Nabble - Samba - samba-announce

[ANNOUNCE] Samba 4.0.0alpha10

2009-12-08T17:04:30Z

We are proud to a announce another alpha release of Samba 4.
What's new in Samba 4 alpha10
============================

Samba 4 is the ambitious next version of the Samba suite that is being
developed in parallel to the stable 3.0 series. The main emphasis in
this branch is support for the Active Directory logon protocols used
by Windows 2000 and above.

Samba4 alpha10 follows on from the alpha release series we have been
publishing since September 2007

WARNINGS
========

Samba4 alpha10 is not a final Samba release. That is more a reference
to Samba4's lack of the features we expect you will need than a
statement of code quality, but clearly it hasn't seen a broad
deployment yet. If you were to upgrade Samba3 (or indeed Windows) to
Samba4, you would find many things work, but that other key features
you may have relied on simply are not there yet.

For example, while Samba 3.0 is an excellent member of a Active
Directory domain, Samba4 is happier as a domain controller, and it is
in this role where it has seen deployment into production.

Samba4 is subjected to an awesome battery of tests on an
automated basis, we have found Samba4 to be very stable in it's
behaviour. We have to recommend against upgrading production servers
from Samba 3 to Samba 4 at this stage, because there may be the features on
which you may rely that are not present, or the mapping of
your configuration and user database may not be complete.

If you are upgrading, or looking to develop, test or deploy Samba4, you should
backup all configuration and data.

NEW FEATURES
============

Samba4 supports the server-side of the Active Directory logon environment
used by Windows 2000 and later, so we can do full domain join
and domain logon operations with these clients.

Our Domain Controller (DC) implementation includes our own built-in
LDAP server and Kerberos Key Distribution Center (KDC) as well as the
Samba3-like logon services provided over CIFS. We correctly generate
the infamous Kerberos PAC, and include it with the Kerberos tickets we
issue.

The new VFS features in Samba 4 adapts the filesystem on the server to
match the Windows client semantics, allowing Samba 4 to better match
windows behaviour and application expectations. This includes file
annotation information (in streams) and NT ACLs in particular. The
VFS is backed with an extensive automated test suite.

A new scripting interface has been added to Samba 4, allowing
Python programs to interface to Samba's internals.

The Samba 4 architecture is based around an LDAP-like database that
can use a range of modular backends. One of the backends supports
standards compliant LDAP servers (including OpenLDAP), and we are
working on modules to map between AD-like behaviours and this backend.
We are aiming for Samba 4 to be powerful frontend to large
directories.

CHANGES SINCE alpha9
=====================

Alpha9 was released last week, but in the time since the release we
have found and fixed two important segfaults, and improved the
experimental DRS replication.

CHANGES
=======

Those familiar with Samba 3 can find a list of user-visible changes
since that release series in the NEWS file.

KNOWN ISSUES
============

- Domain member support is in it's infancy, and is not comparable to
the support found in Samba3.

- There is no printing support in the current release.

- There is no NetBIOS browsing support in the current release

- The Samba4 port of the CTDB clustering support is not yet complete

- Clock Synchronisation is critical. Many 'wrong password' errors are
actually due to Kerberos objecting to a clock skew between client
and server. (The NTP work in the previous alphas are partly to assist
with this problem).

- The DRS replication code often fails, and is very new

- Users upgrading existing databases to Samba4 should carefully
consult upgrading-samba4.txt. We have made a number of changes in
this release that should make it easier to upgrade in future.
Btw: there exists also a script under the "setup" directory of the
source distribution called "upgrade_from_s3" which should allow a step-up
from Samba3 to Samba4. It's not included yet in the binary distributions
since it's completely experimental!

- ACL are not set by default on shares created by the provision.
Work is underway on this subject and it should be fixed in Alpha10.

RUNNING Samba4
==============

A short guide to setting up Samba 4 can be found in the howto.txt file
in root of the tarball.

DEVELOPMENT and FEEDBACK
========================

Bugs can be filed at https://bugzilla.samba.org/ but please be aware
that many features are simply not expected to work at this stage.

The Samba Wiki at http://wiki.samba.org should detail some of these
development plans.

Development and general discussion about Samba 4 happens mainly on
the #samba-technical IRC channel (on irc.freenode.net) and
the samba-technical mailing list (see http://lists.samba.org/ for
details).

================
Download Details
================

The release tarball is available from the following location:
* http://download.samba.org/samba/ftp/samba4/samba-4.0.0alpha10.tar.gz

This release has been signed using GPG with Andrew's GPG key (28B436BB).

* http://download.samba.org/samba/ftp/samba4/samba-4.0.0alpha10.tar.asc

To verify that the signature is correct, make sure that the tarball has
been unzipped and run:

$ gpg --verify samba-4.0.0alpha10.tar.asc

Happy testing!

The Samba team

--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team http://samba.org
Samba Developer, Red Hat Inc.

signature.asc (196 bytes) Download Attachment

[ANNOUNCE] Samba 4.0.0alpha9

2009-11-30T21:05:49Z

We are proud to a announce another alpha release of Samba 4.

What's new in Samba 4 alpha9
============================

Samba 4 is the ambitious next version of the Samba suite that is being
developed in parallel to the stable 3.0 series. The main emphasis in
this branch is support for the Active Directory logon protocols used
by Windows 2000 and above.

Samba4 alpha9 follows on from the alpha release series we have been
publishing since September 2007

WARNINGS
========

Samba4 alpha9 is not a final Samba release. That is more a reference
to Samba4's lack of the features we expect you will need than a
statement of code quality, but clearly it hasn't seen a broad
deployment yet. If you were to upgrade Samba3 (or indeed Windows) to
Samba4, you would find many things work, but that other key features
you may have relied on simply are not there yet.

For example, while Samba 3.0 is an excellent member of a Active
Directory domain, Samba4 is happier as a domain controller, and it is
in this role where it has seen deployment into production.

Samba4 is subjected to an awesome battery of tests on an
automated basis, we have found Samba4 to be very stable in it's
behaviour. We have to recommend against upgrading production servers
from Samba 3 to Samba 4 at this stage, because there may be the features on
which you may rely that are not present, or the mapping of
your configuration and user database may not be complete.

If you are upgrading, or looking to develop, test or deploy Samba4, you should
backup all configuration and data.

NEW FEATURES
============

Samba4 supports the server-side of the Active Directory logon environment
used by Windows 2000 and later, so we can do full domain join
and domain logon operations with these clients.

Our Domain Controller (DC) implementation includes our own built-in
LDAP server and Kerberos Key Distribution Center (KDC) as well as the
Samba3-like logon services provided over CIFS. We correctly generate
the infamous Kerberos PAC, and include it with the Kerberos tickets we
issue.

The new VFS features in Samba 4 adapts the filesystem on the server to
match the Windows client semantics, allowing Samba 4 to better match
windows behaviour and application expectations. This includes file
annotation information (in streams) and NT ACLs in particular. The
VFS is backed with an extensive automated test suite.

A new scripting interface has been added to Samba 4, allowing
Python programs to interface to Samba's internals.

The Samba 4 architecture is based around an LDAP-like database that
can use a range of modular backends. One of the backends supports
standards compliant LDAP servers (including OpenLDAP), and we are
working on modules to map between AD-like behaviours and this backend.
We are aiming for Samba 4 to be powerful frontend to large
directories.

CHANGES SINCE alpha8
=====================

In the time since Samba4 alpha8 was released in June 2009, Samba has
continued to evolve, but you may particularly notice these areas
(in no particular order):

Samba4 now includes the full set of user interface strings (display Specifiers)
required to have the Microsoft Management Console operate

LDB (the core Samba4 database library) has again been reworked for
better performance

Replication between Samba4 and Active Directory domains using the
native replication protocol (DRS) has been demonstrated.

Access Control Lists (in nTSecurityDescriptor) are now set correctly
on objects in the directory, based on the same rules as Windows 2008.
(Searches and still use a simplistic administrator/not administrator
criteria)

These are just some of the user-visible highlights of the work done in
the past few months. More details of the work done 'under the hood'
can be found in our GIT history.

CHANGES
=======

Those familiar with Samba 3 can find a list of user-visible changes
since that release series in the NEWS file.

KNOWN ISSUES
============

- Domain member support is in it's infancy, and is not comparable to
the support found in Samba3.

- There is no printing support in the current release.

- There is no NetBIOS browsing support in the current release

- The Samba4 port of the CTDB clustering support is not yet complete

- Clock Synchronisation is critical. Many 'wrong password' errors are
actually due to Kerberos objecting to a clock skew between client
and server. (The NTP work in the previous alphas are partly to assist
with this problem).

- The DRS replication code often fails, and is very new

- Users upgrading existing databases to Samba4 should carefully
consult upgrading-samba4.txt. We have made a number of changes in
this release that should make it easier to upgrade in future.
Btw: there exists also a script under the "setup" directory of the
source distribution called "upgrade_from_s3" which should allow a step-up
from Samba3 to Samba4. It's not included yet in the binary distributions
since it's completely experimental!

- ACL are not set by default on shares created by the provision.
Work is underway on this subject and it should be fixed in Alpha10.

RUNNING Samba4
==============

A short guide to setting up Samba 4 can be found in the howto.txt file
in root of the tarball.

DEVELOPMENT and FEEDBACK
========================

Bugs can be filed at https://bugzilla.samba.org/ but please be aware
that many features are simply not expected to work at this stage.

The Samba Wiki at http://wiki.samba.org should detail some of these
development plans.

Development and general discussion about Samba 4 happens mainly on
the #samba-technical IRC channel (on irc.freenode.net) and
the samba-technical mailing list (see http://lists.samba.org/ for
details).

================
Download Details
================

The release tarball is available from the following location:
* http://download.samba.org/samba/ftp/samba4/samba-4.0.0alpha9.tar.gz

This release has been signed using GPG with Andrew's GPG key (28B436BB).

* http://download.samba.org/samba/ftp/samba4/samba-4.0.0alpha9.tar.asc

To verify that the signature is correct, make sure that the tarball has
been unzipped and run:

$ gpg --verify samba-4.0.0alpha9.tar.asc

Happy testing!

The Samba team

--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team http://samba.org
Samba Developer, Red Hat Inc.

signature.asc (196 bytes) Download Attachment

[Announce] Samba 3.5.0pre1 Available for Download

2009-11-26T06:27:48Z

Release Announcements
=====================

This is the first preview release of Samba 3.5. This is *not*
intended for production environments and is designed for testing
purposes only. Please report any defects via the Samba bug reporting
system at https://bugzilla.samba.org/.

Major enhancements in Samba 3.5.0 include:

General changes:
o Add support for full Windows timestamp resolution

Protocol changes:
o Experimental implementation of SMB2

Printing Changes:
o Add encryption support for connections to a CUPS server

Winbind changes:
o Major refactoring
o Asynchronous

General changes:
================

Support for full Windows timestamp resolution has been added. This effectively
makes us use Windows' full 100ns timestamp resolution if supported by the
kernel (2.6.22 and higher) and the glibc (2.6 and higher).

Protocol changes
================

An EXPERIMENTAL implementation of the SMB2 protocol has been added. SMB2 can be
enabled by setting "max protocol = smb2". SMB2 is a new implementation of the
SMB protocol used by Windows Vista and higher.

Printing Changes
================

A new parameter "cups encrypt" has been added to control whether connections to
CUPS servers will be encrypted or not. The default is to use unencrypted
connections.

Winbind changes
===============

The Winbind daemon has been refactored internally to be asynchronous. The new
Winbind will not be blocked by running 'wbinfo -g' or 'wbinfo -u'.

######################################################################
Changes
#######

smb.conf changes
----------------

Parameter Name Description Default
-------------- ----------- -------

create krb5 conf New yes
ctdb timeout New 0
cups encrypt New no
debug hires timestamp Changed Default yes
ldap follow referral New auto

New configure options
---------------------

--enable-external-libtalloc Enable external tdb
--enable-netapi Turn on netapi support
--enable-pthreadpool Enable pthreads pool helper support
--with-cifsumount Include umount.cifs (Linux only) support
--with-codepagedir=DIR Where to put codepages

Commit Highlights
=================

o Björn Jacke <bjacke@...>
* Add support for full Windows timestamp resolution.
* Add encryption support for connections to a CUPS server.

o Volker Lendecke <vl@...>
* Major internal refactoring of the Winbind daemon.
* Make Winbind asynchronous.

o Stefan Metzmacher <metze@...>
* Implement the new SMB2 protocol (experimental).

######################################################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical IRC channel on irc.freenode.net.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored. All bug reports should
be filed under the Samba 3.5 product in the project's Bugzilla
database (https://bugzilla.samba.org/).

======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================

attachment0 (205 bytes) Download Attachment

[Announce] Samba 3.4.3 Available for Download

2009-10-29T04:18:43Z

=================================================================
"I never met a chocolate I didn't like."

Deanna Troi (Marina Sirtis) in
Star Trek: The Next Generation
=================================================================

Release Announcements
=====================

This is the latest stable release of Samba 3.4.

Major enhancements in Samba 3.4.3 include:

o Fix trust relationships to windows 2008 (2008 r2) (bug #6711).
o Fix file corruption using smbclient with NT4 server (bug #6606).
o Fix Windows 7 share access (which defaults to NTLMv2) (bug #6680).

######################################################################
Changes
#######

Changes since 3.4.2
-------------------

o Jeremy Allison <jra@...>
* BUG 6529: Offline files conflict with Vista and Office 2003.
* BUG 6726: SIVAL should have been an SVAL.
* BUG 6769: Fix symlink unlink.
* BUG 6774: smbd crashes if "aio write behind" is set.
* BUG 6776: Fix core dump caused by running overlapping Byte Lock test.
* BUG 6781: Fix renaming subfolders in Explorer view.
* BUG 6793: Fix Winbind crash with "INTERNAL ERROR: Signal 6".
* BUG 6796: Deleting an event context on shutdown can cause smbd to crash.
* BUG 6828: Fix infinite timeout when byte lock held outside of Samba.
* BUG 6829: Fix displaying of multibyte characters in smbclient.

o Günther Deschner <gd@...>
* BUG 6711: Fix trust relationships to windows 2008 (2008 r2).
* BUG 6815: Fix Windows 2008 R2 SPNEGO negTokenTarg parsing failure.

o Olaf Flebbe <o.flebbe@...>
* BUG 6772: Allow outstanding_aio_calls to be decremented.
* BUG 6804: Fix hpux compiler issue.
* BUG 6805: Correctly handle aio_error() and errno.

o Björn Jacke <bj@...>
* BUG 6704: Fix syntax error in avahi configure test.
* BUG 6728: BSD needs sys/sysctl.h included to build properly.
* BUG 6824: Fix avahi activation.
* QNX doesn't know uint - replace with uint_t.

o Andrew Klosterman <andrew.klosterman+samba_bugzilla@...>
* BUG 6690: Fix wrong error check in profile.

o Marc Aurele La France <tsi@...>
* BUG 6707: Fix an occasional segfault in config file parsing.

o Jeff Layton <jlayton@...>
* BUG 6810: Add support for finding alternate credcaches to cifs.upcall.

o Volker Lendecke <vl@...>
* BUG 6606: Fix file corruption using smbclient with NT4 server.
* BUG 6703: Allow smbstatus as non-root.
* BUG 6731: Fix reading beyond the end of a named stream in xattr_streams.
* BUG 6765: Add a "hidden" parameter "share:fake_fscaps".
* BUG 6793: Fix segfault in winbindd_pam_auth.
* BUG 6797: Fix a memleak in libwbclient.
* BUG 6807: Fix a segfault in "net rpc trustdom list" for long domain names.
* Fix an uninitialized variable.
* Only ever handle one event after a select call.

o Derrell Lipman <derrell.lipman@...>
* BUG 6532: Fix domain enumeration if master browser has space in name.

o Stefan Metzmacher <metze@...>
* BUG 6711: Fix trust relationships to windows 2008 (2008 r2).

o Buchan Milne <bgmilne@...>
* BUG 6791: Fix linking order in cifs.upcall.

o Lars Müller <lars@...>
* BUG 6710: Adjust regex to match variable names including underscores.
* Conditional install of the cifs.upcall man page.

o Shirish Pargaonkar <shirishpargaonkar@...>
* BUG 4675: mount.cifs: Do not attempt to update /etc/mtab if it is
a symbolic link.

o Karolin Seeger <kseeger@...>
* Fix warning occuring when building the manpages.

o Simo Sorce <ssorce@...>
* BUG 6764: Fix timeval calculation.

o Bo Yang <boyang@...>
* BUG 6735: Don't overwrite password in pam_winbind, subsequent pam modules
might use the old password and new password.
* BUG 6811: Fix reference to freed memory in pam_winbind.
* BUG 6826: Don't fail authentication when one or some group of
require-membership-of is invalid.
* BUG 6840: Fix crash in pam_winbind.

======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/stable

The release notes are available online at:

http://www.samba.org/samba/history/samba-3.4.3.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[ANNOUNCE] Samba 3.3.9 Maintenance Release Available

2009-10-15T05:02:08Z

==================================================================
“I found that dance was key to keeping depression
out of my life. When you dance, things just go
away, things don't seem so bad. There's no better
way to take care of health than through something
as joyous and beautiful as dance.”

Patrick Swayze
==================================================================

Release Announcements
=====================

This is the latest bugfix release of the Samba 3.3 series.

Major enhancements in Samba 3.3.9 include:

o Fix trust relationships to windows 2008 (2008 r2) (bug #6711).
o Fix file corruption using smbclient with NT4 server (bug #6606).
o Fix Windows 7 share access (which defaults to NTLMv2) (bug #6680).
o Fix SAMR server for Winbind access (bug #6504).

######################################################################
Changes
#######

Changes since 3.3.8
-------------------

o Michael Adam <obnox@...>
* BUG 6509: Use gid (not uid) cache in fetch_gid_from_cache().
* BUG 6692: Fix mount.cifs segfault.

o Jeremy Allison <jra@...>
* BUG 6504: Fix SAMR server for Winbind access.
* BUG 6769: Symlink unlink does nothing.
* BUG 6776: Fix core dump when running overlapping Byte Lock test.
* BUG 6781: Fix renaming of subfolders in Explorer view.

o Yannick Bergeron <burgergold@...>
* Increase the max_grp value to 128 (AIX NGROUPS_MAX value).

o Guenther Deschner <gd@...>
* BUG 6680: Fix Windows 7 share access (which defaults to NTLMv2).
* BUG 6697: Fix interdomain trusts with Windows 2008 R2 DCs.
* BUG 6700: Use DNS domain name when needing to guess server principal.
* BUG 6711: Fix trust relationships to windows 2008 (2008 r2).
* BUG 6789: Remove unrequired dependency on popt for [u]mount.cifs.

o Andrew Klosterman <andrew.klosterman+samba_bugzilla@...>
* BUG 6690: Fix error check.

o Volker Lendecke <vl@...>
* BUG 5886: Fix password change propagation.
* BUG 6349: Initialize domain info struct.
* BUG 6585: Fix unqualified "net join".
* BUG 6606: Fix file corruption using smbclient with NT4 server.
* BUG 6646: Correctly chew keepalive packets.
* BUG 6785: Only ever handle one event after a select call.
* BUG 6797: Fix a memleak in libwbclient.

o Derrell Lipman <derrell.lipman@...>
* BUG 6532: Fix domain enumeration if master browser has space in name.

o Stefan Metzmacher <metze@...>
* BUG 6627: Raise the timeout for lsa_Lookup*() calls
from 10 to 35 seconds.
* BUG 6664: Make sure we don't truncate the session key to 8 bytes.
* BUG 6711: Fix trust relationships to windows 2008 (2008 r2).

o Simo Sorce <idra@...>
* BUG 6693: Check we read off the complete event from inotify.

o TAKEDA Yasuma <yasuma@...>
* BUG 5879: Update LDAP schema for Netscape DS 5.

o Kumar Thangavelu <Kumar.Thangavelu@...>
* BUG 6420: Fix 'net' crash when attempting to join a
domain.

o Bo Yang <boyang@...>
* BUG 6615: Fix browsing DFS when using kerberos in libsmbclient.
* BUG 6735: Don't overwrite password in pam_winbind.

