1 WHAT'S NEW IN Samba 2.2.7 - 20th November 2002
2 ==============================================
4 This is the latest stable release of Samba. This is the version
5 that all production Samba servers should be running for all current
8 IMPORTANT: Security bugfix for Samba
9 ------------------------------------
14 A security hole has been discovered in versions 2.2.2 through 2.2.6
15 of Samba that could potentially allow an attacker to gain root access
16 on the target machine. The word "potentially" is used because there
17 is no known exploit of this bug, and the Samba Team has not been able to
18 craft one ourselves. However, the seriousness of the problem warrants
19 this immediate 2.2.7 release.
21 In addition to addressing this security issue, Samba 2.2.7 also includes
22 thirteen unrelated improvements. These improvements result from our
23 process of continuous quality assurance and code review, and are part of
24 the Samba team's committment to excellence.
29 There was a bug in the length checking for encrypted password change
30 requests from clients. A client could potentially send an encrypted
31 password, which, when decrypted with the old hashed password could be
32 used as a buffer overrun attack on the stack of smbd. The attach would
33 have to be crafted such that converting a DOS codepage string to little
34 endian UCS2 unicode would translate into an executable block of code.
36 All versions of Samba between 2.2.2 to 2.2.6 inclusive are vulnerable
37 to this problem. This version of Samba 2.2.7 contains a fix for this
40 Earlier versions of Samba are not vulnerable.
42 There is no known exploit or exploit code for this vulnerability,
43 it was discovered by a code audit by Debian Samba maintainers.
48 Thanks to Steve Langasek <vorlon@debian.org> and Eloy Paris
49 <peloy@debian.org> for bringing this vulnerability to our notice.
51 Patch for Samba versions 2.2.2 to 2.2.6
52 ---------------------------------------
54 The following patch applies cleanly to the above Samba versions
55 and will fix the vulnerability for sites that do not wish to upgrade
56 to 2.2.7 at this time.
59 -------------------------------cut here---------------------------------
60 --- libsmb/smbencrypt.c.orig Tue Nov 19 17:21:57 2002
61 +++ libsmb/smbencrypt.c Tue Nov 19 17:22:12 2002
65 /* Password must be converted to NT unicode - null terminated. */
66 - dos_struni2((char *)wpwd, (const char *)passwd, 256);
67 + dos_struni2((char *)wpwd, (const char *)passwd, len);
68 /* Calculate length in bytes */
69 len = strlen_w((const smb_ucs2_t *)wpwd) * sizeof(int16);
70 -------------------------------cut here---------------------------------
77 See the cvs log for SAMBA_2_2 for more details
79 1) ensure we send the notify message in the same way it is expected
80 to be received by srv_spoolss_receive_message().
81 2) attribute matching on truncate only matters when opening truncate
82 with current SYSTEM|HIDDEN -> NONE. It's fine to truncate on open
83 with current NONE -> SYSTEM | HIDDEN.
84 3) Fix bug in rpcclient's deldriver command
85 4) Don't set global_machine_password_needs_changing if
86 lp_machine_password_timeout() is set to zero
87 5) don't parse the BUFFER5 if the buffer length is zero
88 6) fix core dump if pdbedit is run as non-root or smbpasswd file does
90 7) Ensure can_delete() returns correct error code
91 8) correctly return NT_STATUS_DELETE_PENDING from open code
92 9) fix bug that assumed dos_unistr2 length was in ucs2 units, not bytes
93 10) check the long_archi name is not null when deleting a printer driver.
94 fixes core dump in smbd when using rpcclient's deldriver
95 11) fix fd leak with kernel change notify on Linux 2.4 kernels
96 12) must add one to the extra_data size to transfer the 0 string
97 terminator. This was causing "wbinfo --sequence" to access past the
98 end of malloced memory
99 13) fix for large systems allowing more than 65536 files open in
101 14) Fix bug in %U expansion
104 =========================================
106 Older releases notes for 2.2.x distributions follow
108 -----------------------------------------------------------------------------
109 The release notes for 2.2.6 follow :
111 There have been several fixes and internal enhancements which include:
113 * Fixes for MS-RPC printing issues affecting Windows 2000 clients
114 * New support for smb.conf generation in SWAT
115 * Inclusion of several performance enhancements (See --with-sendfile
116 & and the modified smb.conf(5) parameters in these Release Notes)
