| blob | 89e730b605e92e506a49088004640aaaea076854 |
1 ==============================
2 Release Notes for Samba 4.11.7
3 March 10, 2020
4 ==============================
7 This is the latest stable release of the Samba 4.11 release series.
10 Changes since 4.11.6:
11 ---------------------
13 o Jeremy Allison <jra@samba.org>
14 * BUG 14239: s3: lib: nmblib. Clean up and harden nmb packet processing.
15 * BUG 14283: s3: VFS: full_audit. Use system session_info if called from a
16 temporary share definition.
18 o Andrew Bartlett <abartlet@samba.org>
19 * BUG 14258: dsdb: Correctly handle memory in objectclass_attrs.
20 * BUG 14270: ldb: version 2.0.9, Samba 4.11 and later give incorrect results
21 for SCOPE_ONE searches.
23 o Volker Lendecke <vl@samba.org>
24 * BUG 14247: auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences.
25 * BUG 14285: smbd: Handle EINTR from open(2) properly.
27 o Stefan Metzmacher <metze@samba.org>
28 * BUG 14247: winbind member (source3) fails local SAM auth with empty domain
29 name.
30 * BUG 14265: winbindd: Handling missing idmap in getgrgid().
32 o Andreas Schneider <asn@samba.org>
33 * BUG 14253: lib:util: Log mkdir error on correct debug levels.
34 * BUG 14266: wafsamba: Do not use 'rU' as the 'U' is deprecated in
35 Python 3.9.
37 o Martin Schwenke <martin@meltin.net>
38 * BUG 14274: ctdb-tcp: Make error handling for outbound connection
39 consistent.
42 #######################################
43 Reporting bugs & Development Discussion
44 #######################################
46 Please discuss this release on the samba-technical mailing list or by
47 joining the #samba-technical IRC channel on irc.freenode.net.
49 If you do report problems then please try to send high quality
50 feedback. If you don't provide vital information to help us track down
51 the problem then you will probably be ignored. All bug reports should
52 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
53 database (https://bugzilla.samba.org/).
56 ======================================================================
57 == Our Code, Our Bugs, Our Responsibility.
58 == The Samba Team
59 ======================================================================
62 Release notes for older releases follow:
63 ----------------------------------------
65 ==============================
66 Release Notes for Samba 4.11.6
67 January 28, 2020
68 ==============================
71 This is the latest stable release of the Samba 4.11 release series.
74 Changes since 4.11.5:
75 ---------------------
77 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
78 * BUG 14209: pygpo: Use correct method flags.
80 o David Disseldorp <ddiss@samba.org>
81 * BUG 14216: vfs_ceph_snapshots: Fix root relative path handling.
83 o Torsten Fohrer <torsten.fohrer@sbe.de>
84 * BUG 14209: Avoiding bad call flags with python 3.8, using METH_NOARGS
85 instead of zero.
87 o Fabrice Fontaine <fontaine.fabrice@gmail.com>
88 * BUG 14218: source4/utils/oLschema2ldif: Include stdint.h before cmocka.h.
90 o Björn Jacke <bjacke@samba.org>
91 * BUG 14122: docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc.
93 o Volker Lendecke <vl@samba.org>
94 * BUG 14251: smbd: Fix the build with clang.
96 o Gary Lockyer <gary@catalyst.net.nz>
97 * BUG 14199: upgradedns: Ensure lmdb lock files linked.
99 o Anoop C S <anoopcs@redhat.com>
100 * BUG 14182: s3: VFS: glusterfs: Reset nlinks for symlink entries during
101 readdir.
103 o Andreas Schneider <asn@samba.org>
104 * BUG 14101: smbc_stat() doesn't return the correct st_mode and also the
105 uid/gid is not filled (SMBv1) file.
106 * BUG 14219: librpc: Fix string length checking in
107 ndr_pull_charset_to_null().
109 o Martin Schwenke <martin@meltin.net>
110 * BUG 14227: ctdb-scripts: Strip square brackets when gathering connection
111 info.
114 #######################################
115 Reporting bugs & Development Discussion
116 #######################################
118 Please discuss this release on the samba-technical mailing list or by
119 joining the #samba-technical IRC channel on irc.freenode.net.
