{"id":165282,"date":"2026-03-19T11:11:55","date_gmt":"2026-03-19T09:11:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-samba-4-24-0"},"modified":"2026-03-19T11:11:55","modified_gmt":"2026-03-19T09:11:55","slug":"vypusk-samba-4-24-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/no\/blog\/news\/vypusk-samba-4-24-0","title":{"rendered":"Utgivelse av Samba 4.24.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Etter 6 m\u00e5neder med utvikling er Samba 4.24.0 n\u00e5 ute, og den fortsetter utviklingen av Samba 4 med en fullstendig implementering av domenekontrolleren og Active Directory-tjenesten, som er kompatibel med Windows Server-implementeringen og kan betjene alle st\u00f8ttede Microsoft-versjoner av Windows-klienter, inkludert Windows 11. Samba 4 er et multifunksjonelt serverprodukt som ogs\u00e5 tilbyr implementering av filserver, utskriftstjeneste og identitetstjener (winbind). Prosjektkoden er skrevet i C og distribueres under GPLv3-lisensen.      <\/p>\n<p>N\u00f8kkelendringer i Samba 4.24:  <\/p>\n<ul>\n<li class=\"l\"> En ny VFS-modul vfs_aio_ratelimit er lagt til for \u00e5 begrense intensiteten (rate-limit) av asynkrone I\/O-operasjoner (AIO). Begrensninger kan settes i bytes per sekund eller i operasjoner per sekund. N\u00e5r den angitte grensen overskrides, begynner modulen \u00e5 legge inn kunstige forsinkelser i asynkrone operasjoner for \u00e5 opprettholde det angitte \u00f8vre grense.\n<li class=\"l\"> VFS-modulen vfs_ceph_new har f\u00e5tt st\u00f8tte for RPC-protokollen Keybridge og FSCrypt-modusen for kryptering av data og filnavn i CephFS-filsystemet. Kryptering p\u00e5 niv\u00e5et av individuelle kataloger kan aktiveres.\n<li class=\"l\"> I VFS-modulen vfs_streams_xattr, som lar lagring av alternative datasett NTFS (NTFS alternativedata stream) i utvidede filattributter (xattr) i Linux, er innstillingen \u00abstreams_xattr:max xattrs per stream\u00bb lagt til, som definerer det tillatte antallet xattr som skal brukes til lagring av data. I Linux er st\u00f8rrelsen p\u00e5 xattr begrenset til 65536 byte, men XFS-filsystemet gir mulighet for \u00e5 knytte mer enn \u00e9n xattr til en fil, noe som gj\u00f8r at flere xattr kan brukes til \u00e5 lagre opptil 1 MB alternative data.\n<li class=\"l\"> St\u00f8tte for revisjon av informasjon relatert til autentisering er implementert. Feils\u00f8kingsklassene \u00abdsdb_password_audit\u00bb og \u00abdsdb_password_json_audit\u00bb er lagt til for \u00e5 loggf\u00f8re endringer i attributtene for Active Directory: altSecurityIdentities, dNSHostName, msDS-AdditionalDnsHostName, msDS-KeyCredentialLink og servicePrincipalName.\n<li class=\"l\"> St\u00f8tte for eksterne passordh\u00e5ndteringssystemer Microsoft Entra ID og Keycloak, som bruker passordtilbakestilling (SSPR, password reset) uten \u00e5 overf\u00f8re det gamle passordet til kontrolleren, er lagt til. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/no\/domain\/\" title=\"domenet\" data-wpil-keyword-link=\"linked\">domenet<\/a>. For \u00e5 overholde policyer som kontrollerer passordets varighet, overf\u00f8res ekstra parametere (\u00abpassword policy hints\u00bb) ved tilbakestilling av passord, noe som lar operasjonen behandles som et vanlig passordbytte. N\u00e5 tar Samba hensyn til slike parametere n\u00e5r det gjelder lokale passordpolicyer.\n<li class=\"l\"> St\u00f8tte for PKINIT KeyTrust autentiseringsmekanismen i Kerberos er lagt til, noe som gir mulighet for kontroller av domener basert p\u00e5 Samba og Heimdal KDC til \u00e5 bruke metoden \u00abWindows Hello for Business Key-Trust logons\u00bb for PKINIT-autentisering med selvsignerte n\u00f8kler. For \u00e5 legge til og vise den offentlige n\u00f8kkelen i verkt\u00f8yet samba-tool, er kommandoen \u00abuser|computer keytrust\u00bb lagt til. Informasjonen om den offentlige n\u00f8kkelen lagres i kontoen ved hjelp av attributtet msDS-KeyCredentialLink.\n<li class=\"l\"> St\u00f8tte for utvidelsen av Kerberos PKINIT-protokollen for n\u00f8kkelmappinger (\u00abWindows Strong and Flexible key mappings\u00bb) er lagt til i kontroller av domener basert p\u00e5 Samba og Heimdal KDC, brukt ved autentisering med offentlige n\u00f8kler. Som standard tillates kun n\u00f8yaktig samsvar med sertifikatene (\u00abstrong certificate binding enforcement = full\u00bb), men fleksibel samsvar (\u00abstrong certificate binding enforcement = compatibility\u00bb) er ogs\u00e5 mulig, som tillater nyere sertifikater enn brukerkontoen. Informasjon om sertifikatmapping for kontoen lagres i attributtet altSecurityIdentities.