117 * Fixes for several file locking bugs and returned status codes
123 Refer to the smb.conf(5) man page for complete descriptions of new parameters.
125 * profile acls (S) workaround for issue with WinXP SP1
126 and roaming user profiles
137 * max xmit (G) new default value
138 * large readwrite (G) new default value
140 New ./configure Options
141 -----------------------
143 --with-sendfile Enable experimental sendfile support
144 --with-winbind-ldap-hack Enable winbindd_ldap_hack() functionality
145 for Windows 2000 native mode domains
151 See the cvs log for SAMBA_2_2 for more details
153 1) Fixed several compiler warnings caused by the use of const parameters
154 2) Fixed a hang in the main smbd process caused by an EINTR in the
156 3) Fixed string substitutions to accept a length for sanity checks
157 4) Fixed 17-bit length field in nmb header
158 5) Removed non-portable inline declaration for functions
159 6) Performance fix for including files with an smb.conf variable in the
161 7) Fix for parsing LPRng lpq output
162 8) Parsing fix for PRINTER_INFO_2 structure which was causing viewing
163 printer properties to fail
164 9) Fix for printer change notification and Windows NT clients which caused
165 the client to go into an infinite loop of refreshing the local printers
167 10) Allow trans2 and nttrans messages to be processed in oplock break state
168 which fixes a problem with oplock break requests and Win2k clients
169 11) Don't crash on setfileinfo on printer fsp
170 12) Memory fixes caught by Valgrind
171 13) Updates to stop spurious error message in tdb
172 14) Fix silly logic bug in 'make smbd processes' and 'status = no' check
173 15) Fix compilation of pam_smbpass and --with-ldap
174 16) Fix compilation of smbwrapper on Solaris hosts
175 17) fix logic error in a check for enabling the winbind_pam_auth_crap() code
176 & fix formatting typo in --with-winbind-auth-challenge
177 18) Correcting check for ldap_start_tls()
178 19) Fixed a problem with getgroups() where it could include our current
180 20) fix incorrect semantics in the DeletePrinterDriver() spoolss rpc
181 to only attempt to delete the architecture specified by the client
182 21) Don't allow TEMP attribute on directory open
183 22) Restore VxFS quotas to the 2.2 branch
184 23) Added basic "Wizard" functionality to SWAT
185 24) Fix initial "allocation size" in NTcreate&X call
186 25) Fix for open fid, "nametoolong"
187 26) Exit server on receipt of a non-SMB packet. Ensure we have
188 at least smb_size bytes before processing a packet
189 27) Replace inet_aton with inet_addr() to correct compile problems on Solaris
190 28) Include the "account" objectclass when adding a new account to --with-ldapsam
191 in order to comply with the data model implemented by OpenLDAP 2.1.x
192 29) Various fixes for POSIX compliance
193 30) Correct alignment & offset bug in EnumPrinterDataEx()
194 31) Fix access checks when modifying forms using a print server handle
195 (not just a printer handle)
196 32) Account for case data_len == 0 in EnumPrinterDataEx()
197 33) Fix logic error in blocking lock code
198 34) Fixed various incorrect return codes to clients
199 35) Add RESOLVE_DFSPATH to mkdir operations
200 36) Fix longstanding bug in Win2k clients by clearing the shortname
201 buffer before returning ASCII short name
202 37) added -t option to smbpasswd for explicitly changing a trust
203 account password when operating in security = domain
204 38) installed -x option to testparm to eXclude printing all parameter
205 values that are at default settings.
206 39) Fix shares/printers view in SWAT so that only Basic options are exposed
208 40) Added 1125 & KOI8-U to codepage list in Makefile.in
209 41) Include separate configure checks for *openbsd* & *freebsd* when
210 determining flags used to compile shared libraries.
211 42) Merge in free list unlock on error fix
212 43) Correctly fail opens with mismatching SYSTEM or HIDDEN attributes
213 if we are mapping system or hidden
214 44) Fix bug with stat mode open being done on read-only open with truncate
215 45) Fix crash bug discovered where cli struct was being deallocated in a
217 46) Ensure we open UNIX fifo's non-blocking
218 47) Fix DeletePrinterDriver() (hopefully for the last time...yeah right....)
219 48) only lowercase global_myname in the %L substitution, not the whole string
220 49) Merged Steve French's fix for OS/2 EA return error being removed
221 50) Patch from Steve French to fix difference in responses to smbclient
222 //server/share ls / on Samba and Windows 2000
223 51) Print error and exit if smb.conf doesn't have security=domain and
224 encrypt passwords=yes when joining domain
225 52) Added final Steve French patch for "required" attributes with old dir
227 53) Initialize user_rid value in WINBIND_USERINFO structure returned by
228 the rpc version of query_user()
229 54) Ensure we've failed a lock with a lock denied message before automatically
230 pushing it onto the blocking queue
231 55) Add experimental --with-sendfile code
232 56) alignment fix in printing code merged from HEAD
233 57) Merge fix for other sids in token from HEAD
234 58) Merge winbindd with current (more advanced) state of play in APPLIANCE_HEAD
235 59) fix smbclient / Win98 off by one bug
236 60) Never, *ever* hold a mutex lock in the message database where there may be
237 traversals being attempted
238 61) Add LDAP hack for retrieving the SAM sequence number when a member of a
239 Windows 2000 native mode domain
240 62) Fix race condition when changing a machine account password as we were
241 no longer locking the secrets entry
242 63) Allow '@' as a valid character in domain names
243 64) remove jobs from the spool directory when using cups
244 65) removed -lresolv for --enable-ldapsam
245 66) Memory leak fix and correct use of negative caching in winbindd
246 67) Updated spoolss parsing code with known good state of APPLIANCE_HEAD
247 68) Delete printer security check was reversed
248 69) Windows allows delete printer on a handle opened by an admin user, then
249 used on a pipe handle created by an anonymous user...We do to now...
250 70) Make explicit the difference between a tdb key with no data attached, and
252 71) Ensure we register the 1c name on the unicast subnet.
