| blob | 7268196fed8e8f3851eadaa0de42b728a81b7e20 |
1 =============================
2 Release Notes for Samba 4.4.7
3 October 26, 2016
4 =============================
7 This is the latest stable release of Samba 4.4.
9 Major enhancements in Samba 4.4.7 include:
11 o Let winbindd discard expired kerberos tickets when built against
12 (internal) heimdal (BUG #12369).
13 o REGRESSION: smbd segfaults on startup, tevent context being freed
14 (BUG #12283).
17 Changes since 4.4.6:
18 --------------------
20 o Jeremy Allison <jra@samba.org>
21 * BUG 11259: smbd contacts a domain controller for each session.
22 * BUG 12283: REGRESSION: smbd segfaults on startup, tevent context being
23 freed.
24 * BUG 12291: source3/lib/msghdr: Fix syntax error before or at: ;.
25 * BUG 12381: s3: cldap: cldap_multi_netlogon_send() fails with one bad IPv6
26 address.
28 o Christian Ambach <ambi@samba.org>
29 * BUG 9945: Setting specific logger levels in smb.conf makes 'samba-tool drs
30 showrepl' crash.
32 o Björn Baumbach <bb@sernet.de>
33 * BUG 8618: s3-printing: Fix migrate printer code.
35 o Ralph Boehme <slow@samba.org>
36 * BUG 12261: s3/smbd: Set FILE_ATTRIBUTE_DIRECTORY as necessary.
38 o Günther Deschner <gd@samba.org>
39 * BUG 12285: "DriverVersion" registry backend parsing incorrect in spoolss.
41 o David Disseldorp <ddiss@samba.org>
42 * BUG 12144: smbd/ioctl: Match WS2016 ReFS get compression behaviour.
44 o Amitay Isaacs <amitay@gmail.com>
45 * BUG 12287: CTDB PID file handling is too weak.
47 o Volker Lendecke <vl@samba.org>
48 * BUG 12045: gencache: Bail out of stabilize if we can not get the allrecord
49 lock.
50 * BUG 12283: glusterfs: Avoid tevent_internal.h.
51 * BUG 12374: spoolss: Fix caching of printername->sharename.
53 o Stefan Metzmacher <metze@samba.org>
54 * BUG 12283: REGRESSION: smbd segfaults on startup, tevent context being
55 freed.
56 * BUG 12369: Let winbindd discard expired kerberos tickets when built against
57 (internal) heimdal.
59 o Noel Power <noel.power@suse.com>
60 * BUG 12298: s3/winbindd: Using default domain with user@domain.com format
61 fails.
63 o Jose A. Rivera <jarrpa@samba.org>
64 * BUG 12362: ctdb-scripts: Avoid dividing by zero in memory calculation.
66 o Anoop C S <anoopcs@redhat.com>
67 * BUG 12377: vfs_glusterfs: Fix a memory leak in connect path.
69 o Andreas Schneider <asn@samba.org>
70 * BUG 12269: nss_wins has incorrect function definitions for gethostbyname*.
71 * BUG 12276: s3-lib: Fix %G substitution in AD member environment.
72 * BUG 12364: s3-utils: Fix loading smb.conf in smbcquotas.
74 o Martin Schwenke <martin@meltin.net>
75 * BUG 12287: CTDB PID file handling is too weak.
76 * BUG 12362: ctdb-scripts: Fix incorrect variable reference.
79 #######################################
80 Reporting bugs & Development Discussion
81 #######################################
83 Please discuss this release on the samba-technical mailing list or by
84 joining the #samba-technical IRC channel on irc.freenode.net.
86 If you do report problems then please try to send high quality
87 feedback. If you don't provide vital information to help us track down
88 the problem then you will probably be ignored. All bug reports should
89 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
90 database (https://bugzilla.samba.org/).
93 ======================================================================
94 == Our Code, Our Bugs, Our Responsibility.
95 == The Samba Team
96 ======================================================================
99 Release notes for older releases follow:
100 ----------------------------------------
102 =============================
103 Release Notes for Samba 4.4.6
104 September 22, 2016
105 =============================
108 This is the latest stable release of Samba 4.4.
111 Changes since 4.4.5:
112 --------------------
114 o Michael Adam <obnox@samba.org>
115 * BUG 11977: libnet: Ignore realm setting for domain security joins to AD
116 domains if 'winbind rpc only = true'.
117 * BUG 12155: idmap: Centrally check that unix IDs returned by the idmap
118 backends are in range.
120 o Jeremy Allison <jra@samba.org>
121 * BUG 11838: s4: ldb: Ignore case of "range" in sscanf as we've already
122 checked for its presence.
123 * BUG 11845: Incorrect bytecount in ReadAndX smb1 response.
124 * BUG 11955: lib: Fix uninitialized read in msghdr_copy.
125 * BUG 11959: s3: krb5: keytab - The done label can be jumped to with context
126 == NULL.
127 * BUG 11986: s3: libsmb: Correctly trim a trailing \\ character in
128 cli_smb2_create_fnum_send() when passing a pathname to SMB2 create.
129 * BUG 12021: Fix smbd crash (Signal 4) on File Delete.
130 * BUG 12135: libgpo: Correctly use the 'server' parameter after parsing it
131 out of the GPO path.
132 * BUG 12139: s3: oplock: Fix race condition when closing an oplocked file.
133 * BUG 12272: Fix messaging subsystem crash.
135 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
136 * BUG 11750: gcc6 fails to build internal heimdal.
138 o Andrew Bartlett <abartlet@samba.org>
139 * BUG 11991: build: Build less of Samba when building
140 '--without-ntvfs-fileserver'.
141 * BUG 12026: build: Always build eventlog6. This is not a duplicate of
142 eventlog.
143 * BUG 12154: ldb-samba: Add "secret" as a value to hide in LDIF files.
144 * BUG 12178: dbcheck: Abandon dbcheck if we get an error during a
145 transaction.
147 o Ralph Boehme <slow@samba.org>
148 * BUG 10008: dbwrap_ctdb: Treat empty records in ltdb as non-existing.
149 * BUG 11520: Fix DNS secure updates.
150 * BUG 11961: idmap_autorid allocates ids for unknown SIDs from other
151 backends.
152 * BUG 11992: s3/smbd: Only use stored dos attributes for
153 open_match_attributes() check.
154 * BUG 12005: smbd: Ignore ctdb tombstone records in
155 fetch_share_mode_unlocked_parser().
156 * BUG 12016: cleanupd terminates main smbd on exit.
157 * BUG 12028: vfs_acl_xattr: Objects without NT ACL xattr.
158 * BUG 12105: async_req: Make async_connect_send() "reentrant".
159 * BUG 12177: vfs_acl_common: Fix unexpected synthesized default ACL from
160 vfs_acl_xattr.
161 * BUG 12181: vfs_acl_xattr|tdb: Enforced settings when
162 "ignore system acls = yes".
164 o Alexander Bokovoy <ab@samba.org>
165 * BUG 11975: libnet_join: use sitename if it was set by pre-join detection.
167 o Günther Deschner <gd@samba.org>
168 * BUG 11977: s3-libnet: Print error string even on successful completion of
169 libnetjoin.
171 o Amitay Isaacs <amitay@gmail.com>
172 * BUG 11940: CTDB fails to recover large database.
173 * BUG 11941: CTDB does not ban misbehaving nodes during recovery.
174 * BUG 11946: Samba and CTDB packages both have tevent-unix-util dependency.
175 * BUG 11956: ctdb-recoverd: Avoid duplicate recoverd event in parallel
176 recovery.
