1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
2 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3 <html xmlns="http://www.w3.org/1999/xhtml">
6 <title>Samba - Release Notes Archive</title>
11 <h2>The Samba Team announce Samba 2.2.3a</h2>
15 The Samba Team announces the release of Samba 2.2.3a, a bugfix release to
16 correct an error in Samba 2.2.3.
18 This is the latest stable release of Samba. This is the version that all
19 production Samba servers should be running for all current bug-fixes.
21 This is a minor bugfix release for the 2.2.3 release. The 2.2.3
22 release had a problem that was visible to Windows 2000 Explorer
23 users in that copying files into a share that already existed
24 failed with "Access Denied" rather than asking the user if an
25 overwrite was required. This was due to an incorrect error mapping
26 between the UNIX EEXIST error code and the corresponding NT status error.
28 As Windows Explorer is a highly visible end user application a quick
29 bugfix release was required, hence 2.2.3a.
31 There are several important scaling bugs that have been fixed in this release
32 for large server systems so an upgrade is recommended.
34 Samba 2.2.3a is available in source form from samba.org and all of our
35 mirror sites at the url
37 <a href="/samba/ftp/samba-2.2.3a.tar.gz">/samba/ftp/samba-2.2.3a.tar.gz </a>
39 The release notes follow.
41 If you think you have found a bug please email a report to :
43 <a href="mailto:samba@samba.org">samba@samba.org</a>
45 As always, all bugs are our responsibility.
51 ----------------------------------------------------------------------
52 WHATS NEW IN Samba 2.2.3a - 6th February 2002
53 ==============================================
55 This is the latest stable release of Samba. This is the version that all
56 production Samba servers should be running for all current bug-fixes.
58 There are several important scaling bugs that have been fixed in this release
59 for large server systems so an upgrade is recommended.
64 This is a minor bugfix release for the 2.2.3 release. The 2.2.3
65 release had a problem that was visible to Windows 2000 Explorer
66 users in that copying files into a share that already existed
67 failed with "Access Denied" rather than asking the user if an
68 overwrite was required. This was due to an incorrect error mapping
69 between the UNIX EEXIST error code and the NT status error.
71 As Windows Explorer is a highly visible end user application a quick
72 bugfix release was required, hence 2.2.3a.
74 Compilation on HPUX versions earlier than HPUX 11 has also been
77 The cvs.log file is no longer included with this release, as it adds
78 13Mb to the size of the release, and is easily available on the Web.
83 Much work has been done on the LDAP backend code. The configure
84 option --with-ldapsam is now considered to be stable. The schema
85 used has changed, see the file examples/LDAP/samba.schema for the
88 New documentation explaining how to set up a Samba only PDC/BDC
89 setup has been added in the files Samba-LDAP-HOWTO and Samba-BDC-HOWTO
90 in the documentation tree.
92 winbindd daemon extended
93 ------------------------
95 Samba 2.2.2 was the first release to include the winbind daemon.
96 This code allows UNIX systems that implement the name service
97 switch (nss) to be entered into a Windows NT/2000 domain and
98 use the Domain controller for all user and group enumeration.
100 Samba 2.2.3 fixes the known memory leaks in winbindd and has
101 been extended to work with SGI IRIX and HPUX (11.x) in addition
102 to the earlier targets of Linux and Solaris.
104 For more information on using winbind, see the man pages for
107 Note that winbindd is not installed by default.
109 New/Changed parameters in 2.2.3a
110 --------------------------------
112 For more information on these parameters, see the man pages for
115 Added/changed parameters.
116 -------------------------
120 Enables the experimental UNIX CIFS extensions in smbd. See the manpage
125 Some printer drivers will crash the Windows NT/2000 spooler service
126 if they are given a default devmode, some require it. This parameter
127 allows the administrator a choice of whether smbd returns such a
128 default devmode for a driver.
132 This parameter has been restored to allow people who wish smbd to ignore
133 client share modes. This is *very dangerous* and should not be set without
134 full knowledge of what this is designed for.
