| blob | 9f604b0d45776ce63f716d54aab4ec78ad71e822 |
1 =============================
2 Release Notes for Samba 4.8.7
3 November 27, 2018
4 =============================
7 This is a security release in order to address the following defects:
9 o CVE-2018-14629 (Unprivileged adding of CNAME record causing loop in AD
10 Internal DNS server)
11 o CVE-2018-16841 (Double-free in Samba AD DC KDC with PKINIT)
12 o CVE-2018-16851 (NULL pointer de-reference in Samba AD DC LDAP server)
13 o CVE-2018-16853 (Samba AD DC S4U2Self crash in experimental MIT Kerberos
14 configuration (unsupported))
17 =======
18 Details
19 =======
21 o CVE-2018-14629:
22 All versions of Samba from 4.0.0 onwards are vulnerable to infinite
23 query recursion caused by CNAME loops. Any dns record can be added via
24 ldap by an unprivileged user using the ldbadd tool, so this is a
25 security issue.
27 o CVE-2018-16841:
28 When configured to accept smart-card authentication, Samba's KDC will call
29 talloc_free() twice on the same memory if the principal in a validly signed
30 certificate does not match the principal in the AS-REQ.
32 This is only possible after authentication with a trusted certificate.
34 talloc is robust against further corruption from a double-free with
35 talloc_free() and directly calls abort(), terminating the KDC process.
37 There is no further vulnerability associated with this issue, merely a
38 denial of service.
40 o CVE-2018-16851:
41 During the processing of an LDAP search before Samba's AD DC returns
42 the LDAP entries to the client, the entries are cached in a single
43 memory object with a maximum size of 256MB. When this size is
44 reached, the Samba process providing the LDAP service will follow the
45 NULL pointer, terminating the process.
47 There is no further vulnerability associated with this issue, merely a
48 denial of service.
50 o CVE-2018-16853:
51 A user in a Samba AD domain can crash the KDC when Samba is built in the
52 non-default MIT Kerberos configuration.
54 With this advisory we clarify that the MIT Kerberos build of the Samba
55 AD DC is considered experimental. Therefore the Samba Team will not
56 issue security patches for this configuration.
58 For more details and workarounds, please refer to the security advisories.
61 Changes since 4.8.6:
62 --------------------
64 o Andrew Bartlett <abartlet@samba.org>
65 * BUG 13628: CVE-2018-16841: heimdal: Fix segfault on PKINIT with
66 mis-matching principal.
67 * BUG 13678: CVE-2018-16853: build: The Samba AD DC, when build with MIT
68 Kerberos is experimental
70 o Aaron Haslett <aaronhaslett@catalyst.net.nz>
71 * BUG 13600: CVE-2018-14629: dns: CNAME loop prevention using counter.
73 o Garming Sam <garming@catalyst.net.nz>
74 * BUG 13674: CVE-2018-16851: ldap_server: Check ret before manipulating blob.
77 #######################################
78 Reporting bugs & Development Discussion
79 #######################################
81 Please discuss this release on the samba-technical mailing list or by
82 joining the #samba-technical IRC channel on irc.freenode.net.
84 If you do report problems then please try to send high quality
85 feedback. If you don't provide vital information to help us track down
86 the problem then you will probably be ignored. All bug reports should
87 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
88 database (https://bugzilla.samba.org/).
91 ======================================================================
92 == Our Code, Our Bugs, Our Responsibility.
93 == The Samba Team
94 ======================================================================
97 Release notes for older releases follow:
98 ----------------------------------------
100 =============================
101 Release Notes for Samba 4.8.6
102 October 9, 2018
103 =============================
106 This is the latest stable release of the Samba 4.8 release series.
109 Changes since 4.8.5:
110 --------------------
112 o Paulo Alcantara <paulo@paulo.ac>
113 * BUG 13578: s3: util: Do not take over stderr when there is no log file.
115 o Jeremy Allison <jra@samba.org>
116 * BUG 13585: s3: smbd: Ensure get_real_filename() copes with empty pathnames.
118 o Ralph Boehme <slow@samba.org>
119 * BUG 13441: vfs_fruit: delete 0 byte size streams if AAPL is enabled.
120 * BUG 13549: s3:smbd: Durable Reconnect fails because cookie.allow_reconnect
121 is not set.
123 o Alexander Bokovoy <ab@samba.org>
124 * BUG 13539: krb5-samba: Interdomain trust uses different salt principal.
126 o Volker Lendecke <vl@samba.org>
127 * BUG 13362: Fix possible memory leak in the Samba process.
128 * BUG 13441: vfs_fruit: Don't unlink the main file.
129 * BUG 13602: smbd: Fix a memleak in async search ask sharemode.
131 o Stefan Metzmacher <metze@samba.org>
132 * BUG 11517: Fix Samba GPO issue when Trust is enabled.
133 * BUG 13539: samba-tool: Add virtualKerberosSalt attribute to 'user
134 getpassword/syncpasswords'.
136 o Andreas Schneider <asn@samba.org>
137 * BUG 13606: wafsamba: Fix 'make -j<jobs>'.
139 o Martin Schwenke <martin@meltin.net>
140 * BUG 13592: ctdbd logs an error until it can successfully connect to
141 eventd.
142 * BUG 13617: Fix race conditions in CTDB recovery lock.
