[SCM] Samba Shared Repository - branch master updated

Karolin Seeger kseeger at samba.org
Tue Jul 9 10:05:15 UTC 2019

The branch, master has been updated
       via  36f021f74d9 WHATSNEW: Start release notes for Samba 4.12.0pre1.
      from  9cb028d6d16 VERSION: Bump version up to 4.12.0.


- Log -----------------------------------------------------------------
commit 36f021f74d9739a9c73b95fc7d6f821bbf7cafdd
Author: Karolin Seeger <kseeger at samba.org>
Date:   Tue Jul 9 12:04:27 2019 +0200

    WHATSNEW: Start release notes for Samba 4.12.0pre1.
    Signed-off-by: Karolin Seeger <kseeger at samba.org>


Summary of changes:
 WHATSNEW.txt | 286 +----------------------------------------------------------
 1 file changed, 3 insertions(+), 283 deletions(-)

Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index c0d13d20d6b..510ee2c89db 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,297 +1,25 @@
 Release Announcements
-This is the first preview release of Samba 4.11.  This is *not*
+This is the first preview release of Samba 4.12.  This is *not*
 intended for production environments and is designed for testing
 purposes only.  Please report any defects via the Samba bug reporting
 system at https://bugzilla.samba.org/.
-Samba 4.11 will be the next version of the Samba suite.
+Samba 4.12 will be the next version of the Samba suite.
-SMB1 is disabled by default
-The defaults of 'client min protocol' and 'server min protocol'
-have been changed to SMB2_02.
-This means clients without support for SMB2 or SMB3 are no longer
-able to connect to smbd (by default).
-It also means client tools like smbclient and other,
-as well as applications making use of libsmbclient are no longer
-able to connect to servers without SMB2 or SMB3 support (by default).
-It's still possible to allow SMB1 dialects, e.g. NT1, LANMAN2
-and LANMAN1 for client and server, as well as CORE and COREPLUS on
-the client.
-Note that most commandline tools e.g. smbclient, smbcacls and others
-also support the --option argument to overwrite smb.conf options,
-e.g. --option='client min protocol=NT1' might be useful.
-As Microsoft no longer installs SMB1 support in recent releases
-or uninstalls it after 30 days without usage, the Samba Team
-tries to get remove the SMB1 usage as much as possible.
-SMB1 is officially deprecated and might be removed step by step
-in the following years. If you have a strong requirement for SMB1
-(except for supporting old Linux Kernels), please file a bug
-at https://bugzilla.samba.org and let us know about the details.
-Default samba process model
-The default for the --model argument passed to the samba executable has changed
-from 'standard' to 'prefork'. This means a difference in the number of samba
-child processes that are created to handle client connections. The previous
-default would create a separate process for every LDAP or NETLOGON client
-connection. For a network with a lot of persistent client connections, this
-could result in significant memory overhead.  Now, with the new default of
-'prefork', the LDAP, NETLOGON, and KDC services will create a fixed number of
-worker processes at startup and share the client connections amongst these
-workers. The number of worker processes can be configured by the 'prefork
-children' setting in the smb.conf (the default is 4).
-Authentication Logging.
-Winbind now logs PAM_AUTH and NTLM_AUTH events, a new attribute "logonId" has
-been added to the Authentication JSON log messages.  This contains a random
-logon id that is generated for each PAM_AUTH and NTLM_AUTH request and is passed
-to SamLogon, linking the windbind and SamLogon requests.
-The serviceDescription of the messages is set to "winbind", the authDescription
-is set to one of:
-   "PASSDB, <command>, <pid>"
-   "PAM_AUTH, <command>, <pid>"
-   "NTLM_AUTH, <command>, <pid>"
-   <command> is the name of the command makinmg the winbind request i.e. wbinfo
-   <pid>     is the process id of the requesting process.
-The version of the JSON Authentication messages has been changed to 1.2 from 1.1
-LDAP referrals
-The scheme of returned LDAP referrals now reflects the scheme of the original
-request, i.e. referrals received via ldap are prefixed with "ldap://"
-and those over ldaps are prefixed with "ldaps://"
-Previously all referrals were prefixed with "ldap://"
-Bind9 logging
-It is now possible to log the duration of DNS operations performed by Bind9
-This should aid future diagnosis of performance issues, and could be used to
-monitor DNS performance. The logging is enabled by setting log level to
-"dns:10" in smb.conf
-The logs are currently Human readable text only, i.e. no JSON formatted output.
-Log lines are of the form:
-    <function>: DNS timing: result: [<result>] duration: (<duration>)
-    zone: [<zone>] name: [<name>] data: [<data>]
-    durations are in microseconds.
-Default schema updated to 2012_R2
-Default AD schema changed from 2008_R2 to 2012_R2.  2012_R2 functional level
-is not yet available.  Older schemas can be used by provisioning with the
-'--base-schema' argument.  Existing installations can be updated with the
-samba-tool command "domain schemaupgrade".
-Samba's replication code has also been improved to handle replication
-with the 2012 schema (the core of this replication fix has also been
-backported to 4.9.11 and will be in a 4.10.x release).
-GnuTLS 3.2 required
-Samba is making efforts to remove in-tree cryptographic functionality,
-and to instead rely on externally maintained libraries.  To this end,
-Samba has chosen GnuTLS as our standard cryptographic provider.
-Samba now requires GnuTLS 3.2 to be installed (including development
-headers at build time) for all configurations, not just the Samba AD
