The release of Samba 4.17.0 has been unveiled, continuing the development of the Samba 4 branch with a full implementation of the domain controller and Active Directory service compatible with Windows 2008, capable of servicing all supported Microsoft versions of Windows clients, including Windows 11. Samba 4 is a multifunctional server product that also provides a file server, print service, and identification server (winbind).
Key changes in Samba 4.17:
- Efforts have been made to eliminate performance regressions in overloaded SMB servers, which arose from the addition of protections against vulnerabilities that manipulate symbolic links. Among the optimizations carried out, a reduction in system calls during directory name checks and the non-use of wakeup events during the handling of competing operations that lead to delays are noted.
- The ability to build Samba without SMB1 protocol support in smbd has been provided. To disable SMB1 in the build script configure, the option āāwithout-smb1-serverā has been implemented (this only affects smbd, while SMB1 support remains in client libraries).
- When using MIT Kerberos 1.20, the capability to counter the āBronze Bitā attack (CVE-2020-17049) has been implemented by passing additional information between KDC and KDB components. The issue was resolved in the default KDC based on Heimdal Kerberos in 2021.
- When built with MIT Kerberos 1.20, support has been implemented in the controller domain based on Samba for Kerberos extensions S4U2Self and S4U2Proxy, as well as the addition of limited resource-based delegation (RBCD, Resource Based Constrained Delegation). To manage RBCD, subcommands āadd-principalā and ādel-principalā have been added to the āsamba-tool delegationā command. The default KDC based on Heimdal Kerberos currently does not support RBCD mode.
- The built-in DNS service now offers the ability to change the network port that receives requests (for instance, to run another DNS server on the same system that redirects certain requests to Samba).
- In the CTDB component responsible for cluster configuration operations, the syntax requirements for the ctdb.tunables file have been reduced. When building Samba with the options ā--with-cluster-supportā and ā--systemd-install-servicesā, the installation of the systemd service for CTDB is ensured. The delivery of the ctdbd_wrapper script has been discontinued ā the ctdbd process now starts directly from the systemd service or from the initialization script.
- The configuration ānt hash store = neverā has been implemented, prohibiting the storage of ābareā (unsalted) hashes of Active Directory user passwords. In the next version, the ānt hash storeā setting will default to āautoā, where the āneverā mode will apply if the āntlm auth = disabledā setting is in place.
- A wrapper for accessing the API of the smbconf library from Python code has been proposed.
- The smbstatus program has been enhanced to support outputting information in JSON format (enabled with the ā--jsonā option).
- Support for the āProtected Usersā security group, introduced in Windows Server 2012 R2, has been implemented in the domain controller, which prohibits the use of insecure encryption types (for users in this group, NTLM authentication support and Kerberos TGTs based on RC4, as well as limited and unlimited delegation, are disabled).
- Support for the password storage and authentication method based on LanMan has been discontinued (the setting ālanman auth = yesā is now irrelevant).
Source: opennet.ru