145 #######################################
146 Reporting bugs & Development Discussion
147 #######################################
149 Please discuss this release on the samba-technical mailing list or by
150 joining the #samba-technical IRC channel on irc.freenode.net.
152 If you do report problems then please try to send high quality
153 feedback. If you don't provide vital information to help us track down
154 the problem then you will probably be ignored. All bug reports should
155 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
156 database (https://bugzilla.samba.org/).
159 ======================================================================
160 == Our Code, Our Bugs, Our Responsibility.
161 == The Samba Team
162 ======================================================================
165 ----------------------------------------------------------------------
168 =============================
169 Release Notes for Samba 4.8.5
170 August 24, 2018
171 =============================
174 This is the latest stable release of the Samba 4.8 release series.
177 Changes since 4.8.4:
178 --------------------
180 o Jeremy Allison <jra@samba.org>
181 * BUG 13474: python: pysmbd: Additional error path leak fix.
182 * BUG 13511: libsmbclient: Initialize written value before use.
183 * BUG 13527: s3: libsmbclient: Fix cli_splice() fallback when reading less
184 than a complete file.
185 * BUG 13537: Using "sendfile = yes" with SMB2 can cause CPU spin.
187 o Andrew Bartlett <abartlet@samba.org>
188 * BUG 13519: ldb: Refuse to build Samba against a newer minor version of
189 ldb.
190 * BUG 13575: ldb: Release LDB 1.3.6.
192 o Bailey Berro <baileyberro@chromium.org>
193 * BUG 13511: libsmbclient: Initialize written in cli_splice_fallback().
195 o Ralph Boehme <slow@samba.org>
196 * BUG 13318: Durable Handles reconnect fails in a cluster when the cluster
197 fs uses different device ids.
198 * BUG 13351: s3: smbd: Always set vuid in check_user_ok().
199 * BUG 13441: vfs_fruit: Delete 0 byte size streams if AAPL is enabled.
200 * BUG 13451: Fail renaming file if that file has open streams.
201 * BUG 13505: lib: smb_threads: Fix access before init bug.
202 * BUG 13535: s3: smbd: Fix path check in
203 smbd_smb2_create_durable_lease_check().
205 o Alexander Bokovoy <ab@samba.org>
206 * BUG 13538: samba-tool trust: Support discovery via netr_GetDcName.
208 o Samuel Cabrero <scabrero@suse.de>
209 * BUG 13540: ctdb_mutex_ceph_rados_helper: Set SIGINT signal handler.
211 o David Disseldorp <ddiss@samba.org>
212 * BUG 13506: vfs_ceph: Don't lie about flock support.
213 * BUG 13540: Fix deadlock with ctdb_mutex_ceph_rados_helper.
215 o Amitay Isaacs <amitay@gmail.com>
216 * BUG 13493: ctdb: Fix build on FreeBSD and AIX.
218 o Volker Lendecke <vl@samba.org>
219 * BUG 13553: libsmb: Fix CID 1438243 (Unchecked return value), CID 1438244
220 (Unsigned compared against 0), CID 1438245 (Dereference before null check),
221 CID 1438246 (Unchecked return value).
222 * BUG 13584: vfs_fruit: Fix a panic if fruit_access_check detects a locking
223 conflict.
225 o Gary Lockyer <gary@catalyst.net.nz>
226 * BUG 13536: The current position in the dns name was not advanced past the
227 '.' character.
229 o Stefan Metzmacher <metze@samba.org>
230 * BUG 13308: samba-tool domain trust: Fix trust compatibility to Windows
231 Server 1709 and FreeIPA.
233 o Oleksandr Natalenko <oleksandr@redhat.com>
234 * BUG 13559: systemd: Only start smb when network interfaces are up.
236 o Noel Power <noel.power@suse.com>
237 * BUG 13553: Fix quotas with SMB2.
238 * BUG 13563: s3/smbd: Ensure quota code is only called when quota support
239 detected.
241 o Anoop C S <anoopcs@redhat.com>
242 * BUG 13204: s3/libsmb: Explicitly set delete_on_close token for rmdir.
244 o Andreas Schneider <asn@samba.org>
245 * BUG 13489: krb5_plugin: Install plugins to krb5 modules dir.
246 * BUG 13503: s3:winbind: Do not lookup local system accounts in AD.
248 o Martin Schwenke <martin@meltin.net>
249 * BUG 13499: Don't use CTDB_BROADCAST_VNNMAP.
250 * BUG 13500: ctdb-daemon: Only consider client ID for local database attach.
252 o Justin Stephenson <jstephen@redhat.com>
253 * BUG 13485: s3:client: Add "--quiet" option to smbclient.
255 o Ralph Wuerthner <ralph.wuerthner@de.ibm.com>
256 * BUG 13568: s3: vfs: time_audit: Fix handling of token_blob in
257 smb_time_audit_offload_read_recv().
260 #######################################
261 Reporting bugs & Development Discussion
262 #######################################
264 Please discuss this release on the samba-technical mailing list or by
265 joining the #samba-technical IRC channel on irc.freenode.net.
267 If you do report problems then please try to send high quality
268 feedback. If you don't provide vital information to help us track down
269 the problem then you will probably be ignored. All bug reports should
270 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
271 database (https://bugzilla.samba.org/).
274 ======================================================================
275 == Our Code, Our Bugs, Our Responsibility.
