| blob | 5eb0a0281c1c164820731e88e02fe008273e3430 |
1 ==============================
2 Release Notes for Samba 4.17.5
3 January 26, 2023
4 ==============================
7 This is the latest stable release of the Samba 4.17 release series.
10 Changes since 4.17.4
11 --------------------
13 o Jeremy Allison <jra@samba.org>
14 * BUG 14808: smbc_getxattr() return value is incorrect.
15 * BUG 15172: Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled
16 correctly.
17 * BUG 15210: synthetic_pathref AFP_AfpInfo failed errors.
18 * BUG 15226: samba-tool gpo listall fails IPv6 only - finddcs() fails to find
19 DC when there is only an AAAA record for the DC in DNS.
20 * BUG 15236: smbd crashes if an FSCTL request is done on a stream handle.
21 * BUG 15277: DFS links don't work anymore on Mac clients since 4.17.
22 * BUG 15283: vfs_virusfilter segfault on access, directory edgecase
23 (accessing NULL value).
25 o Samuel Cabrero <scabrero@samba.org>
26 * BUG 15240: CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5)
27 based SChannel on NETLOGON (additional changes).
29 o Volker Lendecke <vl@samba.org>
30 * BUG 15243: %U for include directive doesn't work for share listing
31 (netshareenum).
32 * BUG 15266: Shares missing from netshareenum response in samba 4.17.4.
33 * BUG 15269: ctdb: use-after-free in run_proc.
35 o Stefan Metzmacher <metze@samba.org>
36 * BUG 15243: %U for include directive doesn't work for share listing
37 (netshareenum).
38 * BUG 15266: Shares missing from netshareenum response in samba 4.17.4.
39 * BUG 15280: irpc_destructor may crash during shutdown.
40 * BUG 15286: auth3_generate_session_info_pac leaks wbcAuthUserInfo.
42 o Andreas Schneider <asn@samba.org>
43 * BUG 15268: smbclient segfaults with use after free on an optimized build.
45 o Jones Syue <jonessyue@qnap.com>
46 * BUG 15282: smbstatus leaking files in msg.sock and msg.lock.
48 o Andrew Walker <awalker@ixsystems.com>
49 * BUG 15164: Leak in wbcCtxPingDc2.
50 * BUG 15265: Access based share enum does not work in Samba 4.16+.
51 * BUG 15267: Crash during share enumeration.
52 * BUG 15271: rep_listxattr on FreeBSD does not properly check for reads off
53 end of returned buffer.
55 o Florian Weimer <fweimer@redhat.com>
56 * BUG 15281: Avoid relying on C89 features in a few places.
59 #######################################
60 Reporting bugs & Development Discussion
61 #######################################
63 Please discuss this release on the samba-technical mailing list or by
64 joining the #samba-technical:matrix.org matrix room, or
65 #samba-technical IRC channel on irc.libera.chat.
68 If you do report problems then please try to send high quality
69 feedback. If you don't provide vital information to help us track down
70 the problem then you will probably be ignored. All bug reports should
71 be filed under the Samba 4.1 and newer product in the project's Bugzilla
72 database (https://bugzilla.samba.org/).
75 ======================================================================
76 == Our Code, Our Bugs, Our Responsibility.
77 == The Samba Team
78 ======================================================================
81 Release notes for older releases follow:
82 ----------------------------------------
83 ==============================
84 Release Notes for Samba 4.17.4
85 December 15, 2022
86 ==============================
89 This is the latest stable release of the Samba 4.17 release series.
90 It also contains security changes in order to address the following defects:
93 o CVE-2022-37966: This is the Samba CVE for the Windows Kerberos
94 RC4-HMAC Elevation of Privilege Vulnerability
95 disclosed by Microsoft on Nov 8 2022.
97 A Samba Active Directory DC will issue weak rc4-hmac
98 session keys for use between modern clients and servers
99 despite all modern Kerberos implementations supporting
100 the aes256-cts-hmac-sha1-96 cipher.
102 On Samba Active Directory DCs and members
103 'kerberos encryption types = legacy' would force
104 rc4-hmac as a client even if the server supports
105 aes128-cts-hmac-sha1-96 and/or aes256-cts-hmac-sha1-96.
