| blob | 4c96fefcf4eae0a8f52652525a0fc82b60b28c75 |
1 =============================
2 Release Notes for Samba 4.5.5
3 January 30, 2017
4 =============================
7 This is the latest stable release of the Samba 4.5 release series.
9 Samba 4.5.4 erroneously included a rewrite of the vfs_fruit module.
10 This patchset will be reverted with this release, because it needs to pass the
11 review process first. If you are using the vfs_fruit module, please do not use
12 Samba 4.5.4.
14 Changes since 4.5.4:
15 --------------------
17 o Amitay Isaacs <amitay@gmail.com>
18 * BUG 12469: ctdb-locking: Explicitly unlock record/db in lock helper.
20 o Björn Jacke <bj@sernet.de>
21 * BUG 12535: vfs_default: Unlock the right file in copy chunk.
23 o Martin Schwenke <martin@meltin.net>
24 * BUG 12512: ctdb-scripts: Fix remaining uses of "ctdb gratiousarp".
25 * BUG 12516: /etc/iproute2/rt_tables gets populated with multiple
26 'default' entries.
29 #######################################
30 Reporting bugs & Development Discussion
31 #######################################
33 Please discuss this release on the samba-technical mailing list or by
34 joining the #samba-technical IRC channel on irc.freenode.net.
36 If you do report problems then please try to send high quality
37 feedback. If you don't provide vital information to help us track down
38 the problem then you will probably be ignored. All bug reports should
39 be filed under the Samba 4.1 and newer product in the project's Bugzilla
40 database (https://bugzilla.samba.org/).
43 ======================================================================
44 == Our Code, Our Bugs, Our Responsibility.
45 == The Samba Team
46 ======================================================================
49 Release notes for older releases follow:
50 ----------------------------------------
52 =============================
53 Release Notes for Samba 4.5.4
54 January 18, 2017
55 =============================
58 This is the latest stable release of the Samba 4.5 release series.
61 Changes since 4.5.3:
62 --------------------
64 o Jeremy Allison <jra@samba.org>
65 * BUG 12460: rename_internals_fsp missing ACL permission-check on destination
66 folder.
67 * BUG 12466: lib: security: se_access_check() incorrectly processes owner
68 rights (S-1-3-4) DENY ace entries.
69 * BUG 12467: s3: ntlm_auth: Don't corrupt the output stream with debug
70 messages.
71 * BUG 12479: s3: libsmb: Add cli_smb2_ftruncate(), plumb into
72 cli_ftruncate().
74 o Ralph Boehme <slow@samba.org>
75 * BUG 12396: s3/smbd: Remove a misleading error message.
76 * BUG 12412: vfs_fruit: Fix "fruit:resource" option spelling, but not
77 behaviour.
78 * BUG 12485: ctdbd_conn: Fix a resource leak.
80 o David Disseldorp <ddiss@samba.org>
81 * BUG 12144: smbd/ioctl: match WS2016 ReFS set compression behaviour.
83 o Björn Jacke <bj@sernet.de>
84 * BUG 2210: pam: Map more NT password errors to PAM errors.
86 o Volker Lendecke <vl@samba.org>
87 * BUG 12484: winbindd: Use idmap cache in xids2sids.
88 * BUG 12509: messaging: Fix dead but not cleaned-up-yet destination sockets.
90 o Stefan Metzmacher <metze@samba.org>
91 * BUG 12480: kinit succeeded but ads_sasl_spnego_gensec_bind(KRB5) failed: An
92 internal error occurred (with MIT krb5).
94 o Andreas Schneider <asn@samba.org>
95 * BUG 12183: printing: Fix building with CUPS version older than 1.7.
96 * BUG 12441: s3:libads: Include system /etc/krb5.conf if we use MIT Kerberos.
98 o Martin Schwenke <martin@meltin.net>
99 * BUG 12470: Fix ctdb ip bugs.
102 #######################################
103 Reporting bugs & Development Discussion
104 #######################################
106 Please discuss this release on the samba-technical mailing list or by
107 joining the #samba-technical IRC channel on irc.freenode.net.
109 If you do report problems then please try to send high quality
110 feedback. If you don't provide vital information to help us track down
111 the problem then you will probably be ignored. All bug reports should
112 be filed under the Samba 4.1 and newer product in the project's Bugzilla
113 database (https://bugzilla.samba.org/).
116 ======================================================================
117 == Our Code, Our Bugs, Our Responsibility.
