1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
|
Release Announcements
=====================
This is the first preview release of Samba 4.5. This is *not*
intended for production environments and is designed for testing
purposes only. Please report any defects via the Samba bug reporting
system at https://bugzilla.samba.org/.
Samba 4.5 will be the next version of the Samba suite.
UPGRADING
=========
NTLMv1 authentication disabled by default
-----------------------------------------
In order to improve security we have changed
the default value for the "ntlm auth" option from
"yes" to "no". This may have impact on very old
client which doesn't support NTLMv2 yet.
The primary user of NTLMv1 is MSCHAPv2 for VPNs and 802.1x.
By default Samba will only allow NTLMv2 via NTLMSSP now,
as we have the following default "lanman auth = no",
"ntlm auth = no" and "raw NTLMv2 auth = no".
NEW FEATURES/CHANGES
====================
Support for LDAP_SERVER_NOTIFICATION_OID
----------------------------------------
The ldap server has support for the LDAP_SERVER_NOTIFICATION_OID
control. This can be used to monitor the active directory database
for changes.
KCC improvements for sparse network replication
-----------------------------------------------
The Samba KCC will now be the default knowledge consistency checker in
Samba AD. Instead of using full mesh replication between every DC, the
KCC will set up connections to optimize replication latency and cost
(using site links to calculate the routes). This change should allow
larger domains to function significantly better in terms of replication
traffic and the time spent performing DRS replication.
VLV - Virtual List View
-----------------------
The VLV Control allows applications to page the LDAP directory in the
way you might expect a live phone book application to operate, without
first downloading the entire directory.
DRS Replication for the AD DC
-----------------------------
DRS Replication in Samba 4.5 is now much more efficient in handling
linked attributes, particularly in large domains with over 1000 group
memberships or other links.
Replication is also much more reliable in the handling of tree
renames, such as the rename of an organizational unit containing many
users. Extensive tests have been added to ensure this code remains
reliable, particularly in the case of conflicts between objects added
with the same name on different servers.
Schema updates are also handled much more reliably.
replPropertyMetaData Changes
----------------------------
During the development of the DRS replication, tests showed that Samba
stores the replPropertyMetaData object incorrectly. To address this,
be aware that dbcheck will now detect and offer to fix all objects in
the domain for this error.
Linked attributes on deleted objects
------------------------------------
In Active Directory, an object that has been tombstoned or recycled
has no linked attributes. However, Samba incorrectly maintained such
links, slowing replication and run-time performance. dbcheck now
offers to remove such links, and they are no longer kept after the
object is tombstoned or recycled.
Improved AD DC performance
--------------------------
Many other improvements have been made to our LDAP database layer in
the AD DC, to improve performance, both during samba-tool domain
provision and at runtime.
Other dbcheck improvements
--------------------------
- samba-tool dbcheck can now find and fix a missing or corrupted
'deleted objects' container.
- BUG 11433: samba-dbcheck no longer offers to resort auxiliary class values
in objectClass as these were then re-sorted at the next dbcheck indefinitely.
Tombstone Reanimation
---------------------
Samba now supports tombstone reanimation, a feature in the AD DC
allowing tombstones, that is objects which have been deleted, to be
restored with the original SID and GUID still in place.
Multiple DNS Forwarders on the AD DC
------------------------------------
Multiple DNS forwarders are now supported on the AD DC, allowing
samba to fall back between two different DNS servers for forwarded queries.
Password quality plugin support in the AD DC
--------------------------------------------
The check password script now operates correctly in the AD DC (this
was silently ignored in past releases)
pwdLastSet is now correctly honoured
------------------------------------
BUG 9654: the pwdLastSet attribute is now correctly handled (this previously
permitted passwords that next expire).
net ads dns unregister
----------------------
It is now possible to remove the DNS entries created with 'net ads register'
with the matching 'net ads unregister' command.
Samba-tool improvements
------------------------
Running samba-tool on the command line should now be a lot snappier. The tool
now only loads the code specific to the subcommand that you wish to run.
SMB 2.1 Leases enabled by default
---------------------------------
Leasing is an SMB 2.1 (and higher) feature which allows clients to
aggressively cache files locally above and beyond the caching allowed
by SMB 1 oplocks. This feature was disabled in previous releases, but
the SMB2 leasing code is now considered mature and stable enough to be
enabled by default.
Open File Description (OFD) Locks
---------------------------------
On systems that support them (currently only Linux), the fileserver now
uses Open File Description (OFD) locks instead of POSIX locks to implement
client byte range locks. As these locks are associated with a specific
file descriptor on a file this allows more efficient use when multiple
descriptors having file locks are opened onto the same file. An internal
tunable "smbd:force process locks = true" may be used to turn off OFD
locks if there appear to be problems with them.
REMOVED FEATURES
================
only user and username parameters
---------------------------------
These two parameters have long been deprecated and superseded by
"valid users" and "invalid users".
smb.conf changes
----------------
Parameter Name Description Default
-------------- ----------- -------
ntlm auth Changed default no
only user Removed
username Removed
kccsrv:samba_kcc Changed default true
smb2 leases Changed default yes
KNOWN ISSUES
============
Currently none.
#######################################
Reporting bugs & Development Discussion
#######################################
Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical IRC channel on irc.freenode.net.
If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored. All bug reports should
be filed under the Samba 4.1 and newer product in the project's Bugzilla
database (https://bugzilla.samba.org/).
======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================
|
