The release of Samba 4.16.0 has been announced, continuing the development of the Samba 4 branch with a full implementation of the domain controller and Active Directory service, compatible with the Windows 2000 implementation and capable of serving all supported Microsoft versions of Windows clients, including Windows 10. Samba 4 is a multifunctional server product that also provides implementations for file serving, print services, and identity servers (winbind).
Key changes in Samba 4.16:
- A new executable file samba-dcerpcd has been added, which ensures the operation of DCE/RPC (Distributed Computing Environment / Remote Procedure Calls) services. To process incoming requests, samba-dcerpcd can be invoked as needed from the smbd processes or 'winbind —np-helper' by passing information through named pipes. Additionally, samba-dcerpcd can also operate as an independently running background process, handling requests on its own, and can be used not only together with samba but also with other implementations. servers SMB2, such as the ksmbd server built into the Linux kernel. To control the startup of samba-dcerpcd, the smb.conf file in the '[global]' section has the configuration option 'rpc start on demand helpers = [true|false]'.
- The built-in implementation server Kerberos has been upgraded to the Heimdal 8.0pre release, which added support for the FAST protection mechanism, which ensures mandate protection by encapsulating requests and responses in a separate encrypted tunnel.
- A Certificate Auto Enrollment mechanism has been added, allowing automatic retrieval of certificates from Active Directory services when group policies are enabled ('apply group policies' in smb.conf).
- The built-in DNS server has implemented the ability to use an arbitrary network port number when specifying DNS servers for query forwarding (dns forwarder). Previously, only the host for forwarding could be specified in the settings, but now the information can be provided in the format host:port.
- In the CTDB component responsible for cluster configurations, the roles 'recovery master' and 'recovery lock' have been renamed to 'leader' and 'cluster lock', and the term 'master' should be replaced with 'leader' in various commands (recmaster -> leader, setrecmasterrole -> setleaderrole).
- Support for the SMBCopy team (SMB_COM_COPY) and the wildcard mask functionality in server-side file names defined in the deprecated SMB1 protocol has been discontinued. The functionality of the SMB2 protocol for server-side file copying remains unchanged.
- Mandatory file locks in the implementation of 'share modes' have been discontinued in smbd on the Linux platform. These locks, which were implemented in the kernel through blocking system calls and deemed unreliable due to potential race conditions, are not supported starting from Linux kernel 5.15.
Source: opennet.ru