276 == The Samba Team
277 ======================================================================
280 ----------------------------------------------------------------------
283 =============================
284 Release Notes for Samba 4.8.4
285 August 14, 2018
286 =============================
289 This is a security release in order to address the following defects:
291 o CVE-2018-1139 (Weak authentication protocol allowed.)
292 o CVE-2018-1140 (Denial of Service Attack on DNS and LDAP server.)
293 o CVE-2018-10858 (Insufficient input validation on client directory
294 listing in libsmbclient.)
295 o CVE-2018-10918 (Denial of Service Attack on AD DC DRSUAPI server.)
296 o CVE-2018-10919 (Confidential attribute disclosure from the AD LDAP
297 server.)
300 =======
301 Details
302 =======
304 o CVE-2018-1139:
305 Vulnerability that allows authentication via NTLMv1 even if disabled.
307 o CVE-2018-1140:
308 Missing null pointer checks may crash the Samba AD DC, both over
309 DNS and LDAP.
311 o CVE-2018-10858:
312 A malicious server could return a directory entry that could corrupt
313 libsmbclient memory.
315 o CVE-2018-10918:
316 Missing null pointer checks may crash the Samba AD DC, over the
317 authenticated DRSUAPI RPC service.
319 o CVE-2018-10919:
320 Missing access control checks allow discovery of confidential attribute
321 values via authenticated LDAP search expressions.
324 Changes since 4.8.3:
325 --------------------
327 o Jeremy Allison <jra@samba.org>
328 * BUG 13453: CVE-2018-10858: libsmb: Harden smbc_readdir_internal() against
329 returns from malicious servers.
331 o Andrew Bartlett <abartlet@samba.org>
332 * BUG 13374: CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query
333 with escapes crashes, ldb: Release LDB 1.3.5 for CVE-2018-1140
334 * BUG 13552: CVE-2018-10918: cracknames: Fix DoS (NULL pointer de-ref) when
335 not servicePrincipalName is set on a user.
337 o Tim Beale <timbeale@catalyst.net.nz>
338 * BUG 13434: CVE-2018-10919: acl_read: Fix unauthorized attribute access via
339 searches.
341 o Günther Deschner <gd@samba.org>
342 * BUG 13360: CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it
343 is disabled via "ntlm auth".
345 o Andrej Gessel <Andrej.Gessel@janztec.com>
346 * BUG 13374: CVE-2018-1140 Add NULL check for ldb_dn_get_casefold() in
347 ltdb_index_dn_attr().
350 #######################################
351 Reporting bugs & Development Discussion
352 #######################################
354 Please discuss this release on the samba-technical mailing list or by
355 joining the #samba-technical IRC channel on irc.freenode.net.
357 If you do report problems then please try to send high quality
358 feedback. If you don't provide vital information to help us track down
359 the problem then you will probably be ignored. All bug reports should
360 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
361 database (https://bugzilla.samba.org/).
364 ======================================================================
365 == Our Code, Our Bugs, Our Responsibility.
366 == The Samba Team
367 ======================================================================
370 ----------------------------------------------------------------------
373 =============================
374 Release Notes for Samba 4.8.3
375 June 26, 2018
376 =============================
379 This is the latest stable release of the Samba 4.8 release series.
382 Changes since 4.8.2:
383 --------------------
385 o Jeremy Allison <jra@samba.org>
386 * BUG 13428: s3: smbd: Fix SMB2-FLUSH against directories.
387 * BUG 13457: s3: smbd: printing: Re-implement delete-on-close semantics for
388 print files missing since 3.5.x.
389 * BUG 13474: python: Fix talloc frame use in make_simple_acl().
391 o Jeffrey Altman <jaltman@secure-endpoints.com>
392 * BUG 11573: heimdal: lib/krb5: Do not fail set_config_files due to parse
393 error.
395 o Andrew Bartlett <abartlet@samba.org>
396 * ldb: version 1.3.4
397 * BUG 13448: ldb: One-level search was incorrectly falling back to full DB
398 scan.
399 * BUG 13452: ldb: Save a copy of the index result before calling the
400 callbacks.
401 * BUG 13454: No Backtrace given by Samba's AD DC by default.
402 * BUG 13471: ldb_tdb: Use mem_ctx and so avoid leak onto long-term memory
403 on duplicated add.
405 o Ralph Boehme <slow@samba.org>
406 * BUG 13432: s3:smbd: Fix interaction between chown and SD flags.
408 o Günther Deschner <gd@samba.org>
409 * BUG 13437: Fix building Samba with gcc 8.1.
411 o Andrej Gessel <Andrej.Gessel@janztec.com>
412 * BUG 13475: Fix several mem leaks in ldb_index ldb_search ldb_tdb.
414 o Volker Lendecke <vl@samba.org>
415 * BUG 13331: libgpo: Fix the build --without-ads.
417 o Stefan Metzmacher <metze@samba.org>
418 * BUG 13369: Looking up the user using the UPN results in user name with the
419 REALM instead of the DOMAIN.
420 * BUG 13427: Fix broken server side GENSEC_FEATURE_LDAP_STYLE handling
421 (NTLMSSP NTLM2 packet check failed due to invalid signature!).
423 o Christof Schmitt <cs@samba.org>
424 * BUG 13446: smbd: Flush dfree memcache on service reload.
425 * BUG 13478: krb5_wrap: Fix keep_old_entries logic for older Kerberos
426 libraries.