118 == The Samba Team
119 ======================================================================
122 ----------------------------------------------------------------------
125 =============================
126 Release Notes for Samba 4.5.3
127 December 19, 2016
128 =============================
131 This is a security release in order to address the following defects:
133 o CVE-2016-2123 (Samba NDR Parsing ndr_pull_dnsp_name Heap-based Buffer
134 Overflow Remote Code Execution Vulnerability).
135 o CVE-2016-2125 (Unconditional privilege delegation to Kerberos servers in
136 trusted realms).
137 o CVE-2016-2126 (Flaws in Kerberos PAC validation can trigger privilege
138 elevation).
140 =======
141 Details
142 =======
144 o CVE-2016-2123:
145 The Samba routine ndr_pull_dnsp_name contains an integer wrap problem,
146 leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name
147 parses data from the Samba Active Directory ldb database. Any user
148 who can write to the dnsRecord attribute over LDAP can trigger this
149 memory corruption.
151 By default, all authenticated LDAP users can write to the dnsRecord
152 attribute on new DNS objects. This makes the defect a remote privilege
153 escalation.
155 o CVE-2016-2125
156 Samba client code always requests a forwardable ticket
157 when using Kerberos authentication. This means the
158 target server, which must be in the current or trusted
159 domain/realm, is given a valid general purpose Kerberos
160 "Ticket Granting Ticket" (TGT), which can be used to
161 fully impersonate the authenticated user or service.
163 o CVE-2016-2126
164 A remote, authenticated, attacker can cause the winbindd process
165 to crash using a legitimate Kerberos ticket due to incorrect
166 handling of the arcfour-hmac-md5 PAC checksum.
168 A local service with access to the winbindd privileged pipe can
169 cause winbindd to cache elevated access permissions.
172 Changes since 4.5.2:
173 --------------------
175 o Volker Lendecke <vl@samba.org>
176 * BUG 12409: CVE-2016-2123: Fix DNS vuln ZDI-CAN-3995.
178 o Stefan Metzmacher <metze@samba.org>
179 * BUG 12445: CVE-2016-2125: Don't send delegated credentials to all servers.
180 * BUG 12446: CVE-2016-2126: auth/kerberos: Only allow known checksum types in
181 check_pac_checksum().
184 #######################################
185 Reporting bugs & Development Discussion
186 #######################################
188 Please discuss this release on the samba-technical mailing list or by
189 joining the #samba-technical IRC channel on irc.freenode.net.
191 If you do report problems then please try to send high quality
192 feedback. If you don't provide vital information to help us track down
193 the problem then you will probably be ignored. All bug reports should
194 be filed under the Samba 4.1 and newer product in the project's Bugzilla
195 database (https://bugzilla.samba.org/).
198 ======================================================================
199 == Our Code, Our Bugs, Our Responsibility.
200 == The Samba Team
201 ======================================================================
204 ----------------------------------------------------------------------
207 =============================
208 Release Notes for Samba 4.5.2
209 December 07, 2016
210 =============================
213 This is the latest stable release of the Samba 4.5 release series.
216 Changes since 4.5.1:
217 --------------------
219 o Michael Adam <obnox@samba.org>
220 * BUG 12404: vfs:glusterfs: Preallocate result for glfs_realpath.
222 o Jeremy Allison <jra@samba.org>
223 * BUG 12384: s3: vfs: Remove files/directories after the streams are deleted.
224 * BUG 12387: s3: vfs_streams_depot: Use conn->connectpath not conn->cwd.
225 * BUG 12436: s3/smbd: Fix the last resort check that sets the file type
226 attribute.
228 o Andrew Bartlett <abartlet@samba.org>
229 * BUG 9954: dsdb: Create RID Set as SYSTEM.
230 * BUG 12297: dbcheck: Correct message for orphaned backlinks.
231 * BUG 12395: build: Fix build with perl on debian sid.
232 * BUG 12398: Fix errors in extended operations (like allocating a RID Set).
234 o Günther Deschner <gd@samba.org>
235 * BUG 11197: spoolss: Use correct values for secdesc and devmode pointers.
237 o Clive Ferreira <cliveferreira@catalyst.net.nz>
238 * BUG 12394: objectclass_attrs: Only abort on a missing attribute when an
239 attribute is both MUST and replicated.
241 o Amitay Isaacs <amitay@gmail.com>
242 * BUG 12366: provision,dlz-bind: Add support for BIND 9.11.x.
243 * BUG 12392: ctdb-locking: Reset real-time priority in lock helper.
