[SCM] Samba Shared Repository - branch v4-8-test updated
Karolin Seeger
kseeger at samba.org
Thu Mar 1 20:17:01 UTC 2018
The branch, v4-8-test has been updated
via efaf354 VERSION: Bump version up to 4.8.0rc5...
via 562b385 VERSION: Disable GIT_SNAPSHOT for the 4.8.0rc4 release.
via 9d4ae41 WHATSNEW: Add changes since rc4.
via 0486f44 WHATSNEW: document changed wbinfo -m --verbose output
via c76d2e0 WHATSNEW: add 'Improved support for trusted domains (as AD DC)' section
via 608d1b81f WHATSNEW: reference 'smbclient reparse point symlink parameters reversed' to 'UPGRADING'
via 44685eb WHATSNEW: move descriptions of removed features to "REMOVED FEATURES"
from 4cfa1f5 s4:kdc: disable support for CROSS_ORGANIZATION domains
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-8-test
- Log -----------------------------------------------------------------
commit efaf354f9e4e793cee72a9ca773189d4957d9a41
Author: Karolin Seeger <kseeger at samba.org>
Date: Thu Mar 1 21:03:53 2018 +0100
VERSION: Bump version up to 4.8.0rc5...
and re-enable GIT_SNAPSHOT.
Signed-off-by: Karolin Seeger <kseeger at samba.org>
commit 562b385756409568c224098aa20b4bf808c3bafb
Author: Karolin Seeger <kseeger at samba.org>
Date: Thu Mar 1 21:02:59 2018 +0100
VERSION: Disable GIT_SNAPSHOT for the 4.8.0rc4 release.
Signed-off-by: Karolin Seeger <kseeger at samba.org>
commit 9d4ae41fc5052e8074b1f59139813e58ded137bc
Author: Karolin Seeger <kseeger at samba.org>
Date: Thu Mar 1 21:02:15 2018 +0100
WHATSNEW: Add changes since rc4.
Signed-off-by: Karolin Seeger <kseeger at samba.org>
commit 0486f44b76cbcaf3f843cb4d6e0d0003e87d6781
Author: Ralph Boehme <slow at samba.org>
Date: Thu Mar 1 12:10:56 2018 +0100
WHATSNEW: document changed wbinfo -m --verbose output
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
commit c76d2e06fd1e9d71cedcc297a6db0cffb71ee64c
Author: Stefan Metzmacher <metze at samba.org>
Date: Thu Mar 1 09:52:51 2018 +0100
WHATSNEW: add 'Improved support for trusted domains (as AD DC)' section
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
commit 608d1b81fa2b013c6e62807536190f4d14eb0911
Author: Stefan Metzmacher <metze at samba.org>
Date: Thu Mar 1 09:32:23 2018 +0100
WHATSNEW: reference 'smbclient reparse point symlink parameters reversed' to 'UPGRADING'
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
commit 44685eb99a1d700911d9ed5b23737d8f4e2edae9
Author: Stefan Metzmacher <metze at samba.org>
Date: Thu Mar 1 09:31:17 2018 +0100
WHATSNEW: move descriptions of removed features to "REMOVED FEATURES"
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
-----------------------------------------------------------------------
Summary of changes:
VERSION | 2 +-
WHATSNEW.txt | 195 +++++++++++++++++++++++++++++++++++++++++++++++++----------
2 files changed, 164 insertions(+), 33 deletions(-)
Changeset truncated at 500 lines:
diff --git a/VERSION b/VERSION
index 30de02c..8720a82 100644
--- a/VERSION
+++ b/VERSION
@@ -87,7 +87,7 @@ SAMBA_VERSION_PRE_RELEASE=
# e.g. SAMBA_VERSION_RC_RELEASE=1 #
# -> "3.0.0rc1" #
########################################################
-SAMBA_VERSION_RC_RELEASE=4
+SAMBA_VERSION_RC_RELEASE=5
########################################################
# To mark SVN snapshots this should be set to 'yes' #
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 357a8f6..5151564 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,7 +1,7 @@
Release Announcements
=====================
-This is the third release candidate of Samba 4.8. This is *not*
+This is the fourth release candidate of Samba 4.8. This is *not*
intended for production environments and is designed for testing
purposes only. Please report any defects via the Samba bug reporting
system at https://bugzilla.samba.org/.
@@ -22,6 +22,16 @@ Unlike in previous releases a transparent downgrade is not possible.
