| blob | 4ddfe2db83c0e9de012996ee2c698b2934fdc129 |
1 ===============================
2 Release Notes for Samba 4.16.10
3 March 29, 2023
4 ===============================
7 This is a security release in order to address the following defects:
9 o CVE-2023-0922: The Samba AD DC administration tool, when operating against a
10 remote LDAP server, will by default send new or reset
11 passwords over a signed-only connection.
12 https://www.samba.org/samba/security/CVE-2023-0922.html
14 o CVE-2023-0614: The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919
15 Confidential attribute disclosure via LDAP filters was
16 insufficient and an attacker may be able to obtain
17 confidential BitLocker recovery keys from a Samba AD DC.
18 Installations with such secrets in their Samba AD should
19 assume they have been obtained and need replacing.
20 https://www.samba.org/samba/security/CVE-2023-0614.html
23 Changes since 4.16.9
24 --------------------
26 o Andrew Bartlett <abartlet@samba.org>
27 * BUG 15270: VE-2023-0614.
28 * BUG 15331: ldb wildcard matching makes excessive allocations.
29 * BUG 15332: large_ldap test is inefficient.
31 o Rob van der Linde <rob@catalyst.net.nz>
32 * BUG 15315: CVE-2023-0922.
34 o Joseph Sutton <josephsutton@catalyst.net.nz>
35 * BUG 15270: CVE-2023-0614.
38 #######################################
39 Reporting bugs & Development Discussion
40 #######################################
42 Please discuss this release on the samba-technical mailing list or by
43 joining the #samba-technical:matrix.org matrix room, or
44 #samba-technical IRC channel on irc.libera.chat.
46 If you do report problems then please try to send high quality
47 feedback. If you don't provide vital information to help us track down
48 the problem then you will probably be ignored. All bug reports should
49 be filed under the Samba 4.1 and newer product in the project's Bugzilla
50 database (https://bugzilla.samba.org/).
53 ======================================================================
54 == Our Code, Our Bugs, Our Responsibility.
55 == The Samba Team
56 ======================================================================
59 Release notes for older releases follow:
60 ----------------------------------------
61 ==============================
62 Release Notes for Samba 4.16.9
63 February 16, 2023
64 ==============================
67 This is the latest stable release of the Samba 4.16 release series.
70 Changes since 4.16.8
71 --------------------
73 o Jeremy Allison <jra@samba.org>
74 * BUG 14808: smbc_getxattr() return value is incorrect.
75 * BUG 15172: Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled
76 correctly.
77 * BUG 15210: synthetic_pathref AFP_AfpInfo failed errors.
78 * BUG 15226: samba-tool gpo listall fails IPv6 only - finddcs() fails to find
79 DC when there is only an AAAA record for the DC in DNS.
80 * BUG 15236: smbd crashes if an FSCTL request is done on a stream handle.
82 o Ralph Boehme <slow@samba.org>
83 * BUG 15299: Spotlight doesn't work with latest macOS Ventura.
85 o Samuel Cabrero <scabrero@suse.de>
86 * BUG 15240: CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5)
87 based SChannel on NETLOGON.
89 o Volker Lendecke <vl@samba.org>
90 * BUG 15243: %U for include directive doesn't work for share listing
91 (netshareenum).
92 * BUG 15266: Shares missing from netshareenum response in samba 4.17.4.
93 * BUG 15269: ctdb: use-after-free in run_proc.
95 o Stefan Metzmacher <metze@samba.org>
96 * BUG 15243: %U for include directive doesn't work for share listing
97 (netshareenum).
98 * BUG 15266: Shares missing from netshareenum response in samba 4.17.4.
99 * BUG 15280: irpc_destructor may crash during shutdown.
100 * BUG 15286: auth3_generate_session_info_pac leaks wbcAuthUserInfo.
102 o Andreas Schneider <asn@samba.org>
103 * BUG 15268: smbclient segfaults with use after free on an optimized build.
105 o Andrew Walker <awalker@ixsystems.com>
106 * BUG 15164: Leak in wbcCtxPingDc2.
107 * BUG 15265: Access based share enum does not work in Samba 4.16+.
108 * BUG 15267: Crash during share enumeration.
109 * BUG 15271: rep_listxattr on FreeBSD does not properly check for reads off
110 end of returned buffer.
113 #######################################
114 Reporting bugs & Development Discussion
115 #######################################
117 Please discuss this release on the samba-technical mailing list or by
118 joining the #samba-technical:matrix.org matrix room, or
119 #samba-technical IRC channel on irc.libera.chat.
122 If you do report problems then please try to send high quality
123 feedback. If you don't provide vital information to help us track down
124 the problem then you will probably be ignored. All bug reports should
125 be filed under the Samba 4.1 and newer product in the project's Bugzilla
126 database (https://bugzilla.samba.org/).
129 ======================================================================
130 == Our Code, Our Bugs, Our Responsibility.
131 == The Samba Team
132 ======================================================================
135 ----------------------------------------------------------------------
136 ==============================
137 Release Notes for Samba 4.16.8
138 December 15, 2022
139 ==============================
142 This is the latest stable release of the Samba 4.16 release series.
143 It also contains security changes in order to address the following defects
145 o CVE-2022-37966: This is the Samba CVE for the Windows Kerberos
146 RC4-HMAC Elevation of Privilege Vulnerability
147 disclosed by Microsoft on Nov 8 2022.
