| blob | 4ad852d871344916adaebf03e577eb4e1822e070 |
1 ==============================
2 Release Notes for Samba 4.15.7
3 April 26, 2022
4 ==============================
7 This is the latest stable release of the Samba 4.15 release series.
10 Changes since 4.15.6
11 --------------------
13 o Jeremy Allison <jra@samba.org>
14 * BUG 14831: Share and server swapped in smbget password prompt.
15 * BUG 15022: Durable handles won't reconnect if the leased file is written
16 to.
17 * BUG 15023: rmdir silently fails if directory contains unreadable files and
18 hide unreadable is yes.
19 * BUG 15038: SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on
20 renamed file handle.
22 o Ralph Boehme <slow@samba.org>
23 * BUG 14957: vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback.
24 * BUG 15035: shadow_copy2 fails listing snapshotted dirs with
25 shadow:fixinodes.
27 o Samuel Cabrero <scabrero@samba.org>
28 * BUG 15046: PAM Kerberos authentication incorrectly fails with a clock skew
29 error.
31 o Pavel Filipenský <pfilipen@redhat.com>
32 * BUG 15041: username map - samba erroneously applies unix group memberships
33 to user account entries.
35 o Elia Geretto <elia.f.geretto@gmail.com>
36 * BUG 14983: NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
37 in SMBC_server_internal.
39 o Stefan Metzmacher <metze@samba.org>
40 * BUG 13879: Simple bind doesn't work against an RODC (with non-preloaded
41 users).
42 * BUG 14641: Crash of winbind on RODC.
43 * BUG 14865: uncached logon on RODC always fails once.
44 * BUG 14951: KVNO off by 100000.
45 * BUG 15001: LDAP simple binds should honour "old password allowed period".
46 * BUG 15003: wbinfo -a doesn't work reliable with upn names.
48 o Garming Sam <garming@catalyst.net.nz>
49 * BUG 13879: Simple bind doesn't work against an RODC (with non-preloaded
50 users).
52 o Christof Schmitt <cs@samba.org>
53 * BUG 15027: Uninitialized litemask in variable in vfs_gpfs module.
55 o Andreas Schneider <asn@samba.org>
56 * BUG 15016: Regression: create krb5 conf = yes doesn't work with a single
57 KDC.
60 #######################################
61 Reporting bugs & Development Discussion
62 #######################################
64 Please discuss this release on the samba-technical mailing list or by
65 joining the #samba-technical:matrix.org matrix room, or
66 #samba-technical IRC channel on irc.libera.chat.
68 If you do report problems then please try to send high quality
69 feedback. If you don't provide vital information to help us track down
70 the problem then you will probably be ignored. All bug reports should
71 be filed under the Samba 4.1 and newer product in the project's Bugzilla
72 database (https://bugzilla.samba.org/).
75 ======================================================================
76 == Our Code, Our Bugs, Our Responsibility.
77 == The Samba Team
78 ======================================================================
81 Release notes for older releases follow:
82 ----------------------------------------
83 ==============================
84 Release Notes for Samba 4.15.6
85 March 15, 2022
86 ==============================
89 This is the latest stable release of the Samba 4.15 release series.
92 Changes since 4.15.5
93 --------------------
95 o Jeremy Allison <jra@samba.org>
96 * BUG 14169: Renaming file on DFS root fails with
97 NT_STATUS_OBJECT_PATH_NOT_FOUND.
98 * BUG 14737: Samba does not response STATUS_INVALID_PARAMETER when opening 2
99 objects with same lease key.
100 * BUG 14938: NT error code is not set when overwriting a file during rename
101 in libsmbclient.
103 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
104 * BUG 14996: Fix ldap simple bind with TLS auditing.
106 o Ralph Boehme <slow@samba.org>
107 * BUG 14674: net ads info shows LDAP Server: 0.0.0.0 depending on contacted
108 server.
110 o Samuel Cabrero <scabrero@suse.de>
111 * BUG 14979: Problem when winbind renews Kerberos.
113 o Günther Deschner <gd@samba.org>
114 * BUG 8691: pam_winbind will not allow gdm login if password about to expire.
116 o Pavel Filipenský <pfilipen@redhat.com>
117 * BUG 14971: virusfilter_vfs_openat: Not scanned: Directory or special file.
119 o Björn Jacke <bj@sernet.de>
120 * BUG 13631: DFS fix for AIX broken.
121 * BUG 14974: Solaris and AIX acl modules: wrong function arguments.
122 * BUG 7239: Function aixacl_sys_acl_get_file not declared / coredump.
124 o Volker Lendecke <vl@samba.org>
125 * BUG 14900: Regression: Samba 4.15.2 on macOS segfaults intermittently
126 during strcpy in tdbsam_getsampwnam.
127 * BUG 14989: Fix a use-after-free in SMB1 server.
129 o Stefan Metzmacher <metze@samba.org>
130 * BUG 14968: smb2_signing_decrypt_pdu() may not decrypt with
131 gnutls_aead_cipher_decrypt() from gnutls before 3.5.2.
132 * BUG 14984: changing the machine password against an RODC likely destroys
133 the domain join.
134 * BUG 14993: authsam_make_user_info_dc() steals memory from its struct
135 ldb_message *msg argument.
