mirror of
https://github.com/samba-team/samba.git
synced 2024-12-24 21:34:56 +03:00
1fd927136b
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
204 lines
6.9 KiB
Plaintext
204 lines
6.9 KiB
Plaintext
Release Announcements
|
|
=====================
|
|
|
|
This is the first preview release of Samba 4.5. This is *not*
|
|
intended for production environments and is designed for testing
|
|
purposes only. Please report any defects via the Samba bug reporting
|
|
system at https://bugzilla.samba.org/.
|
|
|
|
Samba 4.5 will be the next version of the Samba suite.
|
|
|
|
|
|
UPGRADING
|
|
=========
|
|
|
|
NTLMv1 authentication disabled by default
|
|
-----------------------------------------
|
|
|
|
In order to improve security we have changed
|
|
the default value for the "ntlm auth" option from
|
|
"yes" to "no". This may have impact on very old
|
|
client which doesn't support NTLMv2 yet.
|
|
|
|
The primary user of NTLMv1 is MSCHAPv2 for VPNs and 802.1x.
|
|
|
|
By default Samba will only allow NTLMv2 via NTLMSSP now,
|
|
as we have the following default "lanman auth = no",
|
|
"ntlm auth = no" and "raw NTLMv2 auth = no".
|
|
|
|
|
|
NEW FEATURES/CHANGES
|
|
====================
|
|
|
|
Support for LDAP_SERVER_NOTIFICATION_OID
|
|
----------------------------------------
|
|
|
|
The ldap server has support for the LDAP_SERVER_NOTIFICATION_OID
|
|
control. This can be used to monitor the active directory database
|
|
for changes.
|
|
|
|
KCC improvements for sparse network replication
|
|
-----------------------------------------------
|
|
|
|
The Samba KCC will now be the default knowledge consistency checker in
|
|
Samba AD. Instead of using full mesh replication between every DC, the
|
|
KCC will set up connections to optimize replication latency and cost
|
|
(using site links to calculate the routes). This change should allow
|
|
larger domains to function significantly better in terms of replication
|
|
traffic and the time spent performing DRS replication.
|
|
|
|
VLV - Virtual List View
|
|
-----------------------
|
|
|
|
The VLV Control allows applications to page the LDAP directory in the
|
|
way you might expect a live phone book application to operate, without
|
|
first downloading the entire directory.
|
|
|
|
DRS Replication for the AD DC
|
|
-----------------------------
|
|
|
|
DRS Replication in Samba 4.5 is now much more efficient in handling
|
|
linked attributes, particularly in large domains with over 1000 group
|
|
memberships or other links.
|
|
|
|
Replication is also much more reliable in the handling of tree
|
|
renames, such as the rename of an organizational unit containing many
|
|
users. Extensive tests have been added to ensure this code remains
|
|
reliable, particularly in the case of conflicts between objects added
|
|
with the same name on different servers.
|
|
|
|
Schema updates are also handled much more reliably.
|
|
|
|
replPropertyMetaData Changes
|
|
----------------------------
|
|
|
|
During the development of the DRS replication, tests showed that Samba
|
|
stores the replPropertyMetaData object incorrectly. To address this,
|
|
be aware that dbcheck will now detect and offer to fix all objects in
|
|
the domain for this error.
|
|
|
|
Linked attributes on deleted objects
|
|
------------------------------------
|
|
|
|
In Active Directory, an object that has been tombstoned or recycled
|
|
has no linked attributes. However, Samba incorrectly maintained such
|
|
links, slowing replication and run-time performance. dbcheck now
|
|
offers to remove such links, and they are no longer kept after the
|
|
object is tombstoned or recycled.
|
|
|
|
Improved AD DC performance
|
|
--------------------------
|
|
|
|
Many other improvements have been made to our LDAP database layer in
|
|
the AD DC, to improve performance, both during samba-tool domain
|
|
provision and at runtime.
|
|
|
|
Other dbcheck improvements
|
|
--------------------------
|
|
|
|
- samba-tool dbcheck can now find and fix a missing or corrupted
|
|
'deleted objects' container.
