Release Announcements
=====================
-This is the first preview release of Samba 4.5. This is *not*
+This is the first preview release of Samba 4.8. This is *not*
intended for production environments and is designed for testing
purposes only. Please report any defects via the Samba bug reporting
system at https://bugzilla.samba.org/.
-Samba 4.5 will be the next version of the Samba suite.
+Samba 4.8 will be the next version of the Samba suite.
UPGRADING
=========
-NTLMv1 authentication disabled by default
------------------------------------------
-
-In order to improve security we have changed
-the default value for the "ntlm auth" option from
-"yes" to "no". This may have impact on very old
-client which doesn't support NTLMv2 yet.
-
-The primary user of NTLMv1 is MSCHAPv2 for VPNs and 802.1x.
-
-By default Samba will only allow NTLMv2 via NTLMSSP now,
-as we have the following default "lanman auth = no",
-"ntlm auth = no" and "raw NTLMv2 auth = no".
-
NEW FEATURES/CHANGES
====================
-Support for LDAP_SERVER_NOTIFICATION_OID
-----------------------------------------
-
-The ldap server has support for the LDAP_SERVER_NOTIFICATION_OID
-control. This can be used to monitor the active directory database
-for changes.
-
-KCC improvements for sparse network replication
------------------------------------------------
-
-The Samba KCC will now be the default knowledge consistency checker in
-Samba AD. Instead of using full mesh replication between every DC, the
-KCC will set up connections to optimize replication latency and cost
-(using site links to calculate the routes). This change should allow
-larger domains to function significantly better in terms of replication
-traffic and the time spent performing DRS replication.
-
-VLV - Virtual List View
------------------------
-
-The VLV Control allows applications to page the LDAP directory in the
-way you might expect a live phone book application to operate, without
-first downloading the entire directory.
-
-DRS Replication for the AD DC
------------------------------
-
-DRS Replication in Samba 4.5 is now much more efficient in handling
-linked attributes, particularly in large domains with over 1000 group
-memberships or other links.
-
-Replication is also much more reliable in the handling of tree
-renames, such as the rename of an organizational unit containing many
-users. Extensive tests have been added to ensure this code remains
-reliable, particularly in the case of conflicts between objects added
-with the same name on different servers.
-
-Schema updates are also handled much more reliably.
+KDC GPO application
+-------------------
-replPropertyMetaData Changes
-----------------------------
+Adds Group Policy support for the samba kdc. Applies password policies
+(minimum/maximum password age, minimum password length, and password
+complexity) and kerberos policies (user/service ticket lifetime and
+renew lifetime).
-During the development of the DRS replication, tests showed that Samba
-stores the replPropertyMetaData object incorrectly. To address this,
-be aware that dbcheck will now detect and offer to fix all objects in
-the domain for this error.
+Adds the samba_gpoupdate script for applying and unapplying
+policy. Can be applied automatically by setting
-Linked attributes on deleted objects
-------------------------------------
+ 'server services = +gpoupdate'.
-In Active Directory, an object that has been tombstoned or recycled
-has no linked attributes. However, Samba incorrectly maintained such
-links, slowing replication and run-time performance. dbcheck now
-offers to remove such links, and they are no longer kept after the
-object is tombstoned or recycled.
+Time Machine Support with vfs_fruit
+===================================
+Samba can be configured as a Time Machine target for Apple Mac devices
+through the vfs_fruit module. When enabling a share for Time Machine
+support the relevant Avahi records to support discovery will be published
+for installations that have been built against the Avahi client library.
-Improved AD DC performance
---------------------------
+Shares can be designated as a Time Machine share with the following setting:
-Many other improvements have been made to our LDAP database layer in
-the AD DC, to improve performance, both during samba-tool domain
-provision and at runtime.
+ 'fruit:time machine = yes'
-Other dbcheck improvements
---------------------------
+Support for lower casing the MDNS Name
+======================================
+Allows the server name that is advertised through MDNS to be set to the
+hostname rather than the Samba NETBIOS name. This allows an administrator
+to make Samba registered MDNS records match the case of the hostname
+rather than being in all capitals.
- - samba-tool dbcheck can now find and fix a missing or corrupted
- 'deleted objects' container.
- - BUG 11433: samba-dbcheck no longer offers to resort auxiliary class values
- in objectClass as these were then re-sorted at the next dbcheck indefinitely.
+This can be set with the following settings:
-Tombstone Reanimation
----------------------
+ 'mdns name = mdns'
-Samba now supports tombstone reanimation, a feature in the AD DC
-allowing tombstones, that is objects which have been deleted, to be
-restored with the original SID and GUID still in place.
-Multiple DNS Forwarders on the AD DC
-------------------------------------
-
-Multiple DNS forwarders are now supported on the AD DC, allowing
-samba to fall back between two different DNS servers for forwarded queries.