136 * BUG 14995: Use Heimdal 8.0 (pre) rather than an earlier snapshot.
138 o Andreas Schneider <asn@samba.org>
139 * BUG 14967: Samba autorid fails to map AD users if id rangesize fits in the
140 id range only once.
143 #######################################
144 Reporting bugs & Development Discussion
145 #######################################
147 Please discuss this release on the samba-technical mailing list or by
148 joining the #samba-technical IRC channel on irc.libera.chat or the
149 #samba-technical:matrix.org matrix channel.
151 If you do report problems then please try to send high quality
152 feedback. If you don't provide vital information to help us track down
153 the problem then you will probably be ignored. All bug reports should
154 be filed under the Samba 4.1 and newer product in the project's Bugzilla
155 database (https://bugzilla.samba.org/).
158 ======================================================================
159 == Our Code, Our Bugs, Our Responsibility.
160 == The Samba Team
161 ======================================================================
164 ----------------------------------------------------------------------
165 ==============================
166 Release Notes for Samba 4.15.5
167 January 31, 2022
168 ==============================
171 This is a security release in order to address the following defects:
173 o CVE-2021-44141: UNIX extensions in SMB1 disclose whether the outside target
174 of a symlink exists.
175 https://www.samba.org/samba/security/CVE-2021-44141.html
177 o CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit module.
178 https://www.samba.org/samba/security/CVE-2021-44142.html
180 o CVE-2022-0336: Re-adding an SPN skips subsequent SPN conflict checks.
181 https://www.samba.org/samba/security/CVE-2022-0336.html
184 Changes since 4.15.4
185 --------------------
187 o Jeremy Allison <jra@samba.org>
188 * BUG 14911: CVE-2021-44141
190 o Ralph Boehme <slow@samba.org>
191 * BUG 14914: CVE-2021-44142
193 o Joseph Sutton <josephsutton@catalyst.net.nz>
194 * BUG 14950: CVE-2022-0336
197 #######################################
198 Reporting bugs & Development Discussion
199 #######################################
201 Please discuss this release on the samba-technical mailing list or by
202 joining the #samba-technical IRC channel on irc.libera.chat or the
203 #samba-technical:matrix.org matrix channel.
205 If you do report problems then please try to send high quality
206 feedback. If you don't provide vital information to help us track down
207 the problem then you will probably be ignored. All bug reports should
208 be filed under the Samba 4.1 and newer product in the project's Bugzilla
209 database (https://bugzilla.samba.org/).
212 ======================================================================
213 == Our Code, Our Bugs, Our Responsibility.
214 == The Samba Team
215 ======================================================================
218 ----------------------------------------------------------------------
219 ==============================
220 Release Notes for Samba 4.15.4
221 January 19, 2022
222 ==============================
225 This is the latest stable release of the Samba 4.15 release series.
228 Changes since 4.15.3
229 --------------------
231 o Jeremy Allison <jra@samba.org>
232 * BUG 14928: Duplicate SMB file_ids leading to Windows client cache
233 poisoning.
234 * BUG 14939: smbclient -L doesn't set "client max protocol" to NT1 before
235 calling the "Reconnecting with SMB1 for workgroup listing" path.
236 * BUG 14944: Missing pop_sec_ctx() in error path inside close_directory().
238 o Pavel Filipenský <pfilipen@redhat.com>
239 * BUG 14940: Cross device copy of the crossrename module always fails.
240 * BUG 14941: symlinkat function from VFS cap module always fails with an
241 error.
242 * BUG 14942: Fix possible fsp pointer deference.
244 o Volker Lendecke <vl@samba.org>
245 * BUG 14934: kill_tcp_connections does not work.
247 o Stefan Metzmacher <metze@samba.org>
248 * BUG 14932: Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error -
249 NT_STATUS_BUFFER_TOO_SMALL.
250 * BUG 14935: Can't connect to Windows shares not requiring authentication
251 using KDE/Gnome.
253 o Andreas Schneider <asn@samba.org>
254 * BUG 14945: "smbd --build-options" no longer works without an smb.conf file.
256 o Jones Syue <jonessyue@qnap.com>
257 * BUG 14928: Duplicate SMB file_ids leading to Windows client cache
258 poisoning.
261 #######################################
262 Reporting bugs & Development Discussion
263 #######################################
265 Please discuss this release on the samba-technical mailing list or by
266 joining the #samba-technical IRC channel on irc.libera.chat or the
267 #samba-technical:matrix.org matrix channel.
269 If you do report problems then please try to send high quality
270 feedback. If you don't provide vital information to help us track down
271 the problem then you will probably be ignored. All bug reports should
272 be filed under the Samba 4.1 and newer product in the project's Bugzilla
273 database (https://bugzilla.samba.org/).
276 ======================================================================
277 == Our Code, Our Bugs, Our Responsibility.
278 == The Samba Team
279 ======================================================================
282 ----------------------------------------------------------------------
283 ==============================
284 Release Notes for Samba 4.15.3
285 December 08, 2021
286 ==============================
289 This is the latest stable release of the Samba 4.15 release series.
291 Important Notes
292 ===============
294 There have been a few regressions in the security release 4.15.2:
296 o CVE-2020-25717: A user on the domain can become root on domain members.