149 A Samba Active Directory DC will issue weak rc4-hmac
150 session keys for use between modern clients and servers
151 despite all modern Kerberos implementations supporting
152 the aes256-cts-hmac-sha1-96 cipher.
154 On Samba Active Directory DCs and members
155 'kerberos encryption types = legacy' would force
156 rc4-hmac as a client even if the server supports
157 aes128-cts-hmac-sha1-96 and/or aes256-cts-hmac-sha1-96.
159 https://www.samba.org/samba/security/CVE-2022-37966.html
161 o CVE-2022-37967: This is the Samba CVE for the Windows
162 Kerberos Elevation of Privilege Vulnerability
163 disclosed by Microsoft on Nov 8 2022.
165 A service account with the special constrained
166 delegation permission could forge a more powerful
167 ticket than the one it was presented with.
169 https://www.samba.org/samba/security/CVE-2022-37967.html
171 o CVE-2022-38023: The "RC4" protection of the NetLogon Secure channel uses the
172 same algorithms as rc4-hmac cryptography in Kerberos,
173 and so must also be assumed to be weak.
175 https://www.samba.org/samba/security/CVE-2022-38023.html
177 Note that there are several important behavior changes
178 included in this release, which may cause compatibility problems
179 interacting with system still expecting the former behavior.
180 Please read the advisories of CVE-2022-37966,
181 CVE-2022-37967 and CVE-2022-38023 carefully!
183 samba-tool got a new 'domain trust modify' subcommand
184 -----------------------------------------------------
186 This allows "msDS-SupportedEncryptionTypes" to be changed
187 on trustedDomain objects. Even against remote DCs (including Windows)
188 using the --local-dc-ipaddress= (and other --local-dc-* options).
189 See 'samba-tool domain trust modify --help' for further details.
191 smb.conf changes
192 ----------------
194 Parameter Name Description Default
195 -------------- ----------- -------
196 allow nt4 crypto Deprecated no
197 allow nt4 crypto:COMPUTERACCOUNT New
198 kdc default domain supported enctypes New (see manpage)
199 kdc supported enctypes New (see manpage)
200 kdc force enable rc4 weak session keys New No
201 reject md5 clients New Default, Deprecated Yes
202 reject md5 servers New Default, Deprecated Yes
203 server schannel Deprecated Yes
204 server schannel require seal New, Deprecated Yes
205 server schannel require seal:COMPUTERACCOUNT New
206 winbind sealed pipes Deprecated Yes
208 Changes since 4.16.7
209 --------------------
211 o Jeremy Allison <jra@samba.org>
212 * BUG 15224: pam_winbind uses time_t and pointers assuming they are of the
213 same size.
215 o Andrew Bartlett <abartlet@samba.org>
216 * BUG 14929: CVE-2022-44640 [SECURITY] Upstream Heimdal free of
217 user-controlled pointer in FAST.
218 * BUG 15219: Heimdal session key selection in AS-REQ examines wrong entry.
219 * BUG 15237: CVE-2022-37966.
220 * BUG 15258: filter-subunit is inefficient with large numbers of knownfails.
222 o Ralph Boehme <slow@samba.org>
223 * BUG 15240: CVE-2022-38023.
224 * BUG 15252: smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories.
226 o Stefan Metzmacher <metze@samba.org>
227 * BUG 13135: The KDC logic arround msDs-supportedEncryptionTypes differs from
228 Windows.
229 * BUG 14611: CVE-2021-20251 [SECURITY] Bad password count not incremented
230 atomically.
231 * BUG 15203: CVE-2022-42898 [SECURITY] krb5_pac_parse() buffer parsing
232 vulnerability.
233 * BUG 15219: Heimdal session key selection in AS-REQ examines wrong entry.
234 * BUG 15230: Memory leak in snprintf replacement functions.
235 * BUG 15237: CVE-2022-37966.
236 * BUG 15240: CVE-2022-38023.
237 * BUG 15253: RODC doesn't reset badPwdCount reliable via an RWDC
238 (CVE-2021-20251 regression).
240 o Noel Power <noel.power@suse.com>
241 * BUG 15224: pam_winbind uses time_t and pointers assuming they are of the
242 same size.
244 o Andreas Schneider <asn@samba.org>
245 * BUG 15237: CVE-2022-37966.
246 * BUG 15243: %U for include directive doesn't work for share listing
247 (netshareenum).
248 * BUG 15257: Stack smashing in net offlinejoin requestodj.
250 o Joseph Sutton <josephsutton@catalyst.net.nz>
251 * BUG 15197: Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue.
252 * BUG 15219: Heimdal session key selection in AS-REQ examines wrong entry.
253 * BUG 15231: CVE-2022-37967.
254 * BUG 15237: CVE-2022-37966.
256 o Nicolas Williams <nico@twosigma.com>
257 * BUG 14929: CVE-2022-44640 [SECURITY] Upstream Heimdal free of
258 user-controlled pointer in FAST.
261 #######################################
262 Reporting bugs & Development Discussion
263 #######################################
265 Please discuss this release on the samba-technical mailing list or by
266 joining the #samba-technical:matrix.org matrix room, or
267 #samba-technical IRC channel on irc.libera.chat.