177 * BUG 12158: CTDB release IP fixes.
178 * BUG 12259: ctdb-protocol: Fix marshalling for GET_DB_SEQNUM control
179 request.
180 * BUG 12271: CTDB recovery does not terminate if no node is banned due to
181 failure.
182 * BUG 12275: ctdb-recovery-helper: Add missing initialisation of ban_credits.
184 o Volker Lendecke <vl@samba.org>
185 * BUG 12268: smbd: Reset O_NONBLOCK on open files.
187 o Stefan Metzmacher <metze@samba.org>
188 * BUG 11948: dcerpc.idl: Remove unused DCERPC_NCACN_PAYLOAD_MAX_SIZE.
189 * BUG 11982: Invalid auth_pad_length is not ignored for BIND_* and ALTER_*
190 pdus.
191 * BUG 11994: gensec/spnego: Work around missing server mechListMIC in SMB
192 servers.
193 * BUG 12007: libads: Ensure the right ccache is used during spnego bind.
194 * BUG 12018: python/remove_dc: Handle dnsNode objects without dnsRecord
195 attribute.
196 * BUG 12129: samba-tool/ldapcmp: Ignore differences of whenChanged.
198 o Marc Muehlfeld <mmuehlfeld@samba.org>
199 * BUG 12023: man: Wrong option for parameter ldap ssl in smb.conf man page.
201 o Andreas Schneider <asn@samba.org>
202 * BUG 11936: libutil: Support systemd 230.
203 * BUG 11999: s3-winbind: Fix memory leak with each cached credential login.
204 * BUG 12104: ctdb-waf: Move ctdb tests to libexec directory.
205 * BUG 12175: s3-util: Fix asking for username and password in smbget.
207 o Martin Schwenke <martin@meltin.net>
208 * BUG 12104: ctdb-packaging: Move ctdb tests to libexec directory.
209 * BUG 12110: ctdb-daemon: Fix several Coverity IDs.
210 * BUG 12158: CTDB release IP fixes.
211 * BUG 12161: Fix CTDB cumulative takeover timeout.
212 * BUG 12180: Fix CTDB crashes running eventscripts.
214 o Uri Simchoni <uri@samba.org>
215 * BUG 12006: auth: Fix a memory leak in gssapi_get_session_key().
216 * BUG 12145: smbd: If inherit owner is enabled, the free disk on a folder
217 should take the owner's quota into account.
218 * BUG 12149: smbd: Allow reading files based on FILE_EXECUTE access right.
219 * BUG 12172: Fix access of snapshot folders via SMB1.
221 o Lorinczy Zsigmond <lzsiga@freemail.c3.hu>
222 * BUG 11947: lib: replace: snprintf: Fix length calculation for hex/octal
223 64-bit values.
226 #######################################
227 Reporting bugs & Development Discussion
228 #######################################
230 Please discuss this release on the samba-technical mailing list or by
231 joining the #samba-technical IRC channel on irc.freenode.net.
233 If you do report problems then please try to send high quality
234 feedback. If you don't provide vital information to help us track down
235 the problem then you will probably be ignored. All bug reports should
236 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
237 database (https://bugzilla.samba.org/).
240 ======================================================================
241 == Our Code, Our Bugs, Our Responsibility.
242 == The Samba Team
243 ======================================================================
246 ----------------------------------------------------------------------
249 =============================
250 Release Notes for Samba 4.4.5
251 July 7, 2016
252 =============================
255 This is a security release in order to address the following defect:
257 o CVE-2016-2119 (Client side SMB2/3 required signing can be downgraded)
259 =======
260 Details
261 =======
263 o CVE-2016-2119:
264 It's possible for an attacker to downgrade the required signing for
265 an SMB2/3 client connection, by injecting the SMB2_SESSION_FLAG_IS_GUEST
266 or SMB2_SESSION_FLAG_IS_NULL flags.
268 This means that the attacker can impersonate a server being connected to by
269 Samba, and return malicious results.
271 The primary concern is with winbindd, as it uses DCERPC over SMB2 when talking
272 to domain controllers as a member server, and trusted domains as a domain
273 controller. These DCE/RPC connections were intended to protected by the
274 combination of "client ipc signing" and
275 "client ipc max protocol" in their effective default settings
276 ("mandatory" and "SMB3_11").
278 Additionally, management tools like net, samba-tool and rpcclient use DCERPC
279 over SMB2/3 connections.
281 By default, other tools in Samba are unprotected, but rarely they are
282 configured to use smb signing, via the "client signing" parameter (the default
283 is "if_required"). Even more rarely the "client max protocol" is set to SMB2,
284 rather than the NT1 default.
286 If both these conditions are met, then this issue would also apply to these
287 other tools, including command line tools like smbcacls, smbcquota, smbclient,
288 smbget and applications using libsmbclient.
291 Changes since 4.4.4:
292 --------------------
294 o Stefan Metzmacher <metze@samba.org>
295 * BUG 11860: CVE-2016-2119: Fix client side SMB2 signing downgrade.
296 * BUG 11948: Total dcerpc response payload more than 0x400000.
299 #######################################
300 Reporting bugs & Development Discussion
301 #######################################
303 Please discuss this release on the samba-technical mailing list or by
304 joining the #samba-technical IRC channel on irc.freenode.net.
306 If you do report problems then please try to send high quality
307 feedback. If you don't provide vital information to help us track down
308 the problem then you will probably be ignored. All bug reports should
309 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
310 database (https://bugzilla.samba.org/).
313 ======================================================================
314 == Our Code, Our Bugs, Our Responsibility.
315 == The Samba Team
316 ======================================================================
319 ----------------------------------------------------------------------
322 =============================
323 Release Notes for Samba 4.4.4
324 June 7, 2016
325 =============================
328 This is the latest stable release of Samba 4.4.
331 Changes since 4.4.3:
332 --------------------
334 o Michael Adam <obnox@samba.org>
335 * BUG 11809: SMB3 multichannel: Add implementation of missing channel sequence
336 number verification.
337 * BUG 11919: smbd:close: Only remove kernel share modes if they had been
338 taken at open.
339 * BUG 11930: notifyd: Prevent NULL deref segfault in notifyd_peer_destructor.
341 o Jeremy Allison <jra@samba.org>
342 * BUG 10618: s3: auth: Move the declaration of struct dom_sid tmp_sid to
343 function level scope.
345 o Christian Ambach <ambi@samba.org>
346 * BUG 10796: s3:rpcclient: Make '--pw-nt-hash' option work.
347 * BUG 11354: s3:libsmb/clifile: Use correct value for MaxParameterCount for
348 setting EAs.
349 * BUG 11438: Fix case sensitivity issues over SMB2 or above.
351 o Ralph Boehme <slow@samba.org>
352 * BUG 1703: s3:libnet:libnet_join: Add netbios aliases as SPNs.
353 * BUG 11721: vfs_fruit: Add an option that allows disabling POSIX rename
354 behaviour.
356 o Alexander Bokovoy <ab@samba.org>
357 * BUG 11936: s3-smbd: Support systemd 230.
359 o Ira Cooper <ira@samba.org>
360 * BUG 11907: source3: Honor the core soft limit of the OS.
362 o Günther Deschner <gd@samba.org>
363 * BUG 11809: SMB3 multichannel: Add implementation of missing channel sequence
364 number verification.
365 * BUG 11864: s3:client:smbspool_krb5_wrapper: Fix the non clearenv build.
366 * BUG 11906: s3-kerberos: Avoid entering a password change dialogue also when
367 using MIT.
