1 ==============================
2 Release Notes for Samba 4.5.10
4 ==============================
7 This is a security release in order to address the following defect:
9 o CVE-2017-7494 (Remote code execution from a writable share)
16 All versions of Samba from 3.5.0 onwards are vulnerable to a remote
17 code execution vulnerability, allowing a malicious client to upload a
18 shared library to a writable share, and then cause the server to load
25 o Volker Lendecke <vl@samba.org>
26 * BUG 12780: CVE-2017-7494: Avoid remote code execution from a writable
30 #######################################
31 Reporting bugs & Development Discussion
32 #######################################
34 Please discuss this release on the samba-technical mailing list or by
35 joining the #samba-technical IRC channel on irc.freenode.net.
37 If you do report problems then please try to send high quality
38 feedback. If you don't provide vital information to help us track down
39 the problem then you will probably be ignored. All bug reports should
40 be filed under the Samba 4.1 and newer product in the project's Bugzilla
41 database (https://bugzilla.samba.org/).
44 ======================================================================
45 == Our Code, Our Bugs, Our Responsibility.
47 ======================================================================
50 Release notes for older releases follow:
51 ----------------------------------------
53 =============================
54 Release Notes for Samba 4.5.9
56 =============================
59 This is the latest stable release of the Samba 4.5 release series.
65 o Michael Adam <obnox@samba.org>
66 * BUG 12743: vfs_shadow_copy2 fails to list snapshots from shares with
69 o Jeremy Allison <jra@samba.org>
70 * BUG 12747: Wrong use of getgroups causes buffer overflow.
72 o Hanno Böck <hanno@hboeck.de>
73 * BUG 12746: lib: debug: Avoid negative array access.
74 * BUG 12748: cleanupdb: Fix a memory read error.
76 o Ralph Boehme <slow@samba.org>
77 * BUG 11961: idmap_autorid allocates ids for unknown SIDs from other backends.
78 * BUG 12562: vfs_acl_common should force "create mask = 0777".
79 * BUG 12565: vfs_fruit: resource fork open request with
80 flags=O_CREAT|O_RDONLY.
81 * BUG 12727: Lookup-domain for well-known SIDs on a DC.
82 * BUG 12728: winbindd: Fix error handling in rpc_lookup_sids().
83 * BUG 12729: winbindd: Trigger possible passdb_dsdb initialisation.
84 * BUG 12749: Can't case-rename files with vfs_fruit.
85 * BUG 12766: s3/smbd: Update exclusive oplock optimisation to the lease area.
87 o Amitay Isaacs <amitay@gmail.com>
88 * BUG 12733: ctdb-docs: Fix documentation of "-n" option to 'ctdb tool'.
90 o Shilpa Krishnareddy <skrishnareddy@panzura.com>
91 * BUG 12756: notify: Fix ordering of events in notifyd.
93 o Volker Lendecke <vl@samba.org>
94 * BUG 12276: lib: Fix CID 1373623 Dereference after null check.
95 * BUG 12558: smbd: Fix smb1 findfirst with DFS.
96 * BUG 12757: idmap_rfc2307: Fix lookup of more than two SIDs.
98 o Stefan Metzmacher <metze@samba.org>
99 * BUG 12767: samba-tool: Let 'samba-tool user syncpasswords' report deletions
101 * BUG 12725: pam_winbind: no longer use wbcUserPasswordPolicyInfo when
104 o Doug Nazar <nazard@nazar.ca>
105 * BUG 12760: s3: smbd: inotify_map_mask_to_filter incorrectly indexes an
108 o Christof Schmitt <cs@samba.org>
109 * BUG 12725: winbindd: Fix password policy for pam authentication.
111 o Andreas Schneider <asn@samba.org>
112 * BUG 12277: waf: Explicitly link libreplace against libnss_wins.so.
114 o Uri Simchoni <uri@samba.org>
115 * BUG 12737: vfs_acl_xattr - failure to get ACL on Linux if memory is
119 #######################################
120 Reporting bugs & Development Discussion
121 #######################################
123 Please discuss this release on the samba-technical mailing list or by
124 joining the #samba-technical IRC channel on irc.freenode.net.
126 If you do report problems then please try to send high quality
127 feedback. If you don't provide vital information to help us track down
128 the problem then you will probably be ignored. All bug reports should
129 be filed under the Samba 4.1 and newer product in the project's Bugzilla
130 database (https://bugzilla.samba.org/).
133 ======================================================================
134 == Our Code, Our Bugs, Our Responsibility.
136 ======================================================================
139 ----------------------------------------------------------------------
142 =============================
143 Release Notes for Samba 4.5.8
145 =============================
148 This is a bug fix release to address a regression introduced by the security
149 fixes for CVE-2017-2619 (Symlink race allows access outside share definition).
150 Please see https://bugzilla.samba.org/show_bug.cgi?id=12721 for details.
156 o Jeremy Allison <jra@samba.org>
157 * BUG 12721: Fix regression with "follow symlinks = no".
160 #######################################
161 Reporting bugs & Development Discussion
162 #######################################
164 Please discuss this release on the samba-technical mailing list or by
165 joining the #samba-technical IRC channel on irc.freenode.net.
167 If you do report problems then please try to send high quality
168 feedback. If you don't provide vital information to help us track down
169 the problem then you will probably be ignored. All bug reports should
170 be filed under the Samba 4.1 and newer product in the project's Bugzilla
171 database (https://bugzilla.samba.org/).
174 ======================================================================
175 == Our Code, Our Bugs, Our Responsibility.
