The branch, v4-8-test has been updated via efaf354 VERSION: Bump version up to 4.8.0rc5... via 562b385 VERSION: Disable GIT_SNAPSHOT for the 4.8.0rc4 release. via 9d4ae41 WHATSNEW: Add changes since rc4. via 0486f44 WHATSNEW: document changed wbinfo -m --verbose output via c76d2e0 WHATSNEW: add 'Improved support for trusted domains (as AD DC)' section via 608d1b81f WHATSNEW: reference 'smbclient reparse point symlink parameters reversed' to 'UPGRADING' via 44685eb WHATSNEW: move descriptions of removed features to "REMOVED FEATURES" from 4cfa1f5 s4:kdc: disable support for CROSS_ORGANIZATION domains
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-8-test - Log ----------------------------------------------------------------- commit efaf354f9e4e793cee72a9ca773189d4957d9a41 Author: Karolin Seeger <ksee...@samba.org> Date: Thu Mar 1 21:03:53 2018 +0100 VERSION: Bump version up to 4.8.0rc5... and re-enable GIT_SNAPSHOT. Signed-off-by: Karolin Seeger <ksee...@samba.org> commit 562b385756409568c224098aa20b4bf808c3bafb Author: Karolin Seeger <ksee...@samba.org> Date: Thu Mar 1 21:02:59 2018 +0100 VERSION: Disable GIT_SNAPSHOT for the 4.8.0rc4 release. Signed-off-by: Karolin Seeger <ksee...@samba.org> commit 9d4ae41fc5052e8074b1f59139813e58ded137bc Author: Karolin Seeger <ksee...@samba.org> Date: Thu Mar 1 21:02:15 2018 +0100 WHATSNEW: Add changes since rc4. Signed-off-by: Karolin Seeger <ksee...@samba.org> commit 0486f44b76cbcaf3f843cb4d6e0d0003e87d6781 Author: Ralph Boehme <s...@samba.org> Date: Thu Mar 1 12:10:56 2018 +0100 WHATSNEW: document changed wbinfo -m --verbose output Signed-off-by: Ralph Boehme <s...@samba.org> Reviewed-by: Stefan Metzmacher <me...@samba.org> commit c76d2e06fd1e9d71cedcc297a6db0cffb71ee64c Author: Stefan Metzmacher <me...@samba.org> Date: Thu Mar 1 09:52:51 2018 +0100 WHATSNEW: add 'Improved support for trusted domains (as AD DC)' section Signed-off-by: Stefan Metzmacher <me...@samba.org> Reviewed-by: Ralph Boehme <s...@samba.org> Reviewed-by: Andreas Schneider <a...@samba.org> commit 608d1b81fa2b013c6e62807536190f4d14eb0911 Author: Stefan Metzmacher <me...@samba.org> Date: Thu Mar 1 09:32:23 2018 +0100 WHATSNEW: reference 'smbclient reparse point symlink parameters reversed' to 'UPGRADING' Signed-off-by: Stefan Metzmacher <me...@samba.org> Reviewed-by: Ralph Boehme <s...@samba.org> Reviewed-by: Andreas Schneider <a...@samba.org> commit 44685eb99a1d700911d9ed5b23737d8f4e2edae9 Author: Stefan Metzmacher <me...@samba.org> Date: Thu Mar 1 09:31:17 2018 +0100 WHATSNEW: move descriptions of removed features to "REMOVED FEATURES" Signed-off-by: Stefan Metzmacher <me...@samba.org> Reviewed-by: Ralph Boehme <s...@samba.org> Reviewed-by: Andreas Schneider <a...@samba.org> ----------------------------------------------------------------------- Summary of changes: VERSION | 2 +- WHATSNEW.txt | 195 +++++++++++++++++++++++++++++++++++++++++++++++++---------- 2 files changed, 164 insertions(+), 33 deletions(-) Changeset truncated at 500 lines: diff --git a/VERSION b/VERSION index 30de02c..8720a82 100644 --- a/VERSION +++ b/VERSION @@ -87,7 +87,7 @@ SAMBA_VERSION_PRE_RELEASE= # e.g. SAMBA_VERSION_RC_RELEASE=1 # # -> "3.0.0rc1" # ######################################################## -SAMBA_VERSION_RC_RELEASE=4 +SAMBA_VERSION_RC_RELEASE=5 ######################################################## # To mark SVN snapshots this should be set to 'yes' # diff --git a/WHATSNEW.txt b/WHATSNEW.txt index 357a8f6..5151564 100644 --- a/WHATSNEW.txt +++ b/WHATSNEW.txt @@ -1,7 +1,7 @@ Release Announcements ===================== -This is the third release candidate of Samba 4.8. This is *not* +This is the fourth release candidate of Samba 4.8. This is *not* intended for production environments and is designed for testing purposes only. Please report any defects via the Samba bug reporting system at https://bugzilla.samba.org/. @@ -22,6 +22,16 @@ Unlike in previous releases a transparent downgrade is not possible. If you wish to downgrade such a DB to a Samba 4.7 or earlier version, please run the source4/scripting/bin/sambaundoguididx script first. +smbclient reparse point symlink parameters reversed +--------------------------------------------------- + +See