121 If you do report problems then please try to send high quality
122 feedback. If you don't provide vital information to help us track down
123 the problem then you will probably be ignored. All bug reports should
124 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
125 database (https://bugzilla.samba.org/).
128 ======================================================================
129 == Our Code, Our Bugs, Our Responsibility.
130 == The Samba Team
131 ======================================================================
134 ----------------------------------------------------------------------
137 ==============================
138 Release Notes for Samba 4.11.5
139 January 21, 2020
140 ==============================
143 This is a security release in order to address the following defects:
145 o CVE-2019-14902: Replication of ACLs set to inherit down a subtree on AD
146 Directory not automatic.
147 o CVE-2019-14907: Crash after failed character conversion at log level 3 or
148 above.
149 o CVE-2019-19344: Use after free during DNS zone scavenging in Samba AD DC.
152 =======
153 Details
154 =======
156 o CVE-2019-14902:
157 The implementation of ACL inheritance in the Samba AD DC was not complete,
158 and so absent a 'full-sync' replication, ACLs could get out of sync between
159 domain controllers.
161 o CVE-2019-14907:
162 When processing untrusted string input Samba can read past the end of the
163 allocated buffer when printing a "Conversion error" message to the logs.
165 o CVE-2019-19344:
166 During DNS zone scavenging (of expired dynamic entries) there is a read of
167 memory after it has been freed.
169 For more details and workarounds, please refer to the security advisories.
172 Changes since 4.11.4:
173 ---------------------
175 o Andrew Bartlett <abartlet@samba.org>
176 * BUG 12497: CVE-2019-14902: Replication of ACLs down subtree on AD Directory
177 not automatic.
178 * BUG 14208: CVE-2019-14907: lib/util: Do not print the failed to convert
179 string into the logs.
181 o Gary Lockyer <gary@catalyst.net.nz>
182 * BUG 14050: CVE-2019-19344: kcc dns scavenging: Fix use after free in
183 dns_tombstone_records_zone.
186 #######################################
187 Reporting bugs & Development Discussion
188 #######################################
190 Please discuss this release on the samba-technical mailing list or by
191 joining the #samba-technical IRC channel on irc.freenode.net.
193 If you do report problems then please try to send high quality
194 feedback. If you don't provide vital information to help us track down
195 the problem then you will probably be ignored. All bug reports should
196 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
197 database (https://bugzilla.samba.org/).
200 ======================================================================
201 == Our Code, Our Bugs, Our Responsibility.
202 == The Samba Team
203 ======================================================================
206 ----------------------------------------------------------------------
209 ==============================
210 Release Notes for Samba 4.11.4
211 December 16, 2019
212 ==============================
215 This is the latest stable release of the Samba 4.11 release series.
218 Changes since 4.11.3:
219 ---------------------
221 o Jeremy Allison <jra@samba.org>
222 * BUG 14161: s3: libsmb: Ensure SMB1 cli_qpathinfo2() doesn't return an inode
223 number.
224 * BUG 14174: s3: utils: smbtree. Ensure we don't call cli_RNetShareEnum()
225 on an SMB1 connection.
226 * BUG 14176: NT_STATUS_ACCESS_DENIED becomes EINVAL when using SMB2 in
227 SMBC_opendir_ctx.
228 * BUG 14189: s3: smbd: SMB2 - Ensure we use the correct session_id if
229 encrypting an interim response.
230 * BUG 14205: Prevent smbd crash after invalid SMB1 negprot.
232 o Ralph Boehme <slow@samba.org>
233 * BUG 13745: s3:printing: Fix %J substition.
234 * BUG 13925: s3: Remove now unneeded call to cmdline_messaging_context().
235 * BUG 14069: Incomplete conversion of former parametric options.
236 * BUG 14070: Fix sync dosmode fallback in async dosmode codepath.
237 * BUG 14171: vfs_fruit returns capped resource fork length.
239 o Isaac Boukris <iboukris@gmail.com>
240 * BUG 14116: libnet_join: Add SPNs for additional-dns-hostnames entries.
242 o Volker Lendecke <vl@samba.org>
243 * BUG 14211: smbd: Increase a debug level.
245 o Stefan Metzmacher <metze@samba.org>
246 * BUG 14153: Prevent azure ad connect from reporting discovery errors:
247 reference-value-not-ldap-conformant.