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.3.9.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.0.37 Security Release Available

2009-10-01T06:00:44Z

Release Announcements
=====================

This is a security release in order to address CVE-2009-2813, CVE-2009-2948
and CVE-2009-2906.

o CVE-2009-2813:
In all versions of Samba later than 3.0.11, connecting to the home
share of a user will use the root of the filesystem
as the home directory if this user is misconfigured to have
an empty home directory in /etc/passwd.

o CVE-2009-2948:
If mount.cifs is installed as a setuid program, a user can pass it a
credential or password path to which he or she does not have access and
then use the --verbose option to view the first line of that file.
All known Samba versions are affected.

o CVE-2009-2906:
Specially crafted SMB requests on authenticated SMB connections can
send smbd into a 100% CPU loop, causing a DoS on the Samba server.

######################################################################
Changes
#######

Changes since 3.0.36
--------------------

o Jeremy Allison <jra@...>
* BUG 6763: Fix for CVE-2009-2813.
* BUG 6768: Fix for CVE-2009-2906.

o Jeff Layton <jlayton@...>
* Fix for CVE-2009-2948.

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.0.37.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.2.15 Security Release Available

2009-10-01T05:59:43Z

Release Announcements
=====================

This is a security release in order to address CVE-2009-2813, CVE-2009-2948
and CVE-2009-2906.

o CVE-2009-2813:
In all versions of Samba later than 3.0.11, connecting to the home
share of a user will use the root of the filesystem
as the home directory if this user is misconfigured to have
an empty home directory in /etc/passwd.

o CVE-2009-2948:
If mount.cifs is installed as a setuid program, a user can pass it a
credential or password path to which he or she does not have access and
then use the --verbose option to view the first line of that file.
All known Samba versions are affected.

o CVE-2009-2906:
Specially crafted SMB requests on authenticated SMB connections can
send smbd into a 100% CPU loop, causing a DoS on the Samba server.

######################################################################
Changes
#######

Changes since 3.2.14
--------------------

o Jeremy Allison <jra@...>
* BUG 6763: Fix for CVE-2009-2813.
* BUG 6768: Fix for CVE-2009-2906.

o Jeff Layton <jlayton@...>
* Fix for CVE-2009-2948.

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.2.15.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.3.8 Security Release Available

2009-10-01T05:58:32Z

Release Announcements
=====================

This is a security release in order to address CVE-2009-2813, CVE-2009-2948
and CVE-2009-2906.

o CVE-2009-2813:
In all versions of Samba later than 3.0.11, connecting to the home
share of a user will use the root of the filesystem
as the home directory if this user is misconfigured to have
an empty home directory in /etc/passwd.

o CVE-2009-2948:
If mount.cifs is installed as a setuid program, a user can pass it a
credential or password path to which he or she does not have access and
then use the --verbose option to view the first line of that file.
All known Samba versions are affected.

o CVE-2009-2906:
Specially crafted SMB requests on authenticated SMB connections can
send smbd into a 100% CPU loop, causing a DoS on the Samba server.

######################################################################
Changes
#######

Changes since 3.3.7
-------------------

o Jeremy Allison <jra@...>
* BUG 6763: Fix for CVE-2009-2813.
* BUG 6768: Fix for CVE-2009-2906.

o Jeff Layton <jlayton@...>
* Fix for CVE-2009-2948.

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.3.8.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.4.2 Security Release Available

2009-10-01T05:57:31Z

Release Announcements
=====================

This is a security release in order to address CVE-2009-2813, CVE-2009-2948
and CVE-2009-2906.

o CVE-2009-2813:
In all versions of Samba later than 3.0.11, connecting to the home
share of a user will use the root of the filesystem
as the home directory if this user is misconfigured to have
an empty home directory in /etc/passwd.

o CVE-2009-2948:
If mount.cifs is installed as a setuid program, a user can pass it a
credential or password path to which he or she does not have access and
then use the --verbose option to view the first line of that file.
All known Samba versions are affected.

o CVE-2009-2906:
Specially crafted SMB requests on authenticated SMB connections can
send smbd into a 100% CPU loop, causing a DoS on the Samba server.

######################################################################
Changes
#######

Changes since 3.4.1
-------------------

o Jeremy Allison <jra@...>
* BUG 6763: Fix for CVE-2009-2813.
* BUG 6768: Fix for CVE-2009-2906.

o Jeff Layton <jlayton@...>
* Fix for CVE-2009-2948.

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.4.2.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.4.1 Available for Download

2009-09-09T07:29:36Z

=================================================================
"I don't know anything about music.
In my line you don't have to."

Elvis Presley
=================================================================

Release Announcements
=====================

This is the latest stable release of Samba 3.4.

Major enhancements in Samba 3.4.1 include:

o Fix authentication on member servers without Winbind (bug #6650).
o Nautilus fails to copy files from an SMB share (bug #6649).
o Fix connections of Win98 clients (bug #6551).
o Fix interdomain trusts with Windows 2008 R2 DCs (bug #6697).
o Fix Winbind authentication issue (bug #6646).

######################################################################
Changes
#######

Changes since 3.4.0
-------------------

o Michael Adam <obnox@...>
* BUG 6650: Fix authentication on member servers without Winbind.

o Jeremy Allison <jra@...>
* BUG 6437: Make open_udp_socket() IPv6 clean.
* BUG 6506: Smbd server doesn't set EAs when a file is overwritten in
NT_TRANSACT_CREATE.
* BUG 6551: Fix connections of Win98 clients.
* BUG 6564: SetPrinter fails (panics) as non root.
* BUG 6593: Correctly implement SMB_INFO_STANDARD setfileinfo.
* BUG 6649: Nautilus fails to copy files from an SMB share.
* BUG 6651: Fix smbd SIGSEGV when breaking oplocks.
* BUG 6673: Fix 'smbpasswd' with "unix password sync = yes".

o Yannick Bergeron <burgergold@...>
* Increase the max_grp value to 128 (AIX NGROUPS_MAX value) instead of 32 to
allow AIX to call sys_getgrouplist only once.

o Günther Deschner <gd@...>
* BUG 6568: Fix _spoolss_GetPrintProcessorDirectory() implementation.
* BUG 6607: Fix crash bug in spoolss_addprinterex_level_2.
* BUG 6680: Fix authentication failure from Windows 7 when domain joined.
* BUG 6697: Fix interdomain trusts with Windows 2008 R2 DCs.

o Olaf Flebbe <flebbe@...>
* BUG 6655: Fix 'smbcontrol smbd ping'.

o Björn Jacke <bj@...>
* BUG 6105: Make linking of rpcclient --as-needed safe.

o Matt Kraai <mkraai@...>
* BUG 6630: Fix opening of sockets on QNX.

o Robert LeBlanc <robert@...>
* BUG 6700: Use dns domain name when needing to guess server principal.

o Volker Lendecke <vl@...>
* BUG 5886: Fix password change propagation with ldapsam.
* BUG 6585: Fix unqualified "net join".
* BUG 6611: Fix a valgrind error in chain_reply.
* BUG 6646: Fix Winbind authentication issue.
* Fix linking on Solaris.

o Stefan Metzmacher <metze@...>
* BUG 6222: Default to DRSUAPI replication for net rpc vampire keytab.
* BUG 6532: Fix the build with external talloc.
* BUG 6538: Cancel all locks that are made before the first failure.
* BUG 6627: Raise the timeout for lsa_Lookup*() calls from 10 to 35 seconds.
* BUG 6651: Fix smbd SIGSEGV when breaking oplocks.
* BUG 6664: Fix truncation of the session key.

o Tim Prouty <tprouty@...>
* BUG 6620: Fix a bug in renames of directories.

o Rusty Russell <rusty@...>
* BUG 6601: Avoid global fd limits.

o SATOH Fumiyasu <fumiyas@...>
* BUG 6496: MS-DFS cannot follow multibyte char link name in libsmbclient.

o Simo Sorce <idra@...>
* BUG 6693: Check we read off the complete event from inotify.

o Peter Volkov <pva@...>
* BUG 6105: Make linking of cifs.upcall --as-needed safe.

o TAKEDA Yasuma <yasuma@...>
* BUG 5879: Update LDAP schema for Netscape DS 5.

o Bo Yang <boyang@...>
* BUG 6560: Fix lookupname.
* BUG 6615: Fix browsing of DFS when using kerberos in libsmbclient.
* BUG 6688: Fix crash in 'net usershare list'.

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/stable

The release notes are available online at:

http://www.samba.org/samba/history/samba-3.4.1.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.2.14 Maintenance Release Available

2009-08-12T07:18:53Z

================================================================
"I think there is a world market
for maybe five computers."

Thomas Watson
================================================================

Release Announcements
=====================

This is the last maintenance release of the Samba 3.2 series.

Please note that this is the last bugfix release of the Samba 3.2 series!
There will security releases on demand only. Please see
http://wiki.samba.org/index.php/Samba3_Release_Planning for information
on current releases.

Major enhancements in 3.2.14 include:

o Fix SAMR access checks (e.g. bugs #6089 and #6112).
o Fix 'force user' (bug #6291).
o Improve Win7 support (bug #6099).
o Fix posix ACLs when setting an ACL without explicit ACE for the
owner (bug #2346).

######################################################################
Changes
#######

Changes since 3.2.13
--------------------

o Michael Adam <obnox@...>
* BUG 6387: Fix Winbind crash when multiple IDmappings exist in the
LDAP directory.
* BUG 6509: Use gid (not uid) cache in fetch_gid_from_cache().
* BUG 6628: 'smbpasswd -a' uses algorithmic rid base with
'passdb backend = tdbsam'.
* Prevent creation of keys containing the '/' character.

o Jeremy Allison <jra@...>
* BUG 6089: Fix SAMR access checks.
* BUG 6112: Fix SAMR access checks.
* BUG 6279: Fix Winbind crash.
* BUG 6291: Fix 'force user'.
* BUG 6099: Try to fix domain join of Win7 Beta.
* BUG 6386: Groupdb mapping fix.
* BUG 6421: Fix POSIX read-only open on read-only shares.
* BUG 6476: Fix more smbd-zombies in memory.
* BUG 6488: acl_group_override() call in posix acls references an
uninitialized variable.
* BUG 6504: Fix SAMR server for Winbind access.
* BUG 6520: Fix time stamps.
* Fix join of Windows 7 RC to a Samba3 DC.
* Fix bug in processing of open modes in POSIX open.

o Günther Deschner <gd@...>
* BUG 6301: Fix samr_ConnectVersion enum which is 32bit not 16bit.
* BUG 6340: Don't segfault when cleartext trustdom pwd could not be
retrieved.
* BUG 6372: Fix usermanager only displaying 1024 groups and aliases.
* BUG 6465: Fix enum_aliasmem in ldb branch.
* BUG 6484: Fix searching for users while adding them to groups via
Windows usermanager.
* Fix the negotiate flags.
* Protect netlogon_creds_server_step() against NULL creds.

o Björn Jacke <bj@...>
* Also handle DirX return codes.

o Stefan Metzmacher <metze@...>
* BUG 2346: Fix posix ACLs when setting an ACL without explicit ACE for the
owner.
* BUG 6526: Let parent_dirname() correctly return toplevel filenames.
* BUG 6627: Raise the timeout for lsa_Lookup*() calls from 10 to 35 seconds.
* Fix a crash bug if we timeout in net rpc trustdom list.
* Add '--request-timeout' option to 'net'.

o Volker Lendecke <vl@...>
* BUG 5798: Preserve CFLAGS info in configure.
* BUG 6382: Case insensitive access to DFS links broken.
* Fix a race condition in Winbind leading to a panic.
* Add workaround for MS KB932762.

o Jim McDonough <jmcd@...>
* BUG 6481: Don't require "Modify property" perms to unjoin.

o Sébastien Prud'homme <sebastien.prudhomme@...>
* 5945: Fix out of memory error with Winbind idmap.

o Simo Sorce <ssorce@...>
* BUG 6628: 'smbpasswd -a' uses algorithmic rid base with
'passdb backend = tdbsam'.
* Avoid duplicate ACEs.
* Fix profile ACLs in some corner cases.

o Marc VanHeyningen <marc.vanheyningen@...>
* Zero an uninitialized array.

o Bo Yang <boyang@...>
* BUG 6560: Lookupname failed, cannot find domain when attempt
to change password.

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.2.14.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.0.36 Maintenance Release Available

2009-08-05T03:26:39Z

================================================================
"Because things are the way they are,
things will not stay the way they are."

Bertolt Brecht
================================================================

Release Announcements
=====================

This is the latest bugfix release of the Samba 3.0 series.

Please note, that the 3.0 series will be DISCONTINUED after this release!
There will be neither any bugfix release nor any security release. Updating
to the latest release series is strongly recommended. For more information
on current Samba releases, please see

http://wiki.samba.org/index.php/Samba3_Release_Planning

Major enhancements included in Samba 3.0.36 are:

o Fix Winbind crash on 'getent group' (bug #5906).
o Excel save operation corrupts file ACLs (bug #4308).
o Prevent segmentation fault on joining a very long domain name.

######################################################################
Changes
#######

Changes since 3.0.35
--------------------

o Michael Adam <obnox@...>
* BUG 5906: Fix Winbind crash on 'getent group'.
* BUG 6066: netinet/ip.h present but cannot be compiled on Solaris.

o Jeremy Allison <jra@...>
* BUG 4308: Excel save operation corrupts file ACLs.
* BUG 6099: In order to allow Win7 to connect to a Samba NT style
* BUG 6279: Fix Winbind crash.
PDC we set the flags before we know if it's an error or not.
* Fix logic error in try_chown.
* Correctly use chroot().
* Fix bug in processing of open modes in POSIX open.

o Günther Deschner <gd@...>
* Don't install the cifs.upcall binary twice.

o Steve French <smfrench@...>
* BUG 4640: Fix guest mounts in mount-cifs.
* Fix mount.cifs handling of -V option.

o Bhaskar Jain (bhajain) <bhajain@...>
* Prevent segmentation fault on joining a very long domain name.

o Günter Kukkukk <linux@...>
* Don't try and delete a default ACL from a file.

o Volker Lendecke <vl@...>
* Add workaround for MS KB932762.

o Shirish Pargaonkar <shirishpargaonkar@...>
* BUG 4370: Clean-up entries in /etc/mtab after unmount.
* Add fakemount (-f) and nomtab (-n) flags to mount.cifs.

o Ted Percival <ted.percival@...>
* Fix a crash during name resolution when log level >= 10
and libc segfaults if printf is passed NULL for a "%s" arg
(eg. Solaris).

o Miguel Suarez <Miguel.Suarez@...>
* BUG 6085: Fix build of vfs_default.

o Yasuma Takeda <yasuma@...>
* BUG 6098: When the DNS server is invalid, the ads_find_dc() does not work
correctly.

######################################################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical IRC channel on irc.freenode.net.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored. All bug reports should
be filed under the Samba 3.0 product in the project's Bugzilla
database (https://bugzilla.samba.org/).

======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.0.36.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.3.7 Available for Download

2009-07-29T02:33:33Z

=================================================================
"We'll love you just the way you are
if you're perfect."

Alanis Morissette
=================================================================

Release Announcements
=====================

This is the latest bugfix release of the Samba 3.3 series.

######################################################################
Changes
#######

Changes since 3.3.6:
--------------------

o Jeremy Allison <jra@...>
* BUG 6421: Fix POSIX read-only open on read-only shares.
* BUG 6476: Fix smbd zombies in memory when using [x]inetd.
* BUG 6487: Add missing DFS call in trans2 mkdir call.
* BUG 6520: Fix time stamps when "unix extensions = yes".

o Günther Deschner <gd@...>
* BUG 6253: Use correct value for password expiry calculation in
pam_winbind.
* BUG 6340: Fix segfault when cleartext trustdom pwd could not be retrieved.
* BUG 6451: Use right access bits in net/libnetapi user rename.
* BUG 6484: Fix _lsa_LookupNames2() server implementation which always
returned a NULL sid_array.

o Björn Jacke <bj@...>
* BUG 6497: Fix configure error.

o Volker Lendecke <vl@...>
* BUG 6498: Add workaround for MS KB932762.

o Jim McDonough <jmcd@...>
* BUG 6481: Don't require "Modify property" perms to unjoin.

o Stefan Metzmacher <metze@...>
* BUG 6526: Let parent_dirname() correctly return toplevel filenames.

o Bo Yang <boyang@...>
* BUG 6560: Fix handling of UPN.

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.3.7.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.4.0 Available for Download

2009-07-03T07:30:11Z

=================================================================
"Always keep an open mind and a
compassionate heart."

Phil Jackson
=================================================================

Release Announcements
=====================

This is the first stable release of Samba 3.4.

Major enhancements in Samba 3.4.0 include:
------------------------------------------

Configuration changes:
o The default passdb backend has been changed to 'tdbsam'!

General changes:
o Samba4 and Samba3 sources are included in the tarball

Authentication Changes:
o Changed the way smbd handles untrusted domain names given during user
authentication.

Printing Changes:
o Various fixes including printer change notificiation for Samba spoolss
print servers.

Internal changes:
o The remaining hand-marshalled DCE/RPC services (ntsvcs, svcctl, eventlog
and spoolss) were replaced by autogenerated code based on PIDL.
o Samba3 and Samba4 do now share a common tevent library.
o The code has been cleaned up and the major basic interfaces are shared with
Samba4 now.
o An asynchronous API has been added.

Configuration changes
=====================

!!! ATTENTION !!!
The default passdb backend has been changed to 'tdbsam'! That breaks existing
setups using the 'smbpasswd' backend without explicit declaration! Please use
'passdb backend = smbpasswd' if you would like to stick to the 'smbpasswd'
backend or convert your smbpasswd entries using e.g. 'pdbedit -i smbpasswd -e
tdbsam'.

The 'tdbsam' backend is much more flexible concerning per user settings
like 'profile path' or 'home directory' and there are some commands which do not
work with the 'smbpasswd' backend at all.