If you wish to downgrade such a DB to a Samba 4.7 or earlier version,
please run the source4/scripting/bin/sambaundoguididx script first.
+smbclient reparse point symlink parameters reversed
+---------------------------------------------------
+
+See the more detailed description below.
+
+Changed trusted domains listing with wbinfo -m --verbose
+--------------------------------------------------------
+
+See the more detailed description below.
+
NEW FEATURES/CHANGES
====================
@@ -133,37 +143,6 @@ dot or xdot, this shows the network as a graph with DCs as vertices
and connections edges. Certain types of degenerate edges are shown in
different colours or line-styles.
-NT4-style replication based net commands removed
-------------------------------------------------
-
-The following commands and sub-commands have been removed from the
-"net" utility:
-
-net rpc samdump
-net rpc vampire ldif
-
-Also, replicating from a real NT4 domain with "net rpc vampire" and
-"net rpc vampire keytab" has been removed.
-
-The NT4-based commands were accidentially broken in 2013, and nobody
-noticed the breakage. So instead of fixing them including tests (which
-would have meant writing a server for the protocols, which we don't
-have) we decided to remove them.
-
-For the same reason, the "samsync", "samdeltas" and "database_redo"
-commands have been removed from rpcclient.
-
-"net rpc vampire keytab" from Active Directory domains continues to be
-supported.
-
-vfs_aio_linux module removed
-----------------------------
-
-The current Linux kernel aio does not match what Samba would
-do. Shipping code that uses it leads people to false
-assumptions. Samba implements async I/O based on threads by default,
-there is no special module required to see benefits of read and write
-request being sent do the disk in parallel.
smbclient reparse point symlink parameters reversed
---------------------------------------------------
@@ -192,6 +171,74 @@ domains. Some pam_winbind setups may also require the global list.
If you have a setup that doesn't require the global list, you should set
"winbind scan trusted domains = no".
+Improved support for trusted domains (as AD DC)
+-----------------------------------------------
+
+The support for trusted domains/forests has improved a lot.
+
+External domain trusts, as well a transitive forest trusts,
+are supported in both directions (inbound and outbound)
+for Kerberos and NTLM authentication now.
+
+The LSA LookupNames and LookupSids implementations
+support resolving names and sids from trusts domains/forest
+now. This is important in order to allow Samba based
+domain members to make use of the trust.
+
+However there are currently still a few limitations:
+
+- It's not possible to add users/groups of a trusted domain
+ into domain groups. So group memberships are not expanded
+ on trust boundaries.
+ See https://bugzilla.samba.org/show_bug.cgi?id=13300
+- Both sides of the trust need to fully trust each other!
+- No SID filtering rules are applied at all!
+- This means DCs of domain A can grant domain admin rights
+ in domain B.
+- Selective (CROSS_ORIGANIZATION) authentication is
+ not supported. It's possible to create such a trust,
+ but the KDC and winbindd ignore them.
+
+Changed trusted domains listing with wbinfo -m --verbose
+--------------------------------------------------------
+
+The trust properties printed by wbinfo -m --verbose have been changed to
+correctly reflect the view of the system where wbinfo is executed.
+
+The trust type field in particular can show additional values that correctly
+reflect the type of the trust: "Local" for the local SAM and BUILTIN,
+"Workstation" for a workstation trust to the primary domain, "RWDC" for the SAM
+on a AD DC, "RODC" for the SAM on a read-only DC, "PDC" for the SAM on a
+NT4-style DC, "Forest" for a AD forest trust and "External" for quarantined,
+external or NT4-style trusts.
+
+Indirect trusts are shown as "Routed" including the routing domain.
+
+Example, on a AD DC (SDOM1):
+
+Domain Name DNS Domain Trust Type Transitive In Out
+BUILTIN Local
+SDOM1 sdom1.site RWDC
+WDOM3 wdom3.site Forest Yes No Yes
+WDOM2 wdom2.site Forest Yes Yes Yes
+SUBDOM31 subdom31.wdom3.site Routed (via WDOM3)
+SUBDOM21 subdom21.wdom2.site Routed (via WDOM2)
+
+Same setup, on a member of WDOM2:
+
+Domain Name DNS Domain Trust Type Transitive In Out
+BUILTIN Local
+TITAN Local
+WDOM2 wdom2.site Workstation Yes No Yes
+WDOM1 wdom1.site Routed (via WDOM2)
+WDOM3 wdom3.site Routed (via WDOM2)
+SUBDOM21 subdom21.wdom2.site Routed (via WDOM2)
+SDOM1 sdom1.site Routed (via WDOM2)
+SUBDOM11 subdom11.wdom1.site Routed (via WDOM2)
+
+The list of trusts may be incomplete and additional domains may appear as
+"Routed" if a user of an unknown domain is successfully authenticated.
