diff options
Diffstat (limited to 'WHATSNEW.txt')
| -rw-r--r-- | WHATSNEW.txt | 371 |
1 files changed, 371 insertions, 0 deletions
diff --git a/WHATSNEW.txt b/WHATSNEW.txt new file mode 100644 index 0000000..5c97836 --- /dev/null +++ b/WHATSNEW.txt @@ -0,0 +1,371 @@ + ============================== + Release Notes for Samba 4.20.0 + March 27, 2024 + ============================== + + +This is the first stable release of the Samba 4.20 release series. +Please read the release notes carefully before upgrading. + + +NEW FEATURES/CHANGES +==================== + +New Minimum MIT Krb5 version for Samba AD Domain Controller +----------------------------------------------------------- + +Samba now requires MIT 1.21 when built against a system MIT Krb5 and +acting as an Active Directory DC. This addresses the issues that were +fixed in CVE-2022-37967 (KrbtgtFullPacSignature) and ensures that +Samba builds against the MIT version that allows us to avoid that +attack. + +Removed dependency on Perl JSON module +-------------------------------------- + +Distributions are advised that the Perl JSON package is no longer +required by Samba builds that use the imported Heimdal. The build +instead uses Perl's JSON::PP built into recent perl5 versions. + +Current lists of packages required by Samba for major distributions +are found in the bootstrap/generated-dists/ directory of a Samba +source tree. While there will be some differences - due to features +chosen by packagers - comparing these lists with the build dependencies +in a package may locate other dependencies we no longer require. + +samba-tool user getpassword / syncpasswords ;rounds= change +----------------------------------------------------------- + +The password access tool "samba-tool user getpassword" and the +password sync tool "samba-tool user syncpasswords" allow attributes to +be chosen for output, and accept parameters like +pwdLastSet;format=GeneralizedTime + +These attributes then appear, in the same format, as the attributes in +the LDIF output. This was not the case for the ;rounds= parameter of +virtualCryptSHA256 and virtualCryptSHA512, for example as +--attributes="virtualCryptSHA256;rounds=50000" + +This release makes the behaviour consistent between these two +features. Installations using GPG-encrypted passwords (or plaintext +storage) and the rounds= option, will find the output has changed + +from: +virtualCryptSHA256: {CRYPT}$5$rounds=2561$hXem.M9onhM9Vuix$dFdSBwF + +to: +virtualCryptSHA256;rounds=2561: {CRYPT}$5$rounds=2561$hXem.M9onhM9Vuix$dFdSBwF + +Group Managed service account client-side features +-------------------------------------------------- + +samba-tool has been extended to provide client-side support for Group +Managed Service accounts. These accounts have passwords that change +automatically, giving the advantages of service isolation without risk +of poor, unchanging passwords. + +Where possible, Samba's existing samba-tool password handling +commands, which in the past have only operated against the local +sam.ldb have been extended to permit operation against a remote server +with authenticated access to "-H ldap://$DCNAME" + +Supported operations include: + - reading the current and previous gMSA password via + "samba-tool user getpassword" + - writing a Kerberos Ticket Granting Ticket (TGT) to a local + credentials cache with a new command + "samba-tool user get-kerberos-ticket" + +New Windows Search Protocol Client +---------------------------------- + +Samba now by default builds new experimental Windows Search Protocol (WSP) +command line client "wspsearch" + +The "wspsearch" cmd-line utility allows a WSP search request to be sent +to a server (such as a windows server) that has the (WSP) +Windows Search Protocol service configured and enabled. + +For more details see the wspsearch man page. + +Allow 'smbcacls' to save/restore DACLs to file +-------------------------------------------- + +'smbcacls' has been extended to allow DACLs to be saved and restored +to/from a file. This feature mimics the functionality that windows cmd +line tool 'icacls.exe' provides. Additionally files created either +by 'smbcalcs' or 'icacls.exe' are interchangeable and can be used by +either tool as the same file format is used. + +New options added are: + - '--save savefile' Saves DACLs in sddl format to file + - '--recurse' Performs the '--save' operation above on directory + and all files/directories below. + - '--restore savefile' Restores the stored DACLS to files in directory + +Samba-tool extensions for AD Claims, Authentication Policies and Silos +---------------------------------------------------------------------- + +samba-tool now allows users to be associated with claims. In the +Samba AD DC, claims derive from Active