1 WHATS NEW IN Samba 3.0.0RC4
3 ==============================
5 This is the fourth release candidate snapshot of Samba 3.0.0. A release
6 candidate implies that the code is very close to a final release, remember
7 that this is still a non-production release intended for testing purposes.
10 The purpose of this release candidate is to get wider testing of the major
11 new pieces of code in the current Samba 3.0 development tree.
12 Please refer to the section on "Known Issues" for more details.
18 1) Active Directory support. Samba 3.0 is now able to
19 join a ADS realm as a member server and authenticate
20 users using LDAP/Kerberos.
22 2) Unicode support. Samba will now negotiate UNICODE on the wire and
23 internally there is now a much better infrastructure for multi-byte
24 and UNICODE character sets.
26 3) New authentication system. The internal authentication system has
27 been almost completely rewritten. Most of the changes are internal,
28 but the new auth system is also very configurable.
30 4) New default filename mangling system.
32 5) A new "net" command has been added. It is somewhat similar to
33 the "net" command in windows. Eventually we plan to replace
34 numerous other utilities (such as smbpasswd) with subcommands
37 6) Samba now negotiates NT-style status32 codes on the wire. This
38 improves error handling a lot.
40 7) Better Windows 2000/XP/2003 printing support including publishing
41 printer attributes in active directory.
43 8) New loadable module support for passdb backends and
46 9) New default dual-daemon winbindd support for better performance.
48 10) Support for migrating from a Windows NT 4.0 domain to a Samba
49 domain and maintaining user, group and domain SIDs.
51 11) Support for establishing trust relationships with Windows NT 4.0
54 12) Initial support for a distributed Winbind architecture using
55 an LDAP directory for storing SID to uid/gid mappings.
57 13) Major updates to the Samba documentation tree.
59 14) Full support for client and server SMB signing to ensure
60 compatibility with default Windows 2003 security settings.
62 Plus lots of other improvements!
65 Additional Documentation
66 ------------------------
68 Please refer to Samba documentation tree (included in the docs/
69 subdirectory) for extensive explanations of installing, configuring
70 and maintaining Samba 3.0 servers and clients. It is advised to
71 begin with the Samba-HOWTO-Collection for overviews and specific
72 tasks (the current book is up to approximately 400 pages) and to
73 refer to the various man pages for information on individual options.
75 We are very glad to be able to include the second edition of
76 "Using Samba" by Jay Ts, Robert Eckstein, and David Collier-Brown
77 (O'Reilly & Associates) in this release. The book is available
78 on-line at http://samba.org/samba/docs/ and is included with
79 the Samba Web Administration Tool (SWAT). Thanks to the authors and
80 publisher for making "Using Samba" under the GNU Free Documentation
84 ######################################################################
88 Please refer to the CVS log for the SAMBA_3_0 branch for complete
91 1) Fix incorrect error message in testparm.c regarding 'map system'.
92 2) Protect against core dump if ioctl for print job sends invalid
94 3) Fix bug in generic hash cacluation.
95 4) Remove references to unused 'strip dot' parameter
96 5) Fix CPU burn bug in multi-byte character conversion.
97 6) Use opt_target_workgroup instead of lp_workgroup() in vampire
98 code so we can override the value in smb.conf with the -w option.
99 7) Display an error if we can't create a posix account for the
100 user when running 'net rpc vampire' (bug 323).
101 8) Fix UTF8 conversion bugs in LDAP passdb and idmap code (bug 296).
102 9) Fix smbd crash when changing the machine trust account password
104 10) Remove getpwnam() calls from init_sam_from_xxx(). This means
105 that %u & %g will no longer expand in the "login ..." set of
106 smb.conf options, but %U and %G still do. The payback is that
107 winbindd local accounts for users work with 'wbinfo -u'
108 when winbind is running on a Samba PDC.
109 11) Fix unitiailized timestamp where merging print_jobs and
116 1) Remove Perl module dependencies in generated RedHat 8/9 RPMS.
117 2) Update mount helper to take synonyms for file_mode and
118 dir_mode (fmask and dmask).
119 3) Fix portability bug with log2pcaphex.
120 4) Use different algorithm to generate codepages source code which
121 allows to take gaps into account thus making unnecessary
122 extended [index] = value, syntax in to_ucs2 array (bug 380).
123 5) Fix comment strings to 43 bytes as per spec.
124 6) Fix pam_winbind compile bug on FreeBSD (bug 261).
125 7) Support for in-memory keytabs, which are needed to make heimdal
126 work properly. MIT does not support them, so this check will be
127 used to decide whether to use them. (partial fix for bug 372).
128 8) Disable RC4-HMAC on broken heimdal setups. (remainder of bug
130 9) Correct bug in smbclient that resulted in errors when untarring
131 long filenames (bug 308).