the more detailed description below. + +Changed trusted domains listing with wbinfo -m --verbose +-------------------------------------------------------- + +See the more detailed description below. + NEW FEATURES/CHANGES ==================== @@ -133,37 +143,6 @@ dot or xdot, this shows the network as a graph with DCs as vertices and connections edges. Certain types of degenerate edges are shown in different colours or line-styles. -NT4-style replication based net commands removed ------------------------------------------------- - -The following commands and sub-commands have been removed from the -"net" utility: - -net rpc samdump -net rpc vampire ldif - -Also, replicating from a real NT4 domain with "net rpc vampire" and -"net rpc vampire keytab" has been removed. - -The NT4-based commands were accidentially broken in 2013, and nobody -noticed the breakage. So instead of fixing them including tests (which -would have meant writing a server for the protocols, which we don't -have) we decided to remove them. - -For the same reason, the "samsync", "samdeltas" and "database_redo" -commands have been removed from rpcclient. - -"net rpc vampire keytab" from Active Directory domains continues to be -supported. - -vfs_aio_linux module removed ----------------------------- - -The current Linux kernel aio does not match what Samba would -do. Shipping code that uses it leads people to false -assumptions. Samba implements async I/O based on threads by default, -there is no special module required to see benefits of read and write -request being sent do the disk in parallel. smbclient reparse point symlink parameters reversed --------------------------------------------------- @@ -192,6 +171,74 @@ domains. Some pam_winbind setups may also require the global list. If you have a setup that doesn't require the global list, you should set "winbind scan trusted domains = no". +Improved support for trusted domains (as AD DC) +----------------------------------------------- + +The support for trusted domains/forests has improved a lot. + +External domain trusts, as well a transitive forest trusts, +are supported in both directions (inbound and outbound) +for Kerberos and NTLM authentication now. + +The LSA LookupNames and LookupSids implementations +support resolving names and sids from trusts domains/forest +now. This is important in order to allow Samba based +domain members to make use of the trust. + +However there are currently still a few limitations: + +- It's not possible to add users/groups of a trusted domain + into domain groups. So group memberships are not expanded + on trust boundaries. + See https://bugzilla.samba.org/show_bug.cgi?id=13300 +- Both sides of the trust need to fully trust each other! +- No SID filtering rules are applied at all! +- This means DCs of domain A can grant domain admin rights + in domain B. +- Selective (CROSS_ORIGANIZATION) authentication is + not supported. It's possible to create such a trust, + but the KDC and winbindd ignore them. + +Changed trusted domains listing with wbinfo -m --verbose +-------------------------------------------------------- + +The trust properties printed by wbinfo -m --verbose have been changed to +correctly reflect the view of the system where wbinfo is executed. + +The trust type field in particular can show additional values that correctly +reflect the type of the trust: "Local" for the local SAM and BUILTIN, +"Workstation" for a workstation trust to the primary domain, "RWDC" for the SAM +on a AD DC, "RODC" for the SAM on a read-only DC, "PDC" for the SAM on a +NT4-style DC, "Forest" for a AD forest trust and "External" for quarantined, +external or NT4-style trusts. + +Indirect trusts are shown as "Routed" including the routing domain. + +Example, on a AD DC (SDOM1): + +Domain Name DNS Domain Trust Type Transitive In Out +BUILTIN Local +SDOM1 sdom1.site RWDC +WDOM3 wdom3.site Forest Yes No Yes +WDOM2 wdom2.site Forest Yes Yes Yes +SUBDOM31 subdom31.wdom3.site Routed (via WDOM3) +SUBDOM21 subdom21.wdom2.site Routed (via WDOM2) + +Same setup, on a member of WDOM2: + +Domain Name DNS Domain Trust Type Transitive In Out +BUILTIN Local +TITAN Local +WDOM2 