244 * BUG 12407: ctdb-scripts: Fix calculation of CTDB_BASE.
245 * BUG 12434: ctdb-recovery: Avoid NULL dereference in failure case.
247 o Stefan Metzmacher <metze@samba.org>
248 * BUG 10297: s3:smbd: Only pass UCF_PREP_CREATEFILE to filename_convert() if
249 we may create a new file.
251 o Mathieu Parent <math.parent@gmail.com>
252 * BUG 12371: ctdb-scripts: Fix Debian init in samba eventscript.
254 o Garming Sam <garming@catalyst.net.nz>
255 * BUG 9954: samba_tool/fsmo: Allocate RID Set when seizing RID manager.
256 * BUG 10882: s4-auth: Don't check for NULL saltPrincipal if it doesn't need
257 it.
258 * BUG 12297: upgradeprovision: Remove objectCategory from constructed attrs.
259 * BUG 12385: collect_tombstones: Allow links to recycled objects to be
260 deleted.
262 o Andreas Schneider <asn@samba.org>
263 * BUG 12183: s3-printing: Correctly encode CUPS printer URIs.
264 * BUG 12195: s3-printing: Allow printer names longer than 16 chars.
265 * BUG 12269: nss_wins: Fix errno values for HOST_NOT_FOUND.
266 * BUG 12405: s3-winbind: Do not return NO_MEMORY if we have an empty user
267 list.
268 * BUG 12415: s3:spoolss: Add support for COPY_FROM_DIRECTORY in
269 AddPrinterDriverEx.
271 o Martin Schwenke <martin@meltin.net>
272 * BUG 12104: ctdb-packaging: Move CTDB tests to /usr/local/share/ctdb/tests/.
274 o Uri Simchoni <uri@samba.org>
275 * BUG 12375: smbd: In ntlm auth, do not map empty domain in case of
276 \user@realm.
278 o Ralph Wuerthner <ralph.wuerthner@de.ibm.com>
279 * BUG 12372: ctdb-conn: Add missing variable initialization.
282 #######################################
283 Reporting bugs & Development Discussion
284 #######################################
286 Please discuss this release on the samba-technical mailing list or by
287 joining the #samba-technical IRC channel on irc.freenode.net.
289 If you do report problems then please try to send high quality
290 feedback. If you don't provide vital information to help us track down
291 the problem then you will probably be ignored. All bug reports should
292 be filed under the Samba 4.1 and newer product in the project's Bugzilla
293 database (https://bugzilla.samba.org/).
296 ======================================================================
297 == Our Code, Our Bugs, Our Responsibility.
298 == The Samba Team
299 ======================================================================
302 ----------------------------------------------------------------------
305 =============================
306 Release Notes for Samba 4.5.1
307 October 26, 2016
308 =============================
311 This is the latest stable release of the Samba 4.5 release series.
313 Major enhancements in Samba 4.5.1 include:
315 o Let winbindd discard expired kerberos tickets when built against
316 (internal) heimdal (BUG #12369).
317 o REGRESSION: smbd segfaults on startup, tevent context being freed
318 (BUG #12283).
321 Changes since 4.5.0:
322 --------------------
324 o Jeremy Allison <jra@samba.org>
325 * BUG 11259: smbd contacts a domain controller for each session.
326 * BUG 12272: Fix messaging subsystem crash.
327 * BUG 12283: REGRESSION: smbd segfaults on startup, tevent context being
328 freed.
329 * BUG 12381: s3: cldap: cldap_multi_netlogon_send() fails with one bad IPv6
330 address.
331 * BUG 12383: s3: libsmb: Fix cut and paste error using the wrong structure
332 type.
334 o Christian Ambach <ambi@samba.org>
335 * BUG 9945: Setting specific logger levels in smb.conf makes 'samba-tool drs
336 showrepl' crash.
338 o Andrew Bartlett <abartlet@samba.org>
339 * BUG 12382: Tombstone expunge does not remove old links.
341 o Björn Baumbach <bb@sernet.de>
342 * BUG 8618: s3-printing: Fix migrate printer code.
344 o Ralph Boehme <slow@samba.org>
345 * BUG 12256: s3/smbd: In call_trans2qfilepathinfo call lstat when dealing
346 with posix pathnames.
347 * BUG 12261: s3/smbd: Set FILE_ATTRIBUTE_DIRECTORY as necessary.
349 o Günther Deschner <gd@samba.org>
350 * BUG 12285: "DriverVersion" registry backend parsing incorrect in spoolss.
