4 This is the first pre release of Samba 4.17. This is *not*
5 intended for production environments and is designed for testing
6 purposes only. Please report any defects via the Samba bug reporting
7 system at https://bugzilla.samba.org/.
9 Samba 4.17 will be the next version of the Samba suite.
19 Bronze bit and S4U support with MIT Kerberos 1.20
20 -------------------------------------------------
22 In 2020 Microsoft Security Response Team received another Kerberos-related
23 report. Eventually, that led to a security update of the CVE-2020-17049,
24 Kerberos KDC Security Feature Bypass Vulnerability, also known as a ‘Bronze
25 Bit’. With this vulnerability, a compromised service that is configured to use
26 Kerberos constrained delegation feature could tamper with a service ticket that
27 is not valid for delegation to force the KDC to accept it.
29 With the release of MIT Kerberos 1.20, Samba AD DC is able able to mitigate the
30 ‘Bronze Bit’ attack. MIT Kerberos KDC's KDB (Kerberos Database Driver) API was
31 changed to allow passing more details between KDC and KDB components. When built
32 against MIT Kerberos, Samba AD DC supports MIT Kerberos 1.19 and 1.20 versions
33 but 'Bronze Bit' mitigation is provided only with MIT Kerberos 1.20.
35 In addition to fixing the ‘Bronze Bit’ issue, Samba AD DC now fully supports
36 S4U2Self and S4U2Proxy Kerberos extensions.
38 Resource Based Constrained Delegation (RBCD) support
39 ----------------------------------------------------
41 Samba AD DC built with MIT Kerberos 1.20 offers RBCD support now. With MIT
42 Kerberos 1.20 we have complete RBCD support passing Sambas S4U testsuite.
43 Note that samba-tool lacks support for setting this up yet!
45 To complete RBCD support and make it useful to Administrators we added the
46 Asserted Identity [1] SID into the PAC for constrained delegation. This is
47 available for Samba AD compiled with MIT Kerberos 1.20.
49 [1] https://docs.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview
51 Customizable DNS listening port
52 -------------------------------
54 It is now possible to set a custom listening port for the builtin DNS service,
55 making easy to host another DNS on the same system that would bind to the
56 default port and forward the domain-specific queries to Samba using the custom
57 port. This is the opposite configuration of setting a forwarder in Samba.
59 It makes possible to use another DNS server as a front and forward to Samba.
61 Dynamic DNS updates may not be proxied by the front DNS server when forwarding
62 to Samba. Dynamic DNS update proxying depends on the features of the other DNS
63 server used as a front.
69 LanMan Authentication and password storage removed from the AD DC
70 -----------------------------------------------------------------
72 The storage and authentication with LanMan passwords has been entirely
73 removed from the Samba AD DC, even when "lanman auth = yes" is set.
78 Parameter Name Description Default
79 -------------- ----------- -------
80 dns port New default 53
86 https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.17#Release_blocking_bugs
89 #######################################
90 Reporting bugs & Development Discussion
91 #######################################
93 Please discuss this release on the samba-technical mailing list or by
94 joining the #samba-technical:matrix.org matrix room, or
95 #samba-technical IRC channel on irc.libera.chat
97 If you do report problems then please try to send high quality
98 feedback. If you don't provide vital information to help us track down
99 the problem then you will probably be ignored. All bug reports should
100 be filed under the Samba 4.1 and newer product in the project's Bugzilla
101 database (https://bugzilla.samba.org/).
104 ======================================================================
105 == Our Code, Our Bugs, Our Responsibility.
107 ======================================================================