107 https://www.samba.org/samba/security/CVE-2022-37966.html
109 o CVE-2022-37967: This is the Samba CVE for the Windows
110 Kerberos Elevation of Privilege Vulnerability
111 disclosed by Microsoft on Nov 8 2022.
113 A service account with the special constrained
114 delegation permission could forge a more powerful
115 ticket than the one it was presented with.
117 https://www.samba.org/samba/security/CVE-2022-37967.html
119 o CVE-2022-38023: The "RC4" protection of the NetLogon Secure channel uses the
120 same algorithms as rc4-hmac cryptography in Kerberos,
121 and so must also be assumed to be weak.
123 https://www.samba.org/samba/security/CVE-2022-38023.html
125 Note that there are several important behavior changes
126 included in this release, which may cause compatibility problems
127 interacting with system still expecting the former behavior.
128 Please read the advisories of CVE-2022-37966,
129 CVE-2022-37967 and CVE-2022-38023 carefully!
131 samba-tool got a new 'domain trust modify' subcommand
132 -----------------------------------------------------
134 This allows "msDS-SupportedEncryptionTypes" to be changed
135 on trustedDomain objects. Even against remote DCs (including Windows)
136 using the --local-dc-ipaddress= (and other --local-dc-* options).
137 See 'samba-tool domain trust modify --help' for further details.
139 smb.conf changes
140 ----------------
142 Parameter Name Description Default
143 -------------- ----------- -------
144 allow nt4 crypto Deprecated no
145 allow nt4 crypto:COMPUTERACCOUNT New
146 kdc default domain supported enctypes New (see manpage)
147 kdc supported enctypes New (see manpage)
148 kdc force enable rc4 weak session keys New No
149 reject md5 clients New Default, Deprecated Yes
150 reject md5 servers New Default, Deprecated Yes
151 server schannel Deprecated Yes
152 server schannel require seal New, Deprecated Yes
153 server schannel require seal:COMPUTERACCOUNT New
154 winbind sealed pipes Deprecated Yes
156 Changes since 4.17.3
157 --------------------
159 o Jeremy Allison <jra@samba.org>
160 * BUG 15224: pam_winbind uses time_t and pointers assuming they are of the
161 same size.
163 o Andrew Bartlett <abartlet@samba.org>
164 * BUG 14929: CVE-2022-44640 [SECURITY] Upstream Heimdal free of
165 user-controlled pointer in FAST.
166 * BUG 15219: Heimdal session key selection in AS-REQ examines wrong entry.
167 * BUG 15237: CVE-2022-37966.
168 * BUG 15258: filter-subunit is inefficient with large numbers of knownfails.
170 o Ralph Boehme <slow@samba.org>
171 * BUG 15240: CVE-2022-38023.
172 * BUG 15252: smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories.
174 o Stefan Metzmacher <metze@samba.org>
175 * BUG 13135: The KDC logic arround msDs-supportedEncryptionTypes differs from
176 Windows.
177 * BUG 14611: CVE-2021-20251 [SECURITY] Bad password count not incremented
178 atomically.
179 * BUG 15203: CVE-2022-42898 [SECURITY] krb5_pac_parse() buffer parsing
180 vulnerability.
181 * BUG 15206: libnet: change_password() doesn't work with
182 dcerpc_samr_ChangePasswordUser4().
183 * BUG 15219: Heimdal session key selection in AS-REQ examines wrong entry.
184 * BUG 15230: Memory leak in snprintf replacement functions.
185 * BUG 15237: CVE-2022-37966.
186 * BUG 15240: CVE-2022-38023.
187 * BUG 15253: RODC doesn't reset badPwdCount reliable via an RWDC
188 (CVE-2021-20251 regression).
190 o Noel Power <noel.power@suse.com>
191 * BUG 15224: pam_winbind uses time_t and pointers assuming they are of the
192 same size.
194 o Anoop C S <anoopcs@samba.org>
195 * BUG 15198: Prevent EBADF errors with vfs_glusterfs.
197 o Andreas Schneider <asn@samba.org>
198 * BUG 15237: CVE-2022-37966.
199 * BUG 15243: %U for include directive doesn't work for share listing
200 (netshareenum).
201 * BUG 15257: Stack smashing in net offlinejoin requestodj.