\n<li class=\"l\"> St\u00f8tte for \u00abKerberos PKINIT SID\u00bb-protokollutvidelsen, som tillater bruk av sertifikater med Object SID ved autentisering, er lagt til. For \u00e5 signere sertifikater er kommandoen \u00abuser|computer generate-csr\u00bb lagt til verkt\u00f8yet samba-tool.\n<li class=\"l\"> I KDC (Key Distribution Center) er det som standard implementert retur av PAC (Privilege Attribute Certificate) strukturen, som inneholder data om brukerens rettigheter, uavhengig av om PA-PAC-REQUEST feltet er spesifisert i klientens foresp\u00f8rsel. For \u00e5 returnere den gamle oppf\u00f8rselen finnes det en innstilling &#171;kdc always generate pac = no&#187;.\n<li class=\"l\"> I KDC er det lagt til en innstilling &#171;kdc require canonicalization&#187;, hvor settes til &#171;yes&#187;, er klienten forpliktet til \u00e5 be om utf\u00f8ring av kanonisering av brukernavn ved henvendelse til <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/no\/server\/dts-shicago\/\" title=\"server\" data-wpil-keyword-link=\"linked\">server<\/a> autentisering (AS_REQ). Hvis kanonisering ikke er bedt om, vil serveren returnere feilen &#171;bruker ukjent&#187;. I nettverk med brukere som bruker Windows OS, skal aktivering av den nye innstillingen ikke for\u00e5rsake problemer, ettersom Windows-klienter som standard alltid ber om kanonisering.\n<p>Obligatorisk kanonisering beskytter mot angrep av typen &#171;dollar ticket&#187;, som manipulerer det faktum at brukernavn kan spesifiseres p\u00e5 forskjellige m\u00e5ter (&#171;user&#187; og &#171;user$&#187;) og behandles forskjellig i kanonisert og vanlig fremstilling. Kjernen i angrepet er at en angriper for eksempel kunne ha opprettet en datamaskin brukerpost i AD med navnet &#171;root$&#187; og bruke den til \u00e5 f\u00e5 en billett fra KDC, ved \u00e5 sende brukernavnet &#171;root&#187; i foresp\u00f8rselen i stedet for &#171;root$&#187;. KDC, som ikke finner brukeren &#171;root&#187;, ville ha behandlet foresp\u00f8rselen i konteksten til brukeren &#171;root$&#187; og gitt ut en billett som kan brukes til \u00e5 logge inn som bruker root via SSH eller NFS til en Linux-server med SSSD.      <\/p>\n<li class=\"l\"> I KDC er det lagt til en alternativ beskyttelsesmetode mot &#171;dollar ticket&#187; angrep for konfigurasjoner med obligatoriske kanoniseringsforesp\u00f8rslene deaktivert (&#171;kdc require canonicalization = no&#187; som brukes som standard). Som standard, hvis klienten ikke ba om kanonisering og det kontrollerte navnet ikke ble funnet, utf\u00f8rer serveren en ekstra sjekk ved \u00e5 legge til symbolet &#171;$&#187; til navnet. Med den nye innstillingen &#171;kdc name match implicit dollar without canonicalization = no&#187; kan denne oppf\u00f8rselen deaktiveres, og gj\u00f8re kun n\u00f8yaktige sjekker (i konteksten av det nevnte angrepet, vil serveren ikke sjekke navnet &#171;root$&#187; ved foresp\u00f8rsel om &#171;root&#187;).\n<li class=\"l\"> I Heimdal KDC er som standard aktivert sending av til Kerberos-tjenester med bare kanoniserte navn (sAMAccountName fra PAC) i stedet for det opprinnelige verdien cname. For \u00e5 gjenvinne den gamle oppf\u00f8rselen er innstillingen \u00abkrb5 acceptor report canonical client name = no\u00bb tilgjengelig.\n<li class=\"l\"> For \u00e5 oppn\u00e5 full beskyttelse mot \u00abdollar ticket\u00bb-angrep anbefales f\u00f8lgende innstillinger: strong certificate binding enforcement full, kdc always include pac yes, kdc require canonicalization yes.\n<li class=\"l\"> For \u00e5 blokkere s\u00e5rbarheten CVE-2026-20833 er metoden for domene-kryptering i KDC-innstillingene som standard endret til AES (innstillingen \u00abkdc default domain supported enctypes\u00bb er satt til \u00abaes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96\u00bb).              <\/ul>\n<p>Kilde: <a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=65016\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 Samba 4.24.0, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0432\u0448\u0438\u0439 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0432\u0435\u0442\u043a\u0438 Samba 4 \u0441 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Active Directory, \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0433\u043e \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Windows Server \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0433\u043e \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 Microsoft \u0432\u0435\u0440\u0441\u0438\u0438 Windows-\u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 Windows 11. Samba 4 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043c\u043d\u043e\u0433\u043e\u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u043c \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u043c, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u043c \u0442\u0430\u043a\u0436\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u043f\u0435\u0447\u0430\u0442\u0438 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-165282","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 Samba 4.24.0, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0432\u0448\u0438\u0439 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0432\u0435\u0442\u043a\u0438 Samba 4 \u0441 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Active Directory, \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0433\u043e \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Windows Server \u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/no\/blog\/news\/vypusk-samba-4-24-0\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"nn_NO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Samba 4.24.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 Samba 4.24.0, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0432\u0448\u0438\u0439 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0432\u0435\u0442\u043a\u0438 Samba 4 \u0441 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Active Directory, \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0433\u043e \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Windows Server \u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/no\/blog\/news\/vypusk-samba-4-24-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-03-19T09:11:55+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-03-19T09:11:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Utgivelse av Samba 4.24.0 | ProHoster","description":"Etter 6 m\u00e5neder med utvikling ble utgivelsen Samba 4.24.0 presentert, som videref\u00f8rer utviklingen av Samba 4 med fullverdig implementering av domenekontroller og Active Directory-tjeneste, kompatibel med Windows Server-implementeringen.","canonical_url":"https:\/\/prohoster.info\/no\/blog\/news\/vypusk-samba-4-24-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nn_NO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Samba 4.24.0 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 Samba 4.24.0, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0432\u0448\u0438\u0439 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0432\u0435\u0442\u043a\u0438 Samba 4 \u0441 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Active Directory, \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0433\u043e \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Windows Server \u0438.","og:url":"https:\/\/prohoster.info\/no\/blog\/news\/vypusk-samba-4-24-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-19T09:11:55+00:00","article:modified_time":"2026-03-19T09:11:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/165282","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/comments?post=165282"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/165282\/revisions"}],"predecessor-version":[{"id":168128,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/165282\/revisions\/168128"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/media?parent=165282"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/categories?post=165282"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/tags?post=165282"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}