-This file contains a history of changes since the first Samba 4 Technology
-Preview. For a general introduction to Samba 4, see the README file in this
-directory. The NEWS file contains a list of differences between
-Samba 3 and Samba 4.
+Release Announcements
+=====================
+
+This is the second release candidate of Samba 4.0. This is *not*
+intended for production environments and is designed for testing
+purposes only. Please report any defects via the Samba bug reporting
+system at https://bugzilla.samba.org/.
+
+Samba 4.0 will be the next version of the Samba suite and incorporates
+all the technology found in both the Samba4 series and the
+stable 3.x series. The primary additional features over Samba 3.6 are
+support for the Active Directory logon protocols used by Windows 2000
+and above.
+
+This release contains the best of all of Samba's
+technology parts, both a file server (that you can reasonably expect
+to upgrade existing Samba 3.x releases to) and the AD domain
+controller work previously known as 'samba4'.
+
+If you are upgrading, or looking to develop, test or deploy Samba 4.0
+releases candidates, you should backup all configuration and data.
+
+
+UPGRADING
+=========
+
+Users upgrading from Samba 3.x domain controllers and wanting to use
+Samba 4.0 as an AD DC should use the 'samba-tool domain
+classicupgrade' command. See the wiki for more details:
+https://wiki.samba.org/index.php/Samba4/samba3upgrade/HOWTO.
+
+Users upgrading from Samba 4.0 alpha and beta releases since alpha15
+should run 'samba-tool dbcheck --cross-ncs --fix' before re-starting
+Samba. Users upgrading from earlier alpha releases should contact the
+team for advice.
+
+Users upgrading an AD DC from any previous release should run
+'samba-tool ntacl sysvolreset' to re-sync ACLs on the sysvol share
+with those matching the GPOs in LDAP and the defaults from an initial
+provision. This will set an underlying POSIX ACL if required (eg not
+using the NTVFS file server).
+
+If you used the BIND9_FLATFILE or BIND9_DLZ features,
+you'll have to add '-dns' to the 'server services' option,
+as the internal dns server (SAMBA_INTERNAL) is the default now.
+
+
+NEW FEATURES
+============
+
+Samba 4.0 supports the server-side of the Active Directory logon
+environment used by Windows 2000 and later, so we can do full domain
+join and domain logon operations with these clients.
+
+Our Domain Controller (DC) implementation includes our own built-in
+LDAP server and Kerberos Key Distribution Center (KDC) as well as the
+Samba3-like logon services provided over CIFS. We correctly generate
+the infamous Kerberos PAC, and include it with the Kerberos tickets we
+issue.
+
+Samba 4.0.0rc2 ships with two distinct file servers. We now use the
+file server from the Samba 3.x series 'smbd' for all file serving by
+default.
+
+Samba 4.0 also ships with the 'NTVFS' file server. This file server
+is what was used in all previous releases of Samba 4.0, and is
+tuned to match the requirements of an AD domain controller. We
+continue to support this, not only to provide continuity to
+installations that have deployed it as part of an AD DC, but also as a
+running example of the NT-FSA architecture we expect to move smbd to in
+the longer term.
+
+For pure file server work, the binaries users would expect from that
+series (nmbd, winbindd, smbpasswd) continue to be available. When
+running an AD DC, you only need to run 'samba' (not
+nmbd/smbd/winbind), as the required services are co-coordinated by this
+master binary.
+
+As DNS is an integral part of Active Directory, we also provide two DNS
+solutions, a simple internal DNS server for 'out of the box' configurations
+and a more elaborate BIND plugin using the BIND DLZ mechanism in versions
+9.8 and 9.9. During the provision, you can select which backend to use.
+With the internal backend, your DNS server is good to go.
+If you chose the BIND_DLZ backend, a configuration file will be generated
+for bind to make it use this plugin, as well as a file explaining how to
+set up bind.
+
+To provide accurate timestamps to Windows clients, we integrate with
+the NTP project to provide secured NTP replies. To use you need to
+start ntpd and configure it with the 'restrict ... ms-sntp' and
+ntpsigndsocket options.