General Changes
===============

On the way towards a standalone Samba AD domain controller, Samba3 and Samba4
branches can be built as "merged" build. That's why Samba3 and Samba4 sources
are included in the tarball. The merged build is possible in Samba 3.4.0, but
disabled by default. To learn more about the merged build,
please see http://wiki.samba.org/index.php/Franky.

According to this one, there is no "source" directory included in the tarball at
all. Samba3 sources are located in "source3", Samba4 sources are located in
"source4". The libraries have been moved to the toplevel directory.

To build plain Samba3, please change to "source3" and start the build as usual.
To build Samba4 as well, please use the "--enable-merged-build" configure
option.

Authentication Changes
======================

Previously, when Samba was a domain member and a client was connecting using an
untrusted domain name, such as BOGUS\user smbd would remap the untrusted
domain to the primary domain smbd was a member of and attempt authentication
using that DOMAIN\user name. This differed from how a Windows member server
would behave. Now, smbd will replace the BOGUS name with it's SAM name. In
the case where smbd is acting as a PDC this will be DOMAIN\user. In the case
where smbd is acting as a domain member server this will be WORKSTATION\user.
Thus, smbd will never assume that an incoming user name which is not qualified
with the same primary domain, is part of smbd's primary domain.

While this behavior matches Windows, it may break some workflows which depended
on smbd to always pass through bogus names to the DC for verification. A new
parameter "map untrusted to domain" can be enabled to revert to the legacy
behavior.

Printing Changes
================

The spoolss subsystem was replaced by autogenerated code based on PIDL. That fixes
several printing issues including printer change notificiation on Samba print
servers and will stabilize the printing functionality generally.
The support for spoolss printing with Windows Vista has been improved.

Internal Changes
================

The remaining hand-marshalled DCE/RPC services (ntsvcs, svcctl, eventlog and
spoolss) were replaced by autogenerated code based on PIDL.
So Günther Deschner finally corrected one of the biggest mistakes in the
development of Samba: Hand-marshalled RPC stubs.

Thanks a lot! :-)

Samba3 and Samba4 do now share a common tevent library for fd and timer events.

The code has been cleaned up and Samba3 and Samba4 do share the major basic
interfaces now. That is why the libraries were moved to the toplevel directory.
That is one of the first steps to share code and minimize the gap between
these two versions.

An asynchronous API has been added.

######################################################################
Changes
#######

smb.conf changes
----------------

Parameter Name Description Default
-------------- ----------- -------

access based share enum New No
dedicated keytab file New ""
kerberos method New default
map untrusted to domain New No
max open files Changed Default auto detected
passdb backend Changed Default tdbsam
perfcount module New ""
use kerberos keytab Removed

New [sub]commands
-----------------

net eventlog Import/dump/export native win32 eventlog files.
net rpc service create Create a new service.
net rpc service delete Delete an existing service.

New configure options
---------------------

--enable-external-libtalloc Enable external talloc
--enable-merged-build Build Samba 4 as well
--enable-gnutls Turn on gnutls support
--with-statedir=DIR Where to put persistent state files
--with-cachedir=DIR Where to put temporary cache files
--with-ncalprcdir=DIR Where to put ncalrpc sockets
--with-selftest-shrdir=DIR The share directory that make test will be run
against
--with-selftest-custom-conf=PATH
An optional custom smb.conf that is included in
the server smb.conf during make test
--with-wbclient Use external wbclient
--with-included-popt Use bundled popt library, not from system
--with-libiconv=BASEDIR Use libiconv in BASEDIR/lib and BASEDIR/include
--with-sqlite3 SQLITE3 backend support
--with-pthreads Include pthreads
--with-setproctitle Search for setproctitle support

Commit Highlights
=================

o Steven Danneman <steven.danneman@...>
* Change the way smbd handles untrusted domain names given during user
authentication.

o Guenther Deschner <gd@...>
* Replace the hand-marshalled DCE/RPC services ntsvcs, svcctl, eventlog
and spoolss by autogenerated code based on PIDL.
* Fix several printing issues and improve support for printer change
notificiations.
* Add 'net eventlog'.

o Volker Lendecke <vl@...>
* Add asynchronous API.

o Stefan Metzmacher <metze@...>
* Make Samba3 and Samba4 share a tevent library.

o Dan Sledz <dsledz@...>
* Add two new parameters to control how we verify kerberos tickets.

o Danny Tylman <danny.tylman@...>
* Add 'net rpc service' subcommands 'create' and 'delete'.

o Jelmer Vernooij <jelmer@...>
* Make merged build possible.
* Move common libraries to the shared lib/ directory.

Changes since 3.4.0rc1
----------------------

o Jeremy Allison <jra@...>
* BUG 6520: Fix time stamps when "unix extensions = yes".

o Michael Adam <obnox@...>
* BUG 6509: Use gid (not uid) cache in fetch_gid_from_cache().
* BUG 6521: Fix building tevent_ntstatus without config.h.
* BUG 6531: Fix pid file name.

o Guenther Deschner <gd@...>
* BUG 6512: Fix support for enumerating user forms.

o Bjoern Jacke <bj@...>
* BUG 6497: Fix calling of 'test' in configure.
* BUG 6459: Fix build of pam_smbpass on some distributions.

o Volker Lendecke <vl@...>
* BUG 6431: Local groups from 3.0 setups no longer found.
* BUG 6498: Add workaround for MS KB932762.

o David Markey <admin@...>
* BUG 6514: Improve error message in 'net' when smb.conf is not available.

o Jim McDonough <jmcd@...>
* BUG 6481: 'net ads leave' needs to try account deletion, NetUnjoinDomain
not.

o Stefan Metzmacher <metze@...>
* BUG 6526: Fix notifies in the share root directory.

o Bo Yang <boyang@...>
* BUG 6499: Fix building of pam_smbpass.

Changes since 3.4.0pre2
-----------------------

o Jeremy Allison <jra@...>
* BUG 6297: Owner of sticky directory cannot delete files created by
others.
* BUG 6476: Fix smbd-zombies in memory when using [x]inetd.
* BUG 6487: Add missing DFS call in trans2 mkdir call.
* BUG 6488: acl_group_override() call in posix acls references an
uninitialized variable.

o Günther Deschner <gd@...>
* BUG 5456: Fix "net ads testjoin".
* BUG 6253: Use correct value for password expiry calculation in
pam_winbind.
* BUG 6305: Correctly prompt for a password when a username was given.
* BUG 6451: net/libnetapi user rename using wrong access bits.
* BUG 6458: Fix uninitialized variable in local_password_change().
* BUG 6465: Fix enumeration of empty aliases.

o Volker Lendecke <vl@...>
* BUG 4699: Remove pidfile on clean shutdown.
* BUG 6449: 'net rap user add' crashes without -C option.

o David Markey <admin@...>
* BUG 6328: Add support for multiple rights to
"net sam rights grant/revoke".

o Andreas Schneider <mail@...>
* Improve pam_winbind documentation.

o Simo Sorce <idra@...>
* BUG 6081: Make it possible to change machine account sids.
* BUG 6333: Consolidate create/delete account paths in pdbedit.

o Jelmer Vernooij <jelmer@...>
* Remove outdated Debian package sources.

Changes since 3.4.0pre1
-----------------------

o Jeremy Allison <jra@...>
* BUG 6291: Fix 'force user'.
* BUG 6313: ldapsam_update_sam_account() crashes while doing talloc_free on
malloced memory.
* BUG 6315: Fix smbd crashes when doing vfs_full_audit on IPC$ close event.
* BUG 6330: Fix DFS on AIX.
* Fix a bunch of compiler warnings about wrong format types.
* Fix the core of the SAMR access functions.
* Fix SAMR server for winbindd access.

o Michael Adam <obnox@...>
* BUG 4271: testparm should not print includes.
* BUG 6292: Update config.guess from gnu.org.
* BUG 6320: Handle registry config source in file_list.
* BUG 6371: Unsuccessful 'net conf setparm' leaves empty share.
* BUG 6387: Fix a crash bug in idmap_ldap_unixids_to_sids.
* BUG 6415: Filter out of range mappings in default idmap config
(idmap_tdb).
* BUG 6416: Filter out of range mappings in default idmap config
(idmap_tdb2).
* BUG 6417: Filter out of range mappings in default idmap config
(idmap_ldap).
* Add dbwrap_tool - a tdb tool that is CTDB-aware.
* Hide "config backend" from swat.
* Fix linking with --disable-shared-libs.

o Steven Danneman <steven.danneman@...>
* Fix issue with missing entries when enumerating directories.
* Map NULL domains to our global sam name.

o Günther Deschner <gd@...>
* BUG 5859: Fix renaming of samr objects failed due to samr setuserinfo
access checks.
* BUG 6099: Fix NETLOGON credential chain.
* BUG 6253: Use correct value for password expiry calculation.
* BUG 6309: Support remote unjoining of Windows 2003 or greater.
* BUG 6340: Don't segfault when cleartext trustdom pwd could not be
retrieved.
* BUG 6372: usermanager only displaying 1024 groups and aliases.
* Fix driver upload for Xerox 4110 PS printer driver.
* Add "net dom renamecomputer" to rename machines in a domain.
* Inspect the correct computername string before enabling/disabling the
change button in netdomjoin-gui.
* Fix join prompt dialog test in netdomjoin-gui.
* Only gray out labels when not root and not connecting to remote
machines (netdomjoin-gui).
* Allow to switch between workgroups/domains with the same name
(netdomjoin-gui).
* Add NetShutdownInit and NetShutdownAbort.
* Fix samr access checks.
* Add a security model to LSA.
* Fix nss_wrapper build for Solaris.

o Geza Gemes <geza@...>
* BUG 6136: New AFS syscall conventions.

o Ole Hansen <ole@...>
* BUG 6359: smbclient -L does not list workgroup for hosts with both IPv4
and IPv6 addresses

o Björn Jacke <bj@...>
* Also handle DirX return codes.

o Steve Langasek <vorlon@...>
* BUG 4831: Don't call openlog() or closelog() from pam_smbpass.

o Volker Lendecke <vl@...>
* BUG 5681: Do not limit the number of network interfaces.
* BUG 6157: Fix handling of multi-value attribute "uid".
* BUG 6302: Give the VFS a chance to read from 0-byte files.
* BUG 6336: Fix segfault in 'net groupmap set'.
* BUG 6361: Make --rcfile work in smbget.
* Do not crash in ctdbd_traverse if ctdbd is not around.
* Fix Coverity ID 897.
* Fix a race condition in vfs_aio_fork with gpfs share modes.
* Fix bug disclosed by lock8 torture test.
* Fix a race condition in winbind leading to a panic.
* Attempt to fix a Debian build problem.

o Jim McDonough <jmcd@...>
* Detect tight loop in tdb_find().

o Stefan Metzmacher <metze@...>
* BUG 2346: Fix posix ACLs when setting an ACL without explicit ACE for the
owner.

o Tim Prouty <tprouty@...>
* Fix chained sesssetupAndX/tconn messages.
* Fix strict locking with chained reads.
* Fix two bugs in sendfile.

o Slava Semushin <php-coder@...>
* Fix memory leak.
* Fix file descriptor leak.

o Aravind Srinivasan <aravind.srinivasan@...>
* Fallback to the legacy sid_to_(uid|gid) instead of returning NULL.
* Always allocate memory in dptr_ReadDirName.

o Kumar Thangavelu <Kumar.Thangavelu@...>
* Fix 'net' crash during domain join.

o Marc VanHeyningen <marc.vanheyningen@...>
* Zero an uninitialized array.
* Allow child processes to exit gracefully if we are out of fds.

######################################################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical IRC channel on irc.freenode.net.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored. All bug reports should
be filed under the Samba 3.4 product in the project's Bugzilla
database (https://bugzilla.samba.org/).

======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/stable/

The release notes are available online at:

http://www.samba.org/samba/history/samba-3.4.0.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.3.6 Security Release Available for Download

2009-06-23T07:43:51Z

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.2.13 Security Release Available for Download

2009-06-23T07:42:28Z

Release Announcements
=====================

This is a security release in order to address CVE-2009-1886 and CVE-2009-1888.

o CVE-2009-1886:
In Samba 3.2.0 to 3.2.12 (inclusive), the smbclient commands dealing
with file names treat user input as a format string to asprintf.
With a maliciously crafted file name smbclient can be made
to execute code triggered by the server.

o CVE-2009-1888:
In Samba 3.0.31 to 3.3.5 (inclusive), an uninitialized read of a data
value can potentially affect access control when "dos filemode"
is set to "yes".

######################################################################
Changes
#######

Changes since 3.2.12
--------------------

o Jeremy Allison <jra@...>
* Fix for CVE-2009-1886.
* Fix for CVE-2009-1888.

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.2.13.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.0.35 Security Release Available for Download

2009-06-23T07:41:22Z

Release Announcements
=====================

This is a security release in order to address CVE-2009-1888.

o CVE-2009-1888:
In Samba 3.0.31 to 3.3.5 (inclusive), an uninitialized read of a
data value can potentially affect access control when "dos filemode"
is set to "yes".

######################################################################
Changes
#######

Changes since 3.0.34
--------------------

o Jeremy Allison <jra@...>
* Fix for CVE-2009-1888.

######################################################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical IRC channel on irc.freenode.net.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored. All bug reports should
be filed under the Samba 3.0 product in the project's Bugzilla
database (https://bugzilla.samba.org/).

======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.0.35.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.4.0rc1 Available for Download

2009-06-19T05:36:05Z

Release Announcements
=====================

This is the first release candidate of Samba 3.4. This is *not*
intended for production environments and is designed for testing
purposes only. Please report any defects via the Samba bug reporting
system at https://bugzilla.samba.org/.

Major enhancements in Samba 3.4.0 include:
------------------------------------------

Configuration changes:
o The default passdb backend has been changed to 'tdbsam'!

General changes:
o Samba4 and Samba3 sources are included in the tarball

Authentication Changes:
o Changed the way smbd handles untrusted domain names given during user
authentication.

Printing Changes:
o Various fixes including printer change notificiation for Samba spoolss
print servers.

Internal changes:
o The remaining hand-marshalled DCE/RPC services (ntsvcs, svcctl, eventlog
and spoolss) were replaced by autogenerated code based on PIDL.
o Samba3 and Samba4 do now share a common tevent library.
o The code has been cleaned up and the major basic interfaces are shared with
Samba4 now.
o An asynchronous API has been added.

Configuration changes
=====================

!!! ATTENTION !!!
The default passdb backend has been changed to 'tdbsam'! That breaks existing
setups using the 'smbpasswd' backend without explicit declaration! Please use
'passdb backend = smbpasswd' if you would like to stick to the 'smbpasswd'
backend or convert your smbpasswd entries using e.g. 'pdbedit -i smbpasswd -e
tdbsam'.

The 'tdbsam' backend is much more flexible concerning per user settings
like 'profile path' or 'home directory' and there are some commands which do not
work with the 'smbpasswd' backend at all.

General Changes
===============

On the way towards a standalone Samba AD domain controller, Samba3 and Samba4
branches can be built as "merged" build. That's why Samba3 and Samba4 sources
are included in the tarball. The merged build is possible in Samba 3.4.0, but
disabled by default. To learn more about the merged build,
please see http://wiki.samba.org/index.php/Franky.

According to this one, there is no "source" directory included in the tarball at
all. Samba3 sources are located in "source3", Samba4 sources are located in
"source4". The libraries have been moved to the toplevel directory.

To build plain Samba3, please change to "source3" and start the build as usual.
To build Samba4 as well, please use the "--enable-merged-build" configure
option.

Authentication Changes
======================

Previously, when Samba was a domain member and a client was connecting using an
untrusted domain name, such as BOGUS\user smbd would remap the untrusted
domain to the primary domain smbd was a member of and attempt authentication
using that DOMAIN\user name. This differed from how a Windows member server
would behave. Now, smbd will replace the BOGUS name with it's SAM name. In
the case where smbd is acting as a PDC this will be DOMAIN\user. In the case
where smbd is acting as a domain member server this will be WORKSTATION\user.
Thus, smbd will never assume that an incoming user name which is not qualified
with the same primary domain, is part of smbd's primary domain.

While this behavior matches Windows, it may break some workflows which depended
on smbd to always pass through bogus names to the DC for verification. A new
parameter "map untrusted to domain" can be enabled to revert to the legacy
behavior.

Printing Changes
================

The spoolss subsystem was replaced by autogenerated code based on PIDL. That fixes
several printing issues including printer change notificiation on Samba print
servers and will stabilize the printing functionality generally.
The support for spoolss printing with Windows Vista has been improved.

Internal Changes
================

The remaining hand-marshalled DCE/RPC services (ntsvcs, svcctl, eventlog and
spoolss) were replaced by autogenerated code based on PIDL.
So Günther Deschner finally corrected one of the biggest mistakes in the
development of Samba: Hand-marshalled RPC stubs.

Thanks a lot! :-)

Samba3 and Samba4 do now share a common tevent library for fd and timer events.

The code has been cleaned up and Samba3 and Samba4 do share the major basic
interfaces now. That is why the libraries were moved to the toplevel directory.
That is one of the first steps to share code and minimize the gap between
these two versions.

An asynchronous API has been added.

######################################################################
Changes
#######

smb.conf changes
----------------

Parameter Name Description Default
-------------- ----------- -------

access based share enum New No
dedicated keytab file New ""
kerberos method New default
map untrusted to domain New No
max open files Changed Default auto detected
passdb backend Changed Default tdbsam
perfcount module New ""
use kerberos keytab Removed

New [sub]commands
-----------------

net eventlog Import/dump/export native win32 eventlog files.
net rpc service create Create a new service.
net rpc service delete Delete an existing service.

New configure options
---------------------

--enable-external-libtalloc Enable external talloc
--enable-merged-build Build Samba 4 as well
--enable-gnutls Turn on gnutls support
--with-statedir=DIR Where to put persistent state files
--with-cachedir=DIR Where to put temporary cache files
--with-ncalprcdir=DIR Where to put ncalrpc sockets
--with-selftest-shrdir=DIR The share directory that make test will be run
against
--with-selftest-custom-conf=PATH
An optional custom smb.conf that is included in
the server smb.conf during make test
--with-wbclient Use external wbclient
--with-included-popt Use bundled popt library, not from system
--with-libiconv=BASEDIR Use libiconv in BASEDIR/lib and BASEDIR/include
--with-sqlite3 SQLITE3 backend support
--with-pthreads Include pthreads
--with-setproctitle Search for setproctitle support

Commit Highlights
=================

o Steven Danneman <steven.danneman@...>
* Change the way smbd handles untrusted domain names given during user
authentication.

o Guenther Deschner <gd@...>
* Replace the hand-marshalled DCE/RPC services ntsvcs, svcctl, eventlog
and spoolss by autogenerated code based on PIDL.
* Fix several printing issues and improve support for printer change
notificiations.
* Add 'net eventlog'.

o Volker Lendecke <vl@...>
* Add asynchronous API.

o Stefan Metzmacher <metze@...>
* Make Samba3 and Samba4 share a tevent library.

o Dan Sledz <dsledz@...>
* Add two new parameters to control how we verify kerberos tickets.

o Danny Tylman <danny.tylman@...>
* Add 'net rpc service' subcommands 'create' and 'delete'.

o Jelmer Vernooij <jelmer@...>
* Make merged build possible.
* Move common libraries to the shared lib/ directory.

