1 <!--#include virtual="/samba/header.html" -->
3 <H2>The Samba Team announces the first official release of Samba 3.0</H2>
7 The Samba Team is proud to announce the availability of the
8 first official, stable release of the Samba 3.0.0 code base.
10 The source code can be downloaded from :
12 <a href="http://download.samba.org/samba/ftp/">http://download.samba.org/samba/ftp/</a>
14 The uncompressed tarball and patch file have been signed
15 using GnuPG. The Samba public key is available at
17 <a href="http://download.samba.org/samba/ftp/samba-pubkey.asc">http://download.samba.org/samba/ftp/samba-pubkey.asc</a>
19 Binary packages are available at
21 <a href="http://download.samba.org/samba/ftp/Binary_Packages/">http://download.samba.org/samba/ftp/Binary_Packages/</a>
23 A simplified version of the CVS log of updates since 3.0.0rc4
24 can be found in the the download directory under the name
25 ChangeLog-3.0.0rc4-3.0.0.
27 Please file any bugs you find in this release at
29 <a href="https://bugzilla.samba.org/">https://bugzilla.samba.org/</a>
31 As always, all bugs are our responsibility.
37 #######################################################################
38 WHATS NEW IN Samba 3.0.0
40 ==============================
42 This is the first official release of Samba 3.0.0 code base. Work
43 on the SAMBA_3_0 CVS branch continues. Please refer to the section
44 on "Known Issues" for more details.
50 1) Active Directory support. Samba 3.0 is now able to
51 join a ADS realm as a member server and authenticate
52 users using LDAP/Kerberos.
54 2) Unicode support. Samba will now negotiate UNICODE on the wire
55 and internally there is now a much better infrastructure for
56 multi-byte and UNICODE character sets.
58 3) New authentication system. The internal authentication system
59 has been almost completely rewritten. Most of the changes are
60 internal, but the new auth system is also very configurable.
62 4) New default filename mangling system.
64 5) A new "net" command has been added. It is somewhat similar to
65 the "net" command in windows. Eventually we plan to replace
66 numerous other utilities (such as smbpasswd) with subcommands
69 6) Samba now negotiates NT-style status32 codes on the wire. This
70 improves error handling a lot.
72 7) Better Windows 2000/XP/2003 printing support including publishing
73 printer attributes in active directory.
75 8) New loadable module support for passdb backends and character
78 9) New default dual-daemon winbindd support for better performance.
80 10) Support for migrating from a Windows NT 4.0 domain to a Samba
81 domain and maintaining user, group and domain SIDs.
83 11) Support for establishing trust relationships with Windows NT 4.0
86 12) Initial support for a distributed Winbind architecture using
87 an LDAP directory for storing SID to uid/gid mappings.
89 13) Major updates to the Samba documentation tree.
91 14) Full support for client and server SMB signing to ensure
92 compatibility with default Windows 2003 security settings.
94 15) Improvement of ACL mapping features based on code donated by
98 Plus lots of other improvements!
101 Additional Documentation
102 ------------------------
104 Please refer to Samba documentation tree (included in the docs/
105 subdirectory) for extensive explanations of installing, configuring
106 and maintaining Samba 3.0 servers and clients. It is advised to
107 begin with the Samba-HOWTO-Collection for overviews and specific
108 tasks (the current book is up to approximately 400 pages) and to
109 refer to the various man pages for information on individual options.
111 We are very glad to be able to include the second edition of
112 "Using Samba" by Jay Ts, Robert Eckstein, and David Collier-Brown
113 (O'Reilly & Associates) in this release. The book is available
114 on-line at http://samba.org/samba/docs/ and is included with
115 the Samba Web Administration Tool (SWAT). Thanks to the authors and
116 publisher for making "Using Samba" under the GNU Free Documentation
120 ######################################################################
124 Please refer to the CVS log for the SAMBA_3_0 branch for complete
127 1) Fix bug that prevented filenames of length >100 characters
128 from being restored using smbclient's tar functionality.
129 2) Fix bug that prevented fast path code in strchr_m()
131 3) Make sure we store the desired access flag on incoming
133 4) Fix smbd crash when dealing with mangled file names.
134 5) Ensure that the group comment field is not overwritten
135 if it already exists.
136 6) Fix bug that prevented 'net rpc join' from working
137 with mixed mode AD domains (bug 442).
138 7) Fix crash in smbd when a Samba PDC is not able to
139 enumerate trusted domains (bug 450).
140 8) Fix crash bug found by the Samba4 testsuite.
141 9) Fix bug that prevented smbd from returning an ACL list
142 if one of the SIDs could not be resolved (bug 470).
143 10) Remove -P option from smbclient printing scripts since it
144 has a different meaning in Samba 3.0 (bug 473).
145 11) Sync smbldap-tools with latest version from idealx cvs tree.
146 12) Cleanup some warnings produced by the Sun C compiler.
147 13) Several fixes for SWAT relating to international character
154 1) Fix incorrect error message in testparm.c regarding 'map system'.
155 2) Protect against core dump if ioctl for print job sends invalid
157 3) Fix bug in generic hash cacluation.