428 o Andreas Schneider <asn@samba.org>
429 * BUG 13369: Looking up the user using the UPN results in user name with the
430 REALM instead of the DOMAIN.
431 * BUG 13437: Fix building Samba with gcc 8.1.
432 * BUG 13440: s3:utils: Do not segfault on error in DoDNSUpdate().
433 * BUG 13480: krb5_plugin: Add winbind localauth plugin for MIT Kerberos.
435 o Lukas Slebodnik <lslebodn@fedoraproject.org>
436 * BUG 13459: ldb: Fix memory leak on module context.
439 #######################################
440 Reporting bugs & Development Discussion
441 #######################################
443 Please discuss this release on the samba-technical mailing list or by
444 joining the #samba-technical IRC channel on irc.freenode.net.
446 If you do report problems then please try to send high quality
447 feedback. If you don't provide vital information to help us track down
448 the problem then you will probably be ignored. All bug reports should
449 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
450 database (https://bugzilla.samba.org/).
453 ======================================================================
454 == Our Code, Our Bugs, Our Responsibility.
455 == The Samba Team
456 ======================================================================
459 ----------------------------------------------------------------------
462 =============================
463 Release Notes for Samba 4.8.2
464 May 16, 2018
465 =============================
468 This is the latest stable release of the Samba 4.8 release series.
470 Major bug fixes include:
471 ------------------------
473 o After update to 4.8.0 DC failed with "Failed to find our own
474 NTDS Settings objectGUID" (bug #13335).
476 Changes since 4.8.1:
477 --------------------
479 o Jeremy Allison <jra@samba.org>
480 * BUG 13380: s3: smbd: Generic fix for incorrect reporting of stream dos
481 attributes on a directory.
482 * BUG 13412: ceph: VFS: Add asynchronous fsync to ceph module, fake using
483 synchronous call.
484 * BUG 13419: s3: libsmbclient: Fix hard-coded connection error return of
485 ETIMEDOUT.
487 o Andrew Bartlett <abartlet@samba.org>
488 * BUG 13306: ldb: Release ldb 1.3.3:
489 * Fix failure to upgrade to the GUID index DB format.
490 * Add tests for GUID index behaviour.
491 * BUG 13420: s4-lsa: Fix use-after-free in LSA server.
492 * BUG 13430: winbindd: Do re-connect if the RPC call fails in the passdb
493 case.
495 o Ralph Boehme <slow@samba.org>
496 * BUG 13416: s3:cleanupd: Sends MSG_SMB_UNLOCK twice to interested peers.
497 * BUG 13414: s3:cleanupd: Use MSG_SMB_BRL_VALIDATE to signal cleanupd
498 unclean process shutdown.
500 o David Disseldorp <ddiss@samba.org>
501 * BUG 13425: vfs_ceph: add fake async pwrite/pread send/recv hooks.
503 o Amitay Isaacs <amitay@gmail.com>
504 * BUG 13411: ctdb-client: Remove ununsed functions from old client code.
506 o Björn Jacke <bjacke@samba.org>
507 * BUG 13395: printing: Return the same error code as windows does on upload
508 failures.
510 o Gary Lockyer <gary@catalyst.net.nz>
511 * BUG 13335: After update to 4.8.0 DC failed with "Failed to find our own
512 NTDS Settings objectGUID".
514 o Stefan Metzmacher <metze@samba.org>
515 * BUG 13400: nsswitch: Fix memory leak in winbind_open_pipe_sock() when the
516 privileged pipe is not accessable.
517 * BUG 13420: s4:lsa_lookup: remove TALLOC_FREE(state) after all
518 dcesrv_lsa_Lookup{Names,Sids}_base_map() calls.
520 o Vandana Rungta <vrungta@amazon.com>
521 * BUG 13424: s3: VFS: Fix memory leak in vfs_ceph.
523 o Christof Schmitt <cs@samba.org>
524 * BUG 13407: rpc_server: Fix NetSessEnum with stale sessions.
526 o Andreas Schneider <asn@samba.org>
527 * BUG 13417: s3:smbspool: Fix cmdline argument handling.
530 #######################################
531 Reporting bugs & Development Discussion
532 #######################################
534 Please discuss this release on the samba-technical mailing list or by
535 joining the #samba-technical IRC channel on irc.freenode.net.
537 If you do report problems then please try to send high quality
538 feedback. If you don't provide vital information to help us track down
539 the problem then you will probably be ignored. All bug reports should
540 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
541 database (https://bugzilla.samba.org/).
544 ======================================================================
545 == Our Code, Our Bugs, Our Responsibility.
546 == The Samba Team
547 ======================================================================
550 ----------------------------------------------------------------------
553 =============================
554 Release Notes for Samba 4.8.1
555 April 26, 2018
556 =============================
559 This is the latest stable release of the Samba 4.8 release series.
562 Changes since 4.8.0:
563 --------------------
565 o Jeremy Allison <jra@samba.org>
566 * BUG 13244: s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on
567 error, we don't own it here.
568 * BUG 13270: s3: smbd: Fix possible directory fd leak if the underlying OS
569 doesn't support fdopendir().
570 * BUG 13319: Round-tripping ACL get/set through vfs_fruit will increase the
571 number of ACE entries without limit.
572 * BUG 13347: s3: smbd: SMB2: Add DBGC_SMB2_CREDITS class to specifically
573 debug credit issues.
574 * BUG 13358: s3: smbd: Files or directories can't be opened DELETE_ON_CLOSE
575 without delete access.