369 o Robin Hack <hack.robin@gmail.com>
370 * BUG 11890: ldb-samba/ldb_matching_rules: Fix CID 1349424 - Uninitialized
371 pointer read.
373 o Volker Lendecke <vl@samba.org>
374 * BUG 11844: dbwrap_ctdb: Fix ENOENT->NT_STATUS_NOT_FOUND.
376 o Robin McCorkell <robin@mccorkell.me.uk>
377 * BUG 11276: Correctly set cli->raw_status for libsmbclient in SMB2 code.
379 o Stefan Metzmacher <metze@samba.org>
380 * BUG 11910: s3:smbd: Fix anonymous authentication if signing is mandatory.
381 * BUG 11912: libcli/auth: Let msrpc_parse() return talloc'ed empty strings.
382 * BUG 11914: Fix NTLM Authentication issue with squid.
383 * BUG 11927: s3:rpcclient: make use of SMB_SIGNING_IPC_DEFAULT.
385 o Luca Olivetti <luca@wetron.es>
386 * BUG 11530: pdb: Fix segfault in pdb_ldap for missing gecos.
388 o Rowland Penny <rpenny@samba.org>
389 * BUG 11613: Allow 'samba-tool fsmo' to cope with empty or missing fsmo
390 roles.
392 o Anoop C S <anoopcs@redhat.com>
393 * BUG 11907: packaging: Set default limit for core file size in service
394 files.
396 o Andreas Schneider <asn@samba.org>
397 * BUG 11922: s3-net: Convert the key_name to UTF8 during migration.
398 * BUG 11935: s3-smbspool: Log to stderr.
400 o Uri Simchoni <uri@samba.org>
401 * BUG 11900: heimdal: Encode/decode kvno as signed integer.
402 * BUG 11931: s3-quotas: Fix sysquotas_4B quota fetching for BSD.
403 * BUG 11937: smbd: dfree: Ignore quota if not enforced.
405 o Raghavendra Talur <rtalur@redhat.com>
406 * BUG 11907: init: Set core file size to unlimited by default.
408 o Hemanth Thummala <hemanth.thummala@nutanix.com>
409 * BUG 11934: Fix memory leak in share mode locking.
412 #######################################
413 Reporting bugs & Development Discussion
414 #######################################
416 Please discuss this release on the samba-technical mailing list or by
417 joining the #samba-technical IRC channel on irc.freenode.net.
419 If you do report problems then please try to send high quality
420 feedback. If you don't provide vital information to help us track down
421 the problem then you will probably be ignored. All bug reports should
422 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
423 database (https://bugzilla.samba.org/).
426 ======================================================================
427 == Our Code, Our Bugs, Our Responsibility.
428 == The Samba Team
429 ======================================================================
432 ----------------------------------------------------------------------
435 =============================
436 Release Notes for Samba 4.4.3
437 May 2, 2016
438 =============================
441 This is the latest stable release of Samba 4.4.
443 This release fixes some regressions introduced by the last security fixes.
444 Please see bug https://bugzilla.samba.org/show_bug.cgi?id=11849 for a list of
445 bugs addressing these regressions and more information.
448 Changes since 4.4.2:
449 --------------------
451 o Michael Adam <obnox@samba.org>
452 * BUG 11786: idmap_hash: Only allow the hash module for default idmap config.
454 o Jeremy Allison <jra@samba.org>
455 * BUG 11822: s3: libsmb: Fix error where short name length was read as 2
456 bytes, should be 1.
458 o Andrew Bartlett <abartlet@samba.org>
459 * BUG 11789: Fix returning of ldb.MessageElement.
461 o Ralph Boehme <slow@samba.org>
462 * BUG 11855: cleanupd: Restart as needed.
464 o Günther Deschner <gd@samba.org>
465 * BUG 11786: s3:winbindd:idmap: check loadparm in domain_has_idmap_config()
466 helper as well.
467 * BUG 11789: libsmb/pysmb: Add pytalloc-util dependency to fix the build.
469 o Volker Lendecke <vl@samba.org>
470 * BUG 11786: winbind: Fix CID 1357100: Unchecked return value.
471 * BUG 11816: nwrap: Fix the build on Solaris.
472 * BUG 11827: vfs_catia: Fix memleak.
473 * BUG 11878: smbd: Avoid large reads beyond EOF.
475 o Stefan Metzmacher <metze@samba.org>
476 * BUG 11789: s3:wscript: pylibsmb depends on pycredentials.
477 * BUG 11841: Fix NT_STATUS_ACCESS_DENIED when accessing Windows public share.
478 * BUG 11847: Only validate MIC if "map to guest" is not being used.
479 * BUG 11849: auth/ntlmssp: Add ntlmssp_{client,server}:force_old_spnego
480 option for testing.
481 * BUG 11850: NetAPP SMB servers don't negotiate NTLMSSP_SIGN.
482 * BUG 11858: Allow anonymous smb connections.
483 * BUG 11870: Fix ads_sasl_spnego_gensec_bind(KRB5).
484 * BUG 11872: Fix 'wbinfo -u' and 'net ads search'.
486 o Tom Mortensen <tomm@lime-technology.com>
487 * BUG 11875: nss_wins: Fix the hostent setup.
489 o Garming Sam <garming@catalyst.net.nz>
490 * BUG 11789: build: Mark explicit dependencies on pytalloc-util.
492 o Partha Sarathi <partha@exablox.com>
493 * BUG 11819: Fix the smb2_setinfo to handle FS info types and FSQUOTA
494 infolevel.
496 o Jorge Schrauwen <sjorge@blackdot.be>
497 * BUG 11816: configure: Don't check for inotify on illumos.
499 o Uri Simchoni <uri@samba.org>
500 * BUG 11806: vfs_acl_common: Avoid setting POSIX ACLs if "ignore system acls"
501 is set.
502 * BUG 11815: smbcquotas: print "NO LIMIT" only if returned quota value is 0.
503 * BUG 11852: libads: Record session expiry for spnego sasl binds.
505 o Hemanth Thummala <hemanth.thummala@nutanix.com>
506 * BUG 11840: Mask general purpose signals for notifyd.
509 #######################################
510 Reporting bugs & Development Discussion
511 #######################################
513 Please discuss this release on the samba-technical mailing list or by
514 joining the #samba-technical IRC channel on irc.freenode.net.
516 If you do report problems then please try to send high quality
517 feedback. If you don't provide vital information to help us track down
518 the problem then you will probably be ignored. All bug reports should
519 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
520 database (https://bugzilla.samba.org/).
523 ======================================================================
524 == Our Code, Our Bugs, Our Responsibility.
525 == The Samba Team
526 ======================================================================
529 ----------------------------------------------------------------------
532 =============================
533 Release Notes for Samba 4.4.2
534 April 12, 2016
535 =============================
537 This is a security release containing one additional
538 regression fix for the security release 4.4.1.
540 This fixes a regression that prevents things like 'net ads join'
541 from working against a Windows 2003 domain.
