4 This is the second release candidate of Samba 4.19. This is *not*
5 intended for production environments and is designed for testing
6 purposes only. Please report any defects via the Samba bug reporting
7 system at https://bugzilla.samba.org/.
9 Samba 4.19 will be the next version of the Samba suite.
19 Migrated smbget to use common command line parser
20 -------------------------------------------------
22 The smbget utility implemented its own command line parsing logic. After
23 discovering an issue we decided to migrate it to use the common command line
24 parser. This has some advantages as you get all the feature it provides like
25 Kerberos authentication. The downside is that breaks the options interface.
26 The support for smbgetrc has been removed. You can use an authentication file
27 if needed, this is documented in the manpage.
29 Please check the smbget manpage or --help output.
34 The libgpo.get_gpo_list function has been deprecated in favor of
35 an implementation written in python. The new function can be imported via
36 `import samba.gp`. The python implementation connects to Active Directory
37 using the SamDB module, instead of ADS (which is what libgpo uses).
39 Improved winbind logging and a new tool for parsing the winbind logs
40 --------------------------------------------------------------------
42 Winbind logs (if smb.conf 'winbind debug traceid = yes' is set) contain new
43 trace header fields 'traceid' and 'depth'. Field 'traceid' allows to track the
44 trace records belonging to the same request. Field 'depth' allows to track the
45 request nesting level. A new tool samba-log-parser is added for better log
48 AD database prepared to FL 2016 standards for new domains
49 ---------------------------------------------------------
51 While Samba still provides only Functional Level 2008R2 by default,
52 Samba as an AD DC will now, in provision ensure that the blank
53 database is already prepared for Functional Level 2016, with AD Schema
56 This preparation is of the default objects in the database, adding
57 containers for Authentication Policies, Authentication Silos and AD
58 claims in particular. These DB objects must be updated to allow
59 operation of the new features found in higher functional levels.
61 Kerberos Claims, Authentication Silos and NTLM authentication policies
62 ----------------------------------------------------------------------
64 An initial, partial implementation of Active Directory Functional
65 Level 2012, 2012R2 and 2016 is available in this release.
67 In particular Samba will issue Active Directory "Claims" in the PAC,
68 for member servers that support these, and honour in-directory
69 configuration for Authentication Policies and Authentication Silos.
71 The primary limitation is that while Samba can read and write claims
72 in the directory, and populate the PAC, Samba does not yet use them
73 for access control decisions.
75 While we continue to develop these features, existing domains can
76 test the feature by selecting the functional level in provision or
77 raising the DC functional level by setting
79 ad dc functional level = 2016
83 The smb.conf file on each DC must have 'ad dc functional level = 2016'
84 set to have the partially complete feature available. This will also,
85 at first startup, update the server's own AD entry with the configured
88 For new domains, add these parameters to 'samba-tool provision'
90 --option="ad dc functional level = 2016" --function-level=2016
92 The second option, setting the overall domain functional level
93 indicates that all DCs should be at this functional level.
95 To raise the domain functional level of an existing domain, after
96 updating the smb.conf and restarting Samba run
97 samba-tool domain schemaupgrade --schema=2019
98 samba-tool domain functionalprep --function-level=2016
99 samba-tool domain level raise --domain-level=2016 --forest-level=2016
101 Improved KDC Auditing
102 ---------------------
104 As part of the auditing required to allow successful deployment of
105 Authentication Policies and Authentication Silos, our KDC now provides
106 Samba-style JSON audit logging of all issued Kerberos tickets,
107 including if they would fail a policy that is not yet enforced.
108 Additionally most failures are audited, (after the initial
109 pre-validation of the request).
111 Kerberos Armoring (FAST) Support for Windows clients
112 ----------------------------------------------------
114 In domains where the domain controller functional level is set, as
115 above, to 2012, 2012_R2 or 2016, Windows clients will, if configured
116 via GPO, use FAST to protect user passwords between (in particular) a
117 workstation and the KDC on the AD DC. This is a significant security
118 improvement, as weak passwords in an AS-REQ are no longer available
121 Claims compression in the AD PAC
122 --------------------------------
124 Samba as an AD DC will compress "AD claims" using the same compression
125 algorithm as Microsoft Windows.
127 Resource SID compression in the AD PAC
128 --------------------------------------
130 Samba as an AD DC will now correctly populate the various PAC group
131 membership buffers, splitting global and local groups correctly.
133 Additionally, Samba marshals Resource SIDs, being local groups in the
134 member server's own domain, to only consume a header and 4 bytes per
135 group in the PAC, not a full-length SID worth of space each. This is
136 known as "Resource SID compression".