352 o David Disseldorp <ddiss@samba.org>
353 * BUG 12144: smbd/ioctl: Match WS2016 ReFS get compression behaviour.
355 o Amitay Isaacs <amitay@gmail.com>
356 * BUG 12259: ctdb-protocol: Fix marshalling for GET_DB_SEQNUM control
357 request.
358 * BUG 12275: ctdb-recovery-helper: Add missing initialisation of ban_credits.
359 * BUG 12287: CTDB PID file handling is too weak.
361 o Volker Lendecke <vl@samba.org>
362 * BUG 12045: gencache: Bail out of stabilize if we can not get the allrecord
363 lock.
364 * BUG 12268: smbd: Reset O_NONBLOCK on open files.
365 * BUG 12283: glusterfs: Avoid tevent_internal.h.
366 * BUG 12291: source3/lib/msghdr.c, line 208: syntax error before or at: ;.
367 * BUG 12374: spoolss: Fix caching of printername->sharename.
369 o Stefan Metzmacher <metze@samba.org>
370 * BUG 12283: REGRESSION: smbd segfaults on startup, tevent context being
371 freed.
372 * BUG 12369: Let winbindd discard expired kerberos tickets when built against
373 (internal) heimdal.
375 o Noel Power <noel.power@suse.com>
376 * BUG 12298: s3/winbindd: Fix using default domain with user@domain.com
377 format.
379 o Christof Schmitt <cs@samba.org>
380 * BUG 12295: winbind: Fix passing idmap failure from wb_sids2xids back to
381 callers.
383 o Andreas Schneider <asn@samba.org>
384 * BUG 12269: nss_wins has incorrect function definitions for gethostbyname*.
385 * BUG 12276: s3-lib: Fix %G substitution in AD member environment.
386 * BUG 12364: s3-utils: Fix loading smb.conf in smbcquotas.
388 o Garming Sam <garming@catalyst.net.nz>
389 * BUG 12286: kcc: Don't check schedule if None.
390 * BUG 12382: Tombstone expunge does not remove old links.
392 o Anoop C S <anoopcs@redhat.com>
393 * BUG 12377: vfs_glusterfs: Fix a memory leak in connect path.
395 o Martin Schwenke <martin@meltin.net>
396 * BUG 12254: CTDB IP takeover does not complete if there are no public
397 addresses configured.
398 * BUG 12255: ctdb-packaging: Fix systemd network dependency.
399 * BUG 12287: CTDB PID file handling is too weak.
401 o Uri Simchoni <uri@samba.org>
402 * BUG 12270: smbcquotas: Fix error message listing quotas.
403 * BUG 12273: s3-sysquotas: Correctly restore path when finding mount point.
404 * BUG 12288: cliquota: Fix param count when setting fs quota.
405 * BUG 12289: smbd: Free talloc context if no quota records are available.
406 * BUG 12307: ntquotas: Support "freeing" an empty quota list.
409 #######################################
410 Reporting bugs & Development Discussion
411 #######################################
413 Please discuss this release on the samba-technical mailing list or by
414 joining the #samba-technical IRC channel on irc.freenode.net.
416 If you do report problems then please try to send high quality
417 feedback. If you don't provide vital information to help us track down
418 the problem then you will probably be ignored. All bug reports should
419 be filed under the Samba 4.1 and newer product in the project's Bugzilla
420 database (https://bugzilla.samba.org/).
423 ======================================================================
424 == Our Code, Our Bugs, Our Responsibility.
425 == The Samba Team
426 ======================================================================
429 ----------------------------------------------------------------------
432 =============================
433 Release Notes for Samba 4.5.0
434 September 7, 2016
435 =============================
438 This is the first stable release of the Samba 4.5 release series.
441 UPGRADING
442 =========
444 NTLMv1 authentication disabled by default
445 -----------------------------------------
447 In order to improve security we have changed
448 the default value for the "ntlm auth" option from
449 "yes" to "no". This may have impact on very old
450 clients which doesn't support NTLMv2 yet.
452 The primary user of NTLMv1 is MSCHAPv2 for VPNs and 802.1x.
454 By default, Samba will only allow NTLMv2 via NTLMSSP now,
455 as we have the following default "lanman auth = no",
456 "ntlm auth = no" and "raw NTLMv2 auth = no".