139 1). Fixed shared library compile for Solaris with native compiler.
140 2). UNIX CIFS extensions code added (donated by HP).
141 3). Changed to using NT status codes on the wire if the client can support
143 4). altname command to show 8.3 name added to smbclient.
144 5). const-safe endian macros now used.
145 6). client code now uses UNICODE on the wire.
146 7). Correctly return fault PDU's on bad handle.
147 8). Improved NT error code mapping table.
148 9). Many new point and print RPC calls added.
149 10). Win9x clients can now see full user list.
150 11). fileid added to identify simultaneous open files (no longer
151 use dev/inode/time as unique value).
152 12). HPUX ACL code added (donated by HP).
153 13). vfs interfaces updated (again !).
154 14). MSDOS Code Page 866 -> 1251 mapping added.
155 15). winbindd now processes quit/hup signals correctly.
156 16). No tdb traversal done on startup/shutdown - ensures scalability.
157 17). Fix bug with paths for homes share.
158 18). Fixed copyfile for OS/2.
159 19). Fix group membership when groups are on more than one line.
160 20). Fixed core dumps in posix ACL mapping code.
161 21). Tidyup of UNICODE functions (put/get).
162 22). Move rpcclient to the new libsmb code.
163 23). Add missing Windows 2000 passthough trans2 calls.
164 24). Return check all tdb calls.
165 25). Make local name lookup work even if wins server is down.
166 26). pam session code added to winbind.
167 27). Added winbindd cache to all lookups.
168 28). Fix allocate bugs that caused file sizes to be incorrect.
169 29). Fixed write cache code - now safe to use.
170 30). Fixed winbindd memory leaks.
171 31). winbindd will now do name lookups (to allow non Open Source
172 systems to do the nsswitch WINS lookup). Fixed by SGI.
173 32). passdb memory leaks fixed.
174 33). LDAP code updates and now properly maintained.
175 34). Finally figured out how changeid is meant to work.
176 35). Downlevel printing now looks as NT does in print monitor window.
177 36). Many fixups in spoolss printing RPC parsing.
178 37). Speed up password enumeration as a PDC.
179 38). Fix printer changed notify messages (work from HP).
180 39). Fix modify timestamp on close code.
181 40). Fix long standing mangled names bug.
182 41). Fix delete on close semantics.
183 42). Stop opening all files with O_NONBLOCK !
184 43). Use O_NOFOLLOW for systems that have it and don't want symlinks.
185 44). Ensure NT suplementary groups get added to user token.
186 45). Try and mitigate effects of DNS timeout (do less lookups).
187 46). Added current user connection context stack.
188 47). Fixes to utmp code.
189 48). smbw code tidyups.
190 49). Added tdb open log code. Several tdb fixes.
192 Older release notes for Samba 2.2.x follow.
194 -----------------------------------------------------------------------------
196 New daemon included - winbindd
197 ------------------------------
199 Samba 2.2.2 is the first release to include the winbind daemon.
200 This code allows UNIX systems that implement the name service
201 switch (nss) to be entered into a Windows NT/2000 domain and
202 use the Domain controller for all user and group enumeration.
204 This allows a Samba server added to a Windows domain to serve
205 file and print services with *NO* local users needed in /etc/passwd
206 and /etc/group - all users and groups are read directly from the
207 Windows domain controller. In addition with pam_winbind which allows
208 a PAM enabled UNIX system to use a Windows domain for authentication
209 service this allows single sign on and account control across
210 UNIX and Windows systems.
212 The current version of winbindd shipped in 2.2.2 does have some
213 memory leaks, which will be addressed for the next Samba release,
214 so it is advisable to monitor the winbind process. This code is
215 being used in production by several vendors, so the leaks are
216 managable. In addition, this version of winbind does not work
217 correctly against a Samba PDC, due to some missing calls on the
218 PDC side. These problems are being addressed for the next Samba
219 release, but it was thought better to release the code now rather
220 than delay the main Samba code to match the winbind release schedule.