177 ======================================================================
180 ----------------------------------------------------------------------
183 =============================
184 Release Notes for Samba 4.5.7
186 =============================
189 This is a security release in order to address the following defect:
191 o CVE-2017-2619 (Symlink race allows access outside share definition)
198 All versions of Samba prior to 4.6.1, 4.5.7, 4.4.11 are vulnerable to
199 a malicious client using a symlink race to allow access to areas of
200 the server file system not exported under the share definition.
202 Samba uses the realpath() system call to ensure when a client requests
203 access to a pathname that it is under the exported share path on the
206 Clients that have write access to the exported part of the file system
207 via SMB1 unix extensions or NFS to create symlinks can race the server
208 by renaming a realpath() checked path and then creating a symlink. If
209 the client wins the race it can cause the server to access the new
210 symlink target after the exported share path check has been done. This
211 new symlink target can point to anywhere on the server file system.
213 This is a difficult race to win, but theoretically possible. Note that
214 the proof of concept code supplied wins the race reliably only when
215 the server is slowed down using the strace utility running on the
216 server. Exploitation of this bug has not been seen in the wild.
222 o Jeremy Allison <jra@samba.org>
223 * BUG 12496: CVE-2017-2619: Symlink race permits opening files outside share
226 o Ralph Boehme <slow@samba.org>
227 * BUG 12496: CVE-2017-2619: Symlink race permits opening files outside share
231 #######################################
232 Reporting bugs & Development Discussion
233 #######################################
235 Please discuss this release on the samba-technical mailing list or by
236 joining the #samba-technical IRC channel on irc.freenode.net.
238 If you do report problems then please try to send high quality
239 feedback. If you don't provide vital information to help us track down
240 the problem then you will probably be ignored. All bug reports should
241 be filed under the Samba 4.1 and newer product in the project's Bugzilla
242 database (https://bugzilla.samba.org/).
245 ======================================================================
246 == Our Code, Our Bugs, Our Responsibility.
248 ======================================================================
251 ----------------------------------------------------------------------
254 =============================
255 Release Notes for Samba 4.5.6
257 =============================
260 This is the latest stable release of the Samba 4.5 release series.
266 o Jeremy Allison <jra@samba.org>
267 * BUG 12499: s3: vfs: dirsort doesn't handle opendir of "." correctly.
268 * BUG 12531: vfs_shadow_copy2 doesn't cope with server changing directories.
269 * BUG 12546: vfs_streams_xattr doesn't cope with server changing directories.
270 * BUG 12572: s3: smbd: Don't loop infinitely on bad-symlink resolution.
271 * BUG 12608: s3: smbd: Restart reading the incoming SMB2 fd when the send
274 o Andrew Bartlett <abartlet@samba.org>
275 * BUG 12573: Samba < 4.7 does not know about compatibleFeatures and
278 o Ralph Boehme <slow@samba.org>
279 * BUG 12184: s3/rpc_server: Shared rpc modules loading.
280 * BUG 12427: vfs_fruit doesn't work with fruit:metadata=stream.
281 * BUG 12520: Ensure global "smb encrypt = off" is effective.
282 * BUG 12524: s3/rpc_server: move rpc_modules.c to its own subsystem.
283 * BUG 12536: s3/smbd: check for invalid access_mask
284 smbd_calculate_access_mask().
285 * BUG 12541: vfs_fruit: checks wrong AAPL config state and so always uses
287 * BUG 12545: s3/rpc_server/mdssvc: add attribute "kMDItemContentType".
288 * BUG 12591: vfs_streams_xattr: use fsp, not base_fsp.
289 * BUG 12604: vfs_fruit: Enabling AAPL extensions must be a global switch.
291 o Amitay Isaacs <amitay@gmail.com>
292 * BUG 12469: ctdb-tests: Use replace headers instead of system headers.
293 * BUG 12547: ctdb-build: Install CTDB tests correctly from toplevel.
294 * BUG 12580: ctdb-common: Fix use-after-free error in comm_fd_handler().
296 o Volker Lendecke <vl@samba.org>
297 * BUG 12551: smbd: Fix "map acl inherit" = yes.
299 o Stefan Metzmacher <metze@samba.org>
300 * BUG 9048: s4:ldap_server: Match Windows in the error messages of failing
302 * BUG 11830: s3:winbindd: Try a NETLOGON connection with noauth over NCACN_NP
303 against trusted domains.
304 * BUG 12262: 'net ads testjoin' and smb access fails after winbindd changed the
306 * BUG 12399: s4:repl_meta_data: Normalize rdn attribute name via the schema.
307 * BUG 12540: s3:smbd: Allow "server min protocol = SMB3_00" to go via "SMB
309 * BUG 12581: smbclient fails on bad endianess when listing shares from
310 Solaris kernel SMB server on SPARC.
311 * BUG 12585: librpc/rpc: fix regression in
312 NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE error mapping.
313 * BUG 12586: libcli/auth: Use the correct creds value against servers without
315 * BUG 12587: winbindd child segfaults on connect to an NT4 domain.
316 * BUG 12588: cm_prepare_connection may return NT_STATUS_OK without a valid
318 * BUG 12598: winbindd (as member) requires Kerberos against trusted ad
319 domain, while it shouldn't.
320 * BUG 12605: s3:winbindd: Fix endless forest trust scan.
322 o Garming Sam <garming@catalyst.net.nz>
323 * BUG 12577: dbcheck-links: Test that dbcheck against one-way links does not
325 * BUG 12600: dbchecker: Stop ignoring linked cases where both objects are
328 o Andreas Schneider <asn@samba.org>
329 * BUG 12571: s3-vfs: Only walk the directory once in open_and_sort_dir().
331 o Martin Schwenke <martin@meltin.net>
332 * BUG 12589: ctdb-scripts: Initialise CTDB_NFS_CALLOUT in statd-callout.
