X-Git-Url: http://git.samba.org/?a=blobdiff_plain;f=WHATSNEW.txt;h=574e9b27e68db850159d76736be04ac1ec4a63e2;hb=69505470a78a98ea6ebf8ea6592021c0ca74071c;hp=1a36e88cff454618e2568eee3aca16b38778ea1e;hpb=aa74d6edf597c92112553b74d9e3675dfa30ca48;p=metze%2Fsamba%2Fwip.git diff --git a/WHATSNEW.txt b/WHATSNEW.txt index 1a36e88cff45..574e9b27e68d 100644 --- a/WHATSNEW.txt +++ b/WHATSNEW.txt @@ -1,12 +1,12 @@ Release Announcements ===================== -This is the first preview release of Samba 4.7. This is *not* +This is the first preview release of Samba 4.9. This is *not* intended for production environments and is designed for testing purposes only. Please report any defects via the Samba bug reporting system at https://bugzilla.samba.org/. -Samba 4.7 will be the next version of the Samba suite. +Samba 4.9 will be the next version of the Samba suite. UPGRADING @@ -16,129 +16,66 @@ UPGRADING NEW FEATURES/CHANGES ==================== -Samba AD with MIT Kerberos --------------------------- -After four years of development, Samba finally supports compiling and -running Samba AD with MIT Kerberos. You can enable it with: +net ads setspn +--------------- - ./configure --with-system-mitkrb5 +There is a new 'net ads setspn' sub command for managing Windows SPN(s) +on the AD. This command aims to give the basic functionaility that is +provided on windows by 'setspn.exe' e.g. ability to add, delete and list +Windows SPN(s) stored in a Windows AD Computer object. -Samba requires version 1.15.1 of MIT Kerberos to build with AD DC support. -The krb5-devel and krb5-server packages are required. -The feature set is not on par with with the Heimdal build but the most important -things, like forest and external trusts, are working. Samba uses the KDC binary -provided by MIT Kerberos. +The format of the command is: -Missing features, compared to Heimdal, are: - * PKINIT support - * S4U2SELF/S4U2PROXY support - * RODC support (not fully working with Heimdal either) +net ads setspn list [machine] +net ads setspn [add | delete ] SPN [machine] -The Samba AD process will take care of starting the MIT KDC and it will load a -KDB (Kerberos Database) driver to access the Samba AD database. When -provisioning an AD DC using 'samba-tool' it will take care of creating a correct -kdc.conf file for the MIT KDC. Note that 'samba-tool' will overwrite the system -kdc.conf by default. It is possible to use a different location during -provision. You should consult the 'samba-tool' help and smb.conf manpage for -details. +'machine' is the name of the computer account on the AD that is to be managed. +If 'machine' is not specified the name of the 'client' running the command +is used instead. -Dynamic RPC port range ----------------------- - -The dynamic port range for RPC services has been changed from the old default -value 1024-1300 to 49152-65535. This port range is not only used by a -Samba AD DC but also applies to all other server roles including NT4-style -domain controllers. The new value has been defined by Microsoft in Windows -Server 2008 and newer versions. To make it easier for Administrators to control -those port ranges we use the same default and make it configureable with the -option: 'rpc server dynamic port range'. - -The 'rpc server port' option sets the first available port from the new -'rpc server dynamic port range' option. The option 'rpc server port' only -applies to Samba provisioned as an AD DC. - -Authentication and Authorization audit support ----------------------------------------------- +The format of a Windows SPN is + 'serviceclass/host:port/servicename' (servicename and port are optional) -Detailed authentication and authorization audit information is now -logged to Samba's debug logs under the "auth_audit" debug class, -including in particular the client IP address triggering the audit -line. Additionally, if Samba is compiled against the jansson JSON -library, a JSON representation is logged under the "auth_json_audit" -debug class. - -Audit support is comprehensive for all authentication and -authorisation of user accounts in the Samba Active Directory Domain -Controller, as well as the implicit authentication in password -changes. In the file server and classic/NT4 domain controller, NTLM -authentication, SMB and RPC authorization is covered, however password -changes are not at this stage, and this support is not currently -backed by a testsuite. +serviceclass/host is generally sufficient to specify a host based service. +net ads keytab changes +---------------------- +net ads keytab add no longer attempts to convert the passed serviceclass +(e.g. nfs, html etc.) into a Windows SPN which is added to the Windows AD +computer object. By default just the keytab file is modified. -Query record for open file or directory ---------------------------------------- +A new keytab subcommand 'add_update_ads' has been added to preserve the +legacy behaviour. However the new 'net ads setspn add' subcommand should +really be used instead. -The record attached to an open file or directory in Samba can be -queried through the 'net tdb locking' command. In clustered Samba this -can be useful to determine the file or directory triggering -corresponding "hot" record warnings in ctdb. +net ads keytab create no longer tries to generate SPN(s) from existing +entries in a keytab file. If it is required to add Windows SPN(s) then +'net ads setspn add' should be used instead. +REMOVED FEATURES +================ -Parameter changes ------------------ -The "strict sync" global parameter has been changed from -a default of "no" to "yes". This means smbd will by default -obey client requests to synchronize unwritten data in operating -system buffers safely onto disk. This is a safer default setting -for modern SMB1/2/3 clients. smb.conf changes ================ - Parameter Name Description Default - -------------- ----------- ------- - auth event notification New parameter no - auth methods Deprecated - map untrusted to domain Deprecated - profile acls Deprecated - strict sync Default changed yes - -Removal of lpcfg_register_defaults_hook() ------------------------------------------ - -The undocumented and unsupported function lpcfg_register_defaults_hook() -that was used by external projects to call into Samba and modify -smb.conf default parameter settings has been removed. If your project -was using this call please raise the issue on -samba-technical@lists.samba.org in order to design a supported -way of obtaining the same functionality. - -Change of loadable module interface ------------------------------------ - -The _init function of all loadable modules in Samba has changed -from: - -NTSTATUS _init(void); - -to: - -NTSTATUS _init(TALLOC_CTX *); +As the most popular Samba install platforms (Linux and FreeBSD) both +support extended attributes by default, the parameters "map readonly", +"store dos attributes" and "ea support" have had their defaults changed +to allow better Windows fileserver compatibility in a default install. -This allows a program loading a module to pass in a long-lived -talloc context (which must be guaranteed to be alive for the -lifetime of the module). This allows modules to avoid use of -the talloc_autofree_context() (which is inherently thread-unsafe) -and still be valgrind-clean on exit. Modules that don't need to -free long-lived data on exist should use the NULL talloc context. + Parameter Name Description Default + -------------- ----------- ------- + map readonly Default changed no + store dos attributes Default changed yes + ea support Default changed yes KNOWN ISSUES ============ -https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.7#Release_blocking_bugs +https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.9#Release_blocking_bugs #######################################