222 For more information on using winbind, see the man pages for
225 Note that winbindd is not installed by default.
227 New/Changed parameters in 2.2.2
228 -------------------------------
230 For more information on these parameters, see the man pages for
233 Added/changed parameters.
234 -------------------------
238 Causes Samba not to create UNIX 'sparse' files, but to follow the
239 Windows behaviour of always allocating on-disk space.
243 Set to 'on' by default, only set to 'off' on HPUX 11.x or below or other
244 UNIX systems that don't have coherent mmap/read-write internal caches.
245 You should not need to set this parameter.
249 This parameter has been changed to a per-share option, and is very
250 useful in enabling Windows 2000 SP2 to load/save profiles from a
253 New printing parameters.
254 ------------------------
258 Setting this parameter causes Samba to go back to the old 2.0.x
259 LANMAN printing behaviour, for people who wish to disable the
264 Causes Windows NT/2000 clients to need have a local printer driver
265 installed and to treat the printer as local.
270 Samba 2.2.2 contains new code to maintain a Samba SAM database
271 on a remote LDAP server. These parameters have been added as
272 part of this code. These parameters are only available when Samba
273 has been compiled with the --with-ldapsam option.
281 The SSL support in Samba has been fixed. These new parameters
282 are part of the changes added. These parameters are only available
283 when Samba has been compiled with the --with-ssl option.
284 Please see the smb.conf man page for details.
290 New winbindd parameters.
291 ------------------------
293 These parameters are used by winbindd. See the man page for
294 winbindd for details.
315 Some new README's have been added in the docs/ directory. These cover
316 using roving profiles with Windows 2000 SP2 (docs/README.Win2kSP2),
317 and how to use Samba to help prevent Windows virus spread
318 (docs/README.Win32-Viruses).
320 Quota problems on a Linux 2.4 kernel.
321 -------------------------------------
323 Currently the quota interfaces have diverged between the Linus
324 2.4.x kernels and the Alan Cox 2.4.x kernels (the Alan Cox varients
325 are shipped with RedHat). Running quota-enabled Samba compiled on
326 an Alan Cox kernel works correctly on an Alan Cox kernel (the one
327 shipped by default with RedHat 7.x) but fails on a Linus kernel.
329 This is a mess, and hopefully Alan and Linus will sort it out soon.
330 In the meantime we need to ship.....
335 1). mmap tdb code disabled on HPUX. This should prevent the reports of
336 tdb corruption on HUPX.
337 2). Large file support set to off in Solaris 5.5 and below.
338 3). Better CUPS detection.
339 4). New SAM (password database) backends - smbpasswd (traditional),
340 LDAP, NIS+ and Samba TDB.
341 5). Quota fixups on Linux.
342 6). libsmbclient stand-alone code added. Can be built as a shared library
344 7). Tru64 ACL suppport added.
345 8). winbindd option added.
346 9). Realloc fail tidyup fixes all over the code.
347 10). Large improvement in hash table code efficiency - would be found with
349 11). Error code consistency improved (still needs more work).
350 12). Profile shared memory support added to nmbd.
351 13). New Windows 2000/NT passthrough info levels added.
352 14). readraw/writeraw code rewritten - many bugs fixed.
353 15). UNIX password sync (non pam) code fixed, use correct wildcard matcher.
354 16). Reverse DNS lookup avoided on socket open.
355 17). Bug preventing nmbd re-registering names on WINS server timeout fixed.
356 18). Zero length byte range lock code added. Much closer to Windows semantics.
357 19). Alignment fault fixes for Linux/Alpha.
358 20). Error checking on tdb returns vastly improved.
359 21). Handling of delete on close fixed. No longer possible to leave 'dead'
361 22). Handling of oplock break failure cleanups improved. Should not be
362 able to leave 'dead' entries.