-NOTE WELL: The use of GnuTLS means that Samba will honour the
-system-wide 'FIPS mode' (a reference to the US FIPS-140 cryptographic
-standard) and so will not operate in many still common situations if
-this system-wide parameter is in effect, as many of our protocols rely
-on outdated cryptography.
-A future Samba version will mitigate this to some extent where good
-cryptography effectively wraps bad cryptography, but for now that above
-samba-tool improvements
-A new "samba-tool contact" command has been added to allow the
-command-line manipulation of contacts, as used for address book
-lookups in LDAP.
-The "samba-tool [user|group|computer|group|contact] edit" command has been
-improved to operate more pleasantly on international character sets.
-100,000 USER and LARGER Samba AD DOMAINS
-Extensive efforts have been made to optimise Samba for use in
-organisations (for example) targeting 100,000 users, plus 120,000
-computer objects, as well as large number of group memberships.
-Many of the specific efforts are detailed below, but the net results
-is to remove barriers to significantly larger Samba deployments
-compared to previous releases.
-Reindex performance improvements
-The performance of samba-tool dbcheck --reindex has been improved,
-especially for large domains.
-join performance improvements
-The performance of samba-tool domain join has been improved,
-especially for large domains.
-LDAP Server memory improvements
-The LDAP server has improved memory efficiency, ensuring that large
-LDAP responses (for example a search for all objects) is not copied
-multiple times into memory.
-Setting lmdb map size
-It is now possible to set the lmdb map size (The maximum permitted
-size for the database).  "samba-tool" now accepts the
-"--backend-store-size" i.e. --backend-store-size=4Gb.  If not
-specified it defaults to 8Gb.
-This option is avaiable for the following sub commands:
- * domain provision
- * domain join
- * domain dcpromo
- * drs clone-dc-database
-LDB "batch_mode"
-To improve performance during batch operations i.e. joins, ldb now
-accepts a "batch_mode" option.  However to prevent any index or
-database inconsistencies if an operation fails, the entire transaction
-will be aborted at commit.
-New LDB pack format
-On first use (startup of 'samba' or the first transaction write)
-Samba's sam.ldb will be updated to a new more efficient pack format.
-This will take a few moments.
-New LDB <= and >= index mode to improve replication performance
-As well as a new pack format, Samba's sam.ldb uses a new index format
-allowing Samba to efficiently select objects changed since the last
-replication cycle.  This in turn improves performance during
-replication of large domains.
-Improvements to ldb search performance
-Search performance on large LDB databases has been improved by
-reducing memory allocations made on each object.
-Improvements to subtree rename performance
-Improvements have been made to Samba's handling of subtree renames,
-for example of containers and organisational units, however large
-renames are still not recommended.
-CTDB changes
-* nfs-linux-kernel-callout now defaults to using systemd service names
-  The Red Hat service names continue to be the default.
-  Other distributions should patch this file when packaging it.
-* The onnode -o option has been removed
-* ctdbd logs when it is using more than 90% of a CPU thread
-  ctdbd is single threaded, so can become saturated if it uses the
-  full capacity of a CPU thread.  To help detect this situation, ctdbd
-  now logs messages when CPU utilisation exceeds 90%.  Each change in
-  CPU utilisation over 90% is logged.  A message is also logged when
-  CPU utilisation drops below the 90% threshold.
-* Script configuration variable CTDB_MONITOR_SWAP_USAGE has been removed
-  05.system.script now monitors total memory (i.e. physical memory +
-  swap) utilisation using the existing CTDB_MONITOR_MEMORY_USAGE
-  script configuration variable.
-Web server
-As a leftover from work related to the Samba Web Administration Tool (SWAT),
-Samba still supported a Python WSGI web server (which could still be turned on
-from the 'server services' smb.conf parameter). This service was unused and has
-now been removed from Samba.
-samba-tool join subdomain
-The subdomain role has been removed from the join command.  This option did
-not work and has no tests.
-Python2 support
-Samba 4.11 will not have any runtime support for Python 2.
-If you are building Samba using the '--disable-python' option
-(i.e. you're excluding all the run-time Python support), then this
-will continue to work on a system that supports either python2 or
-To build Samba with python2 you *must* set the 'PYTHON' environment
-variable for both the 'configure' and 'make' steps, i.e.
-   'PYTHON=python2 ./configure'
-   'PYTHON=python2 make'
-This will override the python3 default.
-Except for this specific build-time use of python2, Samba now requires
-Python 3.4 as a minimum.
 smb.conf changes
@@ -299,19 +27,11 @@ smb.conf changes
   Parameter Name                     Description                Default
   --------------                     -----------                -------
-  allocation roundup size            Default changed/           0
-                                     Deprecated
-  client min protocol                Changed default            SMB2_02
-  server min protocol                Changed default            SMB2_02
-  mangled names                      Changed default            illegal
-  web port                           Removed
-  fruit:zero_file_id                 Changed default            False

Samba Shared Repository

More information about the samba-cvs mailing list