=============================== Release Notes for Samba 4.11.12 August 25, 2020 =============================== This is the latest stable release of the Samba 4.11 release series. Changes since 4.11.11 --------------------- o Jeremy Allison * BUG 14403: s3: libsmb: Fix SMB2 client rename bug to a Windows server. o Andrew Bartlett * BUG 14424: dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work on RHEL7. * BUG 14450: dbcheck: Allow a dangling forward link outside our known NCs. o Ralph Boehme * BUG 14426: lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL. * BUG 14428: s3:smbd: PANIC: assert failed in get_lease_type(). o Günther Deschner * BUG 14370: lib/util: do not install "test_util_paths". o Amit Kumar * BUG 14345: lib:util: Fix smbclient -l basename dir. o Stefan Metzmacher * BUG 14428: s3:smbd: PANIC: assert failed in get_lease_type(). o Christof Schmitt * BUG 14166: util: Allow symlinks in directory_create_or_exist. o Andreas Schneider * BUG 14358: docs: Fix documentation for require_membership_of of pam_winbind. o Andrew * BUG 14425: s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal. ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net. If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the "Samba 4.1 and newer" product in the project's Bugzilla database (https://bugzilla.samba.org/). ====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ====================================================================== Release notes for older releases follow: ---------------------------------------- =============================== Release Notes for Samba 4.11.11 July 02, 2020 =============================== This is a security release in order to address the following defects: o CVE-2020-10730: NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results. o CVE-2020-10745: Parsing and packing of NBT and DNS packets can consume excessive CPU o CVE-2020-10760: LDAP Use-after-free in Samba AD DC Global Catalog with paged_results and VLV. o CVE-2020-14303: Empty UDP packet DoS in Samba AD DC nbtd. ======= Details ======= o CVE-2020-10730: A client combining the 'ASQ' and 'VLV' LDAP controls can cause a NULL pointer de-reference and further combinations with the LDAP paged_results feature can give a use-after-free in Samba's AD DC LDAP server. o CVE-2020-10745: Parsing and packing of NBT and DNS packets can consume excessive CPU. o CVE-2020-10760: The use of the paged_results or VLV controls against the Global Catalog LDAP server on the AD DC will cause a use-after-free. o CVE-2020-14303: The AD DC NBT server in Samba 4.0 will enter a CPU spin and not process further requests once it receives an empty (zero-length) UDP packet to port 137. For more details, please refer to the security advisories. Changes since 4.11.10 --------------------- o Douglas Bagnall * BUG 14378: CVE-2020-10745: Invalid DNS or NBT queries containing dots use several seconds of CPU each. o Andrew Bartlett * BUG 14364: CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined. * BUG 14402: CVE-2020-10760: Fix use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV. * BUG 14417: CVE-2020-14303: Fix endless loop from empty UDP packet sent to AD DC nbt_server. o Gary Lockyer * BUG 14364: CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined, ldb: Bump version to 2.1.4. ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net. If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the "Samba 4.1 and newer" product in the project's Bugzilla database (https://bugzilla.samba.org/). ====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ====================================================================== ---------------------------------------------------------------------- =============================== Release Notes for Samba 4.11.10 June 30, 2020 =============================== This is the latest stable release of the Samba 4.11 release series. Changes since 4.11.9 -------------------- o Jeremy Allison * BUG 14374: Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name. o Ralph Boehme * BUG 14350: vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode. o Alexander Bokovoy * BUG 14413: ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr. o Volker Lendecke * BUG 14366: Malicous SMB1 server can crash libsmbclient. * BUG 14382: winbindd: Fix a use-after-free when winbind clients exit. o Gary Lockyer * BUG 14330: ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. o Andreas Schneider * BUG 14358: docs-xml: Fix usernames in pam_winbind manpages. * BUG 14370: Client tools are not able to read gencache anymore. ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net. If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the "Samba 4.1 and newer" product in the project's Bugzilla database (https://bugzilla.samba.org/). ====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ====================================================================== ---------------------------------------------------------------------- ============================== Release Notes for Samba 4.11.9 May 05, 2020 ============================== This is the latest stable release of the Samba 4.11 release series. Changes since 4.11.8 -------------------- o Douglas Bagnall * BUG 14242: nmblib: Avoid undefined behaviour in handle_name_ptrs(). o Björn Baumbach * BUG 14296: 'samba-tool group' commands do not handle group names with special chars correctly. o Ralph Boehme * BUG 14237: smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid. * BUG 14293: Missing check for DMAPI offline status in async DOS attributes. * BUG 14307: smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs. * BUG 14316: vfs_recycle: Prevent flooding the log if we're called on non-existant paths. * BUG 14320: smbd mistakenly updates a file's write-time on close. o Alexander Bokovoy * BUG 14359: RPC handles cannot be differentiated in source3 RPC server. o Günther Deschner * BUG 14313: librpc: Fix IDL for svcctl_ChangeServiceConfigW. * BUG 14327: nsswitch: Fix use-after-free causing segfault in _pam_delete_cred. o Art M. Gallagher * BUG 13622: Fix fruit:time machine max size on arm. o Amitay Isaacs * BUG 14294: CTDB recovery corner cases can cause record resurrection and node banning. o Volker Lendecke * BUG 14348: ctdb: Fix a memleak. * libsmb: Don't try to find posix stat info in SMBC_getatr(). o Noel Power * BUG 14295: ctdb-tcp: Move free of inbound queue to TCP restart. * BUG 14344: s3/librpc/crypto: Fix double free with unresolved credential cache. o Andreas Schneider * BUG 14336: s3:libads: Fix ads_get_upn(). o Martin Schwenke * BUG 14294: CTDB recovery corner cases can cause record resurrection and node banning. * BUG 14295: Starting ctdb node that was powered off hard before results in recovery loop. * BUG 14324: ctdb-recoverd: Avoid dereferencing NULL rec->nodemap. ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net. If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the "Samba 4.1 and newer" product in the project's Bugzilla database (https://bugzilla.samba.org/). ====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ====================================================================== ---------------------------------------------------------------------- ============================== Release Notes for Samba 4.11.8 April 28, 2020 ============================== This is a security release in order to address the following defects: o CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ o CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC ======= Details ======= o CVE-2020-10700: A client combining the 'ASQ' and 'Paged Results' LDAP controls can cause a use-after-free in Samba's AD DC LDAP server. o CVE-2020-10704: A deeply nested filter in an un-authenticated LDAP search can exhaust the LDAP server's stack memory causing a SIGSEGV. For more details, please refer to the security advisories. Changes since 4.11.7 -------------------- o Andrew Bartlett * BUG 14331: CVE-2020-10700: Fix use-after-free in AD DC LDAP server when ASQ and paged_results combined. o Gary Lockyer * BUG 20454: CVE-2020-10704: Fix LDAP Denial of Service (stack overflow) in Samba AD DC. ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net. If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the "Samba 4.1 and newer" product in the project's Bugzilla database (https://bugzilla.samba.org/). ====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ====================================================================== ---------------------------------------------------------------------- ============================== Release Notes for Samba 4.11.7 March 10, 2020 ============================== This is the latest stable release of the Samba 4.11 release series. Changes since 4.11.6: --------------------- o Jeremy Allison * BUG 14239: s3: lib: nmblib. Clean up and harden nmb packet processing. * BUG 14283: s3: VFS: full_audit. Use system session_info if called from a temporary share definition. o Andrew Bartlett * BUG 14258: dsdb: Correctly handle memory in objectclass_attrs. * BUG 14270: ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches. o Volker Lendecke * BUG 14247: auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences. * BUG 14285: smbd: Handle EINTR from open(2) properly. o Stefan Metzmacher * BUG 14247: winbind member (source3) fails local SAM auth with empty domain name. * BUG 14265: winbindd: Handling missing idmap in getgrgid(). o Andreas Schneider * BUG 14253: lib:util: Log mkdir error on correct debug levels. * BUG 14266: wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9. o Martin Schwenke * BUG 14274: ctdb-tcp: Make error handling for outbound connection consistent. ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net. If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the "Samba 4.1 and newer" product in the project's Bugzilla database (https://bugzilla.samba.org/). ====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ====================================================================== ---------------------------------------------------------------------- ============================== Release Notes for Samba 4.11.6 January 28, 2020 ============================== This is the latest stable release of the Samba 4.11 release series. Changes since 4.11.5: --------------------- o Douglas Bagnall * BUG 14209: pygpo: Use correct method flags. o David Disseldorp * BUG 14216: vfs_ceph_snapshots: Fix root relative path handling. o Torsten Fohrer * BUG 14209: Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero. o Fabrice Fontaine * BUG 14218: source4/utils/oLschema2ldif: Include stdint.h before cmocka.h. o Björn Jacke * BUG 14122: docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc. o Volker Lendecke * BUG 14251: smbd: Fix the build with clang. o Gary Lockyer * BUG 14199: upgradedns: Ensure lmdb lock files linked. o Anoop C S * BUG 14182: s3: VFS: glusterfs: Reset nlinks for symlink entries during readdir. o Andreas Schneider * BUG 14101: smbc_stat() doesn't return the correct st_mode and also the uid/gid is not filled (SMBv1) file. * BUG 14219: librpc: Fix string length checking in ndr_pull_charset_to_null(). o Martin Schwenke * BUG 14227: ctdb-scripts: Strip square brackets when gathering connection info. ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net. If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the "Samba 4.1 and newer" product in the project's Bugzilla database (https://bugzilla.samba.org/). ====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ====================================================================== ---------------------------------------------------------------------- ============================== Release Notes for Samba 4.11.5 January 21, 2020 ============================== This is a security release in order to address the following defects: o CVE-2019-14902: Replication of ACLs set to inherit down a subtree on AD Directory not automatic. o CVE-2019-14907: Crash after failed character conversion at log level 3 or above. o CVE-2019-19344: Use after free during DNS zone scavenging in Samba AD DC. ======= Details ======= o CVE-2019-14902: The implementation of ACL inheritance in the Samba AD DC was not complete, and so absent a 'full-sync' replication, ACLs could get out of sync between domain controllers. o CVE-2019-14907: When processing untrusted string input Samba can read past the end of the allocated buffer when printing a "Conversion error" message to the logs. o CVE-2019-19344: During DNS zone scavenging (of expired dynamic entries) there is a read of memory after it has been freed. For more details and workarounds, please refer to the security advisories. Changes since 4.11.4: --------------------- o Andrew Bartlett * BUG 12497: CVE-2019-14902: Replication of ACLs down subtree on AD Directory not automatic. * BUG 14208: CVE-2019-14907: lib/util: Do not print the failed to convert string into the logs. o Gary Lockyer * BUG 14050: CVE-2019-19344: kcc dns scavenging: Fix use after free in dns_tombstone_records_zone. ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net. If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the "Samba 4.1 and newer" product in the project's Bugzilla database (https://bugzilla.samba.org/). ====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ====================================================================== ---------------------------------------------------------------------- ============================== Release Notes for Samba 4.11.4 December 16, 2019 ============================== This is the latest stable release of the Samba 4.11 release series. Changes since 4.11.3: --------------------- o Jeremy Allison * BUG 14161: s3: libsmb: Ensure SMB1 cli_qpathinfo2() doesn't return an inode