297 https://www.samba.org/samba/security/CVE-2020-25717.html
298 PLEASE [RE-]READ!
299 The instructions have been updated and some workarounds
300 initially adviced for 4.15.2 are no longer required and
301 should be reverted in most cases.
303 o BUG-14902: User with multiple spaces (eg Fred<space><space>Nurk) become
304 un-deletable. While this release should fix this bug, it is
305 adviced to have a look at the bug report for more detailed
306 information, see https://bugzilla.samba.org/show_bug.cgi?id=14902.
308 Changes since 4.15.2
309 --------------------
311 o Jeremy Allison <jra@samba.org>
312 * BUG 14878: Recursive directory delete with veto files is broken in 4.15.0.
313 * BUG 14879: A directory containing dangling symlinks cannot be deleted by
314 SMB2 alone when they are the only entry in the directory.
315 * BUG 14892: SIGSEGV in rmdir_internals/synthetic_pathref - dirfsp is used
316 uninitialized in rmdir_internals().
318 o Andrew Bartlett <abartlet@samba.org>
319 * BUG 14694: MaxQueryDuration not honoured in Samba AD DC LDAP.
320 * BUG 14901: The CVE-2020-25717 username map [script] advice has undesired
321 side effects for the local nt token.
322 * BUG 14902: User with multiple spaces (eg Fred<space><space>Nurk) become
323 un-deletable.
325 o Ralph Boehme <slow@samba.org>
326 * BUG 14127: Avoid storing NTTIME_THAW (-2) as value on disk.
327 * BUG 14882: smbXsrv_client_global record validation leads to crash if
328 existing record points at non-existing process.
329 * BUG 14890: Crash in vfs_fruit asking for fsp_get_io_fd() for an XATTR call.
330 * BUG 14897: Samba process doesn't log to logfile.
331 * BUG 14907: set_ea_dos_attribute() fallback calling
332 get_file_handle_for_metadata() triggers locking.tdb assert.
333 * BUG 14922: Kerberos authentication on standalone server in MIT realm
334 broken.
335 * BUG 14923: Segmentation fault when joining the domain.
337 o Alexander Bokovoy <ab@samba.org>
338 * BUG 14903: Support for ROLE_IPA_DC is incomplete.
340 o Günther Deschner <gd@samba.org>
341 * BUG 14767: rpcclient cannot connect to ncacn_ip_tcp services anymore
342 * BUG 14893: winexe crashes since 4.15.0 after popt parsing.
344 o Volker Lendecke <vl@samba.org>
345 * BUG 14908: net ads status -P broken in a clustered environment.
347 o Stefan Metzmacher <metze@samba.org>
348 * BUG 14788: Memory leak if ioctl(FSCTL_VALIDATE_NEGOTIATE_INFO) fails before
349 smbd_smb2_ioctl_send.
350 * BUG 14882: smbXsrv_client_global record validation leads to crash if
351 existing record points at non-existing process.
352 * BUG 14899: winbindd doesn't start when "allow trusted domains" is off.
353 * BUG 14901: The CVE-2020-25717 username map [script] advice has undesired
354 side effects for the local nt token.
356 o Andreas Schneider <asn@samba.org>
357 * BUG 14767: rpcclient cannot connect to ncacn_ip_tcp services anymore.
358 * BUG 14883: smbclient login without password using '-N' fails with
359 NT_STATUS_INVALID_PARAMETER on Samba AD DC.
360 * BUG 14912: A schannel client incorrectly detects a downgrade connecting to
361 an AES only server.
362 * BUG 14921: Possible null pointer dereference in winbind.
364 o Andreas Schneider <asn@cryptomilk.org>
365 * BUG 14846: Fix -k legacy option for client tools like smbclient, rpcclient,
366 net, etc.
368 o Martin Schwenke <martin@meltin.net>
369 * BUG 14872: Add Debian 11 CI bootstrap support.
371 o Joseph Sutton <josephsutton@catalyst.net.nz>
372 * BUG 14694: MaxQueryDuration not honoured in Samba AD DC LDAP.
373 * BUG 14901: The CVE-2020-25717 username map [script] advice has undesired
374 side effects for the local nt token.
376 o Andrew Walker <awalker@ixsystems.com>
377 * BUG 14888: Crash in recycle_unlink_internal().
380 #######################################
381 Reporting bugs & Development Discussion
382 #######################################
384 Please discuss this release on the samba-technical mailing list or by
385 joining the #samba-technical:matrix.org matrix room, or
386 #samba-technical IRC channel on irc.libera.chat
388 If you do report problems then please try to send high quality
389 feedback. If you don't provide vital information to help us track down
390 the problem then you will probably be ignored. All bug reports should
391 be filed under the Samba 4.1 and newer product in the project's Bugzilla
392 database (https://bugzilla.samba.org/).
395 ======================================================================
396 == Our Code, Our Bugs, Our Responsibility.
397 == The Samba Team
398 ======================================================================
401 ----------------------------------------------------------------------
402 ==============================
403 Release Notes for Samba 4.15.2
404 November 9, 2021
405 ==============================
408 This is a security release in order to address the following defects:
410 o CVE-2016-2124: SMB1 client connections can be downgraded to plaintext
411 authentication.
412 https://www.samba.org/samba/security/CVE-2016-2124.html
414 o CVE-2020-25717: A user on the domain can become root on domain members.