132 10) Improve autoconf checks for PAM header files and libs.
133 11) Added fast path to convert_string() when dealing with
134 ASCII->ASCII, UCS2-LE->ASCII, and ASCII->UCS2-LE with
136 12) Quiet debug messages when we don't find a module and it is not
137 a critical error (bug 375).
138 13) Fix UNIX passwd sync properly.
139 14) Fix more transitive trust issues in winbindd (bug 305).
140 15) Ensure that winbindd functions with 'disable netbios = yes'
141 16) Store the real short domain name in secrets.tdb as soon as we
142 know it. Also display an error message when joining an AD
143 domain and the 'workgroup' parameter has not been specified.
144 17) Return 0 DFS links instead of -1 when dfs support is not enabled.
145 18) Update LDAP schema for Netscape DS 4.x and Novell eDirectory 8.7
146 19) Ensure that name types can be specified using name#type notation
147 in the 'net' command (bug 73).
148 20) Add retry looks to ADS sequence number and domain SID lookups
150 21) use a variant of alloc_sub_basic() for string lists such as
151 'valid users', 'write list', and 'read list' (bug 397).
152 22) Fix seg fault when winbindd receives an error from the AD server
153 in response to an LDAP search (bug 282).
154 23) Update findsmb to use the new syntax for smbclient and nmblookup.
155 24) Fix bug that prevented variables from being used in explicitly
156 defined path in [homes].
157 25) Only set SIDs when they're returned by the MySQL query
159 26) Include support for NTLMv2 key exchange.
160 27) Revert default for 'client ntlmv2 auth' to off (bug 359).
161 28) Fix crash in winbindd when the trust account password gets
162 changed underneath us via 'net rpc changetrustpw' (bug 382).
163 29) Use djb-algorithm string hash - faster than the tdb one we
164 used to use. Does not change on disk format or hashing location.
165 30) Implements some kind of improved AFS support for Samba on
166 Linux with OpenAFS 1.2.10. './configure --with-fake-kaserver'
167 assumes that you have OpenAFS on your machine.
168 31) When enumerating dfs shares loop from 0 to lp_numservices() instead
169 of relying on lp_servicename(n) to return an empty string for
170 invalid service numbers (bug 403).
171 32) Fix crash bug in 'net rpc samdump' (bug 334).
172 33) Fix crash bug in WINS NSS module (bug 299).
173 34) Fix a few minor compile errors on HP-UX.
180 1) Add levels 261 and 262 to search. Found using Samba4 tester.
181 2) Correct bad error return code in session setup reply
182 3) Fix bug where smbd returned DOS error codes from SMBsearch
183 even when NT1 protocol was negotiated.
184 4) Implement SMBexit properly.
185 5) Return group lists from a Samba PDC to a Windows 9x/ME box
186 in implementing user level access control (bug 314).
187 6) Prevent SWAT from crashing when adding shares (bug 254)
188 7) Fix various documentation issues (bugs 304 & 214)
189 8) Fix wins server listing in SWAT (bug 197)
190 9) Fix problem in rpcclient that caused enumerating printer
191 drivers to report failure (bug 294).
192 10) Use kerberos 5 authentication in our client code whenever possible
193 11) Fix schannel bug that caused Active Directory DC's to downgrade our
194 machine account to an NT member.
195 12) Implement missing SAMR_REMOVE_USER_FOREIGN_DOMAIN call (bug 252).
196 13) Implement automatic generation of include/version.h
197 14) Include initial version of smbldap-tool scripts for the Samba
199 15) Implement numerous fixes for multi-byte character strings.
200 16) Enable 'unix extensions' parameter by default.
201 17) Make sure we set the SID type when falling back to the rid
203 18) Correct linking problems with pam_smbpass (bug 327).
204 19) Add SYSV defines for Irix and Solaris to ensure the 'printing'
205 parameter default to the correct value (bug 230)
206 20) Fix recursion bug in alloc_string_sub() (bug 289, et. al.)
207 21) Ensure that 'make install' includes the static and shared
208 versions of the libsmbclient libraries.
209 22) Add CP850 and CP437 internal character set support (bug 150).
210 23) Add support to examples/LDAP/convertSambaAccount for generating
211 LDIF modify files instead of just add (303).
212 24) Fix support for -W option in smbclient (bug 39)
213 25) Remove 'ldap trust ids' parameter since it could not be supported
214 by the current architecture.
215 26) Don't crash when no argument is given to -T in smbclient (bug 345).
216 27) Ensure smbadduser contains the same paths for the smbpasswd file
217 as the other Samba tools (bug 290).
218 28) Port of 'available = no' fix for [homes] from SAMBA_2_2 cvs tree.
219 29) Add sanity checks to DeletePrinterData[Ex]() and ensure that the
220 modified printer is written to disk.
221 30) Force winbindd to periodically update the trusted domain cache.