253 72) Fix inheritance problem when recursively setting ACLs on directories
254 73) prevent ACL set on read-only share
255 74) Ensure we never have more than MAX_PRINT_JOBS in a queue
256 75) Added timeout to tdb_lock_bystring()
257 76) Ensure we set FIRST+LAST flags on a bind request
258 77) Add version strings to the usage message for smbcacls and smbpasswd
259 78) Fix bug in the write cache code
260 79) make the default printed values for boolean the same for all parameters
261 80) Default all LDAP connections to v3 with compiling with --with-ldapsam
262 81) Fix memory leak in smbspool
263 82) Fix bug in mangling code that resulted in Win9x clients not being
264 able to execute batch files in deep, non 8.3 directory paths
265 83) Fix infinite looping bug in winbindd_getgrent()
266 84) Fix crash bug on 64-bit systems (merge from HEAD)
267 85) Fix extended character bug when setting LanMan/NT password
268 86) Negotiate same SMB read size as a Windows 2000 file server
269 to fix performance bug with NT4 clients
272 =========================================
274 Older releases notes for 2.2.x distributions follow
276 -----------------------------------------------------------------------------
277 The release notes for 2.2.5 follow :
279 There have been several fixes and internal enhancements which include:
281 * Several compile fixes for Solaris and HP-UX
282 * More printing fixes for Windows NT/2k/XP clients
283 * New options for the VFS recycle bin library
284 * New internal signal handling semantics relating to directory change
285 notification and oplocks
287 New/Changed parameters in 2.2.5
288 --------------------------------
290 For more information on these parameters, see the man pages for
293 Added/changed parameters
294 ------------------------
296 * block size = <INTEGER>
297 * force unknown acl user = <boolean>
298 * mangling method = [hash|hash2]
301 Deprecated Parameters
302 ---------------------
304 The following parameters have been marked as deprecated and will be removed
320 See the cvs log for SAMBA_2_2 for more details
322 1) Removal of several compiler warnings, incorrect Makefile dependencies,
323 and wrong autoconf tests on various platforms--Solaris & HP-UX 10.20
324 being the predominantly reported platforms
325 2) Fixed winbindd crash bug on the IBM s390 running Linux
326 3) Inclusion of enhanced Linux quota support
327 4) Correctly link against Sun LDAP libraries on Solaris 8 (even through
328 there is no apparent SSL support there)
329 5) POSIX conformance patches
330 6) Include new configure --enable-cups option (can also be disabled even
331 if CUPS libraries are installed on the system)
332 7) Set reasonable default for the "passwd program" parameter using an
334 8) Added --with-winbind-auth for enabling winbindd_pam_auth_crap() code
335 9) fixed bug to prevent root account from being deleted by the
337 10) Inclusion of autoconf script for building VFS modules
338 11) Add new run time options to the VFS recycle bin library (see
339 examples/VFS/recycle/README for details)
340 12) Include findsmb perl script as part of the "make install" process
341 13) Return correct error code for EnumPrinters(PRINTER_ENUM_REMOTE, InfoLevel1)
342 to fix a bug where printers appear at the workgroup level in the Windows
343 NT/2k APW browse list
344 14) Added support to nmblookup to return NMB flags (See nmblookup(8) for
346 15) Fix length bug that caused password changes from Windows NT/2k clients to
348 16) Correct false password expiration when using --with-ldapsam caused by
349 missing attributes in the directory
350 17) added -S option to smbpasswd for storing the SID of a domain controller
351 as the local machine SID in secrets.tdb. See the smbpasswd(8) man page
353 18) Various fixes for UNIX CIFS extensions commands
354 19) Fixed CIDR notation in "hosts allow/deny"
355 20) Change semantics of an idle connection to mean "no open files and no
356 open handles". We cannot idle a connection if there are open named
357 pipe handles. This fixes scalability problem on Samba print servers
358 and NT/2k clients introduced in 2.2.4
359 21) Fix germam umlaut problem when returning ACL entries
360 22) Return NT_STATUS_OBJECT_NAME_NOT_FOUND for ENOENT. This fixes the bug
361 of running the Microsoft Access executable (msaccess.exe) and database
362 files from a Samba share documented in the 2.2.4 release
363 23) Corrected signal handling relating to directory change notification and
365 24) Fix bug in unix_to_nt_time() that appeared on files dated close to Daylight
367 25) Corrected alignment bug in spoolss parsing code which caused Win2k/XP
368 clients not to be able to view printer properties from a Samba host
369 26) Fixed spoolss parsing bug causing printing from ACT! 2000 running on
370 Windows 2k/XP clients to fail
371 27) Fixed incorrect error check in mod_share_entry()
372 28) Allow %S variable in MS-DFS root paths
373 29) Correct a bug regarding the use of 'wbinfo -A'
374 30) Fixed libnss_wins.so to correctly work on RedHat 7.3 systems
375 31) Store the key for a name-to-sid cache entry in upper case rather than
376 whatever case the request was made in. This gets rid of duplicate
378 32) Fix bug causing the pid stored in winbindd's pid file to be the wrong id
379 33) Enhanced error reporting messages of wbinfo
380 34) Parameterize block size on disk size return
381 35) Added new parameter to allow incoming ACLs to have owner and group forced
382 to the currently logged in user. This fixes the XCOPY /O problem
383 36) Fixed bug in local_change_password() caused by reusing a struct
385 37) Change default value for "ldap port" to 389 if "ldap ssl = no"
386 38) Updated HOWTO's, manpages, and general documentation....