158 4) Remove references to unused 'strip dot' parameter
159 5) Fix CPU burn bug in multi-byte character conversion.
160 6) Use opt_target_workgroup instead of lp_workgroup() in vampire
161 code so we can override the value in smb.conf with the -w option.
162 7) Display an error if we can't create a posix account for the
163 user when running 'net rpc vampire' (bug 323).
164 8) Fix UTF8 conversion bugs in LDAP passdb and idmap code (bug 296).
165 9) Fix smbd crash when changing the machine trust account password
167 10) Remove getpwnam() calls from init_sam_from_xxx(). This means
168 that %u & %g will no longer expand in the "login ..." set of
169 smb.conf options, but %U and %G still do. The payback is that
170 winbindd local accounts for users work with 'wbinfo -u'
171 when winbind is running on a Samba PDC.
172 11) Fix unitiailized timestamp where merging print_jobs and
174 12) Fix bug in debian packaging files affecting non-i386 platforms.
180 1) Remove Perl module dependencies in generated RedHat 8/9 RPMS.
181 2) Update mount helper to take synonyms for file_mode and
182 dir_mode (fmask and dmask).
183 3) Fix portability bug with log2pcaphex.
184 4) Use different algorithm to generate codepages source code which
185 allows to take gaps into account thus making unnecessary
186 extended [index] = value, syntax in to_ucs2 array (bug 380).
187 5) Fix comment strings to 43 bytes as per spec.
188 6) Fix pam_winbind compile bug on FreeBSD (bug 261).
189 7) Support for in-memory keytabs, which are needed to make heimdal
190 work properly. MIT does not support them, so this check will be
191 used to decide whether to use them. (partial fix for bug 372).
192 8) Disable RC4-HMAC on broken heimdal setups. (remainder of bug
194 9) Correct bug in smbclient that resulted in errors when untarring
195 long filenames (bug 308).
196 10) Improve autoconf checks for PAM header files and libs.
197 11) Added fast path to convert_string() when dealing with
198 ASCII->ASCII, UCS2-LE->ASCII, and ASCII->UCS2-LE with
200 12) Quiet debug messages when we don't find a module and it is not
201 a critical error (bug 375).
202 13) Fix UNIX passwd sync properly.
203 14) Fix more transitive trust issues in winbindd (bug 305).
204 15) Ensure that winbindd functions with 'disable netbios = yes'
205 16) Store the real short domain name in secrets.tdb as soon as we
206 know it. Also display an error message when joining an AD
207 domain and the 'workgroup' parameter has not been specified.
208 17) Return 0 DFS links instead of -1 when dfs support is not enabled.
209 18) Update LDAP schema for Netscape DS 4.x and Novell eDirectory 8.7
210 19) Ensure that name types can be specified using name#type notation
211 in the 'net' command (bug 73).
212 20) Add retry looks to ADS sequence number and domain SID lookups
214 21) use a variant of alloc_sub_basic() for string lists such as
215 'valid users', 'write list', and 'read list' (bug 397).
216 22) Fix seg fault when winbindd receives an error from the AD server
217 in response to an LDAP search (bug 282).
218 23) Update findsmb to use the new syntax for smbclient and nmblookup.
219 24) Fix bug that prevented variables from being used in explicitly
220 defined path in [homes].
221 25) Only set SIDs when they're returned by the MySQL query
223 26) Include support for NTLMv2 key exchange.
224 27) Revert default for 'client ntlmv2 auth' to off (bug 359).
225 28) Fix crash in winbindd when the trust account password gets
226 changed underneath us via 'net rpc changetrustpw' (bug 382).
227 29) Use djb-algorithm string hash - faster than the tdb one we
228 used to use. Does not change on disk format or hashing location.
229 30) Implements some kind of improved AFS support for Samba on
230 Linux with OpenAFS 1.2.10. './configure --with-fake-kaserver'
231 assumes that you have OpenAFS on your machine.
232 31) When enumerating dfs shares loop from 0 to lp_numservices() instead
233 of relying on lp_servicename(n) to return an empty string for
234 invalid service numbers (bug 403).
235 32) Fix crash bug in 'net rpc samdump' (bug 334).
236 33) Fix crash bug in WINS NSS module (bug 299).
237 34) Fix a few minor compile errors on HP-UX.
244 1) Add levels 261 and 262 to search. Found using Samba4 tester.
245 2) Correct bad error return code in session setup reply
246 3) Fix bug where smbd returned DOS error codes from SMBsearch
247 even when NT1 protocol was negotiated.
248 4) Implement SMBexit properly.
249 5) Return group lists from a Samba PDC to a Windows 9x/ME box
250 in implementing user level access control (bug 314).
251 6) Prevent SWAT from crashing when adding shares (bug 254)
252 7) Fix various documentation issues (bugs 304 & 214)
253 8) Fix wins server listing in SWAT (bug 197)
254 9) Fix problem in rpcclient that caused enumerating printer
255 drivers to report failure (bug 294).
256 10) Use kerberos 5 authentication in our client code whenever possible
257 11) Fix schannel bug that caused Active Directory DC's to downgrade our
258 machine account to an NT member.
