The release of Samba 4.18.0 has been announced, continuing the development of the Samba 4 branch with a full implementation of the domain controller and Active Directory service, compatible with the Windows 2008 implementation and capable of servicing all supported Microsoft versions of Windows clients, including Windows 11. Samba 4 is a multifunctional server product that also provides a file server, print service, and identification server (winbind).
Key changes in Samba 4.18:
- Work has continued on eliminating regressions in the performance of overloaded SMB servers, which arose from the addition of protection against vulnerabilities that manipulate symbolic links. In addition to the efforts made in the previous release to reduce system calls when checking directory names and to stop using wakeup events when handling competing operations, version 4.18 has reduced the overhead of processing locks for competing file path operations by approximately three times. Consequently, the performance of file opening and closing operations has been brought back to the level of Samba 4.12.
- The samba-tool utility now provides more concise and accurate error messages. Instead of outputting a stack trace indicating the position in the code where the issue occurred, which did not always make it clear what the problem was, the new version limits the output to a description of the reason for the error (e.g., incorrect username or password, invalid database LDB file name, missing DNS name, network unreachable, incorrect command line arguments, etc.). In the case of an unrecognized problem, a complete Python stack trace continues to be outputted, which can also be obtained by specifying the ‘-d3’ option. This information may be needed to diagnose the issue on the Web or to include in the sent error notification.
- Support for the option ‘—color=yes|no|auto’ to control output highlighting has been implemented in all samba-tool commands. In ‘—color=auto’ mode, color highlighting is used only when outputting to the terminal. Instead of ‘yes’, the values ‘always’ and ‘force’ are allowed; instead of ‘no’, ‘never’ and ‘none’; and instead of ‘auto’, ‘tty’ and ‘if-tty’.
- Support for the NO_COLOR environment variable has been added to disable output highlighting in situations where ANSI color codes are used or when the —color=auto mode is in effect.
- A new command "dsacl delete" has been added to samba-tool for removing entries in access control lists (ACE, Access Control Entry).
- The wbinfo command has been enhanced with the option "—change-secret-at=" to specify the controller domain for which the password change operation needs to be performed.
- A new parameter "acl_xattr:security_acl_name" has been added to smb.conf to change the name of the extended attribute (xattr) used to store the NT ACL. By default, the attribute security.NTACL is attached to files and directories, and access to it is denied for regular users. When changing the name of the ACL storage attribute, it will not be returned via SMB but will become locally accessible to any users, which requires an understanding of the potential negative impact on security.
- Support for syncing password hashes between the Active Directory domain based on Samba and Azure Active Directory (Office365) has been added.
Source: opennet.ru