Changes since 3.4.0pre2
-----------------------

o Jeremy Allison <jra@...>
* BUG 6297: Owner of sticky directory cannot delete files created by
others.
* BUG 6476: Fix smbd-zombies in memory when using [x]inetd.
* BUG 6487: Add missing DFS call in trans2 mkdir call.
* BUG 6488: acl_group_override() call in posix acls references an
uninitialized variable.

o Günther Deschner <gd@...>
* BUG 5456: Fix "net ads testjoin".
* BUG 6253: Use correct value for password expiry calculation in
pam_winbind.
* BUG 6305: Correctly prompt for a password when a username was given.
* BUG 6451: net/libnetapi user rename using wrong access bits.
* BUG 6458: Fix uninitialized variable in local_password_change().
* BUG 6465: Fix enumeration of empty aliases.

o Volker Lendecke <vl@...>
* BUG 4699: Remove pidfile on clean shutdown.
* BUG 6449: 'net rap user add' crashes without -C option.

o David Markey <admin@...>
* BUG 6328: Add support for multiple rights to
"net sam rights grant/revoke".

o Andreas Schneider <mail@...>
* Improve pam_winbind documentation.

o Simo Sorce <idra@...>
* BUG 6081: Make it possible to change machine account sids.
* BUG 6333: Consolidate create/delete account paths in pdbedit.

o Jelmer Vernooij <jelmer@...>
* Remove outdated Debian package sources.

Changes since 3.4.0pre1
-----------------------

o Jeremy Allison <jra@...>
* BUG 6291: Fix 'force user'.
* BUG 6313: ldapsam_update_sam_account() crashes while doing talloc_free on
malloced memory.
* BUG 6315: Fix smbd crashes when doing vfs_full_audit on IPC$ close event.
* BUG 6330: Fix DFS on AIX.
* Fix a bunch of compiler warnings about wrong format types.
* Fix the core of the SAMR access functions.
* Fix SAMR server for winbindd access.

o Michael Adam <obnox@...>
* BUG 4271: testparm should not print includes.
* BUG 6292: Update config.guess from gnu.org.
* BUG 6320: Handle registry config source in file_list.
* BUG 6371: Unsuccessful 'net conf setparm' leaves empty share.
* BUG 6387: Fix a crash bug in idmap_ldap_unixids_to_sids.
* BUG 6415: Filter out of range mappings in default idmap config
(idmap_tdb).
* BUG 6416: Filter out of range mappings in default idmap config
(idmap_tdb2).
* BUG 6417: Filter out of range mappings in default idmap config
(idmap_ldap).
* Add dbwrap_tool - a tdb tool that is CTDB-aware.
* Hide "config backend" from swat.
* Fix linking with --disable-shared-libs.

o Steven Danneman <steven.danneman@...>
* Fix issue with missing entries when enumerating directories.
* Map NULL domains to our global sam name.

o Günther Deschner <gd@...>
* BUG 5859: Fix renaming of samr objects failed due to samr setuserinfo
access checks.
* BUG 6099: Fix NETLOGON credential chain.
* BUG 6253: Use correct value for password expiry calculation.
* BUG 6309: Support remote unjoining of Windows 2003 or greater.
* BUG 6340: Don't segfault when cleartext trustdom pwd could not be
retrieved.
* BUG 6372: usermanager only displaying 1024 groups and aliases.
* Fix driver upload for Xerox 4110 PS printer driver.
* Add "net dom renamecomputer" to rename machines in a domain.
* Inspect the correct computername string before enabling/disabling the
change button in netdomjoin-gui.
* Fix join prompt dialog test in netdomjoin-gui.
* Only gray out labels when not root and not connecting to remote
machines (netdomjoin-gui).
* Allow to switch between workgroups/domains with the same name
(netdomjoin-gui).
* Add NetShutdownInit and NetShutdownAbort.
* Fix samr access checks.
* Add a security model to LSA.
* Fix nss_wrapper build for Solaris.

o Geza Gemes <geza@...>
* BUG 6136: New AFS syscall conventions.

o Ole Hansen <ole@...>
* BUG 6359: smbclient -L does not list workgroup for hosts with both IPv4
and IPv6 addresses

o Björn Jacke <bj@...>
* BUG 4831: Don't call openlog() or closelog() from pam_smbpass.
* Also handle DirX return codes.

o Volker Lendecke <vl@...>
* BUG 5681: Do not limit the number of network interfaces.
* BUG 6157: Fix handling of multi-value attribute "uid".
* BUG 6302: Give the VFS a chance to read from 0-byte files.
* BUG 6336: Fix segfault in 'net groupmap set'.
* BUG 6361: Make --rcfile work in smbget.
* Do not crash in ctdbd_traverse if ctdbd is not around.
* Fix Coverity ID 897.
* Fix a race condition in vfs_aio_fork with gpfs share modes.
* Fix bug disclosed by lock8 torture test.
* Fix a race condition in winbind leading to a panic.
* Attempt to fix a Debian build problem.

o Jim McDonough <jmcd@...>
* Detect tight loop in tdb_find().

o Stefan Metzmacher <metze@...>
* BUG 2346: Fix posix ACLs when setting an ACL without explicit ACE for the
owner.

o Tim Prouty <tprouty@...>
* Fix chained sesssetupAndX/tconn messages.
* Fix strict locking with chained reads.
* Fix two bugs in sendfile.

o Slava Semushin <php-coder@...>
* Fix memory leak.
* Fix file descriptor leak.

o Aravind Srinivasan <aravind.srinivasan@...>
* Fallback to the legacy sid_to_(uid|gid) instead of returning NULL.
* Always allocate memory in dptr_ReadDirName.

o Kumar Thangavelu <Kumar.Thangavelu@...>
* Fix 'net' crash during domain join.

o Marc VanHeyningen <marc.vanheyningen@...>
* Zero an uninitialized array.
* Allow child processes to exit gracefully if we are out of fds.

######################################################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical IRC channel on irc.freenode.net.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored. All bug reports should
be filed under the Samba 3.4 product in the project's Bugzilla
database (https://bugzilla.samba.org/).

======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/rc/

The release notes are available online at:

http://www.samba.org/samba/ftp/rc/WHATSNEW-3-4-0rc1.txt

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[ANNOUNCE] Samba 4.0.0alpha8

2009-06-18T22:35:38Z

We are proud to a announce another alpha release of Samba 4.

What's new in Samba 4 alpha8
============================

Samba 4 is the ambitious next version of the Samba suite that is being
developed in parallel to the stable 3.0 series. The main emphasis in
this branch is support for the Active Directory logon protocols used
by Windows 2000 and above.

Samba4 alpha8 follows on from the alpha release series we have been
publishing since September 2007

WARNINGS
========

Samba4 alpha8 is not a final Samba release. That is more a reference
to Samba4's lack of the features we expect you will need than a
statement of code quality, but clearly it hasn't seen a broad
deployment yet. If you were to upgrade Samba3 (or indeed Windows) to
Samba4, you would find many things work, but that other key features
you may have relied on simply are not there yet.

For example, while Samba 3.0 is an excellent member of a Active
Directory domain, Samba4 is happier as a domain controller, and it is
in this role where it has seen deployment into production.

Samba4 is subjected to an awesome battery of tests on an
automated basis, we have found Samba4 to be very stable in it's
behaviour. We have to recommend against upgrading production servers
from Samba 3 to Samba 4 at this stage, because there may be the features on
which you may rely that are not present, or the mapping of
your configuration and user database may not be complete.

If you are upgrading, or looking to develop, test or deploy Samba4, you should
backup all configuration and data.

NEW FEATURES
============

Samba4 supports the server-side of the Active Directory logon environment
used by Windows 2000 and later, so we can do full domain join
and domain logon operations with these clients.

Our Domain Controller (DC) implementation includes our own built-in
LDAP server and Kerberos Key Distribution Center (KDC) as well as the
Samba3-like logon services provided over CIFS. We correctly generate
the infamous Kerberos PAC, and include it with the Kerberos tickets we
issue.

The new VFS features in Samba 4 adapts the filesystem on the server to
match the Windows client semantics, allowing Samba 4 to better match
windows behaviour and application expectations. This includes file
annotation information (in streams) and NT ACLs in particular. The
VFS is backed with an extensive automated test suite.

A new scripting interface has been added to Samba 4, allowing
Python programs to interface to Samba's internals.

The Samba 4 architecture is based around an LDAP-like database that
can use a range of modular backends. One of the backends supports
standards compliant LDAP servers (including OpenLDAP), and we are
working on modules to map between AD-like behaviours and this backend.
We are aiming for Samba 4 to be powerful frontend to large
directories.

CHANGES SINCE alpha7
=====================

In the time since Samba4 alpha7 was released in Feburary 2009, Samba has
continued to evolve, but you may particularly notice these areas
(in no particular order):

Samba4 now includes the full AD schema, as used in Microsoft Windows 2008

LDB (the core Samba4 database library) now handles large number of
users and groups much more efficiently

These are just some of the user-visible highlights of the work done in
the past few months. More details of the work done 'under the hood'
can be found in our GIT history.

CHANGES
=======

Those familiar with Samba 3 can find a list of user-visible changes
since that release series in the NEWS file.

KNOWN ISSUES
============

- Domain member support is in it's infancy, and is not comparable to
the support found in Samba3.

- There is no printing support in the current release.

- There is no NetBIOS browsing support in the current release

- The Samba4 port of the CTDB clustering support is not yet complete

- Clock Synchronisation is critical. Many 'wrong password' errors are
actually due to Kerberos objecting to a clock skew between client
and server. (The NTP work in the previous alphas are partly to assist
with this problem).

RUNNING Samba4
==============

A short guide to setting up Samba 4 can be found in the howto.txt file
in root of the tarball.

DEVELOPMENT and FEEDBACK
========================
Bugs can be filed at https://bugzilla.samba.org/ but please be aware
that many features are simply not expected to work at this stage.

The Samba Wiki at http://wiki.samba.org should detail some of these
development plans.

Development and general discussion about Samba 4 happens mainly on
the #samba-technical IRC channel (on irc.freenode.net) and
the samba-technical mailing list (see http://lists.samba.org/ for
details).

================
Download Details
================

The release tarball is available from the following location:
* http://download.samba.org/samba/ftp/samba4/samba-4.0.0alpha8.tar.gz

This release has been signed using GPG with Andrew's GPG key (28B436BB).

* http://download.samba.org/samba/ftp/samba4/samba-4.0.0alpha8.tar.asc

To verify that the signature is correct, make sure that the tarball has
been unzipped and run:

$ gpg --verify samba-4.0.0alpha8.tar.asc

Happy testing!

The Samba team

--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team http://samba.org
Samba Developer, Red Hat Inc.

signature.asc (196 bytes) Download Attachment

[Announce] Samba 3.3.5 Available for Download

2009-06-16T08:01:03Z

=================================================================
"I like the dreams of the future
better than the history of the
past."

Thomas Jefferson
=================================================================

Release Announcements
=====================

This is the latest bugfix release of the Samba 3.3 series.

Major enhancements in Samba 3.3.5 include:

o Fix SAMR and LSA checks (bug #6089, #6289)
o Fix posix acls when setting an ACL without explicit ACE for the
owner (bug #2346).
o Fix joining of Win7 into Samba domain (bug #6099).
o Fix joining of Win2000 SP4 clients (bug #6301).

######################################################################
Changes
#######

Changes since 3.3.4:
--------------------

o Michael Adam <obnox@...>
* BUG 6320: Handle registry config source in file_list.
* BUG 6415: Filter out of range mappings in default idmap config in
idmap_tdb.
* BUG 6416: Filter out of range mappings in default idmap config in
idmap_tdb2.
* BUG 6417: Filter out of range mappings in default idmap config in
idmap_ldap.
* Prevent infinite include nesting.
* Mark registry shares without path unavailable.

o Jeremy Allison <jra@...>
* BUG 6089: Revert the extra SAMR and LSA checks.
* BUG 6099: Fix joining of Win7 into Samba domain.
* BUG 6289: Revert the extra SAMR and LSA checks.
* BUG 6297: Owner of sticky directory cannot delete files created by
others.
* BUG 6315: smbd crashes doing vfs_full_audit on IPC$ close event.
* BUG 6330: Fix DFS on AIX.

o Guenther Deschner <gd@...>
* BUG 6099: Fix joining of Win7 into Samba domain.
* BUG 6157: Fix handling of multi-value attribute "uid".
* BUG 6301: Fix joining of Win2000 SP4 clients.
* BUG 6309: Support remote unjoining of Windows 2003 or greater.
* BUG 6372: Fix usermanager only displaying 1024 groups and aliases.
* BUG 6465: Fix enumeration of empty aliases (ldb backend).

o Björn Jacke <bj@...>
* Also handle DirX return codes.

o Volker Lendecke <vl@...>
* BUG 6336: Fix 'net groupmap set' segfault.
* BUG 6361: Make --rcfile work in smbget.
* BUG 6365: Re-Add the "dropbox" functionality with -wx rights on a
directory.
* BUG 6382: Fix case insensitive access to DFS links.
* BUG 6441: Fix the compile with --enable-dnssd.
* BUG 6449: 'net rap user add' crashes without -C option.
* Fix Coverity ID 897.
* Do not crash in ctdbd_traverse if ctdbd is not around.
* Fix a race condition in winbind leading to a panic.

o TAKAHASHI Motonobu <monyo@...>
* BUG 5897: Fix shutdown script example in the smb.conf manpage.

o Stefan Metzmacher <metze@...>
* BUG 2346: Fix posix acls when setting an ACL without explicit ACE for the
owner.

o D.L. Meyer <dlmeyer@...>
* BUG 5832: Fix build on RHEL when ccache is not available.

o Andreas Schneider <mail@...>
* Some man pam_winbind improvements.

o Karolin Seeger <kseeger@...>
* BUG 5835: Add keyutils-devel to build requires to fix build on RHEL.

o Marc VanHeyningen <marc.vanheyningen@...>
* Zero an uninitialized array.

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.3.5.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.2.12 Maintenance Release Available for Download

2009-06-16T05:41:12Z

================================================================
"Your background and environment
is with you for life.
No question about that."

Sean Connery
================================================================

Release Announcements
=====================

This is a maintenance release of the Samba 3.2 series.

Major enhancements in 3.2.12 include:

o Fix SAMR and LSA checks (bug #6089, #6289)
o Fix posix acls when setting an ACL without explicit ACE for the
owner (bug #2346).
o Fix "force user" (bug #6291).
o Fix Winbind crash (bug #6279).
o Fix joining of Win7 into Samba domain (bug #6099).

######################################################################
Changes
#######

Changes since 3.2.11
--------------------

o Michael Adam <obnox@...>
* Prevent creation of keys containing the '/' character.

o Jeremy Allison <jra@...>
* BUG 6089: Revert the extra SAMR and LSA checks.
* BUG 6099: Fix joining of Win7 into Samba domain.
* BUG 6279: Fix Winbind crash.
* BUG 6289: Revert the extra SAMR and LSA checks.
* BUG 6291: Fix "force user".
* BUG 6386: Groupdb mapping fix.
* Fix bug in processing of open modes in POSIX open.

o Guenther Deschner <gd@...>
* BUG 6099: Fix joining of Win7 into Samba domain.
* BUG 6301: Fix samr_ConnectVersion enum which is 32bit not 16bit.
* BUG 6372: Fix usermanager only displaying 1024 groups and aliases.
* BUG 6465: Fix enumeration of empty aliases (ldb backend).
* Protect netlogon_creds_server_step() against NULL creds.

o Björn Jacke <bj@...>
* Also handle DirX return codes.

o Volker Lendecke <vl@...>
* BUG 5798: CFLAGS info lost in configure.
* BUG 6382: Fix case insensitive access to DFS links.
* Fix a race condition in winbind leading to a panic.

o Stefan Metzmacher <metze@...>
* BUG 2346: Fix posix acls when setting an ACL without explicit ACE for the
owner.
* Fix a crash bug if we timeout in net rpc trustdom list.

o D.L. Meyer <dlmeyer@...>
* BUG 5832: Fix build on RHEL when ccache is not available.

o Sébastien Prud'homme <sebastien.prudhomme@...>
* BUG 5945: Fix out of memory error with Winbind idmap.

o Karolin Seeger <kseeger@...>
* BUG 5835: Add keyutils-devel to build requires.

o Simo Sorce <ssorce@...>
* Fix profile acls in some corner cases.

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.2.12.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.4.0pre2 Available for Download

2009-06-02T05:05:12Z

Release Announcements
=====================

This is the second preview release of Samba 3.4. This is *not*
intended for production environments and is designed for testing
purposes only. Please report any defects via the Samba bug reporting
system at https://bugzilla.samba.org/.

Major enhancements in Samba 3.4.0 include:
------------------------------------------

Configuration changes:
o The default passdb backend has been changed to 'tdbsam'!

General changes:
o Samba4 and Samba3 sources are included in the tarball

Authentication Changes:
o Changed the way smbd handles untrusted domain names given during user
authentication.

Printing Changes:
o Various fixes including printer change notificiation for Samba spoolss
print servers.

Internal changes:
o The remaining hand-marshalled DCE/RPC services (ntsvcs, svcctl, eventlog
and spoolss) were replaced by autogenerated code based on PIDL.
o Samba3 and Samba4 do now share a common tevent library.
o The code has been cleaned up and the major basic interfaces are shared with
Samba4 now.
o An asynchronous API has been added.

net Command Changes:
o Parameter syntax made more consistent.

Configuration changes
=====================

!!! ATTENTION !!!
The default passdb backend has been changed to 'tdbsam'! That breaks existing
setups using the 'smbpasswd' backend without explicit declaration! Please use
'passdb backend = smbpasswd' if you would like to stick to the 'smbpasswd'
backend or convert your smbpasswd entries using e.g. 'pdbedit -i smbpasswd -e
tdbsam'.

The 'tdbsam' backend is much more flexible concerning per user settings
like 'profile path' or 'home directory' and there are some commands which do not
work with the 'smbpasswd' backend at all.

General Changes
===============

On the way towards a standalone Samba AD domain controller, Samba3 and Samba4
branches can be built as "merged" build. That's why Samba3 and Samba4 sources
are included in the tarball. The merged build is possible in Samba 3.4.0, but
disabled by default. To learn more about the merged build,
please see http://wiki.samba.org/index.php/Franky.

According to this one, there is no "source" directory included in the tarball at
all. Samba3 sources are located in "source3", Samba4 sources are located in
"source4". The libraries have been moved to the toplevel directory.

To build plain Samba3, please change to "source3" and start the build as usual.
To build Samba4 as well, please use the "--enable-merged-build" configure
option.