222 31) Remove outdated import/export script to convert an smbpasswd file
223 to and from and LDAP directory. Use the pdbedit tool instead.
224 32) Ensure that %U substitution is restored on next valid packet
228 Changes since 3.0beta3
229 ######################
231 1) Various memory leak fixes.
232 2) Provide full support for SMB signing (server and client)
233 3) Check for broken getgrouplist() in glibc.
234 4) Don't get stuck in an infinite loop listing directories
235 recursively if the server returns an empty directory name
237 5) Idle LDAP connections after 150 seconds.
238 6) Patched make uninstallmodules (bug 236).
239 7) Fix bug that caused smbd to return incomplete directory listings
240 when UNIX files contained MS wildcard characters.
241 8) Quiet default debug messages in command line tools.
242 9) Fixes to avoid panics on invalid multi-byte strings.
243 10) Fix error messages when creating a new smbpasswd file (bug 198).
244 11) Implemented better detection routines in autoconf scripts for
245 locating ads support on the host OS.
246 12) Fix bug that caused libraries in /usr/local/lib to be ignored
248 13) Ensure winbindd_ads uses the correct realm or domain name when
249 connecting to trusted DC.
250 14) Ensure a correct prototype is created for snprintf() (bug 187)
251 15) Stop files being created on read-only shares in some circumstances.
252 16) Fix wbinfo -p (bug 251)
253 17) Support schannel on any tcp/ip connection if necessary
254 18) Correct bug in user_in_list() so that it works with winbind groups
256 19) Ensure the schannel bind credentials default to the domain
257 of the destination host.
258 20) Default password expiration time in account_pol.tdb to never
259 expire. Remove any existing account_pol.tdb file to reset
260 the new default policy (bug 184).
261 21) Add buttons to SWAT to change the view of smb.conf (bug 212)
262 22) Fix incorrect checks that determine whether or not the 'add user
263 script' has been set.
264 23) More cleanup for internal character set conversions.
265 24) Fixes for multi-byte strings in stat cache code.
266 25) Ensure that the net command honors the 'workgroup' parameter
267 in smb.conf when not overridden from the command line.
268 26) Add gss-spnego support to the ntlm_auth tool.
269 27) Add vfs_default_quota VFS module.
270 28) Added server support for NT quota interfaces.
271 29) Prevent Krb5 replay attacks by adding a replay_cache.
272 30) Fix problems with winbindd and transitive trusts in AD domains.
273 31) Added -S to client tools for setting SMB signing options on the
275 32) Fix bug causing the 'passwd change program' to be called as the
276 connected user and not root.
277 33) Fixed data corruption bug in byte-range locking (e.g. affected MS Excel).
278 34) Support winbindd on FreeBSD is possible.
279 35) Look at only the first OID in the security blob sent in the session
280 setup request to determine the token type.
281 36) Only push locks onto a blocking lock queue if the posix lock failed with
282 EACCES or EAGAIN (this means another lock conflicts). Else return an
283 error and don't queue the request.
284 37) Fix command line argument processing for smbtar.
285 38) Correct issue that caused smbd to return generic unix_user.<uid>
287 39) Default to algorithmic mapping when generating a rid for a group
289 40) Expand %g and %G in logon script, profile path, etc... during
290 a domain logon (bug 208).
291 41) Make sure smbclient obeys '-s <config>'
292 42) Added win2k3 shadow copy operations to VFS interface.
293 43) Allow connections to samba domain member as SERVER\user (don't
294 always default to DOMAIN\user).
295 44) Remove checks in winbindd that caused it to attempt to use
296 non-transitive trust relationships.
297 45) Remove delays in winbindd caused by invalid DNS lookups.
298 46) Fix supplementary group memberships on systems with slightly
299 broken NSS implementations (bug 267).
300 47) Correct issue that prevented smbclient from viewing shares on
301 a win2k server when using a non-anonymous connection (bug 284).
302 48) Add --domain=DOMAIN_NAME to wbinfo for limiting operations like
303 'wbinfo -u' to a single domain. The '.' character represents
305 49) Fix group enumeration bug when using an LDAP directory for
306 storing group mappings.
307 50) Default to use NTLMv2 if available. Fallback to not use LM/NTLM
308 when the extended security capability bit is not set.
309 51) Fix crash in 'wbinfo -a' when using extended characters in the
311 52) Fix multi-byte strupper() panics (bug 205).
312 53) Add vfs_readonly VFS module.
313 54) Make sure to initialize the sambaNextUserRid and sambaNextGroupRid
314 attributes when using 'idmap backend = ldap' (bug 280).
315 55) Make sure that users shared between a Samba PDC and member
316 samba server are seen as domain users and not local users on the
318 56) Fix Query FS Info level 2.