249 o Christof Schmitt <cs@samba.org>
250 * BUG 14179: krb5_plugin: Fix developer build with newer heimdal system
251 library.
253 o Andreas Schneider <asn@samba.org>
254 * BUG 14168: replace: Only link libnsl and libsocket if requrired.
256 o Martin Schwenke <martin@meltin.net>
257 * BUG 14175: ctdb: Incoming queue can be orphaned causing communication
258 breakdown.
260 o Uri Simchoni <uri@samba.org>
261 * BUG 13846: ldb: Release ldb 2.0.8. Cross-compile will not take
262 cross-answers or cross-execute.
263 * BUG 13856: heimdal-build: Avoid hard-coded /usr/include/heimdal in
264 asn1_compile-generated code.
267 #######################################
268 Reporting bugs & Development Discussion
269 #######################################
271 Please discuss this release on the samba-technical mailing list or by
272 joining the #samba-technical IRC channel on irc.freenode.net.
274 If you do report problems then please try to send high quality
275 feedback. If you don't provide vital information to help us track down
276 the problem then you will probably be ignored. All bug reports should
277 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
278 database (https://bugzilla.samba.org/).
281 ======================================================================
282 == Our Code, Our Bugs, Our Responsibility.
283 == The Samba Team
284 ======================================================================
287 ----------------------------------------------------------------------
290 ==============================
291 Release Notes for Samba 4.11.3
292 December 10, 2019
293 ==============================
296 This is a security release in order to address the following defects:
298 o CVE-2019-14861: Samba AD DC zone-named record Denial of Service in DNS
299 management server (dnsserver).
300 o CVE-2019-14870: DelegationNotAllowed not being enforced in protocol transition
301 on Samba AD DC.
304 =======
305 Details
306 =======
308 o CVE-2019-14861:
309 An authenticated user can crash the DCE/RPC DNS management server by creating
310 records with matching the zone name.
312 o CVE-2019-14870:
313 The DelegationNotAllowed Kerberos feature restriction was not being applied
314 when processing protocol transition requests (S4U2Self), in the AD DC KDC.
316 For more details and workarounds, please refer to the security advisories.
319 Changes since 4.11.2:
320 ---------------------
322 o Andrew Bartlett <abartlet@samba.org>
323 * BUG 14138: CVE-2019-14861: Fix DNSServer RPC server crash.
325 o Isaac Boukris <iboukris@gmail.com>
326 * BUG 14187: CVE-2019-14870: DelegationNotAllowed not being enforced.
329 #######################################
330 Reporting bugs & Development Discussion
331 #######################################
333 Please discuss this release on the samba-technical mailing list or by
334 joining the #samba-technical IRC channel on irc.freenode.net.
336 If you do report problems then please try to send high quality
337 feedback. If you don't provide vital information to help us track down
338 the problem then you will probably be ignored. All bug reports should
339 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
340 database (https://bugzilla.samba.org/).
343 ======================================================================
344 == Our Code, Our Bugs, Our Responsibility.
345 == The Samba Team
346 ======================================================================
349 ----------------------------------------------------------------------
352 ==============================
353 Release Notes for Samba 4.11.2
354 October 29, 2019
355 ==============================
358 This is a security release in order to address the following defects:
360 o CVE-2019-10218: Client code can return filenames containing path separators.
361 o CVE-2019-14833: Samba AD DC check password script does not receive the full
362 password.
363 o CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server
364 via dirsync.
366 =======
367 Details
368 =======
370 o CVE-2019-10218:
371 Malicious servers can cause Samba client code to return filenames containing
372 path separators to calling code.
374 o CVE-2019-14833:
375 When the password contains multi-byte (non-ASCII) characters, the check
376 password script does not receive the full password string.
378 o CVE-2019-14847:
379 Users with the "get changes" extended access right can crash the AD DC LDAP
380 server by requesting an attribute using the range= syntax.
382 For more details and workarounds, please refer to the security advisories.
385 Changes since 4.11.1:
386 ---------------------
388 o Jeremy Allison <jra@samba.org>
389 * BUG 14071: CVE-2019-10218 - s3: libsmb: Protect SMB1 and SMB2 client code
390 from evil server returned names.