-
-Password quality plugin support in the AD DC
---------------------------------------------
-
-The check password script now operates correctly in the AD DC (this
-was silently ignored in past releases)
-
-pwdLastSet is now correctly honoured
-------------------------------------
-
-BUG 9654: the pwdLastSet attribute is now correctly handled (this previously
-permitted passwords that next expire).
+smb.conf changes
+================
-net ads dns unregister
-----------------------
+ Parameter Name Description Default
+ -------------- ----------- -------
+ binddns dir New
+ gpo update command New
+ oplock contention limit Removed
+ prefork children New 1
+ mdns name Added netbios
+ fruit:time machine Added false
-It is now possible to remove the DNS entries created with 'net ads register'
-with the matching 'net ads unregister' command.
+NT4-style replication based net commands removed
+================================================
-Samba-tool improvements
-------------------------
+The following commands and sub-commands have been removed from the
+"net" utility:
-Running samba-tool on the command line should now be a lot snappier. The tool
-now only loads the code specific to the subcommand that you wish to run.
+net rpc samdump
+net rpc vampire ldif
-SMB 2.1 Leases enabled by default
----------------------------------
+Also, replicating from a real NT4 domain with "net rpc vampire" and
+"net rpc vampire keytab" has been removed.
-Leasing is an SMB 2.1 (and higher) feature which allows clients to
-aggressively cache files locally above and beyond the caching allowed
-by SMB 1 oplocks. This feature was disabled in previous releases, but
-the SMB2 leasing code is now considered mature and stable enough to be
-enabled by default.
+The NT4-based commands were accidentially broken in 2013, and nobody
+noticed the breakage. So instead of fixing them including tests (which
+would have meant writing a server for the protocols, which we don't
+have) we decided to remove them.
-Open File Description (OFD) Locks
----------------------------------
+For the same reason, the "samsync", "samdeltas" and "database_redo"
+commands have been removed from rpcclient.
-On systems that support them (currently only Linux), the fileserver now
-uses Open File Description (OFD) locks instead of POSIX locks to implement
-client byte range locks. As these locks are associated with a specific
-file descriptor on a file this allows more efficient use when multiple
-descriptors having file locks are opened onto the same file. An internal
-tunable "smbd:force process locks = true" may be used to turn off OFD
-locks if there appear to be problems with them.
+"net rpc vampire keytab" from Active Directory domains continues to be
+supported.
-Password sync as active directory domain controller
----------------------------------------------------
+vfs_aio_linux module removed
+============================
-The new commands 'samba-tool user getpassword'
-and 'samba-tool user syncpasswords' provide
-access and syncing of various password fields.
+The current Linux kernel aio does not match what Samba would
+do. Shipping code that uses it leads people to false
+assumptions. Samba implements async I/O based on threads by default,
+there is no special module required to see benefits of read and write
+request being sent do the disk in parallel.
-If compiled with GPGME support (--with-gpgme) it's
-possible to store cleartext passwords in a PGP/OpenGPG
-encrypted form by configuring the new "password hash gpg key ids"
-option. This requires gpgme devel and python packages to be installed
-(e.g. libgpgme11-dev and python-gpgme on debian/ubuntu).
+smbclient reparse point symlink parameters reversed
+===================================================
+A bug in smbclient caused the 'symlink' command to reverse the
+meaning of the new name and link target parameters when creating a
+reparse point symlink against a Windows server. As this is a
+little used feature the ordering of these parameters has been
+reversed to match the parameter ordering of the UNIX extensions
+'symlink' command. The usage message for this command has also
+been improved to remove confusion.
REMOVED FEATURES
================
-only user and username parameters
----------------------------------
-These two parameters have long been deprecated and superseded by
-"valid users" and "invalid users".
-
-
-smb.conf changes
-================
+The two commands "net serverid list" and "net serverid wipe" have been
+removed, because the file serverid.tdb is not used anymore.
- Parameter Name Description Default
- -------------- ----------- -------
- kccsrv:samba_kcc Changed default yes
- ntlm auth Changed default no
- only user Removed
- password hash gpg key ids New
- smb2 leases Changed default yes
- username Removed
+"net serverid list" can be replaced by listing all files in the
+subdirectory "msg.lock" of Samba's "lock directory". The unique id
+listed by "net serverid list" is stored in every process' lockfile in
+"msg.lock".
+"net serverid wipe" is not necessary anymore. It was meant primarily
+for clustered environments, where the serverid.tdb file was not
+properly cleaned up after single node crashes. Nowadays smbd and
+winbind take care of cleaning up the msg.lock and msg.sock directories
+automatically.
KNOWN ISSUES
============
-Currently none.
+https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.8#Release_blocking_bugs
+
#######################################
Reporting bugs & Development Discussion
git.samba.org / samba.git / blobdiff