mirror of
https://github.com/samba-team/samba.git
synced 2024-12-23 17:34:34 +03:00
182 lines
6.9 KiB
Plaintext
182 lines
6.9 KiB
Plaintext
What's new in Samba 4 alpha17
|
|
=============================
|
|
|
|
Samba 4.0 will be the next version of the Samba suite and incorporates
|
|
all the technology found in both the Samba4 alpha series and the
|
|
stable 3.x series. The primary additional features over Samba 3.6 are
|
|
support for the Active Directory logon protocols used by Windows 2000
|
|
and above.
|
|
|
|
WARNINGS
|
|
========
|
|
|
|
Samba4 alpha17 is not a final Samba release, however we are now making
|
|
good progress towards a Samba 4.0 release, of which this is a preview.
|
|
Be aware the this release contains both the technology of Samba 3.6
|
|
(that you can reasonably expect to upgrade existing Samba 3.x releases
|
|
to) and the AD domain controller work previously known as 'samba4'.
|
|
|
|
While binaries for the stable file server are provided in this
|
|
release, for a stable, supported file server, Samba3 domain or AD
|
|
domain member installation, please run a Samba 3.x release, as we are
|
|
still bedding down the new single build system.
|
|
|
|
Samba4 is subjected to an awesome battery of tests on an automated
|
|
basis, we have found Samba 4.0 to be very stable in it's behavior.
|
|
However, we still recommend against upgrading production servers from
|
|
Samba 3.x release to Samba 4.0 alpha at this stage.
|
|
|
|
If you are upgrading, or looking to develop, test or deploy Samba 4.0
|
|
alpha releases, you should backup all configuration and data.
|
|
|
|
NEW FEATURES
|
|
============
|
|
|
|
Samba 4.0 alpha supports the server-side of the Active Directory logon
|
|
environment used by Windows 2000 and later, so we can do full domain
|
|
join and domain logon operations with these clients.
|
|
|
|
Our Domain Controller (DC) implementation includes our own built-in
|
|
LDAP server and Kerberos Key Distribution Center (KDC) as well as the
|
|
Samba3-like logon services provided over CIFS. We correctly generate
|
|
the infamous Kerberos PAC, and include it with the Kerberos tickets we
|
|
issue.
|
|
|
|
Samba 4.0 alpha ships with two distinct file servers. The file server
|
|
from the Samba 3.x series is 'smbd', and works with the binaries users
|
|
would expect from that series (nmbd, winbindd, smbpasswd).
|
|
|
|
Samba 4.0 also ships with a new file server, which is tuned to match
|
|
the requirements of an AD domain controller. Users should not use the
|
|
file server in the 'samba' binary for non-DC related tasks.
|
|
|
|
A new scripting interface has been added to Samba 4, allowing Python
|
|
programs to interface to Samba's internals, and many tools and
|
|
internal workings of the DC code is now implemented in python.
|
|
|
|
|
|
CHANGES SINCE alpha16
|
|
=====================
|
|
|
|
For a list of changes since alpha 15, please see the git log.
|
|
|
|
$ git clone git://git.samba.org/samba.git
|
|
$ cd samba.git
|
|
$ git log release-4-0-0alpha16..release-4-0-0alpha17
|
|
|
|
Some major user-visible changes include:
|
|
|
|
samba-tool dbcheck
|
|
------------------
|
|
|
|
We now have an fsck-like tool for Samba's internal sam.ldb database.
|
|
Run samba-tool dbcheck after installation to check your database for
|
|
self-consistency. Any database created with a previous Samba4 alpha
|
|
will have a very large number of consistency errors, which this tool
|
|
can fix.
|
|
|
|
See also the -H option to point dbcheck at a different database to the
|
|
default, and the --fix and --yes options to make changes and to not
|
|
prompt about those changes.