319 57) Allow enumeration of users and groups by win9x "file server" (bug
321 58) Create symlinks during install for modules that support mutliple
323 59) More iconv detection fixes.
324 60) Fix path length error in vfs_recycle module (bug 291).
325 61) Added server support for the LSA_DS UUID on the \lsarpc pipe.
326 (server DsRoleGetPrimaryDomainInfo() is currently disabled).
327 62) Fix SMBseek and get/set position calls.
328 62) Fix SetFileInfo level 1.
329 63) Added tool to convert smbd log file to a pcap file (log2pcaphex).
333 Changes since 3.0beta2
334 ######################
336 1) Added fix for Japanese case names in statcache code;
337 these can change size on upper casing.
338 2) Correct issues with iconv detection in configure script
339 (support needed to find iconv libraries on FreeBSD).
340 3) Fix bug that caused a WINS server to be marked as dead
341 incorrectly (bug #190).
342 4) Removing additional deadlocks conditions that prevented
343 winbindd from running on a Samba PDC (used for trust
345 5) Add support for searching for Active Directory for
346 published printers (net ads printer search).
347 6) Separate UNIX username from DOMAIN\username in pipe
349 7) Auth modules now support returning NT_STATUS_NOT_IMPLEMENTED
350 for cases that they cannot handle.
351 8) Flush winbindd connection cache when the machine trust account
352 password is changed while a connection is open (bug #200).
353 9) Add support for 'OSVersion' server printer data string
354 (corrects problem with uploading printer drivers from
356 10) Numerous memory leak fixes.
357 11) LDAP fixes ("passdb backend = ldapsam" & "idmap backend = ldap"):
358 - Store domain SID in LDAP directory.
359 - store idmap information in existing entries (use sambaSID=...
360 if adding a new entry).
361 12) Fix incorrect usage of primary group SID when looking up user
363 13) Remove idmap_XX_to_XX calls from smbd. Move back to the the
364 winbind_XXX and local_XXX calls used in 2.2.
365 14) All uid/gid allocation must involve winbindd now (we do not
366 attempt to map unknown SIDs to a UNIX identify).
367 15) Add 'winbind trusted domains only' parameter to force a domain
368 member. The server to use matching users names from /etc/passwd
369 for its domain (needed for domain member of a Samba domain).
370 16) Rename 'idmap only' to 'enable rid algorithm' for better clarity
372 17) Add support for multi-byte statcache code (bug #185)
373 18) Fix open mode race condition.
374 19) Implement winbindd local account management functions. Refer to
375 the "Winbind Changes" section for details.
376 20) Move RID allocation functions into idmap backend.
377 21) Fix parsing error that prevented publishing printers from a
378 Samba server in an AD domain.
379 22) Revive NTLMSSP support for named pipes.
380 23) More SCHANNEL fixes.
381 24) Correct SMB signing with NTLMSSP.
382 25) Fix coherency bug in print handle/printer object caching code
383 that could cause XP clients to infinitely loop while updating
384 their local printer cache.
385 26) Make winbindd use its dual-daemon mode by default (use -Y to
386 start as a single process).
387 27) Add support to nmbd and winbindd for 'smbcontrol <pid>
389 28) Correct problem with smbtar when dealing with files > 8Gb
394 Changes since 3.0beta1
395 ######################
397 1) Rework our smb signing code again, this factors out some of
398 the common MAC calculation code, and now supports multiple
399 outstanding packets (bug #40).
400 2) Enforce 'client plaintext auth', 'client lanman auth' and 'client
402 3) Correct timestamp problem on 64-bit machines (bug #140).
403 4) Add extra debugging statements to winbindd for tracking down
405 5) Fix bug when aliased 'winbind uid/gid' parameters are used.
406 ('winbind uid/gid' are now replaced with 'idmap uid/gid').
407 6) Added an auth flag that indicates if we should be allowed
408 to fall back to NTLMSSP for SASL if krb5 fails.
409 7) Fixed the bug that forced us not to use the winbindd cache when
410 we have a primary ADS domain and a secondary (trusted) NT4
412 8) Use lp_realm() to find the default realm for 'net ads password'.
413 9) Removed editreg from standard build until it is portable..
414 10) Fix domain membership for servers not running winbindd.
415 11) Correct race condition in determining the high water mark
416 in the idmap backend (bug #181).
417 12) Set the user's primary unix group from usrmgr.exe (partial
419 13) Show comments when doing 'net group -l' (bug #3).
420 14) Add trivial extension to 'net' to dump current local idmap
421 and restore mappings as well.
422 15) Modify 'net rpc vampire' to add new and existing users to
423 both the idmap and the SAM. This code needs further testing.
424 16) Fix crash bug in ADS searches.
425 17) Build libnss_wins.so as part of nsswitch target (bug #160).
426 18) Make net rpc vampire return an error if the sam sync RPC
428 19) Fail to join an NT 4 domain as a BDC if a workstation account
429 using our name exists.
