[Samba] [Announce] Samba 3.3.0 Available for Download

Karolin Seeger kseeger at samba.org
Tue Jan 27 11:50:27 GMT 2009 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================================
			"After all, computers crash, people die,
			 relationships fall apart. The best we
			 can do is breath and reboot."

			 Sarah Jessica Parker
================================================================

Release Announcements
=====================

This is the first stable release of Samba 3.3.0.

Major enhancements in Samba 3.3.0 include:

 General changes:
 o The passdb tdbsam version has been raised.

 Configuration/installation:
 o Splitting of library directory into library directory and separate
   modules directory.
 o The default value of "ldap ssl" has been changed to "start tls".

 File Serving:
 o Extended Cluster support.
 o New experimental VFS modules "vfs_acl_xattr" and "vfs_acl_tdb"
   to store NTFS ACLs on Samba file servers.

 Winbind:
 o Simplified idmap configuration.
 o New idmap backends "adex" and "hash".
 o Added new parameter "winbind reconnect delay".
 o Added support for user and group aliasing.
 o Added support for multiple domains to idmap_ad.

 Administrative tools:
 o The destination "all" of smbcontrol does now affect all running
   daemons including nmbd and winbindd.
 o New 'net rpc vampire keytab' and 'net rpc vampire ldif' commands.
 o The 'net' utility can now use kerberos for joining and authentication.
 o The 'wbinfo' utility can now add, modify and remove identity mapping entries.

 Libraries:
 o NetApi library implements various new calls for User- and Group
   Account Management.
 o libsmbclient does now determine case sensitivity based on file system
   attributes.


General changes
===============

The passdb tdbsam version has been raised as among other things the RID counter
has been moved from the winbindd_idmap.tdb to the passdb.tdb file to make
"passdb backend = tdbsam" working in clustered environments.

Please note that an updated passdb.tdb file is _not_ compatible with Samba
versions before 3.3.0! Please backup your passdb.tdb file if
you use "passdb backend = tdbsam". That can be achieved by running

'tdbbackup /etc/samba/passdb.tdb'

before the update.


Configure changes
=================

The configure option "--with-libdir" has been removed. The library
directory can still be specified by using the existing "--libdir" option.
A new option "--with-modulesdir" has been added to allow the specification
of a separate directory for the shared modules.


Configuration changes
=====================

The default value of "ldap ssl" has been changed to "start tls". This means,
Samba will use the LDAPv3 StartTLS extended operation (RFC2830) for
communicating with directory servers by default. If your directory servers
do not support this extended operation, you will have to set
"ldap ssl = no". Otherwise, Samba could not contact the directory servers
anymore!


Winbind idmap backend changes
=============================

The idmap configuration has changed with version 3.3 to something that
allows a smoother upgrade path from pre-3.0.25 configurations that use
"idmap backend". The reason for this change is that to many, also to Samba
developers, the 3.0.25 style configuration with "idmap config" turned out
to be very complex. Version 3.3 no longer deprecates the "idmap backend"
parameter, instead with "idmap backend" the default idmap backend is
specified.

Accordingly, the "idmap config <domain> : default = yes" setting is no
longer being looked at.

The alloc backend defaults to the default backend, which should be able to
allocate IDs. In the default distribution the tdb and ldap backends can
allocate, the ad and rid backends can not. The idmap alloc range is now
being set with the "old" parameters "idmap uid" and "idmap gid".

The "idmap domains" parameter has been removed.


winbind reconnect delay
=======================

This is a new parameter which specifies the number of seconds the Winbind
daemon will wait between attempts to contact a Domain controller for a domain
that is determined to be down or not contactable.


Winbind's Name Aliasing
=======================

Name aliasing in Winbind is a feature that allows an administrator to
map a fully qualified user or group name from a Windows domain to a
convenient short name for Unix access.  This is similar to the username
map functionality supported by smbd but is primary intended for
clients and servers making use of Winbind's PAM and NSS libraries.

For example, the user "DOMAIN\fred" has been mapped to the Unix name
"freddie".

   $ getent passwd "DOMAIN\fred"
   freddie:x:1000:1001:Fred Jones:/home/freddie:/bin/bash

   $ getent passwd freddie
   freddie:x:1000:1001:Fred Jones:/home/freddie:/bin/bash

The name aliasing support is provided by individual nss_info plugins.
For example, the new "adex" plugin reads the uid attribute from Active
Directory to make a short login name to the fully qualified name.
While the new "hash" module utilizes a local file to map "short_name
= QUALIFIED\name".  Both user and group name mapping is supported.
Please refer to the "winbind nss info" option in smb.conf(5) and
to individual plugin man pages for further details.


idmap_hash
==========

The idmap_hash plugin provides similar support as the idmap_rid
module.  However, uids and gids are generated from the full domain
SID using a hashing algorithm that maps the lower 19 bits from the user
or group RID to bits 0 - 19 in the Unix id and hashes 96 bits from
the domain SID to bits 20 - 30 in the Unix id.  The result is a 31 bit
uid or gid that is consistent across machines and provides support for
trusted domains.