387 39) Allow root as well as domain admins to open an LDAP connection
388 40) Fixed veto files bug with ".*"
389 41) Fixed uninitialized variable bug in smbpasswd that was causing a random
390 IP address to be used in the connection when joining a domain
391 42) Fix for joining a domain with a netbios name of 15 characters and
392 pre-creating the account on the DC
393 43) Added links to new documentation on SWAT welcome page
397 -----------------------------------------------------------------------------
398 The release notes for 2.2.4 follow :
400 There have been several fixes and internal enhancements which include:
402 * More/better SPOOLSS printing functionality for Windows
404 * Several fixes relating to serving PC database files such
405 as (Access and FoxPro) from a Samba file share.
406 * Several improves in Samba's VFS layer which can be seen
407 in the inclusion of a "Recycle Bin" vfs module. See
408 examples/VFS/README for more details on this.
409 * Addition of a tool (tdbbackup) for backup/restore of Samba's
411 * Continued improvements to winbind for greater scalability
413 * Several fixes related to Samba's MS-DFS support
414 * Rpcclient's various printer commands now work (again)
417 New/Changed parameters in 2.2.4
418 --------------------------------
420 For more information on these parameters, see the man pages for
423 Added/changed parameters
424 ------------------------
432 * winbind use default domain
435 Deprecated parameters
436 ---------------------
438 The following parameters have been marked as deprecated
439 and will be removed in Samba 3.0
443 * printer driver file
444 * printer driver location
456 See the cvs log for SAMBA_2_2 for more details
458 1) added -c option to smbpasswd
459 2) reworked smbpasswd internal command line option parsing
460 3) small various bug fixes to experimental pdb_tdb.c
461 4) Enforce spoolss RPCs based on the access granted at PrinterOpen()
462 5) Added missing access checks to [add/delete/set]form
463 6) Compile fixes for pam_smbpass
464 7) fix smbd crash when netbios session request fails from
465 spoolss_connect_to_client().
466 8) fixed logic bug that prevent SetPrinter() from storing devmode
467 9) Removed extra get_printer_snum() calls from set_printer_hnd_name()
468 10) fix joining domain on big endian machine when using -U to smbpasswd
469 11) allow command line arg to override smb.conf log level
470 12) continue to retry to register 1b name with wins server if there is an old IP there
471 13) fix smbclient print crash bug
472 14) 9x pnp fix when the config file and driver file are different
473 15) force testparm to print the correct value for log level
474 16) fix swat to show full log level info
475 17) fix server GetPrinterData() fields to be more sensible
476 18) fix logic error in SetPrinterDataEx()
477 19) Only set smb_read_error if not already set
478 20) Fix string returns that require unicode
479 21) Merge of printing performance fixes from appliance
480 22) lpq parsing fixes
481 23) Back port tridge's xcopy /o fix from HEAD
482 24) Fix the printer change notify code (unfinished)
483 25) Patch for Domain users not showing up
484 26) Fixed SetPrinterData(magic key) to support zero length DEVMODE
485 27) Ensure that all methods of looking up and connecting to DC's work
486 using identical logic.
487 28) Merge in the mutex code to stop multiple domain logon failure
489 30) Fix winbindd to respect command line debuglevel as nmbd/smbd
490 31) Update with tdbbackup from HEAD
491 32) Fix for typo on solaris nss
492 33) Merge in the locking changes from HEAD
493 34) Added POSIX ACL layer into the vfs
494 35) Fix the returning of domain enum
495 36) Fix the generation of the MACHINE.SID file into the secrets.tdb.
496 37) Enable test for -rdynamic when building binaries
497 38) Remove the "stat open" code - make it inline
498 39) Fix the mp3 rename bug
499 40) Fix for Explorer DFS problems on older Windows 9X machines
500 41) implement OpenPrinter() opnum == 0x01
501 42) Matched W2K *insane* open semantics....
502 43) small fix that will prevent the "failed to marshall
503 R_NET_SAMLOGON" message in the logs
504 42) don't do checking of local passdb in smbpasswd if using -r option
505 43) fix "smbpasswd -j DOMAIN -r * -U Admin%XXXX" so that it doesn't
506 try to connect to a server named '*'
507 44) merge rpcclient code from HEAD
508 45) Ensure MACHINE.SID update done before child spawns
509 46) Fix the bad path errors for mkdir so mkdir \a\b\c\d works
510 47) Removed --with-vfs - always built if available
511 48) Fixed psec for 2.2
512 49) Fixed the handle leak in the connection management code
513 50) fix disable spoolss after the switch to nt status codes
514 51) Added Shirish's client side caching policy change
515 52) Honor the specversion when parsing the the DEVICEMODE
516 53) fix parsing bug when DEVICEMODE's private data does not end
518 54) do not idle an smbd when there is an open pipe
519 55) when a new driver is added to a Samba server, cycle through
520 all printers and bump the change_id for each one bound to the driver
521 56) allow smbclient to work with a FIFO as well (needed for KDE
523 57) various updates to pdb_nisplus.c
524 58) many small documentation updates
525 59) removed many compiler warnings
528 -----------------------------------------------------------------------------
529 The release notes for 2.2.3a follow :
531 This is a minor bugfix release for the 2.2.3 release. The 2.2.3
532 release had a problem that was visible to Windows 2000 Explorer
533 users in that copying files into a share that already existed
534 failed with "Access Denied" rather than asking the user if an
535 overwrite was required. This was due to an incorrect error mapping
536 between the UNIX EXIST error code and the NT status error.
538 As Windows Explorer is a highly visible end user application a quick
539 bugfix release was required, hence 2.2.3a.