392 o Andrew Bartlett <abartlet@samba.org>
393 * BUG 12438: CVE-2019-14833: Use utf8 characters in the unacceptable
394 password.
395 * BUG 14040: CVE-2019-14847 dsdb: Correct behaviour of ranged_results when
396 combined with dirsync.
398 o Björn Baumbach <bb@sernet.de>
399 * BUG 12438: CVE-2019-14833 dsdb: Send full password to check password
400 script.
403 #######################################
404 Reporting bugs & Development Discussion
405 #######################################
407 Please discuss this release on the samba-technical mailing list or by
408 joining the #samba-technical IRC channel on irc.freenode.net.
410 If you do report problems then please try to send high quality
411 feedback. If you don't provide vital information to help us track down
412 the problem then you will probably be ignored. All bug reports should
413 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
414 database (https://bugzilla.samba.org/).
417 ======================================================================
418 == Our Code, Our Bugs, Our Responsibility.
419 == The Samba Team
420 ======================================================================
423 ----------------------------------------------------------------------
426 ==============================
427 Release Notes for Samba 4.11.1
428 October 18, 2019
429 ==============================
432 This is the latest stable release of the Samba 4.11 release series.
435 Changes since 4.11.0:
436 ---------------------
438 o Michael Adam <obnox@samba.org>
439 * BUG 14141: getpwnam and getpwuid need to return data for ID_TYPE_BOTH
440 group.
442 o Jeremy Allison <jra@samba.org>
443 * BUG 14094: smbc_readdirplus() is incompatible with smbc_telldir() and
444 smbc_lseekdir().
445 * BUG 14152: s3: smbclient: Stop an SMB2-connection from blundering into
446 SMB1-specific calls.
448 o Ralph Boehme <slow@samba.org>
449 * BUG 14137: Fix stale file handle error when using mkstemp on a share.
451 o Isaac Boukris <iboukris@gmail.com>
452 * BUG 14106: Fix spnego fallback from kerberos to ntlmssp in smbd server.
453 * BUG 14140: Overlinking libreplace against librt and pthread against every
454 binary or library causes issues.
456 o Günther Deschner <gd@samba.org>
457 * BUG 14130: s3-winbindd: Fix forest trusts with additional trust attributes.
458 * BUG 14134: auth/gensec: Fix non-AES schannel seal.
460 o Amitay Isaacs <amitay@gmail.com>
461 * BUG 14147: Deleted records can be resurrected during recovery.
463 o Björn Jacke <bj@sernet.de>
464 * BUG 14136: Fix uncaught exception in classicupgrade.
465 * BUG 14139: fault.c: Improve fault_report message text pointing to our wiki.
467 o Bryan Mason <bmason@redhat.com>
468 * BUG 14128: s3:client: Use DEVICE_URI, instead of argv[0], for Device URI.
470 o Stefan Metzmacher <metze@samba.org>
471 * BUG 14124: pam_winbind with krb5_auth or wbinfo -K doesn't work for users
472 of trusted domains/forests.
474 o Mathieu Parent <math.parent@gmail.com>
475 * BUG 14131: Remove 'pod2man' as it is no longer needed.
477 o Andreas Schneider <asn@samba.org>
478 * BUG 13884: Joining Active Directory should not use SAMR to set the
479 password.
480 * BUG 14140: Overlinking libreplace against librt and pthread against every
481 binary or library causes issues.
482 * BUG 14155: 'kpasswd' fails when built with MIT Kerberos.
484 o Martin Schwenke <martin@meltin.net>
485 * BUG 14129: Exit code of ctdb nodestatus should not be influenced by deleted
486 nodes.
489 #######################################
490 Reporting bugs & Development Discussion
491 #######################################
493 Please discuss this release on the samba-technical mailing list or by
494 joining the #samba-technical IRC channel on irc.freenode.net.
496 If you do report problems then please try to send high quality
497 feedback. If you don't provide vital information to help us track down
498 the problem then you will probably be ignored. All bug reports should
499 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
500 database (https://bugzilla.samba.org/).
503 ======================================================================
504 == Our Code, Our Bugs, Our Responsibility.