459 NEW FEATURES/CHANGES
460 ====================
462 Support for LDAP_SERVER_NOTIFICATION_OID
463 ----------------------------------------
465 The ldap server has support for the LDAP_SERVER_NOTIFICATION_OID
466 control. This can be used to monitor the Active Directory database
467 for changes.
469 KCC improvements for sparse network replication
470 -----------------------------------------------
472 The Samba KCC will now be the default knowledge consistency checker in
473 Samba AD. Instead of using full mesh replication between every DC, the
474 KCC will set up connections to optimize replication latency and cost
475 (using site links to calculate the routes). This change should allow
476 larger domains to function significantly better in terms of replication
477 traffic and the time spent performing DRS replication.
479 VLV - Virtual List View
480 -----------------------
482 The VLV Control allows applications to page the LDAP directory in the
483 way you might expect a live phone book application to operate, without
484 first downloading the entire directory.
486 DRS Replication for the AD DC
487 -----------------------------
489 DRS Replication in Samba 4.5 is now much more efficient in handling
490 linked attributes, particularly in large domains with over 1000 group
491 memberships or other links.
493 Replication is also much more reliable in the handling of tree
494 renames, such as the rename of an organizational unit containing many
495 users. Extensive tests have been added to ensure this code remains
496 reliable, particularly in the case of conflicts between objects added
497 with the same name on different servers.
499 Schema updates are also handled much more reliably.
501 samba-tool drs replicate with new options
502 -----------------------------------------
504 'samba-tool drs replicate' got two new options:
506 The option '--local-online' will do the DsReplicaSync() via IRPC
507 to the local dreplsrv service.
509 The option '--async-op' will add DRSUAPI_DRS_ASYNC_OP to the
510 DsReplicaSync(), which won't wait for the replication result.
512 replPropertyMetaData Changes
513 ----------------------------
515 During the development of the DRS replication, tests showed that Samba
516 stores the replPropertyMetaData object incorrectly. To address this,
517 be aware that 'dbcheck' will now detect and offer to fix all objects in
518 the domain for this error.
520 For further information and instructions how to fix the problem, see
521 https://wiki.samba.org/index.php/Updating_Samba#Fixing_replPropertyMetaData_Attributes
523 Linked attributes on deleted objects
524 ------------------------------------
526 In Active Directory, an object that has been tombstoned or recycled
527 has no linked attributes. However, Samba incorrectly maintained such
528 links, slowing replication and run-time performance. 'dbcheck' now
529 offers to remove such links, and they are no longer kept after the
530 object is tombstoned or recycled.
532 Improved AD DC performance
533 --------------------------
535 Many other improvements have been made to our LDAP database layer in
536 the AD DC, to improve performance, both during 'samba-tool domain
537 provision' and at runtime.
539 Other dbcheck improvements
540 --------------------------
542 - 'samba-tool dbcheck' can now find and fix a missing or corrupted
543 'deleted objects' container.
544 - BUG 11433: samba-dbcheck no longer offers to resort auxiliary class values
545 in objectClass as these were then re-sorted at the next dbcheck indefinitely.
547 Tombstone Reanimation
548 ---------------------
550 Samba now supports tombstone reanimation, a feature in the AD DC
551 allowing tombstones, that is objects which have been deleted, to be
552 restored with the original SID and GUID still in place.
554 Multiple DNS Forwarders on the AD DC
555 ------------------------------------
557 Previously, the Samba internal DNS server supported only one DNS forwarder.
558 The "dns forwarder" option has been enhanced and now supports a space-separated
559 list of multiple DNS server IP addresses. As a result, Samba is now able to
560 fall back to alternative DNS servers. In case that a DNS query to the first
561 server timed out, it is sent to the next DNS server listed in the option.
563 Password quality plugin support in the AD DC
564 --------------------------------------------
566 The check password script now operates correctly in the AD DC.
568 pwdLastSet is now correctly honoured
569 ------------------------------------
571 BUG 9654: The pwdLastSet attribute is now correctly handled (this previously
572 permitted passwords that expire next).
574 net ads dns unregister
575 ----------------------
577 It is now possible to remove the DNS entries created with 'net ads register'
578 with the matching 'net ads unregister' command.
580 samba-tool improvements
581 ------------------------
583 Running 'samba-tool' on the command line should now be a lot snappier. The tool
584 now only loads the code specific to the subcommand that you wish to run.
586 SMB 2.1 Leases enabled by default
587 ---------------------------------
589 Leasing is an SMB 2.1 (and higher) feature which allows clients to
590 aggressively cache files locally above and beyond the caching allowed
591 by SMB 1 oplocks. This feature was disabled in previous releases, but
592 the SMB2 leasing code is now considered mature and stable enough to be
593 enabled by default.