Authentication Changes
======================

Previously, when Samba was a domain member and a client was connecting using an
untrusted domain name, such as BOGUS\user smbd would remap the untrusted
domain to the primary domain smbd was a member of and attempt authentication
using that DOMAIN\user name. This differed from how a Windows member server
would behave. Now, smbd will replace the BOGUS name with it's SAM name. In
the case where smbd is acting as a PDC this will be DOMAIN\user. In the case
where smbd is acting as a domain member server this will be WORKSTATION\user.
Thus, smbd will never assume that an incoming user name which is not qualified
with the same primary domain, is part of smbd's primary domain.

While this behavior matches Windows, it may break some workflows which depended
on smbd to always pass through bogus names to the DC for verification. A new
parameter "map untrusted to domain" can be enabled to revert to the legacy
behavior.

Printing Changes
================

The spoolss subsystem was replaced by autogenerated code based on PIDL. That fixes
several printing issues including printer change notificiation on Samba print
servers and will stabilize the printing functionality generally.
The support for spoolss printing with Windows Vista has been improved.

Internal Changes
================

The remaining hand-marshalled DCE/RPC services (ntsvcs, svcctl, eventlog and
spoolss) were replaced by autogenerated code based on PIDL.
So Günther Deschner finally corrected one of the biggest mistakes in the
development of Samba: Hand-marshalled RPC stubs.

Thanks a lot! :-)

Samba3 and Samba4 do now share a common tevent library for fd and timer events.

The code has been cleaned up and Samba3 and Samba4 do share the major basic
interfaces now. That is why the libraries were moved to the toplevel directory.
That is one of the first steps to share code and minimize the gap between
these two versions.

An asynchronous API has been added.

net Command Changes
===================

The net command now accepts the common command line parameters most other Samba
command line utilities use, with a couple of remaining differences:

-l still gives long output for net commands supporting the --long flag. This was
more useful than the common --log-base parameter.

-i still tells net to read data from stdin (like --stdin) instead of toggling
the common --scope flag.

-S still tells net the server to connect to (like --server) instead of
negotiating the common --signing flag. As -S is probably used by most scripts
doing net rpc commands, this would have been a high-impact change for little
gain.

This change was mainly done to unify the authentification options. Here, one
flag changed it's meaning and one useful flag was added.

-N used to be the short version of --ntname. It now matches the Samba default of
--no-pass. Use this to stop net from prompting for a password if you want
anonymous authentication.

-A --authentication-file now takes an authentication file with the username and
password you want net to use, avoiding a password prompt as with plain -U user
or having to give a password on the command line as in -U user%pass.

Last but not least net now always falls back to your local unix username if no
-U is specified and a username is needed. net rpc commands will now prompt for a
password unless one is specified using either -U user%pass or -A auth_file

######################################################################
Changes
#######

smb.conf changes
----------------

Parameter Name Description Default
-------------- ----------- -------

access based share enum New No
dedicated keytab file New ""
kerberos method New default
map untrusted to domain New No
max open files Changed Default auto detected
passdb backend Changed Default tdbsam
perfcount module New ""
use kerberos keytab Removed

New [sub]commands
-----------------

net eventlog Import/dump/export native win32 eventlog files.
net rpc service create Create a new service.
net rpc service delete Delete an existing service.

New configure options
---------------------

--enable-external-libtalloc Enable external talloc
--enable-merged-build Build Samba 4 as well
--enable-gnutls Turn on gnutls support
--with-statedir=DIR Where to put persistent state files
--with-cachedir=DIR Where to put temporary cache files
--with-ncalprcdir=DIR Where to put ncalrpc sockets
--with-selftest-shrdir=DIR The share directory that make test will be run
against
--with-selftest-custom-conf=PATH
An optional custom smb.conf that is included in
the server smb.conf during make test
--with-wbclient Use external wbclient
--with-included-popt Use bundled popt library, not from system
--with-libiconv=BASEDIR Use libiconv in BASEDIR/lib and BASEDIR/include
--with-sqlite3 SQLITE3 backend support
--with-pthreads Include pthreads
--with-setproctitle Search for setproctitle support

Commit Highlights
=================

o Steven Danneman <steven.danneman@...>
* Change the way smbd handles untrusted domain names given during user
authentication.

o Guenther Deschner <gd@...>
* Replace the hand-marshalled DCE/RPC services ntsvcs, svcctl, eventlog
and spoolss by autogenerated code based on PIDL.
* Fix several printing issues and improve support for printer change
notificiations.
* Add 'net eventlog'.

o Volker Lendecke <vl@...>
* Add asynchronous API.

o Stefan Metzmacher <metze@...>
* Make Samba3 and Samba4 share a tevent library.

o Dan Sledz <dsledz@...>
* Add two new parameters to control how we verify kerberos tickets.

o Danny Tylman <danny.tylman@...>
* Add 'net rpc service' subcommands 'create' and 'delete'.

o Jelmer Vernooij <jelmer@...>
* Make merged build possible.
* Move common libraries to the shared lib/ directory.

Changes since 3.4.0pre1
-----------------------

o Jeremy Allison <jra@...>
* BUG 6291: Fix 'force user'.
* BUG 6313: ldapsam_update_sam_account() crashes while doing talloc_free on
malloced memory.
* BUG 6315: Fix smbd crashes when doing vfs_full_audit on IPC$ close event.
* BUG 6330: Fix DFS on AIX.
* Fix a bunch of compiler warnings about wrong format types.
* Fix the core of the SAMR access functions.
* Fix SAMR server for winbindd access.

o Michael Adam <obnox@...>
* BUG 4271: testparm should not print includes.
* BUG 6292: Update config.guess from gnu.org.
* BUG 6320: Handle registry config source in file_list.
* BUG 6371: Unsuccessful 'net conf setparm' leaves empty share.
* BUG 6387: Fix a crash bug in idmap_ldap_unixids_to_sids.
* BUG 6415: Filter out of range mappings in default idmap config
(idmap_tdb).
* BUG 6416: Filter out of range mappings in default idmap config
(idmap_tdb2).
* BUG 6417: Filter out of range mappings in default idmap config
(idmap_ldap).
* Add dbwrap_tool - a tdb tool that is CTDB-aware.
* Hide "config backend" from swat.
* Fix linking with --disable-shared-libs.

o Kai Blin <kai@...>
* BUG #6357: Use Samba default command line arguments in 'net'.

o Steven Danneman <steven.danneman@...>
* Fix issue with missing entries when enumerating directories.
* Map NULL domains to our global sam name.

o Günther Deschner <gd@...>
* BUG 5859: Fix renaming of samr objects failed due to samr setuserinfo
access checks.
* BUG 6099: Fix NETLOGON credential chain.
* BUG 6253: Use correct value for password expiry calculation.
* BUG 6309: Support remote unjoining of Windows 2003 or greater.
* BUG 6340: Don't segfault when cleartext trustdom pwd could not be
retrieved.
* BUG 6372: usermanager only displaying 1024 groups and aliases.
* Fix driver upload for Xerox 4110 PS printer driver.
* Add "net dom renamecomputer" to rename machines in a domain.
* Inspect the correct computername string before enabling/disabling the
change button in netdomjoin-gui.
* Fix join prompt dialog test in netdomjoin-gui.
* Only gray out labels when not root and not connecting to remote
machines (netdomjoin-gui).
* Allow to switch between workgroups/domains with the same name
(netdomjoin-gui).
* Add NetShutdownInit and NetShutdownAbort.
* Fix samr access checks.
* Add a security model to LSA.
* Fix nss_wrapper build for Solaris.

o Geza Gemes <geza@...>
* BUG 6136: New AFS syscall conventions.

o Ole Hansen <ole@...>
* BUG 6359: smbclient -L does not list workgroup for hosts with both IPv4
and IPv6 addresses

o Björn Jacke <bj@...>
* BUG 4831: Don't call openlog() or closelog() from pam_smbpass.
* Also handle DirX return codes.

o Volker Lendecke <vl@...>
* BUG 5681: Do not limit the number of network interfaces.
* BUG 6157: Fix handling of multi-value attribute "uid".
* BUG 6302: Give the VFS a chance to read from 0-byte files.
* BUG 6336: Fix segfault in 'net groupmap set'.
* BUG 6361: Make --rcfile work in smbget.
* Do not crash in ctdbd_traverse if ctdbd is not around.
* Fix Coverity ID 897.
* Fix a race condition in vfs_aio_fork with gpfs share modes.
* Fix bug disclosed by lock8 torture test.
* Fix a race condition in winbind leading to a panic.
* Attempt to fix a Debian build problem.

o Jim McDonough <jmcd@...>
* Detect tight loop in tdb_find().

o Stefan Metzmacher <metze@...>
* BUG 2346: Fix posix ACLs when setting an ACL without explicit ACE for the
owner.

o Tim Prouty <tprouty@...>
* Fix chained sesssetupAndX/tconn messages.
* Fix strict locking with chained reads.
* Fix two bugs in sendfile.

o Slava Semushin <php-coder@...>
* Fix memory leak.
* Fix file descriptor leak.

o Aravind Srinivasan <aravind.srinivasan@...>
* Fallback to the legacy sid_to_(uid|gid) instead of returning NULL.
* Always allocate memory in dptr_ReadDirName.

o Kumar Thangavelu <Kumar.Thangavelu@...>
* Fix 'net' crash during domain join.

o Marc VanHeyningen <marc.vanheyningen@...>
* Zero an uninitialized array.
* Allow child processes to exit gracefully if we are out of fds.

######################################################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical IRC channel on irc.freenode.net.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored. All bug reports should
be filed under the Samba 3.4 product in the project's Bugzilla
database (https://bugzilla.samba.org/).

======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/pre

The release notes are available online at:

http://www.samba.org/samba/ftp/pre/WHATSNEW-3-4-0pre2.txt

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.4.0pre1 Available for Download

2009-04-30T03:48:52Z

Release Announcements
=====================

This is the first preview release of Samba 3.4. This is *not*
intended for production environments and is designed for testing
purposes only. Please report any defects via the Samba bug reporting
system at https://bugzilla.samba.org/.

Major enhancements in Samba 3.4.0 include:
------------------------------------------

General changes:
o Samba4 and Samba3 sources are included in the tarball

Authentication Changes:
o Changed the way smbd handles untrusted domain names given during user
authentication.

Printing Changes:
o Various fixes including printer change notificiation for Samba spoolss
print servers.

Internal changes:
o The remaining hand-marshalled DCE/RPC services (ntsvcs, svcctl, eventlog
and spoolss) were replaced by autogenerated code based on PIDL.
o Samba3 and Samba4 do now share a common tevent library.
o The code has been cleaned up and the major basic interfaces are shared with
Samba4 now.
o An asynchronous API has been added.

General Changes
===============

On the way towards a standalone Samba AD domain controller, Samba3 and Samba4
branches can be built as "merged" build. That's why Samba3 and Samba4 sources
are included in the tarball. The merged build is possible in Samba 3.4.0, but
disabled by default. To learn more about the merged build,
please see http://wiki.samba.org/index.php/Franky.

According to this one, there is no "source" directory included in the tarball at
all. Samba3 sources are located in "source3", Samba4 sources are located in
"source4". The libraries have been moved to the toplevel directory.

To build plain Samba3, please change to "source3" and start the build as usual.
To build Samba4 as well, please use the "--enable-merged-build" configure
option.

Authentication Changes
======================

Previously, when Samba was a domain member and a client was connecting using an
untrusted domain name, such as BOGUS\user smbd would remap the untrusted
domain to the primary domain smbd was a member of and attempt authentication
using that DOMAIN\user name. This differed from how a Windows member server
would behave. Now, smbd will replace the BOGUS name with it's SAM name. In
the case where smbd is acting as a PDC this will be DOMAIN\user. In the case
where smbd is acting as a domain member server this will be WORKSTATION\user.
Thus, smbd will never assume that an incoming user name which is not qualified
with the same primary domain, is part of smbd's primary domain.

While this behavior matches Windows, it may break some workflows which depended
on smbd to always pass through bogus names to the DC for verification. A new
parameter "map untrusted to domain" can be enabled to revert to the legacy
behavior.

Printing Changes
================

The spoolss subsystem was replaced by autogenerated code based on PIDL. That fixes
several printing issues including printer change notificiation on Samba print
servers and will stabilize the printing functionality generally.
The support for spoolss printing with Windows Vista has been improved.

Internal Changes
================

The remaining hand-marshalled DCE/RPC services (ntsvcs, svcctl, eventlog and
spoolss) were replaced by autogenerated code based on PIDL.
So Günther Deschner finally corrected one of the biggest mistakes in the
development of Samba: Hand-marshalled RPC stubs.

Thanks a lot! :-)

Samba3 and Samba4 do now share a common tevent library for fd and timer events.

The code has been cleaned up and Samba3 and Samba4 do share the major basic
interfaces now. That is why the libraries were moved to the toplevel directory.
That is one of the first steps to share code and minimize the gap between
these two versions.

An asynchronous API has been added.

######################################################################
Changes
#######

smb.conf changes
----------------

Parameter Name Description Default
-------------- ----------- -------

access based share enum New No
dedicated keytab file New ""
kerberos method New default
map untrusted to domain New No
max open files Changed Default auto detected
perfcount module New ""
use kerberos keytab Removed

New [sub]commands
-----------------

net eventlog Import/dump/export native win32 eventlog files.
net rpc service create Create a new service.
net rpc service delete Delete an existing service.

New configure options
---------------------

--enable-external-libtalloc Enable external talloc
--enable-merged-build Build Samba 4 as well
--enable-gnutls Turn on gnutls support
--with-statedir=DIR Where to put persistent state files
--with-cachedir=DIR Where to put temporary cache files
--with-ncalprcdir=DIR Where to put ncalrpc sockets
--with-selftest-shrdir=DIR The share directory that make test will be run
against
--with-selftest-custom-conf=PATH
An optional custom smb.conf that is included in
the server smb.conf during make test
--with-wbclient Use external wbclient
--with-included-popt Use bundled popt library, not from system
--with-libiconv=BASEDIR Use libiconv in BASEDIR/lib and BASEDIR/include
--with-sqlite3 SQLITE3 backend support
--with-pthreads Include pthreads
--with-setproctitle Search for setproctitle support

Commit Highlights
=================

o Steven Danneman <steven.danneman@...>
* Change the way smbd handles untrusted domain names given during user
authentication.

o Guenther Deschner <gd@...>
* Replace the hand-marshalled DCE/RPC services ntsvcs, svcctl, eventlog
and spoolss by autogenerated code based on PIDL.
* Fix several printing issues and improve support for printer change
notificiations.
* Add 'net eventlog'.

o Volker Lendecke <vl@...>
* Add asynchronous API.

o Stefan Metzmacher <metze@...>
* Make Samba3 and Samba4 share a tevent library.

o Dan Sledz <dsledz@...>
* Add two new parameters to control how we verify kerberos tickets.

o Danny Tylman <danny.tylman@...>
* Add 'net rpc service' subcommands 'create' and 'delete'.

o Jelmer Vernooij <jelmer@...>
* Make merged build possible.
* Move common libraries to the shared lib/ directory.

######################################################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical IRC channel on irc.freenode.net.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored. All bug reports should
be filed under the Samba 3.4 product in the project's Bugzilla
database (https://bugzilla.samba.org/).

======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/pre

The release notes are available online at:

http://www.samba.org/samba/ftp/pre/WHATSNEW-3-4-0pre1.txt

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.3.4 Available for Download

2009-04-29T02:10:26Z

=================================================================
"A banker is a fellow who lends you his
umbrella when the sun is shining and
wants it back the minute it begins to
rain."

Mark Twain
=================================================================

Release Announcements
=====================

This is the latest bugfix release of the Samba 3.3 series.

Major enhancements in Samba 3.3.4 include:

o Fix domain logins for WinXP clients pre SP3 (bug #6263).
o Fix samr_OpenDomain access checks (bug #6089).
o Fix usrmgr.exe creating a user (bug #6243).

######################################################################
Changes
#######

Changes since 3.3.3:
--------------------

o Michael Adam <obnox@...>
* net conf: Save share name as given, not as lower case only.
* Prevent creation of registry keys containing the '/' character.

o Jeremy Allison <jra@...>
* BUG 6089: Fix samr_OpenDomain access checks.
* BUG 6254: Fix IPv6 PUT/GET errors to an SMB server (3.3) with
"msdfs root" set to "yes".
* BUG 6279: Fix Winbind crash.
* Allow pdbedit to change a user rid/sid.
* When doing a cli_ulogoff don't invalidate the cnum, invalidate the vuid.
* Don't access a freed structure when logging off and re-using a vuid.

o Guenther Deschner <gd@...>
* BUG 5329: Add "net rpc service delete/create".
* BUG 6238: Make sure wbcLogoffUserParams are properly initialized before
freed.
* BUG 6263: Fix domain logins for WinXP clients pre SP3.
* BUG 6286: Call init function for builtin idmap modules before probing for
them as shared modules.
* Try to to fix password_expired flag handling.
* Make sure to grey out change fields in the netdomjoin-gui when not
running as root.

o Jim McDonough <jmcd@...>
* Don't look up local user for remote changes, even when root.

o Volker Lendecke <vl@...>
* BUG 6243: Fix usrmgr.exe creating a user.
* Use procid_str in debug messages for better cluster-debuggability.
* Use cluster-aware procid_is_me instead of comparing pids.
* Fix smbd crash for close_on_completion.
* Fix a memleak in an unlikely error path in change_notify_create().
* Do not use the file system GET_REAL_FILENAME for mangled names.

o Stefan Metzmacher <metze@...>
* Fix a crash bug if we timeout in net rpc trustdom list.
* Add '--request-timeout' option to net.

o Martin Schwenke <martin@...>
* In net_conf_import, start a transaction when importing a single share.

o Simo Sorce <ssorce@...>
* Fix writing of roaming profiles with "profile acls" set to "yes".

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.3.4.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.2.11 Maintenance Release Available

2009-04-17T07:07:50Z

================================================================
"You can't have everything.
Where would you put it?

Steven Wright
================================================================

Release Announcements
=====================

This is a maintenance release of the Samba 3.2 series.

Major enhancements in 3.2.11 include:

o Fix domain logins for WinXP clients pre SP3 (bug #6263).
o Fix samr_OpenDomain access checks (bug #6089).
o Fix smbd crash for close_on_completion.

######################################################################
Changes
#######

Changes since 3.2.10
--------------------

o Jeremy Allison <jra@...>
* BUG 6089: Fix samr_OpenDomain access checks.
* BUG 6254: Fix IPv6 PUT/GET errors to an SMB server (3.3) with
"msdfs root" set to "yes".
* Allow pdbedit to change a user rid/sid.
* When doing a cli_ulogoff don't invalidate the cnum, invalidate the vuid.

o Günther Deschner <gd@...>
* BUG 6205: Correct sample smb.conf share configuration.
* BUG 6263: Fix domain logins for WinXP clients pre SP3.
* Fix resume command typo for "printing = vlp".

o Volker Lendecke <vl@...>
* Fix smbd crash for close_on_completion.
* Fix a memleak in an unlikely error path in change_notify_create().

o Jim McDonough <jmcd@...>
* Don't look up local user for remote changes, even when root.