543 Changes since 4.4.1:
544 ====================
546 o Stefan Metzmacher <metze@samba.org>
547 * Bug 11804 - prerequisite backports for the security release on
548 April 12th, 2016
551 -----------------------------------------------------------------------
554 =============================
555 Release Notes for Samba 4.4.1
556 April 12, 2016
557 =============================
560 This is a security release in order to address the following CVEs:
562 o CVE-2015-5370 (Multiple errors in DCE-RPC code)
564 o CVE-2016-2110 (Man in the middle attacks possible with NTLMSSP)
566 o CVE-2016-2111 (NETLOGON Spoofing Vulnerability)
568 o CVE-2016-2112 (LDAP client and server don't enforce integrity)
570 o CVE-2016-2113 (Missing TLS certificate validation)
572 o CVE-2016-2114 ("server signing = mandatory" not enforced)
574 o CVE-2016-2115 (SMB IPC traffic is not integrity protected)
576 o CVE-2016-2118 (SAMR and LSA man in the middle attacks possible)
578 The number of changes are rather huge for a security release,
579 compared to typical security releases.
581 Given the number of problems and the fact that they are all related
582 to man in the middle attacks we decided to fix them all at once
583 instead of splitting them.
585 In order to prevent the man in the middle attacks it was required
586 to change the (default) behavior for some protocols. Please see the
587 "New smb.conf options" and "Behavior changes" sections below.
589 =======
590 Details
591 =======
593 o CVE-2015-5370
595 Versions of Samba from 3.6.0 to 4.4.0 inclusive are vulnerable to
596 denial of service attacks (crashes and high cpu consumption)
597 in the DCE-RPC client and server implementations. In addition,
598 errors in validation of the DCE-RPC packets can lead to a downgrade
599 of a secure connection to an insecure one.
601 While we think it is unlikely, there's a nonzero chance for
602 a remote code execution attack against the client components,
603 which are used by smbd, winbindd and tools like net, rpcclient and
604 others. This may gain root access to the attacker.
606 The above applies all possible server roles Samba can operate in.
608 Note that versions before 3.6.0 had completely different marshalling
609 functions for the generic DCE-RPC layer. It's quite possible that
610 that code has similar problems!
612 The downgrade of a secure connection to an insecure one may
613 allow an attacker to take control of Active Directory object
614 handles created on a connection created from an Administrator
615 account and re-use them on the now non-privileged connection,
616 compromising the security of the Samba AD-DC.
618 o CVE-2016-2110:
620 There are several man in the middle attacks possible with
621 NTLMSSP authentication.
623 E.g. NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL
624 can be cleared by a man in the middle.
626 This was by protocol design in earlier Windows versions.
628 Windows Server 2003 RTM and Vista RTM introduced a way
629 to protect against the trivial downgrade.
631 See MsvAvFlags and flag 0x00000002 in
632 https://msdn.microsoft.com/en-us/library/cc236646.aspx
634 This new feature also implies support for a mechlistMIC
635 when used within SPNEGO, which may prevent downgrades
636 from other SPNEGO mechs, e.g. Kerberos, if sign or
637 seal is finally negotiated.
639 The Samba implementation doesn't enforce the existence of
640 required flags, which were requested by the application layer,
641 e.g. LDAP or SMB1 encryption (via the unix extensions).
642 As a result a man in the middle can take over the connection.
643 It is also possible to misguide client and/or
644 server to send unencrypted traffic even if encryption
645 was explicitly requested.
647 LDAP (with NTLMSSP authentication) is used as a client
648 by various admin tools of the Samba project,
649 e.g. "net", "samba-tool", "ldbsearch", "ldbedit", ...
651 As an active directory member server LDAP is also used
652 by the winbindd service when connecting to domain controllers.
654 Samba also offers an LDAP server when running as
655 active directory domain controller.
657 The NTLMSSP authentication used by the SMB1 encryption
658 is protected by smb signing, see CVE-2015-5296.
660 o CVE-2016-2111:
662 It's basically the same as CVE-2015-0005 for Windows:
664 The NETLOGON service in Microsoft Windows Server 2003 SP2,
665 Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold
666 and R2, when a Domain Controller is configured, allows remote
667 attackers to spoof the computer name of a secure channel's
668 endpoint, and obtain sensitive session information, by running a
669 crafted application and leveraging the ability to sniff network
670 traffic, aka "NETLOGON Spoofing Vulnerability".
672 The vulnerability in Samba is worse as it doesn't require
673 credentials of a computer account in the domain.
675 This only applies to Samba running as classic primary domain controller,
676 classic backup domain controller or active directory domain controller.
678 The security patches introduce a new option called "raw NTLMv2 auth"
679 ("yes" or "no") for the [global] section in smb.conf.
680 Samba (the smbd process) will reject client using raw NTLMv2
681 without using NTLMSSP.
683 Note that this option also applies to Samba running as
684 standalone server and member server.
686 You should also consider using "lanman auth = no" (which is already the default)
687 and "ntlm auth = no". Have a look at the smb.conf manpage for further details,
688 as they might impact compatibility with older clients. These also
689 apply for all server roles.
691 o CVE-2016-2112:
693 Samba uses various LDAP client libraries, a builtin one and/or the system
694 ldap libraries (typically openldap).
696 As active directory domain controller Samba also provides an LDAP server.
698 Samba takes care of doing SASL (GSS-SPNEGO) authentication with Kerberos or NTLMSSP
699 for LDAP connections, including possible integrity (sign) and privacy (seal)
700 protection.
702 Samba has support for an option called "client ldap sasl wrapping" since version
703 3.2.0. Its default value has changed from "plain" to "sign" with version 4.2.0.
705 Tools using the builtin LDAP client library do not obey the
706 "client ldap sasl wrapping" option. This applies to tools like:
707 "samba-tool", "ldbsearch", "ldbedit" and more. Some of them have command line
708 options like "--sign" and "--encrypt". With the security update they will
709 also obey the "client ldap sasl wrapping" option as default.
711 In all cases, even if explicitly request via "client ldap sasl wrapping",
712 "--sign" or "--encrypt", the protection can be downgraded by a man in the
713 middle.
715 The LDAP server doesn't have an option to enforce strong authentication
716 yet. The security patches will introduce a new option called
717 "ldap server require strong auth", possible values are "no",
718 "allow_sasl_over_tls" and "yes".
720 As the default behavior was as "no" before, you may
721 have to explicitly change this option until all clients have
722 been adjusted to handle LDAP_STRONG_AUTH_REQUIRED errors.
723 Windows clients and Samba member servers already use
724 integrity protection.
726 o CVE-2016-2113:
728 Samba has support for TLS/SSL for some protocols:
729 ldap and http, but currently certificates are not
730 validated at all. While we have a "tls cafile" option,
731 the configured certificate is not used to validate
732 the server certificate.
734 This applies to ldaps:// connections triggered by tools like:
735 "ldbsearch", "ldbedit" and more. Note that it only applies
736 to the ldb tools when they are built as part of Samba or with Samba
737 extensions installed, which means the Samba builtin LDAP client library is
738 used.
740 It also applies to dcerpc client connections using ncacn_http (with https://),
741 which are only used by the openchange project. Support for ncacn_http
742 was introduced in version 4.2.0.
744 The security patches will introduce a new option called
745 "tls verify peer". Possible values are "no_check", "ca_only",
746 "ca_and_name_if_available", "ca_and_name" and "as_strict_as_possible".
748 If you use the self-signed certificates which are auto-generated
749 by Samba, you won't have a crl file and need to explicitly
750 set "tls verify peer = ca_and_name".
752 o CVE-2016-2114
754 Due to a regression introduced in Samba 4.0.0,
755 an explicit "server signing = mandatory" in the [global] section
756 of the smb.conf was not enforced for clients using the SMB1 protocol.
758 As a result it does not enforce smb signing and allows man in the middle attacks.
760 This problem applies to all possible server roles:
761 standalone server, member server, classic primary domain controller,
762 classic backup domain controller and active directory domain controller.