595 Open File Description (OFD) Locks
596 ---------------------------------
598 On systems that support them (currently only Linux), the fileserver now
599 uses Open File Description (OFD) locks instead of POSIX locks to implement
600 client byte range locks. As these locks are associated with a specific
601 file descriptor on a file this allows more efficient use when multiple
602 descriptors having file locks are opened onto the same file. An internal
603 tunable "smbd:force process locks = true" may be used to turn off OFD
604 locks if there appear to be problems with them.
606 Password sync as Active Directory domain controller
607 ---------------------------------------------------
609 The new commands 'samba-tool user getpassword'
610 and 'samba-tool user syncpasswords' provide
611 access and syncing of various password fields.
613 If compiled with GPGME support (--with-gpgme) it's
614 possible to store cleartext passwords in a PGP/OpenGPG
615 encrypted form by configuring the new "password hash gpg key ids"
616 option. This requires gpgme devel and python packages to be installed
617 (e.g. libgpgme11-dev and python-gpgme on Debian/Ubuntu).
619 Python crypto requirements
620 --------------------------
622 Some 'samba-tool' subcommands require python-crypto and/or
623 python-m2crypto packages to be installed.
625 SmartCard/PKINIT improvements
626 -----------------------------
628 'samba-tool user create' accepts "--smartcard-required"
629 and 'samba-tool user setpassword' accepts "--smartcard-required"
630 and "--clear-smartcard-required".
632 Specifying "--smartcard-required" results in the UF_SMARTCARD_REQUIRED
633 flags being set in the userAccountControl attribute.
634 At the same time, the account password is reset to a random
635 NTHASH value.
637 Interactive password logons are rejected, if the UF_SMARTCARD_REQUIRED
638 bit is set in the userAccountControl attribute of a user.
640 When doing a PKINIT based Kerberos logon the KDC adds the
641 required PAC_CREDENTIAL_INFO element to the authorization data.
642 That means the NTHASH is shared between the PKINIT based client and
643 the domain controller, which allows the client to do NTLM based
644 authentication on behalf of the user. It also allows an offline
645 logon using a smartcard to work on Windows clients.
647 CTDB changes
648 ------------
650 * New improved 'ctdb tool'
652 'ctdb tool' has been completely rewritten using new client API.
653 Usage messages are much improved.
655 * Sample CTDB configuration file is installed as ctdbd.conf.
657 * The use of real-time scheduling when taking locks has been narrowed
658 to limit potential performance impacts on nodes.
660 * CTDB_RECOVERY_LOCK now supports specification of an external helper
661 to take and hold the recovery lock.
663 See the RECOVERY LOCK section in ctdb(7) for details. Documentation
664 for writing helpers is provided in doc/cluster_mutex_helper.txt.
666 * "ctdb natgwlist" has been replaced by a top level "ctdb natgw"
667 command that has "master", "list" and "status" subcommands.
669 * The 'onnode' command no longer supports the "recmaster", "lvs" and
670 "natgw" node specifications.
672 * Faster resetting of TCP connections to public IP addresses during
673 failover.
675 * Tunables MaxRedirectCount, ReclockPingPeriod,
676 DeferredRebalanceOnNodeAdd are now obsolete/ignored.
678 * "ctdb listvars" now lists all variables, including the first one.
680 * "ctdb xpnn", "ctdb rebalanceip" and "ctdb rebalancenode" have been
681 removed.
683 These are not needed because "ctdb reloadips" should do the correct
684 rebalancing.
686 * Output for the following commands has been simplified:
688 ctdb getdbseqnum
689 ctdb getdebug
690 ctdb getmonmode
691 ctdb getpid
692 ctdb getreclock
693 ctdb getpid
694 ctdb pnn
696 These now simply print the requested output with no preamble. This
697 means that scripts no longer need to strip part of the output.
699 "ctdb getreclock" now prints nothing when the recovery lock is not
700 set.
702 * Output for the following commands has been improved:
704 ctdb setdebug
705 ctdb uptime
707 * 'ctdb process-exists' has been updated to only take a PID argument.
709 The PNN can be specified with -n <PNN>. Output also cleaned up.
711 * LVS support has been reworked - related commands and configuration
712 variables have changed.