wdom2.site Workstation Yes No Yes +WDOM1 wdom1.site Routed (via WDOM2) +WDOM3 wdom3.site Routed (via WDOM2) +SUBDOM21 subdom21.wdom2.site Routed (via WDOM2) +SDOM1 sdom1.site Routed (via WDOM2) +SUBDOM11 subdom11.wdom1.site Routed (via WDOM2) + +The list of trusts may be incomplete and additional domains may appear as +"Routed" if a user of an unknown domain is successfully authenticated. + VirusFilter VFS module ---------------------- @@ -202,6 +249,9 @@ software to provide scanning and filtering of files on a Samba share. REMOVED FEATURES ================ +'net serverid' commands removed +------------------------------- + The two commands 'net serverid list' and 'net serverid wipe' have been removed, because the file serverid.tdb is not used anymore. @@ -216,6 +266,38 @@ properly cleaned up after single node crashes. Nowadays smbd and winbind take care of cleaning up the msg.lock and msg.sock directories automatically. +NT4-style replication based net commands removed +------------------------------------------------ + +The following commands and sub-commands have been removed from the +"net" utility: + +net rpc samdump +net rpc vampire ldif + +Also, replicating from a real NT4 domain with "net rpc vampire" and +"net rpc vampire keytab" has been removed. + +The NT4-based commands were accidentally broken in 2013, and nobody +noticed the breakage. So instead of fixing them including tests (which +would have meant writing a server for the protocols, which we don't +have) we decided to remove them. + +For the same reason, the "samsync", "samdeltas" and "database_redo" +commands have been removed from rpcclient. + +"net rpc vampire keytab" from Active Directory domains continues to be +supported. + +vfs_aio_linux module removed +---------------------------- + +The current Linux kernel aio does not match what Samba would +do. Shipping code that uses it leads people to false +assumptions. Samba implements async I/O based on threads by default, +there is no special module required to see benefits of read and write +request being sent do the disk in parallel. + smb.conf changes ================ @@ -243,6 +325,55 @@ smb.conf changes winbind trusted domains only Removed +CHANGES SINCE 4.8.0rc3 +====================== + +o Ralph Boehme <s...@samba.org> + * BUG 13287: Fix numerous trust related bugs in winbindd and s4 LSA RPC + server. + * BUG 13296: vfs_fruit: Use off_t, not size_t for TM size calculations. + +o Alexander Bokovoy <a...@samba.org> + * BUG 13304: mit-kdb: Support MIT Kerberos 1.16 KDB API changes. + +o Günther Deschner <g...@samba.org> + * BUG 13277: build: Fix libceph-common detection. + +o Poornima G <pguru...@redhat.com> + * BUG 13297: vfs_glusterfs: Fix the wrong pointer being sent in + glfs_fsync_async. + +o Volker Lendecke <v...@samba.org> + * BUG 13305: vfs_fileid: Fix the 32-bit build. + +o Stefan Metzmacher <me...@samba.org> + * BUG 13206: Unable to authenticate with an empty string domain ''. + * BUG 13276: configure aborts without libnettle/gnutls. + * BUG 13278: winbindd (on an AD DC) should only use netlogon/lsa against + trusted domains. + * BUG 13287: Fix numerous trust related bugs in winbindd and s4 LSA RPC + server. + * BUG 13290: A disconnecting winbind client can cause a problem in + the winbind parent child communication. + * BUG 13291: tevent: version 0.9.36. + * BUG 13292: winbind requests could get stuck in the queue of a busy child, + while later requests could get served fine by other children. + * BUG 13293: Minimize the lifetime of winbindd_cli_state->{pw,gr}ent_state. + * BUG 13294: Avoid using fstrcpy(domain->dcname,...) on a char *. + * BUG 13295: winbind parent should find the dc of a foreign domain via the + primary domain. + * BUG 13299: Disable support for CROSS_ORGANIZATION domains. + * BUG 13306: ldb: version 1.3.2. + +o Sachin Prabhu <spra...@redhat.com> + * BUG 13303: vfs_glusterfs: Add fallocate support for vfs_glusterfs. + +o Garming Sam <garm...@catalyst.net.nz> + * BUG 13031: subnet: Avoid a segfault when renaming subnet objects. + * BUG 13269: RODC may skip objects during replication due to naming + conflicts. + + CHANGES SINCE 4.8.0rc2 ====================== -- Samba Shared Repository