Release Announcements
=====================
-This is the first preview release of Samba 4.5. This is *not*
+This is the first preview release of Samba 4.8. This is *not*
intended for production environments and is designed for testing
purposes only. Please report any defects via the Samba bug reporting
system at https://bugzilla.samba.org/.
-Samba 4.5 will be the next version of the Samba suite.
+Samba 4.8 will be the next version of the Samba suite.
UPGRADING
=========
-Nothing special.
-
NEW FEATURES/CHANGES
====================
-Support for LDAP_SERVER_NOTIFICATION_OID
-----------------------------------------
-
-The ldap server has support for the LDAP_SERVER_NOTIFICATION_OID
-control. This can be used to monitor the active directory database
-for changes.
-
-VLV - Virtual List View
------------------------
-
-The VLV Control allows applications to page the LDAP directory in the
-way you might expect a live phone book application to operate, without
-first downloading the entire directory.
-
-DRS Replication for the AD DC
------------------------------
-
-DRS Replication in Samba 4.5 is now much more efficient in handling
-linked attributes, particularly in large domains with over 1000 group
-memberships or other links.
-
-Replication is also much more reliable in the handling of tree
-renames, such as the rename of an organizational unit containing many
-users. Extensive tests have been added to ensure this code remains
-reliable, particularly in the case of conflicts between objects added
-with the same name on different servers.
-
-Schema updates are also handled much more reliably.
-
-replPropertyMetaData Changes
-----------------------------
-
-During the development of the DRS replication, tests showed that Samba
-stores the replPropertyMetaData object incorrectly. To address this,
-be aware that dbcheck will now detect and offer to fix all objects in
-the domain for this error.
+Using x86_64 Accelerated AES Crypto Instructions
+================================================
-Linked attributes on deleted objects
-------------------------------------
+Samba on x86_64 can now be configured to use the Intel accelerated AES
+instruction set, which has the potential to make SMB3 signing and
+encryption much faster on client and server. To enable this, configure
+Samba using the new option --accel-aes=intelaesni.
-In Active Directory, an object that has been tombstoned or recycled
-has no linked attributes. However, Samba incorrectly maintained such
-links, slowing replication and run-time performance. dbcheck now
-offers to remove such links, and they are no longer kept after the
-object is tombstoned or recycled.
+This is a temporary solution that is being included to allow users
+to enjoy the benefits of Intel accelerated AES on the x86_64 platform,
+but the longer-term solution will be to move Samba to a fully supported
+external crypto library.
-Improved AD DC performance
---------------------------
+The third_party/aesni-intel code will be removed from Samba as soon as
+external crypto library performance reaches parity.
-Many other improvements have been made to our LDAP database layer in
-the AD DC, to improve performance, both during samba-tool domain
-provision and at runtime.
+The default is to build without setting --accel-aes, which uses the
+existing Samba software AES implementation.
-Other dbcheck improvements
---------------------------
+KDC GPO application
+-------------------
- - samba-tool dbcheck can now find and fix a missing or corrupted
- 'deleted objects' container.
- - BUG 11433: samba-dbcheck no longer offers to resort auxiliary class values
- in objectClass as these were then re-sorted at the next dbcheck indefinitely.
+Adds Group Policy support for the samba kdc. Applies password policies
+(minimum/maximum password age, minimum password length, and password
+complexity) and kerberos policies (user/service ticket lifetime and
+renew lifetime).
-Tombstone Reanimation
----------------------
+Adds the samba_gpoupdate script for applying and unapplying
+policy. Can be applied automatically by setting
-Samba now supports tombstone reanimation, a feature in the AD DC
-allowing tombstones, that is objects which have been deleted, to be
-restored with the original SID and GUID still in place.
+ 'server services = +gpoupdate'.
-Multiple DNS Forwarders on the AD DC
-------------------------------------
-
-Multiple DNS forwarders are now supported on the AD DC, allowing
-samba to fall back between two different DNS servers for forwarded queries.
-
-Password quality plugin support in the AD DC
---------------------------------------------
-
-The check password script now operates correctly in the AD DC (this
-was silently ignored in past releases)
-
-pwdLastSet is now correctly honoured
-------------------------------------
-
-BUG 9654: the pwdLastSet attribute is now correctly handled (this previously
-permitted passwords that next expire).
+smb.conf changes
+================
-net ads dns unregister
-----------------------
+ Parameter Name Description Default
+ -------------- ----------- -------
+ oplock contention limit Removed
-It is now possible to remove the DNS entries created with 'net ads register'
-with the matching 'net ads unregister' command.
+NT4-style replication based net commands removed
+================================================
-Samba-tool improvements
-------------------------
+The following commands and sub-commands have been removed from the
+"net" utility:
-Running samba-tool on the command line should now be a lot snappier. The tool
-now only loads the code specific to the subcommand that you wish to run.
+net rpc samdump
+net rpc vampire ldif
+Also, replicating from a real NT4 domain with "net rpc vampire" and
+"net rpc vampire keytab" has been removed.
+The NT4-based commands were accidentially broken in 2013, and nobody
+noticed the breakage. So instead of fixing them including tests (which
+would have meant writing a server for the protocols, which we don't
+have) we decided to remove them.
-REMOVED FEATURES
-================
+For the same reason, the "samsync", "samdeltas" and "database_redo"
+commands have been removed from rpcclient.
-only user and username parameters
----------------------------------
-These two parameters have long been deprecated and superseded by
-"valid users" and "invalid users".
+"net rpc vampire keytab" from Active Directory domains continues to be
+supported.
-smb.conf changes
-----------------
+vfs_aio_linux module removed
+============================
- Parameter Name Description Default
- -------------- ----------- -------
- only user Removed
- username Removed
+The current Linux kernel aio does not match what Samba would
+do. Shipping code that uses it leads people to false
+assumptions. Samba implements async I/O based on threads by default,
+there is no special module required to see benefits of read and write
+request being sent do the disk in parallel.
KNOWN ISSUES
============
-Currently none.
+https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.8#Release_blocking_bugs
+
#######################################
Reporting bugs & Development Discussion
git.samba.org / samba.git / blobdiff