714 'ctdb lvsmaster' and 'ctdb lvs' have been replaced by a top level
715 'ctdb lvs' command that has 'master', 'list' and 'status'
716 subcommands.
718 See the LVS sections in ctdb(7) and ctdbd.conf(5) for details,
719 including configuration changes.
721 * Improved sample NFS Ganesha call-out.
723 New shadow_copy2 options
724 ------------------------
726 * shadow:snapprefix
728 With growing number of snapshots file-systems need some mechanism to
729 differentiate one set of snapshots from other, e.g. monthly, weekly, manual,
730 special events, etc. Therefore, these file-systems provide different ways to tag
731 snapshots, e.g. provide a configurable way to name snapshots, which is not just
732 based on time. With only shadow:format it is very difficult to filter these
733 snapshots. With this optional parameter, one can specify a variable prefix
734 component for names of the snapshot directories in the file-system. If this
735 parameter is set, together with the shadow:format and shadow:delimiter
736 parameters it determines the possible names of snapshot directories in the
737 file-system. The option only supports Basic Regular Expression (BRE).
739 * shadow:delimiter
741 This optional parameter is used as a delimiter between "shadow:snapprefix" and
742 "shadow:format". This parameter is used only when "shadow:snapprefix" is set.
744 Default: shadow:delimiter = "_GMT"
747 REMOVED FEATURES
748 ================
750 "only user" and "username" parameters
751 -------------------------------------
753 These two parameters have long been deprecated and superseded by
754 "valid users" and "invalid users".
757 smb.conf changes
758 ================
760 Parameter Name Description Default
761 -------------- ----------- -------
762 kccsrv:samba_kcc Changed default yes
763 ntlm auth Changed default no
764 only user Removed
765 password hash gpg key ids New
766 shadow:snapprefix New
767 shadow:delimiter New _GMT
768 smb2 leases Changed default yes
769 username Removed
772 KNOWN ISSUES
773 ============
775 While a lot of schema replication bugs were fixed in this release
776 Bug 12204 - Samba fails to replicate schema 69
777 (https://bugzilla.samba.org/show_bug.cgi?id=12204) is still open.
778 The replication fails if more than 133 schema objects are added
779 at the same time.
781 More open bugs are listed at:
782 https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.5#All_bugs
785 CHANGES SINCE 4.5.0rc3
786 ======================
788 o Björn Baumbach <bb@sernet.de>
789 * BUG 12194: idmap_script: fix missing "IDTOSID" argument in scripts
790 command line.
792 o Andrew Bartlett <abartlet@samba.org>
793 * BUG 12178: samba-tool dbcheck fails to fix replPropertyMetaData.
795 o Ralph Boehme <slow@samba.org>
796 * BUG 12177: Unexpected synthesized default ACL from vfs_acl_xattr.
797 * BUG 12181: vfs_acl_common not setting filesystem permissions anymore.
798 * BUG 12184: Loading shared RPC modules failed.
800 o Günther Deschner <gd@samba.org>
801 * BUG 12245: fix _spoolss_GetPrinterDataEx by moving the keyname
802 length check.
804 o Stefan Metzmacher <metze@samba.org>
805 * BUG 11994: smbclient fails to connect to Azure or Apple share spnego
806 fails with no mechListMIC.
808 o Martin Schwenke <martin@meltin.net>
809 * BUG 12180: CTDB crashes running eventscripts.
812 CHANGES SINCE 4.5.0rc2
813 ======================
815 o Michael Adam <obnox@samba.org>
816 * BUG 12155: Some idmap backends don't perform range checks for the result
817 of sids_to_xids.
819 o Jeremy Allison <jra@samba.org>
820 * BUG 12115: Endless loop on drsuapi pull replication after schema changes.
821 * BUG 12135: net ads gpo refresh can crash with null pointer deref..
822 * BUG 12139: Race between break oplock and check for share_mode.
823 * BUG 12150: SMB2 snapshot query fails on DFS shares..
824 * BUG 12165: smbclient allinfo doesn't correctly return 'previous version'
825 info over SMB1.
826 * BUG 12166: smbclient allinfo doesn't correctly return 'previous version'
827 info over SMB2.
828 * BUG 12174: error: 'conn' undeclared.
830 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
831 * BUG 12143: misnamed attribute in samba_kcc causes exception in unusual
832 circumstances.
833 * BUG 12187: Backport changes for partial attribute set calculation
834 for 4.5.
836 o Andrew Bartlett <abartlet@samba.org>
837 * BUG 12107: backport backupkey tests.
