[SCM] Samba Shared Repository - branch master updated
Stefan Metzmacher
metze at samba.org
Sat Sep 20 03:38:04 MDT 2014
The branch, master has been updated
via 3360f9a WHATSNEW: mention overhauled "net idmap" command
via 6efb366 WHATSNEW: Improved DCERPC man in the middle detection
via e28b087 WHATSNEW: Larger IO sizes for SMB2/3 per default
via fc70caa WHATSNEW: Winbindd/Netlogon improvements
from 277f041 passdb: Use talloc_zero_array
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 3360f9ac33e7025811c00f3d7cb04cb9e4d81ec4
Author: Michael Adam <obnox at samba.org>
Date: Sat Sep 20 01:53:28 2014 +0200
WHATSNEW: mention overhauled "net idmap" command
Signed-off-by: Michael Adam <obnox at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
Autobuild-User(master): Stefan Metzmacher <metze at samba.org>
Autobuild-Date(master): Sat Sep 20 11:37:51 CEST 2014 on sn-devel-104
commit 6efb366796a4e0e1a327ddf552fa663d858aecdb
Author: Stefan Metzmacher <metze at samba.org>
Date: Sat Sep 20 01:29:19 2014 +0200
WHATSNEW: Improved DCERPC man in the middle detection
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Michael Adam <obnox at samba.org>
commit e28b087fb94f282bb930aac557e6e36481c1a26f
Author: Stefan Metzmacher <metze at samba.org>
Date: Sat Sep 20 01:18:53 2014 +0200
WHATSNEW: Larger IO sizes for SMB2/3 per default
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Michael Adam <obnox at samba.org>
commit fc70caaf186d51c58d9699e4dc11f6645baad156
Author: Stefan Metzmacher <metze at samba.org>
Date: Sat Sep 20 01:14:11 2014 +0200
WHATSNEW: Winbindd/Netlogon improvements
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Michael Adam <obnox at samba.org>
-----------------------------------------------------------------------
Summary of changes:
WHATSNEW.txt | 72 +++++++++++++++++++++++++++++++++++++++++++++++++++++++--
1 files changed, 69 insertions(+), 3 deletions(-)
Changeset truncated at 500 lines:
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 617dca1..e9a5627 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -12,6 +12,7 @@ Samba 4.2 will be the next version of the Samba suite.
UPGRADING
=========
+Read the "Winbindd/Netlogon improvements" section (below) carefully!
NEW FEATURES
@@ -35,6 +36,65 @@ Snapper for use by Samba. This provides the ability for remote
clients to access shadow-copies via Windows Explorer using the
"previous versions" dialog.
+Winbindd/Netlogon improvements
+==============================
+
+The whole concept of maintaining the netlogon secure channel
+to (other) domain controllers is rewritten in order to maintain
+global state in a netlogon_creds_cli.tdb. This is the proper fix
+for a large number of bugs:
+
+ https://bugzilla.samba.org/show_bug.cgi?id=6563
+ https://bugzilla.samba.org/show_bug.cgi?id=7944
+ https://bugzilla.samba.org/show_bug.cgi?id=7945
+ https://bugzilla.samba.org/show_bug.cgi?id=7568
+ https://bugzilla.samba.org/show_bug.cgi?id=8599
+
+In addition a strong session key is required by default now,
+which means that communication to older servers or clients
+might be rejected by default.
+
+For the client side we the following new options:
+"require strong key" (yes by default), "reject md5 servers" (no by default).
+E.g. for Samba 3.0.37 you need "require strong key = no" and
+for NT4 DCs you need "require strong key = no" and "client NTLMv2 auth = no",
+
+On the server side (as domain controller) we have the following new options:
+"allow nt4 crypto" (no by default), "reject md5 client" (no by default).
+E.g. in order to allow Samba < 3.0.27 or NT4 members to work
+you need "allow nt4 crypto = yes"
+
+winbindd does not list group memberships for display purposes
+(e.g. getent group <domain\<group>) anymore by default.
+The new default is "winbind expand groups = 0" now,
+the reason for this is the same as for "winbind enum users = no"
+and "winbind enum groups = no". Providing this information is not always
+reliably possible, e.g. if there're trusted domains.
+
+Please consult the smb.conf manpage for more details of this new options.
+
+Larger IO sizes for SMB2/3 by default
+=====================================
+
+The default values for "smb2 max read", "smb2 max write" and "smb2 max trans"
+have been changed to 8388608 (8MiB) in order to match the default of
+Windows 2012R2.
+
+Improved DCERPC man in the middle detection
+===========================================
+
+The DCERPC header signing has been implemented
+in addition to the dcerpc_sec_verification_trailer
+protection.
+
+Overhauled "net idmap" command
+==============================
+
+The command line interface of the "net idmap" command has been
+systematized and subcommands for reading and writing the autorid idmap
+database have been added. Note that the writing commands should be
+used with great care. See the net(8) manual page for details.
+
######################################################################
Changes
@@ -46,9 +106,15 @@ smb.conf changes
Parameter Name Description Default
-------------- ----------- -------
-
-
-
+ allow nt4 crypto New no
+ neutralize nt4 emulation New no
+ reject md5 client New no
+ reject md5 servers New no
+ require strong key New yes
+ smb2 max read Changed default 8388608
+ smb2 max write Changed default 8388608
+ smb2 max trans Changed default 8388608
+ winbind expand groups Changed default 0
KNOWN ISSUES
============
--
Samba Shared Repository
More information about the samba-cvs
mailing list