334 o Uri Simchoni <uri@samba.org>
335 * BUG 12529: waf: backport finding of pkg-config.
338 #######################################
339 Reporting bugs & Development Discussion
340 #######################################
342 Please discuss this release on the samba-technical mailing list or by
343 joining the #samba-technical IRC channel on irc.freenode.net.
345 If you do report problems then please try to send high quality
346 feedback. If you don't provide vital information to help us track down
347 the problem then you will probably be ignored. All bug reports should
348 be filed under the Samba 4.1 and newer product in the project's Bugzilla
349 database (https://bugzilla.samba.org/).
352 ======================================================================
353 == Our Code, Our Bugs, Our Responsibility.
355 ======================================================================
358 ----------------------------------------------------------------------
361 =============================
362 Release Notes for Samba 4.5.5
364 =============================
367 This is the latest stable release of the Samba 4.5 release series.
369 Samba 4.5.4 erroneously included a rewrite of the vfs_fruit module.
370 This patchset will be reverted with this release, because it needs to pass the
371 review process first. If you are using the vfs_fruit module, please do not use
377 o Amitay Isaacs <amitay@gmail.com>
378 * BUG 12469: ctdb-locking: Explicitly unlock record/db in lock helper.
380 o Björn Jacke <bj@sernet.de>
381 * BUG 12535: vfs_default: Unlock the right file in copy chunk.
383 o Martin Schwenke <martin@meltin.net>
384 * BUG 12512: ctdb-scripts: Fix remaining uses of "ctdb gratiousarp".
385 * BUG 12516: ctdb-scripts: /etc/iproute2/rt_tables gets populated with multiple
389 #######################################
390 Reporting bugs & Development Discussion
391 #######################################
393 Please discuss this release on the samba-technical mailing list or by
394 joining the #samba-technical IRC channel on irc.freenode.net.
396 If you do report problems then please try to send high quality
397 feedback. If you don't provide vital information to help us track down
398 the problem then you will probably be ignored. All bug reports should
399 be filed under the Samba 4.1 and newer product in the project's Bugzilla
400 database (https://bugzilla.samba.org/).
403 ======================================================================
404 == Our Code, Our Bugs, Our Responsibility.
406 ======================================================================
409 ----------------------------------------------------------------------
412 =============================
413 Release Notes for Samba 4.5.4
415 =============================
418 This is the latest stable release of the Samba 4.5 release series.
424 o Jeremy Allison <jra@samba.org>
425 * BUG 12460: rename_internals_fsp missing ACL permission-check on destination
427 * BUG 12466: lib: security: se_access_check() incorrectly processes owner
428 rights (S-1-3-4) DENY ace entries.
429 * BUG 12467: s3: ntlm_auth: Don't corrupt the output stream with debug
431 * BUG 12479: s3: libsmb: Add cli_smb2_ftruncate(), plumb into
434 o Ralph Boehme <slow@samba.org>
435 * BUG 12396: s3/smbd: Remove a misleading error message.
436 * BUG 12412: vfs_fruit: Fix "fruit:resource" option spelling, but not
438 * BUG 12485: ctdbd_conn: Fix a resource leak.
440 o David Disseldorp <ddiss@samba.org>
441 * BUG 12144: smbd/ioctl: match WS2016 ReFS set compression behaviour.
443 o Björn Jacke <bj@sernet.de>
444 * BUG 2210: pam: Map more NT password errors to PAM errors.
446 o Volker Lendecke <vl@samba.org>
447 * BUG 12484: winbindd: Use idmap cache in xids2sids.
448 * BUG 12509: messaging: Fix dead but not cleaned-up-yet destination sockets.
450 o Stefan Metzmacher <metze@samba.org>
451 * BUG 12480: kinit succeeded but ads_sasl_spnego_gensec_bind(KRB5) failed: An
452 internal error occurred (with MIT krb5).
454 o Andreas Schneider <asn@samba.org>
455 * BUG 12183: printing: Fix building with CUPS version older than 1.7.
456 * BUG 12441: s3:libads: Include system /etc/krb5.conf if we use MIT Kerberos.
458 o Martin Schwenke <martin@meltin.net>
459 * BUG 12470: Fix ctdb ip bugs.
462 #######################################
463 Reporting bugs & Development Discussion
464 #######################################
466 Please discuss this release on the samba-technical mailing list or by
467 joining the #samba-technical IRC channel on irc.freenode.net.
469 If you do report problems then please try to send high quality
470 feedback. If you don't provide vital information to help us track down
471 the problem then you will probably be ignored. All bug reports should
472 be filed under the Samba 4.1 and newer product in the project's Bugzilla
473 database (https://bugzilla.samba.org/).
476 ======================================================================
477 == Our Code, Our Bugs, Our Responsibility.
479 ======================================================================
482 ----------------------------------------------------------------------
485 =============================
486 Release Notes for Samba 4.5.3
488 =============================
491 This is a security release in order to address the following defects:
493 o CVE-2016-2123 (Samba NDR Parsing ndr_pull_dnsp_name Heap-based Buffer
494 Overflow Remote Code Execution Vulnerability).
495 o CVE-2016-2125 (Unconditional privilege delegation to Kerberos servers in
497 o CVE-2016-2126 (Flaws in Kerberos PAC validation can trigger privilege
505 The Samba routine ndr_pull_dnsp_name contains an integer wrap problem,
506 leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name
507 parses data from the Samba Active Directory ldb database. Any user
508 who can write to the dnsRecord attribute over LDAP can trigger this
511 By default, all authenticated LDAP users can write to the dnsRecord
512 attribute on new DNS objects. This makes the defect a remote privilege
516 Samba client code always requests a forwardable ticket
517 when using Kerberos authentication. This means the
518 target server, which must be in the current or trusted
519 domain/realm, is given a valid general purpose Kerberos
520 "Ticket Granting Ticket" (TGT), which can be used to
521 fully impersonate the authenticated user or service.