203 o Joseph Sutton <josephsutton@catalyst.net.nz>
204 * BUG 15197: Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue.
205 * BUG 15219: Heimdal session key selection in AS-REQ examines wrong entry.
206 * BUG 15231: CVE-2022-37967.
207 * BUG 15237: CVE-2022-37966.
209 o Nicolas Williams <nico@twosigma.com>
210 * BUG 14929: CVE-2022-44640 [SECURITY] Upstream Heimdal free of
211 user-controlled pointer in FAST.
215 #######################################
216 Reporting bugs & Development Discussion
217 #######################################
219 Please discuss this release on the samba-technical mailing list or by
220 joining the #samba-technical:matrix.org matrix room, or
221 #samba-technical IRC channel on irc.libera.chat.
224 If you do report problems then please try to send high quality
225 feedback. If you don't provide vital information to help us track down
226 the problem then you will probably be ignored. All bug reports should
227 be filed under the Samba 4.1 and newer product in the project's Bugzilla
228 database (https://bugzilla.samba.org/).
231 ======================================================================
232 == Our Code, Our Bugs, Our Responsibility.
233 == The Samba Team
234 ======================================================================
237 ----------------------------------------------------------------------
238 ==============================
239 Release Notes for Samba 4.17.3
240 November 15, 2022
241 ==============================
244 This is a security release in order to address the following defects:
247 o CVE-2022-42898: Samba's Kerberos libraries and AD DC failed to guard against
248 integer overflows when parsing a PAC on a 32-bit system, which
249 allowed an attacker with a forged PAC to corrupt the heap.
250 https://www.samba.org/samba/security/CVE-2022-42898.html
252 Changes since 4.17.2
253 --------------------
254 o Joseph Sutton <josephsutton@catalyst.net.nz>
255 * BUG 15203: CVE-2022-42898
257 o Nicolas Williams <nico@twosigma.com>
258 * BUG 15203: CVE-2022-42898
261 #######################################
262 Reporting bugs & Development Discussion
263 #######################################
265 Please discuss this release on the samba-technical mailing list or by
266 joining the #samba-technical:matrix.org matrix room, or
267 #samba-technical IRC channel on irc.libera.chat.
270 If you do report problems then please try to send high quality
271 feedback. If you don't provide vital information to help us track down
272 the problem then you will probably be ignored. All bug reports should
273 be filed under the Samba 4.1 and newer product in the project's Bugzilla
274 database (https://bugzilla.samba.org/).
277 ======================================================================
278 == Our Code, Our Bugs, Our Responsibility.
279 == The Samba Team
280 ======================================================================
283 ----------------------------------------------------------------------
284 ==============================
285 Release Notes for Samba 4.17.2
286 October 25, 2022
287 ==============================
290 This is a security release in order to address the following defects:
292 o CVE-2022-3437: There is a limited write heap buffer overflow in the GSSAPI
293 unwrap_des() and unwrap_des3() routines of Heimdal (included
294 in Samba).
295 https://www.samba.org/samba/security/CVE-2022-3437.html
297 o CVE-2022-3592: A malicious client can use a symlink to escape the exported
298 directory.
299 https://www.samba.org/samba/security/CVE-2022-3592.html
301 Changes since 4.17.1
302 --------------------
304 o Volker Lendecke <vl@samba.org>
305 * BUG 15207: CVE-2022-3592.
307 o Joseph Sutton <josephsutton@catalyst.net.nz>
308 * BUG 15134: CVE-2022-3437.
311 #######################################
312 Reporting bugs & Development Discussion
313 #######################################
315 Please discuss this release on the samba-technical mailing list or by
316 joining the #samba-technical:matrix.org matrix room, or
317 #samba-technical IRC channel on irc.libera.chat.
319 If you do report problems then please try to send high quality
320 feedback. If you don't provide vital information to help us track down
321 the problem then you will probably be ignored. All bug reports should
322 be filed under the Samba 4.1 and newer product in the project's Bugzilla
323 database (https://bugzilla.samba.org/).
326 ======================================================================
327 == Our Code, Our Bugs, Our Responsibility.