764 In addition, when Samba is configured with "server role = active directory domain controller"
765 the effective default for the "server signing" option should be "mandatory".
767 During the early development of Samba 4 we had a new experimental
768 file server located under source4/smb_server. But before
769 the final 4.0.0 release we switched back to the file server
770 under source3/smbd.
772 But the logic for the correct default of "server signing" was not
773 ported correctly ported.
775 Note that the default for server roles other than active directory domain
776 controller, is "off" because of performance reasons.
778 o CVE-2016-2115:
780 Samba has an option called "client signing", this is turned off by default
781 for performance reasons on file transfers.
783 This option is also used when using DCERPC with ncacn_np.
785 In order to get integrity protection for ipc related communication
786 by default the "client ipc signing" option is introduced.
787 The effective default for this new option is "mandatory".
789 In order to be compatible with more SMB server implementations,
790 the following additional options are introduced:
791 "client ipc min protocol" ("NT1" by default) and
792 "client ipc max protocol" (the highest support SMB2/3 dialect by default).
793 These options overwrite the "client min protocol" and "client max protocol"
794 options, because the default for "client max protocol" is still "NT1".
795 The reason for this is the fact that all SMB2/3 support SMB signing,
796 while there are still SMB1 implementations which don't offer SMB signing
797 by default (this includes Samba versions before 4.0.0).
799 Note that winbindd (in versions 4.2.0 and higher) enforces SMB signing
800 against active directory domain controllers despite of the
801 "client signing" and "client ipc signing" options.
803 o CVE-2016-2118 (a.k.a. BADLOCK):
805 The Security Account Manager Remote Protocol [MS-SAMR] and the
806 Local Security Authority (Domain Policy) Remote Protocol [MS-LSAD]
807 are both vulnerable to man in the middle attacks. Both are application level
808 protocols based on the generic DCE 1.1 Remote Procedure Call (DCERPC) protocol.
810 These protocols are typically available on all Windows installations
811 as well as every Samba server. They are used to maintain
812 the Security Account Manager Database. This applies to all
813 roles, e.g. standalone, domain member, domain controller.
815 Any authenticated DCERPC connection a client initiates against a server
816 can be used by a man in the middle to impersonate the authenticated user
817 against the SAMR or LSAD service on the server.
819 The client chosen application protocol, auth type (e.g. Kerberos or NTLMSSP)
820 and auth level (NONE, CONNECT, PKT_INTEGRITY, PKT_PRIVACY) do not matter
821 in this case. A man in the middle can change auth level to CONNECT
822 (which means authentication without message protection) and take over
823 the connection.
825 As a result, a man in the middle is able to get read/write access to the
826 Security Account Manager Database, which reveals all passwords
827 and any other potential sensitive information.
829 Samba running as an active directory domain controller is additionally
830 missing checks to enforce PKT_PRIVACY for the
831 Directory Replication Service Remote Protocol [MS-DRSR] (drsuapi)
832 and the BackupKey Remote Protocol [MS-BKRP] (backupkey).
833 The Domain Name Service Server Management Protocol [MS-DNSP] (dnsserver)
834 is not enforcing at least PKT_INTEGRITY.
836 ====================
837 New smb.conf options
838 ====================
840 allow dcerpc auth level connect (G)
842 This option controls whether DCERPC services are allowed to be used with
843 DCERPC_AUTH_LEVEL_CONNECT, which provides authentication, but no per
844 message integrity nor privacy protection.
846 Some interfaces like samr, lsarpc and netlogon have a hard-coded default
847 of no and epmapper, mgmt and rpcecho have a hard-coded default of yes.
849 The behavior can be overwritten per interface name (e.g. lsarpc,
850 netlogon, samr, srvsvc, winreg, wkssvc ...) by using
851 'allow dcerpc auth level connect:interface = yes' as option.
853 This option yields precedence to the implementation specific restrictions.
854 E.g. the drsuapi and backupkey protocols require DCERPC_AUTH_LEVEL_PRIVACY.
855 The dnsserver protocol requires DCERPC_AUTH_LEVEL_INTEGRITY.
857 Default: allow dcerpc auth level connect = no
859 Example: allow dcerpc auth level connect = yes
861 client ipc signing (G)
863 This controls whether the client is allowed or required to use
864 SMB signing for IPC$ connections as DCERPC transport. Possible
865 values are auto, mandatory and disabled.
867 When set to mandatory or default, SMB signing is required.
869 When set to auto, SMB signing is offered, but not enforced and
870 if set to disabled, SMB signing is not offered either.
872 Connections from winbindd to Active Directory Domain Controllers
873 always enforce signing.
875 Default: client ipc signing = default
877 client ipc max protocol (G)
879 The value of the parameter (a string) is the highest protocol level that will
880 be supported for IPC$ connections as DCERPC transport.
882 Normally this option should not be set as the automatic negotiation phase
883 in the SMB protocol takes care of choosing the appropriate protocol.
885 The value default refers to the latest supported protocol, currently SMB3_11.
887 See client max protocol for a full list of available protocols.
888 The values CORE, COREPLUS, LANMAN1, LANMAN2 are silently upgraded to NT1.
890 Default: client ipc max protocol = default
892 Example: client ipc max protocol = SMB2_10
894 client ipc min protocol (G)
896 This setting controls the minimum protocol version that the will be
897 attempted to use for IPC$ connections as DCERPC transport.
899 Normally this option should not be set as the automatic negotiation phase
900 in the SMB protocol takes care of choosing the appropriate protocol.
902 The value default refers to the higher value of NT1 and the
903 effective value of "client min protocol".
905 See client max protocol for a full list of available protocols.
906 The values CORE, COREPLUS, LANMAN1, LANMAN2 are silently upgraded to NT1.
908 Default: client ipc min protocol = default
910 Example: client ipc min protocol = SMB3_11
912 ldap server require strong auth (G)
914 The ldap server require strong auth defines whether the
915 ldap server requires ldap traffic to be signed or
916 signed and encrypted (sealed). Possible values are no,
917 allow_sasl_over_tls and yes.
919 A value of no allows simple and sasl binds over all transports.
921 A value of allow_sasl_over_tls allows simple and sasl binds (without sign or seal)
922 over TLS encrypted connections. Unencrypted connections only
923 allow sasl binds with sign or seal.
925 A value of yes allows only simple binds over TLS encrypted connections.
926 Unencrypted connections only allow sasl binds with sign or seal.
928 Default: ldap server require strong auth = yes
930 raw NTLMv2 auth (G)
932 This parameter determines whether or not smbd(8) will allow SMB1 clients
933 without extended security (without SPNEGO) to use NTLMv2 authentication.
935 If this option, lanman auth and ntlm auth are all disabled, then only
936 clients with SPNEGO support will be permitted. That means NTLMv2 is only
937 supported within NTLMSSP.
939 Default: raw NTLMv2 auth = no
941 tls verify peer (G)
943 This controls if and how strict the client will verify the peer's
944 certificate and name. Possible values are (in increasing order): no_check,
945 ca_only, ca_and_name_if_available, ca_and_name and as_strict_as_possible.
947 When set to no_check the certificate is not verified at all,
948 which allows trivial man in the middle attacks.
950 When set to ca_only the certificate is verified to be signed from a ca
951 specified in the "tls ca file" option. Setting "tls ca file" to a valid file
952 is required. The certificate lifetime is also verified. If the "tls crl file"
953 option is configured, the certificate is also verified against
954 the ca crl.
956 When set to ca_and_name_if_available all checks from ca_only are performed.
957 In addition, the peer hostname is verified against the certificate's
958 name, if it is provided by the application layer and not given as
959 an ip address string.