270 If you do report problems then please try to send high quality
271 feedback. If you don't provide vital information to help us track down
272 the problem then you will probably be ignored. All bug reports should
273 be filed under the Samba 4.1 and newer product in the project's Bugzilla
274 database (https://bugzilla.samba.org/).
277 ======================================================================
278 == Our Code, Our Bugs, Our Responsibility.
279 == The Samba Team
280 ======================================================================
283 ----------------------------------------------------------------------
284 ==============================
285 Release Notes for Samba 4.16.7
286 November 15, 2022
287 ==============================
290 This is a security release in order to address the following defects:
292 o CVE-2022-42898: Samba's Kerberos libraries and AD DC failed to guard against
293 integer overflows when parsing a PAC on a 32-bit system, which
294 allowed an attacker with a forged PAC to corrupt the heap.
295 https://www.samba.org/samba/security/CVE-2022-42898.html
297 Changes since 4.16.6
298 --------------------
300 o Joseph Sutton <josephsutton@catalyst.net.nz>
301 * BUG 15203: CVE-2022-42898
303 o Nicolas Williams <nico@twosigma.com>
304 * BUG 15203: CVE-2022-42898
307 #######################################
308 Reporting bugs & Development Discussion
309 #######################################
311 Please discuss this release on the samba-technical mailing list or by
312 joining the #samba-technical:matrix.org matrix room, or
313 #samba-technical IRC channel on irc.libera.chat.
316 If you do report problems then please try to send high quality
317 feedback. If you don't provide vital information to help us track down
318 the problem then you will probably be ignored. All bug reports should
319 be filed under the Samba 4.1 and newer product in the project's Bugzilla
320 database (https://bugzilla.samba.org/).
323 ======================================================================
324 == Our Code, Our Bugs, Our Responsibility.
325 == The Samba Team
326 ======================================================================
329 ----------------------------------------------------------------------
330 ==============================
331 Release Notes for Samba 4.16.6
332 October 25, 2022
333 ==============================
336 This is a security release in order to address the following defect:
338 o CVE-2022-3437: There is a limited write heap buffer overflow in the GSSAPI
339 unwrap_des() and unwrap_des3() routines of Heimdal (included
340 in Samba).
341 https://www.samba.org/samba/security/CVE-2022-3437.html
343 Changes since 4.16.5
344 ---------------------
346 o Joseph Sutton <josephsutton@catalyst.net.nz>
347 * BUG 15134: CVE-2022-3437.
350 #######################################
351 Reporting bugs & Development Discussion
352 #######################################
354 Please discuss this release on the samba-technical mailing list or by
355 joining the #samba-technical:matrix.org matrix room, or
356 #samba-technical IRC channel on irc.libera.chat.
358 If you do report problems then please try to send high quality
359 feedback. If you don't provide vital information to help us track down
360 the problem then you will probably be ignored. All bug reports should
361 be filed under the Samba 4.1 and newer product in the project's Bugzilla
362 database (https://bugzilla.samba.org/).
365 ======================================================================
366 == Our Code, Our Bugs, Our Responsibility.
367 == The Samba Team
368 ======================================================================
371 ----------------------------------------------------------------------
372 ==============================
373 Release Notes for Samba 4.16.5
374 September 07, 2022
375 ==============================
378 This is the latest stable release of the Samba 4.16 release series.
381 Changes since 4.16.4
382 --------------------
384 o Jeremy Allison <jra@samba.org>
385 * BUG 15128: Possible use after free of connection_struct when iterating
386 smbd_server_connection->connections.
388 o Ralph Boehme <slow@samba.org>
389 * BUG 15086: Spotlight RPC service returns wrong response when Spotlight is
390 disabled on a share.
391 * BUG 15126: acl_xattr VFS module may unintentionally use filesystem
392 permissions instead of ACL from xattr.
393 * BUG 15153: Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1.
394 * BUG 15161: assert failed: !is_named_stream(smb_fname)") at
395 ../../lib/util/fault.c:197.
397 o Stefan Metzmacher <metze@samba.org>
398 * BUG 15148: Missing READ_LEASE break could cause data corruption.
400 o Andreas Schneider <asn@samba.org>
401 * BUG 15124: rpcclient can crash using setuserinfo(2).
402 * BUG 15132: Samba fails to build with glibc 2.36 caused by including
403 <sys/mount.h> in libreplace.
405 o Joseph Sutton <josephsutton@catalyst.net.nz>
406 * BUG 15152: SMB1 negotiation can fail to handle connection errors.
408 o Michael Tokarev <mjt@tls.msk.ru>
409 * BUG 15078: samba-tool domain join segfault when joining a samba ad domain.
412 #######################################
413 Reporting bugs & Development Discussion
414 #######################################
416 Please discuss this release on the samba-technical mailing list or by
417 joining the #samba-technical:matrix.org matrix room, or
418 #samba-technical IRC channel on irc.libera.chat.
421 If you do report problems then please try to send high quality
422 feedback. If you don't provide vital information to help us track down
423 the problem then you will probably be ignored. All bug reports should
424 be filed under the Samba 4.1 and newer product in the project's Bugzilla
425 database (https://bugzilla.samba.org/).