524 A remote, authenticated, attacker can cause the winbindd process
525 to crash using a legitimate Kerberos ticket due to incorrect
526 handling of the arcfour-hmac-md5 PAC checksum.
528 A local service with access to the winbindd privileged pipe can
529 cause winbindd to cache elevated access permissions.
535 o Volker Lendecke <vl@samba.org>
536 * BUG 12409: CVE-2016-2123: Fix DNS vuln ZDI-CAN-3995.
538 o Stefan Metzmacher <metze@samba.org>
539 * BUG 12445: CVE-2016-2125: Don't send delegated credentials to all servers.
540 * BUG 12446: CVE-2016-2126: auth/kerberos: Only allow known checksum types in
541 check_pac_checksum().
544 #######################################
545 Reporting bugs & Development Discussion
546 #######################################
548 Please discuss this release on the samba-technical mailing list or by
549 joining the #samba-technical IRC channel on irc.freenode.net.
551 If you do report problems then please try to send high quality
552 feedback. If you don't provide vital information to help us track down
553 the problem then you will probably be ignored. All bug reports should
554 be filed under the Samba 4.1 and newer product in the project's Bugzilla
555 database (https://bugzilla.samba.org/).
558 ======================================================================
559 == Our Code, Our Bugs, Our Responsibility.
561 ======================================================================
564 ----------------------------------------------------------------------
567 =============================
568 Release Notes for Samba 4.5.2
570 =============================
573 This is the latest stable release of the Samba 4.5 release series.
579 o Michael Adam <obnox@samba.org>
580 * BUG 12404: vfs:glusterfs: Preallocate result for glfs_realpath.
582 o Jeremy Allison <jra@samba.org>
583 * BUG 12384: s3: vfs: Remove files/directories after the streams are deleted.
584 * BUG 12387: s3: vfs_streams_depot: Use conn->connectpath not conn->cwd.
585 * BUG 12436: s3/smbd: Fix the last resort check that sets the file type
588 o Andrew Bartlett <abartlet@samba.org>
589 * BUG 9954: dsdb: Create RID Set as SYSTEM.
590 * BUG 12297: dbcheck: Correct message for orphaned backlinks.
591 * BUG 12395: build: Fix build with perl on debian sid.
592 * BUG 12398: Fix errors in extended operations (like allocating a RID Set).
594 o Günther Deschner <gd@samba.org>
595 * BUG 11197: spoolss: Use correct values for secdesc and devmode pointers.
597 o Clive Ferreira <cliveferreira@catalyst.net.nz>
598 * BUG 12394: objectclass_attrs: Only abort on a missing attribute when an
599 attribute is both MUST and replicated.
601 o Amitay Isaacs <amitay@gmail.com>
602 * BUG 12366: provision,dlz-bind: Add support for BIND 9.11.x.
603 * BUG 12392: ctdb-locking: Reset real-time priority in lock helper.
604 * BUG 12407: ctdb-scripts: Fix calculation of CTDB_BASE.
605 * BUG 12434: ctdb-recovery: Avoid NULL dereference in failure case.
607 o Stefan Metzmacher <metze@samba.org>
608 * BUG 10297: s3:smbd: Only pass UCF_PREP_CREATEFILE to filename_convert() if
609 we may create a new file.
611 o Mathieu Parent <math.parent@gmail.com>
612 * BUG 12371: ctdb-scripts: Fix Debian init in samba eventscript.
614 o Garming Sam <garming@catalyst.net.nz>
615 * BUG 9954: samba_tool/fsmo: Allocate RID Set when seizing RID manager.
616 * BUG 10882: s4-auth: Don't check for NULL saltPrincipal if it doesn't need
618 * BUG 12297: upgradeprovision: Remove objectCategory from constructed attrs.
619 * BUG 12385: collect_tombstones: Allow links to recycled objects to be
622 o Andreas Schneider <asn@samba.org>
623 * BUG 12183: s3-printing: Correctly encode CUPS printer URIs.
624 * BUG 12195: s3-printing: Allow printer names longer than 16 chars.
625 * BUG 12269: nss_wins: Fix errno values for HOST_NOT_FOUND.
626 * BUG 12405: s3-winbind: Do not return NO_MEMORY if we have an empty user
628 * BUG 12415: s3:spoolss: Add support for COPY_FROM_DIRECTORY in
631 o Martin Schwenke <martin@meltin.net>
632 * BUG 12104: ctdb-packaging: Move CTDB tests to /usr/local/share/ctdb/tests/.
634 o Uri Simchoni <uri@samba.org>
635 * BUG 12375: smbd: In ntlm auth, do not map empty domain in case of
638 o Ralph Wuerthner <ralph.wuerthner@de.ibm.com>
639 * BUG 12372: ctdb-conn: Add missing variable initialization.
642 #######################################
643 Reporting bugs & Development Discussion
644 #######################################
646 Please discuss this release on the samba-technical mailing list or by
647 joining the #samba-technical IRC channel on irc.freenode.net.
649 If you do report problems then please try to send high quality
650 feedback. If you don't provide vital information to help us track down
651 the problem then you will probably be ignored. All bug reports should
652 be filed under the Samba 4.1 and newer product in the project's Bugzilla
653 database (https://bugzilla.samba.org/).
656 ======================================================================
657 == Our Code, Our Bugs, Our Responsibility.
659 ======================================================================
662 ----------------------------------------------------------------------
665 =============================
666 Release Notes for Samba 4.5.1
668 =============================
671 This is the latest stable release of the Samba 4.5 release series.
673 Major enhancements in Samba 4.5.1 include:
675 o Let winbindd discard expired kerberos tickets when built against
676 (internal) heimdal (BUG #12369).