259 12) Implement missing SAMR_REMOVE_USER_FOREIGN_DOMAIN call (bug 252).
260 13) Implement automatic generation of include/version.h
261 14) Include initial version of smbldap-tool scripts for the Samba
263 15) Implement numerous fixes for multi-byte character strings.
264 16) Enable 'unix extensions' parameter by default.
265 17) Make sure we set the SID type when falling back to the rid
267 18) Correct linking problems with pam_smbpass (bug 327).
268 19) Add SYSV defines for Irix and Solaris to ensure the 'printing'
269 parameter default to the correct value (bug 230)
270 20) Fix recursion bug in alloc_string_sub() (bug 289, et. al.)
271 21) Ensure that 'make install' includes the static and shared
272 versions of the libsmbclient libraries.
273 22) Add CP850 and CP437 internal character set support (bug 150).
274 23) Add support to examples/LDAP/convertSambaAccount for generating
275 LDIF modify files instead of just add (303).
276 24) Fix support for -W option in smbclient (bug 39)
277 25) Remove 'ldap trust ids' parameter since it could not be supported
278 by the current architecture.
279 26) Don't crash when no argument is given to -T in smbclient (bug 345).
280 27) Ensure smbadduser contains the same paths for the smbpasswd file
281 as the other Samba tools (bug 290).
282 28) Port of 'available = no' fix for [homes] from SAMBA_2_2 cvs tree.
283 29) Add sanity checks to DeletePrinterData[Ex]() and ensure that the
284 modified printer is written to disk.
285 30) Force winbindd to periodically update the trusted domain cache.
286 31) Remove outdated import/export script to convert an smbpasswd file
287 to and from and LDAP directory. Use the pdbedit tool instead.
288 32) Ensure that %U substitution is restored on next valid packet
292 Changes since 3.0beta3
293 ######################
295 1) Various memory leak fixes.
296 2) Provide full support for SMB signing (server and client)
297 3) Check for broken getgrouplist() in glibc.
298 4) Don't get stuck in an infinite loop listing directories
299 recursively if the server returns an empty directory name
301 5) Idle LDAP connections after 150 seconds.
302 6) Patched make uninstallmodules (bug 236).
303 7) Fix bug that caused smbd to return incomplete directory listings
304 when UNIX files contained MS wildcard characters.
305 8) Quiet default debug messages in command line tools.
306 9) Fixes to avoid panics on invalid multi-byte strings.
307 10) Fix error messages when creating a new smbpasswd file (bug 198).
308 11) Implemented better detection routines in autoconf scripts for
309 locating ads support on the host OS.
310 12) Fix bug that caused libraries in /usr/local/lib to be ignored
312 13) Ensure winbindd_ads uses the correct realm or domain name when
313 connecting to trusted DC.
314 14) Ensure a correct prototype is created for snprintf() (bug 187)
315 15) Stop files being created on read-only shares in some circumstances.
316 16) Fix wbinfo -p (bug 251)
317 17) Support schannel on any tcp/ip connection if necessary
318 18) Correct bug in user_in_list() so that it works with winbind groups
320 19) Ensure the schannel bind credentials default to the domain
321 of the destination host.
322 20) Default password expiration time in account_pol.tdb to never
323 expire. Remove any existing account_pol.tdb file to reset
324 the new default policy (bug 184).
325 21) Add buttons to SWAT to change the view of smb.conf (bug 212)
326 22) Fix incorrect checks that determine whether or not the 'add user
327 script' has been set.
328 23) More cleanup for internal character set conversions.
329 24) Fixes for multi-byte strings in stat cache code.
330 25) Ensure that the net command honors the 'workgroup' parameter
331 in smb.conf when not overridden from the command line.
332 26) Add gss-spnego support to the ntlm_auth tool.
333 27) Add vfs_default_quota VFS module.
334 28) Added server support for NT quota interfaces.
335 29) Prevent Krb5 replay attacks by adding a replay_cache.
336 30) Fix problems with winbindd and transitive trusts in AD domains.
337 31) Added -S to client tools for setting SMB signing options on the
339 32) Fix bug causing the 'passwd change program' to be called as the
340 connected user and not root.
341 33) Fixed data corruption bug in byte-range locking (e.g. affected MS Excel).
342 34) Support winbindd on FreeBSD is possible.
343 35) Look at only the first OID in the security blob sent in the session
344 setup request to determine the token type.
345 36) Only push locks onto a blocking lock queue if the posix lock failed with
346 EACCES or EAGAIN (this means another lock conflicts). Else return an
347 error and don't queue the request.
348 37) Fix command line argument processing for smbtar.
349 38) Correct issue that caused smbd to return generic unix_user.<uid>
351 39) Default to algorithmic mapping when generating a rid for a group
353 40) Expand %g and %G in logon script, profile path, etc... during
354 a domain logon (bug 208).
355 41) Make sure smbclient obeys '-s <config>'
356 42) Added win2k3 shadow copy operations to VFS interface.
357 43) Allow connections to samba domain member as SERVER\user (don't
358 always default to DOMAIN\user).