Please refer to the idmap_hash(8) man page for more details.


idmap_adex
==========

The adex idmap/nss_info plugin is an adaptation of the Likewise
Enterprise plugin with support for OU based cells removed
(since the Windows pieces to manage the cells are not available).

This plugin supports

      * The RFC2307 schema for users and groups.
      * Connections to trusted domains
      * Global catalog searches
      * Cross forest trusts
      * User and group aliases

Prerequisite: Add the following attributes to the Partial Attribute
Set in global catalog:

      * uidNumber
      * uid
      * gidNumber

A basic config using the current trunk code would look like:

[global]
	idmap backend = adex
	idmap uid = 10000 - 29999
	idmap gid = 10000 - 29999
	winbind nss info = adex

	winbind normalize names = yes
	winbind refresh tickets = yes
	template homedir = /home/%D/%U
	template shell = /bin/bash

Please refer to the idmap_adex(8) man page for more details.


Libraries
=========

libsmbclient will now treat file names case-sensitive by default if the filesystem
we are connecting to supports case sensitivity. This change of behavior is
considered a bug fix, as it was previously possible to accidentally overwrite a
file that had the same case-insensitive name but a different case-sensitive name
as a previously-existing file, while creating a new file.

If it is not possible to detect if the filesystem supports case sensitivity,
the user-specified option value will be used.


######################################################################
Changes
#######

smb.conf changes
- ----------------

    Parameter Name                      Description     Default
    --------------                      -----------     -------
    cups connection timeout		New		30
    idmap config DOM:range		Removed
    idmap domains			Removed
    init logon delayed hosts		New		""
    init logon delay			New		100
    ldap ssl				Changed Default	start tls
    share modes				Deprecated
    winbind reconnect delay		New		30


Changes since 3.3.0rc2:
- -----------------------


o   Jeremy Allison <jra at samba.org>
    * BUG 4308: Fix corrupting of file ACLs during Excel save operations.
    * BUG 5979: Fix level 2 oplocks being granted improperly.
    * BUG 5980: Race condition when granting level2 oplocks can cause break
      notify to be missed.
    * BUG 5986: Editing a stream is broken (rename problems).
    * BUG 5990: Strict allocate should be checked before ftruncate.
    * BUG 6009: Setting "min receivefile size = 1" breaks writes.
    * BUG 6016: Alternate Data Streams / Extended Attributes seem to conflict.
    * BUG 6017: Fix magic scripts.
    * BUG 6019: Fix file corruption in Clustered SMB/NFS environment managed via
      CTDB.
    * BUG 6021: smbclient du command does not recuse properly.
    * BUG 6024: Deprecate the "share modes" parameter.
    * BUG 6030: Add missing <th> header in Status page.
    * BUG 6035: Fix possible race between fcntl F_SETLKW and alarm delivery.
    * BUG 6040: Calling Samba print server with an aliased DNS-name fails.
    * Fix gcc 4.3.2 warnings.
    * Fix more asprintf errors and error code paths.
    * Attempt to fix crash seen with new CUPS async printcap loading code.
    * Add winbindd_reinit_after_fork(), cleaning out all possible events
      in a forked child.
    * Make winbindd_cm.c use winbindd_reinit_after_fork().
    * Fix race condition in alarm lock processing.
    * Fixes crash bug in SWAT.


o   Michael Adam <obnox at samba.org>
    * Fix build of pam_winbind.so on older Linux systems.
    * Packaging RHEL-CTDB: Fix build of [u]mount.cifs.
    * Prevent access to root filesystem when connecting with empty service name.
    * Fix distclean target and add realdistclean target in the docs build.
    * Add manpage for idmap_tdb2.
    * Clarify idmap manpages.


o   Kai Blin <kai at samba.org>
    * BUG 5953: Fix smbclient crashes.


o   Gerald (Jerry) Carter <jerry at samba.org>
    * Fix "allow trusted domain" so it disables trusted domains.
    * Return immediately on a failed GC connection in ads_connect.


