{"id":165282,"date":"2026-03-19T11:11:55","date_gmt":"2026-03-19T09:11:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-samba-4-24-0"},"modified":"2026-03-19T11:11:55","modified_gmt":"2026-03-19T09:11:55","slug":"vypusk-samba-4-24-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/vypusk-samba-4-24-0","title":{"rendered":"Izdanje Samba 4.24.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Nakon 6 meseci razvoja, predstavljeno je izdanje Samba 4.24.0, koje nastavlja razvoj grane Samba 4 s punom implementacijom kontrolera domena i Active Directory usluge, koja je kompatibilna s Windows Server implementacijom i mo\u017ee podr\u017eavati sve verzije Windows klijenata koje Microsoft podr\u017eava, uklju\u010duju\u0107i Windows 11. Samba 4 je vi\u0161enamensko serversko re\u0161enje koje tako\u0111e pru\u017ea implementaciju serverskog prostora za datoteke, uslugu \u0161tampe i serversku identifikaciju (winbind). Kod projekta je napisan na programskom jeziku C i distribuiran je pod GPLv3 licencom.      <\/p>\n<p>Klju\u010dne promene u Samba 4.24:  <\/p>\n<ul>\n<li class=\"l\"> Dodata je nova VFS modul vfs_aio_ratelimit za ograni\u010davanje intenziteta (rate-limit) operacija asinhronog ulaza\/izlaza (AIO). Ograni\u010denja mogu biti postavljena u bajtovima po sekundi ili operacijama po sekundi. Kada se prekora\u010di postavljeni limit, modul po\u010dinje da ubacuje ve\u0161ta\u010dka ka\u0161njenja u asinhrone operacije kako bi odr\u017eao zadati gornji prag.\n<li class=\"l\"> U VFS modul vfs_ceph_new dodata je podr\u0161ka za RPC protokol Keybridge i FSCrypt re\u017eim za enkripciju podataka i imena datoteka u CephFS datote\u010dnom sistemu. Mogu\u0107nost uklju\u010divanja enkripcije na nivou pojedina\u010dnih direktorijuma.\n<li class=\"l\"> V VFS-modulu vfs_streams_xattr, ki omogo\u010da shranjevanje alternativnih podatkovnih tokov NTFS (NTFS alternate data stream) v raz\u0161irjenih atributih datotek (xattr) v Linuxu, je bila dodana nastavitev \u201estreams_xattr:max xattrs per stream\u201c, ki dolo\u010da dovoljeno \u0161tevilo xattr, uporabljenih za shranjevanje podatkov. V Linuxu je velikost xattr omejena na 65536 bajtov, vendar datote\u010dni sistem XFS omogo\u010da povezovanje ve\u010d kot enega xattr z eno datoteko, kar omogo\u010da uporabo ve\u010d xattr za shranjevanje do 1 MB alternativnih podatkov.\n<li class=\"l\"> Izvedena je bila podpora za revizijo informacij, povezanih z avtentikacijo. Dodani so razred za odpravljanje napak \u201edsdb_password_audit\u201c in \u201edsdb_password_json_audit\u201c za zapisovanje sprememb atributov Active Directory v dnevnik: altSecurityIdentities, dNSHostName, msDS-AdditionalDnsHostName, msDS-KeyCredentialLink in servicePrincipalName.\n<li class=\"l\"> Dodata je podr\u0161ka za spoljne sisteme upravljanja lozinkama Microsoft Entra ID i Keycloak, koji koriste operaciju resetovanja lozinke (SSPR, password reset) bez slanja stare lozinke kontroleru. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sl\/domain\/\" title=\"domene\" data-wpil-keyword-link=\"linked\">domene<\/a>. Za upo\u0161tevanje politik, ki nadzorujejo trajanje gesel, se pri ponastavitvi gesla prena\u0161ajo dodatni parametri (\u201epassword policy hints\u201c), ki omogo\u010dajo obravnavo operacije kot obi\u010dajne spremembe gesla. Zdaj Samba upo\u0161teva take parametre pri uporabi povezanih s gesli, lokalnih politik.\n<li class=\"l\"> Dodana je podpora za mehanizem avtentikacije Kerberos PKINIT KeyTrust, ki omogo\u010da na domenah na osnovi Sambe in Heimdal KDC uporabo metode \u201eWindows Hello for Business Key-Trust logons\u201c za izvajanje mehanizma avtentikacije PKINIT z samo-podpisanimi klju\u010di. Za dodajanje in ogled javnega klju\u010da v orodju samba-tool je bila dodana ukaz \u201euser|computer keytrust\u201c. Podatki o javnem klju\u010du se shranijo v ra\u010dun s pomo\u010djo atributa msDS-KeyCredentialLink.