677 o REGRESSION: smbd segfaults on startup, tevent context being freed
684 o Jeremy Allison <jra@samba.org>
685 * BUG 11259: smbd contacts a domain controller for each session.
686 * BUG 12272: Fix messaging subsystem crash.
687 * BUG 12283: REGRESSION: smbd segfaults on startup, tevent context being
689 * BUG 12381: s3: cldap: cldap_multi_netlogon_send() fails with one bad IPv6
691 * BUG 12383: s3: libsmb: Fix cut and paste error using the wrong structure
694 o Christian Ambach <ambi@samba.org>
695 * BUG 9945: Setting specific logger levels in smb.conf makes 'samba-tool drs
698 o Andrew Bartlett <abartlet@samba.org>
699 * BUG 12382: Tombstone expunge does not remove old links.
701 o Björn Baumbach <bb@sernet.de>
702 * BUG 8618: s3-printing: Fix migrate printer code.
704 o Ralph Boehme <slow@samba.org>
705 * BUG 12256: s3/smbd: In call_trans2qfilepathinfo call lstat when dealing
706 with posix pathnames.
707 * BUG 12261: s3/smbd: Set FILE_ATTRIBUTE_DIRECTORY as necessary.
709 o Günther Deschner <gd@samba.org>
710 * BUG 12285: "DriverVersion" registry backend parsing incorrect in spoolss.
712 o David Disseldorp <ddiss@samba.org>
713 * BUG 12144: smbd/ioctl: Match WS2016 ReFS get compression behaviour.
715 o Amitay Isaacs <amitay@gmail.com>
716 * BUG 12259: ctdb-protocol: Fix marshalling for GET_DB_SEQNUM control
718 * BUG 12275: ctdb-recovery-helper: Add missing initialisation of ban_credits.
719 * BUG 12287: CTDB PID file handling is too weak.
721 o Volker Lendecke <vl@samba.org>
722 * BUG 12045: gencache: Bail out of stabilize if we can not get the allrecord
724 * BUG 12268: smbd: Reset O_NONBLOCK on open files.
725 * BUG 12283: glusterfs: Avoid tevent_internal.h.
726 * BUG 12291: source3/lib/msghdr.c, line 208: syntax error before or at: ;.
727 * BUG 12374: spoolss: Fix caching of printername->sharename.
729 o Stefan Metzmacher <metze@samba.org>
730 * BUG 12283: REGRESSION: smbd segfaults on startup, tevent context being
732 * BUG 12369: Let winbindd discard expired kerberos tickets when built against
735 o Noel Power <noel.power@suse.com>
736 * BUG 12298: s3/winbindd: Fix using default domain with user@domain.com
739 o Christof Schmitt <cs@samba.org>
740 * BUG 12295: winbind: Fix passing idmap failure from wb_sids2xids back to
743 o Andreas Schneider <asn@samba.org>
744 * BUG 12269: nss_wins has incorrect function definitions for gethostbyname*.
745 * BUG 12276: s3-lib: Fix %G substitution in AD member environment.
746 * BUG 12364: s3-utils: Fix loading smb.conf in smbcquotas.
748 o Garming Sam <garming@catalyst.net.nz>
749 * BUG 12286: kcc: Don't check schedule if None.
750 * BUG 12382: Tombstone expunge does not remove old links.
752 o Anoop C S <anoopcs@redhat.com>
753 * BUG 12377: vfs_glusterfs: Fix a memory leak in connect path.
755 o Martin Schwenke <martin@meltin.net>
756 * BUG 12254: CTDB IP takeover does not complete if there are no public
757 addresses configured.
758 * BUG 12255: ctdb-packaging: Fix systemd network dependency.
759 * BUG 12287: CTDB PID file handling is too weak.
761 o Uri Simchoni <uri@samba.org>
762 * BUG 12270: smbcquotas: Fix error message listing quotas.
763 * BUG 12273: s3-sysquotas: Correctly restore path when finding mount point.
764 * BUG 12288: cliquota: Fix param count when setting fs quota.
765 * BUG 12289: smbd: Free talloc context if no quota records are available.
766 * BUG 12307: ntquotas: Support "freeing" an empty quota list.
769 #######################################
770 Reporting bugs & Development Discussion
771 #######################################
773 Please discuss this release on the samba-technical mailing list or by
774 joining the #samba-technical IRC channel on irc.freenode.net.
776 If you do report problems then please try to send high quality
777 feedback. If you don't provide vital information to help us track down
778 the problem then you will probably be ignored. All bug reports should
779 be filed under the Samba 4.1 and newer product in the project's Bugzilla
780 database (https://bugzilla.samba.org/).
783 ======================================================================
784 == Our Code, Our Bugs, Our Responsibility.
786 ======================================================================
789 ----------------------------------------------------------------------
792 =============================
793 Release Notes for Samba 4.5.0
795 =============================
798 This is the first stable release of the Samba 4.5 release series.
804 NTLMv1 authentication disabled by default
805 -----------------------------------------
807 In order to improve security we have changed
808 the default value for the "ntlm auth" option from
809 "yes" to "no". This may have impact on very old
810 clients which doesn't support NTLMv2 yet.
812 The primary user of NTLMv1 is MSCHAPv2 for VPNs and 802.1x.
814 By default, Samba will only allow NTLMv2 via NTLMSSP now,
815 as we have the following default "lanman auth = no",
816 "ntlm auth = no" and "raw NTLMv2 auth = no".