415 https://www.samba.org/samba/security/CVE-2020-25717.html
416 (PLEASE READ! There are important behaviour changes described)
418 o CVE-2020-25718: Samba AD DC did not correctly sandbox Kerberos tickets issued
419 by an RODC.
420 https://www.samba.org/samba/security/CVE-2020-25718.html
422 o CVE-2020-25719: Samba AD DC did not always rely on the SID and PAC in Kerberos
423 tickets.
424 https://www.samba.org/samba/security/CVE-2020-25719.html
426 o CVE-2020-25721: Kerberos acceptors need easy access to stable AD identifiers
427 (eg objectSid).
428 https://www.samba.org/samba/security/CVE-2020-25721.html
430 o CVE-2020-25722: Samba AD DC did not do suffienct access and conformance
431 checking of data stored.
432 https://www.samba.org/samba/security/CVE-2020-25722.html
434 o CVE-2021-3738: Use after free in Samba AD DC RPC server.
435 https://www.samba.org/samba/security/CVE-2021-3738.html
437 o CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability.
438 https://www.samba.org/samba/security/CVE-2021-23192.html
441 Changes since 4.15.1
442 --------------------
444 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
445 * CVE-2020-25722
447 o Andrew Bartlett <abartlet@samba.org>
448 * CVE-2020-25718
449 * CVE-2020-25719
450 * CVE-2020-25721
451 * CVE-2020-25722
453 o Ralph Boehme <slow@samba.org>
454 * CVE-2020-25717
456 o Alexander Bokovoy <ab@samba.org>
457 * CVE-2020-25717
459 o Samuel Cabrero <scabrero@samba.org>
460 * CVE-2020-25717
462 o Nadezhda Ivanova <nivanova@symas.com>
463 * CVE-2020-25722
465 o Stefan Metzmacher <metze@samba.org>
466 * CVE-2016-2124
467 * CVE-2020-25717
468 * CVE-2020-25719
469 * CVE-2020-25722
470 * CVE-2021-23192
471 * CVE-2021-3738
473 o Andreas Schneider <asn@samba.org>
474 * CVE-2020-25719
476 o Joseph Sutton <josephsutton@catalyst.net.nz>
477 * CVE-2020-17049
478 * CVE-2020-25718
479 * CVE-2020-25719
480 * CVE-2020-25721
481 * CVE-2020-25722
482 * MS CVE-2020-17049
485 #######################################
486 Reporting bugs & Development Discussion
487 #######################################
489 Please discuss this release on the samba-technical mailing list or by
490 joining the #samba-technical IRC channel on irc.libera.chat or the
491 #samba-technical:matrix.org matrix channel.
493 If you do report problems then please try to send high quality
494 feedback. If you don't provide vital information to help us track down
495 the problem then you will probably be ignored. All bug reports should
496 be filed under the Samba 4.1 and newer product in the project's Bugzilla
497 database (https://bugzilla.samba.org/).
500 ======================================================================
501 == Our Code, Our Bugs, Our Responsibility.
502 == The Samba Team
503 ======================================================================
506 ----------------------------------------------------------------------
509 ==============================
510 Release Notes for Samba 4.15.1
511 October 27, 2021
512 ==============================
515 This is the latest stable release of the Samba 4.15 release series.
518 Changes since 4.15.0
519 --------------------
521 o Jeremy Allison <jra@samba.org>
522 * BUG 14682: vfs_shadow_copy2: core dump in make_relative_path.
523 * BUG 14685: Log clutter from filename_convert_internal.
524 * BUG 14862: MacOSX compilation fixes.
526 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
527 * BUG 14868: rodc_rwdc test flaps.
529 o Andrew Bartlett <abartlet@samba.org>
530 * BUG 14642: Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze
531 bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded
532 Heimdal.
533 * BUG 14836: Python ldb.msg_diff() memory handling failure.
534 * BUG 14845: "in" operator on ldb.Message is case sensitive.
535 * BUG 14848: Release LDB 2.4.1 for Samba 4.15.1.
536 * BUG 14854: samldb_krbtgtnumber_available() looks for incorrect string.
537 * BUG 14871: Fix Samba support for UF_NO_AUTH_DATA_REQUIRED.
538 * BUG 14874: Allow special chars like "@" in samAccountName when generating
539 the salt.
541 o Ralph Boehme <slow@samba.org>
542 * BUG 14826: Correctly ignore comments in CTDB public addresses file.
544 o Isaac Boukris <iboukris@gmail.com>
545 * BUG 14642: Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze
546 bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded
547 Heimdal.
549 o Viktor Dukhovni <viktor@twosigma.com>
550 * BUG 12998: Fix transit path validation.
552 o Pavel Filipenský <pfilipen@redhat.com>
553 * BUG 14852: Fix that child winbindd logs to log.winbindd instead of
554 log.wb-<DOMAIN>.
556 o Luke Howard <lukeh@padl.com>
557 * BUG 14642: Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze
558 bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded
559 Heimdal.
561 o Stefan Metzmacher <metze@samba.org>
562 * BUG 14855: SMB3 cancel requests should only include the MID together with
563 AsyncID when AES-128-GMAC is used.
565 o Alex Richardson <Alexander.Richardson@cl.cam.ac.uk>
566 * BUG 14862: MacOSX compilation fixes.