961 When set to ca_and_name all checks from ca_and_name_if_available are performed.
962 In addition the peer hostname needs to be provided and even an ip
963 address is checked against the certificate's name.
965 When set to as_strict_as_possible all checks from ca_and_name are performed.
966 In addition the "tls crl file" needs to be configured. Future versions
967 of Samba may implement additional checks.
969 Default: tls verify peer = as_strict_as_possible
971 tls priority (G) (backported from Samba 4.3 to Samba 4.2)
973 This option can be set to a string describing the TLS protocols to be
974 supported in the parts of Samba that use GnuTLS, specifically the AD DC.
976 The default turns off SSLv3, as this protocol is no longer considered
977 secure after CVE-2014-3566 (otherwise known as POODLE) impacted SSLv3 use
978 in HTTPS applications.
980 The valid options are described in the GNUTLS Priority-Strings
981 documentation at http://gnutls.org/manual/html_node/Priority-Strings.html
983 Default: tls priority = NORMAL:-VERS-SSL3.0
985 ================
986 Behavior changes
987 ================
989 o The default auth level for authenticated binds has changed from
990 DCERPC_AUTH_LEVEL_CONNECT to DCERPC_AUTH_LEVEL_INTEGRITY.
991 That means ncacn_ip_tcp:server is now implicitly the same
992 as ncacn_ip_tcp:server[sign] and offers a similar protection
993 as ncacn_np:server, which relies on smb signing.
995 o The following constraints are applied to SMB1 connections:
997 - "client lanman auth = yes" is now consistently
998 required for authenticated connections using the
999 SMB1 LANMAN2 dialect.
1000 - "client ntlmv2 auth = yes" and "client use spnego = yes"
1001 (both the default values), require extended security (SPNEGO)
1002 support from the server. That means NTLMv2 is only used within
1003 NTLMSSP.
1005 o Tools like "samba-tool", "ldbsearch", "ldbedit" and more obey the
1006 default of "client ldap sasl wrapping = sign". Even with
1007 "client ldap sasl wrapping = plain" they will automatically upgrade
1008 to "sign" when getting LDAP_STRONG_AUTH_REQUIRED from the LDAP
1009 server.
1011 Changes since 4.4.0:
1012 ====================
1014 o Jeremy Allison <jra@samba.org>
1015 * Bug 11344 - CVE-2015-5370: Multiple errors in DCE-RPC code.
1017 o Christian Ambach <ambi@samba.org>
1018 * Bug 11804 - prerequisite backports for the security release on
1019 April 12th, 2016.
1021 o Ralph Boehme <slow@samba.org>
1022 * Bug 11644 - CVE-2016-2112: The LDAP client and server don't enforce
1023 integrity protection.
1025 o Günther Deschner <gd@samba.org>
1026 * Bug 11749 - CVE-2016-2111: NETLOGON Spoofing Vulnerability.
1028 * Bug 11804 - prerequisite backports for the security release on
1029 April 12th, 2016.
1031 o Volker Lendecke <vl@samba.org>
1032 * Bug 11804 - prerequisite backports for the security release on
1033 April 12th, 2016.
1035 o Stefan Metzmacher <metze@samba.org>
1036 * Bug 11344 - CVE-2015-5370: Multiple errors in DCE-RPC code.
1038 * Bug 11616 - CVE-2016-2118: SAMR and LSA man in the middle attacks possible.
1040 * Bug 11644 - CVE-2016-2112: The LDAP client and server doesn't enforce
1041 integrity protection.
1043 * Bug 11687 - CVE-2016-2114: "server signing = mandatory" not enforced.
1045 * Bug 11688 - CVE-2016-2110: Man in the middle attacks possible with NTLMSSP.
1047 * Bug 11749 - CVE-2016-2111: NETLOGON Spoofing Vulnerability.
1049 * Bug 11752 - CVE-2016-2113: Missing TLS certificate validation allows man in
1050 the middle attacks.
1052 * Bug 11756 - CVE-2016-2115: SMB client connections for IPC traffic are not
1053 integrity protected.
1055 * Bug 11804 - prerequisite backports for the security release on
1056 April 12th, 2016.
1059 #######################################
1060 Reporting bugs & Development Discussion
1061 #######################################
1063 Please discuss this release on the samba-technical mailing list or by
1064 joining the #samba-technical IRC channel on irc.freenode.net.
1066 If you do report problems then please try to send high quality
1067 feedback. If you don't provide vital information to help us track down
1068 the problem then you will probably be ignored. All bug reports should
1069 be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
1070 database (https://bugzilla.samba.org/).
1073 ======================================================================
1074 == Our Code, Our Bugs, Our Responsibility.
1075 == The Samba Team
1076 ======================================================================
1079 ----------------------------------------------------------------------
1082 =============================
1083 Release Notes for Samba 4.4.0
1084 March 22, 2016
1085 =============================
1088 This is the first stable release of the Samba 4.4 release series.
1091 UPGRADING
1092 =========
1094 Nothing special.
1097 NEW FEATURES/CHANGES
1098 ====================
1100 Asynchronous flush requests
1101 ---------------------------
1103 Flush requests from SMB2/3 clients are handled asynchronously and do
1104 not block the processing of other requests. Note that 'strict sync'
1105 has to be set to 'yes' for Samba to honor flush requests from SMB
1106 clients.
1108 s3: smbd
1109 --------
1111 Remove '--with-aio-support' configure option. We no longer would ever prefer
1112 POSIX-RT aio, use pthread_aio instead.
1114 samba-tool sites
1115 ----------------
1117 The 'samba-tool sites' subcommand can now be run against another server by
1118 specifying an LDB URL using the '-H' option and not against the local database
1119 only (which is still the default when no URL is given).
1121 samba-tool domain demote
1122 ------------------------
1124 Add '--remove-other-dead-server' option to 'samba-tool domain demote'
1125 subcommand. The new version of this tool now can remove another DC that is
1126 itself offline. The '--remove-other-dead-server' removes as many references
1127 to the DC as possible.
1129 samba-tool drs clone-dc-database
1130 --------------------------------
1132 Replicate an initial clone of domain, but do not join it.
1133 This is developed for debugging purposes, but not for setting up another DC.
1135 pdbedit
1136 -------
1138 Add '--set-nt-hash' option to pdbedit to update user password from nt-hash
1139 hexstring. 'pdbedit -vw' shows also password hashes.
1141 smbstatus
1142 ---------
1144 'smbstatus' was enhanced to show the state of signing and encryption for
1145 sessions and shares.
1147 smbget
1148 ------
1149 The -u and -p options for user and password were replaced by the -U option that
1150 accepts username[%password] as in many other tools of the Samba suite.
1151 Similary, smbgetrc files do not accept username and password options any more,
1152 only a single "user" option which also accepts user%password combinations.
1153 The -P option was removed.
1155 s4-rpc_server
1156 -------------
1158 Add a GnuTLS based backupkey implementation.
1160 ntlm_auth
1161 ---------
1163 Using the '--offline-logon' enables ntlm_auth to use cached passwords when the
1164 DC is offline.
1166 Allow '--password' force a local password check for ntlm-server-1 mode.
1168 vfs_offline
1169 -----------
1171 A new VFS module called vfs_offline has been added to mark all files in the
1172 share as offline. It can be useful for shares mounted on top of a remote file
1173 system (either through a samba VFS module or via FUSE).