|
|
- BUG 11433: samba-dbcheck no longer offers to resort auxiliary class values
|
|
in objectClass as these were then re-sorted at the next dbcheck indefinitely.
|
|
|
|
Tombstone Reanimation
|
|
---------------------
|
|
|
|
Samba now supports tombstone reanimation, a feature in the AD DC
|
|
allowing tombstones, that is objects which have been deleted, to be
|
|
restored with the original SID and GUID still in place.
|
|
|
|
Multiple DNS Forwarders on the AD DC
|
|
------------------------------------
|
|
|
|
Multiple DNS forwarders are now supported on the AD DC, allowing
|
|
samba to fall back between two different DNS servers for forwarded queries.
|
|
|
|
Password quality plugin support in the AD DC
|
|
--------------------------------------------
|
|
|
|
The check password script now operates correctly in the AD DC (this
|
|
was silently ignored in past releases)
|
|
|
|
pwdLastSet is now correctly honoured
|
|
------------------------------------
|
|
|
|
BUG 9654: the pwdLastSet attribute is now correctly handled (this previously
|
|
permitted passwords that next expire).
|
|
|
|
net ads dns unregister
|
|
----------------------
|
|
|
|
It is now possible to remove the DNS entries created with 'net ads register'
|
|
with the matching 'net ads unregister' command.
|
|
|
|
Samba-tool improvements
|
|
------------------------
|
|
|
|
Running samba-tool on the command line should now be a lot snappier. The tool
|
|
now only loads the code specific to the subcommand that you wish to run.
|
|
|
|
SMB 2.1 Leases enabled by default
|
|
---------------------------------
|
|
|
|
Leasing is an SMB 2.1 (and higher) feature which allows clients to
|
|
aggressively cache files locally above and beyond the caching allowed
|
|
by SMB 1 oplocks. This feature was disabled in previous releases, but
|
|
the SMB2 leasing code is now considered mature and stable enough to be
|
|
enabled by default.
|
|
|
|
Open File Description (OFD) Locks
|
|
---------------------------------
|
|
|
|
On systems that support them (currently only Linux), the fileserver now
|
|
uses Open File Description (OFD) locks instead of POSIX locks to implement
|
|
client byte range locks. As these locks are associated with a specific
|
|
file descriptor on a file this allows more efficient use when multiple
|
|
descriptors having file locks are opened onto the same file. An internal
|
|
tunable "smbd:force process locks = true" may be used to turn off OFD
|
|
locks if there appear to be problems with them.
|
|
|
|
REMOVED FEATURES
|
|
================
|
|
|
|
only user and username parameters
|
|
---------------------------------
|
|
These two parameters have long been deprecated and superseded by
|
|
"valid users" and "invalid users".
|
|
|
|
smb.conf changes
|
|
----------------
|
|
|
|
Parameter Name Description Default
|
|
-------------- ----------- -------
|
|
ntlm auth Changed default no
|
|
only user Removed
|
|
username Removed
|
|
kccsrv:samba_kcc Changed default true
|
|
smb2 leases Changed default yes
|
|
|
|
KNOWN ISSUES
|
|
============
|
|
|
|
Currently none.
|
|
|
|
#######################################
|
|
Reporting bugs & Development Discussion
|
|
#######################################
|
|
|
|
Please discuss this release on the samba-technical mailing list or by
|
|
joining the #samba-technical IRC channel on irc.freenode.net.
|
|
|
|
If you do report problems then please try to send high quality
|
|
feedback. If you don't provide vital information to help us track down
|
|
the problem then you will probably be ignored. All bug reports should
|
|
be filed under the Samba 4.1 and newer product in the project's Bugzilla
|
|
database (https://bugzilla.samba.org/).
|
|
|
|
|
|
======================================================================
|
|
== Our Code, Our Bugs, Our Responsibility.
|
|
== The Samba Team
|
|
======================================================================
|
|
|