568 o Andreas Schneider <asn@samba.org>
569 * BUG 14870: Prepare to operate with MIT krb5 >= 1.20.
571 o Martin Schwenke <martin@meltin.net>
572 * BUG 14826: Correctly ignore comments in CTDB public addresses file.
574 o Joseph Sutton <josephsutton@catalyst.net.nz>
575 * BUG 14642: Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze
576 bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded
577 Heimdal.
578 * BUG 14836: Python ldb.msg_diff() memory handling failure.
579 * BUG 14845: "in" operator on ldb.Message is case sensitive.
580 * BUG 14864: Heimdal prefers RC4 over AES for machine accounts.
581 * BUG 14868: rodc_rwdc test flaps.
582 * BUG 14871: Fix Samba support for UF_NO_AUTH_DATA_REQUIRED.
583 * BUG 14874: Allow special chars like "@" in samAccountName when generating
584 the salt.
586 o Nicolas Williams <nico@twosigma.com>
587 * BUG 14642: Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze
588 bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded
589 Heimdal.
592 #######################################
593 Reporting bugs & Development Discussion
594 #######################################
596 Please discuss this release on the samba-technical mailing list or by
597 joining the #samba-technical IRC channel on irc.freenode.net.
599 If you do report problems then please try to send high quality
600 feedback. If you don't provide vital information to help us track down
601 the problem then you will probably be ignored. All bug reports should
602 be filed under the Samba 4.1 and newer product in the project's Bugzilla
603 database (https://bugzilla.samba.org/).
606 ======================================================================
607 == Our Code, Our Bugs, Our Responsibility.
608 == The Samba Team
609 ======================================================================
612 ----------------------------------------------------------------------
614 ==============================
615 Release Notes for Samba 4.15.0
616 September 20, 2021
617 ==============================
620 This is the first stable release of the Samba 4.15 release series.
621 Please read the release notes carefully before upgrading.
624 Removed SMB (development) dialects
625 ==================================
627 The following SMB (development) dialects are no longer
628 supported: SMB2_22, SMB2_24 and SMB3_10. They are were
629 only supported by Windows technical preview builds.
630 They used to be useful in order to test against the
631 latest Windows versions, but it's no longer useful
632 to have them. If you have them explicitly specified
633 in your smb.conf or an the command line,
634 you need to replace them like this:
635 - SMB2_22 => SMB3_00
636 - SMB2_24 => SMB3_00
637 - SMB3_10 => SMB3_11
638 Note that it's typically not useful to specify
639 "client max protocol" or "server max protocol"
640 explicitly to a specific dialect, just leave
641 them unspecified or specify the value "default".
643 New GPG key
644 ===========
646 The GPG release key for Samba releases changed from:
648 pub dsa1024/6F33915B6568B7EA 2007-02-04 [SC] [expires: 2021-02-05]
649 Key fingerprint = 52FB C0B8 6D95 4B08 4332 4CDC 6F33 915B 6568 B7EA
650 uid [ full ] Samba Distribution Verification Key <samba-bugs@samba.org>
651 sub elg2048/9C6ED163DA6DFB44 2007-02-04 [E] [expires: 2021-02-05]
653 to the following new key:
655 pub rsa4096/AA99442FB680B620 2020-12-21 [SC] [expires: 2022-12-21]
656 Key fingerprint = 81F5 E283 2BD2 545A 1897 B713 AA99 442F B680 B620
657 uid [ultimate] Samba Distribution Verification Key <samba-bugs@samba.org>
658 sub rsa4096/97EF9386FBFD4002 2020-12-21 [E] [expires: 2022-12-21]
660 Starting from Jan 21th 2021, all Samba releases will be signed with the new key.
662 See also GPG_AA99442FB680B620_replaces_6F33915B6568B7EA.txt
664 New minimum version for the experimental MIT KDC
665 ================================================
667 The build of the AD DC using the system MIT Kerberos, an
668 experimental feature, now requires MIT Kerberos 1.19. An up-to-date
669 Fedora 34 has this version and has backported fixes for the KDC crash
670 bugs CVE-2021-37750 and CVE-2021-36222
673 NEW FEATURES/CHANGES
674 ====================
676 VFS
677 ---
679 The effort to modernize Samba's VFS interface is complete and Samba 4.15.0 ships
680 with a modernized VFS designed for the post SMB1 world.
682 For details please refer to the documentation at source3/modules/The_New_VFS.txt
683 or visit the <https://wiki.samba.org/index.php/The_New_VFS>.
686 Bind DLZ: add the ability to set allow/deny lists for zone transfer clients
687 ---------------------------------------------------------------------------
689 Up to now, any client could use a DNS zone transfer request to the
690 bind server, and get an answer from Samba. Now the default behaviour
691 will be to deny those request. Two new options have been added to
692 manage the list of authorized/denied clients for zone transfer
693 requests. In order to be accepted, the request must be issued by a
694 client that is in the allow list and NOT in the deny list.
697 "server multi channel support" no longer experimental
698 -----------------------------------------------------
700 This option is enabled by default starting with 4.15 (on Linux and FreeBSD).
701 Due to dependencies on kernel APIs of Linux or FreeBSD, it's only possible
702 to use this feature on Linux and FreeBSD for now.