number. * BUG 14174: s3: utils: smbtree. Ensure we don't call cli_RNetShareEnum() on an SMB1 connection. * BUG 14176: NT_STATUS_ACCESS_DENIED becomes EINVAL when using SMB2 in SMBC_opendir_ctx. * BUG 14189: s3: smbd: SMB2 - Ensure we use the correct session_id if encrypting an interim response. * BUG 14205: Prevent smbd crash after invalid SMB1 negprot. o Ralph Boehme * BUG 13745: s3:printing: Fix %J substition. * BUG 13925: s3: Remove now unneeded call to cmdline_messaging_context(). * BUG 14069: Incomplete conversion of former parametric options. * BUG 14070: Fix sync dosmode fallback in async dosmode codepath. * BUG 14171: vfs_fruit returns capped resource fork length. o Isaac Boukris * BUG 14116: libnet_join: Add SPNs for additional-dns-hostnames entries. o Volker Lendecke * BUG 14211: smbd: Increase a debug level. o Stefan Metzmacher * BUG 14153: Prevent azure ad connect from reporting discovery errors: reference-value-not-ldap-conformant. o Christof Schmitt * BUG 14179: krb5_plugin: Fix developer build with newer heimdal system library. o Andreas Schneider * BUG 14168: replace: Only link libnsl and libsocket if requrired. o Martin Schwenke * BUG 14175: ctdb: Incoming queue can be orphaned causing communication breakdown. o Uri Simchoni * BUG 13846: ldb: Release ldb 2.0.8. Cross-compile will not take cross-answers or cross-execute. * BUG 13856: heimdal-build: Avoid hard-coded /usr/include/heimdal in asn1_compile-generated code. ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net. If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the "Samba 4.1 and newer" product in the project's Bugzilla database (https://bugzilla.samba.org/). ====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ====================================================================== ---------------------------------------------------------------------- ============================== Release Notes for Samba 4.11.3 December 10, 2019 ============================== This is a security release in order to address the following defects: o CVE-2019-14861: Samba AD DC zone-named record Denial of Service in DNS management server (dnsserver). o CVE-2019-14870: DelegationNotAllowed not being enforced in protocol transition on Samba AD DC. ======= Details ======= o CVE-2019-14861: An authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name. o CVE-2019-14870: The DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC. For more details and workarounds, please refer to the security advisories. Changes since 4.11.2: --------------------- o Andrew Bartlett * BUG 14138: CVE-2019-14861: Fix DNSServer RPC server crash. o Isaac Boukris * BUG 14187: CVE-2019-14870: DelegationNotAllowed not being enforced. ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net. If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the "Samba 4.1 and newer" product in the project's Bugzilla database (https://bugzilla.samba.org/). ====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ====================================================================== ---------------------------------------------------------------------- ============================== Release Notes for Samba 4.11.2 October 29, 2019 ============================== This is a security release in order to address the following defects: o CVE-2019-10218: Client code can return filenames containing path separators. o CVE-2019-14833: Samba AD DC check password script does not receive the full password. o CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync. ======= Details ======= o CVE-2019-10218: Malicious servers can cause Samba client code to return filenames containing path separators to calling code. o CVE-2019-14833: When the password contains multi-byte (non-ASCII) characters, the check password script does not receive the full password string. o CVE-2019-14847: Users with the "get changes" extended access right can crash the AD DC LDAP server by requesting an attribute using the range= syntax. For more details and workarounds, please refer to the security advisories. Changes since 4.11.1: --------------------- o Jeremy Allison * BUG 14071: CVE-2019-10218 - s3: libsmb: Protect SMB1 and SMB2 client code from evil server returned names. o Andrew Bartlett * BUG 12438: CVE-2019-14833: Use utf8 characters in the unacceptable password. * BUG 14040: CVE-2019-14847 dsdb: Correct behaviour of ranged_results when combined with dirsync. o Björn Baumbach * BUG 12438: CVE-2019-14833 dsdb: Send full password to check password script. ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net. If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the "Samba 4.1 and newer" product in the project's Bugzilla database (https://bugzilla.samba.org/). ====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ====================================================================== ---------------------------------------------------------------------- ============================== Release Notes for Samba 4.11.1 October 18, 2019 ============================== This is the latest stable release of the Samba 4.11 release series. Changes since 4.11.0: --------------------- o Michael Adam * BUG 14141: getpwnam and getpwuid need to return data for ID_TYPE_BOTH group. o Jeremy Allison * BUG 14094: smbc_readdirplus() is incompatible with smbc_telldir() and smbc_lseekdir(). * BUG 14152: s3: smbclient: Stop an SMB2-connection from blundering into SMB1-specific calls. o Ralph Boehme * BUG 14137: Fix stale file handle error when using mkstemp on a share. o Isaac Boukris * BUG 14106: Fix spnego fallback from kerberos to ntlmssp in smbd server. * BUG 14140: Overlinking libreplace against librt and pthread against every binary or library causes issues. o Günther Deschner * BUG 14130: s3-winbindd: Fix forest trusts with additional trust attributes. * BUG 14134: auth/gensec: Fix non-AES schannel seal. o Amitay Isaacs * BUG 14147: Deleted records can be resurrected during recovery. o Björn Jacke * BUG 14136: Fix uncaught exception in classicupgrade. * BUG 14139: fault.c: Improve fault_report message text pointing to our wiki. o Bryan Mason * BUG 14128: s3:client: Use DEVICE_URI, instead of argv[0], for Device URI. o Stefan Metzmacher * BUG 14124: pam_winbind with krb5_auth or wbinfo -K doesn't work for users of trusted domains/forests. o Mathieu Parent * BUG 14131: Remove 'pod2man' as it is no longer needed. o Andreas Schneider * BUG 13884: Joining Active Directory should not use SAMR to set the password. * BUG 14140: Overlinking libreplace against librt and pthread against every binary or library causes issues. * BUG 14155: 'kpasswd' fails when built with MIT Kerberos. o Martin Schwenke * BUG 14129: Exit code of ctdb nodestatus should not be influenced by deleted nodes. ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net. If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the "Samba 4.1 and newer" product in the project's Bugzilla database (https://bugzilla.samba.org/). ====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ====================================================================== ---------------------------------------------------------------------- ============================== Release Notes for Samba 4.11.0 September 17, 2019 ============================== This is the first stable release of the Samba 4.11 release series. Please read the release notes carefully before upgrading. UPGRADING ========= AD Database compatibility ------------------------- Samba 4.11 has changed how the AD database is stored on disk. AD users should not really be affected by this change when upgrading to 4.11. However, AD users should be extremely careful if they need to downgrade from Samba 4.11 to an older release. Samba 4.11 maintains database compatibility with older Samba releases. The database will automatically get rewritten in the new 4.11 format when you first start the upgraded samba executable. However, when downgrading from 4.11 you will need to manually downgrade the AD database yourself. Note that you will need to do this step before you install the downgraded Samba packages. For more details, see: https://wiki.samba.org/index.php/Downgrading_an_Active_Directory_DC When either upgrading or downgrading, users should also avoid making any database modifications between installing the new Samba packages and starting the samba executable. SMB1 is disabled by default --------------------------- The defaults of 'client min protocol' and 'server min protocol' have been changed to SMB2_02. This means clients without support for SMB2 or SMB3 are no longer able to connect to smbd (by default). It also means client tools like smbclient and other, as well as applications making use of libsmbclient are no longer able to connect to servers without SMB2 or SMB3 support (by default). It's still possible to allow SMB1 dialects, e.g. NT1, LANMAN2 and LANMAN1 for client and server, as well as CORE and COREPLUS on the client. Note that most commandline tools e.g. smbclient, smbcacls and others also support the '--option' argument to overwrite smb.conf options, e.g. --option='client min protocol=NT1' might be useful. As Microsoft no longer installs SMB1 support in recent releases