541 Compilation on HPUX versions earlier than HPUX 11 has also been
544 The cvs.log file is no longer included with this release, as it adds
545 13Mb to the size of the release, and is easily available on the Web.
547 -----------------------------------------------------------------------------
548 The release notes for 2.2.3 follow :
550 There are several important scaling bugs that have been fixed in this release
551 for large server systems so an upgrade is recommended.
556 Much work has been done on the LDAP backend code. The configure
557 option --with-ldapsam is now considered to be stable. The schema
558 used has changed, see the file examples/LDAP/samba.schema for the
561 New documentation explaining how to set up a Samba only PDC/BDC
562 setup has been added in the files Samba-LDAP-HOWTO and Samba-BDC-HOWTO
563 in the documentation tree.
565 winbindd daemon extended
566 ------------------------
568 Samba 2.2.2 was the first release to include the winbind daemon.
569 This code allows UNIX systems that implement the name service
570 switch (nss) to be entered into a Windows NT/2000 domain and
571 use the Domain controller for all user and group enumeration.
573 Samba 2.2.3 fixes the known memory leaks in winbindd and has
574 been extended to work with SGI IRIX and HPUX (11.x) in addition
575 to the earlier targets of Linux and Solaris.
577 For more information on using winbind, see the man pages for
580 Note that winbindd is not installed by default.
582 New/Changed parameters in 2.2.3
583 --------------------------------
585 For more information on these parameters, see the man pages for
588 Added/changed parameters.
589 -------------------------
593 Enables the experimental UNIX CIFS extensions in smbd. See the manpage
598 Some printer drivers will crash the Windows NT/2000 spooler service
599 if they are given a default devmode, some require it. This parameter
600 allows the administrator a choice of whether smbd returns such a
601 default devmode for a driver.
605 This parameter has been restored to allow people who wish smbd to ignore
606 client share modes. This is *very dangerous* and should not be set without
607 full knowledge of what this is designed for.
612 1). Fixed shared library compile for Solaris with native compiler.
613 2). UNIX CIFS extensions code added (donated by HP).
614 3). Changed to using NT status codes on the wire if the client can support
616 4). altname command to show 8.3 name added to smbclient.
617 5). const-safe endian macros now used.
618 6). client code now uses UNICODE on the wire.
619 7). Correctly return fault PDU's on bad handle.
620 8). Improved NT error code mapping table.
621 9). Many new point and print RPC calls added.
622 10). Win9x clients can now see full user list.
623 11). field added to identify simultaneous open files (no longer
624 use dev/inode/time as unique value).
625 12). HPUX ACL code added (donated by HP).
626 13). vfs interfaces updated (again !).
627 14). MSDOS Code Page 866 -> 1251 mapping added.
628 15). winbindd now processes quit/hup signals correctly.
629 16). No tdb traversal done on startup/shutdown - ensures scalability.
630 17). Fix bug with paths for homes share.
631 18). Fixed copyfile for OS/2.
632 19). Fix group membership when groups are on more than one line.
633 20). Fixed core dumps in posix ACL mapping code.
634 21). Tidyup of UNICODE functions (put/get).
635 22). Move rpcclient to the new libsmb code.
636 23). Add missing Windows 2000 passthough trans2 calls.
637 24). Return check all tdb calls.
638 25). Make local name lookup work even if wins server is down.
639 26). pam session code added to winbind.
640 27). Added winbindd cache to all lookups.
641 28). Fix allocate bugs that caused file sizes to be incorrect.
642 29). Fixed write cache code - now safe to use.
643 30). Fixed winbindd memory leaks.
644 31). winbindd will now do name lookups (to allow non Open Source
645 systems to do the nsswitch WINS lookup). Fixed by SGI.
646 32). passdb memory leaks fixed.
647 33). LDAP code updates and now properly maintained.
648 34). Finally figured out how changeid is meant to work.
649 35). Downlevel printing now looks as NT does in print monitor window.
650 36). Many fixups in spoolss printing RPC parsing.
651 37). Speed up password enumeration as a PDC.
652 38). Fix printer changed notify messages (work from HP).
653 39). Fix modify timestamp on close code.
654 40). Fix long standing mangled names bug.
655 41). Fix delete on close semantics.
656 42). Stop opening all files with O_NONBLOCK !
657 43). Use O_NOFOLLOW for systems that have it and don't want symlinks.
658 44). Ensure NT supplementary groups get added to user token.
659 45). Try and mitigate effects of DNS timeout (do less lookups).
660 46). Added current user connection context stack.
661 47). Fixes to utmp code.
662 48). smbw code tidyups.
663 49). Added tdb open log code. Several tdb fixes.
665 -----------------------------------------------------------------------------
666 The release notes for 2.2.2 follow :
668 New daemon included - winbindd
669 ------------------------------
671 Samba 2.2.2 is the first release to include the winbind daemon.
672 This code allows UNIX systems that implement the name service
673 switch (nss) to be entered into a Windows NT/2000 domain and
674 use the Domain controller for all user and group enumeration.