576 * BUG 13372: s3: smbd: Fix memory leak in vfswrap_getwd().
577 * BUG 13375: s3: smbd: Unix extensions attempts to change wrong field in
578 fchown call.
580 o Björn Baumbach <bb@sernet.de>
581 * BUG 13337: ms_schema/samba-tool visualize: Fix python2.6 incompatibility.
583 o Timur I. Bakeyev <timur@iXsystems.com>
584 * BUG 13352: Fix invocation of gnutls_aead_cipher_encrypt().
586 o Ralph Boehme <slow@samba.org>
587 * BUG 13328: Windows 10 cannot logon on Samba NT4 domain.
588 * BUG 13332: winbindd: Recover loss of netlogon secure channel in case the
589 peer DC is rebooted.
590 * BUG 13363: s3:smbd: Don't use the directory cache for SMB2/3.
592 o Amitay Isaacs <amitay@gmail.com>
593 * BUG 13356: ctdb-client: Fix bugs in client code.
594 * BUG 13359: ctdb-scripts: Drop "net serverid wipe" from 50.samba event
595 script.
597 o Lutz Justen <ljusten@google.com>
598 * BUG 13368: s3: lib: messages: Don't use the result of sec_init() before
599 calling sec_init().
601 o Volker Lendecke <vl@samba.org>
602 * BUG 13273: libads: Fix the build '--without-ads'.
603 * BUG 13332: winbind: Keep "force_reauth" in invalidate_cm_connection,
604 add 'smbcontrol disconnect-dc'.
605 * BUG 13343: vfs_virusfilter: Fix CIDs 1428738-1428740.
606 * BUG 13367: dsdb: Fix CID 1034966 Uninitialized scalar variable.
607 * BUG 13370: rpc_server: Fix core dump in dfsgetinfo.
608 * BUG 13382: smbclient: Fix notify.
610 o Stefan Metzmacher <metze@samba.org>
611 * BUG 13215: Fix smbd panic if the client-supplied channel sequence number
612 wraps.
613 * BUG 13328: Windows 10 cannot logon on Samba NT4 domain.
614 * BUG 13342: lib/util: Remove unused '#include <sys/syscall.h>' from
615 tests/tfork.c.
616 * BUG 13343: Fix build errors with cc from developerstudio 12.5 on Solaris.
617 * BUG 13344: Fix the picky-developer build on FreeBSD 11.
618 * BUG 13345: s3:modules: Fix the build of vfs_aixacl2.c.
620 o Anton Nefedov
621 * BUG 13338: s3:smbd: map nterror on smb2_flush errorpath.
623 o Noel Power <noel.power@suse.com>
624 * BUG 13341: lib:replace: Fix linking when libtirpc-devel overwrites system
625 headers.
627 o Christof Schmitt <cs@samba.org>
628 * BUG 13312: winbindd: 'wbinfo --name-to-sid' returns misleading result on
629 invalid query.
631 o Andreas Schneider <asn@samba.org>
632 * BUG 13376: s3:passdb: Do not return OK if we don't have pinfo set up.
634 o Eric Vannier <evannier@google.com>
635 * BUG 13302: Allow AESNI to be used on all processor supporting AESNI.
638 #######################################
639 Reporting bugs & Development Discussion
640 #######################################
642 Please discuss this release on the samba-technical mailing list or by
643 joining the #samba-technical IRC channel on irc.freenode.net.
645 If you do report problems then please try to send high quality
646 feedback. If you don't provide vital information to help us track down
647 the problem then you will probably be ignored. All bug reports should
648 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
649 database (https://bugzilla.samba.org/).
652 ======================================================================
653 == Our Code, Our Bugs, Our Responsibility.
654 == The Samba Team
655 ======================================================================
658 ----------------------------------------------------------------------
661 =============================
662 Release Notes for Samba 4.8.0
663 March 13, 2018
664 =============================
667 This is the first stable release of the Samba 4.8 release series.
668 Please read the release notes carefully before upgrading.
671 UPGRADING
672 =========
674 New GUID Index mode in sam.ldb for the AD DC
675 --------------------------------------------
677 Users who upgrade a Samba AD DC in-place will experience a short delay
678 in the first startup of Samba while the sam.ldb is re-indexed.
680 Unlike in previous releases a transparent downgrade is not possible.
681 If you wish to downgrade such a DB to a Samba 4.7 or earlier version,
682 please run the source4/scripting/bin/sambaundoguididx script first.
684 Domain member setups require winbindd
685 -------------------------------------
687 Setups with "security = domain" or "security = ads" require a
688 running 'winbindd' now. The fallback that smbd directly contacts
689 domain controllers is gone.
691 smbclient reparse point symlink parameters reversed
692 ---------------------------------------------------
694 See the more detailed description below.
696 Changed trusted domains listing with wbinfo -m --verbose
697 --------------------------------------------------------
699 See the more detailed description below.
701 NEW FEATURES/CHANGES
702 ====================
704 New GUID Index mode in sam.ldb for the AD DC
705 --------------------------------------------
707 The new layout used for sam.ldb is GUID, rather than DN oriented.
708 This provides Samba's Active Directory Domain Controller with a faster
709 database, particularly at larger scale.
711 The underlying DB is still TDB, simply the choice of key has changed.
713 The new mode is not optional, so no configuration is required. Older
714 Samba versions cannot read the new database (see the upgrade
715 note above).