359 44) Remove checks in winbindd that caused it to attempt to use
360 non-transitive trust relationships.
361 45) Remove delays in winbindd caused by invalid DNS lookups.
362 46) Fix supplementary group memberships on systems with slightly
363 broken NSS implementations (bug 267).
364 47) Correct issue that prevented smbclient from viewing shares on
365 a win2k server when using a non-anonymous connection (bug 284).
366 48) Add --domain=DOMAIN_NAME to wbinfo for limiting operations like
367 'wbinfo -u' to a single domain. The '.' character represents
369 49) Fix group enumeration bug when using an LDAP directory for
370 storing group mappings.
371 50) Default to use NTLMv2 if available. Fallback to not use LM/NTLM
372 when the extended security capability bit is not set.
373 51) Fix crash in 'wbinfo -a' when using extended characters in the
375 52) Fix multi-byte strupper() panics (bug 205).
376 53) Add vfs_readonly VFS module.
377 54) Make sure to initialize the sambaNextUserRid and sambaNextGroupRid
378 attributes when using 'idmap backend = ldap' (bug 280).
379 55) Make sure that users shared between a Samba PDC and member
380 samba server are seen as domain users and not local users on the
382 56) Fix Query FS Info level 2.
383 57) Allow enumeration of users and groups by win9x "file server" (bug
385 58) Create symlinks during install for modules that support mutliple
387 59) More iconv detection fixes.
388 60) Fix path length error in vfs_recycle module (bug 291).
389 61) Added server support for the LSA_DS UUID on the \lsarpc pipe.
390 (server DsRoleGetPrimaryDomainInfo() is currently disabled).
391 62) Fix SMBseek and get/set position calls.
392 62) Fix SetFileInfo level 1.
393 63) Added tool to convert smbd log file to a pcap file (log2pcaphex).
397 Changes since 3.0beta2
398 ######################
400 1) Added fix for Japanese case names in statcache code;
401 these can change size on upper casing.
402 2) Correct issues with iconv detection in configure script
403 (support needed to find iconv libraries on FreeBSD).
404 3) Fix bug that caused a WINS server to be marked as dead
405 incorrectly (bug #190).
406 4) Removing additional deadlocks conditions that prevented
407 winbindd from running on a Samba PDC (used for trust
409 5) Add support for searching for Active Directory for
410 published printers (net ads printer search).
411 6) Separate UNIX username from DOMAIN\username in pipe
413 7) Auth modules now support returning NT_STATUS_NOT_IMPLEMENTED
414 for cases that they cannot handle.
415 8) Flush winbindd connection cache when the machine trust account
416 password is changed while a connection is open (bug #200).
417 9) Add support for 'OSVersion' server printer data string
418 (corrects problem with uploading printer drivers from
420 10) Numerous memory leak fixes.
421 11) LDAP fixes ("passdb backend = ldapsam" & "idmap backend = ldap"):
422 - Store domain SID in LDAP directory.
423 - store idmap information in existing entries (use sambaSID=...
424 if adding a new entry).
425 12) Fix incorrect usage of primary group SID when looking up user
427 13) Remove idmap_XX_to_XX calls from smbd. Move back to the the
428 winbind_XXX and local_XXX calls used in 2.2.
429 14) All uid/gid allocation must involve winbindd now (we do not
430 attempt to map unknown SIDs to a UNIX identify).
431 15) Add 'winbind trusted domains only' parameter to force a domain
432 member. The server to use matching users names from /etc/passwd
433 for its domain (needed for domain member of a Samba domain).
434 16) Rename 'idmap only' to 'enable rid algorithm' for better clarity
436 17) Add support for multi-byte statcache code (bug #185)
437 18) Fix open mode race condition.
438 19) Implement winbindd local account management functions. Refer to
439 the "Winbind Changes" section for details.
440 20) Move RID allocation functions into idmap backend.
441 21) Fix parsing error that prevented publishing printers from a
442 Samba server in an AD domain.
443 22) Revive NTLMSSP support for named pipes.
444 23) More SCHANNEL fixes.
445 24) Correct SMB signing with NTLMSSP.
446 25) Fix coherency bug in print handle/printer object caching code
447 that could cause XP clients to infinitely loop while updating
448 their local printer cache.
449 26) Make winbindd use its dual-daemon mode by default (use -Y to
450 start as a single process).
451 27) Add support to nmbd and winbindd for 'smbcontrol <pid>
453 28) Correct problem with smbtar when dealing with files > 8Gb
458 Changes since 3.0beta1
459 ######################
461 1) Rework our smb signing code again, this factors out some of
462 the common MAC calculation code, and now supports multiple
463 outstanding packets (bug #40).
464 2) Enforce 'client plaintext auth', 'client lanman auth' and 'client
466 3) Correct timestamp problem on 64-bit machines (bug #140).
467 4) Add extra debugging statements to winbindd for tracking down
469 5) Fix bug when aliased 'winbind uid/gid' parameters are used.
470 ('winbind uid/gid' are now replaced with 'idmap uid/gid').
