The release of Samba 4.15.0 has been introduced, continuing the development of the Samba 4 branch with a fully implemented domain controller and Active Directory service compatible with the Windows 2000 implementation, capable of servicing all supported Microsoft versions of Windows clients, including Windows 10. Samba 4 is a multifunctional server product that also provides file server implementation, printing service, and identity server (winbind).
Key changes in Samba 4.15:
- The modernization of the VFS layer has been completed. For historical reasons, the code implementing the file server was tied to file path handling, which was also applied for the SMB2 protocol, converted to use descriptors. The modernization involved converting the code that ensures access to the server's file system to use file descriptors instead of file paths (for example, using the fstat() call instead of stat() and SMB_VFS_FSTAT() instead of SMB_VFS_STAT()).
- The implementation of the BIND DLZ (Dynamically-loaded zones) technology, which allows clients to send DNS zone transfer requests to the BIND server and receive responses from Samba, has been enhanced with the possibility to define access lists that determine which clients are allowed to make such requests and which are not. Support for Bind versions 9.8 and 9.9 has been discontinued in the DLZ DNS plugin.
- Support for SMB3 Multi-Channel has been enabled by default and stabilized, allowing clients to establish multiple connections to parallelize data transmission within a single SMB session. For example, when accessing a single file, input/output operations can be distributed across several open connections. This mode increases throughput and enhances fault tolerance. To disable SMB3 Multi-Channel in smb.conf, the 'server multi channel support' option must be changed, which is now enabled by default on Linux and FreeBSD platforms.
- The ability to use the samba-tool command in Samba configurations built without Active Directory domain controller support (when specifying the '—without-ad-dc' option) has been provided. However, in this case, not all functionality is available; for example, the capabilities of the 'samba-tool domain' command are limited.
- The command line interface has been improved: A new command line options parser has been introduced, utilized in various samba utilities. Similar options that differed across various utilities have been unified, for instance, the handling of options related to encryption, digital signatures, and the use of kerberos has been standardized. Settings for specifying default option values are defined in smb.conf. STDERR is now used for error output across all utilities (the option ‘—debug-stdout’ was introduced for outputting to STDOUT).
The option ‘—client-protection=off|sign|encrypt’ has been added.
Options have been renamed: —kerberos -> —use-kerberos=required|desired|off —krb5-ccache -> —use-krb5-ccache=CCACHE —scope -> —netbios-scope=SCOPE —use-ccache -> —use-winbind-ccache
The options ‘-e|—encrypt’ and ‘-S|—signing’ have been removed.
Clean-up of duplicate options in the utilities ldbadd, ldbdel, ldbedit, ldbmodify, ldbrename, ldbsearch, ndrdump, net, sharesec, smbcquotas, nmbd, smbd, and winbindd has been conducted.
- By default, scanning of the trusted domain list when starting winbindd is disabled, which was relevant during NT4 times but is not applicable to Active Directory.
- Support for the ODJ (Offline Domain Join) mechanism has been added, which allows a computer to join domain without direct access to the domain controller. In Unix-like OS based on Samba, the command ‘net offlinejoin’ is suggested for joining, while in Windows, the built-in program djoin.exe can be used.
- In the command ‘samba-tool dns zoneoptions’, options for setting the update interval and managing the cleaning of outdated DNS records have been implemented. When all records for a DNS name are deleted, the node is transitioned to a deleted state (‘tombstone’).
- DCE/RPC DNS servers can now be used by the samba-tool utility and Windows utilities to manipulate DNS records externally. server.
- When executing the command ‘samba-tool domain backup offline’, proper locking of the LMDB database is ensured to protect against concurrent data modifications during backup.
- Support for experimental SMB protocol dialects — SMB2_22, SMB2_24, and SMB3_10, which were only used in test builds of Windows, has been discontinued.
- In builds with the experimental implementation of Active Directory based on MIT Kerberos, the requirements for this package version have been raised. Now, version MIT Kerberos 1.19 at a minimum is required for the build (provided in Fedora 34).
- Support for NIS has been removed.
- A vulnerability CVE-2021-3671 has been fixed, which allowed an unauthenticated user to crash the domain controller based on Heimdal KDC by sending a TGS-REQ packet without a server name specified.
Source: opennet.ru
