{"id":165282,"date":"2026-03-19T11:11:55","date_gmt":"2026-03-19T09:11:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-samba-4-24-0"},"modified":"2026-03-19T11:11:55","modified_gmt":"2026-03-19T09:11:55","slug":"vypusk-samba-4-24-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-samba-4-24-0","title":{"rendered":"Release of Samba 4.24.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>After 6 months of development, the release of Samba 4.24.0 has been presented, continuing the Samba 4 branch with a full implementation of the domain controller and Active Directory service, compatible with the Windows Server implementation and capable of servicing all supported Microsoft versions of Windows clients, including Windows 11. Samba 4 is a multifunctional server product that also provides file server, printing service, and identification server (winbind) implementations. The project's code is written in C and is distributed under the GPLv3 license.      <\/p>\n<p>Key changes in Samba 4.24:  <\/p>\n<ul>\n<li class=\"l\"> A new VFS module vfs_aio_ratelimit has been added to limit the intensity (rate-limit) of asynchronous I\/O (AIO) operations. Limits can be set in bytes per second or in operations per second. If the specified limit is exceeded, the module begins to introduce artificial delays in asynchronous operations to maintain the specified upper threshold.\n<li class=\"l\"> The VFS module vfs_ceph_new now supports the RPC protocol Keybridge and FSCrypt mode for encrypting data and file names in the CephFS filesystem. Encryption can be enabled at the level of individual directories.\n<li class=\"l\"> The VFS module vfs_streams_xattr, which allows for the preservation of NTFS alternate data streams in extended file attributes (xattr) on Linux, has a new setting \"streams_xattr:max xattrs per stream\" that defines the permissible number of xattrs used for data storage. In Linux, the size of xattrs is limited to 65536 bytes, but the XFS file system allows multiple xattrs to be attached to a single file, enabling the use of several xattrs to store up to 1 MB of alternate data.\n<li class=\"l\"> Support for auditing information related to authentication has been implemented. Debugging classes \"dsdb_password_audit\" and \"dsdb_password_json_audit\" have been added to log changes to Active Directory attributes: altSecurityIdentities, dNSHostName, msDS-AdditionalDnsHostName, msDS-KeyCredentialLink, and servicePrincipalName.\n<li class=\"l\"> Support for external password management systems Microsoft Entra ID and Keycloak has been added, which utilize the password reset operation (SSPR, password reset) when changing the password without transmitting the old password to the controller. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/en\/domain\/\" title=\"domain\" data-wpil-keyword-link=\"linked\">domain<\/a>To comply with policies controlling the validity period of passwords, additional parameters (\"password policy hints\") are passed during a password reset, allowing the operation to be treated as a standard password change. Samba now takes these parameters into account when applying related local password policies.\n<li class=\"l\"> Support for the Kerberos PKINIT KeyTrust authentication mechanism has been added, enabling domain controllers based on Samba and Heimdal KDC to use the \"Windows Hello for Business Key-Trust logons\" method to implement PKINIT authentication with self-signed keys. A command \"user|computer keytrust\" has been added to the samba-tool utility for adding and viewing the public key. The public key information is stored in the account using the msDS-KeyCredentialLink attribute.\n<li class=\"l\"> Support for the Kerberos PKINIT protocol extension for key mapping (\"Windows Strong and Flexible key mappings\") has been added to domain controllers based on Samba and Heimdal KDC, applied during public key authentication. By default, only exact certificate matching is allowed (\"strong certificate binding enforcement = full\"), but flexible matching (\"strong certificate binding enforcement = compatibility\") is also possible, allowing certificates newer than the user account. Information about certificate mapping for the account is stored in the altSecurityIdentities attribute.\n<li class=\"l\"> Support for the \"Kerberos PKINIT SID\" protocol extension has been added, allowing the use of certificates with an Object SID identifier during authentication. The samba-tool utility has been enhanced with the command \"user|computer generate-csr\" for signing certificates.\n<li class=\"l\"> In the KDC (Key Distribution Center) implementation, by default, the PAC (Privilege Attribute Certificate) structure is returned, containing the user's permissions, regardless of whether the PA-PAC-REQUEST field is specified in the client's request. To revert to the old behavior, the configuration 'kdc always generate pac = no' is provided.\n<li class=\"l\"> The KDC has added the setting 'kdc require canonicalization'. When this is set to 'yes', the client is required to request the canonicalization of the username when accessing authentication (AS_REQ). If canonicalization is not requested, the server will return the error 'user unknown'. In networks with users using Windows OS, enabling this new setting should not cause issues, as Windows clients by default always request canonicalization. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/en\/server\/dts-shicago\/\" title=\"server\" data-wpil-keyword-link=\"linked\">server<\/a> Mandatory canonicalization helps protect against 'dollar ticket' attacks, which manipulate the fact that usernames can be specified differently ('user' and 'user$') and can be processed differently in canonical and regular representation. The essence of the attack is that an attacker could create a computer account in AD with the name 'root$' and use it to obtain a ticket from the KDC by sending the username 'root' instead of 'root$' in the request. The KDC, not finding the user 'root', would process the request in the context of the user 'root$' and issue a ticket that could be used to connect as the root user via SSH or NFS to a Linux server with SSSD.