After 6 months of development, the release of Samba 4.25.0 has been presented, continuing the development of the Samba 4 branch with a full implementation of the domain controller and Active Directory service, compatible with the Windows Server implementation and capable of servicing all supported Microsoft versions of Windows clients, including Windows 11. Samba 4 is a multifunctional server product that also provides a file server implementation, printing service, and identity server (winbind). The project's code is written in C and is distributed under the GPLv3 license.
Key changes in Samba 4.25:
- Experimental support for persistent file handles (SMB2_CAP_PERSISTENT_HANDLES) has been added to the SMB3 protocol implementation, allowing clients to continue working with open files after a network connection drop, restart server or failover to a backup server. Persistent handles allow files to remain open after a server failure, which is especially relevant when hosting virtual machines and cluster databases on the file system. server To operate, exclusive access to the SMB storage must be provided, and the settings for 'kernel oplocks', 'kernel share modes', and 'posix locking' must be disabled, which compromises compatibility with POSIX and NFS, and significantly reduces performance due to synchronous metadata writing to disk with each operation. Two fault tolerance modes are proposed: full_outage (default) — a local backup of the state is created, allowing handles to be preserved even after a complete cluster failure, but increasing load; partial_outage — faster operation without a backup, but handles are lost if all cluster nodes fail simultaneously.
A VFS module vfs_aio_ratelimit has been added, allowing a rate limit for request intensity to be set, which applies across the entire cluster rather than being tied to individual nodes. To coordinate global enforcement of limits, a background process ratelimitd must be running on each node, aggregating the activity of all smbd processes on the node and transmitting information to other cluster nodes. Enabling vfs_aio_ratelimit is done at the build stage by specifying the '--with-ratelimitd' option.
- Добавлен VFS-модуль vfs_aio_ratelimit, позволяющий задать ограничение интенсивности запросов (rate limit), действующее в контексте всего кластера, а не только в привязке к отдельным узлам. Для координации глобального применения ограничений на каждом узле должен быть запущен фоновый процесс ratelimitd, агрегирующий активность всех процессов smbd на узле и передающий информацию на другие узлы кластера. Включение vfs_aio_ratelimit осуществляется на этапе сборки через указание опции «—with-ratelimitd».
- The VFS module vfs_ceph_rgw for Ceph RGW (Object Gateway) has been added, enabling data export from the Ceph Object Gateway as an SMB storage with a hierarchical representation of stored objects in the form of regular files and directories, featuring access control at the POSIX uid/gid level.
- Cluster functionality levels similar to those in Active Directory forests have been implemented, allowing for rolling upgrades of nodes within the cluster. Database formats and internal message exchange formats that affect node interaction are only modified after an explicit upgrade for the entire cluster, ensuring compatibility of nodes with different Samba versions during the upgrade. Management is performed through the commands 'net clusterlevel features|show|showall|upgrade'. domain For domain encryption by default, the algorithms aes128-cts-hmac-sha1-96 and aes256-cts-hmac-sha1-96 are used for domains with a functionality level of 2008 and above. This change mitigates the vulnerability CVE-2026-20833, caused by the use of insecure encryption methods in Windows Kerberos.
- In CTDB, files with locks, PID, and sockets have been moved to the ctdb/ subdirectories. The initialization script ctdb.init has been relocated to ctdb/doc/examples. Host monitoring support has been added for hosts such as DNS servers. The detect_init_style() function and the CTDB_INIT_STYLE variable have been deprecated (it is recommended to use CTDB_PLATFORM_STYLE instead).
- After 6 months of development, Samba 4.25.0 has been released, continuing the Samba 4 branch with a full implementation of a domain controller and Active Directory service compatible with Windows Server.
Source: opennet.ru