328 == The Samba Team
329 ======================================================================
332 ----------------------------------------------------------------------
333 ==============================
334 Release Notes for Samba 4.17.1
335 October 19, 2022
336 ==============================
339 This is the latest stable release of the Samba 4.17 release series.
342 Changes since 4.17.0
343 --------------------
345 o Jeremy Allison <jra@samba.org>
346 * BUG 14611: CVE-2021-20251 [SECURITY] Bad password count not incremented
347 atomically.
348 * BUG 15174: smbXsrv_connection_shutdown_send result leaked.
349 * BUG 15182: Flush on a named stream never completes.
350 * BUG 15195: Permission denied calling SMBC_getatr when file not exists.
352 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
353 * BUG 15189: Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later
354 over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC.
355 * BUG 15191: pytest: add file removal helpers for TestCaseInTempDir.
357 o Andrew Bartlett <abartlet@samba.org>
358 * BUG 14611: CVE-2021-20251 [SECURITY] Bad password count not incremented
359 atomically.
360 * BUG 15189: Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later.
361 over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC.
363 o Ralph Boehme <slow@samba.org>
364 * BUG 15182: Flush on a named stream never completes.
366 o Volker Lendecke <vl@samba.org>
367 * BUG 15151: vfs_gpfs silently garbles timestamps > year 2106.
369 o Gary Lockyer <gary@catalyst.net.nz>
370 * BUG 14611: CVE-2021-20251 [SECURITY] Bad password count not incremented
371 atomically.
373 o Stefan Metzmacher <metze@samba.org>
374 * BUG 15200: multi-channel socket passing may hit a race if one of the
375 involved processes already existed.
376 * BUG 15201: memory leak on temporary of struct imessaging_post_state and
377 struct tevent_immediate on struct imessaging_context (in
378 rpcd_spoolss and maybe others).
380 o Noel Power <noel.power@suse.com>
381 * BUG 15205: Since popt1.19 various use after free errors using result of
382 poptGetArg are now exposed.
384 o Anoop C S <anoopcs@samba.org>
385 * BUG 15192: Remove special case for O_CREAT in SMB_VFS_OPENAT from
386 vfs_glusterfs.
388 o Andreas Schneider <asn@samba.org>
389 * BUG 15169: GETPWSID in memory cache grows indefinetly with each NTLM auth.
391 o Joseph Sutton <josephsutton@catalyst.net.nz>
392 * BUG 14611: CVE-2021-20251 [SECURITY] Bad password count not incremented
393 atomically.
396 #######################################
397 Reporting bugs & Development Discussion
398 #######################################
400 Please discuss this release on the samba-technical mailing list or by
401 joining the #samba-technical:matrix.org matrix room, or
402 #samba-technical IRC channel on irc.libera.chat.
405 If you do report problems then please try to send high quality
406 feedback. If you don't provide vital information to help us track down
407 the problem then you will probably be ignored. All bug reports should
408 be filed under the Samba 4.1 and newer product in the project's Bugzilla
409 database (https://bugzilla.samba.org/).
412 ======================================================================
413 == Our Code, Our Bugs, Our Responsibility.
414 == The Samba Team
415 ======================================================================
418 ----------------------------------------------------------------------
419 ==============================
420 Release Notes for Samba 4.17.0
421 September 13, 2022
422 ==============================
425 This is the first stable release of the Samba 4.17 release series.
426 Please read the release notes carefully before upgrading.
429 NEW FEATURES/CHANGES
430 ====================
432 SMB Server performance improvements
433 -----------------------------------
435 The security improvements in recent releases
436 (4.13, 4.14, 4.15, 4.16), mainly as protection against symlink races,
437 caused performance regressions for meta data heavy workloads.
439 With 4.17 the situation improved a lot again:
441 - Pathnames given by a client are devided into dirname and basename.
442 The amount of syscalls to validate dirnames is reduced to 2 syscalls
443 (openat, close) per component. On modern Linux kernels (>= 5.6) smbd
444 makes use of the openat2() syscall with RESOLVE_NO_SYMLINKS,
445 in order to just use 2 syscalls (openat2, close) for the whole dirname.
447 - Contended path based operations used to generate a lot of unsolicited
448 wakeup events causing thundering herd problems, which lead to masive
449 latencies for some clients. These events are now avoided in order
450 to provide stable latencies and much higher throughput of open/close
451 operations.