705 samba-tool available without the ad-dc
706 --------------------------------------
708 The 'samba-tool' command is now available when samba is configured
709 "--without-ad-dc". Not all features will work, and some ad-dc specific options
710 have been disabled. The 'samba-tool domain' options, for example, are limited
711 when no ad-dc is present. Samba must still be built with ads in order to enable
712 'samba-tool'.
715 Improved command line user experience
716 -------------------------------------
718 Samba utilities did not consistently implement their command line interface. A
719 number of options were requiring to specify values in one tool and not in the
720 other, some options meant different in different tools.
722 These should be stories of the past now. A new command line parser has been
723 implemented with sanity checking. Also the command line interface has been
724 simplified and provides better control for encryption, signing and kerberos.
726 Previously many tools silently ignored unknown options. To prevent unexpected
727 behaviour all tools will now consistently reject unknown options.
729 Also several command line options have a smb.conf variable to control the
730 default now.
732 All tools are now logging to stderr by default. You can use "--debug-stdout" to
733 change the behavior. All servers will log to stderr at early startup until logging
734 is setup to go to a file by default.
736 ### Common parser:
738 Options added:
739 --client-protection=off|sign|encrypt
741 Options renamed:
742 --kerberos -> --use-kerberos=required|desired|off
743 --krb5-ccache -> --use-krb5-ccache=CCACHE
744 --scope -> --netbios-scope=SCOPE
745 --use-ccache -> --use-winbind-ccache
747 Options removed:
748 -e|--encrypt
749 -C removed from --use-winbind-ccache
750 -i removed from --netbios-scope
751 -S|--signing
754 ### Duplicates in command line utils
756 ldbadd/ldbdel/ldbedit/ldbmodify/ldbrename/ldbsearch:
757 -e is still available as an alias for --editor,
758 as it used to be.
759 -s is no longer reported as an alias for --configfile,
760 it never worked that way as it was shadowed by '-s' for '--scope'.
762 ndrdump:
763 -l is not available for --load-dso anymore
765 net:
766 -l is not available for --long anymore
768 sharesec:
769 -V is not available for --viewsddl anymore
771 smbcquotas:
772 --user -> --quota-user
774 nmbd:
775 --log-stdout -> --debug-stdout
777 smbd:
778 --log-stdout -> --debug-stdout
780 winbindd:
781 --log-stdout -> --debug-stdout
784 Scanning of trusted domains and enterprise principals
785 -----------------------------------------------------
787 As an artifact from the NT4 times, we still scanned the list of trusted domains
788 on winbindd startup. This is wrong as we never can get a full picture in Active
789 Directory. It is time to change the default value to "No". Also with this change
790 we always use enterprise principals for Kerberos so that the DC will be able
791 to redirect ticket requests to the right DC. This is e.g. needed for one way
792 trusts. The options `winbind use krb5 enterprise principals` and
793 `winbind scan trusted domains` will be deprecated in one of the next releases.
796 Support for Offline Domain Join (ODJ)
797 -------------------------------------
799 The net utility is now able to support the offline domain join feature
800 as known from the Windows djoin.exe command for many years. Samba's
801 implementation is accessible via the 'net offlinejoin' subcommand. It
802 can provision computers and request offline joining for both Windows
803 and Unix machines. It is also possible to provision computers from
804 Windows (using djoin.exe) and use the generated data in Samba's 'net'
805 utility. The existing options for the provisioning and joining steps
806 are documented in the net(8) manpage.
809 'samba-tool dns zoneoptions' for aging control
810 ----------------------------------------------
812 The 'samba-tool dns zoneoptions' command can be used to turn aging on
813 and off, alter the refresh and no-refresh periods, and manipulate the
814 timestamps of existing records.
816 To turn aging on for a zone, you can use something like this:
818 samba-tool dns zoneoptions --aging=1 --refreshinterval=306600
820 which turns on aging and ensures no records less than five years old
821 are aged out and scavenged. After aging has been on for sufficient
822 time for records to be renewed, the command
824 samba-tool dns zoneoptions --refreshinterval=168
826 will set the refresh period to the standard seven days. Using this two
827 step process will help prevent the temporary loss of dynamic records
828 if scavenging happens before their first renewal.
831 Marking old records as static or dynamic with 'samba-tool'
832 ----------------------------------------------------------
834 A bug in Samba versions prior to 4.9 meant records that were meant to
835 be static were marked as dynamic and vice versa. To fix the timestamps
836 in these domains, it is possible to use the following options,
837 preferably before turning aging on.
839 --mark-old-records-static
840 --mark-records-dynamic-regex
841 --mark-records-static-regex
843 The "--mark-old-records-static" option will make records older than the
844 specified date static (that is, with a zero timestamp). For example,
845 if you upgraded to Samba 4.9 in November 2018, you could use ensure no
846 old records will be mistakenly interpreted as dynamic using the
847 following option:
849 samba-tool dns zoneoptions --mark-old-records-static=2018-11-30
851 Then, if you know that that will have marked some records as static
852 that should be dynamic, and you know which those are due to your
853 naming scheme, you can use commands like:
855 samba-tool dns zoneoptions --mark-records-dynamic-regex='\w+-desktop'
857 where '\w+-desktop' is a perl-compatible regular expression that will
858 match 'bob-desktop', 'alice-desktop', and so on.
