4 This is the fourth release candidate of Samba 4.18. This is *not*
5 intended for production environments and is designed for testing
6 purposes only. Please report any defects via the Samba bug reporting
7 system at https://bugzilla.samba.org/.
9 Samba 4.18 will be the next version of the Samba suite.
19 SMB Server performance improvements
20 -----------------------------------
22 The security improvements in recent releases
23 (4.13, 4.14, 4.15, 4.16), mainly as protection against symlink races,
24 caused performance regressions for metadata heavy workloads.
26 While 4.17 already improved the situation quite a lot,
27 with 4.18 the locking overhead for contended path based operations
28 is reduced by an additional factor of ~ 3 compared to 4.17.
29 It means the throughput of open/close
30 operations reached the level of 4.12 again.
32 More succinct samba-tool error messages
33 ---------------------------------------
35 Historically samba-tool has reported user error or misconfiguration by
36 means of a Python traceback, showing you where in its code it noticed
37 something was wrong, but not always exactly what is amiss. Now it
38 tries harder to identify the true cause and restrict its output to
39 describing that. Particular cases include:
41 * a username or password is incorrect
42 * an ldb database filename is wrong (including in smb.conf)
43 * samba-tool dns: various zones or records do not exist
44 * samba-tool ntacl: certain files are missing
45 * the network seems to be down
46 * bad --realm or --debug arguments
48 Accessing the old samba-tool messages
49 -------------------------------------
51 This is not new, but users are reminded they can get the full Python
52 stack trace, along with other noise, by using the argument '-d3'.
53 This may be useful when searching the web.
55 The intention is that when samba-tool encounters an unrecognised
56 problem (especially a bug), it will still output a Python traceback.
57 If you encounter a problem that has been incorrectly identified by
58 samba-tool, please report it on https://bugzilla.samba.org.
60 Colour output with samba-tool --color
61 -------------------------------------
63 For some time a few samba-tool commands have had a --color=yes|no|auto
64 option, which determines whether the command outputs ANSI colour
65 codes. Now all samba-tool commands support this option, which now also
66 accepts 'always' and 'force' for 'yes', 'never' and 'none' for 'no',
67 and 'tty' and 'if-tty' for 'auto' (this more closely matches
68 convention). With --color=auto, or when --color is omitted, colour
69 codes are only used when output is directed to a terminal.
71 Most commands have very little colour in any case. For those that
72 already used it, the defaults have changed slightly.
74 * samba-tool drs showrepl: default is now 'auto', not 'no'
76 * samba-tool visualize: the interactions between --color-scheme,
77 --color, and --output have changed slightly. When --color-scheme is
78 set it overrides --color for the purpose of the output diagram, but
79 not for other output like error messages.
81 New samba-tool dsacl subcommand for deleting ACES
82 -------------------------------------------------
84 The samba-tool dsacl tool can now delete entries in directory access
85 control lists. The interface for 'samba-tool dsacl delete' is similar
86 to that of 'samba-tool dsacl set', with the difference being that the
87 ACEs described by the --sddl argument are deleted rather than added.
89 No colour with NO_COLOR environment variable
90 --------------------------------------------
92 With both samba-tool --color=auto (see above) and some other places
93 where we use ANSI colour codes, the NO_COLOR environment variable will
94 disable colour output. See https://no-color.org/ for a description of
95 this variable. `samba-tool --color=always` will use colour regardless
98 New wbinfo option --change-secret-at
99 ------------------------------------
101 The wbinfo command has a new option, --change-secret-at=<DOMAIN CONTROLLER>
102 which forces the trust account password to be changed at a specified domain
103 controller. If the specified domain controller cannot be contacted the
104 password change fails rather than trying other DCs.
106 New option to change the NT ACL default location
107 ------------------------------------------------
109 Usually the NT ACLs are stored in the security.NTACL extended
110 attribute (xattr) of files and directories. The new
111 "acl_xattr:security_acl_name" option allows to redefine the default
112 location. The default "security.NTACL" is a protected location, which
113 means the content of the security.NTACL attribute is not accessible
114 from normal users outside of Samba. When this option is set to use a
115 user-defined value, e.g. user.NTACL then any user can potentially
116 access and overwrite this information. The module prevents access to
117 this xattr over SMB, but the xattr may still be accessed by other
118 means (eg local access, SSH, NFS). This option must only be used when
119 this consequence is clearly understood and when specific precautions
120 are taken to avoid compromising the ACL content.
122 Azure Active Directory / Office365 synchronisation improvements
123 --------------------------------------------------------------
125 Use of the Azure AD Connect cloud sync tool is now supported for
126 password hash synchronisation, allowing Samba AD Domains to synchronise
127 passwords with this popular cloud environment.
136 Parameter Name Description Default
137 -------------- ----------- -------
138 acl_xattr:security_acl_name New security.NTACL
142 CHANGES SINCE 4.18.0rc3
143 =======================
145 o Andreas Schneider <asn@samba.org>
146 * BUG 15308: Avoid that tests fail because other tests didn't do cleanup on
149 o baixiangcpp <baixiangcpp@gmail.com>
150 * BUG 15311: fd_load() function implicitly closes the fd where it should not.
153 CHANGES SINCE 4.18.0rc2
154 =======================
156 o Jeremy Allison <jra@samba.org>
157 * BUG 15301: Improve file_modtime() and issues around smb3 unix test.
159 o Ralph Boehme <slow@samba.org>
160 * BUG 15299: Spotlight doesn't work with latest macOS Ventura.
162 o Stefan Metzmacher <metze@samba.org>
163 * BUG 15298: Build failure on solaris with tevent 0.14.0 (and ldb 2.7.0).
164 (tevent 0.14.1 and ldb 2.7.1 are already released...)
166 o John Mulligan <jmulligan@redhat.com>
167 * BUG 15307: vfs_ceph incorrectly uses fsp_get_io_fd() instead of
168 fsp_get_pathref_fd() in close and fstat.
170 o Andreas Schneider <asn@samba.org>
171 * BUG 15291: test_chdir_cache.sh doesn't work with SMBD_DONT_LOG_STDOUT=1.
172 * BUG 15301: Improve file_modtime() and issues around smb3 unix test.
175 CHANGES SINCE 4.18.0rc1
176 =======================
178 o Andrew Bartlett <abartlet@samba.org>
179 * BUG 10635: Office365 azure Password Sync not working.
181 o Stefan Metzmacher <metze@samba.org>
182 * BUG 15286: auth3_generate_session_info_pac leaks wbcAuthUserInfo.
184 o Noel Power <noel.power@suse.com>
185 * BUG 15293: With clustering enabled samba-bgqd can core dump due to use
192 https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.18#Release_blocking_bugs
195 #######################################
196 Reporting bugs & Development Discussion
197 #######################################
199 Please discuss this release on the samba-technical mailing list or by
200 joining the #samba-technical:matrix.org matrix room, or
201 #samba-technical IRC channel on irc.libera.chat
203 If you do report problems then please try to send high quality
204 feedback. If you don't provide vital information to help us track down
205 the problem then you will probably be ignored. All bug reports should
206 be filed under the Samba 4.1 and newer product in the project's Bugzilla
207 database (https://bugzilla.samba.org/).
210 ======================================================================
211 == Our Code, Our Bugs, Our Responsibility.
213 ======================================================================