505 == The Samba Team
506 ======================================================================
509 ----------------------------------------------------------------------
512 ==============================
513 Release Notes for Samba 4.11.0
514 September 17, 2019
515 ==============================
518 This is the first stable release of the Samba 4.11 release series.
519 Please read the release notes carefully before upgrading.
522 UPGRADING
523 =========
525 AD Database compatibility
526 -------------------------
528 Samba 4.11 has changed how the AD database is stored on disk. AD users should
529 not really be affected by this change when upgrading to 4.11. However, AD
530 users should be extremely careful if they need to downgrade from Samba 4.11 to
531 an older release.
533 Samba 4.11 maintains database compatibility with older Samba releases. The
534 database will automatically get rewritten in the new 4.11 format when you
535 first start the upgraded samba executable.
537 However, when downgrading from 4.11 you will need to manually downgrade the AD
538 database yourself. Note that you will need to do this step before you install
539 the downgraded Samba packages. For more details, see:
540 https://wiki.samba.org/index.php/Downgrading_an_Active_Directory_DC
542 When either upgrading or downgrading, users should also avoid making any
543 database modifications between installing the new Samba packages and starting
544 the samba executable.
546 SMB1 is disabled by default
547 ---------------------------
549 The defaults of 'client min protocol' and 'server min protocol'
550 have been changed to SMB2_02.
552 This means clients without support for SMB2 or SMB3 are no longer
553 able to connect to smbd (by default).
555 It also means client tools like smbclient and other,
556 as well as applications making use of libsmbclient are no longer
557 able to connect to servers without SMB2 or SMB3 support (by default).
559 It's still possible to allow SMB1 dialects, e.g. NT1, LANMAN2
560 and LANMAN1 for client and server, as well as CORE and COREPLUS on
561 the client.
563 Note that most commandline tools e.g. smbclient, smbcacls and others
564 also support the '--option' argument to overwrite smb.conf options,
565 e.g. --option='client min protocol=NT1' might be useful.
567 As Microsoft no longer installs SMB1 support in recent releases
568 or uninstalls it after 30 days without usage, the Samba Team
569 tries to get remove the SMB1 usage as much as possible.
571 SMB1 is officially deprecated and might be removed step by step
572 in the following years. If you have a strong requirement for SMB1
573 (except for supporting old Linux Kernels), please file a bug
574 at https://bugzilla.samba.org and let us know about the details.
576 LanMan and plaintext authentication deprecated
577 ----------------------------------------------
579 The "lanman auth" and "encrypt passwords" parameters are deprecated
580 with this release as both are only applicable to SMB1 and are quite
581 insecure. NTLM, NTLMv2 and Kerberos authentication are unaffected, as
582 "encrypt passwords = yes" has been the default since Samba 3.0.0.
584 If you have a strong requirement for these authentication protocols,
585 please file a bug at https://bugzilla.samba.org and let us know about
586 the details.
588 BIND9_FLATFILE deprecated
589 -------------------------
591 The BIND9_FLATFILE DNS backend is deprecated in this release and will
592 be removed in the future. This was only practically useful on a single
593 domain controller or under expert care and supervision.
595 This release therefore deprecates the "rndc command" smb.conf
596 parameter, which is used to support this configuration. After writing
597 out a list of DCs permitted to make changes to the DNS Zone "rndc
598 command" is called with reload to tell the 'named' server if a DC was
599 added/removed to to the domain.
602 NEW FEATURES/CHANGES
603 ====================
605 Default samba process model
606 ---------------------------
608 The default for the '--model' argument passed to the samba executable has changed
609 from 'standard' to 'prefork'. This means a difference in the number of samba
610 child processes that are created to handle client connections. The previous
611 default would create a separate process for every LDAP or NETLOGON client
612 connection. For a network with a lot of persistent client connections, this
613 could result in significant memory overhead. Now, with the new default of
614 'prefork', the LDAP, NETLOGON, and KDC services will create a fixed number of
615 worker processes at startup and share the client connections amongst these
616 workers. The number of worker processes can be configured by the 'prefork
617 children' setting in the smb.conf (the default is 4).
619 Authentication Logging
620 ----------------------
622 Winbind now logs PAM_AUTH and NTLM_AUTH events, a new attribute "logonId" has
623 been added to the Authentication JSON log messages. This contains a random
624 logon id that is generated for each PAM_AUTH and NTLM_AUTH request and is passed
625 to SamLogon, linking the windbind and SamLogon requests.