860 These options are deliberately long and cumbersome to type, so people
861 have a chance to think before they get to the end. You can make a
862 mess if you get it wrong.
864 All 'samba-tool dns zoneoptions' modes can be given a "--dry-run/-n"
865 argument that allows you to inspect the likely results before going
866 ahead.
868 NOTE: for aging to work, you need to have "dns zone scavenging = yes"
869 set in the smb.conf of at least one server.
872 DNS tombstones are now deleted as appropriate
873 ---------------------------------------------
875 When all the records for a DNS name have been deleted, the node is put
876 in a tombstoned state (separate from general AD object tombstoning,
877 which deleted nodes also go through). These tombstones should be
878 cleaned up periodically. Due to a conflation of scavenging and
879 tombstoning, we have only been deleting tombstones when aging is
880 enabled.
882 If you have a lot of tombstoned DNS nodes (that is, DNS names for
883 which you have removed all the records), cleaning up these DNS
884 tombstones may take a noticeable time.
887 DNS tombstones use a consistent timestamp format
888 ------------------------------------------------
890 DNS records use an hours-since-1601 timestamp format except for in the
891 case of tombstone records where a 100-nanosecond-intervals-since-1601
892 format is used (this latter format being the most common in Windows).
893 We had mixed that up, which might have had strange effects in zones
894 where aging was enabled (and hence tombstone timestamps were used).
897 samba-tool dns update and RPC changes
898 -------------------------------------
900 The dnsserver DCERPC pipe can be used by 'samba-tool' and Windows tools
901 to manipulate dns records on the remote server. A bug in Samba meant
902 it was not possible to update an existing DNS record to change the
903 TTL. The general behaviour of RPC updates is now closer to that of
904 Windows.
906 'samba-tool dns update' is now a bit more careful in rejecting and
907 warning you about malformed IPv4 and IPv6 addresses.
909 CVE-2021-3671: Crash in Heimdal KDC and updated security release policy
910 -----------------------------------------------------------------------
912 An unuthenticated user can crash the AD DC KDC by omitting the server
913 name in a TGS-REQ. Per Samba's updated security process a specific
914 security release was not made for this issue as it is a recoverable
915 Denial Of Service.
917 See https://wiki.samba.org/index.php/Samba_Security_Proces
919 samba-tool domain backup offline with the LMDB backend
920 ------------------------------------------------------
922 samba-tool domain backup offline, when operating with the LMDB backend
923 now correctly takes out locks against concurrent modification of the
924 database during the backup. If you use this tool on a Samba AD DC
925 using LMDB, you should upgrade to this release for safer backups.
927 REMOVED FEATURES
928 ================
930 Tru64 ACL support has been removed from this release. The last
931 supported release of Tru64 UNIX was in 2012.
933 NIS support has been removed from this release. This is not
934 available in Linux distributions anymore.
936 The DLZ DNS plugin is no longer built for Bind versions 9.8 and 9.9,
937 which have been out of support since 2018.
940 smb.conf changes
941 ================
943 Parameter Name Description Default
944 -------------- ----------- -------
945 client use kerberos New desired
946 client max protocol Values Removed
947 client min protocol Values Removed
948 client protection New default
949 client smb3 signing algorithms New see man smb.conf
950 client smb3 encryption algorithms New see man smb.conf
951 preopen:posix-basic-regex New No
952 preopen:nomatch_log_level New 5
953 preopen:match_log_level New 5
954 preopen:nodigits_log_level New 1
955 preopen:founddigits_log_level New 3
956 preopen:reset_log_level New 5
957 preopen:push_log_level New 3
958 preopen:queue_log_level New 10
959 server max protocol Values Removed
960 server min protocol Values Removed
961 server multi channel support Changed Yes (on Linux and FreeBSD)
962 server smb3 signing algorithms New see man smb.conf
963 server smb3 encryption algorithms New see man smb.conf
964 winbind use krb5 enterprise principals Changed Yes
965 winbind scan trusted domains Changed No
968 CHANGES SINCE 4.15.0rc6
969 =======================
971 o Andrew Bartlett <abartlet@samba.org>
972 * BUG 14791: All the ways to specify a password are not documented.
974 o Ralph Boehme <slow@samba.org>
975 * BUG 14790: vfs_btrfs compression support broken.
976 * BUG 14828: Problems with commandline parsing.
977 * BUG 14829: smbd crashes when "ea support" is set to no.
979 o Stefan Metzmacher <metze@samba.org>
980 * BUG 14825: "{client,server} smb3 {signing,encryption} algorithms" should
981 use the same strings as smbstatus output.
982 * BUG 14828: Problems with commandline parsing.
984 o Alex Richardson <Alexander.Richardson@cl.cam.ac.uk>
985 * BUG 8773: smbd fails to run as root because it belongs to more than 16
986 groups on MacOS X.
988 o Martin Schwenke <martin@meltin.net>
989 * BUG 14784: Fix CTDB flag/status update race conditions.
992 CHANGES SINCE 4.15.0rc5
993 =======================
995 o Andrew Bartlett <abartlet@samba.org>
996 * BUG 14806: Address a signifcant performance regression in database access
997 in the AD DC since Samba 4.12.