363 23). Fix handling of errors trying to set 64 bit locks on 32 bit NFS mounts.
364 24). Misc. MS-DFS code fixes.
365 25). Ignore logon packets if not a PDC (needed for PDC/BDC failover).
366 26). winbind pam module added.
367 27). Order N^^2 enumeration of printers problem fixed.
368 28). Password backend database code re-ordered to allow different password
369 backends (at compile time currently).
370 29). Improved print driver version detection for Windows 2000.
371 30). Driver DEVMODE initialization fixes.
372 31). Improved SYSV print parse code.
373 32). Fixed enumeration of large numbers of users/groups from Windows clients.
375 33). Fix for buggy NetApp RPC pipe clients.
376 34). Fix for NT sending multiple SetPrinterDataEx calls.
377 35). Fix for logic bug where smbd could delay oplock break request messages
378 from other smbd daemons whilst client kept us busy.
379 36). Fix deadlock problem with connections tdb on enumeration.
380 37). Fixes for setting/getting NT ACLs - improved POSIX mapping both ways.
381 38). Removed unused readbmpx/writebmpx code.
382 39). Attempt to fix Linux 2.4.x quota mess.
383 40). Improved ctemp code for Windows 2000 compatibilty.
384 41). Finally understood difference between set EOF and set allocation requests.
385 Added strict allocate parameter to help.
386 42). Correctly return name types on name to SID lookups.
387 43). tdb spinlock code update.
388 44). Use pread/pwrite on systems that have it to fix race condition in tdb code.
390 Older release notes for Samba 2.2.x follow.
392 -----------------------------------------------------------------------------
393 The release notes for 2.2.1a follow :
395 This is a minor bugfix release for 2.2.1, *NOT* security related.
397 1). 2.2.1 had a bug where using smbpasswd -m to add a Windows NT or
398 Windows2000 machine into a Samba hosted PDC would fail due to our
399 stricter user name checking. We were disallowing user names
400 containing '$', which is needed when using smbpasswd to add a
401 machine into a domain. Automatically adding machines (using the
402 native Windows tools) into a Samba domain worked correctly.
404 2.2.1a fixes this single problem.
406 -----------------------------------------------------------------------------
407 The release notes for 2.2.1 follow :
409 New/Changed parameters in 2.2.1
410 -------------------------------
415 obey pam restrictions
417 When Samba is configured to use PAM, turns on or off Samba checking
418 the PAM account restrictions. Defaults to off.
422 When Samba is configured to use PAM, turns on or off Samba passing
423 the password changes to PAM. Defaults to off.
427 New option to allow new Windows 2000 large file (64k) streaming
428 read/write options. Needs a 64 bit underlying operating system
429 (for Linux use kernel 2.4 with glibc 2.2 or above). Can improve performance
430 by 10% with Windows 2000 clients. Defaults to off. Not as tested
431 as some other Samba code paths.
435 Prevents clients from seeing the existance of files that cannot
436 be read. Off by default.
440 Turn on/off the enhanced Samba browing functionality (*1B names).
441 Default is "on". Can prevent eternal machines in workgroups when
442 WINS servers are not synchronised.
454 1). "find" command removed for smbclient. Internal code now used.
455 2). smbspool updates to retry connections from Michael Sweet.
456 3). Fix for mapping 8859-15 characters to UNICODE.
457 4). Changed "security=server" to try with invalid username to prevent
459 5). Fixes to allow Windows 2000 SP2 clients to join a Samba PDC.
460 6). Support for Windows 9x Nexus tools to allow security changes from Win9x.
461 7). Two locking fixes added. Samba 2.2.1 now passes the Clarion network
462 lock tester tool for distributed databases.
463 8). Preliminary support added for Windows 2000 large file read/write SMBs.
464 9). Changed random number generator in Samba to prevent guess attacks.
465 10). Fixes for tdb corruption in connections.tdb and file locking brlock.tdb.
466 smbd's clean the tdb files on startup and shutdown.