627 The serviceDescription of the messages is set to "winbind", the authDescription
628 is set to one of:
629 "PASSDB, <command>, <pid>"
630 "PAM_AUTH, <command>, <pid>"
631 "NTLM_AUTH, <command>, <pid>"
632 where:
633 <command> is the name of the command makinmg the winbind request i.e. wbinfo
634 <pid> is the process id of the requesting process.
636 The version of the JSON Authentication messages has been changed from 1.1 to
637 1.2.
639 LDAP referrals
640 --------------
642 The scheme of returned LDAP referrals now reflects the scheme of the original
643 request, i.e. referrals received via ldap are prefixed with "ldap://"
644 and those over ldaps are prefixed with "ldaps://".
646 Previously all referrals were prefixed with "ldap://".
648 Bind9 logging
649 -------------
651 It is now possible to log the duration of DNS operations performed by Bind9.
652 This should aid future diagnosis of performance issues and could be used to
653 monitor DNS performance. The logging is enabled by setting log level to
654 "dns:10" in smb.conf.
656 The logs are currently human readable text only, i.e. no JSON formatted output.
658 Log lines are of the form:
660 <function>: DNS timing: result: [<result>] duration: (<duration>)
661 zone: [<zone>] name: [<name>] data: [<data>]
663 durations are in microseconds.
665 Default schema updated to 2012_R2
666 ---------------------------------
668 Default AD schema changed from 2008_R2 to 2012_R2. 2012_R2 functional level
669 is not yet available. Older schemas can be used by provisioning with the
670 '--base-schema' argument. Existing installations can be updated with the
671 samba-tool command "domain schemaupgrade".
673 Samba's replication code has also been improved to handle replication
674 with the 2012 schema (the core of this replication fix has also been
675 backported to 4.9.11 and will be in a 4.10.x release).
677 For more about how the AD schema relates to overall Windows compatibility,
678 please read:
679 https://wiki.samba.org/index.php/Windows_2012_Server_compatibility
681 GnuTLS 3.2 required
682 -------------------
684 Samba is making efforts to remove in-tree cryptographic functionality,
685 and to instead rely on externally maintained libraries. To this end,
686 Samba has chosen GnuTLS as our standard cryptographic provider.
688 Samba now requires GnuTLS 3.2 to be installed (including development
689 headers at build time) for all configurations, not just the Samba AD
690 DC.
692 NOTE WELL: The use of GnuTLS means that Samba will honour the
693 system-wide 'FIPS mode' (a reference to the US FIPS-140 cryptographic
694 standard) and so will not operate in many still common situations if
695 this system-wide parameter is in effect, as many of our protocols rely
696 on outdated cryptography.
698 A future Samba version will mitigate this to some extent where good
699 cryptography effectively wraps bad cryptography, but for now that above
700 applies.
702 samba-tool improvements
703 -----------------------
705 A new "samba-tool contact" command has been added to allow the
706 command-line manipulation of contacts, as used for address book
707 lookups in LDAP.
709 The "samba-tool [user|group|computer|group|contact] edit" command has been
710 improved to operate more pleasantly on international character sets.
712 100,000 USER and LARGER Samba AD DOMAINS
713 ========================================
715 Extensive efforts have been made to optimise Samba for use in
716 organisations (for example) targeting 100,000 users, plus 120,000
717 computer objects, as well as large number of group memberships.
719 Many of the specific efforts are detailed below, but the net results
720 is to remove barriers to significantly larger Samba deployments
721 compared to previous releases.
723 Reindex performance improvements
724 --------------------------------
726 The performance of samba-tool dbcheck --reindex has been improved,
727 especially for large domains.
729 join performance improvements
730 -----------------------------
732 The performance of samba-tool domain join has been improved,
733 especially for large domains.
735 LDAP Server memory improvements
736 -------------------------------
738 The LDAP server has improved memory efficiency, ensuring that large
739 LDAP responses (for example a search for all objects) is not copied
740 multiple times into memory.
742 Setting lmdb map size
743 ---------------------
745 It is now possible to set the lmdb map size (the maximum permitted
746 size for the database). "samba-tool" now accepts the
747 "--backend-store-size" i.e. --backend-store-size=4Gb. If not
748 specified it defaults to 8Gb.