or uninstalls it after 30 days without usage, the Samba Team tries to get remove the SMB1 usage as much as possible. SMB1 is officially deprecated and might be removed step by step in the following years. If you have a strong requirement for SMB1 (except for supporting old Linux Kernels), please file a bug at https://bugzilla.samba.org and let us know about the details. LanMan and plaintext authentication deprecated ---------------------------------------------- The "lanman auth" and "encrypt passwords" parameters are deprecated with this release as both are only applicable to SMB1 and are quite insecure. NTLM, NTLMv2 and Kerberos authentication are unaffected, as "encrypt passwords = yes" has been the default since Samba 3.0.0. If you have a strong requirement for these authentication protocols, please file a bug at https://bugzilla.samba.org and let us know about the details. BIND9_FLATFILE deprecated ------------------------- The BIND9_FLATFILE DNS backend is deprecated in this release and will be removed in the future. This was only practically useful on a single domain controller or under expert care and supervision. This release therefore deprecates the "rndc command" smb.conf parameter, which is used to support this configuration. After writing out a list of DCs permitted to make changes to the DNS Zone "rndc command" is called with reload to tell the 'named' server if a DC was added/removed to to the domain. NEW FEATURES/CHANGES ==================== Default samba process model --------------------------- The default for the '--model' argument passed to the samba executable has changed from 'standard' to 'prefork'. This means a difference in the number of samba child processes that are created to handle client connections. The previous default would create a separate process for every LDAP or NETLOGON client connection. For a network with a lot of persistent client connections, this could result in significant memory overhead. Now, with the new default of 'prefork', the LDAP, NETLOGON, and KDC services will create a fixed number of worker processes at startup and share the client connections amongst these workers. The number of worker processes can be configured by the 'prefork children' setting in the smb.conf (the default is 4). Authentication Logging ---------------------- Winbind now logs PAM_AUTH and NTLM_AUTH events, a new attribute "logonId" has been added to the Authentication JSON log messages. This contains a random logon id that is generated for each PAM_AUTH and NTLM_AUTH request and is passed to SamLogon, linking the windbind and SamLogon requests. The serviceDescription of the messages is set to "winbind", the authDescription is set to one of: "PASSDB, , " "PAM_AUTH, , " "NTLM_AUTH, , " where: is the name of the command makinmg the winbind request i.e. wbinfo is the process id of the requesting process. The version of the JSON Authentication messages has been changed from 1.1 to 1.2. LDAP referrals -------------- The scheme of returned LDAP referrals now reflects the scheme of the original request, i.e. referrals received via ldap are prefixed with "ldap://" and those over ldaps are prefixed with "ldaps://". Previously all referrals were prefixed with "ldap://". Bind9 logging ------------- It is now possible to log the duration of DNS operations performed by Bind9. This should aid future diagnosis of performance issues and could be used to monitor DNS performance. The logging is enabled by setting log level to "dns:10" in smb.conf. The logs are currently human readable text only, i.e. no JSON formatted output. Log lines are of the form: : DNS timing: result: [] duration: () zone: [] name: [] data: [] durations are in microseconds. Default schema updated to 2012_R2 --------------------------------- Default AD schema changed from 2008_R2 to 2012_R2. 2012_R2 functional level is not yet available. Older schemas can be used by provisioning with the '--base-schema' argument. Existing installations can be updated with the samba-tool command "domain schemaupgrade". Samba's replication code has also been improved to handle replication with the 2012 schema (the core of this replication fix has also been backported to 4.9.11 and will be in a 4.10.x release). For more about how the AD schema relates to overall Windows compatibility, please read: https://wiki.samba.org/index.php/Windows_2012_Server_compatibility GnuTLS 3.2 required ------------------- Samba is making efforts to remove in-tree cryptographic functionality, and to instead rely on externally maintained libraries. To this end, Samba has chosen GnuTLS as our