717 KDC GPO application
718 -------------------
720 Adds Group Policy support for the Samba kdc. Applies password policies
721 (minimum/maximum password age, minimum password length, and password
722 complexity) and kerberos policies (user/service ticket lifetime and
723 renew lifetime).
725 Adds the samba_gpoupdate script for applying and unapplying
726 policy. Can be applied automatically by setting
728 'apply group policies = yes'.
730 Time Machine Support with vfs_fruit
731 -----------------------------------
733 Samba can be configured as a Time Machine target for Apple Mac devices
734 through the vfs_fruit module. When enabling a share for Time Machine
735 support the relevant Avahi records to support discovery will be published
736 for installations that have been built against the Avahi client library.
738 Shares can be designated as a Time Machine share with the following setting:
740 'fruit:time machine = yes'
742 Support for lower casing the MDNS Name
743 --------------------------------------
745 Allows the server name that is advertised through MDNS to be set to the
746 hostname rather than the Samba NETBIOS name. This allows an administrator
747 to make Samba registered MDNS records match the case of the hostname
748 rather than being in all capitals.
750 This can be set with the following settings:
752 'mdns name = mdns'
754 Encrypted secrets
755 -----------------
757 Attributes deemed to be sensitive are now encrypted on disk. The sensitive
758 values are currently:
759 pekList
760 msDS-ExecuteScriptPassword
761 currentValue
762 dBCSPwd
763 initialAuthIncoming
764 initialAuthOutgoing
765 lmPwdHistory
766 ntPwdHistory
767 priorValue
768 supplementalCredentials
769 trustAuthIncoming
770 trustAuthOutgoing
771 unicodePwd
772 clearTextPassword
774 This encryption is enabled by default on a new provision or join, it
775 can be disabled at provision or join time with the new option
776 '--plaintext-secrets'.
778 However, an in-place upgrade will not encrypt the database.
780 Once encrypted, it is not possible to do an in-place downgrade (eg to
781 4.7) of the database. To obtain an unencrypted copy of the database a
782 new DC join should be performed, specifying the '--plaintext-secrets'
783 option.
785 The key file "encrypted_secrets.key" is created in the same directory
786 as the database and should NEVER be disclosed. It is included by the
787 samba_backup script.
789 Active Directory replication visualisation
790 ------------------------------------------
792 To work out what is happening in a replication graph, it is sometimes
793 helpful to use visualisations. We introduce a samba-tool subcommand to
794 write Graphviz dot output and generate text-based heatmaps of the
795 distance in hops between DCs.
797 There are two subcommands, two graphical modes, and (roughly) two modes of
798 operation with respect to the location of authority.
800 `samba-tool visualize ntdsconn` looks at NTDS Connections.
801 `samba-tool visualize reps` looks at repsTo and repsFrom objects.
803 In '--distance' mode (default), the distances between DCs are shown in
804 a matrix in the terminal. With '--color=yes', this is depicted as a
805 heatmap. With '--utf8' it is a lttle prettier.
807 In '--dot' mode, Graphviz dot output is generated. When viewed using
808 dot or xdot, this shows the network as a graph with DCs as vertices
809 and connections edges. Certain types of degenerate edges are shown in
810 different colours or line-styles.
812 smbclient reparse point symlink parameters reversed
813 ---------------------------------------------------
815 A bug in smbclient caused the 'symlink' command to reverse the
816 meaning of the new name and link target parameters when creating a
817 reparse point symlink against a Windows server. As this is a
818 little used feature the ordering of these parameters has been
819 reversed to match the parameter ordering of the UNIX extensions
820 'symlink' command. The usage message for this command has also
821 been improved to remove confusion.
823 Winbind changes
824 ---------------
826 The dependency to global list of trusted domains within
827 the winbindd processes has been reduced a lot.
829 The construction of that global list is not reliable and often
830 incomplete in complex trust setups. In most situations the list is not needed
831 any more for winbindd to operate correctly. E.g. for plain file serving via SMB
832 using a simple idmap setup with autorid, tdb or ad. However some more complex
833 setups require the list, e.g. if you specify idmap backends for specific
834 domains. Some pam_winbind setups may also require the global list.
836 If you have a setup that doesn't require the global list, you should set
837 "winbind scan trusted domains = no".
839 Improved support for trusted domains (as AD DC)
840 -----------------------------------------------
842 The support for trusted domains/forests has improved a lot.
844 External domain trusts, as well a transitive forest trusts,
845 are supported in both directions (inbound and outbound)
846 for Kerberos and NTLM authentication now.
848 The LSA LookupNames and LookupSids implementations
849 support resolving names and sids from trusts domains/forest
850 now. This is important in order to allow Samba based
851 domain members to make use of the trust.
853 However there are currently still a few limitations:
855 - It's not possible to add users/groups of a trusted domain
856 into domain groups. So group memberships are not expanded
857 on trust boundaries.
858 See https://bugzilla.samba.org/show_bug.cgi?id=13300
859 - Both sides of the trust need to fully trust each other!
860 - No SID filtering rules are applied at all!
861 - This means DCs of domain A can grant domain admin rights
862 in domain B.
863 - Selective (CROSS_ORIGANIZATION) authentication is
864 not supported. It's possible to create such a trust,
865 but the KDC and winbindd ignore them.