471 6) Added an auth flag that indicates if we should be allowed
472 to fall back to NTLMSSP for SASL if krb5 fails.
473 7) Fixed the bug that forced us not to use the winbindd cache when
474 we have a primary ADS domain and a secondary (trusted) NT4
476 8) Use lp_realm() to find the default realm for 'net ads password'.
477 9) Removed editreg from standard build until it is portable..
478 10) Fix domain membership for servers not running winbindd.
479 11) Correct race condition in determining the high water mark
480 in the idmap backend (bug #181).
481 12) Set the user's primary unix group from usrmgr.exe (partial
483 13) Show comments when doing 'net group -l' (bug #3).
484 14) Add trivial extension to 'net' to dump current local idmap
485 and restore mappings as well.
486 15) Modify 'net rpc vampire' to add new and existing users to
487 both the idmap and the SAM. This code needs further testing.
488 16) Fix crash bug in ADS searches.
489 17) Build libnss_wins.so as part of nsswitch target (bug #160).
490 18) Make net rpc vampire return an error if the sam sync RPC
492 19) Fail to join an NT 4 domain as a BDC if a workstation account
493 using our name exists.
494 20) Fix various memory leaks in server and client code
495 21) Remove the short option to --set-auth-user for wbinfo (-A) to
496 prevent confusion with the -a option (bug #158).
497 22) Added new 'map acl inherit' parameter.
498 23) Removed unused 'privileges' code from group mapping database.
499 24) Don't segfault on empty passdb backend list (bug #136).
500 25) Fixed acl sorting algorithm for Windows 2000 clients.
501 26) Replace universal group cache with netsamlogon_cache
502 from APPLIANCE_HEAD branch.
503 27) Fix autoconf detection issues surrounding --with-ads=yes
504 but no Krb5 header files installed (bug #152).
505 28) Add LDAP lookup for domain sequence number in case we are
506 joined using NT4 protocols to a native mode AD domain.
507 29) Fix backend method selection for trusted NT 4 (or 2k
509 30) Fixed bug that caused us to enumerate domain local groups
510 from native mode AD domains other than our own.
511 31) Correct group enumeration for viewing in the Windows
512 security tab (bug #110).
513 32) Consolidate the DC location code.
514 33) Moved 'ads server' functionality into 'password server' for
515 backwards compatibility.
516 34) Fix winbindd_idmap tdb upgrades from a 2.2 installation.
517 ( if you installed beta1, be sure to
518 'mv idmap.tdb winbindd_idmap.tdb' ).
519 35) Fix pdb_ldap segfaults, and wrong default values for
521 36) Enable negative connection cache for winbindd's ADS backend
523 37) Enable address caching for active directory DC's so we don't
524 have to hit DNS so much.
525 38) Fix bug in idmap code that caused mapping to randomly be
527 39) Add tdb locking code to prevent race condition when adding a
528 new mapping to idmap.
529 40) Fix 'map to guest = bad user' when acting as a PDC supporting
531 41) Prevent deadlock issues when running winbindd on a Samba PDC
532 to handle allocating uids & gids for trusted users and groups
533 42) added LOCALE patch from Steve Langasek (bug #122).
534 43) Add the 'guest' passdb backend automatically to the end of
535 the 'passdb backend' list if 'guest account' has a valid
537 44) Remove samstrict_dc auth method. Rework 'samstrict' to only
538 handle our local names (or domain name if we are a PDC).
539 Move existing permissive 'sam' method to 'sam_ignoredomain'
540 and make 'samstrict' the new default 'sam' auth method.
541 45) Match Windows NT4/2k behavior when authenticating a user with
542 and unknown domain (default to our domain if we are a DC or
543 domain member; default to our local name if we are a
545 46) Fix Get_Pwnam() to always fall back to lookup 'user' if the
546 'DOMAIN\user' lookup fails. This matches 2.2. behavior.
547 47) Fix the trustdom_cache code to update the list of trusted
548 domains when operating as a domain member and not using
550 48) Remove 'nisplussam' passdb backend since it has suffered for
551 too long without a maintainer.
556 ######################################################################
557 Upgrading from a previous Samba 3.0 beta
558 ########################################
560 Beginning with Samba 3.0.0beta3, the RID allocation functions
561 have been moved into winbindd. Previously these were handled
562 by each passdb backend. This means that winbindd must be running
563 to automatically allocate RIDs for users and/or groups. Otherwise,
564 smbd will use the 2.2 algorithm for generating new RIDs.
566 If you are using 'passdb backend = tdbsam' with a previous Samba
567 3.0 beta release (or possibly alpha), it may be necessary to
568 move the RID_COUNTER entry from /usr/local/samba/private/passdb.tdb
569 to winbindd_idmap.tdb. To do this:
571 1) Ensure that winbindd_idmap.tdb exists (launch winbindd at least
573 2) build tdbtool by executing 'make tdbtool' in the source/tdb/
575 3) run: (note that 'tdb>' is the tool's prompt for input)
577 root# ./tdbtool /usr/local/samba/private/passdb.tdb
578 tdb> show RID_COUNTER
582 [000] 0A 52 00 00 .R.