453 Configure without the SMB1 Server
454 ---------------------------------
456 It is now possible to configure Samba without support for
457 the SMB1 protocol in smbd. This can be selected at configure
458 time with either of the options:
460 --with-smb1-server
461 --without-smb1-server
463 By default (without either of these options set) Samba
464 is configured to include SMB1 support (i.e. --with-smb1-server
465 is the default). When Samba is configured without SMB1 support,
466 none of the SMB1 code is included inside smbd except the minimal
467 stub code needed to allow a client to connect as SMB1 and immediately
468 negotiate the selected protocol into SMB2 (as a Windows server also
469 allows).
471 None of the SMB1-only smb.conf parameters are removed when
472 configured without SMB1, but these parameters are ignored by
473 the smbd server. This allows deployment without having to change
474 an existing smb.conf file.
476 This option allows sites, OEMs and integrators to configure Samba
477 to remove the old and insecure SMB1 protocol from their products.
479 Note that the Samba client libraries still support SMB1 connections
480 even when Samba is configured as --without-smb1-server. This is
481 to ensure maximum compatibility with environments containing old
482 SMB1 servers.
484 Bronze bit and S4U support now also with MIT Kerberos 1.20
485 ----------------------------------------------------------
487 In 2020 Microsoft Security Response Team received another Kerberos-related
488 report. Eventually, that led to a security update of the CVE-2020-17049,
489 Kerberos KDC Security Feature Bypass Vulnerability, also known as a ‘Bronze
490 Bit’. With this vulnerability, a compromised service that is configured to use
491 Kerberos constrained delegation feature could tamper with a service ticket that
492 is not valid for delegation to force the KDC to accept it.
494 With the release of MIT Kerberos 1.20, Samba AD DC is able able to mitigate the
495 ‘Bronze Bit’ attack. MIT Kerberos KDC's KDB (Kerberos Database Driver) API was
496 changed to allow passing more details between KDC and KDB components. When built
497 against MIT Kerberos, Samba AD DC supports MIT Kerberos 1.19 and 1.20 versions
498 but 'Bronze Bit' mitigation is provided only with MIT Kerberos 1.20.
500 In addition to fixing the ‘Bronze Bit’ issue, Samba AD DC now fully supports
501 S4U2Self and S4U2Proxy Kerberos extensions.
503 Note the default (Heimdal-based) KDC was already fixed in 2021,
504 see https://bugzilla.samba.org/show_bug.cgi?id=14642
506 Resource Based Constrained Delegation (RBCD) support
507 ----------------------------------------------------
509 Samba AD DC built with MIT Kerberos 1.20 offers RBCD support now. With MIT
510 Kerberos 1.20 we have complete RBCD support passing Sambas S4U testsuite.
512 samba-tool delegation got the 'add-principal' and 'del-principal' subcommands
513 in order to manage RBCD.
515 To complete RBCD support and make it useful to Administrators we added the
516 Asserted Identity [1] SID into the PAC for constrained delegation. This is
517 available for Samba AD compiled with MIT Kerberos 1.20.
519 Note the default (Heimdal-based) KDC does not support RBCD yet.
521 [1] https://docs.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview
523 Customizable DNS listening port
524 -------------------------------
526 It is now possible to set a custom listening port for the builtin DNS service,
527 making easy to host another DNS on the same system that would bind to the
528 default port and forward the domain-specific queries to Samba using the custom
529 port. This is the opposite configuration of setting a forwarder in Samba.
531 It makes possible to use another DNS server as a front and forward to Samba.
533 Dynamic DNS updates may not be proxied by the front DNS server when forwarding
534 to Samba. Dynamic DNS update proxying depends on the features of the other DNS
535 server used as a front.
537 CTDB changes
538 ------------
540 * When Samba is configured with both --with-cluster-support and
541 --systemd-install-services then a systemd service file for CTDB will
542 be installed.
544 * ctdbd_wrapper has been removed. ctdbd is now started directly from
545 a systemd service file or init script.
547 * The syntax for the ctdb.tunables configuration file has been
548 relaxed. However, trailing garbage after the value, including
549 comments, is no longer permitted. Please see ctdb-tunables(7) for
550 more details.
