and wanting to use Samba 4.0 as an AD DC should use the 'samba-tool domain classicupgrade' command. See the wiki for more details Migrating a Samba NT4 Domain to Samba AD (Classic Upgrade).

Users upgrading from Samba 4.0 alpha and beta releases since alpha15 should run 'samba-tool dbcheck --cross-ncs --fix' before re-starting Samba. Users upgrading from earlier alpha releases should contact the team for advice.

Users upgrading an AD DC from any previous release should run 'samba-tool ntacl sysvolreset' to re-sync ACLs on the sysvol share with those matching the GPOs in LDAP and the defaults from an initial provision. This will set an underlying POSIX ACL if required (eg not using the NTVFS file server).

If you used the BIND9_FLATFILE or BIND9_DLZ features, you'll have to add '-dns' to the 'server services' option, as the internal dns server (SAMBA_INTERNAL) is the default now.

Supported features

A whitepaper of currently (un-)supported features is available on the wiki:

Samba_4.0_Whitepaper

smb.conf changes
  Parameter Name    		Description
  --------------			-----------
  acl compatibility			Removed
  allow dns updates			New
  announce as				Removed
  announce version			Removed
  cldap port				New
  client max protocol			New
  client min protocol			New
  client signing			Changed default
  dcerpc endpoint servers		New
  dgram port				New
  directory security mask		Removed
  display charset			Removed
  dns forwarder			New
  dns update command			New
  force security mode			Removed
  force directory security mode	Removed
  homedir map				Changed default
  kernel oplocks			Changed default
  kernel share modes			New
  kpasswd port				New
  krb5 port				New
  nbt client socket address		New
  nbt port				New
  nsupdate command			New
  ntp signd socket directory		New
  ntvfs handler			New
  paranoid server security		Removed
  pid directory			New
  printer admin			Removed
  rndc command 			New
  rpc big endian			New
  samba kcc command			New
  security mask			Removed
  send spnego principal		Removed
  server max protocol			New
  server min protocol			New
  server role				New
  server services			New
  server signing			Changed default
  share backend			New
  share modes				Removed
  smb2 max read			Changed default
  smb2 max write			Changed default
  smb2 max trans			Changed default
  socket address			Removed
  spn update command			New
  time offset				Removed
  tls cafile				New
  tls certfile				New
  tls crlfile				New
  tls dh params file			New
  tls enabled				New
  tls keyfile				New
  unicode				New
  web port				New
  winbindd privileged socket directory	New
  winbind sealed pipes			New
  winbindd socket directory		New