584 tdb> move RID_COUNTER /usr/local/samba/var/locks/winbindd_idmap.tdb
588 If you are using 'passdb backend = ldapsam', it will be necessary to
589 store idmap entries in the LDAP directory as well (i.e. idmap backend
590 = ldap). Refer to the 'net idmap' command for more information on
591 migrating SID<->UNIX id mappings from one backend to another.
593 If the RID_COUNTER record does not exist, then these instructions are
594 unneccessary and the new RID_COUNTER record will be correctly generated
599 ########################
600 Upgrading from Samba 2.2
601 ########################
603 This section is provided to help administrators understand the details
604 involved with upgrading a Samba 2.2 server to Samba 3.0.
610 Many of the options to the GNU autoconf script have been modified
611 in the 3.0 release. The most noticeable are:
613 * removal of --with-tdbsam (is now included by default; see section
614 on passdb backends and authentication for more details)
616 * --with-ldapsam is now on used to provided backward compatible
617 parameters for LDAP enabled Samba 2.2 servers. Refer to the passdb
618 backend and authentication section for more details
620 * inclusion of non-standard passdb modules may be enabled using
621 --with-expsam. This includes an XML backend and a mysql backend.
623 * removal of --with-msdfs (is now enabled by default)
625 * removal of --with-ssl (no longer supported)
627 * --with-utmp now defaults to 'yes' on supported systems
629 * --with-sendfile-support is now enabled by default on supported
636 This section contains a brief listing of changes to smb.conf options
637 in the 3.0.0 release. Please refer to the smb.conf(5) man page for
638 complete descriptions of new or modified parameters.
640 Removed Parameters (order alphabetically):
643 * alternate permissions
646 * code page directory
650 * force unknown acl user
654 * printer driver file
655 * printer driver location
663 New Parameters (new parameters have been grouped by function):
667 * abort shutdown script
670 User and Group Account Management
671 ---------------------------------
674 * add user to group script
675 * algorithmic rid base
676 * delete group script
677 * delete user from group script
679 * set primary group script
695 * paranoid server security
705 * hide unwriteable files
707 * kernel change notify
717 * max reported print jobs
719 UNICODE and Character Sets
720 --------------------------
726 SID to uid/gid Mappings
727 -----------------------
731 * winbind enable local accounts
732 * winbind trusted domains only
733 * template primary group
734 * enable rid algorithm
741 * ldap machine suffix
745 General Configuration
746 ---------------------
750 Modified Parameters (changes in behavior):
752 * encrypt passwords (enabled by default)
753 * mangling method (set to 'hash2' by default)
756 * restrict anonymous (integer value)
757 * security (new 'ads' value)
758 * strict locking (enabled by default)
759 * unix extensions (enabled by default)
760 * winbind cache time (increased to 5 minutes)
761 * winbind uid (deprecated in favor of 'idmap uid')
762 * winbind gid (deprecated in favor of 'idmap gid')
768 This section contains brief descriptions of any new databases
769 introduced in Samba 3.0. Please remember to backup your existing
770 ${lock directory}/*tdb before upgrading to Samba 3.0. Samba will
771 upgrade databases as they are opened (if necessary), but downgrading
772 from 3.0 to 2.2 is an unsupported path.
774 Name Description Backup?
775 ---- ----------- -------
776 account_policy User policy settings yes
777 gencache Generic caching db no
778 group_mapping Mapping table from Windows yes
779 groups/SID to unix groups
780 winbindd_idmap ID map table from SIDS to UNIX yes
782 namecache Name resolution cache entries no
783 netsamlogon_cache Cache of NET_USER_INFO_3 structure no
784 returned as part of a successful
785 net_sam_logon request
786 printing/*.tdb Cached output from 'lpq no
787 command' created on a per print
789 registry Read-only samba registry skeleton no
790 that provides support for exporting
791 various db tables via the winreg RPCs
797 The following issues are known changes in behavior between Samba 2.2 and
798 Samba 3.0 that may affect certain installations of Samba.
800 1) When operating as a member of a Windows domain, Samba 2.2 would
801 map any users authenticated by the remote DC to the 'guest account'
802 if a uid could not be obtained via the getpwnam() call. Samba 3.0
803 rejects the connection as NT_STATUS_LOGON_FAILURE. There is no
804 current work around to re-establish the 2.2 behavior.
806 2) When adding machines to a Samba 2.2 controlled domain, the
807 'add user script' was used to create the UNIX identity of the
808 machine trust account. Samba 3.0 introduces a new 'add machine
809 script' that must be specified for this purpose. Samba 3.0 will
810 not fall back to using the 'add user script' in the absence of
811 an 'add machine script'
814 ######################################################################
815 Passdb Backends and Authentication
816 ##################################
818 There have been a few new changes that Samba administrators should be
819 aware of when moving to Samba 3.0.
821 1) encrypted passwords have been enabled by default in order to
822 inter-operate better with out-of-the-box Windows client
823 installations. This does mean that either (a) a samba account
824 must be created for each user, or (b) 'encrypt passwords = no'
825 must be explicitly defined in smb.conf.