+
+Finally, a new scripting interface has been added to Samba 4, allowing
+Python programs to interface to Samba's internals, and many tools and
+internal workings of the DC code is now implemented in python.
+
+
+######################################################################
+Changes
+#######
+
+smb.conf changes
+----------------
+
+ Parameter Name Description Default
+ -------------- ----------- -------
+
+ allow dns updates New secure only
+ announce as Removed
+ announce version Removed
+ cldap port New 0
+ client max protocol New
+ client min protocol New
+ client signing Changed default default
+ dcerpc endpoint servers New
+ dgram port New 0
+ directory security mask Removed
+ display charset Removed
+ dns forwarder New
+ dns update command New
+ force security mode Removed
+ force directory security mode Removed
+ homedir map Changed default auto.home
+ kernel share modes New Yes
+ kpasswd port New 0
+ krb5 port New 0
+ max protocol Removed
+ min protocol Removed
+ nbt client socket address New 0.0.0.0
+ nbt port New 0
+ nsupdate command New
+ ntp signd socket directory New
+ ntvfs handler New
+ paranoid server security Removed
+ pid directory New
+ printer admin Removed
+ rndc command New
+ rpc big endian New No
+ samba kcc command New
+ security mask Removed
+ send spnego principal Removed
+ server max protocol New SMB3
+ server min protocol New LANMAN1
+ server role New auto
+ server services New
+ server signing Changed default default
+ share backend New
+ share modes Removed
+ smb2 max read Changed default 1048576
+ smb2 max write Changed default 1048576
+ smb2 max trans Changed default 1048576
+ socket address Removed
+ spn update command New
+ time offset Removed
+ tls cafile New
+ tls certfile New
+ tls crlfile New
+ tls dh params file New
+ tls enabled New No
+ tls keyfile New
+ unicode New Yes
+ web port New 0
+ winbindd privileged socket directory New
+ winbind sealed pipes New No
+ winbindd socket directory New
+
+
+CHANGES SINCE 4.0.0rc1
+======================
+
+o Michael Adam <obnox@samba.org>
+ * BUG 9173: Make the SMB2 compound request create/delete_on_close/
+ close work as Windows.
+
+
+o Jeremy Allison <jra@samba.org>
+ * BUG 9161: Re-add the vfs_Chdir() cache.
+ * BUG 9189: SMB2 Create doesn't return correct MAX ACCESS access mask in
+ blob.
+ * BUG 9213: Bad ASN.1 NegTokenInit packet can cause invalid free.
+
+
+o Christian Ambach <ambi@samba.org>
+ * BUG 9162: Fix the build of the GPFS VFS module.
+ * BUG 9197: Only do 'printing_subsystem_update' when printing is enabled.
+
+
+o Alexander Bokovoy <ab@samba.org>
+ * BUG 9157: Cleanup idmap_ldap build dependencies.
+
+
+o Ira Cooper <ira@samba.org>
+ * BUG 9162: Fix build on Illumos/Solaris using '--with-acl'.
+ * BUG 9173: Compound requests should continue processing.
+
+
+o Björn Jacke <bj@sernet.de>
+ * BUG 9162: Fix the build of the ACL VFS modules.
+ * BUG 9172: Fix reporting of gfs2 quotas.
+
+
+o Volker Lendecke <vl@samba.org>
+ * BUG 9217: CreateFile with FILE_DIRECTORY_FILE can create directories
+ on read-only shares.
+
+
+o Stefan Metzmacher <metze@samba.org>
+ * BUG 9173: Make the SMB2 compound request create/delete_on_close/
+ close work as Windows.
+ * BUG 9184: Fix receiving of UDP packets from 0 bytes.
+ * BUG 9191: Release the share mode lock before calling exit_server().
+ * BUG 9193: Fix usage of invalid memory in smb2_signing_check_pdu().
+ * BUG 9194: Disallow '--prefix=/usr' and '--prefix=/usr/local' without
+ '--enable-fhs'.