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.2.11.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.3.3 Available for Download

2009-04-01T06:51:34Z

=================================================================
"Never refuse any advance of friendship, for if
nine out of ten bring you nothing, one alone
may repay you."

Madame de Tencin
=================================================================

Release Announcements
=====================

This is the latest bugfix release release of the Samba 3.3 series.

Major enhancements in Samba 3.3.3 include:

o Migrating from 3.0.x to 3.3.x can fail to update passdb.tdb
correctly (bug #6195).
o Fix serving of files with colons to CIFS/VFS client (bug #6196).
o Fix "map readonly" (bug #6186).

######################################################################
Changes
#######

Changes since 3.3.2:
--------------------

o Michael Adam <obnox@...>
* BUG 6195: Don't let smbd child processes panic.
* Add backend_requires_messaging() method to libsmbconf.
* Add methods is_writeable() and wrapper smbconf_is_writeable() to libsmbconf.
* Fall back to file backend when no valid backend was found.
* Fix a memleak in dbwrap_rbt.
* Provide transaction_start|commit|cancel fns for the registry tdb.
* Speed up "net conf drop".
* Speed up "net conf import".
* Add transactions to the libsmbconf API.
* Reduce memory usage of "net conf import".
* Registry cleanup.
* Fix handling of SAMBA_VERSION_VENDOR_PATCH.
* Fix build of pam_winbind.so with static linking.
* Tidy up some convert_string_internal error cases.

o Jeremy Allison <jra@...>
* BUG 6186: Fix map readonly.
* BUG 6195: Migrating from 3.0.x to 3.3.x can fail to update passdb.tdb
correctly.
* BUG 6196: Unable to serve files with colons to Linux CIFS/VFS client.
* BUG 6224: nmbd waits 5 minutes at startup before checking if it needs
to run elections.
* Allow DFS client paths to work when POSIX pathnames have been
selected.
* Try and fix the build farm RAW-STREAMS errors.
* Ensure files starting with multiple dots are hidden.

o Günther Deschner <gd@...>
* BUG 6102: NetQueryDisplayInformation could return wrong information.
* BUG 6193: Avoid messing with sync_context in libnet_samsync_delta().
* Fix notify_printer_status_byname.
* Fix Coverity IDs 722, 762, 774, 775, 776.

o Björn Jacke <bj@...>
* Fix build on old Heimdal based systems.
* Fix compile warning.
* Use parentheses in if condition to make negation clear.

o Andy Kelk <andy@...>
* Add dirsort module.

o Steve Langasek <vorlon@...>
* BUG 6147: Fix detection of the GNU ld version.

o Volker Lendecke <vl@...>
* BUG 6097: Fix smbd segfault.
* BUG 6130: Don't crash in winbindd_rpc lookup_groupmem() on unmapped
members.
* BUG 6139: Add missing whitespace in mount.cifs error message.
* Fix a malloc/talloc mismatch when cli_initialise() fails.
* Fix a valgrind error.
* Speed up "net conf list".
* Add sorted subkey cache.
* Use StrCaseCmp in the dirsort module.
* Document the dirsort module.
* Fix the build on HP/UX.
* Disable dns_sd by default.
* Add avahi detection to configure.
* Add event avahi binding.
* Use avahi to register _smb._tcp in smbd.
* Fix two memleaks in the encryption code.
* Fix a scary "fill_share_mode_lock failed" message.

o Derrell Lipman <derrell@dworkin.(none)>
* BUG 6228: Fix SMBC_open_ctx failure due to path resolve failure doesn't set
errno.

o Stefan Metzmacher <metze@...>
* Don't use reserved words in smbconftort.
* Fix smb signing for fragmented trans/trans2/nttrans requests.

o Tim Prouty <tprouty@...>
* Parse_packet can return NULL which is then dereferenced in
match_mailslot_name.

o Timur <timur@...>
* Format the header check for netinet/ip.h more nicely.
* Fix detection of netinet/ip.h on FreeBSD.

o Alexander Zagrebin <alexz@...>
* Missing break in conversion function prevents tdb password database
update.

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.3.3.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.2.10 Available for Download

2009-04-01T06:50:25Z

================================================================
"A life spent making mistakes is not
only more honorable, but more useful
than a life spent doing nothing."

George Bernard Shaw
================================================================

Release Announcements
=====================

This is a maintenance release of the Samba 3.2 series.

In Samba 3.2.9, there is an issue while migrating passdb.tdb files from older
Samba versions (e.g. 3.2.8). That causes panics of smbd child processes until
the parent smbd is restarted once after converting the passdb.tdb file. This
issue is fixed in Samba 3.2.10.

Sorry for the inconveniences!

######################################################################
Changes
#######

Changes since 3.2.9
-------------------

o Michael Adam <obnox@...>
* BUG #6195: Don't let smbd child processes panic.

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.2.10.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

attachment0 (204 bytes) Download Attachment

[Announce] Samba 3.2.9 Maintenance Release Available

2009-03-31T07:08:22Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================================
"In summer, the song sings itself."

William Carlos Williams
================================================================

Release Announcements
=====================

This is a maintenance release of the Samba 3.2 series.

Major enhancements included in Samba 3.2.9 are:

o Migrating from 3.0.x to 3.3.x can fail to update passdb.tdb
correctly (bug #6195).
o Fix guest authentication in setups with "security = share" and
"guest ok = yes" when Winbind is running.
o Fix corruptions of source path in tar mode of smbclient (bug #6161).

######################################################################
Changes
#######

Changes since 3.2.8
- -------------------

o Michael Adam <obnox@...>
* Add script fill-templates.
* Make update-pkginfo callable from any directory.

o Jeremy Allison <jra@...>
* BUG 6099: Samba returns incurrate capabilities list.
* BUG 6133: Cannot delete non-ACL files on Solaris/ZFS/NFSv4 ACL
filesystem.
* BUG 6161: smbclient corrupts source path in tar mode.
* BUG 6195: Migrating from 3.0.x to 3.3.x can fail to update passdb.tdb
correctly.
* BUG 6196: Unable to serve files with colons to Linux CIFS/VFS client.
* BUG 6224: nmbd waits 5 minutes at startup before checking if it needs to
run elections.
* Correctly use chroot().
* Parameterize in local.h the MAX_RPC_DATA_SIZE, and ensure
that "offered" read from the rpc packet in spoolss is under
that size.
* Fix Coverity ID 602.
* Backport the semantics of when to delete alternate data streams on a file
truncate.
* Allow set attributes on a stream fnum to be redirected to the base
filename.
* Fix use of streams modules with CIFSFS client.
* Fix more POSIX path lstat calls.
* Allow DFS client paths to work when POSIX pathnames have been
selected.
* Try and fix the build farm RAW-STREAMS errors.
* Ensure files starting with multiple dots are hidden.

o Steven Danneman <steven.danneman@...>
* Fix guest auth when Winbind is running.

o Günther Deschner <gd@...>
* BUG 6102: NetQueryDisplayInformation could return wrong information.
* BUG 6193: Avoid messing with sync_context in fetch_database_to_ldif().
* Fix memleak in get_remote_printer_publishing_data().
* Add pidl in order to be able to regenerate librpc functions.
* Fix Coverity IDs 722, 762.

o Steve French <smfrench@...>
* cifs mount fix for handling -V parameter.
* Fix guest mounts.

o Holger Hetterich <hhetter@...>
* Enable total anonymization in vfs_smb_traffic_analyzer.

o Björn Jacke <bj@...>
* Enable IPv6 support for NetBSD and FreeBSD.
* Prefer gssapi header files from subdirectory.
* Fix build on old Heimdal based systems.
* Use parentheses in if condition to make negation clear.

o Günter Kukkukk <linux@...>
* Don't try and delete a default ACL from a file.

o Jeff Layton <jlayton@...>
* Initialize rc to 0 in main.

o Volker Lendecke <vl@...>
* BUG 6100: Complete fix.
* BUG 6130: Don't crash in winbindd_rpc lookup_groupmem() on unmapped
members.
* BUG 6097: Fix smbd segfault.
* Fix remotely adding a share via MMC.
* Fix resume handle for _samr_EnumDomainGroups.
* Fix Coverity IDs 742, 744, 745, 879, 880.
* Fix a buffer handling bug when adding lots of registry keys.
* Fix a O(n^2) algorithm in regdb_fetch_keys().
* Fix an uninitialized variable warning.
* Fix a valgrind error / segfault in dns_register_smbd().
* Don't log NDR_PRINT_DEBUG at level 0, this always ends up in syslog.
* Fix a malloc/talloc mismatch when cli_initialise() fails.
* Fix a valgrind error.
* Fix two memleaks in the encryption code.
* Fix gcc 4.4 compile warning.
* Fix a scary "fill_share_mode_lock failed" message.

o Derrell Lipman <derrell@dworkin.(none)>
* BUG 6228: Fix SMBC_open_ctx failure due to path resolve failure doesn't
set errno.

o Stefan Metzmacher <metze@...>
* BUG 6100: Implement _netr_LogonGetCapabilities() with
NT_STATUS_NOT_IMPLEMENTED.
* Add S-1-22-X-Y sids to the local token.
* Add idl for netr_LogonGetCapabilities().
* Fix the build on SLES8.
* Fix smb signing for fragmented trans/trans2/nttrans requests.

o Glenn Machin <gmachin@...>
* Don't miss an absolute pathname as a kerberos keytab path.

o Shirish Pargaonkar <shirishpargaonkar@...>
* Clean-up entries in /etc/mtab after unmount.
* Add fakemount (-f) and nomtab (-n) flags to mount.cifs.

o Ted Percival <ted.percival@...>
* Fix a crash during name resolution when log level >= 10 and libc
segfaults if printf is passed NULL for a "%s" arg (e.g. Solaris).

o Tim Prouty <tprouty@...>
* Fix SMB_VFS_RECVFILE/SENDFILE macros.
* Parse_packet can return NULL which is then dereferenced in
match_mailslot_name.

o Dan Sledz <dsledz@...>
* Fix double free caused by incorrect talloc_steal usage.

o Aravind Srinivasan <aravind.srinivasan@...>
* Have nmbd check all available interfaces for WINS before failing.

o Miguel Suarez <Miguel.Suarez@...>
* BUG 6085: Fix build of vfs_default on systems without utime support.

o Yasuma Takeda <yasuma@...>
* BUG 5920: The length of the memcpy was calculated wrong.
* BUG 6098: Fix the ads_find_dc() with "security = domain" when the DNS
server is invalid.

o Andrew Tridgell <tridge@...>
* Fix a bug in message handling for code the change notify code.

o Jelmer Vernooij <jelmer@...>
* Properly cast array length in print functions.

o Bo Yang <boyang@...>
* Initialize the id_map status in idmap_ldap to avoid surprise.

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.2.9.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAknSI5cACgkQKGi9fisXk1FqOgCghf4D7LrtMVz4Vf4duSVJii8G
DjcAn3Cg5v/mJZAL0h/wVFyDpOCzhMfj
=ioGn
-----END PGP SIGNATURE-----

[Announce] Samba 3.3.2 Available for Download

2009-03-12T08:04:39Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=================================================================
"The superfluous, a very necessary thing."

Voltaire
=================================================================

Release Announcements
=====================

This is the latest bugfix release release of the Samba 3.3 series.

Major enhancements in Samba 3.3.2 include:

* Fix "force group" (bug #6155).
* Fix saving of files on Samba share using MS Office 2007 (bug #6160).
* Fix guest authentication in setups with "security = share" and
"guest ok = yes" when Winbind is running.
* Fix corruptions of source path in tar mode of smbclient (bug #6161).

######################################################################
Changes
#######

Changes since 3.3.1:
- --------------------

o Jeremy Allison <jra@...>
* BUG 6082: Fix renaming and deleting of directories using Windows clients.
* BUG 6154: Make ZFS honor admin users.
* BUG 6155: Fix "force group".
* BUG 6160: Fix saving of files on Samba share using MS Office 2007.
* BUG 6161: Fix corruptions of source path in tar mode of smbclient.
* Fix some NetBSD warnings.
* Fix bug in processing of open modes in POSIX open.
* Fix use of streams modules with CIFSFS client.
* Ensure ACL modules work with POSIX paths.
* Use fsp->posix_open in preference if we have it.
* Fix more POSIX path lstat calls.

o Andrew Tridgell <tridge@...>
* Fix a bug in message handling for the change notify code.

o Steven Danneman <steven.danneman@...>
* Fix guest authentication in setups with "security = share" and "guest ok =
yes" when Winbind is running.

o Steve French <smfrench@...>
* BUG 4640: Fix guest mounts in mount.cifs.
* Fix displaying the version string properly when no other parameters passed
in in mount.cifs.

o Björn Jacke <bj@...>
* Prefer gssapi header files from subdirectory.

o Volker Lendecke <vl@...>
* BUG 6124: Fix the build on IRIX.
* BUG 6176: winbindd -n should disable the winbind idmap cache.
* Add a vfs_preopen module to hide fs latencies.
* Don't log NDR_PRINT_DEBUG at level 0, this always ends up in syslog.
* Fix a valgrind error / segfault in dns_register_smbd().

o Stefan Metzmacher <metze@...>
* Fix build on SLES8.
* Decremented by 1 for ntcancel requests.

o Tim Prouty <tprouty@...>
* Fix creation of core files.

o Dan Sledz <dan.sledz@...>
* Fix first mapping of uids/gids in Winbind.

o Bo Yang <boyang@...>
* Initialize the id_map status in idmap_ldap to avoid surprise.
* Fix initialization of idmap status.

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.3.2.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAkm5HukACgkQKGi9fisXk1FlQwCfRKgZX/XSiKcoZMepHzf/fzUE
DVkAoIg1Hlk6iOgYkbBq30iaKn8vBMvO
=xdpy
-----END PGP SIGNATURE-----

[ANNOUNCE] Samba 4.0.0alpha7

2009-02-26T14:57:15Z

We are proud to a announce another alpha release of Samba 4.

What's new in Samba 4 alpha7
============================

Samba 4 is the ambitious next version of the Samba suite that is being
developed in parallel to the stable 3.0 series. The main emphasis in
this branch is support for the Active Directory logon protocols used
by Windows 2000 and above.

Samba4 alpha7 follows on from the alpha release series we have been
publishing since September 2007

WARNINGS
========

Samba4 alpha7 is not a final Samba release. That is more a reference
to Samba4's lack of the features we expect you will need than a
statement of code quality, but clearly it hasn't seen a broad
deployment yet. If you were to upgrade Samba3 (or indeed Windows) to
Samba4, you would find many things work, but that other key features
you may have relied on simply are not there yet.

For example, while Samba 3.0 is an excellent member of a Active
Directory domain, Samba4 is happier as a domain controller, and it is
in this role where it has seen deployment into production.

Samba4 is subjected to an awesome battery of tests on an
automated basis, we have found Samba4 to be very stable in it's
behaviour. We have to recommend against upgrading production servers
from Samba 3 to Samba 4 at this stage, because there may be the features on
which you may rely that are not present, or the mapping of
your configuration and user database may not be complete.

If you are upgrading, or looking to develop, test or deploy Samba4, you should
backup all configuration and data.

NEW FEATURES
============

Samba4 supports the server-side of the Active Directory logon environment
used by Windows 2000 and later, so we can do full domain join
and domain logon operations with these clients.

Our Domain Controller (DC) implementation includes our own built-in
LDAP server and Kerberos Key Distribution Center (KDC) as well as the
Samba3-like logon services provided over CIFS. We correctly generate
the infamous Kerberos PAC, and include it with the Kerberos tickets we
issue.

The new VFS features in Samba 4 adapts the filesystem on the server to
match the Windows client semantics, allowing Samba 4 to better match
windows behaviour and application expectations. This includes file
annotation information (in streams) and NT ACLs in particular. The
VFS is backed with an extensive automated test suite.

A new scripting interface has been added to Samba 4, allowing
Python programs to interface to Samba's internals.

The Samba 4 architecture is based around an LDAP-like database that
can use a range of modular backends. One of the backends supports
standards compliant LDAP servers (including OpenLDAP), and we are
working on modules to map between AD-like behaviours and this backend.
We are aiming for Samba 4 to be powerful frontend to large
directories.

CHANGES SINCE alpha6
=====================

In the time since Samba4 alpha6 was released in Janurary 2009, Samba has
continued to evolve, but you may particularly notice these areas
(in no particular order):

Multi Master Replication (MMR) configuration can now be generated
for the OpenLDAP-Backend.

OpenLDAP-Online-Configuration (olc) can now be generated for the
OpenLDAP-Backend. (OpenLDAP-Versions >=2.4.15 required).

Support for Windows 7 beta as a member of the Samba4 domain

Issues with the nesting of LDB transactions have been fixed

A number of internal libraries (tevent, auth in particular has been
updated for easier use outside Samba4

spoolss IDL updates to bring Samba3 to use PIDL code, and to merge
the corrected IDL back into Samba4

Fixes to allow use of C++ compilers and to increase portability

Fixed TLS (SSL) support with modern versions of GnuTLS

These are just some of the highlights of the work done in the past
month. More details can be found in our GIT history.

CHANGES
=======

Those familiar with Samba 3 can find a list of user-visible changes
since that release series in the NEWS file.

KNOWN ISSUES
============

- Domain member support is in it's infancy, and is not comparable to
the support found in Samba3.

- There is no printing support in the current release.

- There is no NetBIOS browsing support in the current release

- The Samba4 port of the CTDB clustering support is not yet complete

- Clock Synchronisation is critical. Many 'wrong password' errors are
actually due to Kerberos objecting to a clock skew between client
and server. (The NTP work in the previous alphas are partly to assist
with this problem).

- Samba4 alpha7 is currently only portable to recent Linux
distributions. Work to return support for other Unix varients is
expected during the next alpha cycles

RUNNING Samba4
==============

A short guide to setting up Samba 4 can be found in the howto.txt file
in root of the tarball.

DEVELOPMENT and FEEDBACK
========================
Bugs can be filed at https://bugzilla.samba.org/ but please be aware
that many features are simply not expected to work at this stage.

The Samba Wiki at http://wiki.samba.org should detail some of these
development plans.

Development and general discussion about Samba 4 happens mainly on
the #samba-technical IRC channel (on irc.freenode.net) and
the samba-technical mailing list (see http://lists.samba.org/ for
details).

================
Download Details
================

The release tarball is available from the following location:
* http://download.samba.org/samba/ftp/samba4/samba-4.0.0alpha7.tar.gz

This release has been signed using GPG with Andrew's GPG key (28B436BB).

* http://download.samba.org/samba/ftp/samba4/samba-4.0.0alpha7.tar.asc

To verify that the signature is correct, make sure that the tarball has
been unzipped and run:

$ gpg --verify samba-4.0.0alpha4.tar.asc

Happy testing!

The Samba team

--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team http://samba.org
Samba Developer, Red Hat Inc.

signature.asc (196 bytes) Download Attachment

[Announce] Samba 3.3.1 Available for Download

2009-02-24T03:00:39Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=================================================================
"There are two ways to write error-free programs;
only the third one works."