428 ======================================================================
429 == Our Code, Our Bugs, Our Responsibility.
430 == The Samba Team
431 ======================================================================
434 ----------------------------------------------------------------------
435 ==============================
436 Release Notes for Samba 4.16.4
437 July 27, 2022
438 ==============================
441 This is a security release in order to address the following defects:
443 o CVE-2022-2031: Samba AD users can bypass certain restrictions associated with
444 changing passwords.
445 https://www.samba.org/samba/security/CVE-2022-2031.html
447 o CVE-2022-32744: Samba AD users can forge password change requests for any user.
448 https://www.samba.org/samba/security/CVE-2022-32744.html
450 o CVE-2022-32745: Samba AD users can crash the server process with an LDAP add
451 or modify request.
452 https://www.samba.org/samba/security/CVE-2022-32745.html
454 o CVE-2022-32746: Samba AD users can induce a use-after-free in the server
455 process with an LDAP add or modify request.
456 https://www.samba.org/samba/security/CVE-2022-32746.html
458 o CVE-2022-32742: Server memory information leak via SMB1.
459 https://www.samba.org/samba/security/CVE-2022-32742.html
461 Changes since 4.16.3
462 --------------------
464 o Jeremy Allison <jra@samba.org>
465 * BUG 15085: CVE-2022-32742.
467 o Andrew Bartlett <abartlet@samba.org>
468 * BUG 15009: CVE-2022-32746.
470 o Andreas Schneider <asn@samba.org>
471 * BUG 15047: CVE-2022-2031.
473 o Joseph Sutton <josephsutton@catalyst.net.nz>
474 * BUG 15008: CVE-2022-32745.
475 * BUG 15009: CVE-2022-32746.
476 * BUG 15047: CVE-2022-2031.
477 * BUG 15074: CVE-2022-32744.
480 #######################################
481 Reporting bugs & Development Discussion
482 #######################################
484 Please discuss this release on the samba-technical mailing list or by
485 joining the #samba-technical:matrix.org matrix room, or
486 #samba-technical IRC channel on irc.libera.chat.
488 If you do report problems then please try to send high quality
489 feedback. If you don't provide vital information to help us track down
490 the problem then you will probably be ignored. All bug reports should
491 be filed under the Samba 4.1 and newer product in the project's Bugzilla
492 database (https://bugzilla.samba.org/).
495 ======================================================================
496 == Our Code, Our Bugs, Our Responsibility.
497 == The Samba Team
498 ======================================================================
501 ----------------------------------------------------------------------
502 ==============================
503 Release Notes for Samba 4.16.3
504 July 18, 2022
505 ==============================
508 This is the latest stable release of the Samba 4.16 release series.
511 Changes since 4.16.2
512 --------------------
514 o Jeremy Allison <jra@samba.org>
515 * BUG 15099: Using vfs_streams_xattr and deleting a file causes a panic.
517 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
518 * BUG 14986: Add support for bind 9.18.
519 * BUG 15076: logging dsdb audit to specific files does not work.
521 o Samuel Cabrero <scabrero@samba.org>
522 * BUG 14979: Problem when winbind renews Kerberos.
523 * BUG 15095: Samba with new lorikeet-heimdal fails to build on gcc 12.1 in
524 developer mode.
526 o Volker Lendecke <vl@samba.org>
527 * BUG 15105: Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL.
528 * BUG 15118: Crash in rpcd_classic - NULL pointer deference in
529 mangle_is_mangled().
531 o Noel Power <noel.power@suse.com>
532 * BUG 15100: smbclient commands del & deltree fail with
533 NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS.
535 o Christof Schmitt <cs@samba.org>
536 * BUG 15120: Fix check for chown when processing NFSv4 ACL.
538 o Andreas Schneider <asn@samba.org>
539 * BUG 15082: The pcap background queue process should not be stopped.
540 * BUG 15097: testparm: Fix typo in idmap rangesize check.
541 * BUG 15106: net ads info returns LDAP server and LDAP server name as null.
542 * BUG 15108: ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link.
544 o Martin Schwenke <martin@meltin.net>
545 * BUG 15090: CTDB child process logging does not work as expected.
548 #######################################
549 Reporting bugs & Development Discussion
550 #######################################
552 Please discuss this release on the samba-technical mailing list or by
553 joining the #samba-technical:matrix.org matrix room, or
554 #samba-technical IRC channel on irc.libera.chat.
556 If you do report problems then please try to send high quality
557 feedback. If you don't provide vital information to help us track down
558 the problem then you will probably be ignored. All bug reports should
559 be filed under the Samba 4.1 and newer product in the project's Bugzilla
560 database (https://bugzilla.samba.org/).
563 ======================================================================
564 == Our Code, Our Bugs, Our Responsibility.
565 == The Samba Team
566 ======================================================================
569 ----------------------------------------------------------------------
570 ==============================
571 Release Notes for Samba 4.16.2
572 June 13, 2022
573 ==============================
576 This is the latest stable release of the Samba 4.16 release series.
579 Changes since 4.16.1
580 --------------------
582 o Jeremy Allison <jra@samba.org>
583 * BUG 15042: Use pathref fd instead of io fd in vfs_default_durable_cookie.
585 o Ralph Boehme <slow@samba.org>
586 * BUG 15069: vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
587 file had been deleted.