138 New samba-tool support for silos, claims, sites and subnets.
139 ------------------------------------------------------------
141 samba-tool can now list, show, add and manipulate Authentication Silos
142 (silos) and Active Directory Authentication Claims (claims).
144 samba-tool can now list and show Active Directory sites and subnets.
146 A new Object Relational Model (ORM) based architecture, similar to
147 that used with Django, has been built to make adding new samba-tool
148 subcommands simpler and more consistent, with JSON output available
149 standard on these new commands.
151 Updated GnuTLS requirement / in-tree cryptography removal
152 ----------------------------------------------------------
154 Samba requires GnuTLS 3.6.13 and prefers GnuTLS 3.6.14 or later.
156 This has allowed Samba to remove all of our in-tree cryptography,
157 except that found in our Heimdal import. Samba's runtime cryptography
158 needs are now all provided by GnuTLS.
160 (The GnuTLS vesion requirement is raised to 3.7.2 on systems without
161 the Linux getrandom())
163 We also use Python's cryptography module for our testing.
165 The use of well known cryptography libraries makes Samba easier for
166 end-users to validate and deploy, and for distributors to ship. This
167 is the end of a very long journey for Samba.
169 Updated Heimdal import
170 ----------------------
172 Samba's Heimdal branch (known as lorikeet-heimdal) has been updated to
173 the current pre-8.0 (master) tree from upstream Heimdal, ensuring that
174 this vendored copy, included in our release remains as close as
175 possible to the current upstream code.
177 Revocation support in Heimdal KDC for PKINIT certificates
178 ---------------------------------------------------------
180 Samba will now correctly honour the revocation of 'smart card'
181 certificates used for PKINIT Kerberos authentication.
183 This list is reloaded each time the file changes, so no further action
184 other than replacing the file is required. The additional krb5.conf
188 pkinit_revoke = FILE:/path/to/crl.pem
190 Information on the "Smart Card login" feature as a whole is at:
191 https://wiki.samba.org/index.php/Samba_AD_Smart_Card_Login
193 Protocol level testsuite for (Smart Card Logon) PKINIT
194 ------------------------------------------------------
196 Previously Samba's PKINIT support in the KDC was tested by use of
197 shell scripts around the client tools of MIT or Heimdal Kerberos.
198 Samba's independently written python testsuite has been extended to
199 validate KDC behaviour for PKINIT.
201 Require encrypted connection to modify unicodePwd on the AD DC
202 --------------------------------------------------------------
204 Setting the password on an AD account on should never be attempted
205 over a plaintext or signed-only LDAP connection. If the unicodePwd
206 (or userPassword) attribute is modified without encryption (as seen by
207 Samba), the request will be rejected. This is to encourage the
208 administrator to use an encrypted connection in the future.
210 NOTE WELL: If Samba is accessed via a TLS frontend or load balancer,
211 the LDAP request will be regarded as plaintext.
213 Samba AD TLS Certificates can be reloaded
214 -----------------------------------------
216 The TLS certificates used for Samba's AD DC LDAP server were
217 previously only read on startup, and this meant that when then expired
218 it was required to restart Samba, disrupting service to other users.
220 smbcontrol ldap_server reload-certs
222 This will now allow these certificates to be reloaded 'on the fly'
232 Parameter Name Description Default
233 -------------- ----------- -------
234 winbind debug traceid Add traceid No
235 directory name cache size Removed
238 CHANGES SINCE 4.19.0rc1
239 =======================
241 o Andrew Bartlett <abartlet@samba.org>
242 * BUG 9959: Windows client join fails if a second container CN=System exists
245 o Noel Power <noel.power@suse.com>
246 * BUG 15435: regression DFS not working with widelinks = true.
248 o Arvid Requate <requate@univention.de>
249 * BUG 9959: Windows client join fails if a second container CN=System exists
252 o Joseph Sutton <josephsutton@catalyst.net.nz>
253 * BUG 15443: Heimdal fails to build on 32-bit FreeBSD.
255 o Jones Syue <jonessyue@qnap.com>
256 * BUG 15441: samba-tool ntacl get segfault if aio_pthread appended.
262 https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.19#Release_blocking_bugs
265 #######################################
266 Reporting bugs & Development Discussion
267 #######################################
269 Please discuss this release on the samba-technical mailing list or by
270 joining the #samba-technical:matrix.org matrix room, or
271 #samba-technical IRC channel on irc.libera.chat
273 If you do report problems then please try to send high quality
274 feedback. If you don't provide vital information to help us track down
275 the problem then you will probably be ignored. All bug reports should
276 be filed under the Samba 4.1 and newer product in the project's Bugzilla
277 database (https://bugzilla.samba.org/).
280 ======================================================================
281 == Our Code, Our Bugs, Our Responsibility.
283 ======================================================================