1175 KCC
1176 ---
1178 The Samba KCC has been improved, but is still disabled by default.
1180 DNS
1181 ---
1183 There were several improvements concerning the Samba DNS server.
1185 Active Directory
1186 ----------------
1188 There were some improvements in the Active Directory area.
1190 WINS nsswitch module
1191 --------------------
1193 The WINS nsswitch module has been rewritten to address memory issues and to
1194 simplify the code. The module now uses libwbclient to do WINS queries. This
1195 means that winbind needs to be running in order to resolve WINS names using
1196 the nss_wins module. This does not affect smbd.
1198 CTDB changes
1199 ------------
1201 * CTDB now uses a newly implemented parallel database recovery scheme
1202 that avoids deadlocks with smbd.
1204 In certain circumstances CTDB and smbd could deadlock. The new
1205 recovery implementation avoid this. It also provides improved
1206 recovery performance.
1208 * All files are now installed into and referred to by the paths
1209 configured at build time. Therefore, CTDB will now work properly
1210 when installed into the default location at /usr/local.
1212 * Public CTDB header files are no longer installed, since Samba and
1213 CTDB are built from within the same source tree.
1215 * CTDB_DBDIR can now be set to tmpfs[:<tmpfs-options>]
1217 This will cause volatile TDBs to be located in a tmpfs. This can
1218 help to avoid performance problems associated with contention on the
1219 disk where volatile TDBs are usually stored. See ctdbd.conf(5) for
1220 more details.
1222 * Configuration variable CTDB_NATGW_SLAVE_ONLY is no longer used.
1223 Instead, nodes should be annotated with the "slave-only" option in
1224 the CTDB NAT gateway nodes file. This file must be consistent
1225 across nodes in a NAT gateway group. See ctdbd.conf(5) for more
1226 details.
1228 * New event script 05.system allows various system resources to be
1229 monitored
1231 This can be helpful for explaining poor performance or unexpected
1232 behaviour. New configuration variables are
1233 CTDB_MONITOR_FILESYSTEM_USAGE, CTDB_MONITOR_MEMORY_USAGE and
1234 CTDB_MONITOR_SWAP_USAGE. Default values cause warnings to be
1235 logged. See the SYSTEM RESOURCE MONITORING CONFIGURATION in
1236 ctdbd.conf(5) for more information.
1238 The memory, swap and filesystem usage monitoring previously found in
1239 00.ctdb and 40.fs_use is no longer available. Therefore,
1240 configuration variables CTDB_CHECK_FS_USE, CTDB_MONITOR_FREE_MEMORY,
1241 CTDB_MONITOR_FREE_MEMORY_WARN and CTDB_CHECK_SWAP_IS_NOT_USED are
1242 now ignored.
1244 * The 62.cnfs eventscript has been removed. To get a similar effect
1245 just do something like this:
1247 mmaddcallback ctdb-disable-on-quorumLoss \
1248 --command /usr/bin/ctdb \
1249 --event quorumLoss --parms "disable"
1251 mmaddcallback ctdb-enable-on-quorumReached \
1252 --command /usr/bin/ctdb \
1253 --event quorumReached --parms "enable"
1255 * The CTDB tunable parameter EventScriptTimeoutCount has been renamed
1256 to MonitorTimeoutCount
1258 It has only ever been used to limit timed-out monitor events.
1260 Configurations containing CTDB_SET_EventScriptTimeoutCount=<n> will
1261 cause CTDB to fail at startup. Useful messages will be logged.
1263 * The commandline option "-n all" to CTDB tool has been removed.
1265 The option was not uniformly implemented for all the commands.
1266 Instead of command "ctdb ip -n all", use "ctdb ip all".
1268 * All CTDB current manual pages are now correctly installed
1271 EXPERIMENTAL FEATURES
1272 =====================
1274 SMB3 Multi-Channel
1275 ------------------
1277 Samba 4.4.0 adds *experimental* support for SMB3 Multi-Channel.
1278 Multi-Channel is an SMB3 protocol feature that allows the client
1279 to bind multiple transport connections into one authenticated
1280 SMB session. This allows for increased fault tolerance and
1281 throughput. The client chooses transport connections as reported
1282 by the server and also chooses over which of the bound transport
1283 connections to send traffic. I/O operations for a given file
1284 handle can span multiple network connections this way.
1285 An SMB multi-channel session will be valid as long as at least
1286 one of its channels are up.
1288 In Samba, multi-channel can be enabled by setting the new
1289 smb.conf option "server multi channel support" to "yes".
1290 It is disabled by default.
1292 Samba has to report interface speeds and some capabilities to
1293 the client. On Linux, Samba can auto-detect the speed of an
1294 interface. But to support other platforms, and in order to be
1295 able to manually override the detected values, the "interfaces"
1296 smb.conf option has been given an extended syntax, by which an
1297 interface specification can additionally carry speed and
1298 capability information. The extended syntax looks like this
1299 for setting the speed to 1 gigabit per second:
1301 interfaces = 192.168.1.42;speed=1000000000
1303 This extension should be used with care and are mainly intended
1304 for testing. See the smb.conf manual page for details.
1306 CAVEAT: While this should be working without problems mostly,
1307 there are still corner cases in the treatment of channel failures
1308 that may result in DATA CORRUPTION when these race conditions hit.
1309 It is hence
1311 NOT RECOMMENDED TO USE MULTI-CHANNEL IN PRODUCTION
1313 at this stage. This situation can be expected to improve during
1314 the life-time of the 4.4 release. Feed-back from test-setups is
1315 highly welcome.
1318 REMOVED FEATURES
1319 ================
1321 Public headers
1322 --------------
1324 Several public headers are not installed any longer. They are made for internal
1325 use only. More public headers will very likely be removed in future releases.
1327 The following headers are not installed any longer:
1328 dlinklist.h, gen_ndr/epmapper.h, gen_ndr/mgmt.h, gen_ndr/ndr_atsvc_c.h,
1329 gen_ndr/ndr_epmapper_c.h, gen_ndr/ndr_epmapper.h, gen_ndr/ndr_mgmt_c.h,
1330 gen_ndr/ndr_mgmt.h,gensec.h, ldap_errors.h, ldap_message.h, ldap_ndr.h,
1331 ldap-util.h, pytalloc.h, read_smb.h, registry.h, roles.h, samba_util.h,
1332 smb2_constants.h, smb2_create_blob.h, smb2.h, smb2_lease.h, smb2_signing.h,
1333 smb_cli.h, smb_cliraw.h, smb_common.h, smb_composite.h, smb_constants.h,
1334 smb_raw.h, smb_raw_interfaces.h, smb_raw_signing.h, smb_raw_trans2.h,
1335 smb_request.h, smb_seal.h, smb_signing.h, smb_unix_ext.h, smb_util.h,
1336 torture.h, tstream_smbXcli_np.h.
1338 vfs_smb_traffic_analyzer
1339 ------------------------
1341 The SMB traffic analyzer VFS module has been removed, because it is not
1342 maintained any longer and not widely used.
1344 vfs_scannedonly
1345 ---------------
1347 The scannedonly VFS module has been removed, because it is not maintained
1348 any longer.
1350 smb.conf changes
1351 ----------------
1353 Parameter Name Description Default
1354 -------------- ----------- -------
1355 aio max threads New 100
1356 ldap page size Changed default 1000
1357 server multi channel support New No
1358 interfaces Extended syntax
1361 KNOWN ISSUES
1362 ============
1364 Currently none.
1367 CHANGES SINCE 4.4.0rc5
1368 ======================
1370 o Michael Adam <obnox@samba.org>
1371 * BUG 11796: smbd: Enable multi-channel if 'server multi channel support =
1372 yes' in the config.