Directory attributes mapped +into specific names. These claims can be used in rules, which are +conditional ACEs in a security descriptor, that decide if a user is +restricted by an authentication policy. + +samba-tool also allows the creation and management of authentication +policies, which are rules about where a user may authenticate from, +if NTLM is permitted, and what services a user may authenticate to. + +Finally, support is added for the creation and management of +authentication silos, which are helpful in defining network boundaries +by grouping users and the services they connect to. + +Please note: The command line syntax for these tools is not final, and +may change before the next release, as we gain user feedback. The +syntax will be locked in once Samba offers 2016 AD Functional Level as +a default. + +AD DC support for Authentication Silos and Authentication Policies +------------------------------------------------------------------ + +The Samba AD DC now also honours any existing claims, authentication +policy and authentication silo configuration previously created (eg +from an import of a Microsoft AD), as well as new configurations +created with samba-tool. The use of Microsoft's Powershell based +client tools is not expected to work. + +To use this feature, the functional level must be set to 2012_R2 or +later with: + + ad dc functional level = 2016 + +in the smb.conf. + +The smb.conf file on each DC must have 'ad dc functional level = 2016' +set to have the partially complete feature available. This will also, +at first startup, update the server's own AD entry with the configured +functional level. + +For new domains, add these parameters to 'samba-tool provision' + +--option="ad dc functional level = 2016" --function-level=2016 + +The second option, setting the overall domain functional level +indicates that all DCs should be at this functional level. + +To raise the domain functional level of an existing domain, after +updating the smb.conf and restarting Samba run +samba-tool domain schemaupgrade --schema=2019 +samba-tool domain functionalprep --function-level=2016 +samba-tool domain level raise --domain-level=2016 --forest-level=2016 + +This support is still new, so is not enabled by default in this +release. The above instructions are set at 2016, which while not +complete, matches what our testing environment validates. + +Conditional ACEs and Resource Attribute ACEs +-------------------------------------------- + +Ordinary Access Control Entries (ACEs) unconditionally allow or deny +access to a given user or group. Conditional ACEs have an additional +section that describes conditions under which the ACE applies. If the +conditional expression is true, the ACE works like an ordinary ACE, +otherwise it is ignored. The condition terms can refer to claims, +group memberships, and attributes on the object itself. These +attributes are described in Resource Attribute ACEs that occur in the +object's System Access Control List (SACL). Conditional ACEs are +described in Microsoft documentation. + +Conditional ACE evaluation is controlled by the "acl claims +evaluation" smb.conf option. The default value is "AD DC only" which +enables them in AD DC settings. The other option is "never", which +disables them altogether. There is currently no option to enable them +on the file server (this is likely to change in future releases). + +The Security Descriptor Definition Language has extensions for +conditional ACEs and resource attribute ACEs; these are now supported +by Samba. + +Service Witness Protocol [MS-SWN] +--------------------------------- + +In a ctdb cluster it is now possible to provide +the SMB witness service that allows clients to +monitor their current smb connection to cluster +node A by asking cluster node B to notify the +client if the ip address from node A or the +whole node A becomes unavailable. + +For disk shares in a ctdb cluster +SMB2_SHARE_CAP_SCALEOUT is now always returned +for SMB3 tree connect responses. + +If the witness service is active +SMB2_SHARE_CAP_CLUSTER is now also returned. + +In order to activate the witness service +"rpc start on demand helpers = no" needs to +be configured in the global section. +At the same time the 'samba-dcerpcd' service +needs to be started explicitly, typically +with the '--libexec-rpcds' option in order +to make all available services usable. +One important aspect is that tcp ports +135 (for the endpoint mapper) and various +ports in the 'rpc server dynamic port range' +will be used to provide the witness service +(rpcd_witness). + +ctdb provides a '47.samba-dcerpcd.script' in order +to manage the samba-dcerpcd.service. +Typically as systemd service, but that's up +to the packager and/or admin. + +Please note that current