867 Changed trusted domains listing with wbinfo -m --verbose
868 --------------------------------------------------------
870 The trust properties printed by wbinfo -m --verbose have been changed to
871 correctly reflect the view of the system where wbinfo is executed.
873 The trust type field in particular can show additional values that correctly
874 reflect the type of the trust: "Local" for the local SAM and BUILTIN,
875 "Workstation" for a workstation trust to the primary domain, "RWDC" for the SAM
876 on a AD DC, "RODC" for the SAM on a read-only DC, "PDC" for the SAM on a
877 NT4-style DC, "Forest" for a AD forest trust and "External" for quarantined,
878 external or NT4-style trusts.
880 Indirect trusts are shown as "Routed" including the routing domain.
882 Example, on a AD DC (SDOM1):
884 Domain Name DNS Domain Trust Type Transitive In Out
885 BUILTIN Local
886 SDOM1 sdom1.site RWDC
887 WDOM3 wdom3.site Forest Yes No Yes
888 WDOM2 wdom2.site Forest Yes Yes Yes
889 SUBDOM31 subdom31.wdom3.site Routed (via WDOM3)
890 SUBDOM21 subdom21.wdom2.site Routed (via WDOM2)
892 Same setup, on a member of WDOM2:
894 Domain Name DNS Domain Trust Type Transitive In Out
895 BUILTIN Local
896 TITAN Local
897 WDOM2 wdom2.site Workstation Yes No Yes
898 WDOM1 wdom1.site Routed (via WDOM2)
899 WDOM3 wdom3.site Routed (via WDOM2)
900 SUBDOM21 subdom21.wdom2.site Routed (via WDOM2)
901 SDOM1 sdom1.site Routed (via WDOM2)
902 SUBDOM11 subdom11.wdom1.site Routed (via WDOM2)
904 The list of trusts may be incomplete and additional domains may appear as
905 "Routed" if a user of an unknown domain is successfully authenticated.
907 VirusFilter VFS module
908 ----------------------
910 This new module integrates with Sophos, F-Secure and ClamAV anti-virus
911 software to provide scanning and filtering of files on a Samba share.
914 Local authorization plugin for MIT Kerberos
915 -------------------------------------------
917 This plugin controls the relationship between Kerberos principals and AD
918 accounts through winbind. The module receives the Kerberos principal and the
919 local account name as inputs and can then check if they match. This can resolve
920 issues with canonicalized names returned by Kerberos within AD. If the user
921 tries to log in as 'alice', but the samAccountName is set to ALICE (uppercase),
922 Kerberos would return ALICE as the username. Kerberos would not be able to map
923 'alice' to 'ALICE' in this case and auth would fail. With this plugin account
924 names can be correctly mapped. This only applies to GSSAPI authentication,
925 not for the geting the initial ticket granting ticket.
927 REMOVED FEATURES
928 ================
930 'net serverid' commands removed
931 -------------------------------
933 The two commands 'net serverid list' and 'net serverid wipe' have been
934 removed, because the file serverid.tdb is not used anymore.
936 'net serverid list' can be replaced by listing all files in the
937 subdirectory "msg.lock" of Samba's "lock directory". The unique id
938 listed by 'net serverid list' is stored in every process' lockfile in
939 "msg.lock".
941 'net serverid wipe' is not necessary anymore. It was meant primarily
942 for clustered environments, where the serverid.tdb file was not
943 properly cleaned up after single node crashes. Nowadays smbd and
944 winbind take care of cleaning up the msg.lock and msg.sock directories
945 automatically.
947 NT4-style replication based net commands removed
948 ------------------------------------------------
950 The following commands and sub-commands have been removed from the
951 "net" utility:
953 net rpc samdump
954 net rpc vampire ldif
956 Also, replicating from a real NT4 domain with "net rpc vampire" and
957 "net rpc vampire keytab" has been removed.
959 The NT4-based commands were accidentally broken in 2013, and nobody
960 noticed the breakage. So instead of fixing them including tests (which
961 would have meant writing a server for the protocols, which we don't
962 have) we decided to remove them.
964 For the same reason, the "samsync", "samdeltas" and "database_redo"
965 commands have been removed from rpcclient.
967 "net rpc vampire keytab" from Active Directory domains continues to be
968 supported.
970 vfs_aio_linux module removed
971 ----------------------------
973 The current Linux kernel aio does not match what Samba would
974 do. Shipping code that uses it leads people to false
975 assumptions. Samba implements async I/O based on threads by default,
976 there is no special module required to see benefits of read and write
977 request being sent do the disk in parallel.
980 smb.conf changes
981 ================
983 Parameter Name Description Default
984 -------------- ----------- -------
985 apply group policies New no
986 auth methods Removed
987 binddns dir New
988 client schannel Default changed/ yes
989 Deprecated
990 gpo update command New
991 ldap ssl ads Deprecated
992 map untrusted to domain Removed
993 oplock contention limit Removed
994 prefork children New 1
995 mdns name New netbios
996 fruit:time machine New false
997 profile acls Removed
998 use spnego Removed
999 server schannel Default changed/ yes
1000 Deprecated
1001 unicode Deprecated
1002 winbind scan trusted domains New yes
1003 winbind trusted domains only Removed
1006 CHANGES SINCE 4.8.0rc4
1007 ======================
1009 o Jeremy Allison <jra@samba.org>
1010 * BUG 11343: CVE-2018-1050: Codenomicon crashes in spoolss server code.