750 This option is avaiable for the following sub commands:
751 * domain provision
752 * domain join
753 * domain dcpromo
754 * drs clone-dc-database
756 LDB "batch_mode"
757 ----------------
759 To improve performance during batch operations i.e. joins, ldb now
760 accepts a "batch_mode" option. However to prevent any index or
761 database inconsistencies if an operation fails, the entire transaction
762 will be aborted at commit.
764 New LDB pack format
765 -------------------
767 On first use (startup of 'samba' or the first transaction write)
768 Samba's sam.ldb will be updated to a new more efficient pack format.
769 This will take a few moments.
771 New LDB <= and >= index mode to improve replication performance
772 ---------------------------------------------------------------
774 As well as a new pack format, Samba's sam.ldb uses a new index format
775 allowing Samba to efficiently select objects changed since the last
776 replication cycle. This in turn improves performance during
777 replication of large domains.
779 https://wiki.samba.org/index.php/LDB_Greater_than_and_Less_than_indexing
781 Improvements to ldb search performance
782 --------------------------------------
784 Search performance on large LDB databases has been improved by
785 reducing memory allocations made on each object.
787 Improvements to subtree rename performance
788 ------------------------------------------
790 Improvements have been made to Samba's handling of subtree renames,
791 for example of containers and organisational units, however large
792 renames are still not recommended.
794 CTDB changes
795 ============
797 * nfs-linux-kernel-callout now defaults to using systemd service names
799 The Red Hat service names continue to be the default.
801 Other distributions should patch this file when packaging it.
803 * The onnode -o option has been removed
805 * ctdbd logs when it is using more than 90% of a CPU thread
807 ctdbd is single threaded, so can become saturated if it uses the
808 full capacity of a CPU thread. To help detect this situation, ctdbd
809 now logs messages when CPU utilisation exceeds 90%. Each change in
810 CPU utilisation over 90% is logged. A message is also logged when
811 CPU utilisation drops below the 90% threshold.
813 * Script configuration variable CTDB_MONITOR_SWAP_USAGE has been removed
815 05.system.script now monitors total memory (i.e. physical memory +
816 swap) utilisation using the existing CTDB_MONITOR_MEMORY_USAGE
817 script configuration variable.
819 CephFS Snapshot Integration
820 ---------------------------
822 CephFS snapshots can now be exposed as previous file versions using the new
823 ceph_snapshots VFS module. See the vfs_ceph_snapshots(8) man page for details.
826 REMOVED FEATURES
827 ================
829 Web server
830 ----------
832 As a leftover from work related to the Samba Web Administration Tool (SWAT),
833 Samba still supported a Python WSGI web server (which could still be turned on
834 from the 'server services' smb.conf parameter). This service was unused and has
835 now been removed from Samba.
837 samba-tool join subdomain
838 -------------------------
840 The subdomain role has been removed from the join command. This option did
841 not work and has no tests.
843 Python2 support
844 ---------------
846 Samba 4.11 will not have any runtime support for Python 2.
848 If you are building Samba using the '--disable-python' option
849 (i.e. you're excluding all the run-time Python support), then this
850 will continue to work on a system that supports either python2 or
851 python3.
853 To build Samba with python2 you *must* set the 'PYTHON' environment
854 variable for both the 'configure' and 'make' steps, i.e.
855 'PYTHON=python2 ./configure'
856 'PYTHON=python2 make'
857 This will override the python3 default.
859 Except for this specific build-time use of python2, Samba now requires
860 Python 3.4 as a minimum.
862 smb.conf changes
863 ================
865 Parameter Name Description Default
866 -------------- ----------- -------
868 allocation roundup size Default changed/ 0
869 Deprecated
870 client min protocol Changed default SMB2_02
871 server min protocol Changed default SMB2_02
872 mangled names Changed default illegal
873 web port Removed
874 fruit:zero_file_id Changed default False
875 debug encryption New: dump encryption keys False
876 rndc command Deprecated
877 lanman auth Deprecated
878 encrypt passwords Deprecated
881 CHANGES SINCE 4.11.0rc4
882 =======================
885 CHANGES SINCE 4.11.0rc3
886 =======================
888 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
889 * BUG 14049: ldb: Don't try to save a value that isn't there.