+
VirusFilter VFS module
----------------------
@@ -202,6 +249,9 @@ software to provide scanning and filtering of files on a Samba share.
REMOVED FEATURES
================
+'net serverid' commands removed
+-------------------------------
+
The two commands 'net serverid list' and 'net serverid wipe' have been
removed, because the file serverid.tdb is not used anymore.
@@ -216,6 +266,38 @@ properly cleaned up after single node crashes. Nowadays smbd and
winbind take care of cleaning up the msg.lock and msg.sock directories
automatically.
+NT4-style replication based net commands removed
+------------------------------------------------
+
+The following commands and sub-commands have been removed from the
+"net" utility:
+
+net rpc samdump
+net rpc vampire ldif
+
+Also, replicating from a real NT4 domain with "net rpc vampire" and
+"net rpc vampire keytab" has been removed.
+
+The NT4-based commands were accidentally broken in 2013, and nobody
+noticed the breakage. So instead of fixing them including tests (which
+would have meant writing a server for the protocols, which we don't
+have) we decided to remove them.
+
+For the same reason, the "samsync", "samdeltas" and "database_redo"
+commands have been removed from rpcclient.
+
+"net rpc vampire keytab" from Active Directory domains continues to be
+supported.
+
+vfs_aio_linux module removed
+----------------------------
+
+The current Linux kernel aio does not match what Samba would
+do. Shipping code that uses it leads people to false
+assumptions. Samba implements async I/O based on threads by default,
+there is no special module required to see benefits of read and write
+request being sent do the disk in parallel.
+
smb.conf changes
================
@@ -243,6 +325,55 @@ smb.conf changes
winbind trusted domains only Removed
+CHANGES SINCE 4.8.0rc3
+======================
+
+o Ralph Boehme <slow at samba.org>
+ * BUG 13287: Fix numerous trust related bugs in winbindd and s4 LSA RPC
+ server.
+ * BUG 13296: vfs_fruit: Use off_t, not size_t for TM size calculations.
+
+o Alexander Bokovoy <ab at samba.org>
+ * BUG 13304: mit-kdb: Support MIT Kerberos 1.16 KDB API changes.
+
+o Günther Deschner <gd at samba.org>
+ * BUG 13277: build: Fix libceph-common detection.
+
+o Poornima G <pgurusid at redhat.com>
+ * BUG 13297: vfs_glusterfs: Fix the wrong pointer being sent in
+ glfs_fsync_async.
+
+o Volker Lendecke <vl at samba.org>
+ * BUG 13305: vfs_fileid: Fix the 32-bit build.
+
+o Stefan Metzmacher <metze at samba.org>
+ * BUG 13206: Unable to authenticate with an empty string domain ''.
+ * BUG 13276: configure aborts without libnettle/gnutls.
+ * BUG 13278: winbindd (on an AD DC) should only use netlogon/lsa against
+ trusted domains.
+ * BUG 13287: Fix numerous trust related bugs in winbindd and s4 LSA RPC
+ server.
+ * BUG 13290: A disconnecting winbind client can cause a problem in
+ the winbind parent child communication.
+ * BUG 13291: tevent: version 0.9.36.
+ * BUG 13292: winbind requests could get stuck in the queue of a busy child,
+ while later requests could get served fine by other children.
+ * BUG 13293: Minimize the lifetime of winbindd_cli_state->{pw,gr}ent_state.
+ * BUG 13294: Avoid using fstrcpy(domain->dcname,...) on a char *.
+ * BUG 13295: winbind parent should find the dc of a foreign domain via the
+ primary domain.
+ * BUG 13299: Disable support for CROSS_ORGANIZATION domains.
+ * BUG 13306: ldb: version 1.3.2.
+
+o Sachin Prabhu <sprabhu at redhat.com>
+ * BUG 13303: vfs_glusterfs: Add fallocate support for vfs_glusterfs.
+
+o Garming Sam <garming at catalyst.net.nz>
+ * BUG 13031: subnet: Avoid a segfault when renaming subnet objects.
+ * BUG 13269: RODC may skip objects during replication due to naming
+ conflicts.
+
+
CHANGES SINCE 4.8.0rc2
======================
--
Samba Shared Repository
More information about the samba-cvs
mailing list