467 11). Fixes for default ACLs on Solaris.
468 12). Tidyup of password entry caching code.
469 13). Correct shutdowns added for send fails. Helps tdb cleanup code.
470 14). Prevent invalid '/' characters in workgroup names.
471 15). Removed more static arrays in SAMR code.
472 16). Client code is now UNICODE on the wire.
473 17). Fix 2 second timstamp resolution everywhere if dos timestamp set to yes.
474 18). All tdb opens now going through logging function.
475 19). Add pam password changing and pam restrictions code.
476 20). Printer driver management improvements (delete driver).
477 21). Fix difference between NULL security descriptors and empty
478 security descriptors.
479 22). Fix SID returns for server roles.
480 23). Allow Windows 2000 mmc to view and set Samba share security descriptors.
481 24). Allow smbcontrol to forcibly disconnect a share.
482 25). tdb fixes for HPUX, OpenBSD and other OS's that don't have a coherent
483 mmap/file read/write cache.
484 26). Fix race condition in returning create disposition for file create/open.
485 27). Fix NT rewriting of security descriptors to their canonical form for
487 28). Fix for Samba running on top of Linux VFAT ftruncate bug.
488 29). Swat fixes for being run with xinetd that doesn't set the umask.
489 30). Fix for slow writes with Win9x Explorer clients. Emulates Microsoft
490 TCP stack early ack specification error.
491 31). Changed lock & persistant tdb directory to /var/cache/samba by default on
492 RedHat and Mandrake as they clear the /var/lock/samba directory on reboot.
494 -----------------------------------------------------------------------------
495 The release notes for 2.2.0a follow :
500 This is a security bugfix release for Samba 2.2.0. This release provides the
501 following two changes *ONLY* from the 2.2.0 release.
503 1). Fix for the security hole discovered by Michal Zalewski (lcamtuf@bos.bindview.com)
504 and described in the security advisory below.
505 2). Fix for the hosts allow/hosts deny parameters not being honoured.
507 No other changes are being made for this release to ensure a security fix only.
508 For new functionality (including these security fixes) download Samba 2.2.1
509 when it is available.
511 The security advisory follows :
514 IMPORTANT: Security bugfix for Samba
515 ------------------------------------
523 A serious security hole has been discovered in all versions of Samba
524 that allows an attacker to gain root access on the target machine for
525 certain types of common Samba configuration.
527 The immediate fix is to edit your smb.conf configuration file and
528 remove all occurances of the macro "%m". Replacing occurances of %m
529 with %I is probably the best solution for most sites.
534 A remote attacker can use a netbios name containing unix path
535 characters which will then be substituted into the %m macro wherever
536 it occurs in smb.conf. This can be used to cause Samba to create a log
537 file on top of an important system file, which in turn can be used to
538 compromise security on the server.
540 The most commonly used configuration option that can be vulnerable to
541 this attack is the "log file" option. The default value for this
542 option is VARDIR/log.smbd. If the default is used then Samba is not
543 vulnerable to this attack.
545 The security hole occurs when a log file option like the following is
548 log file = /var/log/samba/%m.log
550 In that case the attacker can use a locally created symbolic link to
551 overwrite any file on the system. This requires local access to the
554 If your Samba configuration has something like the following:
556 log file = /var/log/samba/%m
558 Then the attacker could successfully compromise your server remotely
559 as no symbolic link is required. This type of configuration is very
562 The most commonly used log file configuration containing %m is the
563 distributed in the sample configuration file that comes with Samba:
565 log file = /var/log/samba/log.%m
567 in that case your machine is not vulnerable to this attack unless you
568 happen to have a subdirectory in /var/log/samba/ which starts with the
574 Thanks to Michal Zalewski (lcamtuf@bos.bindview.com) for finding this
581 While we recommend that vulnerable sites immediately change their
582 smb.conf configuration file to prevent the attack we will also be
583 making new releases of Samba within the next 24 hours to properly fix
584 the problem. Please see http://www.samba.org/ for the new releases.