589 o Samuel Cabrero <scabrero@samba.org>
590 * BUG 15087: netgroups support removed.
592 o Samuel Cabrero <scabrero@suse.de>
593 * BUG 14674: net ads info shows LDAP Server: 0.0.0.0 depending on contacted
594 server.
596 o Volker Lendecke <vl@samba.org>
597 * BUG 15062: Update from 4.15 to 4.16 breaks discovery of [homes] on
598 standalone server from Win and IOS.
600 o Stefan Metzmacher <metze@samba.org>
601 * BUG 15071: waf produces incorrect names for python extensions with Python
602 3.11.
604 o Noel Power <noel.power@suse.com>
605 * BUG 15075: smbclient -E doesn't work as advertised.
607 o Andreas Schneider <asn@samba.org>
608 * BUG 15071: waf produces incorrect names for python extensions with Python
609 3.11.
610 * BUG 15081: The samba background daemon doesn't refresh the printcap cache
611 on startup.
613 o Robert Sprowson <webpages@sprow.co.uk>
614 * BUG 14443: Out-by-4 error in smbd read reply max_send clamp..
617 #######################################
618 Reporting bugs & Development Discussion
619 #######################################
621 Please discuss this release on the samba-technical mailing list or by
622 joining the #samba-technical:matrix.org matrix room, or
623 #samba-technical IRC channel on irc.libera.chat.
625 If you do report problems then please try to send high quality
626 feedback. If you don't provide vital information to help us track down
627 the problem then you will probably be ignored. All bug reports should
628 be filed under the Samba 4.1 and newer product in the project's Bugzilla
629 database (https://bugzilla.samba.org/).
632 ======================================================================
633 == Our Code, Our Bugs, Our Responsibility.
634 == The Samba Team
635 ======================================================================
638 ----------------------------------------------------------------------
639 ==============================
640 Release Notes for Samba 4.16.1
641 May 02, 2022
642 ==============================
645 This is the latest stable release of the Samba 4.16 release series.
648 Changes since 4.16.0
649 --------------------
651 o Jeremy Allison <jra@samba.org>
652 * BUG 14831: Share and server swapped in smbget password prompt.
653 * BUG 15022: Durable handles won't reconnect if the leased file is written
654 to.
655 * BUG 15023: rmdir silently fails if directory contains unreadable files and
656 hide unreadable is yes.
657 * BUG 15038: SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on
658 renamed file handle.
660 o Andrew Bartlett <abartlet@samba.org>
661 * BUG 8731: Need to describe --builtin-libraries= better (compare with
662 --bundled-libraries).
664 o Ralph Boehme <slow@samba.org>
665 * BUG 14957: vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback.
666 * BUG 15035: shadow_copy2 fails listing snapshotted dirs with
667 shadow:fixinodes.
669 o Samuel Cabrero <scabrero@samba.org>
670 * BUG 15046: PAM Kerberos authentication incorrectly fails with a clock skew
671 error.
673 o Pavel Filipenský <pfilipen@redhat.com>
674 * BUG 15041: Username map - samba erroneously applies unix group memberships
675 to user account entries.
677 o Stefan Metzmacher <metze@samba.org>
678 * BUG 14951: KVNO off by 100000.
680 o Christof Schmitt <cs@samba.org>
681 * BUG 15027: Uninitialized litemask in variable in vfs_gpfs module.
682 * BUG 15055: vfs_gpfs recalls=no option prevents listing files.
684 o Andreas Schneider <asn@cryptomilk.org>
685 * BUG 15054: smbd doesn't handle UPNs for looking up names.
688 #######################################
689 Reporting bugs & Development Discussion
690 #######################################
692 Please discuss this release on the samba-technical mailing list or by
693 joining the #samba-technical:matrix.org matrix room, or
694 #samba-technical IRC channel on irc.libera.chat.
696 If you do report problems then please try to send high quality
697 feedback. If you don't provide vital information to help us track down
698 the problem then you will probably be ignored. All bug reports should
699 be filed under the Samba 4.1 and newer product in the project's Bugzilla
700 database (https://bugzilla.samba.org/).
703 ======================================================================
704 == Our Code, Our Bugs, Our Responsibility.
705 == The Samba Team
706 ======================================================================
709 ----------------------------------------------------------------------
710 ==============================
711 Release Notes for Samba 4.16.0
712 March 21, 2022
713 ==============================
715 This is the first stable release of the Samba 4.16 release series.
716 Please read the release notes carefully before upgrading.
719 NEW FEATURES/CHANGES
720 ====================
722 New samba-dcerpcd binary to provide DCERPC in the member server setup
723 ---------------------------------------------------------------------
725 In order to make it much easier to break out the DCERPC services
726 from smbd, a new samba-dcerpcd binary has been created.
728 samba-dcerpcd can be used in two ways. In the normal case without
729 startup script modification it is invoked on demand from smbd or
730 winbind --np-helper to serve DCERPC over named pipes. Note that
731 in order to run in this mode the smb.conf [global] section has
732 a new parameter "rpc start on demand helpers = [true|false]".
733 This parameter is set to "true" by default, meaning no changes to
734 smb.conf files are needed to run samba-dcerpcd on demand as a named
735 pipe helper.