1012 o Ralph Boehme <slow@samba.org>
1013 * BUG 13272: CVE-2018-1057: Unprivileged user can change any user (and admin)
1014 password.
1015 * BUG 13313: nsswitch: Fix wbinfo -m --verbose trust type "Local".
1017 o Stefan Metzmacher <metze@samba.org>
1018 * BUG 13272: CVE-2018-1057: Unprivileged user can change any user (and admin)
1019 password.
1021 o Dan Robertson <drobertson@tripwire.com>
1022 * BUG 13310: libsmb: Use smb2 tcon if conn_protocol >= SMB2_02.
1024 o Andreas Schneider <asn@samba.org>
1025 * BUG 13315: s3:smbd: Do not crash if we fail to init the session table.
1028 CHANGES SINCE 4.8.0rc3
1029 ======================
1031 o Ralph Boehme <slow@samba.org>
1032 * BUG 13287: Fix numerous trust related bugs in winbindd and s4 LSA RPC
1033 server.
1034 * BUG 13296: vfs_fruit: Use off_t, not size_t for TM size calculations.
1036 o Alexander Bokovoy <ab@samba.org>
1037 * BUG 13304: mit-kdb: Support MIT Kerberos 1.16 KDB API changes.
1039 o Günther Deschner <gd@samba.org>
1040 * BUG 13277: build: Fix libceph-common detection.
1042 o Poornima G <pgurusid@redhat.com>
1043 * BUG 13297: vfs_glusterfs: Fix the wrong pointer being sent in
1044 glfs_fsync_async.
1046 o Volker Lendecke <vl@samba.org>
1047 * BUG 13305: vfs_fileid: Fix the 32-bit build.
1049 o Stefan Metzmacher <metze@samba.org>
1050 * BUG 13206: Unable to authenticate with an empty string domain ''.
1051 * BUG 13276: configure aborts without libnettle/gnutls.
1052 * BUG 13278: winbindd (on an AD DC) should only use netlogon/lsa against
1053 trusted domains.
1054 * BUG 13287: Fix numerous trust related bugs in winbindd and s4 LSA RPC
1055 server.
1056 * BUG 13290: A disconnecting winbind client can cause a problem in
1057 the winbind parent child communication.
1058 * BUG 13291: tevent: version 0.9.36.
1059 * BUG 13292: winbind requests could get stuck in the queue of a busy child,
1060 while later requests could get served fine by other children.
1061 * BUG 13293: Minimize the lifetime of winbindd_cli_state->{pw,gr}ent_state.
1062 * BUG 13294: Avoid using fstrcpy(domain->dcname,...) on a char *.
1063 * BUG 13295: winbind parent should find the dc of a foreign domain via the
1064 primary domain.
1065 * BUG 13299: Disable support for CROSS_ORGANIZATION domains.
1066 * BUG 13306: ldb: version 1.3.2.
1068 o Sachin Prabhu <sprabhu@redhat.com>
1069 * BUG 13303: vfs_glusterfs: Add fallocate support for vfs_glusterfs.
1071 o Garming Sam <garming@catalyst.net.nz>
1072 * BUG 13031: subnet: Avoid a segfault when renaming subnet objects.
1073 * BUG 13269: RODC may skip objects during replication due to naming
1074 conflicts.
1077 CHANGES SINCE 4.8.0rc2
1078 ======================
1080 o Trever L. Adams <trever.adams@gmail.com>
1081 * BUG 13246: Backport Samba VirusFilter.
1083 o Ralph Boehme <slow@samba.org>
1084 * BUG 13228: dbcheck: Add support for restoring missing forward links.
1086 o Günther Deschner <gd@samba.org>
1087 * BUG 13221: python: fix the build with python3.
1089 o Stefan Metzmacher <metze@samba.org>
1090 * BUG 13228: dbcheck: Add support for restoring missing forward links.
1093 CHANGES SINCE 4.8.0rc1
1094 ======================
1096 o Günther Deschner <gd@samba.org>
1097 * BUG 13227: packaging: Fix default systemd-dir path.
1098 * BUG 13238: build: Deal with recent glibc sunrpc header removal.
1100 o Stefan Metzmacher <metze@samba.org>
1101 * BUG 13228: repl_meta_data: fix linked attribute corruption on databases
1102 with unsorted links on expunge.
1104 o Christof Schmitt <cs@samba.org>
1105 * BUG 13217: s3/smbd: Remove file system sharemode before calling unlink.
1107 o Andreas Schneider <asn@samba.org>
1108 * BUG 13209: Small improvements in winbindd for the resource cleanup in error
1109 cases.
1110 * BUG 13238: Make Samba work with tirpc and libnsl2.
1113 KNOWN ISSUES
1114 ============
1116 https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.8#Release_blocking_bugs
1119 #######################################
1120 Reporting bugs & Development Discussion
1121 #######################################
1123 Please discuss this release on the samba-technical mailing list or by
1124 joining the #samba-technical IRC channel on irc.freenode.net.
1126 If you do report problems then please try to send high quality
1127 feedback. If you don't provide vital information to help us track down
1128 the problem then you will probably be ignored. All bug reports should
1129 be filed under the Samba 4.1 and newer product in the project's Bugzilla
1130 database (https://bugzilla.samba.org/).
1133 ======================================================================
1134 == Our Code, Our Bugs, Our Responsibility.
1135 == The Samba Team
1136 ======================================================================