838 * BUG 12115: Endless loop on drsuapi pull replication after schema changes.
839 * BUG 12128: Correctly resolve replicated schema changes regarding linked
840 attributes.
842 o Amitay Isaacs <amitay@gmail.com>
843 * BUG 12137: Fix printf format non-liternal warnings and printf
844 format errors.
845 * BUG 12138: Fix uninitialized timeout in ctdb_pmda.
846 * BUG 12151: Drop resurrected ctdb commands in new ctdb tool.
847 * BUG 12152: Fix ctdb addip; implementation to match ctdb delip.
848 * BUG 12163: Fix missing arguments and format elements in format strings.
849 * BUG 12168: Fix format-nonliteral warnings.
851 o Stefan Metzmacher <metze@samba.org>
852 * BUG 12108: Backport selftest/autobuild fixes to v4-5-test.
853 * BUG 12114: In memory schema updated on non schema master.
854 * BUG 12115: Endless loop on drsuapi pull replication after schema changes.
855 * BUG 12128: Correctly resolve replicated schema changes regarding
856 linked attributes.
857 * BUG 12129: let samba-tool ldapcmp ignore whenChanged.
859 o Garming Sam <garming@catalyst.net.nz>
860 * BUG 12187: Backport changes for partial attribute set calculation
861 for 4.5.
863 o Andreas Schneider <asn@samba.org>
864 * BUG 12175: smbget always prompts for a username.
866 o Christof Schmitt <cs@samba.org>
867 * BUG 12150: SMB2 snapshot query fails on DFS shares..
869 o Martin Schwenke <martin@meltin.net>
870 * BUG 12157: Coverity and related fixes.
871 * BUG 12158: CTDB release IP fixes.
872 * BUG 12161: Fix CTDB cumulative takeover timeout.
873 * BUG 12170: CTDB test runs can kill each other's ctdbd daemons.
875 o Uri Simchoni <uri@samba.org>
876 * BUG 12145: smbd: if inherit owner is enabled, the free disk on a folder
877 should take the owner's quota into account.
878 * BUG 12149: smbd: cannot load a Windows device driver from a Samba share
879 via SMB2.
880 * BUG 12172: a snapshot folder cannot be accessed via SMB1.
883 CHANGES SINCE 4.5.0rc1
884 ======================
886 o Ralph Boehme <slow@samba.org>
887 * BUG 12005: parse_share_modes() chokes on ctdb tombstone record from ltdb.
888 * BUG 12105: smbclient connection to not reachable IP eats 100% CPU.
890 o Ira Cooper <ira@samba.org>
891 * BUG 12133: source3/wscript: Add support for disabling vfs_cephfs.
893 o Amitay Isaacs <amitay@gmail.com>
894 * BUG 12121: ctdb-tools: Fix numerous Coverity IDs and other issues.
895 * BUG 12122: If a transaction fails, it should be canceled and transaction
896 handle should be freed.
897 * BUG 12134: dbwrap: Fix structure initialization.
899 o Marc Muehlfeld <mmuehlfeld@samba.org>
900 * BUG 12023: man: Fix wrong option for parameter "ldap ssl" in smb.conf
901 man page.
903 o Andreas Schneider <asn@samba.org>
904 * BUG 12104: ctdb-waf: Move ctdb tests to libexec directory.
906 o Martin Schwenke <martin@meltin.net>
907 * BUG 12104: ctdb-packaging: Move ctdb tests to libexec directory.
908 * BUG 12109: Fixes several CTDB tests.
909 * BUG 12110: Fix numerous Coverity IDs.
910 * BUG 12113: ctdb-mutex: Avoid corner case where helper is already
911 reparented to init.
912 * BUG 12123: Fix ctdb tickle command and update documentation.
913 * BUG 12125: CTDB overwrites working configuration due to packaging
914 change.
915 * BUG 12126: Fix broken CTDB log messages.
918 #######################################
919 Reporting bugs & Development Discussion
920 #######################################
922 Please discuss this release on the samba-technical mailing list or by
923 joining the #samba-technical IRC channel on irc.freenode.net.
925 If you do report problems then please try to send high quality
926 feedback. If you don't provide vital information to help us track down
927 the problem then you will probably be ignored. All bug reports should
928 be filed under the Samba 4.1 and newer product in the project's Bugzilla
929 database (https://bugzilla.samba.org/).
932 ======================================================================
933 == Our Code, Our Bugs, Our Responsibility.
934 == The Samba Team
935 ======================================================================