676 This allows a Samba server added to a Windows domain to serve
677 file and print services with *NO* local users needed in /etc/passwd
678 and /etc/group - all users and groups are read directly from the
679 Windows domain controller. In addition with pam_winbind which allows
680 a PAM enabled UNIX system to use a Windows domain for authentication
681 service this allows single sign on and account control across
682 UNIX and Windows systems.
684 The current version of winbindd shipped in 2.2.2 does have some
685 memory leaks, which will be addressed for the next Samba release,
686 so it is advisable to monitor the winbind process. This code is
687 being used in production by several vendors, so the leaks are
688 manageable. In addition, this version of winbind does not work
689 correctly against a Samba PDC, due to some missing calls on the
690 PDC side. These problems are being addressed for the next Samba
691 release, but it was thought better to release the code now rather
692 than delay the main Samba code to match the winbind release schedule.
694 For more information on using winbind, see the man pages for
697 Note that winbindd is not installed by default.
699 New/Changed parameters in 2.2.2
700 -------------------------------
702 For more information on these parameters, see the man pages for
705 Added/changed parameters.
706 -------------------------
710 Causes Samba not to create UNIX 'sparse' files, but to follow the
711 Windows behavior of always allocating on-disk space.
715 Set to 'on' by default, only set to 'off' on HPUX 11.x or below or other
716 UNIX systems that don't have coherent mmap/read-write internal caches.
717 You should not need to set this parameter.
721 This parameter has been changed to a per-share option, and is very
722 useful in enabling Windows 2000 SP2 to load/save profiles from a
725 New printing parameters.
726 ------------------------
730 Setting this parameter causes Samba to go back to the old 2.0.x
731 LANMAN printing behavior, for people who wish to disable the
736 Causes Windows NT/2000 clients to need have a local printer driver
737 installed and to treat the printer as local.
742 Samba 2.2.2 contains new code to maintain a Samba SAM database
743 on a remote LDAP server. These parameters have been added as
744 part of this code. These parameters are only available when Samba
745 has been compiled with the --with-ldapsam option.
753 The SSL support in Samba has been fixed. These new parameters
754 are part of the changes added. These parameters are only available
755 when Samba has been compiled with the --with-ssl option.
756 Please see the smb.conf man page for details.
762 New winbindd parameters.
763 ------------------------
765 These parameters are used by winbindd. See the man page for
766 winbindd for details.
787 Some new README's have been added in the docs/ directory. These cover
788 using roving profiles with Windows 2000 SP2 (docs/README.Win2kSP2),
789 and how to use Samba to help prevent Windows virus spread
790 (docs/README.Win32-Viruses).
792 Quota problems on a Linux 2.4 kernel.
793 -------------------------------------
795 Currently the quota interfaces have diverged between the Linus
796 2.4.x kernels and the Alan Cox 2.4.x kernels (the Alan Cox variants
797 are shipped with RedHat). Running quota-enabled Samba compiled on
798 an Alan Cox kernel works correctly on an Alan Cox kernel (the one
799 shipped by default with RedHat 7.x) but fails on a Linus kernel.
801 This is a mess, and hopefully Alan and Linus will sort it out soon.
802 In the meantime we need to ship.....
807 1). mmap tdb code disabled on HPUX. This should prevent the reports of
808 tdb corruption on HUPX.
809 2). Large file support set to off in Solaris 5.5 and below.
810 3). Better CUPS detection.
811 4). New SAM (password database) backends - smbpasswd (traditional),
812 LDAP, NIS+ and Samba TDB.
813 5). Quota fixups on Linux.
814 6). libsmbclient stand-alone code added. Can be built as a shared library
816 7). Tru64 ACL support added.
817 8). winbindd option added.
818 9). Realloc fail tidyup fixes all over the code.
819 10). Large improvement in hash table code efficiency - would be found with
821 11). Error code consistency improved (still needs more work).
822 12). Profile shared memory support added to nmbd.
823 13). New Windows 2000/NT passthrough info levels added.
824 14). readraw/writeraw code rewritten - many bugs fixed.
825 15). UNIX password sync (non pam) code fixed, use correct wildcard matcher.
826 16). Reverse DNS lookup avoided on socket open.
827 17). Bug preventing nmbd re-registering names on WINS server timeout fixed.
828 18). Zero length byte range lock code added. Much closer to Windows semantics.
829 19). Alignment fault fixes for Linux/Alpha.
830 20). Error checking on tdb returns vastly improved.
831 21). Handling of delete on close fixed. No longer possible to leave 'dead'
833 22). Handling of oplock break failure cleanups improved. Should not be
834 able to leave 'dead' entries.
835 23). Fix handling of errors trying to set 64 bit locks on 32 bit NFS mounts.
836 24). Misc. MS-DFS code fixes.
837 25). Ignore logon packets if not a PDC (needed for PDC/BDC failover).
838 26). winbind pam module added.
839 27). Order N^^2 enumeration of printers problem fixed.
840 28). Password backend database code re-ordered to allow different password
841 backends (at compile time currently).
842 29). Improved print driver version detection for Windows 2000.
843 30). Driver DEVMODE initialization fixes.
844 31). Improved SYSV print parse code.
845 32). Fixed enumeration of large numbers of users/groups from Windows clients.
847 33). Fix for buggy NetApp RPC pipe clients.
848 34). Fix for NT sending multiple SetPrinterDataEx calls.
849 35). Fix for logic bug where smbd could delay oplock break request messages
850 from other smbd daemons whilst client kept us busy.
851 36). Fix deadlock problem with connections tdb on enumeration.
852 37). Fixes for setting/getting NT ACLs - improved POSIX mapping both ways.
853 38). Removed unused readbmpx/writebmpx code.
