1
0
mirror of https://github.com/samba-team/samba.git synced 2025-03-01 04:58:35 +03:00

1241 Commits

Author SHA1 Message Date
Stefan Metzmacher
5bd1f11c6b samba: tag release samba-4.3.8
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iD8DBQBXC2bnbzORW2Vot+oRAiYAAKC4rM1pUHsIfbckQXtS0ZCmyAnGKwCfRmF/
 lHnUYxf3dzXuc0fGfoWgcfM=
 =JLuc
 -----END PGP SIGNATURE-----

Merge tag 'samba-4.3.8' into v4-3-test

samba: tag release samba-4.3.8

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2016-04-12 21:12:44 +02:00
Stefan Metzmacher
e9718e2b40 CVE-2016-2118: docs-xml: default "allow dcerpc auth level connect" to "no"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11616

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2016-03-30 04:18:52 +02:00
Stefan Metzmacher
979067f6a3 CVE-2016-2118: docs-xml: add "allow dcerpc auth level connect" defaulting to "yes"
We sadly need to allow this for now by default.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11616

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-03-30 04:18:48 +02:00
Stefan Metzmacher
fa2630fad5 CVE-2016-2115: docs-xml: always default "client ipc signing" to "mandatory"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11756

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2016-03-30 04:18:12 +02:00
Stefan Metzmacher
668cc85770 CVE-2016-2115: docs-xml: add "client ipc signing" option
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11756

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2016-03-30 04:18:10 +02:00
Stefan Metzmacher
2f7d773829 CVE-2016-2115: docs-xml: add "client ipc min protocol" and "client ipc max protocol" options
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11796

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2016-03-30 04:18:06 +02:00
Stefan Metzmacher
25b05a8e57 CVE-2016-2114: docs-xml: let the "smb signing" documentation reflect the reality
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11687

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-03-30 04:17:39 +02:00
Stefan Metzmacher
641cbccc95 CVE-2016-2113: docs-xml: let "tls verify peer" default to "as_strict_as_possible"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11752

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2016-03-30 04:17:29 +02:00
Stefan Metzmacher
fc026680ed CVE-2016-2113: docs-xml: add "tls verify peer" option defaulting to "no_check"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11752

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-03-30 04:17:25 +02:00
Stefan Metzmacher
104a6911c9 CVE-2016-2112: docs-xml: change the default of "ldap server require strong auth" to "yes"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2016-03-29 16:27:25 +02:00
Stefan Metzmacher
b0125355c7 CVE-2016-2112: docs-xml: add "ldap server require strong auth" option
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-03-29 16:27:03 +02:00
Stefan Metzmacher
60647fac98 CVE-2016-2111: docs-xml/smbdotconf: default "raw NTLMv2 auth" to "no"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11749

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2016-03-29 16:26:31 +02:00
Stefan Metzmacher
3dbb32c996 CVE-2016-2111: docs-xml: add "raw NTLMv2 auth" defaulting to "yes"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11749

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-03-29 16:26:29 +02:00
Stefan Metzmacher
eaabdc1219 CVE-2016-2111: docs-xml: document the new "client NTLMv2 auth" and "client use spnego" interaction
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11749

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2016-03-29 16:26:28 +02:00
Berend De Schouwer
89b13fea7b docs: Add example for domain logins to smbspool man page.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11643

Reviewed-by: Karolin Seeger <kseeger@samba.org>
2016-02-22 11:19:12 +01:00
Günther Deschner
f1d03419b7 docs-xml: fix typo in smbspool_krb5_wrapper manpage.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 109164ed63ee76c4088f5df7ffb66740cac629c1)

Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Tue Feb  9 12:03:49 CET 2016 on sn-devel-104
2016-02-09 12:03:49 +01:00
Andreas Schneider
4c7f237b8e docs: Add smbspool_krb5_wrapper manpage
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11690

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Karolin Seeger <kseeger@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Feb  3 21:25:54 CET 2016 on sn-devel-144

(cherry picked from commit 4c54901102440ba9cbd96b349e95e3127415614a)
2016-02-09 08:55:20 +01:00
Karolin Seeger
a1774eb488 docs: Fix typos in man vfs_gpfs.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11641
Duplicate "acl map full control" entry in man vfs_gpfs

Signed-off-by: Karolin Seeger <kseeger@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 79df4caed3b819cc1cd67c4033f3ac700086ab99)

Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Fri Dec 18 13:30:04 CET 2015 on sn-devel-104
2015-12-18 13:30:04 +01:00
Karolin Seeger
392b2d33f2 docs: Fix some typos in the idmap backend section.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Nov 26 14:47:17 CET 2015 on sn-devel-104

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11619

(cherry picked from commit 257ec9c6e28b1ddc32bd554ff8259f8a067dd44e)

Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Wed Dec  2 13:29:25 CET 2015 on sn-devel-104
2015-12-02 13:29:25 +01:00
Michael Adam
0230180dbf doc: fix a typo in the smb.conf manpage, explanation of idmap config
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Fri Nov  6 06:26:34 CET 2015 on sn-devel-104

(cherry picked from commit c6ae462a020648c851fe6f6724ae9cf32c9d0ab8)
2015-12-02 10:23:16 +01:00
YvanM
c2b3914de6 manpage: corrected small typo error
Corrected mistakes, probably comming from a too fast
"copy and paste", in the smb.conf manpage.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11584

Signed-off-by: YvanM <yvan.masson@openmailbox.org>
Reviewed-by: Björn Jacke <bj@sernet.de>
Reviewed-by: Karolin Seeger <kseeger@samba.org>

Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Mon Nov  2 14:43:15 CET 2015 on sn-devel-104

(cherry picked from commit d66863b1fff862aa2ae21a06116bc2a2b2f7a6ce)
2015-11-05 11:48:14 +01:00
Martin Schwenke
d87877251a doc: Fix documentation for "ctdb timeout" parameter
The documentation claims this is specified in seconds.  However, it is
passed straight through to poll(2), which takes a timeout in
milliseconds.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Jul 20 15:47:43 CEST 2015 on sn-devel-104
2015-07-20 15:47:43 +02:00
Karolin Seeger
01ed85ceca docs: Bump version up to 4.3.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Jul 20 06:11:53 CEST 2015 on sn-devel-104
2015-07-20 06:11:53 +02:00
Andrew Bartlett
06f378fa65 lib/tls: Change default supported TLS versions.
The new default is to disable SSLv3, as this is no longer considered
secure after CVE-2014-3566.  Newer GnuTLS versions already disable SSLv3.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
2015-07-20 03:08:26 +02:00
Andrew Bartlett
374d73617d lib/tls: Add new 'tls priority' option
This adds a new option to the smb.conf to allow administrators to disable
TLS protocols in GnuTLS without changing the code.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11076
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2015-07-20 03:08:26 +02:00
Uri Simchoni
03282bfd41 doc: clarify "winbind max clients"
Add clarification about the nature of "winbind max clients" parameter.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11397

Signed-off-by: Uri Simchoni <urisimchoni@gmail.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-15 22:41:13 +02:00
Michael Adam
7105bd370a docs:smb.conf: fix typo in 'smb encrypt' text.
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Wed Jul 15 22:40:54 CEST 2015 on sn-devel-104
2015-07-15 22:40:54 +02:00
Andreas Schneider
e736a169d5 docs: Documents length limitations for NetBIOS name
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11401

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Jul 15 19:35:48 CEST 2015 on sn-devel-104
2015-07-15 19:35:48 +02:00
Jeremy Allison
eeddeba8b5 docs: Document new scopy command.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2015-07-14 13:04:17 +02:00
Uri Simchoni
6cff239a1e docs: Correct list of supported socket options
Bring the list of supported socket options in smb.conf in sync
with the code

Signed-off-by: Uri Simchoni <urisimchoni@gmail.com>
Reviewed-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jul  9 03:48:13 CEST 2015 on sn-devel-104
2015-07-09 03:48:13 +02:00
Stefan Metzmacher
cab82ebda7 samba-tool: add 'domain trust *' commands
Available subcommands:
  create      - Create a domain or forest trust.
  delete      - Delete a domain trust.
  list        - List domain trusts.
  namespaces  - Manage forest trust namespaces.
  show        - Show trusted domain details.
  validate    - Validate a domain trust.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2015-07-08 18:38:22 +02:00
Volker Lendecke
730b025d7b smbd: Remove the notify_fam module
This has been moved to main smbd