o   SATOH Fumiyasu <fumiyas at osstech.jp>
    * Fix gmem->numgids and gmem->maxgids breakage on Solaris 64-bit.
    * Fix SIGBUS on non-x86 CPUs in libsmbclient.
    * Fix a compile-time warning.


o   Holger Hetterich <hhetter at novell.com>
    * Add a simple tdb integrity check to tdbtool.


o   Björn Jacke <bj at sernet.de>
    * Correct the description of the "ldap timeout" parameter.


o   Volker Lendecke <vl at samba.org>
    * BUG 5913: Fix build error with at least GCC 4.2.2.
    * BUG 5933: Fix incrementing/decrementing of num_validated_vuids.
    * BUG 5953: Make cli_send_smb_direct_writeX use writev.
    * BUG 5965: Fix creation of the first share using SWAT.
    * BUG 5969: Optimize smbclient put command.
    * BUG 6012: Add "get_real_filename" to full_audit.
    * BUG 6014: Fix segfault when calling mget without arguments.
    * Fix a spinning smbd when printing.
    * Fix a memory leak in cups_pull_comment_location.
    * Fix a valgrind error.
    * Fix a "ignoring function call result" warning.
    * Fix some C++ warnings.
    * Fix an ancient uninitialized variable read.
    * Fix a bad memleak in vfs_full_audit.


o   Derrell Lipman <derrell.lipman at unwireduniverse.com>
    * BUG 6022: Make smbc_urlencode and smbc_urldecode in libsmbclient.
    * Determine case sensitivity based on file system attributes.


o   Stefan Metzmacher <metze at samba.org>
    * net_status: Use dbwrap to open sessionid.tdb.
    * Fix dbwrap_store_uint32() to match dbwrap_store_int32().
    * Make marshalling struct samu from and to a buffer more generic.
    * Store the next rid counter in passdb.tdb instead of winbind_idmap.tdb.
    * Register the client connection via CTDB_CONTROL_TCP_ADD.
    * Don't need to call messaging_reinit() twice.
    * Raise TDBSAM_VERSION.
    * Add manpage for vfs_fileid.
    * Rename 'fd_event' to 'winbindd_fd_event' to avoid confusion.
    * Recreate the per domain check_online_event without relying on global
      state.
    * Handle the smb signing states the same in the krb5 and ntlmssp cases.
    * Re-add 'fileid:algorithm' option to vfs_fileid.
    * Fix CTDB IPv6 support in cluster setups.
    * Reinit_after_fork() should reinit the event context before the
      messaging context.
    * Fix PCAP support in socket_wrapper.


o   Lars Müller <lars at samba.org>
    * Tweak with pam defines of older Linux versions.


o   Tim Prouty <tprouty at samba.org>
    * Fix stream marshalling to return the correct streaminfo status.
    * Allow renames of streams via NTRENAME and fix stream error codes on
      rename.
    * Remove a few unnecessary checks from the streams xattr module.
    * Remove a few unnecessary checks from the streams depot module and fix to
      work with NTRENAME.


o   Andreas Schneider <anschneider at suse.de>
    * Fix a segfault if ? is there but the options are NULL.
    * Avoid flooding of syslog with failing pam_putenv messages.


o   Karolin Seeger <kseeger at samba.org>
    * BUG 6000: Avoid bashism in perfcount.init.
    * Change default value of "ldap ssl" to "start tls".
    * Update version number in the manpages.
    * Fix several small issues and typos in the manpages.
    * Check if Unix account exists before asking for the password in smbpasswd.


o   Todd Stecher <todd.stecher at gmail.com>
    * Fix memory leaks and other fixes found by Coverity.


o   Bo Yang <boyang at novell.com>
    * Clean event context after child is forked.
    * Fix broken krb5 refresh chain.
    * Set entry->refresh_time to make ccache_regain_all_now() work correctly.
    * Refresh sequence number as soon as possible.
    * Don't set child->requests to NULL in parent after fork.
    * Don't send message to any other child in child process.
    * Fix bug in get_dc_name_via_netlogon(), null pointer reference.


================
Download Details
================

The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA).  The source code can be downloaded
from:

        http://download.samba.org/samba/ftp/

The release notes are available online at:

        http://www.samba.org/samba/ftp/history/samba-3.3.0.html

Binary packages will be made available on a volunteer basis from

        http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

                        --Enjoy
                        The Samba Team



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAkl+xKQACgkQKGi9fisXk1FTtACfZmxpMxe+hf3NA3GZSphyIpZV
ePQAn3cVMjNJ4NpZpV/DDP3m3CNu7G9z
=Bf7U
-----END PGP SIGNATURE-----

More information about the samba mailing list