854 39). Attempt to fix Linux 2.4.x quota mess.
855 40). Improved ctemp code for Windows 2000 compatibility.
856 41). Finally understood difference between set EOF and set allocation requests.
857 Added strict allocate parameter to help.
858 42). Correctly return name types on name to SID lookups.
859 43). tdb spinlock code update.
860 44). Use pread/pwrite on systems that have it to fix race condition in tdb code.
862 -----------------------------------------------------------------------------
863 The release notes for 2.2.1a follow :
865 This is a minor bugfix release for 2.2.1, *NOT* security related.
867 1). 2.2.1 had a bug where using smbpasswd -m to add a Windows NT or
868 Windows2000 machine into a Samba hosted PDC would fail due to our
869 stricter user name checking. We were disallowing user names
870 containing '$', which is needed when using smbpasswd to add a
871 machine into a domain. Automatically adding machines (using the
872 native Windows tools) into a Samba domain worked correctly.
874 2.2.1a fixes this single problem.
876 -----------------------------------------------------------------------------
877 The release notes for 2.2.1 follow :
879 New/Changed parameters in 2.2.1
880 -------------------------------
885 obey pam restrictions
887 When Samba is configured to use PAM, turns on or off Samba checking
888 the PAM account restrictions. Defaults to off.
892 When Samba is configured to use PAM, turns on or off Samba passing
893 the password changes to PAM. Defaults to off.
897 New option to allow new Windows 2000 large file (64k) streaming
898 read/write options. Needs a 64 bit underlying operating system
899 (for Linux use kernel 2.4 with glibc 2.2 or above). Can improve performance
900 by 10% with Windows 2000 clients. Defaults to off. Not as tested
901 as some other Samba code paths.
905 Prevents clients from seeing the existence of files that cannot
906 be read. Off by default.
910 Turn on/off the enhanced Samba browsing functionality (*1B names).
911 Default is "on". Can prevent eternal machines in workgroups when
912 WINS servers are not synchronized.
924 1). "find" command removed for smbclient. Internal code now used.
925 2). smbspool updates to retry connections from Michael Sweet.
926 3). Fix for mapping 8859-15 characters to UNICODE.
927 4). Changed "security=server" to try with invalid username to prevent
929 5). Fixes to allow Windows 2000 SP2 clients to join a Samba PDC.
930 6). Support for Windows 9x Nexus tools to allow security changes from Win9x.
931 7). Two locking fixes added. Samba 2.2.1 now passes the Clarion network
932 lock tester tool for distributed databases.
933 8). Preliminary support added for Windows 2000 large file read/write SMBs.
934 9). Changed random number generator in Samba to prevent guess attacks.
935 10). Fixes for tdb corruption in connections.tdb and file locking brlock.tdb.
936 smbd's clean the tdb files on startup and shutdown.
937 11). Fixes for default ACLs on Solaris.
938 12). Tidyup of password entry caching code.
939 13). Correct shutdowns added for send fails. Helps tdb cleanup code.
940 14). Prevent invalid '/' characters in workgroup names.
941 15). Removed more static arrays in SAMR code.
942 16). Client code is now UNICODE on the wire.
943 17). Fix 2 second timestamp resolution everywhere if dos timestamp set to yes.
944 18). All tdb opens now going through logging function.
945 19). Add pam password changing and pam restrictions code.
946 20). Printer driver management improvements (delete driver).
947 21). Fix difference between NULL security descriptors and empty
948 security descriptors.
949 22). Fix SID returns for server roles.
950 23). Allow Windows 2000 mmc to view and set Samba share security descriptors.
951 24). Allow smbcontrol to forcibly disconnect a share.
952 25). tdb fixes for HPUX, OpenBSD and other OS's that don't have a coherent
953 mmap/file read/write cache.
954 26). Fix race condition in returning create disposition for file create/open.
955 27). Fix NT rewriting of security descriptors to their canonical form for
957 28). Fix for Samba running on top of Linux VFAT ftruncate bug.
958 29). Swat fixes for being run with xinetd that doesn't set the umask.
959 30). Fix for slow writes with Win9x Explorer clients. Emulates Microsoft
960 TCP stack early ack specification error.
961 31). Changed lock & persistent tdb directory to /var/cache/samba by default on
962 RedHat and Mandrake as they clear the /var/lock/samba directory on reboot.
964 -----------------------------------------------------------------------------
965 The release notes for 2.2.0a follow :
970 This is a security bugfix release for Samba 2.2.0. This release provides the
971 following two changes *ONLY* from the 2.2.0 release.
973 1). Fix for the security hole discovered by Michal Zalewski (lcamtuf@bos.bindview.com)
974 and described in the security advisory below.
975 2). Fix for the hosts allow/hosts deny parameters not being honoured.
977 No other changes are being made for this release to ensure a security fix only.
978 For new functionality (including these security fixes) download Samba 2.2.1
979 when it is available.
981 The security advisory follows :
984 IMPORTANT: Security bugfix for Samba
985 ------------------------------------
993 A serious security hole has been discovered in all versions of Samba
994 that allows an attacker to gain root access on the target machine for
995 certain types of common Samba configuration.
997 The immediate fix is to edit your smb.conf configuration file and
998 remove all occurances of the macro "%m". Replacing occurances of %m
999 with %I is probably the best solution for most sites.