998 * BUG 14807: Fix performance regression in lsa_LookupSids3/LookupNames4 since
999 Samba 4.9 by using an explicit database handle cache.
1000 * BUG 14817: An unuthenticated user can crash the AD DC KDC by omitting the
1001 server name in a TGS-REQ.
1002 * BUG 14818: Address flapping samba_tool_drs_showrepl test.
1003 * BUG 14819: Address flapping dsdb_schema_attributes test.
1005 o Luke Howard <lukeh@padl.com>
1006 * BUG 14817: An unuthenticated user can crash the AD DC KDC by omitting the
1007 server name in a TGS-REQ.
1009 o Gary Lockyer <gary@catalyst.net.nz>
1010 * BUG 14817: An unuthenticated user can crash the AD DC KDC by omitting the
1011 server name in a TGS-REQ.
1013 o Andreas Schneider <asn@samba.org>
1014 * BUG 14817: An unuthenticated user can crash the AD DC KDC by omitting the
1015 server name in a TGS-REQ.
1017 o Joseph Sutton <josephsutton@catalyst.net.nz>
1018 * BUG 14817: An unuthenticated user can crash the AD DC KDC by omitting the
1019 server name in a TGS-REQ.
1022 CHANGES SINCE 4.15.0rc4
1023 =======================
1025 o Jeremy Allison <jra@samba.org>
1026 * BUG 14809: Shares with variable substitutions cause core dump upon
1027 connection from MacOS Big Sur 11.5.2.
1028 * BUG 14816: Fix pathref open of a filesystem fifo in the DISABLE_OPATH
1029 build.
1031 o Andrew Bartlett <abartlet@samba.org>
1032 * BUG 14815: A subset of tests from Samba's selftest system were not being
1033 run, while others were run twice.
1035 o Ralph Boehme <slow@samba.org>
1036 * BUG 14771: Some VFS operations on pathref (O_PATH) handles fail on GPFS.
1037 * BUG 14787: net conf list crashes when run as normal user,
1038 * BUG 14803: smbd/winbindd started in daemon mode generate output on
1039 stderr/stdout.
1040 * BUG 14804: winbindd can crash because idmap child state is not fully
1041 initialized.
1043 o Stefan Metzmacher <metze@samba.org>
1044 * BUG 14771: Some VFS operations on pathref (O_PATH) handles fail on GPFS.
1047 CHANGES SINCE 4.15.0rc3
1048 =======================
1050 o Bjoern Jacke <bj@sernet.de>
1051 * BUG 14800: util_sock: fix assignment of sa_socklen.
1054 CHANGES SINCE 4.15.0rc2
1055 =======================
1057 o Jeremy Allison <jra@samba.org>
1058 * BUG 14760: vfs_streams_depot directory creation permissions and store
1059 location problems.
1060 * BUG 14766: vfs_ceph openat() doesn't cope with dirfsp != AT_FDCW.
1061 * BUG 14769: smbd panic on force-close share during offload write.
1062 * BUG 14805: OpenDir() loses the correct errno return.
1064 o Ralph Boehme <slow@samba.org>
1065 * BUG 14795: copy_file_range() may fail with EOPNOTSUPP.
1067 o Stefan Metzmacher <metze@samba.org>
1068 * BUG 14793: Start the SMB encryption as soon as possible.
1070 o Andreas Schneider <asn@samba.org>
1071 * BUG 14779: Winbind should not start if the socket path is too long.
1073 o Noel Power <noel.power@suse.com>
1074 * BUG 14760: vfs_streams_depot directory creation permissions and store
1075 location problems.
1078 CHANGES SINCE 4.15.0rc1
1079 =======================
1081 o Andreas Schneider <asn@samba.org>
1082 * BUG 14768: smbd/winbind should load the registry if configured
1083 * BUG 14777: do not quote passed argument of configure script
1084 * BUG 14779: Winbind should not start if the socket path is too long
1086 o Stefan Metzmacher <metze@samba.org>
1087 * BUG 14607: tree connect failed: NT_STATUS_INVALID_PARAMETER
1088 * BUG 14764: aes-256-gcm and aes-256-ccm doesn't work in the server
1090 o Ralph Boehme <slow@samba.org>
1091 * BUG 14700: file owner not available when file unredable
1093 o Jeremy Allison <jra@samba.org>
1094 * BUG 14607: tree connect failed: NT_STATUS_INVALID_PARAMETER
1095 * BUG 14759: 4.15rc can leak meta-data about the directory containing the
1096 share path
1099 KNOWN ISSUES
1100 ============
1102 https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.15#Release_blocking_bugs
1105 #######################################
1106 Reporting bugs & Development Discussion
1107 #######################################
1109 Please discuss this release on the samba-technical mailing list or by
1110 joining the #samba-technical IRC channel on irc.libera.chat or the
1111 #samba-technical:matrix.org matrix channel.
1113 If you do report problems then please try to send high quality
1114 feedback. If you don't provide vital information to help us track down
1115 the problem then you will probably be ignored. All bug reports should
1116 be filed under the Samba 4.1 and newer product in the project's Bugzilla
1117 database (https://bugzilla.samba.org/).
1120 ======================================================================
1121 == Our Code, Our Bugs, Our Responsibility.
1122 == The Samba Team
1123 ======================================================================