+ * BUG 9198: Fix RHEL-CTDB packaging.
+
+
+o Matthieu Patou <mat@matws.net>
+ * BUG 9199: Fix usage of "panic action".
+
+
+o Andreas Schneider <asn@samba.org>
+ * BUG 8632: Fix builtin forms order to match Windows again.
+ * BUG 9159: Fix generating idmap manpages.
+ * BUG 9218: Don't segfault if user specified ports out for range.
+
+
+KNOWN ISSUES
+============
-========================================
-Changes in Samba4-TP2
-Release date: UNRELEASED
-========================================
+- 'samba-tool domain classicupgrade' will fail when setting ACLs on
+ the GPO folders with NT_STATUS_INVALID_ONWER in the default
+ configuration. This happens if, as is typical a 'domain admins'
+ group (-512) is mapped in the passdb backend being upgraded. This
+ is because the group mapping to a GID only prevents Samba from
+ allocating a uid for that group. The uid is needed so the 'domain
+ admins' group can own the GPO file objects.
- * Make ldb async internally (idra)
+ To work around this issue, remove the 'domain admins' group before
+ upgrade, as it will be re-created automatically. You will
+ of course need to fill in the group membership again. A future release
+ will make this automatic, or find some other workaround.
- * Use HDB-LDB as the keytab (abartlet)
+- This release makes the s3fs file server the default, as this is the
+ file server combination we will use for the Samba 4.0 release.
- * Call the wins hook script again (metze)
+- For similar reasons, sites with ACLs stored by the ntvfs file server
+ may wish to continue to use that file server implementation, as a
+ posix ACL will similarly not be set in this case.
- * Make sure no more then 25 records are added in the WINS database (metze)
-
- * Documentation updates (jelmer)
+- Replication of DNS data from one AD server to another may not work.
+ The DNS data used by the internal DNS server and bind9_dlz is stored
+ in an application partition in our directory. The replication of
+ this partition is not yet reliable.
- * Fix termination issue in winreg server (metze)
+- Replication may fail on FreeBSD due to getaddrinfo() rejecting names
+ containing _. A workaround will be in a future release.
- * AES fix for Samba 4 <-> Samba4 (abartlet)
+- samba_upgradeprovision should not be run when upgrading to this release
+ from a recent release. No important database format changes have
+ been made since alpha16.
- * Better conformance to FHS (abartlet, jelmer)
+- Installation on systems without a system iconv (and developer
+ headers at compile time) is known to cause errors when dealing with
+ non-ASCII characters.
- * Improve internal API and code quality in smbclient (jelmer)
+- Domain member support in the 'samba' binary is in its infancy, and
+ is not comparable to the support found in winbindd. As such, do not
+ use the 'samba' binary (provided for the AD server) on a member
+ server.
- * Add testsuite for smbclient (jelmer)
+- There is no NetBIOS browsing support (network neighbourhood)
+ available for the AD domain controller. (Support in nmbd and smbd
+ for classic domains and member/standalone servers is unchanged).
- * Remove support for password as an optional second parameter in
- smbclient (jelmer)
+- Clock Synchronisation is critical. Many 'wrong password' errors are
+ actually due to Kerberos objecting to a clock skew between client
+ and server. (The NTP work in the previous alphas are partly to assist
+ with this problem).
- * Various warning fixes (metze)
+- The DRS replication code may fail. Please contact the team if you
+ experience issues with DRS replication, as we have fixed many issues
+ here in response to feedback from our production users.