standard cryptographic provider. Samba now requires GnuTLS 3.2 to be installed (including development headers at build time) for all configurations, not just the Samba AD DC. NOTE WELL: The use of GnuTLS means that Samba will honour the system-wide 'FIPS mode' (a reference to the US FIPS-140 cryptographic standard) and so will not operate in many still common situations if this system-wide parameter is in effect, as many of our protocols rely on outdated cryptography. A future Samba version will mitigate this to some extent where good cryptography effectively wraps bad cryptography, but for now that above applies. samba-tool improvements ----------------------- A new "samba-tool contact" command has been added to allow the command-line manipulation of contacts, as used for address book lookups in LDAP. The "samba-tool [user|group|computer|group|contact] edit" command has been improved to operate more pleasantly on international character sets. 100,000 USER and LARGER Samba AD DOMAINS ======================================== Extensive efforts have been made to optimise Samba for use in organisations (for example) targeting 100,000 users, plus 120,000 computer objects, as well as large number of group memberships. Many of the specific efforts are detailed below, but the net results is to remove barriers to significantly larger Samba deployments compared to previous releases. Reindex performance improvements -------------------------------- The performance of samba-tool dbcheck --reindex has been improved, especially for large domains. join performance improvements ----------------------------- The performance of samba-tool domain join has been improved, especially for large domains. LDAP Server memory improvements ------------------------------- The LDAP server has improved memory efficiency, ensuring that large LDAP responses (for example a search for all objects) is not copied multiple times into memory. Setting lmdb map size --------------------- It is now possible to set the lmdb map size (the maximum permitted size for the database). "samba-tool" now accepts the "--backend-store-size" i.e. --backend-store-size=4Gb. If not specified it defaults to 8Gb. This option is avaiable for the following sub commands: * domain provision * domain join * domain dcpromo * drs clone-dc-database LDB "batch_mode" ---------------- To improve performance during batch operations i.e. joins, ldb now accepts a "batch_mode" option. However to prevent any index or database inconsistencies if an operation fails, the entire transaction will be aborted at commit. New LDB pack format ------------------- On first use (startup of 'samba' or the first transaction write) Samba's sam.ldb will be updated to a new more efficient pack format. This will take a few moments. New LDB <= and >= index mode to improve replication performance --------------------------------------------------------------- As well as a new pack format, Samba's sam.ldb uses a new index format allowing Samba to efficiently select objects changed since the last replication cycle. This in turn improves performance during replication of large domains. https://wiki.samba.org/index.php/LDB_Greater_than_and_Less_than_indexing Improvements to ldb search performance -------------------------------------- Search performance on large LDB databases has been improved by reducing memory allocations made on each object. Improvements to subtree rename performance ------------------------------------------ Improvements have been made to Samba's handling of subtree renames, for example of containers and organisational units, however large renames are still not recommended. CTDB changes ============ * nfs-linux-kernel-callout now defaults to using systemd service names The Red Hat service names continue to be the default. Other distributions should patch this file when packaging it. * The onnode -o option has been removed * ctdbd logs when it is using more than 90% of a CPU thread ctdbd is single threaded, so can become saturated if it uses the full capacity of a CPU thread. To help detect this situation, ctdbd now logs messages when CPU utilisation exceeds 90%. Each change in CPU utilisation over 90% is logged. A message is also logged when CPU utilisation drops below the 90% threshold. * Script configuration variable CTDB_MONITOR_SWAP_USAGE has been removed 05.system.script now monitors total memory (i.e. physical memory + swap) utilisation using the existing CTDB_MONITOR_MEMORY_USAGE script configuration variable. CephFS Snapshot Integration --------------------------- CephFS snapshots can now be exposed