827 2) Inclusion of new 'security = ads' option for integration
828 with an Active Directory domain using the native Windows
829 Kerberos 5 and LDAP protocols.
831 MIT kerberos 1.3.1 supports the ARCFOUR-HMAC-MD5 encryption
832 type which is neccessary for servers on which the
833 administrator password has not been changed, or kerberos-enabled
834 SMB connections to servers that require Kerberos SMB signing.
835 Besides this one difference, either MIT or Heimdal Kerberos
836 distributions are usable by Samba 3.0.
839 Samba 3.0 also includes the possibility of setting up chains
840 of authentication methods (auth methods) and account storage
841 backends (passdb backend). Please refer to the smb.conf(5)
842 man page for details. While both parameters assume sane default
843 values, it is likely that you will need to understand what the
844 values actually mean in order to ensure Samba operates correctly.
846 The recommended passdb backends at this time are
848 * smbpasswd - 2.2 compatible flat file format
849 * tdbsam - attribute rich database intended as an smbpasswd
850 replacement for stand alone servers
851 * ldapsam - attribute rich account storage and retrieval
852 backend utilizing an LDAP directory.
853 * ldapsam_compat - a 2.2 backward compatible LDAP account
856 Certain functions of the smbpasswd(8) tool have been split between the
857 new smbpasswd(8) utility, the net(8) tool, and the new pdbedit(8)
858 utility. See the respective man pages for details.
861 ######################################################################
865 This section outlines the new features affecting Samba / LDAP
871 A new object class (sambaSamAccount) has been introduced to replace
872 the old sambaAccount. This change aids us in the renaming of attributes
873 to prevent clashes with attributes from other vendors. There is a
874 conversion script (examples/LDAP/convertSambaAccount) to modify and LDIF
875 file to the new schema.
879 $ ldapsearch .... -b "ou=people,dc=..." > old.ldif
880 $ convertSambaAccount <DOM SID> old.ldif new.ldif
882 The <DOM SID> can be obtained by running 'net getlocalsid <DOMAINNAME>'
883 on the Samba PDC as root.
885 The old sambaAccount schema may still be used by specifying the
886 "ldapsam_compat" passdb backend. However, the sambaAccount and
887 associated attributes have been moved to the historical section of
888 the schema file and must be uncommented before use if needed.
889 The 2.2 object class declaration for a sambaAccount has not changed
890 in the 3.0 samba.schema file.
892 Other new object classes and their uses include:
894 * sambaDomain - domain information used to allocate rids
895 for users and groups as necessary. The attributes are added
896 in 'ldap suffix' directory entry automatically if
897 an idmap uid/gid range has been set and the 'ldapsam'
898 passdb backend has been selected.
900 * sambaGroupMapping - an object representing the
901 relationship between a posixGroup and a Windows
902 group/SID. These entries are stored in the 'ldap
903 group suffix' and managed by the 'net groupmap' command.
905 * sambaUnixIdPool - created in the 'ldap idmap suffix' entry
906 automatically and contains the next available 'idmap uid' and
909 * sambaIdmapEntry - object storing a mapping between a
910 SID and a UNIX uid/gid. These objects are created by the
911 idmap_ldap module as needed.
913 * sambaSidEntry - object representing a SID alone, as a Structural
914 class on which to build the sambaIdmapEntry.
917 New Suffix for Searching
918 ------------------------
920 The following new smb.conf parameters have been added to aid in directing
921 certain LDAP queries when 'passdb backend = ldapsam://...' has been
924 * ldap suffix - used to search for user and computer accounts
925 * ldap user suffix - used to store user accounts
926 * ldap machine suffix - used to store machine trust accounts
927 * ldap group suffix - location of posixGroup/sambaGroupMapping entries
928 * ldap idmap suffix - location of sambaIdmapEntry objects
930 If an 'ldap suffix' is defined, it will be appended to all of the
931 remaining sub-suffix parameters. In this case, the order of the suffix
932 listings in smb.conf is important. Always place the 'ldap suffix' first
935 Due to a limitation in Samba's smb.conf parsing, you should not surround
936 the DN's with quotation marks.
942 Samba 3.0 supports an ldap backend for the idmap subsystem. The
943 following options would inform Samba that the idmap table should be
944 stored on the directory server onterose in the "ou=idmap,dc=plainjoe,
949 idmap backend = ldap:ldap://onterose/
950 ldap idmap suffix = ou=idmap,dc=plainjoe,dc=org
951 idmap uid = 40000-50000
952 idmap gid = 40000-50000
954 This configuration allows winbind installations on multiple servers to
955 share a uid/gid number space, thus avoiding the interoperability problems
956 with NFS that were present in Samba 2.2.
960 ######################################################################
961 Trust Relationships and a Samba Domain
962 ######################################
964 Samba 3.0.0beta2 is able to utilize winbindd as the means of
965 allocating uids and gids to trusted users and groups. More
966 information regarding Samba's support for establishing trust
967 relationships can be found in the Samba-HOWTO-Collection included
968 in the docs/ directory of this release.
970 First create your Samba PDC and ensure that everything is
971 working correctly before moving on the trusts.