1004 A remote attacker can use a netbios name containing unix path
1005 characters which will then be substituted into the %m macro wherever
1006 it occurs in smb.conf. This can be used to cause Samba to create a log
1007 file on top of an important system file, which in turn can be used to
1008 compromise security on the server.
1010 The most commonly used configuration option that can be vulnerable to
1011 this attack is the "log file" option. The default value for this
1012 option is VARDIR/log.smbd. If the default is used then Samba is not
1013 vulnerable to this attack.
1015 The security hole occurs when a log file option like the following is
1018 log file = /var/log/samba/%m.log
1020 In that case the attacker can use a locally created symbolic link to
1021 overwrite any file on the system. This requires local access to the
1024 If your Samba configuration has something like the following:
1026 log file = /var/log/samba/%m
1028 Then the attacker could successfully compromise your server remotely
1029 as no symbolic link is required. This type of configuration is very
1032 The most commonly used log file configuration containing %m is the
1033 distributed in the sample configuration file that comes with Samba:
1035 log file = /var/log/samba/log.%m
1037 in that case your machine is not vulnerable to this attack unless you
1038 happen to have a subdirectory in /var/log/samba/ which starts with the
1044 Thanks to Michal Zalewski (lcamtuf@bos.bindview.com) for finding this
1051 While we recommend that vulnerable sites immediately change their
1052 smb.conf configuration file to prevent the attack we will also be
1053 making new releases of Samba within the next 24 hours to properly fix
1054 the problem. Please see http://www.samba.org/ for the new releases.
1056 Please report any attacks to the appropriate authority.
1061 ---------------------------------------------------------------------------
1063 The release notes for 2.2.0 follow :
1065 This is the official Samba 2.2.0 release. This version of Samba provides
1066 the following new features and enhancements.
1068 Integration between Windows oplocks and NFS file opens (IRIX and Linux
1069 2.4 kernel only). This gives complete data and locking integrity between
1070 Windows and UNIX file access to the same data files.
1072 Ability to act as an authentication source for Windows 2000 clients as
1073 well as for NT4.x clients.
1075 Integration with the winbind daemon that provides a single
1076 sign on facility for UNIX servers in Windows 2000/NT4 networks
1077 driven by a Windows 2000/NT4 PDC. winbind is not included in
1078 this release, it currently must be obtained separately. We are
1079 committed to including winbind in a future Samba 2.2.x release.
1081 Support for native Windows 2000/NT4 printing RPCs. This includes
1082 support for automatic printer driver download.
1084 Support for server supported Access Control Lists (ACLs).
1085 This release contains support for the following filesystems:
1089 Linux Kernel with ACL patch from http://acl.bestbits.at
1090 Linux Kernel with XFS ACL support.
1091 Caldera/SCO UnixWare
1093 FreeBSD (with external patch)
1095 Other platforms will be supported as resources are
1096 available to test and implement the necessary modules. If
1097 you are interested in writing the support for a particular
1098 ACL filesystem, please join the samba-technical mailing
1099 list and coordinate your efforts.
1101 On PAM (Pluggable Authentication Module) based systems - better debugging
1102 messages and encrypted password users now have access control verified via
1103 PAM - Note: Authentication still uses the encrypted password database.
1105 Rewritten internal locking semantics for more robustness.
1106 This release supports full 64 bit locking semantics on all
1107 (even 32 bit) platforms. SMB locks are mapped onto POSIX
1108 locks (32 bit or 64 bit) as the underlying system allows.
1110 Conversion of various internal flat data structures to use
1111 database records for increased performance and
1114 Support for acting as a MS-DFS (Distributed File System) server.
1116 Support for manipulating Samba shares using Windows client tools
1117 (server manager). Per share security can be set using these tools
1118 and Samba will obey the access restrictions applied.
1120 Samba profiling support (see below).
1122 Compile time option for enabling a (Virtual file system) VFS layer
1123 to allow non-disk resources to be exported as Windows filesystems
1124 (such as databases etc.).
1126 The documentation in this release has been updated and converted
1127 from Yodl to DocBook 4.1. There are many new parameters since 2.0.7
1128 and some defaults have changed.
1132 Support for collection of profile information. A shared
1133 memory area has been created which contains counters for
1134 the number of calls to and the amount of time spent in
1135 various system calls, smb transactions and nmbd activity. See
1136 the file profile.h for a complete listing of the information
1137 collected. Sample code for a samba pmda (collection agent
1138 for Performance Co-Pilot) has been included in the pcp
1141 To enable the profile data collection code in samba, you must
1142 compile samba with profile data support (run configure with
1143 the --with-profiling-data option). On startup, collection of
1144 data is disabled. To begin collecting data use the smbcontrol
1145 program to turn on profiling (see the smbcontrol man page).
1146 Profile information collection can be enabled for nmbd, all smbd
1147 processes or one or more selected processes. The profiling
1148 data collected is the aggregate for all processes that have
1151 With samba compiled for profile data collection, you may see
1152 a very slight degradation in performance even with profiling
1153 collection turned off. On initial tests with NetBench on an
1154 SGI Origin 200 server, this degradation was not measurable
1155 with profile collection off compared to no profile collection
1156 compiled into samba.
1158 With count profile collection enabled on all clients, the
1159 degradation was less than 2%. With full profile collection
1160 enabled on all clients, the degradation was about 8.5%.
1162 =====================================================================
1164 If you think you have found a bug please email a report to :
1168 As always, all bugs are our responsibility.