737 It can also be used in a standalone mode where it is started
738 separately from smbd or winbind but this requires changes to system
739 startup scripts, and in addition a change to smb.conf, setting the new
740 [global] parameter "rpc start on demand helpers = false". If "rpc
741 start on demand helpers" is not set to false, samba-dcerpcd will
742 refuse to start in standalone mode.
744 Note that when Samba is run in the Active Directory Domain Controller
745 mode the samba binary that provides the AD code will still provide its
746 normal DCERPC services whilst allowing samba-dcerpcd to provide
747 services like SRVSVC in the same way that smbd used to in this
748 configuration.
750 The parameters that allowed some smbd-hosted services to be started
751 externally are now gone (detailed below) as this is now the default
752 setting.
754 samba-dcerpcd can also be useful for use outside of the Samba
755 framework, for example, use with the Linux kernel SMB2 server ksmbd or
756 possibly other SMB2 server implementations.
758 Heimdal-8.0pre used for Samba Internal Kerberos, adds FAST support
759 ------------------------------------------------------------------
761 Samba has since Samba 4.0 included a snapshot of the Heimdal Kerberos
762 implementation. This snapshot has now been updated and will closely
763 match what will be released as Heimdal 8.0 shortly.
765 This is a major update, previously we used a snapshot of Heimdal from
766 2011, and brings important new Kerberos security features such as
767 Kerberos request armoring, known as FAST. This tunnels ticket
768 requests and replies that might be encrypted with a weak password
769 inside a wrapper built with a stronger password, say from a machine
770 account.
772 In Heimdal and MIT modes Samba's KDC now supports FAST, for the
773 support of non-Windows clients.
775 Windows clients will not use this feature however, as they do not
776 attempt to do so against a server not advertising domain Functional
777 Level 2012. Samba users are of course free to modify how Samba
778 advertises itself, but use with Windows clients is not supported "out
779 of the box".
781 Finally, Samba also uses a per-KDC, not per-realm 'cookie' to secure part of
782 the FAST protocol. A future version will align this more closely with
783 Microsoft AD behaviour.
785 If FAST needs to be disabled on your Samba KDC, set
787 kdc enable fast = no
789 in the smb.conf.
791 The Samba project wishes to thank the numerous developers who have put
792 in a massive effort to make this possible over many years. In
793 particular we thank Stefan Metzmacher, Joseph Sutton, Gary Lockyer,
794 Isaac Boukris and Andrew Bartlett. Samba's developers in turn thank
795 their employers and in turn their customers who have supported this
796 effort over many years.
798 Certificate Auto Enrollment
799 ---------------------------
801 Certificate Auto Enrollment allows devices to enroll for certificates from
802 Active Directory Certificate Services. It is enabled by Group Policy.
803 To enable Certificate Auto Enrollment, Samba's group policy will need to be
804 enabled by setting the smb.conf option `apply group policies` to Yes. Samba
805 Certificate Auto Enrollment depends on certmonger, the cepces certmonger
806 plugin, and sscep. Samba uses sscep to download the CA root chain, then uses
807 certmonger paired with cepces to monitor the host certificate templates.
808 Certificates are installed in /var/lib/samba/certs and private keys are
809 installed in /var/lib/samba/private/certs.
811 Ability to add ports to dns forwarder addresses in internal DNS backend
812 -----------------------------------------------------------------------
814 The internal DNS server of Samba forwards queries non-AD zones to one or more
815 configured forwarders. Up until now it has been assumed that these forwarders
816 listen on port 53. Starting with this version it is possible to configure the
817 port using host:port notation. See smb.conf for more details. Existing setups
818 are not affected, as the default port is 53.
820 CTDB changes
821 ------------
823 * The "recovery master" role has been renamed "leader"
825 Documentation and logs now refer to "leader".
827 The following ctdb tool command names have changed:
829 recmaster -> leader
830 setrecmasterrole -> setleaderrole
832 Command output has changed for the following commands:
834 status
835 getcapabilities
837 The "[legacy] -> recmaster capability" configuration option has been
838 renamed and moved to the cluster section, so this is now:
840 [cluster] -> leader capability
842 * The "recovery lock" has been renamed "cluster lock"
844 Documentation and logs now refer to "cluster lock".
846 The "[cluster] -> recovery lock" configuration option has been
847 deprecated and will be removed in a future version. Please use
848 "[cluster] -> cluster lock" instead.
850 If the cluster lock is enabled then traditional elections are not
851 done and leader elections use a race for the cluster lock. This
852 avoids various conditions where a node is elected leader but can not
853 take the cluster lock. Such conditions included:
855 - At startup, a node elects itself leader of its own cluster before
856 connecting to other nodes
858 - Cluster filesystem failover is slow
860 The abbreviation "reclock" is still used in many places, because a
861 better abbreviation eludes us (i.e. "clock" is obvious bad) and
862 changing all instances would require a lot of churn. If the
863 abbreviation "reclock" for "cluster lock" is confusing, please
864 consider mentally prefixing it with "really excellent".
866 * CTDB now uses leader broadcasts and an associated timeout to
867 determine if an election is required
869 The leader broadcast timeout can be configured via new configuration
870 option
872 [cluster] -> leader timeout
874 This specifies the number of seconds without leader broadcasts
875 before a node calls an election. The default is 5.