as previous file versions using the new ceph_snapshots VFS module. See the vfs_ceph_snapshots(8) man page for details. REMOVED FEATURES ================ Web server ---------- As a leftover from work related to the Samba Web Administration Tool (SWAT), Samba still supported a Python WSGI web server (which could still be turned on from the 'server services' smb.conf parameter). This service was unused and has now been removed from Samba. samba-tool join subdomain ------------------------- The subdomain role has been removed from the join command. This option did not work and has no tests. Python2 support --------------- Samba 4.11 will not have any runtime support for Python 2. If you are building Samba using the '--disable-python' option (i.e. you're excluding all the run-time Python support), then this will continue to work on a system that supports either python2 or python3. To build Samba with python2 you *must* set the 'PYTHON' environment variable for both the 'configure' and 'make' steps, i.e. 'PYTHON=python2 ./configure' 'PYTHON=python2 make' This will override the python3 default. Except for this specific build-time use of python2, Samba now requires Python 3.4 as a minimum. smb.conf changes ================ Parameter Name Description Default -------------- ----------- ------- allocation roundup size Default changed/ 0 Deprecated client min protocol Changed default SMB2_02 server min protocol Changed default SMB2_02 mangled names Changed default illegal web port Removed fruit:zero_file_id Changed default False debug encryption New: dump encryption keys False rndc command Deprecated lanman auth Deprecated encrypt passwords Deprecated CHANGES SINCE 4.11.0rc4 ======================= CHANGES SINCE 4.11.0rc3 ======================= o Douglas Bagnall * BUG 14049: ldb: Don't try to save a value that isn't there. * ldb_dn: Free dn components on explode failure. * ldb: Do not allow adding a DN as a base to itself. o Andrew Bartlett * ldb: Release ldb 2.0.7. * BUG 13695: ldb: Correct Pigeonhole principle validation in ldb_filter_attrs(). * BUG 14049: Fix ldb dn crash. * BUG 14117: Deprecate "lanman auth = yes" and "encrypt passwords = no". o Ralph Boehme * BUG 14038: Fix compiling ctdb on older systems lacking POSIX robust mutexes. * BUG 14121: smbd returns bad File-ID on filehandle used to create a file or directory. o Poornima G * BUG 14098: vfs_glusterfs: Use pthreadpool for scheduling aio operations. o Stefan Metzmacher * BUG 14055: Add the target server name of SMB 3.1.1 connections as a hint to load balancers or servers with "multi-tenancy" support. * BUG 14113: Fix byte range locking bugs/regressions. o Swen Schillig * ldb: Fix mem-leak if talloc_realloc fails. o Evgeny Sinelnikov * BUG 14007: Fix join with don't exists machine account. o Martin Schwenke * BUG 14085: ctdb-recoverd: Only check for LMASTER nodes in the VNN map. CHANGES SINCE 4.11.0rc2 ======================= o Michael Adam * BUG 13972: Different Device Id for GlusterFS FUSE mount is causing data loss in CTDB cluster. o Jeremy Allison * BUG 14035: CVE-2019-10197: Permissions check deny can allow user to escape from the share. o Andrew Bartlett * BUG 14059: ldb: Release ldb 2.0.6 (log database repack so users know what is happening). * BUG 14092: docs: Deprecate "rndc command" for Samba 4.11. o Tim Beale * BUG 14059: ldb: Free memory when repacking database. o Ralph Boehme * BUG 14089: vfs_default: Use correct flag in vfswrap_fs_file_id. * BUG 14090: vfs_glusterfs: Initialize st_ex_file_id, st_ex_itime and st_ex_iflags. o Anoop C S * BUG 14093: vfs_glusterfs: Enable profiling for file system operations. o Aaron Haslett * BUG 14059: Backport sambadowngradedatabase for v4.11. o Stefan Metzmacher * BUG 14035: CVE-2019-10197: Permissions check deny can allow user to escape from the share. o Christof Schmitt * BUG 14032: vfs_gpfs: Implement special case for denying owner access to ACL. o Martin Schwenke * BUG 14084: Avoid marking a node as connected before it can receive packets. * BUG 14086: Fix onnode test failure with ShellCheck >= 0.4.7. * BUG 14087: ctdb-daemon: Stop "ctdb stop" from completing before freezing databases. KNOWN ISSUES ============ https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.11#Release_blocking_bugs ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net. If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the Samba 4.1 and newer product in the project's Bugzilla database (https://bugzilla.samba.org/). ====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ======================================================================