[SCM] Samba Shared Repository - branch master updated

[Stefan Metzmacher]

The branch, master has been updated
       via  7ea7ba6 WHATSNEW: fix indentation
       via  aacd55d WHATSNEW: Update changed parameters.
       via  8def6b5 WHATSNEW: Update changed parameters.
       via  08401ff WHATSNEW: Add information on changed security defaults.
      from  706d479 .gitignore: cleanup old stuff

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 7ea7ba64e1520af336b28c1e5f39233f9f7c526e
Author: Stefan Metzmacher <metze at samba.org>
Date:   Mon Dec 27 16:55:31 2010 +0100

    WHATSNEW: fix indentation
    
    metze
    
    Autobuild-User: Stefan Metzmacher <metze at samba.org>
    Autobuild-Date: Mon Dec 27 17:50:05 CET 2010 on sn-devel-104

commit aacd55da938e68933091d4a48c7e68ed2d88df9e
Author: Karolin Seeger <kseeger at samba.org>
Date:   Sun Dec 26 23:16:54 2010 +0100

    WHATSNEW: Update changed parameters.
    
    Karolin
    (cherry picked from commit 6148d5eb84d0a15442d689e0265e1172096e9110)

commit 8def6b5d3f2f6c555b84daff8bf547683eb6394b
Author: Karolin Seeger <kseeger at samba.org>
Date:   Sun Dec 26 23:06:09 2010 +0100

    WHATSNEW: Update changed parameters.
    
    Karolin
    (cherry picked from commit 23341ca37e165ed3fa615030b87d8d65ea166970)

commit 08401ffd3e679e16bcf85c4e30b3efdedc40a1aa
Author: Karolin Seeger <kseeger at samba.org>
Date:   Fri Dec 17 20:39:57 2010 +0100

    WHATSNEW: Add information on changed security defaults.
    
    Thanks to Andrew Bartlett for providing this text!
    (cherry picked from commit 2e867d9db26865012c8a210331c0f0541024f57f)

-----------------------------------------------------------------------

Summary of changes:
 WHATSNEW.txt |   51 +++++++++++++++++++++++++++++++++++++++++++++++----
 1 files changed, 47 insertions(+), 4 deletions(-)


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 63f35e4..9c44e75 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,6 +1,6 @@
                    =================================
                    Release Notes for Samba 3.6.0pre1
-                   July 28, 2010
+                             July 28, 2010
                    =================================
 
 
@@ -13,6 +13,40 @@ system at https://bugzilla.samba.org/.
 Major enhancements in Samba 3.6.0 include:
 
 
+Changed security defaults
+-------------------------
+
+Samba 3.6 has adopted a number of improved security defaults that will
+impact on existing users of Samba.
+
+ client ntlmv2 auth = yes
+ client use spnego principal = no
+ send spnego principal = no
+
+The impact of 'client ntlmv2 auth = yes' is that by default we will not
+use NTLM authentication as a client.  This applies to the Samba client
+tools such as smbclient and winbind, but does not change the separately
+released in-kernel CIFS client.  To re-enable the poorer NTLM encryption
+set '--option=clientusentlmv2auth=no' on your smbclient command line, or
+set 'client ntlmv2 auth = no' in your smb.conf
+
+The impact of 'client use spnego principal = no' is that we may be able
+to use Kerberos to communicate with a server less often in smbclient,
+winbind and other Samba client tools.  We may fall back to NTLMSSP in
+more situations where we would previously rely on the insecure
+indication from the 'NegProt' CIFS packet.  This mostly occursed when
+connecting to a name alias not recorded as a servicePrincipalName for
+the server.  This indication is not available from Windows 2008 or later
+in any case, and is not used by modern Windows clients, so this makes
+Samba's behaviour consistent with other clients and against all servers.
+
+The impact of 'send spnego principal = no' is to match Windows 2008 and
+not to send this principal, making existing clients give more consistent
+behaviour (more likely to fall back to NTLMSSP) between Samba and
+Windows 2008, and between Windows versions that did and no longer use
+this insecure hint.
+
+
 SMB2 support
 ------------
 
@@ -103,13 +137,22 @@ smb.conf changes
    Parameter Name                      Description     Default
    --------------                      -----------     -------
 
-   log writeable files on exit	       New	       No
+   async smb echo handler	       New	       No
+   client ntlmv2 auth		       Changed Default Yes
+   client use spnego principal	       New	       No
    ctdb locktime warn threshold	       New	       0
+   idmap read only		       New	       No
+   log writeable files on exit	       New	       No
+   multicast dns register	       New	       Yes
+   ncalrpc dir			       New
+   send spnego principal	       New	       No
+   smb2 max credits		       New	       128
    smb2 max read		       New	       1048576
-   smb2 max write		       New	       1048576
    smb2 max trans		       New	       1048576
+   smb2 max write		       New	       1048576
+   strict allocate		       Changed Default Yes
    username map cache time	       New	       0
-   async smb echo handler	       New	       No
+   winbind max clients		       New	       200
 
 
 ######################################################################


-- 
Samba Shared Repository