|
|
|
|
After upgrading Samba, it is suggested that you do the following:
|
|
|
|
- stop samba
|
|
- take a backup copy of your sam.ldb and sam.ldb.d/* database files
|
|
- run samba-tool dbcheck --cross-ncs --fix
|
|
- use 'all' to say yes to fixing each type of error found
|
|
- after it has finished, run dbcheck again to ensure it reports no
|
|
errors
|
|
|
|
There will be a lot of errors fixed, particularly related to
|
|
bad/missing GUID values. This is due to a bug in previous releases
|
|
that left many objects with bad GUID values. These can all be fixed
|
|
using dbcheck with steps above.
|
|
|
|
|
|
New default paths
|
|
-----------------
|
|
|
|
The configure options for paths have changed again, and the
|
|
--enable-fhs option has been reinstated. Packagers should attempt to
|
|
first package Samba using:
|
|
|
|
./configure --enable-fhs --prefix=/usr --sysconfdir=/etc --localstatedir=/var
|
|
|
|
and only after examining the location Samba uses with these options
|
|
should further changes be made. Existing packaging scripts are not
|
|
expected to work unmodified, instead the Samba Team's aim is to
|
|
simplify such scripts for the long term.
|
|
|
|
samba-tool domain samba3upgrade
|
|
-------------------------------
|
|
|
|
The new samba-tool domain samba3upgrade command is a supported upgrade route from Samba
|
|
3.x domain controllers to Samba 4.0 AD domain controllers. This
|
|
provides a one-time migration of all users, domain members, passwords,
|
|
groups, group members and account polcies.
|
|
|
|
This tool is still under development and may fail when presented with
|
|
an inconsistant Samba3 database (such as many LDAP configurations).
|
|
We hope to improve the error handling and recovery in these
|
|
situations, so please provide feedback using the samba-technical
|
|
mailing list.
|
|
|
|
KNOWN ISSUES
|
|
============
|
|
|
|
- Installation on systems without a system iconv (and developer
|
|
headers at compile time) is known to cause errors when dealing with
|
|
non-ASCII characters.
|
|
|
|
- In some situations, group members may not be upgraded by the
|
|
samba-tool domain upgrade_from_s3 script
|
|
|
|
- The samba-tool domain join script will not join Windows 2000 domains.
|
|
|
|
- Domain member support in the 'samba' binary is in it's infancy, and
|
|
is not comparable to the support found in winbindd. As such, do not
|
|
use the 'samba' binary (provided for the AD server) on a member
|
|
server.
|
|
|
|
- There is no printing support in the 'samba' binary (use smbd instead)
|
|
|
|
- There is no NetBIOS browsing support (network neighbourhood) in the
|
|
'samba' binary (use nmbd and smbd instead)
|
|
|
|
- Clock Synchronisation is critical. Many 'wrong password' errors are
|
|
actually due to Kerberos objecting to a clock skew between client
|
|
and server. (The NTP work in the previous alphas are partly to assist
|
|
with this problem).
|
|
|
|
- The DRS replication code may fail. Please contact the team if you
|
|
experience issues with DRS replication, as we have fixed many issues
|
|
here in response to feedback from our production users.
|
|
|
|
RUNNING Samba 4.0 as an AD DC
|
|
=============================
|
|
|
|
A short guide to setting up Samba 4 as an AD DC can be found on the wiki:
|
|
|
|
http://wiki.samba.org/index.php/Samba4/HOWTO
|
|
|
|
#######################################
|
|
Reporting bugs & Development Discussion
|
|
#######################################
|
|
|
|
Please discuss this release on the samba-technical mailing list or by
|
|
joining the #samba-technical IRC channel on irc.freenode.net.
|
|
|
|
If you do report problems then please try to send high quality
|
|
feedback. If you don't provide vital information to help us track down
|
|
the problem then you will probably be ignored. All bug reports should
|
|
be filed under the Samba 4.0 product in the project's Bugzilla
|
|
database (https://bugzilla.samba.org/).
|
|
|
|
|
|
======================================================================
|
|
== Our Code, Our Bugs, Our Responsibility.
|
|
== The Samba Team
|
|
======================================================================
|
|
|