- * Several clarifications of comments (abartlet)
- * Remove use of pstring in some places (jelmer)
+RUNNING Samba 4.0 as an AD DC
+=============================
- * Re-add the global -k option to enable kerberos (abartlet)
+A short guide to setting up Samba 4 as an AD DC can be found on the wiki:
- * Various memory allocation fixes (abartlet)
+ http://wiki.samba.org/index.php/Samba4/HOWTO
- * Add new cifsdd client (jpeach)
+#######################################
+Reporting bugs & Development Discussion
+#######################################
- * Add tests for even more insane delete-on-close semantics (jra, tridge)
-
- * Initial work on BASE-DELETE test passing (tridge)
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
- * Optimizations in tdb (tridge)
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored. All bug reports should
+be filed under the Samba 4.0 product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
- * Improvements to ldb documentation (idra, Brad Hards)
- * Check attribute names to obey rfc2251 (idra)
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
- * Allow WINS replication with NT4SP6A (metze)
-
- * Add ManageDSAIT control (Pete Rowley, idra)
-
- * Add tests for LDB controls (idra)
-
- * Various LDB crash fixes (idra)
-
- * Initial work on vlv LDB control (idra)
-
- * Add -p option to smbtorture (jpeach)
-
- * Several improvements to the SMB URL and UNC parsing (jpeach)
-
- * Make DCE/RPC connect functions work async (rafal)
-
- * Fix invalid steal on supportedControls (closes: #3525) (abartlet)
-
- * Start parsing saslauthd requests (metze)
-
- * Split the NBT-WINSREPLICATION test into multiple tests (metze)
-
- * Add new ACB-bits as seen in acct_flags in the PAC info3 (gd)
-
- * Move header files out of include/ (jelmer)
-
- * Create separate library for generic utility functions (jelmer)
-
- * Add highestCommittedUSN, uSNChanged and uSNCreated support to LDB (tridge)
-
- * Allow more control over the the winbindd socket location (abartlet)
-
- * Allow messaging without a server messaging context (abartlet)
-
- * Make GSSAPI SASL mech work (abartlet)
-
- * Write out Samba4 version when provisioning (idra)
-
- * Allow servers to bind to non-broadcast interfaces (tridge, abartlet)
-
- * Initialize some ASN.1 elements that are optional (metze)
-
- * Various improvements to RPC-SCHANNEL (abartlet)
-
- * Make Samba4 pass some of the newer schannel tests (abartlet)
-
- * Better handling of connections without SPNEGO (abartlet)
-
- * Generate seperate headers for RPC client functions (jelmer)
-
- * Improve NTLMSSP tests (abartlet, vl)
-
- * Support any size pointers in pidl (tridge)
-
- * Large overhaul of the opendb code to pass BASE-DELETE (tridge)
-
- * Use doxygen for documenting lib/util and lib/registry (jelmer)
-
- * Add registration mechanism for modules and backends in ldb (idra, jelmer)
-
- * Support building shared libraries in the build system (metze, jelmer)
-
- * Install headers in a sane location (jelmer)
-
- * Fix BASE-NEGNOWAIT (tridge)
-
- * Add prefixes to most of the SMB-related functions (metze)
-
- * Get rid of proto.h (jelmer)
-
- * Reduce number of headers included in includes.h (jelmer)
-
- * Support header dependencies (jelmer)
-
- * Add RAW-NOTIFY (tridge, metze)
-
- * Fix 'your password has expired' on every login (abartlet)
-
- * Improvements to RPC-SAMSYNC (abartlet)
-
- * Work on supporting change notify (tridge, metze)
-
- * Reopen log files after SIGHUP (metze)
-
- * Add BUGS.txt (#3523) (jelmer)
-
- * Add summary to configure (#3442) (metze, jelmer)
-
- * Swig fixes (idra)
-
- * Improve NBT-WINSREPLICATION-OWNED test (metze)
-
- * Fix a lot of compiler warnings (metze)
-
- * Several code improvements found by static code checker (tridge, metze)
-
- * Force correct alignment when in ASCII mode (#2921) (tridge)
-
- * Fix coverity bug #127 (vl)
-
- * Add support for changing process titles (metze)
-
- * Support raw NTLMSSP (abartlet)
-
- * Fix debug levels in several places (abartlet)
-
- * Work to unify the ntvfs structures for smb and smb2 (metze, tridge)
-
- * A lot of small cleanups and typo fixes
- (metze, abartlet, idra, jpeach, tridge, jelmer)
-
-(up to date until revno 14554)
git.samba.org / mat / samba.git / blobdiff