430 20) Fix various memory leaks in server and client code
431 21) Remove the short option to --set-auth-user for wbinfo (-A) to
432 prevent confusion with the -a option (bug #158).
433 22) Added new 'map acl inherit' parameter.
434 23) Removed unused 'privileges' code from group mapping database.
435 24) Don't segfault on empty passdb backend list (bug #136).
436 25) Fixed acl sorting algorithm for Windows 2000 clients.
437 26) Replace universal group cache with netsamlogon_cache
438 from APPLIANCE_HEAD branch.
439 27) Fix autoconf detection issues surrounding --with-ads=yes
440 but no Krb5 header files installed (bug #152).
441 28) Add LDAP lookup for domain sequence number in case we are
442 joined using NT4 protocols to a native mode AD domain.
443 29) Fix backend method selection for trusted NT 4 (or 2k
445 30) Fixed bug that caused us to enumerate domain local groups
446 from native mode AD domains other than our own.
447 31) Correct group enumeration for viewing in the Windows
448 security tab (bug #110).
449 32) Consolidate the DC location code.
450 33) Moved 'ads server' functionality into 'password server' for
451 backwards compatibility.
452 34) Fix winbindd_idmap tdb upgrades from a 2.2 installation.
453 ( if you installed beta1, be sure to
454 'mv idmap.tdb winbindd_idmap.tdb' ).
455 35) Fix pdb_ldap segfaults, and wrong default values for
457 36) Enable negative connection cache for winbindd's ADS backend
459 37) Enable address caching for active directory DC's so we don't
460 have to hit DNS so much.
461 38) Fix bug in idmap code that caused mapping to randomly be
463 39) Add tdb locking code to prevent race condition when adding a
464 new mapping to idmap.
465 40) Fix 'map to guest = bad user' when acting as a PDC supporting
467 41) Prevent deadlock issues when running winbindd on a Samba PDC
468 to handle allocating uids & gids for trusted users and groups
469 42) added LOCALE patch from Steve Langasek (bug #122).
470 43) Add the 'guest' passdb backend automatically to the end of
471 the 'passdb backend' list if 'guest account' has a valid
473 44) Remove samstrict_dc auth method. Rework 'samstrict' to only
474 handle our local names (or domain name if we are a PDC).
475 Move existing permissive 'sam' method to 'sam_ignoredomain'
476 and make 'samstrict' the new default 'sam' auth method.
477 45) Match Windows NT4/2k behavior when authenticating a user with
478 and unknown domain (default to our domain if we are a DC or
479 domain member; default to our local name if we are a
481 46) Fix Get_Pwnam() to always fall back to lookup 'user' if the
482 'DOMAIN\user' lookup fails. This matches 2.2. behavior.
483 47) Fix the trustdom_cache code to update the list of trusted
484 domains when operating as a domain member and not using
486 48) Remove 'nisplussam' passdb backend since it has suffered for
487 too long without a maintainer.
492 ######################################################################
493 Upgrading from a previous Samba 3.0 beta
494 ########################################
496 Beginning with Samba 3.0.0beta3, the RID allocation functions
497 have been moved into winbindd. Previously these were handled
498 by each passdb backend. This means that winbindd must be running
499 to automatically allocate RIDs for users and/or groups. Otherwise,
500 smbd will use the 2.2 algorithm for generating new RIDs.
502 If you are using 'passdb backend = tdbsam' with a previous Samba
503 3.0 beta release (or possibly alpha), it may be necessary to
504 move the RID_COUNTER entry from /usr/local/samba/private/passdb.tdb
505 to winbindd_idmap.tdb. To do this:
507 1) Ensure that winbindd_idmap.tdb exists (launch winbindd at least
509 2) build tdbtool by executing 'make tdbtool' in the source/tdb/
511 3) run: (note that 'tdb>' is the tool's prompt for input)
513 root# ./tdbtool /usr/local/samba/private/passdb.tdb
514 tdb> show RID_COUNTER
518 [000] 0A 52 00 00 .R.
520 tdb> move RID_COUNTER /usr/local/samba/var/locks/winbindd_idmap.tdb
524 If you are using 'passdb backend = ldapsam', it will be necessary to
525 store idmap entries in the LDAP directory as well (i.e. idmap backend
526 = ldap). Refer to the 'net idmap' command for more information on
527 migrating SID<->UNIX id mappings from one backend to another.
529 If the RID_COUNTER record does not exist, then these instructions are
530 unneccessary and the new RID_COUNTER record will be correctly generated
535 ########################
536 Upgrading from Samba 2.2
537 ########################
539 This section is provided to help administrators understand the details
540 involved with upgrading a Samba 2.2 server to Samba 3.0.