1374 o Günther Deschner <gd@samba.org>
1375 * BUG 11802: lib/socket/interfaces: Fix some uninitialied bytes.
1377 o Uri Simchoni <uri@samba.org>
1378 * BUG 11798: build: Fix build when '--without-quota' specified.
1381 CHANGES SINCE 4.4.0rc4
1382 ======================
1384 o Andrew Bartlett <abartlet@samba.org>
1385 * BUG 11780: mkdir can return ACCESS_DENIED incorrectly on create race.
1386 * BUG 11783: Mismatch between local and remote attribute ids lets
1387 replication fail with custom schema.
1388 * BUG 11789: Talloc: Version 2.1.6.
1390 o Ira Cooper <ira@samba.org>
1391 * BUG 11774: vfs_glusterfs: Fix use after free in AIO callback.
1393 o Günther Deschner <gd@samba.org>
1394 * BUG 11755: Fix net join.
1396 o Amitay Isaacs <amitay@gmail.com>
1397 * BUG 11770: Reset TCP Connections during IP failover.
1399 o Justin Maggard <jmaggard10@gmail.com>
1400 * BUG 11773: s3:smbd: Add negprot remote arch detection for OSX.
1402 o Stefan Metzmacher <metze@samba.org>
1403 * BUG 11772: ldb: Version 1.1.26.
1404 * BUG 11782: "trustdom_list_done: Got invalid trustdom response" message
1405 should be avoided.
1407 o Uri Simchoni <uri@samba.org>
1408 * BUG 11769: libnet: Make Kerberos domain join site-aware.
1409 * BUG 11788: Quota is not supported on Solaris 10.
1412 CHANGES SINCE 4.4.0rc3
1413 ======================
1415 o Jeremy Allison <jra@samba.org>
1416 * BUG 11648: CVE-2015-7560: Getting and setting Windows ACLs on symlinks can
1417 change permissions on link target.
1419 o Christian Ambach <ambi@samba.org>
1420 * BUG 11767: s3:utils/smbget: Fix option parsing.
1422 o Alberto Maria Fiaschi <alberto.fiaschi@estar.toscana.it>
1423 * BUG 8093: Access based share enum: handle permission set in configuration
1424 files.
1426 o Stefan Metzmacher <metze@samba.org>
1427 * BUG 11702: s3:clispnego: Fix confusing warning in spnego_gen_krb5_wrap().
1428 * BUG 11742: tevent: version 0.9.28: Fix memory leak when old signal action
1429 restored.
1430 * BUG 11755: s3:libads: setup the msDS-SupportedEncryptionTypes attribute on
1431 ldap_add.
1432 * BUGs 11128, 11686: CVE-2016-0771: Read of uninitialized memory DNS TXT
1433 handling.
1435 o Garming Sam <garming@catalyst.net.nz>
1436 * BUGs 11128, 11686: CVE-2016-0771: Read of uninitialized memory DNS TXT
1437 handling.
1439 o Uri Simchoni <uri@samba.org>
1440 * BUG 11691: winbindd: Return trust parameters when listing trusts.
1441 * BUG 11753: smbd: Ignore SVHDX create context.
1442 * BUG 11763: passdb: Add linefeed to debug message.
1445 CHANGES SINCE 4.4.0rc2
1446 ======================
1448 o Michael Adam <obnox@samba.org>
1449 * BUG 11723: lib:socket: Fix CID 1350010: Integer OVERFLOW_BEFORE_WIDEN.
1450 * BUG 11735: lib:socket: Fix CID 1350009: Fix illegal memory accesses
1451 (BUFFER_SIZE_WARNING).
1453 o Jeremy Allison <jra@samba.org>
1454 * BUG 10489: s3: smbd: posix_acls: Fix check for setting u:g:o entry on a
1455 filesystem with no ACL support.
1457 o Christian Ambach <ambi@samba.org>
1458 * BUG 11700: s3:utils/smbget: Set default blocksize.
1460 o Anoop C S <anoopcs@redhat.com>
1461 * BUG 11734: lib/socket: Fix improper use of default interface speed.
1463 o Ralph Boehme <slow@samba.org>
1464 * BUG 11714: lib/tsocket: Work around sockets not supporting FIONREAD.
1466 o Volker Lendecke <vl@samba.org>
1467 * BUG 11724: smbd: Fix CID 1351215 Improper use of negative value.
1468 * BUG 11725: smbd: Fix CID 1351216 Dereference null return value.
1469 * BUG 11732: param: Fix str_list_v3 to accept ; again.
1471 o Noel Power <noel.power@suse.com>
1472 * BUG 11738: libcli: Fix debug message, print sid string for new_ace trustee.
1474 o Jose A. Rivera <jarrpa@samba.org>
1475 * BUG 11727: s3:smbd:open: Skip redundant call to file_set_dosmode when
1476 creating a new file.
1478 o Andreas Schneider <asn@samba.org>
1479 * BUG 11730: docs: Add manpage for cifsdd.
1480 * BUG 11739: Fix installation path of Samba helper binaries.
1482 o Berend De Schouwer <berend.de.schouwer@gmail.com>
1483 * BUG 11643: docs: Add example for domain logins to smbspool man page.
1485 o Martin Schwenke <martin@meltin.net>
1486 * BUG 11719: ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."
1488 o Hemanth Thummala <hemanth.thummala@nutanix.com>
1489 * BUG 11708: loadparm: Fix memory leak issue.
1490 * BUG 11740: Fix memory leak in loadparm.
1493 CHANGES SINCE 4.4.0rc1
1494 ======================
1496 o Michael Adam <obnox@samba.org>
1497 * BUG 11715: s3:vfs:glusterfs: Fix build after quota changes.
1499 o Jeremy Allison <jra@samba.org>
1500 * BUG 11703: s3: smbd: Fix timestamp rounding inside SMB2 create.
1502 o Christian Ambach <ambi@samba.org>
1503 * BUG 11700: Streamline 'smbget' options with the rest of the Samba utils.
1505 o Günther Deschner <gd@samba.org>
1506 * BUG 11696: ctdb: Do not provide a useless pkgconfig file for ctdb.
1508 o Stefan Metzmacher <metze@samba.org>
1509 * BUG 11699: Crypto.Cipher.ARC4 is not available on some platforms, fallback
1510 to M2Crypto.RC4.RC4 then.
1512 o Amitay Isaacs <amitay@gmail.com>
1513 * BUG 11705: Sockets with htons(IPPROTO_RAW) and CVE-2015-8543.
1515 o Andreas Schneider <asn@samba.org>
1516 * BUG 11690: docs: Add smbspool_krb5_wrapper manpage.
1518 o Uri Simchoni <uri@samba.org>
1519 * BUG 11681: smbd: Show correct disk size for different quota and dfree block
1520 sizes.
1523 #######################################
1524 Reporting bugs & Development Discussion
1525 #######################################
1527 Please discuss this release on the samba-technical mailing list or by
1528 joining the #samba-technical IRC channel on irc.freenode.net.
1530 If you do report problems then please try to send high quality
1531 feedback. If you don't provide vital information to help us track down
1532 the problem then you will probably be ignored. All bug reports should
1533 be filed under the Samba 4.1 and newer product in the project's Bugzilla
1534 database (https://bugzilla.samba.org/).
1537 ======================================================================
1538 == Our Code, Our Bugs, Our Responsibility.
1539 == The Samba Team
1540 ======================================================================