822 Support for LDAP_SERVER_NOTIFICATION_OID
823 ----------------------------------------
825 The ldap server has support for the LDAP_SERVER_NOTIFICATION_OID
826 control. This can be used to monitor the Active Directory database
829 KCC improvements for sparse network replication
830 -----------------------------------------------
832 The Samba KCC will now be the default knowledge consistency checker in
833 Samba AD. Instead of using full mesh replication between every DC, the
834 KCC will set up connections to optimize replication latency and cost
835 (using site links to calculate the routes). This change should allow
836 larger domains to function significantly better in terms of replication
837 traffic and the time spent performing DRS replication.
839 VLV - Virtual List View
840 -----------------------
842 The VLV Control allows applications to page the LDAP directory in the
843 way you might expect a live phone book application to operate, without
844 first downloading the entire directory.
846 DRS Replication for the AD DC
847 -----------------------------
849 DRS Replication in Samba 4.5 is now much more efficient in handling
850 linked attributes, particularly in large domains with over 1000 group
851 memberships or other links.
853 Replication is also much more reliable in the handling of tree
854 renames, such as the rename of an organizational unit containing many
855 users. Extensive tests have been added to ensure this code remains
856 reliable, particularly in the case of conflicts between objects added
857 with the same name on different servers.
859 Schema updates are also handled much more reliably.
861 samba-tool drs replicate with new options
862 -----------------------------------------
864 'samba-tool drs replicate' got two new options:
866 The option '--local-online' will do the DsReplicaSync() via IRPC
867 to the local dreplsrv service.
869 The option '--async-op' will add DRSUAPI_DRS_ASYNC_OP to the
870 DsReplicaSync(), which won't wait for the replication result.
872 replPropertyMetaData Changes
873 ----------------------------
875 During the development of the DRS replication, tests showed that Samba
876 stores the replPropertyMetaData object incorrectly. To address this,
877 be aware that 'dbcheck' will now detect and offer to fix all objects in
878 the domain for this error.
880 For further information and instructions how to fix the problem, see
881 https://wiki.samba.org/index.php/Updating_Samba#Fixing_replPropertyMetaData_Attributes
883 Linked attributes on deleted objects
884 ------------------------------------
886 In Active Directory, an object that has been tombstoned or recycled
887 has no linked attributes. However, Samba incorrectly maintained such
888 links, slowing replication and run-time performance. 'dbcheck' now
889 offers to remove such links, and they are no longer kept after the
890 object is tombstoned or recycled.
892 Improved AD DC performance
893 --------------------------
895 Many other improvements have been made to our LDAP database layer in
896 the AD DC, to improve performance, both during 'samba-tool domain
897 provision' and at runtime.
899 Other dbcheck improvements
900 --------------------------
902 - 'samba-tool dbcheck' can now find and fix a missing or corrupted
903 'deleted objects' container.
904 - BUG 11433: samba-dbcheck no longer offers to resort auxiliary class values
905 in objectClass as these were then re-sorted at the next dbcheck indefinitely.
907 Tombstone Reanimation
908 ---------------------
910 Samba now supports tombstone reanimation, a feature in the AD DC
911 allowing tombstones, that is objects which have been deleted, to be
912 restored with the original SID and GUID still in place.
914 Multiple DNS Forwarders on the AD DC
915 ------------------------------------
917 Previously, the Samba internal DNS server supported only one DNS forwarder.
918 The "dns forwarder" option has been enhanced and now supports a space-separated
919 list of multiple DNS server IP addresses. As a result, Samba is now able to
920 fall back to alternative DNS servers. In case that a DNS query to the first
921 server timed out, it is sent to the next DNS server listed in the option.
923 Password quality plugin support in the AD DC
924 --------------------------------------------
926 The check password script now operates correctly in the AD DC.
928 pwdLastSet is now correctly honoured
929 ------------------------------------
931 BUG 9654: The pwdLastSet attribute is now correctly handled (this previously
932 permitted passwords that expire next).
934 net ads dns unregister
935 ----------------------
937 It is now possible to remove the DNS entries created with 'net ads register'
938 with the matching 'net ads unregister' command.
940 samba-tool improvements
941 ------------------------
943 Running 'samba-tool' on the command line should now be a lot snappier. The tool
944 now only loads the code specific to the subcommand that you wish to run.
946 SMB 2.1 Leases enabled by default
947 ---------------------------------
949 Leasing is an SMB 2.1 (and higher) feature which allows clients to
950 aggressively cache files locally above and beyond the caching allowed
951 by SMB 1 oplocks. This feature was disabled in previous releases, but
952 the SMB2 leasing code is now considered mature and stable enough to be
955 Open File Description (OFD) Locks
956 ---------------------------------
958 On systems that support them (currently only Linux), the fileserver now
959 uses Open File Description (OFD) locks instead of POSIX locks to implement
960 client byte range locks. As these locks are associated with a specific
961 file descriptor on a file this allows more efficient use when multiple
962 descriptors having file locks are opened onto the same file. An internal
963 tunable "smbd:force process locks = true" may be used to turn off OFD
964 locks if there appear to be problems with them.
966 Password sync as Active Directory domain controller
967 ---------------------------------------------------
969 The new commands 'samba-tool user getpassword'
970 and 'samba-tool user syncpasswords' provide
971 access and syncing of various password fields.
973 If compiled with GPGME support (--with-gpgme) it's
974 possible to store cleartext passwords in a PGP/OpenGPG
975 encrypted form by configuring the new "password hash gpg key ids"
976 option. This requires gpgme devel and python packages to be installed
977 (e.g. libgpgme11-dev and python-gpgme on Debian/Ubuntu).
979 Python crypto requirements
980 --------------------------
982 Some 'samba-tool' subcommands require python-crypto and/or
983 python-m2crypto packages to be installed.