windows client +requires SMB2_SHARE_CAP_CONTINUOUS_AVAILABILITY +in addition to SMB2_SHARE_CAP_CLUSTER in order +to make use of the witness service. +But SMB2_SHARE_CAP_CONTINUOUS_AVAILABILITY implies +the windows clients always ask for persistent handle +(which are not implemented in samba yet), so +that every open generates a warning in the +windows smb client event log. +That's why SMB2_SHARE_CAP_CONTINUOUS_AVAILABILITY +is not returned by default. +An explicit 'smb3 share cap:CONTINUOUS AVAILABILITY = yes' +is needed. + +There are also new 'net witness' commands in order +to let the admin list active client registrations +or ask specific clients to move their smb connection +to another cluster node. These are available: + + net witness list + net witness client-move + net witness share-move + net witness force-unregister + net witness force-response + +Consult 'man net' or 'net witness help' for further details. + + +REMOVED FEATURES +================ + +Get locally logged on users from utmp +------------------------------------- + +The Workstation Service Remote Protocol [MS-WKST] calls NetWkstaGetInfo +level 102 and NetWkstaEnumUsers level 0 and 1 return the list of locally +logged on users. Samba was getting the list from utmp, which is not +Y2038 safe. This feature has been completely removed and Samba will +always return an empty list. + + +smb.conf changes +================ + + Parameter Name Description Default + -------------- ----------- ------- + acl claims evaluation new AD DC only + smb3 unix extensions Per share - + smb3 share cap:ASYMMETRIC new no + smb3 share cap:CLUSTER new see 'man smb.conf' + smb3 share cap:CONTINUOUS AVAILABILITY new no + smb3 share cap:SCALE OUT new see 'man smb.conf' + + +Changes since 4.20.0rc4 +======================= + +o Douglas Bagnall <douglas.bagnall@catalyst.net.nz> + * BUG 15606: Avoid null-dereference with bad claims. + * BUG 15613: ndr_pull_security_ace can leave resource attribute ACE coda + claim struct undefined. + +o Ralph Boehme <slow@samba.org> + * BUG 15527: fd_handle_destructor() panics within an smbd_smb2_close() if + vfs_stat_fsp() fails in fd_close(). + +o Björn Jacke <bjacke@samba.org> + * BUG 15583: set_nt_acl sometimes fails with NT_STATUS_INVALID_PARAMETER - + openat() EACCES. + +o Noel Power <noel.power@suse.com> + * BUG 15527: fd_handle_destructor() panics within an smbd_smb2_close() if + vfs_stat_fsp() fails in fd_close(). + +o Andreas Schneider <asn@samba.org> + * BUG 15599: libgpo: Segfault in python bindings. + +o Jo Sutton <josutton@catalyst.net.nz> + * BUG 15607: Samba AD is missing some authentication policy tests. + + +CHANGES SINCE 4.20.0rc3 +======================= + +o Andreas Schneider <asn@samba.org> + * BUG 15588: samba-gpupdate: Correctly implement site support. + + +CHANGES SINCE 4.20.0rc2 +======================= + +o Rob van der Linde <rob@catalyst.net.nz> + * BUG 15575: Remove unsupported "Final" keyword missing from Python 3.6. + +o Stefan Metzmacher <metze@samba.org> + * BUG 15577: Additional witness backports for 4.20.0. + +o Noel Power <noel.power@suse.com> + * BUG 15579: Error output with wspsearch. + +o Martin Schwenke <mschwenke@ddn.com> + * BUG 15580: Packet marshalling push support missing for + CTDB_CONTROL_TCP_CLIENT_DISCONNECTED and + CTDB_CONTROL_TCP_CLIENT_PASSED. + +o Jo Sutton <josutton@catalyst.net.nz> + * BUG 15575: Remove unsupported "Final" keyword missing from Python 3.6. + + +CHANGES SINCE 4.20.0rc1 +======================= + +o Douglas Bagnall <douglas.bagnall@catalyst.net.nz> + * BUG 15574: Performance regression for NDR parsing of security descriptors. + +o Anoop C S <anoopcs@samba.org> + * BUG 15565: Build and install man page for wspsearch client utility. + +o Andreas Schneider <asn@samba.org> + * BUG 15558: samba-gpupdate logging doesn't work. + + +KNOWN ISSUES +============ + +https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.20#Release_blocking_bugs + + +####################################### +Reporting bugs & Development Discussion +####################################### + +Please discuss this release on the samba-technical mailing list or by +joining the #samba-technical:matrix.org matrix room, or +#samba-technical IRC channel on irc.libera.chat + +If you do report problems then please try to send high quality +feedback. If you don't provide vital information to help us track down +the problem then you will probably be ignored. All bug reports should +be filed under the Samba 4.1 and newer product in the project's Bugzilla +database (https://bugzilla.samba.org/). + + +====================================================================== +== Our Code, Our Bugs, Our Responsibility. +== The Samba Team +====================================================================== + |