552 Operation without the (unsalted) NT password hash
553 -------------------------------------------------
555 When Samba is configured with 'nt hash store = never' then Samba will
556 no longer store the (unsalted) NT password hash for users in Active
557 Directory. (Trust accounts, like computers, domain controllers and
558 inter-domain trusts are not impacted).
560 In the next version of Samba the default for 'nt hash store' will
561 change from 'always' to 'auto', where it will follow (behave as 'nt
562 hash store = never' when 'ntlm auth = disabled' is set.
564 Security-focused deployments of Samba that have eliminated NTLM from
565 their networks will find setting 'ntlm auth = disabled' with 'nt hash
566 store = always' as a useful way to improve compliance with
567 best-practice guidance on password storage (which is to always use an
568 interated hash).
570 Note that when 'nt hash store = never' is set, then arcfour-hmac-md5
571 Kerberos keys will not be available for users who subsequently change
572 their password, as these keys derive their values from NT hashes. AES
573 keys are stored by default for all deployments of Samba with Domain
574 Functional Level 2008 or later, are supported by all modern clients,
575 and are much more secure.
577 Finally, also note that password history in Active Directory is stored
578 in nTPwdHistory using a series of NT hash values. Therefore the full
579 password history feature is not available in this mode.
581 To provide some protection against password re-use previous Kerberos
582 hash values (the current, old and older values are already stored) are
583 used, providing a history length of 3.
585 There is one small limitation of this workaround: Changing the
586 sAMAccountName, userAccountControl or userPrincipalName of an account
587 can cause the Kerberos password salt to change. This means that after
588 *both* an account rename and a password change, only the current
589 password will be recognised for password history purposes.
591 Python API for smbconf
592 ----------------------
594 Samba's smbconf library provides a generic frontend to various
595 configuration backends (plain text file, registry) as a C library. A
596 new Python wrapper, importable as 'samba.smbconf' is available. An
597 additional module, 'samba.samba3.smbconf', is also available to enable
598 registry backend support. These libraries allow Python programs to
599 read, and optionally write, Samba configuration natively.
601 JSON support for smbstatus
602 --------------------------
604 It is now possible to print detailed information in JSON format in
605 the smbstatus program using the new option --json. The JSON output
606 covers all the existing text output including sessions, connections,
607 open files, byte-range locks, notifies and profile data with all
608 low-level information maintained by Samba in the respective databases.
610 Protected Users security group
611 ------------------------------
613 Samba AD DC now includes support for the Protected Users security
614 group introduced in Windows Server 2012 R2. The feature reduces the
615 attack surface of user accounts by preventing the use of weak
616 encryption types. It also mitigates the effects of credential theft by
617 limiting credential lifetime and scope.
619 The protections are intended for user accounts only, and service or
620 computer accounts should not be added to the Protected Users
621 group. User accounts added to the group are granted the following
622 security protections:
624 * NTLM authentication is disabled.
625 * Kerberos ticket-granting tickets (TGTs) encrypted with RC4 are
626 not issued to or accepted from affected principals. Tickets
627 encrypted with AES, and service tickets encrypted with RC4, are
628 not affected by this restriction.
629 * The lifetime of Kerberos TGTs is restricted to a maximum of four
630 hours.
631 * Kerberos constrained and unconstrained delegation is disabled.
633 If the Protected Users group is not already present in the domain, it
634 can be created with 'samba-tool group add'. The new '--special'
635 parameter must be specified, with 'Protected Users' as the name of the
636 group. An example command invocation is:
638 samba-tool group add 'Protected Users' --special
640 or against a remote server:
642 samba-tool group add 'Protected Users' --special -H ldap://dc1.example.com -U Administrator
644 The Protected Users group is identified in the domain by its having a
645 RID of 525. Thus, it should only be created with samba-tool and the
646 '--special' parameter, as above, so that it has the required RID
647 to function correctly.
650 REMOVED FEATURES
651 ================
653 LanMan Authentication and password storage removed from the AD DC
654 -----------------------------------------------------------------
656 The storage and authentication with LanMan passwords has been entirely
657 removed from the Samba AD DC, even when "lanman auth = yes" is set.