Alan J. Perlis
=================================================================

Release Announcements
=====================

This is the latest bugfix release release of the Samba 3.3 series.

Major enhancements in Samba 3.3.1 include:

* Fix net ads join when "ldap ssl = start tls" (bug #6073).
* Fix renaming/deleting of files using Windows clients (bug #6082).
* Fix renaming/deleting a "not matching/resolving" symlink (bug #6090).
* Fix remotely adding a share via the Windows MMC.

######################################################################
Changes
#######

smb.conf changes
- ----------------

Parameter Name Description Default
-------------- ----------- -------
ldap ssl ads New No

Changes since 3.3.0:
- --------------------

o Jeremy Allison <jra@...>
* BUG 6082: Fix renaming/deleting of files using Windows clients.
* BUG 6069: Fix build with too many arguments.
* BUG 6090: Fix renaming/deleting a "not matching/resolving" symlink.
* BUG 6099: Try to fix domain join of Win7 Beta.
* BUG 6117: Fix core dump of pdbedit -a.
* BUG 6133: Fix deletion of non-ACL files on Solaris/ZFS/NFSv4 ACL
filesystem.
* Fix Coverity IDs 115, 116, 117, 602.
* Fix warning (bad handler prototype).
* Unify the detection of the timespec code in configure.in, and the
application of it in time.c.
* Correctly use chroot().
* Parameterize in local.h the MAX_RPC_DATA_SIZE, and ensure that "offered"
read from the rpc packet in spoolss is under that size.
* Backport the semantics of when to delete alternate data streams on a file
truncate.
* Fix printf warnings.
* Fix warnings on Solaris.

o Michael Adam <obnox@...>
* BUG 6066: netinet/ip.h present but cannot be compiled on Solaris.
* BUG 6073: Prevent ads_connect() from using SSL unless explicitly
requested.
* Fix 'getent passwd' to allocate new uids.
* Fix 'getent group' to allocate new gids.
* Remove check for sharename being a username in 'net conf
addshare'.

o Guenther Deschner <gd@...>
* Fix Coverity ID 848.
* Remove unused ENUM_HND from 'net'.
* Fix getform command asprintf return code in rpcclient.
* Fix memleak in get_remote_printer_publishing_data().
* Remove duplicate prototypes for generated rpc server functions.

o Holger Hetterich <hhetter@...>
* Enable total anonymization in vfs_smb_traffic_analyzer.

o Bjoern Jacke <bj@...>
* Fix build with external dns_sd libraries.
* Fix configure check "sub-second timestamps without struct timespec".
* Add configure check for AIX style sub-second resolution support.
* Add configure check for Tru64 sub-second timestamp resolution.
* Add Tru64 sub-second resolution timestamp support.
* Enable IPv6 support for NetBSD and FreeBSD.
* Use correct BSD evironment variable.

o Guenter Kukkukk <linux@...>
* Don't try and delete a default ACL from a file.

o Volker Lendecke <vl@...>
* BUG 5798: CFLAGS info lost in configure.
* Fix Coverity IDs 740, 742, 744, 745, 876, 879, 880.
* Fix remotely adding a share via the Windows MMC.
* Avoid valgrind errors.
* Fix 'net rpc join' for users with the SeMachineAccountPrivilege.
* Fix resume handle for _samr_EnumDomainGroups.
* Fix a buffer handling bug when adding lots of registry keys.
* Fix a O(n^2) algorithm in regdb_fetch_keys().

o Jeff Layton <jlayton@...>
* Initialize rc to 0 in main in mount.cifs.

o Derrell Lipman <derrell.lipman@...>
* BUG 6069: Add a fstatvfs function for libsmbclient.
* Eliminate compiler warnings.

o Glenn Machin <gmachin@...>
* Don't miss an absolute pathname as a kerberos keytab path.

o Stefan Metzmacher <metze@...>
* BUG 6100: Implement _netr_LogonGetCapabilities() with
NT_STATUS_NOT_IMPLEMENTED.
* Make Samba work with older ctdb versions.
* Add S-1-22-X-Y sids to the local token.

o Lars Mueller <lars@...>
* Conditional install of the cifs.upcall man page.
* Adjust regex to match variable names including underscores.

o Shirish Pargaonkar <shirishpargaonkar@...>
* BUG 4370: Clean-up entries in /etc/mtab after unmount.
* Add fakemount (-f) and nomtab (-n) flags to mount.cifs.

o Ted Percival <ted.percival@...>
* Fix a crash during name resolution.

o Tim Prouty <tprouty@...>
* Fix "assignment discards qualifiers from pointer target type"
warnings.
* Fix SMB_VFS_RECVFILE/SENDFILE macros.

o Karolin Seeger <kseeger@...>
* Change "ldap ssl:ads" parameter to "ldap ssl ads".
* Add manpages for vfs_acl_xattr and vfs_acl_tdb.

o Dan Sledz <dsledz@...>
* Fix double free caused by incorrect talloc_steal usage.

o Simo Sorce <idra@...>
* Build ldbrename.

o Aravind Srinivasan <aravind.srinivasan@...>
* Make nmbd check all available interfaces for WINS before failing.

o Miguel Suarez <Miguel.Suarez@...>
* Fix compilation of vfs_default on systems that do not support utimes().

o Yasuma Takeda <yasuma@...>
* BUG 5920: Fix the calculation of the memcpy length.
* BUG 6098: Fix ads_find_dc() in setups with "security = domain".

o Bo Yang <boyang@...>
* Make libsmbclient work with DFS.

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.3.1.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAkmj0ywACgkQKGi9fisXk1FGEQCfeOEWbeLOtnXBwwGeEiDvMS8f
T3gAoKeDVigbE7/iQ3ZncGCQeop7D2Xv
=X/RV
-----END PGP SIGNATURE-----

[Announce] Samba 3.2.8 Maintainance Release Available

2009-02-03T09:07:29Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================================
"Always keep an open mind and a
compassionate heart."

Phil Jackson
================================================================

Release Announcements
=====================

This is a bug fix release of the Samba 3.2 series.

Major enhancements included in Samba 3.2.8 are:

o Correctly detect if the current DC is the closest one.
o Add saf_join_store() function to memorize the DC used at join time.
This avoids problems caused by replication delays shortly after domain
joins.

The original security announcement for this and past advisories can
be found http://www.samba.org/samba/security/

######################################################################
Changes
#######

Changes since 3.2.7
- -------------------

o Michael Adam <obnox@...>
* BUG 6066: netinet/ip.h present but cannot be compiled under Solaris.
* Fix join by creating keytab after changing the config in libnet.
* Streamline logic of libnet_join_post_processing() in libnet_join.
* Fix build of [u]mount.cifs in the RHEL packaging.
* Fix distclean target and add realdistclean target in the docs build.
* Clean generated .png images and build/catalog.xml in "make clean".
* Fix detection of netinet/ip.h on Solaris 8.

o Jeremy Allison <jra@...>
* BUG 4308: Excel save operation corrupts file ACLs.
* BUG 5979: Fix level 2 oplocks.
* BUG 5980: Fix race condition when granting level2 oplocks can cause break
notify to be missed.
* BUG 5986: Fix renaming of streams.
* BUG 5990: Strict allocate should be checked before ftruncate.
* BUG 6009: Setting "min receivefile size = 1" breaks writes.
* BUG 6016: Alternate Data Streams / Extended Attributes seem to conflict.
* BUG 6017: Fix magic scripts.
* BUG 6019: Fix file corruption in Clustered SMB/NFS environments managed via
CTDB.
* BUG 6021: smbclient du command does not recuse properly.
* BUG 6030: Add missing <th> header in Status page.
* BUG 6035: Fix possible race between fcntl F_SETLKW and alarm delivery.
* BUG 6040: Calling Samba print server with an aliased DNS-name fails.
* Fix race condition in alarm lock processing.
* Fix logic bug introduce in backport of ccache_regain_all_now.
* Fix crash bug in SWAT.
* Fix logic error in try_chown.
* Fix detection of dns_sd libraries.

o Kai Blin <kai@...>
* BUG 5953: Fix smbclient crashes.

o Gerald (Jerry) Carter <jerry@...>
* Fix "allow trusted domain" so it disables trusted domains.

o Guenther Deschner <gd@...>
* Fix buffer allocation in eventlog read call.
* Fix various invalid memcpy in read_package_entry().

o SATOH Fumiyasu <fumiyas@...>
* Variables for signals must be volatile sig_atomic_t in Winbind.
* Fix gmem->numgids and gmem->maxgids breakage on Solaris 64-bit.
* Fix a compile-time warning.
* Fix SIGBUS on non-x86 CPUs in libsmbclient.

o Björn Jacke <bj@...>
* Correct the description of the "ldap timeout" parameter.
* Fix build with external dns_sd libraries.

o Jeff Layton <jlayton@...>
* Allow mounts to ipv6 capable servers in mount.cifs.

o Volker Lendecke <vl@...>
* BUG 5933: Fix incrementing/decrementing num_validated_vuids.
* BUG 5953: Make cli_send_smb_direct_writeX use writev.
* BUG 5965: Fix creation of the first share using SWAT.
* BUG 5969: Optimize smbclient put command.
* BUG 6014: mget shouldn't segfault without arguments.
* Fix error code when smbclient puts a file over an existing directory.
* Fix a valgrind error.
* Fix a "ignoring function call result" warning.
* Add sys_writev.
* Add write_data_iov.
* Make write_data use write_data_iov.
* Fix a memory leak in cups_pull_comment_location.
* Fix an ancient uninitialized variable read.
* Fix a bad memleak in vfs_full_audit.
* Fix several valgrind errors.
* Fix 'net rpc join' for users with the SeMachineAccountPrivilege.

o Herb Lewis <hlewis@...>
* Don't return 0 on error in smbcacls - bad for scripts.

o Derrell Lipman <derrell.lipman@...>
* Determine case sensitivity based on file system attributes in
libsmbclient.

o Stefan Metzmacher <metze@...>
* Correctly detect if the current dc is the closest one.
* Use get_dc_name() instead of get_sorted_dc_list() in the LDAP case.
* Fallback to returning all DCs, when none is available in the requested
site.
* Add saf_join_store() function.
* Use DS_FORCE_REDISCOVERY in libnet_join.
* Use dbwrap to open sessionid.tdb in net status.
* Fix dbwrap_store_uint32() to match dbwrap_store_int32().
* Handle the SMB signing states the same in the krb5 and ntlmssp cases in
libsmb.
* Re-add "fileid:algorithm" as option in vfs_fileid.
* Add vfs_fileid manpage.

o Lars Müller <lars@...>
* Tweak with pam defines of older Linux versions.
* Adjust regex to match variable names including underscores.
* Conditional install of the cifs.upcall man page.

o Tim Prouty <tprouty@...>
* Fix stream marshalling to return the correct streaminfo status.
* Fix a delete on close divergence from Windows.
* Allow renames of streams via NTRENAME and fix stream error codes on
rename.
* Remove a few unnecessary checks from the streams depot module and fix to
work with NTRENAME.
* Remove a few unnecessary checks from the streams xattr module.
* Remove a few unnecessary checks from the streams xattr module.

o Andreas Schneider <anschneider@...>
* Fix a segfault if ? is there but the options are NULL.
* Avoid flooding of syslog with failing pam_putenv messages.
* Document default of the printing config variable.
* Use talloc_tos() instead of the talloc NULL context.

o Karolin Seeger <kseeger@...>
* BUG 6058: Use 'make distclean' instead of 'make clean' in build_docs.
* BUG 6000: Avoid bashism in perfcount.init.
* Change default value for "ldap ssl" to "start tls".
* Several documentation improvements/typo fixes.
* Fix syntax error in samba.spec.tmpl.
* Check if Unix account exists before asking for the password in smbpasswd.
* Add manpage for vfs_shadow_copy2.

o Richard Sharpe <realrichardsharpe@...>
* Fix mistake in DEBUG message.

o Andrew Tridgell <tridge@...>
* Keep compatibility with v3-0-ctdb name for fileid:mapping option.

o Bo Yang <boyang@...>
* Clean event context after child is forked.
* Refresh sequence number as soon as possible.
* Don't set child->requests to NULL in parent after fork.
* Backport of the clean event context after fork and
krb5 refresh chain fixes.
* Fix null pointer refrence in event context.
* Don't send message to any other child in child process.
* Fix bug in get_dc_name_via_netlogon(), null pointer refrence.

######################################################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical IRC channel on irc.freenode.net.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored. All bug reports should
be filed under the Samba 3.2 product in the project's Bugzilla
database (https://bugzilla.samba.org/).

======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.2.8.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAkmIbvEACgkQKGi9fisXk1FzPQCfaUMOPwenxD6ylu9rXJs1V05/
4NIAoJHSKXfqyiOKYcJ3P2mD4HoRRBZO
=5UHm
-----END PGP SIGNATURE-----

[Announce] Samba 3.3.0 Available for Download

2009-01-27T03:50:27Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================================
"After all, computers crash, people die,
relationships fall apart. The best we
can do is breath and reboot."

Sarah Jessica Parker
================================================================

Release Announcements
=====================

This is the first stable release of Samba 3.3.0.

Major enhancements in Samba 3.3.0 include:

General changes:
o The passdb tdbsam version has been raised.

Configuration/installation:
o Splitting of library directory into library directory and separate
modules directory.
o The default value of "ldap ssl" has been changed to "start tls".

File Serving:
o Extended Cluster support.
o New experimental VFS modules "vfs_acl_xattr" and "vfs_acl_tdb"
to store NTFS ACLs on Samba file servers.

Winbind:
o Simplified idmap configuration.
o New idmap backends "adex" and "hash".
o Added new parameter "winbind reconnect delay".
o Added support for user and group aliasing.
o Added support for multiple domains to idmap_ad.

Administrative tools:
o The destination "all" of smbcontrol does now affect all running
daemons including nmbd and winbindd.
o New 'net rpc vampire keytab' and 'net rpc vampire ldif' commands.
o The 'net' utility can now use kerberos for joining and authentication.
o The 'wbinfo' utility can now add, modify and remove identity mapping entries.

Libraries:
o NetApi library implements various new calls for User- and Group
Account Management.
o libsmbclient does now determine case sensitivity based on file system
attributes.

General changes
===============

The passdb tdbsam version has been raised as among other things the RID counter
has been moved from the winbindd_idmap.tdb to the passdb.tdb file to make
"passdb backend = tdbsam" working in clustered environments.

Please note that an updated passdb.tdb file is _not_ compatible with Samba
versions before 3.3.0! Please backup your passdb.tdb file if
you use "passdb backend = tdbsam". That can be achieved by running

'tdbbackup /etc/samba/passdb.tdb'

before the update.

Configure changes
=================

The configure option "--with-libdir" has been removed. The library
directory can still be specified by using the existing "--libdir" option.
A new option "--with-modulesdir" has been added to allow the specification
of a separate directory for the shared modules.

Configuration changes
=====================

The default value of "ldap ssl" has been changed to "start tls". This means,
Samba will use the LDAPv3 StartTLS extended operation (RFC2830) for
communicating with directory servers by default. If your directory servers
do not support this extended operation, you will have to set
"ldap ssl = no". Otherwise, Samba could not contact the directory servers
anymore!

Winbind idmap backend changes
=============================

The idmap configuration has changed with version 3.3 to something that
allows a smoother upgrade path from pre-3.0.25 configurations that use
"idmap backend". The reason for this change is that to many, also to Samba
developers, the 3.0.25 style configuration with "idmap config" turned out
to be very complex. Version 3.3 no longer deprecates the "idmap backend"
parameter, instead with "idmap backend" the default idmap backend is
specified.

Accordingly, the "idmap config <domain> : default = yes" setting is no
longer being looked at.

The alloc backend defaults to the default backend, which should be able to
allocate IDs. In the default distribution the tdb and ldap backends can
allocate, the ad and rid backends can not. The idmap alloc range is now
being set with the "old" parameters "idmap uid" and "idmap gid".

The "idmap domains" parameter has been removed.

winbind reconnect delay
=======================

This is a new parameter which specifies the number of seconds the Winbind
daemon will wait between attempts to contact a Domain controller for a domain
that is determined to be down or not contactable.

Winbind's Name Aliasing
=======================

Name aliasing in Winbind is a feature that allows an administrator to
map a fully qualified user or group name from a Windows domain to a
convenient short name for Unix access. This is similar to the username
map functionality supported by smbd but is primary intended for
clients and servers making use of Winbind's PAM and NSS libraries.

For example, the user "DOMAIN\fred" has been mapped to the Unix name
"freddie".

$ getent passwd "DOMAIN\fred"
freddie:x:1000:1001:Fred Jones:/home/freddie:/bin/bash

$ getent passwd freddie
freddie:x:1000:1001:Fred Jones:/home/freddie:/bin/bash

The name aliasing support is provided by individual nss_info plugins.
For example, the new "adex" plugin reads the uid attribute from Active
Directory to make a short login name to the fully qualified name.
While the new "hash" module utilizes a local file to map "short_name
= QUALIFIED\name". Both user and group name mapping is supported.
Please refer to the "winbind nss info" option in smb.conf(5) and
to individual plugin man pages for further details.

idmap_hash
==========

The idmap_hash plugin provides similar support as the idmap_rid
module. However, uids and gids are generated from the full domain
SID using a hashing algorithm that maps the lower 19 bits from the user
or group RID to bits 0 - 19 in the Unix id and hashes 96 bits from
the domain SID to bits 20 - 30 in the Unix id. The result is a 31 bit
uid or gid that is consistent across machines and provides support for
trusted domains.

Please refer to the idmap_hash(8) man page for more details.

idmap_adex
==========

The adex idmap/nss_info plugin is an adaptation of the Likewise
Enterprise plugin with support for OU based cells removed
(since the Windows pieces to manage the cells are not available).

This plugin supports

* The RFC2307 schema for users and groups.
* Connections to trusted domains
* Global catalog searches
* Cross forest trusts
* User and group aliases

Prerequisite: Add the following attributes to the Partial Attribute
Set in global catalog:

* uidNumber
* uid
* gidNumber

A basic config using the current trunk code would look like:

[global]
idmap backend = adex
idmap uid = 10000 - 29999
idmap gid = 10000 - 29999
winbind nss info = adex

winbind normalize names = yes
winbind refresh tickets = yes
template homedir = /home/%D/%U
template shell = /bin/bash

Please refer to the idmap_adex(8) man page for more details.

Libraries
=========

libsmbclient will now treat file names case-sensitive by default if the filesystem
we are connecting to supports case sensitivity. This change of behavior is
considered a bug fix, as it was previously possible to accidentally overwrite a
file that had the same case-insensitive name but a different case-sensitive name
as a previously-existing file, while creating a new file.

If it is not possible to detect if the filesystem supports case sensitivity,
the user-specified option value will be used.