878 REMOVED FEATURES
879 ================
881 Older SMB1 protocol SMBCopy command removed
882 -------------------------------------------
884 SMB is a nearly 30-year old protocol, and some protocol commands that
885 while supported in all versions, have not seen widespread use.
887 One of those is SMBCopy, a feature for a server-side copy of a file.
888 This feature has been so unmaintained that Samba has no testsuite for
889 it.
891 The SMB1 command SMB_COM_COPY (SMB1 command number 0x29) was
892 introduced in the LAN Manager 1.0 dialect and it was rendered obsolete
893 in the NT LAN Manager dialect.
895 Therefore it has been removed from the Samba smbd server.
897 We do note that a fully supported and tested server-side copy is
898 present in SMB2, and can be accessed with "scopy" subcommand in
899 smbclient)
901 SMB1 server-side wildcard expansion removed
902 -------------------------------------------
904 Server-side wildcard expansion is another feature that sounds useful,
905 but is also rarely used and has become problematic - imposing extra
906 work on the server (both in terms of code and CPU time).
908 In actual OS design, wildcard expansion is handled in the local shell,
909 not at the remote server using SMB wildcard syntax (which is not shell
910 syntax).
912 In Samba 4.16 the ability to process file name wildcards in requests
913 using the SMB1 commands SMB_COM_RENAME (SMB1 command number 0x7),
914 SMB_COM_NT_RENAME (SMB1 command number 0xA5) and SMB_COM_DELETE (SMB1
915 command number 0x6) has been removed.
917 SMB1 protocol has been deprecated, particularly older dialects
918 --------------------------------------------------------------
920 We take this opportunity to remind that we have deprecated and
921 disabled by default, but not removed, the whole SMB1 protocol since
922 Samba 4.11. If needed for security purposes or code maintenance we
923 will continue to remove older protocol commands and dialects that are
924 unused or have been replaced in more modern SMB1 versions.
926 We specifically deprecate the older dialects older than "NT LM 0.12"
927 (also known as "NT LANMAN 1.0" and "NT1").
929 Please note that "NT LM 0.12" is the dialect used by software as old
930 as Windows 95, Windows NT and Samba 2.0, so this deprecation applies
931 to DOS and similar era clients.
933 We do reassure that that 'simple' operation of older clients than
934 these (eg DOS) will, while untested, continue for the near future, our
935 purpose is not to cripple use of Samba in unique situations, but to
936 reduce the maintaince burden.
938 Eventually SMB1 as a whole will be removed, but no broader change is
939 announced for 4.16.
941 In the rare case where the above changes cause incompatibilities,
942 users requiring support for these features will need to use older
943 versions of Samba.
945 No longer using Linux mandatory locks for sharemodes
946 ====================================================
948 smbd mapped sharemodes to Linux mandatory locks. This code in the Linux kernel
949 was broken for a long time, and is planned to be removed with Linux 5.15. This
950 Samba release removes the usage of mandatory locks for sharemodes and the
951 "kernel share modes" config parameter is changed to default to "no". The Samba
952 VFS interface is kept, so that file-system specific VFS modules can still use
953 private calls for enforcing sharemodes.
956 smb.conf changes
957 ================
959 Parameter Name Description Default
960 -------------- ----------- -------
961 kernel share modes New default No
962 dns forwarder Changed
963 rpc_daemon Removed
964 rpc_server Removed
965 rpc start on demand helpers Added true
968 CHANGES SINCE 4.16.0rc5
969 =======================
971 o Andrew Bartlett <abartlet@samba.org>
972 * BUG 15000: Memory leak in FAST cookie handling.
974 o Elia Geretto <elia.f.geretto@gmail.com>
975 * BUG 14983: NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
976 in SMBC_server_internal.
978 o Stefan Metzmacher <metze@samba.org>
979 * BUG 13879: Simple bind doesn't work against an RODC (with non-preloaded
980 users).
981 * BUG 14641: Crash of winbind on RODC.
982 * BUG 15001: LDAP simple binds should honour "old password allowed period".
983 * BUG 15002: S4U2Self requests don't work against servers without FAST
984 support.
985 * BUG 15003: wbinfo -a doesn't work reliable with upn names.
986 * BUG 15005: A cross-realm kerberos client exchanges fail using KDCs with and
987 without FAST.
988 * BUG 15015: PKINIT: hdb_samba4_audit: Unhandled hdb_auth_status=9 =>
989 INTERNAL_ERROR.
991 o Garming Sam <garming@catalyst.net.nz>
992 * BUG 13879: Simple bind doesn't work against an RODC (with non-preloaded
993 users).
995 o Andreas Schneider <asn@samba.org>
996 * BUG 15016: Regression: create krb5 conf = yes doesn't work with a single
997 KDC.
999 o Joseph Sutton <josephsutton@catalyst.net.nz>
1000 * BUG 15015: PKINIT: hdb_samba4_audit: Unhandled hdb_auth_status=9 =>
1001 INTERNAL_ERROR.
1004 CHANGES SINCE 4.16.0rc4
1005 =======================
1007 o Jeremy Allison <jra@samba.org>
1008 * BUG 14737: Samba does not response STATUS_INVALID_PARAMETER when opening 2
1009 objects with same lease key.