546 Many of the options to the GNU autoconf script have been modified
547 in the 3.0 release. The most noticeable are:
549 * removal of --with-tdbsam (is now included by default; see section
550 on passdb backends and authentication for more details)
552 * --with-ldapsam is now on used to provided backward compatible
553 parameters for LDAP enabled Samba 2.2 servers. Refer to the passdb
554 backend and authentication section for more details
556 * inclusion of non-standard passdb modules may be enabled using
557 --with-expsam. This includes an XML backend and a mysql backend.
559 * removal of --with-msdfs (is now enabled by default)
561 * removal of --with-ssl (no longer supported)
563 * --with-utmp now defaults to 'yes' on supported systems
565 * --with-sendfile-support is now enabled by default on supported
572 This section contains a brief listing of changes to smb.conf options
573 in the 3.0.0 release. Please refer to the smb.conf(5) man page for
574 complete descriptions of new or modified parameters.
576 Removed Parameters (order alphabetically):
579 * alternate permissions
582 * code page directory
586 * force unknown acl user
590 * printer driver file
591 * printer driver location
599 New Parameters (new parameters have been grouped by function):
603 * abort shutdown script
606 User and Group Account Management
607 ---------------------------------
610 * add user to group script
611 * algorithmic rid base
612 * delete group script
613 * delete user from group script
615 * set primary group script
631 * paranoid server security
641 * hide unwriteable files
643 * kernel change notify
653 * max reported print jobs
655 UNICODE and Character Sets
656 --------------------------
662 SID to uid/gid Mappings
663 -----------------------
667 * winbind enable local accounts
668 * winbind trusted domains only
669 * template primary group
670 * enable rid algorithm
677 * ldap machine suffix
681 General Configuration
682 ---------------------
686 Modified Parameters (changes in behavior):
688 * encrypt passwords (enabled by default)
689 * mangling method (set to 'hash2' by default)
692 * restrict anonymous (integer value)
693 * security (new 'ads' value)
694 * strict locking (enabled by default)
695 * unix extensions (enabled by default)
696 * winbind cache time (increased to 5 minutes)
697 * winbind uid (deprecated in favor of 'idmap uid')
698 * winbind gid (deprecated in favor of 'idmap gid')
704 This section contains brief descriptions of any new databases
705 introduced in Samba 3.0. Please remember to backup your existing
706 ${lock directory}/*tdb before upgrading to Samba 3.0. Samba will
707 upgrade databases as they are opened (if necessary), but downgrading
708 from 3.0 to 2.2 is an unsupported path.
710 Name Description Backup?
711 ---- ----------- -------
712 account_policy User policy settings yes
713 gencache Generic caching db no
714 group_mapping Mapping table from Windows yes
715 groups/SID to unix groups
716 winbindd_idmap ID map table from SIDS to UNIX yes
718 namecache Name resolution cache entries no
719 netsamlogon_cache Cache of NET_USER_INFO_3 structure no
720 returned as part of a successful
721 net_sam_logon request
722 printing/*.tdb Cached output from 'lpq no
723 command' created on a per print
725 registry Read-only samba registry skeleton no
726 that provides support for exporting
727 various db tables via the winreg RPCs
733 The following issues are known changes in behavior between Samba 2.2 and
734 Samba 3.0 that may affect certain installations of Samba.
736 1) When operating as a member of a Windows domain, Samba 2.2 would
737 map any users authenticated by the remote DC to the 'guest account'
738 if a uid could not be obtained via the getpwnam() call. Samba 3.0
739 rejects the connection as NT_STATUS_LOGON_FAILURE. There is no
740 current work around to re-establish the 2.2 behavior.
742 2) When adding machines to a Samba 2.2 controlled domain, the
743 'add user script' was used to create the UNIX identity of the
744 machine trust account. Samba 3.0 introduces a new 'add machine
745 script' that must be specified for this purpose. Samba 3.0 will
746 not fall back to using the 'add user script' in the absence of
747 an 'add machine script'
750 ######################################################################
751 Passdb Backends and Authentication
752 ##################################
754 There have been a few new changes that Samba administrators should be
755 aware of when moving to Samba 3.0.
757 1) encrypted passwords have been enabled by default in order to
758 inter-operate better with out-of-the-box Windows client
759 installations. This does mean that either (a) a samba account
760 must be created for each user, or (b) 'encrypt passwords = no'
761 must be explicitly defined in smb.conf.
763 2) Inclusion of new 'security = ads' option for integration
764 with an Active Directory domain using the native Windows
765 Kerberos 5 and LDAP protocols.
767 MIT kerberos 1.3.1 supports the ARCFOUR-HMAC-MD5 encryption
768 type which is neccessary for servers on which the
769 administrator password has not been changed, or kerberos-enabled
770 SMB connections to servers that require Kerberos SMB signing.
771 Besides this one difference, either MIT or Heimdal Kerberos
772 distributions are usable by Samba 3.0.