######################################################################
Changes
#######

smb.conf changes
- ----------------

Parameter Name Description Default
-------------- ----------- -------
cups connection timeout New 30
idmap config DOM:range Removed
idmap domains Removed
init logon delayed hosts New ""
init logon delay New 100
ldap ssl Changed Default start tls
share modes Deprecated
winbind reconnect delay New 30

Changes since 3.3.0rc2:
- -----------------------

o Jeremy Allison <jra@...>
* BUG 4308: Fix corrupting of file ACLs during Excel save operations.
* BUG 5979: Fix level 2 oplocks being granted improperly.
* BUG 5980: Race condition when granting level2 oplocks can cause break
notify to be missed.
* BUG 5986: Editing a stream is broken (rename problems).
* BUG 5990: Strict allocate should be checked before ftruncate.
* BUG 6009: Setting "min receivefile size = 1" breaks writes.
* BUG 6016: Alternate Data Streams / Extended Attributes seem to conflict.
* BUG 6017: Fix magic scripts.
* BUG 6019: Fix file corruption in Clustered SMB/NFS environment managed via
CTDB.
* BUG 6021: smbclient du command does not recuse properly.
* BUG 6024: Deprecate the "share modes" parameter.
* BUG 6030: Add missing <th> header in Status page.
* BUG 6035: Fix possible race between fcntl F_SETLKW and alarm delivery.
* BUG 6040: Calling Samba print server with an aliased DNS-name fails.
* Fix gcc 4.3.2 warnings.
* Fix more asprintf errors and error code paths.
* Attempt to fix crash seen with new CUPS async printcap loading code.
* Add winbindd_reinit_after_fork(), cleaning out all possible events
in a forked child.
* Make winbindd_cm.c use winbindd_reinit_after_fork().
* Fix race condition in alarm lock processing.
* Fixes crash bug in SWAT.

o Michael Adam <obnox@...>
* Fix build of pam_winbind.so on older Linux systems.
* Packaging RHEL-CTDB: Fix build of [u]mount.cifs.
* Prevent access to root filesystem when connecting with empty service name.
* Fix distclean target and add realdistclean target in the docs build.
* Add manpage for idmap_tdb2.
* Clarify idmap manpages.

o Kai Blin <kai@...>
* BUG 5953: Fix smbclient crashes.

o Gerald (Jerry) Carter <jerry@...>
* Fix "allow trusted domain" so it disables trusted domains.
* Return immediately on a failed GC connection in ads_connect.

o SATOH Fumiyasu <fumiyas@...>
* Fix gmem->numgids and gmem->maxgids breakage on Solaris 64-bit.
* Fix SIGBUS on non-x86 CPUs in libsmbclient.
* Fix a compile-time warning.

o Holger Hetterich <hhetter@...>
* Add a simple tdb integrity check to tdbtool.

o Björn Jacke <bj@...>
* Correct the description of the "ldap timeout" parameter.

o Volker Lendecke <vl@...>
* BUG 5913: Fix build error with at least GCC 4.2.2.
* BUG 5933: Fix incrementing/decrementing of num_validated_vuids.
* BUG 5953: Make cli_send_smb_direct_writeX use writev.
* BUG 5965: Fix creation of the first share using SWAT.
* BUG 5969: Optimize smbclient put command.
* BUG 6012: Add "get_real_filename" to full_audit.
* BUG 6014: Fix segfault when calling mget without arguments.
* Fix a spinning smbd when printing.
* Fix a memory leak in cups_pull_comment_location.
* Fix a valgrind error.
* Fix a "ignoring function call result" warning.
* Fix some C++ warnings.
* Fix an ancient uninitialized variable read.
* Fix a bad memleak in vfs_full_audit.

o Derrell Lipman <derrell.lipman@...>
* BUG 6022: Make smbc_urlencode and smbc_urldecode in libsmbclient.
* Determine case sensitivity based on file system attributes.

o Stefan Metzmacher <metze@...>
* net_status: Use dbwrap to open sessionid.tdb.
* Fix dbwrap_store_uint32() to match dbwrap_store_int32().
* Make marshalling struct samu from and to a buffer more generic.
* Store the next rid counter in passdb.tdb instead of winbind_idmap.tdb.
* Register the client connection via CTDB_CONTROL_TCP_ADD.
* Don't need to call messaging_reinit() twice.
* Raise TDBSAM_VERSION.
* Add manpage for vfs_fileid.
* Rename 'fd_event' to 'winbindd_fd_event' to avoid confusion.
* Recreate the per domain check_online_event without relying on global
state.
* Handle the smb signing states the same in the krb5 and ntlmssp cases.
* Re-add 'fileid:algorithm' option to vfs_fileid.
* Fix CTDB IPv6 support in cluster setups.
* Reinit_after_fork() should reinit the event context before the
messaging context.
* Fix PCAP support in socket_wrapper.

o Lars Müller <lars@...>
* Tweak with pam defines of older Linux versions.

o Tim Prouty <tprouty@...>
* Fix stream marshalling to return the correct streaminfo status.
* Allow renames of streams via NTRENAME and fix stream error codes on
rename.
* Remove a few unnecessary checks from the streams xattr module.
* Remove a few unnecessary checks from the streams depot module and fix to
work with NTRENAME.

o Andreas Schneider <anschneider@...>
* Fix a segfault if ? is there but the options are NULL.
* Avoid flooding of syslog with failing pam_putenv messages.

o Karolin Seeger <kseeger@...>
* BUG 6000: Avoid bashism in perfcount.init.
* Change default value of "ldap ssl" to "start tls".
* Update version number in the manpages.
* Fix several small issues and typos in the manpages.
* Check if Unix account exists before asking for the password in smbpasswd.

o Todd Stecher <todd.stecher@...>
* Fix memory leaks and other fixes found by Coverity.

o Bo Yang <boyang@...>
* Clean event context after child is forked.
* Fix broken krb5 refresh chain.
* Set entry->refresh_time to make ccache_regain_all_now() work correctly.
* Refresh sequence number as soon as possible.
* Don't set child->requests to NULL in parent after fork.
* Don't send message to any other child in child process.
* Fix bug in get_dc_name_via_netlogon(), null pointer reference.

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.3.0.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAkl+xKQACgkQKGi9fisXk1FTtACfZmxpMxe+hf3NA3GZSphyIpZV
ePQAn3cVMjNJ4NpZpV/DDP3m3CNu7G9z
=Bf7U
-----END PGP SIGNATURE-----

[Announce] Samba 4 alpha6 Available for Download

2009-01-21T04:53:17Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

We are proud to finally announce another alpha release of Samba 4.

What's new in Samba 4 alpha6
============================

Samba 4 is the ambitious next version of the Samba suite that is being
developed in parallel to the stable 3.0 series. The main emphasis in
this branch is support for the Active Directory logon protocols used
by Windows 2000 and above.

Samba4 alpha6 follows on from the alpha release series we have been
publishing since September 2007

WARNINGS
========

Samba4 alpha6 is not a final Samba release. That is more a reference
to Samba4's lack of the features we expect you will need than a
statement of code quality, but clearly it hasn't seen a broad
deployment yet. If you were to upgrade Samba3 (or indeed Windows) to
Samba4, you would find many things work, but that other key features
you may have relied on simply are not there yet.

For example, while Samba 3.0 is an excellent member of a Active
Directory domain, Samba4 is happier as a domain controller, and it is
in this role where it has seen deployment into production.

Samba4 is subjected to an awesome battery of tests on an
automated basis, we have found Samba4 to be very stable in it's
behaviour. We have to recommend against upgrading production servers
from Samba 3 to Samba 4 at this stage, because there may be the features on
which you may rely that are not present, or the mapping of
your configuration and user database may not be complete.

If you are upgrading, or looking to develop, test or deploy Samba4, you should
backup all configuration and data.

NEW FEATURES
============

Samba4 supports the server-side of the Active Directory logon environment
used by Windows 2000 and later, so we can do full domain join
and domain logon operations with these clients.

Our Domain Controller (DC) implementation includes our own built-in
LDAP server and Kerberos Key Distribution Center (KDC) as well as the
Samba3-like logon services provided over CIFS. We correctly generate
the infamous Kerberos PAC, and include it with the Kerberos tickets we
issue.

The new VFS features in Samba 4 adapts the filesystem on the server to
match the Windows client semantics, allowing Samba 4 to better match
windows behaviour and application expectations. This includes file
annotation information (in streams) and NT ACLs in particular. The
VFS is backed with an extensive automated test suite.

A new scripting interface has been added to Samba 4, allowing
Python programs to interface to Samba's internals.

The Samba 4 architecture is based around an LDAP-like database that
can use a range of modular backends. One of the backends supports
standards compliant LDAP servers (including OpenLDAP), and we are
working on modules to map between AD-like behaviours and this backend.
We are aiming for Samba 4 to be powerful frontend to large
directories.

CHANGES SINCE Alpha5
=====================

In the time since Samba4 Alpha5 was released in June 2008, Samba has
continued to evolve, but you may particularly notice these areas
(in no particular order):

The source code for various libraries that are used by both Samba 3 and
Samba 4 are now shared between the two rather than duplicated
(and being slightly diverged).

The tevent library has been split out and is now usable on its own.

Several crash bugs and memory leaks in the registry library have been fixed.

The Python modules have been extended and are no longer generated using SWIG.

Stream renames are now supported.

The provision script now has an interactive mode.

The (broken) copy of CTDB has been removed.

More work towards supporting an OpenLDAP backend.

Initial work on using the Microsoft LDAP schema.

The storage of schemas in LDB is now much more efficient.

Support for extended DNs in LDB has been added.

Incoming trusts are now supported.

Compatibility of the registry server with several Windows versions has been
improved.

Improvements to LSA.idl for better functionality in the usrmgr.exe.

Improved handling of non-standard characters in passwords.

The embedded JavaScript library has been removed in favor of Python.

The WMI implementation has been re-added, but does not completely work yet.

xpress compression is now supported in the NDR layer.

The main binary is now named "samba" rather than "smbd".

A simple script for setting the expiration of a user was added.

The LDB library is now completely asynchronous internally.

Various unknowns and correctness issues in the drsblobs and drsuapi RPC
interface implementations have been fixed.

It is now possible to connect to an LDAP backend using SASL credentials.

Multi-fragment NTtrans request support has been added.

The DCE/RPC server can now listen on a separate pipe to allow DCE/RPC
connections forwarded from Samba 3. The user credentials are provided
by the client.

A large number of bugs in the SMB2 implementation have been fixed.

Auxiliary classes in LDAP schema conversion are now collapsed.

Several tests have been added to the SMB testsuite.

Object GUIDs in DCE/RPC connections are now dealt with properly.

The correctness of the LSA and NETLOGON implementations has been
improved.

Multi Master Replication configuration can now be generated
for OpenLDAP.

These are just some of the highlights of the work done in the past few
months. More details can be found in our GIT history.

CHANGES
=======

Those familiar with Samba 3 can find a list of user-visible changes
since that release series in the NEWS file.

KNOWN ISSUES
============

- - Domain member support is in it's infancy, and is not comparable to
the support found in Samba3.

- - There is no printing support in the current release.

- - There is no NetBIOS browsing support in the current release

- - The Samba4 port of the CTDB clustering support is not yet complete

- - Clock Synchronisation is critical. Many 'wrong password' errors are
actually due to Kerberos objecting to a clock skew between client
and server. (The NTP work in the previous alpha is partly to assist
with this problem).

- - Samba4 alpha6 is currently only portable to recent Linux
distributions. Work to return support for other Unix varients is
expected during the next alpha cycle

- - Samba4 alpha6 is incompatible with GnuTLS 2.0, found in Fedora 9 and
recent Ubuntu releases. GnuTLS use may be disabled using the
--disable-gnutls argument to ./configure. (otherwise 'make test' and
LDAPS operations will hang).

RUNNING Samba4
==============

A short guide to setting up Samba 4 can be found in the howto.txt file
in root of the tarball.

DEVELOPMENT and FEEDBACK
========================
Bugs can be filed at https://bugzilla.samba.org/ but please be aware
that many features are simply not expected to work at this stage.

The Samba Wiki at http://wiki.samba.org should detail some of these
development plans.

Development and general discussion about Samba 4 happens mainly on
the #samba-technical IRC channel (on irc.freenode.net) and
the samba-technical mailing list (see http://lists.samba.org/ for
details).

================
Download Details
================

The release tarball is available from the following location:
* http://download.samba.org/samba/ftp/samba4/samba-4.0.0alpha6.tar.gz

This release has been signed using GPG with Jelmer's GPG key (1EEF5276).

* http://download.samba.org/samba/ftp/samba4/samba-4.0.0alpha6.tar.asc

To verify that the signature is correct, make sure that the tarball has
been unzipped and run:

$ gpg --verify samba-4.0.0alpha6.tar.asc

We are also planning on making Debian packages available.

Happy testing!

The Samba team

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAkl3GmkACgkQKGi9fisXk1FtSwCfS4stqbzRtesWQA+4ZOWH0hvN
UksAoKd2Rx5eejlD0VZy93migA3uVpor
=KcYG
-----END PGP SIGNATURE-----

[Announce] Samba 3.0.34 Maintainance Release Available

2009-01-20T01:21:35Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===============================================================
"Minds are like parachutes.
They only function when they
are open."

Sir James Dewar
===============================================================

Release Announcements
=====================

This is a bug fix release of the Samba 3.0 series.

Major enhancements included in Samba 3.0.34 are:

o Fix update of machine account passwords.
o Fix SMB signing issue on Windows Vista with MS Hotfix KB955302.
o Fix Winbind crashes.
o Correctly detect if the current dc is the closest one.
o Add saf_join_store() function to memorize the dc used at join time.
This avoids problems caused by replication delays shortly after domain
joins.
o Fix write list in setups using "security = share".

######################################################################
Changes
#######

Changes since 3.0.33
- --------------------

o Michael Adam <obnox@...>
* Fix linking cifs.upcall when nscd_flush_cache() is found.
* Fix smbd hanging on Solaris when winbindd closes socket.
* Use the reconnect methods instead of the rpc methods directly.

o Jeremy Allison <jra@...>
* BUG 1254: Fix write list in setups using "security = share".
* BUG 5052: Not work cancel inheritance on share.
* BUG 5729: Explicitly allow "-valid" parameter.
* BUG 5737: Fix Winbind crash in an unusual failure mode.
* BUG 5750: Fix SMB signing issue on Windows Vista with MS Hotfix KB955302.
* BUG 5751: Backport to fix showing of ACLson DFS with smbclient.
* BUG 5790: Fix returning STATUS_OBJECT_NAME_NOT_FOUND on set file
disposition call.
* BUG 5814: Fix core dump of Winbind while doing "rescan_trusted_domain".
* BUG 5873: Fix ACL inheritance.
* BUG 5914: Fix build failure (redefinition of struct name_list).
* BUG 5937: Fix filenames with "*" char hiding other files.
* BUG 6019: File corruption in Clustered SMB/NFS environment
managed via CTDB.
* BUG 6035: Fix possible race between fcntl F_SETLKW and alarm delivery.
* Remove unecessary msync.
* Rename cifs.spnego to cifs.upcall.
* Fix segfault when execution cifs.upcall without any arguments.
* Ensure we emit the notify message before renaming the open files.
* Fix use of DLIST_REMOVE.
* Cope with bad trans2mkdir requests from System in QNTC IBM SMB client.
* Fix memory leak in error path.
* Fix logic bug introduced in backport of ccache_regain_all_now.

o Kai Blin <kai@...>
* Reformat the WBFLAGS defines to prepare for adding a new flag.
* Put huge NTLMv2 blobs into extra_data on CRAP auth.

o Günther Deschner <gd@...>
* BUG 5710: Fix update of machine account passwords.
* Define NET_SRVPWSET2 call.
* Net should just use machine account creds when changing passwords.
* Fix net_io_q_srv_pwset2.

o Carsten Dumke <carsten@...>
* BUG 5892: Fix documentation of net rap printq info.

o Dina Fine <dina@...>
* BUG 5908: Fix failing of internal change notify on share directory.

o Steve French <stevef@...>
* Fix compile warning in cifs.upcall.
* Fix cifs.upcall manpage and comments.

o Jeff Layton <jlayton@...>
* Build cifs.upcall by default on Linux.
* Fix negatively instantiate keys on error in cifs.upcall.
* Handle handle MSKRB5 OID properly in cifs.upcall.
* Bump SPNEGO msg version number and don't reject old versions in
cifs.upcall.
* Fix several problems when mounting subdirectories of shares in
mount.cifs.
* Don't prompt for password on krb5 mounts in mount.cifs.
* Have uppercase_string return success on NULL pointer in mount.cifs.
* Make return codes match the return codes for /bin/mount in mount.cifs.
* Use lock/unlock_mtab scheme from util-linux-ng mount prog.

o Volker Lendecke <vl@...>
* BUG 5965: Fix creation of the first share using SWAT.
* Fix bug triggered by the RAW-SAMBA3OPLOCKLOGOFF test.

o David Leonard <David.Leonard@...>
* BUG 4516: No IPv6 on Solaris 2.6.

o Igor Mammedov <niallain@...>
* Add support for cifs.spnego helper into configure and Makefile.in.
* Add checks for spnego prereq keyutils.h and kerberos in configure.in.
* Add helper source for handling cifs kernel module upcall for kerberos
authorization.
* Add -c option to set service prefix to "cifs" in service principal by
default service prefix "host" is used.
* Add support for cifs.resolver upcall.

o Stefan Metzmacher <metze@...>
* Correctly detect if the current dc is the closest one.
* For CLDAP we need to use get_sorted_dc_list() to avoid recursion.
* Add fallback to return all dcs, when none is available in the requested
site.
* Add saf_join_store() function to memorize the dc used at join time.
* Return an error instead of crashing when no realm is given.
* Handle the SMB signing states the same in the krb5 and ntlmssp cases.

o Andreas Schneider <mail@...>
* Delete the krb5 ccname variable from the PAM environment if set.
* Fix the build of pam_winbind.
* Fix circular dependency error with autoconf 2.6.3.

o Simo Sorce <idra@...>
* Fix an ifdef check.
* Fix warning.

o Yasuma Takeda <yasuma@...>
* BUG 5909: Fix MS-DFS links inlcuding multibyte characters on Vista.

o Andrew Tridgell <tridge@...>
* Avoid a race condition in glibc between AIO and setresuid().
* Become root for AIO operations.

o Bo Yang <boyang@...>
* Don't set child->requests to NULL in parent after fork.
* Backport of the clean event context after fork and krb5
refresh chain fixes.
* Fix null pointer refrence in event context in backport from v3-3-test.

o Qiao Yang <geoyang@...>
* Fix a memleak.

######################################################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical IRC channel on irc.freenode.net.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored. All bug reports should
be filed under the Samba 3.0 product in the project's Bugzilla
database (https://bugzilla.samba.org/).

======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================

================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA). The source code can be downloaded
from:

http://download.samba.org/samba/ftp/

The release notes are available online at:

http://www.samba.org/samba/ftp/history/samba-3.0.34.html

Binary packages will be made available on a volunteer basis from

http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

--Enjoy
The Samba Team

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAkl1i70ACgkQKGi9fisXk1HTwACeNiVEOAuvCIpQ7w3RnFYRQsbf
tH0AoJq4tRZlhAkVtkB5vfdU8dthPXnb
=ZAxF
-----END PGP SIGNATURE-----