1011 o Jule Anger <janger@samba.org>
1012 * BUG 14999: Listing shares with smbstatus no longer works.
1014 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
1015 * BUG 14996: Fix ldap simple bind with TLS auditing.
1017 o Andrew Bartlett <abartlet@samba.org>
1018 * BUG 14995: Use Heimdal 8.0 (pre) rather than an earlier snapshot.
1020 o Volker Lendecke <vl@samba.org>
1021 * BUG 14989: Fix a use-after-free in SMB1 server.
1023 o Stefan Metzmacher <metze@samba.org>
1024 * BUG 14865: Uncached logon on RODC always fails once.
1025 * BUG 14984: Changing the machine password against an RODC likely destroys
1026 the domain join.
1027 * BUG 14993: authsam_make_user_info_dc() steals memory from its struct
1028 ldb_message *msg argument.
1029 * BUG 14995: Use Heimdal 8.0 (pre) rather than an earlier snapshot.
1031 o Joseph Sutton <josephsutton@catalyst.net.nz>
1032 * BUG 14995: Use Heimdal 8.0 (pre) rather than an earlier snapshot.
1035 CHANGES SINCE 4.16.0rc3
1036 =======================
1038 o Samuel Cabrero <scabrero@suse.de>
1039 * BUG 14979: Problem when winbind renews Kerberos.
1041 o Björn Jacke <bj@sernet.de>
1042 * BUG 13631: DFS fix for AIX broken.
1043 * BUG 14974: Solaris and AIX acl modules: wrong function arguments.
1044 * BUG 7239: Function aixacl_sys_acl_get_file not declared / coredump.
1046 o Andreas Schneider <asn@samba.org>
1047 * BUG 14967: Samba autorid fails to map AD users if id rangesize fits in the
1048 id range only once.
1050 o Martin Schwenke <martin@meltin.net>
1051 * BUG 14958: CTDB can get stuck in election and recovery.
1054 CHANGES SINCE 4.16.0rc2
1055 =======================
1057 o Jeremy Allison <jra@samba.org>
1058 * BUG 14169: Renaming file on DFS root fails with
1059 NT_STATUS_OBJECT_PATH_NOT_FOUND.
1060 * BUG 14938: NT error code is not set when overwriting a file during rename
1061 in libsmbclient.
1063 o Ralph Boehme <slow@samba.org>
1064 * BUG 14674: net ads info shows LDAP Server: 0.0.0.0 depending on contacted
1065 server.
1067 o Pavel Filipenský <pfilipen@redhat.com>
1068 * BUG 14971: virusfilter_vfs_openat: Not scanned: Directory or special file.
1070 o Volker Lendecke <vl@samba.org>
1071 * BUG 14900: Regression: Samba 4.15.2 on macOS segfaults intermittently
1072 during strcpy in tdbsam_getsampwnam.
1073 * BUG 14975: Fix a crash in vfs_full_audit - CREATE_FILE can free a used fsp.
1075 o Stefan Metzmacher <metze@samba.org>
1076 * BUG 14968: smb2_signing_decrypt_pdu() may not decrypt with
1077 gnutls_aead_cipher_decrypt() from gnutls before 3.5.2.
1079 o Andreas Schneider <asn@samba.org>
1080 * BUG 14960: SDB uses HDB flags directly which can lead to unwanted side
1081 effects.
1084 CHANGES SINCE 4.16.0rc1
1085 =======================
1087 o Jeremy Allison <jra@samba.org>
1088 * BUG 14911: CVE-2021-44141: UNIX extensions in SMB1 disclose whether the
1089 outside target of a symlink exists.
1091 o Ralph Boehme <slow@samba.org>
1092 * BUG 14914: CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
1093 module.
1094 * BUG 14961: install elasticsearch_mappings.json
1096 o FeRD (Frank Dana) <ferdnyc@gmail.com>
1097 * BUG 14947: samba-bgqd still notifying systemd, triggering log warnings
1098 without NotifyAccess=all.
1100 o Stefan Metzmacher <metze@samba.org>
1101 * BUG 14867: Printing no longer works on Windows 7 with 2021-10 monthly
1102 rollup patch.
1103 * BUG 14956: ndr_push_string() adds implicit termination for
1104 STR_NOTERM|REMAINING empty strings.
1106 o Joseph Sutton <josephsutton@catalyst.net.nz>
1107 * BUG 14950: CVE-2022-0336: Re-adding an SPN skips subsequent SPN conflict
1108 checks.
1111 KNOWN ISSUES
1112 ============
1114 https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.16#Release_blocking_bugs
1117 #######################################
1118 Reporting bugs & Development Discussion
1119 #######################################
1121 Please discuss this release on the samba-technical mailing list or by
1122 joining the #samba-technical:matrix.org matrix room, or
1123 #samba-technical IRC channel on irc.libera.chat
1125 If you do report problems then please try to send high quality
1126 feedback. If you don't provide vital information to help us track down
1127 the problem then you will probably be ignored. All bug reports should
1128 be filed under the Samba 4.1 and newer product in the project's Bugzilla
1129 database (https://bugzilla.samba.org/).
1132 ======================================================================
1133 == Our Code, Our Bugs, Our Responsibility.
1134 == The Samba Team
1135 ======================================================================