660 smb.conf changes
661 ================
663 Parameter Name Description Default
664 -------------- ----------- -------
665 dns port New default 53
666 fruit:zero_file_id New default yes
667 nt hash store New parameter always
668 smb1 unix extensions Replaces "unix extensions"
669 volume serial number New parameter -1
670 winbind debug traceid New parameter no
673 CHANGES SINCE 4.17.0rc4
674 =======================
676 o Ralph Boehme <slow@samba.org>
677 * BUG 15126: acl_xattr VFS module may unintentionally use filesystem
678 permissions instead of ACL from xattr.
679 * BUG 15153: Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1.
680 * BUG 15161: assert failed: !is_named_stream(smb_fname)") at
681 ../../lib/util/fault.c:197.
683 o Volker Lendecke <vl@samba.org>
684 * BUG 15126: acl_xattr VFS module may unintentionally use filesystem
685 permissions instead of ACL from xattr.
686 * BUG 15161: assert failed: !is_named_stream(smb_fname)") at
687 ../../lib/util/fault.c:197.
689 o Stefan Metzmacher <metze@samba.org>
690 * BUG 15159: Cross-node multi-channel reconnects result in SMB2 Negotiate
691 returning NT_STATUS_NOT_SUPPORTED.
693 o Noel Power <noel.power@suse.com>
694 * BUG 15160: winbind at info level debug can coredump when processing
695 wb_lookupusergroups.
698 CHANGES SINCE 4.17.0rc3
699 =======================
701 o Anoop C S <anoopcs@samba.org>
702 * BUG 15157: Make use of glfs_*at() API calls in vfs_glusterfs.
705 CHANGES SINCE 4.17.0rc2
706 =======================
708 o Jeremy Allison <jra@samba.org>
709 * BUG 15128: Possible use after free of connection_struct when iterating
710 smbd_server_connection->connections.
712 o Christian Ambach <ambi@samba.org>
713 * BUG 15145: `net usershare add` fails with flag works with --long but fails
714 with -l.
716 o Ralph Boehme <slow@samba.org>
717 * BUG 15126: acl_xattr VFS module may unintentionally use filesystem
718 permissions instead of ACL from xattr.
720 o Stefan Metzmacher <metze@samba.org>
721 * BUG 15125: Performance regression on contended path based operations.
722 * BUG 15148: Missing READ_LEASE break could cause data corruption.
724 o Andreas Schneider <asn@samba.org>
725 * BUG 15141: libsamba-errors uses a wrong version number.
727 o Joseph Sutton <josephsutton@catalyst.net.nz>
728 * BUG 15152: SMB1 negotiation can fail to handle connection errors.
731 CHANGES SINCE 4.17.0rc1
732 =======================
734 o Jeremy Allison <jra@samba.org>
735 * BUG 15143: New filename parser doesn't check veto files smb.conf parameter.
736 * BUG 15144: 4.17.rc1 still uses symlink-race prone unix_convert()
737 * BUG 15146: Backport fileserver related changed to 4.17.0rc2
739 o Jule Anger <janger@samba.org>
740 * BUG 15147: Manpage for smbstatus json is missing
742 o Volker Lendecke <vl@samba.org>
743 * BUG 15146: Backport fileserver related changed to 4.17.0rc2
745 o Stefan Metzmacher <metze@samba.org>
746 * BUG 15125: Performance regression on contended path based operations
747 * BUG 15146: Backport fileserver related changed to 4.17.0rc2
749 o Andreas Schneider <asn@samba.org>
750 * BUG 15140: Fix issues found by coverity in smbstatus json code
751 * BUG 15146: Backport fileserver related changed to 4.17.0rc2
754 KNOWN ISSUES
755 ============
757 https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.17#Release_blocking_bugs
760 #######################################
761 Reporting bugs & Development Discussion
762 #######################################
764 Please discuss this release on the samba-technical mailing list or by
765 joining the #samba-technical:matrix.org matrix room, or
766 #samba-technical IRC channel on irc.libera.chat
768 If you do report problems then please try to send high quality
769 feedback. If you don't provide vital information to help us track down
770 the problem then you will probably be ignored. All bug reports should
771 be filed under the Samba 4.1 and newer product in the project's Bugzilla
772 database (https://bugzilla.samba.org/).
775 ======================================================================
776 == Our Code, Our Bugs, Our Responsibility.
777 == The Samba Team
778 ======================================================================