4 This is the first release candidate of Samba 4.2. This is *not*
5 intended for production environments and is designed for testing
6 purposes only. Please report any defects via the Samba bug reporting
7 system at https://bugzilla.samba.org/.
9 Samba 4.2 will be the next version of the Samba suite.
15 Read the "Winbindd/Netlogon improvements" section (below) carefully!
21 Transparent File Compression
22 ============================
24 Samba 4.2.0 adds support for the manipulation of file and folder
25 compression flags on the Btrfs filesystem.
26 With the Btrfs Samba VFS module enabled, SMB2+ compression flags can
27 be set remotely from the Windows Explorer File->Properties->Advanced
28 dialog. Files flagged for compression are transparently compressed
29 and uncompressed when accessed or modified.
31 Previous File Versions with Snapper
32 ===================================
34 The newly added Snapper VFS module exposes snapshots managed by
35 Snapper for use by Samba. This provides the ability for remote
36 clients to access shadow-copies via Windows Explorer using the
37 "previous versions" dialog.
39 Winbindd/Netlogon improvements
40 ==============================
42 The whole concept of maintaining the netlogon secure channel
43 to (other) domain controllers was rewritten in order to maintain
44 global state in a netlogon_creds_cli.tdb. This is the proper fix
45 for a large number of bugs:
47 https://bugzilla.samba.org/show_bug.cgi?id=6563
48 https://bugzilla.samba.org/show_bug.cgi?id=7944
49 https://bugzilla.samba.org/show_bug.cgi?id=7945
50 https://bugzilla.samba.org/show_bug.cgi?id=7568
51 https://bugzilla.samba.org/show_bug.cgi?id=8599
53 In addition a strong session key is now required by default,
54 which means that communication to older servers or clients
55 might be rejected by default.
57 For the client side we have the following new options:
58 "require strong key" (yes by default), "reject md5 servers" (no by default).
59 E.g. for Samba 3.0.37 you need "require strong key = no" and
60 for NT4 DCs you need "require strong key = no" and "client NTLMv2 auth = no",
62 On the server side (as domain controller) we have the following new options:
63 "allow nt4 crypto" (no by default), "reject md5 client" (no by default).
64 E.g. in order to allow Samba < 3.0.27 or NT4 members to work
65 you need "allow nt4 crypto = yes"
67 winbindd does not list group memberships for display purposes
68 (e.g. getent group <domain\<group>) anymore by default.
69 The new default is "winbind expand groups = 0" now,
70 the reason for this is the same as for "winbind enum users = no"
71 and "winbind enum groups = no". Providing this information is not always
72 reliably possible, e.g. if there are trusted domains.
74 Please consult the smb.conf manpage for more details on these new options.
76 Winbindd use on the Samba AD DC
77 ===============================
79 Winbindd is now used on the Samba AD DC by default, replacing the
80 partial rewrite used for winbind operations in Samba 4.0 and 4.1.
82 This allows more code to be shared, more options to be honoured, and
83 paves the way for support for trusted domains in the AD DC.
85 If required the old internal winbind can be activated by setting
86 'server services = +winbind -winbindd'. Upgrading users with a server
87 services parameter specified should ensure they change 'winbind' to
88 'winbindd' to obtain the new functionality.
90 The 'samba' binary still manages the starting of this service, there
91 is no need to start the winbindd binary manually.
93 Larger IO sizes for SMB2/3 by default
94 =====================================
96 The default values for "smb2 max read", "smb2 max write" and "smb2 max trans"
97 have been changed to 8388608 (8MiB) in order to match the default of
100 Improved DCERPC man in the middle detection
101 ===========================================
103 The DCERPC header signing has been implemented
104 in addition to the dcerpc_sec_verification_trailer
107 Overhauled "net idmap" command
108 ==============================
110 The command line interface of the "net idmap" command has been
111 made systematic, and subcommands for reading and writing the autorid idmap
112 database have been added. Note that the writing commands should be
113 used with great care. See the net(8) manual page for details.
118 The tdb library, our core mechanism to store Samba-specific data on disk and
119 share it between processes, has been improved to support process shared robust
120 mutexes on Linux. These mutexes are available on Linux and Solaris and
121 significantly reduce the overhead involved with tdb. To enable mutexes for
124 dbwrap_tdb_mutexes:* = yes
126 in the [global] section of your smb.conf.
128 Tdb file space management has also been made more efficient. This
129 will lead to smaller and less fragmented databases.
131 Messaging improvements
132 ======================
134 Our internal messaging subsystem, used for example for things like oplock
135 break messages between smbds or setting a process debug level dynamically, has
136 been rewritten to use unix domain datagram messages.
141 Samba's file server clustering component CTDB is now integrated in the
142 Samba tree. This avoids the confusion of compatibility of Samba and CTDB
143 versions as existed previously.
145 To build the Samba file server with cluster support, use the configure
146 command line option --with-cluster-support. This will build clustered
147 file server against the in-tree ctdb. Building clustered samba with
148 previous versions of CTDB is no longer supported.
150 CTDB is built separately from the ctdb/ sub-directory. To build CTDB,
151 use the following steps:
159 ######################################################################
166 Parameter Name Description Default
167 -------------- ----------- -------
169 allow nt4 crypto New no
170 neutralize nt4 emulation New no
171 reject md5 client New no
172 reject md5 servers New no
173 require strong key New yes
174 smb2 max read Changed default 8388608
175 smb2 max write Changed default 8388608
176 smb2 max trans Changed default 8388608
177 winbind expand groups Changed default 0
183 #######################################
184 Reporting bugs & Development Discussion
185 #######################################
187 Please discuss this release on the samba-technical mailing list or by
188 joining the #samba-technical IRC channel on irc.freenode.net.
190 If you do report problems then please try to send high quality
191 feedback. If you don't provide vital information to help us track down
192 the problem then you will probably be ignored. All bug reports should
193 be filed under the Samba 4.2 product in the project's Bugzilla
194 database (https://bugzilla.samba.org/).
197 ======================================================================
198 == Our Code, Our Bugs, Our Responsibility.
200 ======================================================================