985 SmartCard/PKINIT improvements
986 -----------------------------
988 'samba-tool user create' accepts "--smartcard-required"
989 and 'samba-tool user setpassword' accepts "--smartcard-required"
990 and "--clear-smartcard-required".
992 Specifying "--smartcard-required" results in the UF_SMARTCARD_REQUIRED
993 flags being set in the userAccountControl attribute.
994 At the same time, the account password is reset to a random
997 Interactive password logons are rejected, if the UF_SMARTCARD_REQUIRED
998 bit is set in the userAccountControl attribute of a user.
1000 When doing a PKINIT based Kerberos logon the KDC adds the
1001 required PAC_CREDENTIAL_INFO element to the authorization data.
1002 That means the NTHASH is shared between the PKINIT based client and
1003 the domain controller, which allows the client to do NTLM based
1004 authentication on behalf of the user. It also allows an offline
1005 logon using a smartcard to work on Windows clients.
1010 * New improved 'ctdb tool'
1012 'ctdb tool' has been completely rewritten using new client API.
1013 Usage messages are much improved.
1015 * Sample CTDB configuration file is installed as ctdbd.conf.
1017 * The use of real-time scheduling when taking locks has been narrowed
1018 to limit potential performance impacts on nodes.
1020 * CTDB_RECOVERY_LOCK now supports specification of an external helper
1021 to take and hold the recovery lock.
1023 See the RECOVERY LOCK section in ctdb(7) for details. Documentation
1024 for writing helpers is provided in doc/cluster_mutex_helper.txt.
1026 * "ctdb natgwlist" has been replaced by a top level "ctdb natgw"
1027 command that has "master", "list" and "status" subcommands.
1029 * The 'onnode' command no longer supports the "recmaster", "lvs" and
1030 "natgw" node specifications.
1032 * Faster resetting of TCP connections to public IP addresses during
1035 * Tunables MaxRedirectCount, ReclockPingPeriod,
1036 DeferredRebalanceOnNodeAdd are now obsolete/ignored.
1038 * "ctdb listvars" now lists all variables, including the first one.
1040 * "ctdb xpnn", "ctdb rebalanceip" and "ctdb rebalancenode" have been
1043 These are not needed because "ctdb reloadips" should do the correct
1046 * Output for the following commands has been simplified:
1056 These now simply print the requested output with no preamble. This
1057 means that scripts no longer need to strip part of the output.
1059 "ctdb getreclock" now prints nothing when the recovery lock is not
1062 * Output for the following commands has been improved:
1067 * 'ctdb process-exists' has been updated to only take a PID argument.
1069 The PNN can be specified with -n <PNN>. Output also cleaned up.
1071 * LVS support has been reworked - related commands and configuration
1072 variables have changed.
1074 'ctdb lvsmaster' and 'ctdb lvs' have been replaced by a top level
1075 'ctdb lvs' command that has 'master', 'list' and 'status'
1078 See the LVS sections in ctdb(7) and ctdbd.conf(5) for details,
1079 including configuration changes.
1081 * Improved sample NFS Ganesha call-out.
1083 New shadow_copy2 options
1084 ------------------------
1088 With growing number of snapshots file-systems need some mechanism to
1089 differentiate one set of snapshots from other, e.g. monthly, weekly, manual,
1090 special events, etc. Therefore, these file-systems provide different ways to tag
1091 snapshots, e.g. provide a configurable way to name snapshots, which is not just
1092 based on time. With only shadow:format it is very difficult to filter these
1093 snapshots. With this optional parameter, one can specify a variable prefix
1094 component for names of the snapshot directories in the file-system. If this
1095 parameter is set, together with the shadow:format and shadow:delimiter
1096 parameters it determines the possible names of snapshot directories in the
1097 file-system. The option only supports Basic Regular Expression (BRE).
1101 This optional parameter is used as a delimiter between "shadow:snapprefix" and
1102 "shadow:format". This parameter is used only when "shadow:snapprefix" is set.
1104 Default: shadow:delimiter = "_GMT"
1110 "only user" and "username" parameters
1111 -------------------------------------
1113 These two parameters have long been deprecated and superseded by
1114 "valid users" and "invalid users".
1120 Parameter Name Description Default
1121 -------------- ----------- -------
1122 kccsrv:samba_kcc Changed default yes
1123 ntlm auth Changed default no
1125 password hash gpg key ids New
1126 shadow:snapprefix New
1127 shadow:delimiter New _GMT
1128 smb2 leases Changed default yes
1135 While a lot of schema replication bugs were fixed in this release
1136 Bug 12204 - Samba fails to replicate schema 69
1137 (https://bugzilla.samba.org/show_bug.cgi?id=12204) is still open.
1138 The replication fails if more than 133 schema objects are added
1141 More open bugs are listed at:
1142 https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.5#All_bugs
1145 CHANGES SINCE 4.5.0rc3
1146 ======================
1148 o Björn Baumbach <bb@sernet.de>
1149 * BUG 12194: idmap_script: fix missing "IDTOSID" argument in scripts
1152 o Andrew Bartlett <abartlet@samba.org>
1153 * BUG 12178: samba-tool dbcheck fails to fix replPropertyMetaData.
1155 o Ralph Boehme <slow@samba.org>
1156 * BUG 12177: Unexpected synthesized default ACL from vfs_acl_xattr.
1157 * BUG 12181: vfs_acl_common not setting filesystem permissions anymore.
1158 * BUG 12184: Loading shared RPC modules failed.
1160 o Günther Deschner <gd@samba.org>
1161 * BUG 12245: fix _spoolss_GetPrinterDataEx by moving the keyname
1164 o Stefan Metzmacher <metze@samba.org>
1165 * BUG 11994: smbclient fails to connect to Azure or Apple share spnego
1166 fails with no mechListMIC.