775 Samba 3.0 also includes the possibility of setting up chains
776 of authentication methods (auth methods) and account storage
777 backends (passdb backend). Please refer to the smb.conf(5)
778 man page for details. While both parameters assume sane default
779 values, it is likely that you will need to understand what the
780 values actually mean in order to ensure Samba operates correctly.
782 The recommended passdb backends at this time are
784 * smbpasswd - 2.2 compatible flat file format
785 * tdbsam - attribute rich database intended as an smbpasswd
786 replacement for stand alone servers
787 * ldapsam - attribute rich account storage and retrieval
788 backend utilizing an LDAP directory.
789 * ldapsam_compat - a 2.2 backward compatible LDAP account
792 Certain functions of the smbpasswd(8) tool have been split between the
793 new smbpasswd(8) utility, the net(8) tool, and the new pdbedit(8)
794 utility. See the respective man pages for details.
797 ######################################################################
801 This section outlines the new features affecting Samba / LDAP
807 A new object class (sambaSamAccount) has been introduced to replace
808 the old sambaAccount. This change aids us in the renaming of attributes
809 to prevent clashes with attributes from other vendors. There is a
810 conversion script (examples/LDAP/convertSambaAccount) to modify and LDIF
811 file to the new schema.
815 $ ldapsearch .... -b "ou=people,dc=..." > old.ldif
816 $ convertSambaAccount <DOM SID> old.ldif new.ldif
818 The <DOM SID> can be obtained by running 'net getlocalsid <DOMAINNAME>'
819 on the Samba PDC as root.
821 The old sambaAccount schema may still be used by specifying the
822 "ldapsam_compat" passdb backend. However, the sambaAccount and
823 associated attributes have been moved to the historical section of
824 the schema file and must be uncommented before use if needed.
825 The 2.2 object class declaration for a sambaAccount has not changed
826 in the 3.0 samba.schema file.
828 Other new object classes and their uses include:
830 * sambaDomain - domain information used to allocate rids
831 for users and groups as necessary. The attributes are added
832 in 'ldap suffix' directory entry automatically if
833 an idmap uid/gid range has been set and the 'ldapsam'
834 passdb backend has been selected.
836 * sambaGroupMapping - an object representing the
837 relationship between a posixGroup and a Windows
838 group/SID. These entries are stored in the 'ldap
839 group suffix' and managed by the 'net groupmap' command.
841 * sambaUnixIdPool - created in the 'ldap idmap suffix' entry
842 automatically and contains the next available 'idmap uid' and
845 * sambaIdmapEntry - object storing a mapping between a
846 SID and a UNIX uid/gid. These objects are created by the
847 idmap_ldap module as needed.
849 * sambaSidEntry - object representing a SID alone, as a Structural
850 class on which to build the sambaIdmapEntry.
853 New Suffix for Searching
854 ------------------------
856 The following new smb.conf parameters have been added to aid in directing
857 certain LDAP queries when 'passdb backend = ldapsam://...' has been
860 * ldap suffix - used to search for user and computer accounts
861 * ldap user suffix - used to store user accounts
862 * ldap machine suffix - used to store machine trust accounts
863 * ldap group suffix - location of posixGroup/sambaGroupMapping entries
864 * ldap idmap suffix - location of sambaIdmapEntry objects
866 If an 'ldap suffix' is defined, it will be appended to all of the
867 remaining sub-suffix parameters. In this case, the order of the suffix
868 listings in smb.conf is important. Always place the 'ldap suffix' first
871 Due to a limitation in Samba's smb.conf parsing, you should not surround
872 the DN's with quotation marks.
878 Samba 3.0 supports an ldap backend for the idmap subsystem. The
879 following options would inform Samba that the idmap table should be
880 stored on the directory server onterose in the "ou=idmap,dc=plainjoe,
885 idmap backend = ldap:ldap://onterose/
886 ldap idmap suffix = ou=idmap,dc=plainjoe,dc=org
887 idmap uid = 40000-50000
888 idmap gid = 40000-50000
890 This configuration allows winbind installations on multiple servers to
891 share a uid/gid number space, thus avoiding the interoperability problems
892 with NFS that were present in Samba 2.2.
896 ######################################################################
897 Trust Relationships and a Samba Domain
898 ######################################
900 Samba 3.0.0beta2 is able to utilize winbindd as the means of
901 allocating uids and gids to trusted users and groups. More
902 information regarding Samba's support for establishing trust
903 relationships can be found in the Samba-HOWTO-Collection included
904 in the docs/ directory of this release.
906 First create your Samba PDC and ensure that everything is
907 working correctly before moving on the trusts.