\n<li class=\"l\"> V domenskih kontrolerjih na osnovi Sambe in Heimdal KDC je bila dodana podpora za raz\u0161iritev protokola Kerberos PKINIT za usklajevanje klju\u010dev (\u201eWindows Strong and Flexible key mappings\u201c), ki se uporablja pri avtentikaciji z javnimi klju\u010di. Po privzetku je dovoljeno le natan\u010dno ujemanje potrdil (\u201estrong certificate binding enforcement = full\u201c), vendar je mogo\u010de tudi flexible ujemanje (\u201estrong certificate binding enforcement = compatibility\u201c), ki dovoljuje potrdila novej\u0161a od uporabni\u0161kega ra\u010duna. Podatki o usklajevanju potrdil za ra\u010dun se shranijo v atributu altSecurityIdentities.\n<li class=\"l\"> Dodana je podpora za raz\u0161iritev protokola \u201eKerberos PKINIT SID\u201c, ki omogo\u010da uporabo potrdil z identifikatorjem Object SID pri avtentikaciji. Za podpisovanje potrdil je bila v orodju samba-tool dodana ukaz \u201euser|computer generate-csr\u201c.\n<li class=\"l\"> V implementaciji KDC (Key Distribution Center) je privzeto omogo\u010deno vra\u010danje strukture PAC (Privilege Attribute Certificate), ki vsebuje podatke o pooblastilih uporabnika, ne glede na to, ali je polje PA-PAC-REQUEST navedeno v zahtevku odjemalca. Za vrnitev starega vedenja je dolo\u010dena nastavitev \u201ekdc always generate pac = no.\u201c\n<li class=\"l\"> V KDC je dodana nastavitev \u201ekdc require canonicalization\u201c, pri \u010demer je treba, \u010de je nastavljena na \u201eyes\u201c, zahtevati izvajanje kanonizacije imena uporabnika pri dostopu do <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sl\/server\/dts-shicago\/\" title=\"stre\u017eniku\" data-wpil-keyword-link=\"linked\">stre\u017eniku<\/a> avtentikacije (AS_REQ). \u010ce kanonizacija ni zahtevana, bo stre\u017enik vrnil napako \u201euporabnik ni znan\u201c. V omre\u017ejih z uporabniki, ki uporabljajo operacijski sistem Windows, nova nastavitev ne bi smela povzro\u010diti te\u017eav, saj Windows odjemalci privzeto vedno zahtevajo kanonizacijo.\n<p>Obvezna kanonizacija omogo\u010da za\u0161\u010dito pred napadi vrste \u201edollar ticket\u201c, ki manipulirajo s tem, kako se imena uporabnikov lahko dolo\u010dajo na razli\u010dne na\u010dine (\u201euser\u201c in \u201euser$\u201c) in se razli\u010dno obravnavajo v kanonizirani in navadni obliki. Pojem napada je, da bi lahko napadalec, na primer, ustvaril v AD uporabni\u0161ki ra\u010dun ra\u010dunalnika z imenom \u201eroot$\u201c in ga uporabil za pridobitev mandata (ticket) pri KDC, tako da bi v zahtevku poslal ime uporabnika \u201eroot\u201c namesto \u201eroot$\u201c. KDC, ki ne bi na\u0161el uporabnika \u201eroot\u201c, bi obdelal zahtevo v kontekstu uporabnika \u201eroot$\u201c in izdal mandat, ki se ga lahko uporabi za povezovanje kot uporabnik root preko SSH ali NFS na Linux stre\u017enik s SSSD.      <\/p>\n<li class=\"l\"> V KDC je dodan obvodni na\u010din za\u0161\u010dite pred napadi \u201edollar ticket\u201c za konfiguracije z onemogo\u010denimi obveznimi zahtevami po kanonizaciji imen (\u201ekdc require canonicalization = no\u201c, kar je privzeto). Privzeto, \u010de odjemalec ne zahteva izvajanja kanonizacije in preverjeno ime ni najdeno, stre\u017enik izvede dodatno preverjanje, tako da doda simbol \u201e$\u201c k imenu. S pomo\u010djo nove nastavitve \u201ekdc name match implicit dollar without canonicalization = no\u201c lahko to vedenje onemogo\u010dite in izvajate samo natan\u010dna preverjanja (v kontekstu zgoraj omenjenega napada stre\u017enik ne bo preverjal imena \u201eroot$\u201c pri zahtevku \u201eroot\u201c).\n<li class=\"l\"> V Heimdal KDC je privzeto omogo\u010deno po\u0161iljanje storitvam Kerberos le kanoniziranih imen (sAMAccountName iz PAC) namesto izvorne vrednosti cname. Za vrnitev starega vedenja je na voljo nastavitev \u201ekrb5 acceptor report canonical client name = no\u201c.\n<li class=\"l\"> Za popolno za\u0161\u010dito pred napadi \u201edollar ticket\u201c se priporo\u010da, da nastavite: strong certificate binding enforcement full, kdc always include pac yes, kdc require canonicalization yes.\n<li class=\"l\"> Za prepre\u010ditev ranljivosti CVE-2026-20833 je bila privzeta metoda \u0161ifriranja domene v nastavitvah KDC spremenjena na AES (nastavitev \u201ekdc default domain supported enctypes\u201c je nastavljena na \u201eaes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96\u201c).              <\/ul>\n<p>Izvor: <a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=65016\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 Samba 4.24.0, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0432\u0448\u0438\u0439 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0432\u0435\u0442\u043a\u0438 Samba 4 \u0441 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Active Directory, \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0433\u043e \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Windows Server \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0433\u043e \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 Microsoft \u0432\u0435\u0440\u0441\u0438\u0438 Windows-\u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 Windows 11. Samba 4 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043c\u043d\u043e\u0433\u043e\u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u043c \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u043c, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u043c \u0442\u0430\u043a\u0436\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u043f\u0435\u0447\u0430\u0442\u0438 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-165282","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 Samba 4.24.0, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0432\u0448\u0438\u0439 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0432\u0435\u0442\u043a\u0438 Samba 4 \u0441 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Active Directory, \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0433\u043e \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Windows Server \u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/news\/vypusk-samba-4-24-0\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Samba 4.24.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 Samba 4.24.0, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0432\u0448\u0438\u0439 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0432\u0435\u0442\u043a\u0438 Samba 4 \u0441 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Active Directory, \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0433\u043e \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Windows Server \u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/news\/vypusk-samba-4-24-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-03-19T09:11:55+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-03-19T09:11:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Izdaja Samba 4.24.0 | ProHoster","description":"Po 6 mesecih razvoja je bila predstavljena izdaja Samba 4.24.0, ki nadaljuje razvoj veje Samba 4 s polno implementacijo nadzornika domene in storitve Active Directory, zdru\u017eljive z implementacijo Windows Server.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/vypusk-samba-4-24-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Samba 4.24.0 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 Samba 4.24.0, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0432\u0448\u0438\u0439 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0432\u0435\u0442\u043a\u0438 Samba 4 \u0441 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Active Directory, \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0433\u043e \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 Windows Server \u0438.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/vypusk-samba-4-24-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-19T09:11:55+00:00","article:modified_time":"2026-03-19T09:11:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/165282","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=165282"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/165282\/revisions"}],"predecessor-version":[{"id":168128,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/165282\/revisions\/168128"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=165282"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=165282"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=165282"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}