1168 o Martin Schwenke <martin@meltin.net>
1169 * BUG 12180: CTDB crashes running eventscripts.
1172 CHANGES SINCE 4.5.0rc2
1173 ======================
1175 o Michael Adam <obnox@samba.org>
1176 * BUG 12155: Some idmap backends don't perform range checks for the result
1179 o Jeremy Allison <jra@samba.org>
1180 * BUG 12115: Endless loop on drsuapi pull replication after schema changes.
1181 * BUG 12135: net ads gpo refresh can crash with null pointer deref..
1182 * BUG 12139: Race between break oplock and check for share_mode.
1183 * BUG 12150: SMB2 snapshot query fails on DFS shares..
1184 * BUG 12165: smbclient allinfo doesn't correctly return 'previous version'
1186 * BUG 12166: smbclient allinfo doesn't correctly return 'previous version'
1188 * BUG 12174: error: 'conn' undeclared.
1190 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
1191 * BUG 12143: misnamed attribute in samba_kcc causes exception in unusual
1193 * BUG 12187: Backport changes for partial attribute set calculation
1196 o Andrew Bartlett <abartlet@samba.org>
1197 * BUG 12107: backport backupkey tests.
1198 * BUG 12115: Endless loop on drsuapi pull replication after schema changes.
1199 * BUG 12128: Correctly resolve replicated schema changes regarding linked
1202 o Amitay Isaacs <amitay@gmail.com>
1203 * BUG 12137: Fix printf format non-liternal warnings and printf
1205 * BUG 12138: Fix uninitialized timeout in ctdb_pmda.
1206 * BUG 12151: Drop resurrected ctdb commands in new ctdb tool.
1207 * BUG 12152: Fix ctdb addip; implementation to match ctdb delip.
1208 * BUG 12163: Fix missing arguments and format elements in format strings.
1209 * BUG 12168: Fix format-nonliteral warnings.
1211 o Stefan Metzmacher <metze@samba.org>
1212 * BUG 12108: Backport selftest/autobuild fixes to v4-5-test.
1213 * BUG 12114: In memory schema updated on non schema master.
1214 * BUG 12115: Endless loop on drsuapi pull replication after schema changes.
1215 * BUG 12128: Correctly resolve replicated schema changes regarding
1217 * BUG 12129: let samba-tool ldapcmp ignore whenChanged.
1219 o Garming Sam <garming@catalyst.net.nz>
1220 * BUG 12187: Backport changes for partial attribute set calculation
1223 o Andreas Schneider <asn@samba.org>
1224 * BUG 12175: smbget always prompts for a username.
1226 o Christof Schmitt <cs@samba.org>
1227 * BUG 12150: SMB2 snapshot query fails on DFS shares..
1229 o Martin Schwenke <martin@meltin.net>
1230 * BUG 12157: Coverity and related fixes.
1231 * BUG 12158: CTDB release IP fixes.
1232 * BUG 12161: Fix CTDB cumulative takeover timeout.
1233 * BUG 12170: CTDB test runs can kill each other's ctdbd daemons.
1235 o Uri Simchoni <uri@samba.org>
1236 * BUG 12145: smbd: if inherit owner is enabled, the free disk on a folder
1237 should take the owner's quota into account.
1238 * BUG 12149: smbd: cannot load a Windows device driver from a Samba share
1240 * BUG 12172: a snapshot folder cannot be accessed via SMB1.
1243 CHANGES SINCE 4.5.0rc1
1244 ======================
1246 o Ralph Boehme <slow@samba.org>
1247 * BUG 12005: parse_share_modes() chokes on ctdb tombstone record from ltdb.
1248 * BUG 12105: smbclient connection to not reachable IP eats 100% CPU.
1250 o Ira Cooper <ira@samba.org>
1251 * BUG 12133: source3/wscript: Add support for disabling vfs_cephfs.
1253 o Amitay Isaacs <amitay@gmail.com>
1254 * BUG 12121: ctdb-tools: Fix numerous Coverity IDs and other issues.
1255 * BUG 12122: If a transaction fails, it should be canceled and transaction
1256 handle should be freed.
1257 * BUG 12134: dbwrap: Fix structure initialization.
1259 o Marc Muehlfeld <mmuehlfeld@samba.org>
1260 * BUG 12023: man: Fix wrong option for parameter "ldap ssl" in smb.conf
1263 o Andreas Schneider <asn@samba.org>
1264 * BUG 12104: ctdb-waf: Move ctdb tests to libexec directory.
1266 o Martin Schwenke <martin@meltin.net>
1267 * BUG 12104: ctdb-packaging: Move ctdb tests to libexec directory.
1268 * BUG 12109: Fixes several CTDB tests.
1269 * BUG 12110: Fix numerous Coverity IDs.
1270 * BUG 12113: ctdb-mutex: Avoid corner case where helper is already
1272 * BUG 12123: Fix ctdb tickle command and update documentation.
1273 * BUG 12125: CTDB overwrites working configuration due to packaging
1275 * BUG 12126: Fix broken CTDB log messages.
1278 #######################################
1279 Reporting bugs & Development Discussion
1280 #######################################
1282 Please discuss this release on the samba-technical mailing list or by
1283 joining the #samba-technical IRC channel on irc.freenode.net.
1285 If you do report problems then please try to send high quality
1286 feedback. If you don't provide vital information to help us track down
1287 the problem then you will probably be ignored. All bug reports should
1288 be filed under the Samba 4.1 and newer product in the project's Bugzilla
1289 database (https://bugzilla.samba.org/).
1292 ======================================================================
1293 == Our Code, Our Bugs, Our Responsibility.
1295 ======================================================================