909 To establish Samba as the trusting domain (named SAMBA) from a Windows NT
910 4.0 domain named WINDOWS:
912 1) create the trust account for SAMBA in "User Manager for Domains"
913 2) connect the trust from the Samba domain using
914 'net rpc trustdom establish GLASS'
916 To create a trustlationship with SAMBA as the trusted domain:
918 1) create the initial trust account for GLASS using
919 'smbpasswd -a -i GLASS'. You may need to create a UNIX
920 account for GLASS$ prior to this step (depending on your
921 local configuration).
922 2) connect the trust from a WINDOWS DC using "User Manager
925 Now join winbindd on the Samba PDC to the SAMBA domain using
926 the normal steps for adding a Samba server to an NT4 domain:
927 (note that smbd & nmbd must be running at this point)
929 root# net rpc join -U root
930 Password: <enter root password from smbpasswd file here>
932 Start winbindd and test the join with 'wbinfo -t'.
934 Now test the trust relationship by connecting to the SAMBA DC
935 (e.g. POGO) as a user from the WINDOWS domain:
937 $ smbclient //pogo/netlogon -U Administrator -W WINDOWS
940 Now connect to the WINDOWS DC (e.g. CRYSTAL) as a Samba user:
942 $ smbclient //crystal/netlogon -U root -W WINDOWS
945 ######################################################################
949 Beginning with Samba3.0.0beta3, winbindd has been given new account
950 manage functionality equivalent to the 'add user script' family of
951 smb.conf parameters. The idmap design has also been changed to
952 centralize control of foreign SID lookups and matching to UNIX
956 Brief Description of Changes
957 ----------------------------
959 1) The sid_to_uid() family of functions (smbd/uid.c) have been
960 reverted to the 2.2.x design. This means that when resolving a
961 SID to a UID or similar mapping:
963 a) First consult winbindd
964 b) perform a local lookup only if winbindd fails to
965 return a successful answer
967 There are some variations to this, but these two rules generally
970 2) All idmap lookups have been moved into winbindd. This means that
971 a server must run winbindd (and support NSS) in order to achieve
972 any mappings of SID to dynamically allocated UNIX ids. This was
973 a conscious design choice.
975 3) New functions have been added to winbindd to emulate the 'add user
976 script' family of smbd functions without requiring that external
977 scripts be defined. This functionality is controlled by the 'winbind
978 enable local accounts' smb.conf parameter (enabled by default).
980 However, this account management functionality is only supported
981 in a local tdb (winbindd_idmap.tdb). If these new UNIX accounts
982 must be shared among multiple Samba servers (such as a PDC and BDCs),
983 it will be necessary to define your own 'add user script', et. al.
984 programs that place the accounts/groups in some form of directory
985 such as NIS or LDAP. This requirement was deemed beyond the scope
986 of winbind's account management functions. Solutions for
987 distributing UNIX system information have been deployed and tested
988 for many years. We saw no need to reinvent the wheel.
990 4) A member of a Samba controlled domain running winbindd is now able
991 to map domain users directly onto existing UNIX accounts while still
992 automatically creating accounts for trusted users and groups. This
993 behavior is controlled by the 'winbind trusted domains only' smb.conf
994 parameter (disabled by default to provide 2.2.x winbind behavior).
996 5) Group mapping support is wrapped in the local_XX_to_XX() functions
997 in smbd/uid.c. The reason that group mappings are not included
998 in winbindd is because the purpose of Samba's group map is to
999 match any Windows SID with an existing UNIX group. These UNIX
1000 groups can be created by winbindd (see next section), but the
1001 SID<->gid mapping is retreived by smbd, not winbindd.
1007 * security = server running winbindd to allocate accounts on demand
1009 * Samba PDC running winbindd to handle the automatic creation of UNIX
1010 identities for machine trust accounts
1012 * Automtically creating UNIX user and groups when migrating a Windows NT
1013 4.0 PDC to a Samba PDC. Winbindd must be running when executing
1014 'net rpc vampire' for this to work.
1017 ######################################################################
1021 * There are several bugs currently logged against the 3.0 codebase
1022 that affect the use of NT 4.0 GUI domain management tools when run
1023 against a Samba 3.0 PDC. This bugs should be released in an early
1026 Please refer to https://bugzilla.samba.org/ for a current list of bugs
1027 filed against the Samba 3.0 codebase.
1030 ######################################################################
1031 Reporting bugs & Development Discussion
1032 #######################################
1034 Please discuss this release on the samba-technical mailing list or by
1035 joining the #samba-technical IRC channel on irc.freenode.net.
1037 If you do report problems then please try to send high quality
1038 feedback. If you don't provide vital information to help us track down
1039 the problem then you will probably be ignored.
1041 A new bugzilla installation has been established to help support the
1042 Samba 3.0 community of users. This server, located at
1043 https://bugzilla.samba.org/, has replaced the older jitterbug server
1044 previously located at http://bugs.samba.org/.