\n<p>The KDC has added a workaround to protect against 'dollar ticket' attacks for configurations with mandatory name canonicalization requests disabled ('kdc require canonicalization = no', which is applied by default). By default, if the client does not request canonicalization and the checked name is not found, the server performs an additional check by appending the '$' symbol to the name. With the new setting 'kdc name match implicit dollar without canonicalization = no', this behavior can be disabled, and only exact checks will be performed (in the context of the aforementioned attack, the server will not check the name 'root$' when the request is for 'root').      <\/p>\n<li class=\"l\"> The KDC has added a workaround to protect against 'dollar ticket' attacks for configurations with mandatory name canonicalization requests disabled ('kdc require canonicalization = no', which is applied by default). By default, if the client does not request canonicalization and the checked name is not found, the server performs an additional check by appending the '$' symbol to the name. With the new setting 'kdc name match implicit dollar without canonicalization = no', this behavior can be disabled, allowing for exact checks only (in the context of the aforementioned attack, the server will not check the name 'root$' when the request is for 'root').\n<li class=\"l\"> In Heimdal KDC, by default, the sending of canonical names (sAMAccountName from PAC) to Kerberos services instead of the original cname value is enabled. To revert to the old behavior, the setting 'krb5 acceptor report canonical client name = no' is provided.\n<li class=\"l\"> For complete protection against 'dollar ticket' attacks, it is recommended to set the following configurations: strong certificate binding enforcement full, kdc always include pac yes, kdc require canonicalization yes.\n<li class=\"l\"> To block the vulnerability CVE-2026-20833, the default domain encryption method in KDC settings has been changed to AES (the 'kdc default domain supported enctypes' setting is set to 'aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96').              <\/ul>\n<p>Source: <a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=65016\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 Samba 4.24.0, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0432\u0448\u0438\u0439 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0432\u0435\u0442\u043a\u0438 Samba 4 \u0441 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Active Directory, \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0433\u043e \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Windows Server \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0433\u043e \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 Microsoft \u0432\u0435\u0440\u0441\u0438\u0438 Windows-\u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 Windows 11. Samba 4 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043c\u043d\u043e\u0433\u043e\u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u043c \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u043c, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u043c \u0442\u0430\u043a\u0436\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u043f\u0435\u0447\u0430\u0442\u0438 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-165282","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 Samba 4.24.0, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0432\u0448\u0438\u0439 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0432\u0435\u0442\u043a\u0438 Samba 4 \u0441 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Active Directory, \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0433\u043e \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Windows Server \u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-samba-4-24-0\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Samba 4.24.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 Samba 4.24.0, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0432\u0448\u0438\u0439 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0432\u0435\u0442\u043a\u0438 Samba 4 \u0441 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Active Directory, \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0433\u043e \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Windows Server \u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-samba-4-24-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-03-19T09:11:55+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-03-19T09:11:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Samba 4.24.0 Release | ProHoster","description":"After 6 months of development, Samba 4.24.0 has been released, continuing the Samba 4 branch with a complete implementation of the domain controller and Active Directory service compatible with the Windows Server implementation.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-samba-4-24-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Samba 4.24.0 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 Samba 4.24.0, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0432\u0448\u0438\u0439 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0432\u0435\u0442\u043a\u0438 Samba 4 \u0441 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Active Directory, \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0433\u043e \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Windows Server \u0438.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-samba-4-24-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-19T09:11:55+00:00","article:modified_time":"2026-03-19T09:11:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/165282","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=165282"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/165282\/revisions"}],"predecessor-version":[{"id":168128,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/165282\/revisions\/168128"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=165282"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=165282"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=165282"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}