973 To establish Samba as the trusting domain (named SAMBA) from a Windows NT
974 4.0 domain named WINDOWS:
976 1) create the trust account for SAMBA in "User Manager for Domains"
977 2) connect the trust from the Samba domain using
978 'net rpc trustdom establish GLASS'
980 To create a trustlationship with SAMBA as the trusted domain:
982 1) create the initial trust account for GLASS using
983 'smbpasswd -a -i GLASS'. You may need to create a UNIX
984 account for GLASS$ prior to this step (depending on your
985 local configuration).
986 2) connect the trust from a WINDOWS DC using "User Manager
989 Now join winbindd on the Samba PDC to the SAMBA domain using
990 the normal steps for adding a Samba server to an NT4 domain:
991 (note that smbd & nmbd must be running at this point)
993 root# net rpc join -U root
994 Password: <enter root password from smbpasswd file here>
996 Start winbindd and test the join with 'wbinfo -t'.
998 Now test the trust relationship by connecting to the SAMBA DC
999 (e.g. POGO) as a user from the WINDOWS domain:
1001 $ smbclient //pogo/netlogon -U Administrator -W WINDOWS
1004 Now connect to the WINDOWS DC (e.g. CRYSTAL) as a Samba user:
1006 $ smbclient //crystal/netlogon -U root -W WINDOWS
1009 ######################################################################
1013 Beginning with Samba3.0.0beta3, winbindd has been given new account
1014 manage functionality equivalent to the 'add user script' family of
1015 smb.conf parameters. The idmap design has also been changed to
1016 centralize control of foreign SID lookups and matching to UNIX
1020 Brief Description of Changes
1021 ----------------------------
1023 1) The sid_to_uid() family of functions (smbd/uid.c) have been
1024 reverted to the 2.2.x design. This means that when resolving a
1025 SID to a UID or similar mapping:
1027 a) First consult winbindd
1028 b) perform a local lookup only if winbindd fails to
1029 return a successful answer
1031 There are some variations to this, but these two rules generally
1034 2) All idmap lookups have been moved into winbindd. This means that
1035 a server must run winbindd (and support NSS) in order to achieve
1036 any mappings of SID to dynamically allocated UNIX ids. This was
1037 a conscious design choice.
1039 3) New functions have been added to winbindd to emulate the 'add user
1040 script' family of smbd functions without requiring that external
1041 scripts be defined. This functionality is controlled by the 'winbind
1042 enable local accounts' smb.conf parameter (enabled by default).
1044 However, this account management functionality is only supported
1045 in a local tdb (winbindd_idmap.tdb). If these new UNIX accounts
1046 must be shared among multiple Samba servers (such as a PDC and BDCs),
1047 it will be necessary to define your own 'add user script', et. al.
1048 programs that place the accounts/groups in some form of directory
1049 such as NIS or LDAP. This requirement was deemed beyond the scope
1050 of winbind's account management functions. Solutions for
1051 distributing UNIX system information have been deployed and tested
1052 for many years. We saw no need to reinvent the wheel.
1054 4) A member of a Samba controlled domain running winbindd is now able
1055 to map domain users directly onto existing UNIX accounts while still
1056 automatically creating accounts for trusted users and groups. This
1057 behavior is controlled by the 'winbind trusted domains only' smb.conf
1058 parameter (disabled by default to provide 2.2.x winbind behavior).
1060 5) Group mapping support is wrapped in the local_XX_to_XX() functions
1061 in smbd/uid.c. The reason that group mappings are not included
1062 in winbindd is because the purpose of Samba's group map is to
1063 match any Windows SID with an existing UNIX group. These UNIX
1064 groups can be created by winbindd (see next section), but the
1065 SID<->gid mapping is retreived by smbd, not winbindd.
1071 * security = server running winbindd to allocate accounts on demand
1073 * Samba PDC running winbindd to handle the automatic creation of UNIX
1074 identities for machine trust accounts
1076 * Automtically creating UNIX user and groups when migrating a Windows NT
1077 4.0 PDC to a Samba PDC. Winbindd must be running when executing
1078 'net rpc vampire' for this to work.
1081 ######################################################################
1085 * There are several bugs currently logged against the 3.0 codebase
1086 that affect the use of NT 4.0 GUI domain management tools when run
1087 against a Samba 3.0 PDC. This bugs should be released in an early
1090 Please refer to https://bugzilla.samba.org/ for a current list of bugs
1091 filed against the Samba 3.0 codebase.
1094 ######################################################################
1095 Reporting bugs & Development Discussion
1096 #######################################
1098 Please discuss this release on the samba-technical mailing list or by
1099 joining the #samba-technical IRC channel on irc.freenode.net.
1101 If you do report problems then please try to send high quality
1102 feedback. If you don't provide vital information to help us track down
1103 the problem then you will probably be ignored.
1105 A new bugzilla installation has been established to help support the
1106 Samba 3.0 community of users. This server, located at
1107 https://bugzilla.samba.org/, has replaced the older jitterbug server
1108 previously located at http://bugs.samba.org/.
1110 <!--#include virtual="/samba/footer.html" -->