890 * ldb_dn: Free dn components on explode failure.
891 * ldb: Do not allow adding a DN as a base to itself.
893 o Andrew Bartlett <abartlet@samba.org>
894 * ldb: Release ldb 2.0.7.
895 * BUG 13695: ldb: Correct Pigeonhole principle validation in
896 ldb_filter_attrs().
897 * BUG 14049: Fix ldb dn crash.
898 * BUG 14117: Deprecate "lanman auth = yes" and "encrypt passwords = no".
900 o Ralph Boehme <slow@samba.org>
901 * BUG 14038: Fix compiling ctdb on older systems lacking POSIX robust
902 mutexes.
903 * BUG 14121: smbd returns bad File-ID on filehandle used to create a file or
904 directory.
906 o Poornima G <pgurusid@redhat.com>
907 * BUG 14098: vfs_glusterfs: Use pthreadpool for scheduling aio operations.
909 o Stefan Metzmacher <metze@samba.org>
910 * BUG 14055: Add the target server name of SMB 3.1.1 connections as a hint to
911 load balancers or servers with "multi-tenancy" support.
912 * BUG 14113: Fix byte range locking bugs/regressions.
914 o Swen Schillig <swen@linux.ibm.com>
915 * ldb: Fix mem-leak if talloc_realloc fails.
917 o Evgeny Sinelnikov <sin@altlinux.org>
918 * BUG 14007: Fix join with don't exists machine account.
920 o Martin Schwenke <martin@meltin.net>
921 * BUG 14085: ctdb-recoverd: Only check for LMASTER nodes in the VNN map.
924 CHANGES SINCE 4.11.0rc2
925 =======================
927 o Michael Adam <obnox@samba.org>
928 * BUG 13972: Different Device Id for GlusterFS FUSE mount is causing data
929 loss in CTDB cluster.
931 o Jeremy Allison <jra@samba.org>
932 * BUG 14035: CVE-2019-10197: Permissions check deny can allow user to escape
933 from the share.
935 o Andrew Bartlett <abartlet@samba.org>
936 * BUG 14059: ldb: Release ldb 2.0.6 (log database repack so users know what
937 is happening).
938 * BUG 14092: docs: Deprecate "rndc command" for Samba 4.11.
940 o Tim Beale <timbeale@catalyst.net.nz>
941 * BUG 14059: ldb: Free memory when repacking database.
943 o Ralph Boehme <slow@samba.org>
944 * BUG 14089: vfs_default: Use correct flag in vfswrap_fs_file_id.
945 * BUG 14090: vfs_glusterfs: Initialize st_ex_file_id, st_ex_itime and
946 st_ex_iflags.
948 o Anoop C S <anoopcs@redhat.com>
949 * BUG 14093: vfs_glusterfs: Enable profiling for file system operations.
951 o Aaron Haslett <aaronhaslett@catalyst.net.nz>
952 * BUG 14059: Backport sambadowngradedatabase for v4.11.
954 o Stefan Metzmacher <metze@samba.org>
955 * BUG 14035: CVE-2019-10197: Permissions check deny can allow user to escape
956 from the share.
958 o Christof Schmitt <cs@samba.org>
959 * BUG 14032: vfs_gpfs: Implement special case for denying owner access to
960 ACL.
962 o Martin Schwenke <martin@meltin.net>
963 * BUG 14084: Avoid marking a node as connected before it can receive packets.
964 * BUG 14086: Fix onnode test failure with ShellCheck >= 0.4.7.
965 * BUG 14087: ctdb-daemon: Stop "ctdb stop" from completing before freezing
966 databases.
969 KNOWN ISSUES
970 ============
972 https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.11#Release_blocking_bugs
975 #######################################
976 Reporting bugs & Development Discussion
977 #######################################
979 Please discuss this release on the samba-technical mailing list or by
980 joining the #samba-technical IRC channel on irc.freenode.net.
982 If you do report problems then please try to send high quality
983 feedback. If you don't provide vital information to help us track down
984 the problem then you will probably be ignored. All bug reports should
985 be filed under the Samba 4.1 and newer product in the project's Bugzilla
986 database (https://bugzilla.samba.org/).
989 ======================================================================
990 == Our Code, Our Bugs, Our Responsibility.
991 == The Samba Team
992 ======================================================================