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-07 23:51:24 +02:00
Volker Lendecke
a24f0379ac param: Make "kernel change notify" global
With a central notifyd, we can't do this per share anymore. Notifyd will
only look at absolute paths, not shares.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-07 23:51:24 +02:00
Volker Lendecke
e5895c3c37 param: Make "change notify" global
With a central notifyd, we can't do this per share anymore. Notifyd will
only look at absolute paths, not shares.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-07 23:51:23 +02:00
Ralph Boehme
e0edda7311 s3-mdssvc: add documentation for mdssvc and mdssd
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-07-07 17:34:28 +02:00
Ralph Boehme
25f56f5f40 s3-mdssvc: add new option 'spotlight'
Per share option: it reflects whether a share is indexed by Tracker or
not. The global switch that controls whether Spotlight is enabled or
not, are the mdsvc RPC switches.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-07-07 17:34:28 +02:00
Michael Adam
365d9d8bdf docs:smb.conf: explain effect of new setting 'desired' of smb encrypt
Thereby clarify some details.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11372

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2015-07-07 14:05:28 +02:00
Volker Lendecke
589de04178 docs: Document smbclient "notify" command
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Jul  3 18:30:21 CEST 2015 on sn-devel-104
2015-07-03 18:30:21 +02:00
Ralph Boehme
6fd351f23b vfs:fruit: implement copyfile style copy_chunk
Implement Apple's special copy_chunk ioctl that requests a copy of the
whole file along with all attached metadata.

These copy_chunk requests have a chunk count of 0 that we translate to a
copy_chunk_send VFS call overloading the parameters src_off = dest_off =
num = 0.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11317

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-06-23 11:45:23 +02:00
Christof Schmitt
8406d4dd15 docs-xml: Update sharesec manpage to reflect current output
Update the sharesec man page to reflect the output currently used, and
also add a note that the OWNER and GROUP fields are not used for share
ACLs.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11324

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Jun 17 13:36:23 CEST 2015 on sn-devel-104
2015-06-17 13:36:23 +02:00
Christof Schmitt
b73121f383 docs: Add missing SRVSVC entries in rpcclient manpage
Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Jun 12 12:39:08 CEST 2015 on sn-devel-104
2015-06-12 12:39:08 +02:00
Ralph Boehme
b26a1449a0 vfs_fruit: add option veto_appledouble
vfs_fruit adds a wildcard path "._*" to the vetolist in order to prevent
client access to ._ AppleDouble files created internally by vfs_fruit
for storing the Mac resource fork stream.

Unfortunately there are legitimite use cases where an OS X client may
want to use such filenames, extracting ZIP archives (where the archive
contains ._ files) being one of them.

A possible simple solution to this problem would be to not veto ._ files
in the first place, even though that exposes internally created ._ files
which the client shouldn't be able to access.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11305

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Tue Jun  9 14:48:14 CEST 2015 on sn-devel-104
2015-06-09 14:48:12 +02:00
Christof Schmitt
07211343d4 docs: Reference ldap ssl options in idmap_rfc2307 manpage
Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Fri Jun  5 14:18:01 CEST 2015 on sn-devel-104
2015-06-05 14:18:01 +02:00
Ralph Boehme
1b8a0e6a26 vfs_fruit: add option "nfs_aces" that controls the NFS ACEs stuff
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11213

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-05-08 18:38:14 +02:00
Stefan Metzmacher
684c711665 smbd: Offer SMB 3.1.1 by default.
Pair-Programmed-With: Michael Adam <obnox@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Fri May  8 15:49:32 CEST 2015 on sn-devel-104
2015-05-08 15:49:32 +02:00
Stefan Metzmacher
8a56fab24d s3:smb2_negprot: add support for negotiating SMB 3.1.0 and SMB 3.1.1
Note: SMB 3.1.0 was used in a early preview versions of Windows 10.
Was later superseded by 3.1.1.

Pair-Programmed-With: Michael Adam <obnox@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
2015-05-08 13:00:28 +02:00
Michael Adam
f424f8d1c2 smbd: offer SMB 3.0.2 by default.
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2015-05-08 13:00:28 +02:00
Stefan Metzmacher
02b223ced3 s3:smb2_negprot: add support for negotiating SMB 3.0.2
Pair-Programmed-With: Michael Adam <obnox@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Michael Adam <obnox@samba.org>
2015-05-08 13:00:28 +02:00
Stefan Metzmacher
a554f02bc1 libcli/smb: add PROTOCOL_SMB3_11 and SMB3_DIALECT_REVISION_311
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2015-05-08 13:00:28 +02:00
Michael Adam
26ad4b368d docs: remove swat specific flags from the DTD
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Sat May  2 03:33:08 CEST 2015 on sn-devel-104
2015-05-02 03:33:07 +02:00