586 Please report any attacks to the appropriate authority.
591 ---------------------------------------------------------------------------
593 The release notes for 2.2.0 follow :
595 This is the official Samba 2.2.0 release. This version of Samba provides
596 the following new features and enhancements.
598 Integration between Windows oplocks and NFS file opens (IRIX and Linux
599 2.4 kernel only). This gives complete data and locking integrity between
600 Windows and UNIX file access to the same data files.
602 Ability to act as an authentication source for Windows 2000 clients as
603 well as for NT4.x clients.
605 Integration with the winbind daemon that provides a single
606 sign on facility for UNIX servers in Windows 2000/NT4 networks
607 driven by a Windows 2000/NT4 PDC. winbind is not included in
608 this release, it currently must be obtained separately. We are
609 committed to including winbind in a future Samba 2.2.x release.
611 Support for native Windows 2000/NT4 printing RPCs. This includes
612 support for automatic printer driver download.
614 Support for server supported Access Control Lists (ACLs).
615 This release contains support for the following filesystems:
619 Linux Kernel with ACL patch from http://acl.bestbits.at
620 Linux Kernel with XFS ACL support.
623 FreeBSD (with external patch)
625 Other platforms will be supported as resources are
626 available to test and implement the encessary modules. If
627 you are interested in writing the support for a particular
628 ACL filesystem, please join the samba-technical mailing
629 list and coordinate your efforts.
631 On PAM (Pluggable Authentication Module) based systems - better debugging
632 messages and encrypted password users now have access control verified via
633 PAM - Note: Authentication still uses the encrypted password database.
635 Rewritten internal locking semantics for more robustness.
636 This release supports full 64 bit locking semantics on all
637 (even 32 bit) platforms. SMB locks are mapped onto POSIX
638 locks (32 bit or 64 bit) as the underlying system allows.
640 Conversion of various internal flat data structures to use
641 database records for increased performance and
644 Support for acting as a MS-DFS (Distributed File System) server.
646 Support for manipulating Samba shares using Windows client tools
647 (server manager). Per share security can be set using these tools
648 and Samba will obey the access restrictions applied.
650 Samba profiling support (see below).
652 Compile time option for enabling a (Virtual file system) VFS layer
653 to allow non-disk resources to be exported as Windows filesystems
654 (such as databases etc.).
656 The documentation in this release has been updated and converted
657 from Yodl to DocBook 4.1. There are many new parameters since 2.0.7
658 and some defaults have changed.
662 Support for collection of profile information. A shared
663 memory area has been created which contains counters for
664 the number of calls to and the amount of time spent in
665 various system calls, smb transactions and nmbd activity. See
666 the file profile.h for a complete listing of the information
667 collected. Sample code for a samba pmda (collection agent
668 for Performance Co-Pilot) has been included in the pcp
671 To enable the profile data collection code in samba, you must
672 compile samba with profile data support (run configure with
673 the --with-profiling-data option). On startup, collection of
674 data is disabled. To begin collecting data use the smbcontrol
675 program to turn on profiling (see the smbcontrol man page).
676 Profile information collection can be enabled for nmbd, all smbd
677 processes or one or more selected processes. The profiling
678 data collected is the aggragate for all processes that have
681 With samba compiled for profile data collection, you may see
682 a very slight degradation in performance even with profiling
683 collection turned off. On initial tests with NetBench on an
684 SGI Origin 200 server, this degradation was not measureable
685 with profile collection off compared to no profile collection
688 With count profile collection enabled on all clients, the
689 degradation was less than 2%. With full profile collection
690 enabled on all clients, the degradation was about 8.5%.
692 =====================================================================
694 If you think you have found a bug please email a report to :
696 <a href="mailto:samba@samba.org">samba@samba.org</a>
698 As always, all bugs are our responsibility.
git.samba.org / metze / test / web / .git / blob