After 6 months of development, the release of Samba 4.25.0 has been announced, continuing the evolution of the Samba 4 branch with a complete implementation of a domain controller and Active Directory service compatible with the Windows Server implementation, capable of servicing all supported Microsoft versions of Windows clients, including Windows 11. Samba 4 is a multifunctional server product that also provides a file server implementation, printing service, and identity server (winbind). The project code is written in C and is distributed under the GPLv3 license.
Key changes in Samba 4.25:
- Experimental support for persistent file handles (SMB2_CAP_PERSISTENT_HANDLES) has been added to the SMB3 protocol implementation, allowing clients to continue working with opened files after a network connection drop, a restart server or a failover to a backup server. Persistent handles eliminate the need to reopen files after a server failure, which is especially relevant for hosting file server Samba virtual machines and clustered databases.
Exclusive access to the SMB storage must be provided, and the settings for 'kernel oplocks', 'kernel share modes', and 'posix locking' must be disabled, which compromises compatibility with POSIX and NFS and significantly reduces performance due to synchronous metadata writes to disk with each operation. Two fault tolerance modes are proposed: full_outage (default) — a local backup copy of the state is created, allowing handles to be preserved even after a complete cluster failure, but increasing the load; partial_outage — faster operation without a backup, but handles are lost if all cluster nodes fail simultaneously.
- A VFS module vfs_aio_ratelimit has been added, allowing for a request rate limit to be set, applicable at the cluster level rather than just tied to individual nodes. To coordinate global enforcement of limits on each node, a background process ratelimitd must be running, aggregating the activity of all smbd processes on the node and passing information to other nodes in the cluster. Enabling vfs_aio_ratelimit is done during the build stage by specifying the option '--with-ratelimitd'.
- The VFS module vfs_ceph_rgw for Ceph RGW (Object Gateway) has been added, allowing data to be exported from Ceph Object Gateway as SMB storage with a hierarchical view of stored objects in the form of regular files and directories, with access segregation at the POSIX uid/gid level.
- Cluster functional levels resembling levels domain and forests in Active Directory have been implemented, allowing for rolling upgrades of nodes in the cluster. Database formats and internal message exchange formats affecting node interactions are only changed after an explicit upgrade for the entire cluster, ensuring node compatibility with different Samba versions during the update. Management is done through the commands 'net clusterlevel features|show|showall|upgrade'.
- For encryption in domains, the aes128-cts-hmac-sha1-96 and aes256-cts-hmac-sha1-96 algorithms are used by default for domains with a functional level of 2008 and above. This change blocks the manifestation of the CVE-2026-20833 vulnerability caused by the use of insecure encryption methods in Windows Kerberos.
- In CTDB, files with locks, PID, and sockets have been moved to subdirectories ctdb/. The initialization script ctdb.init has been moved to ctdb/doc/examples. Support for monitoring hosts, such as DNS servers, has been added. The function detect_init_style() and the variable CTDB_INIT_STYLE have been deprecated (it is recommended to use CTDB_PLATFORM_STYLE instead).
Source: opennet.ru
