The branch, master has been updated via 3360f9a WHATSNEW: mention overhauled "net idmap" command via 6efb366 WHATSNEW: Improved DCERPC man in the middle detection via e28b087 WHATSNEW: Larger IO sizes for SMB2/3 per default via fc70caa WHATSNEW: Winbindd/Netlogon improvements from 277f041 passdb: Use talloc_zero_array
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master - Log ----------------------------------------------------------------- commit 3360f9ac33e7025811c00f3d7cb04cb9e4d81ec4 Author: Michael Adam <ob...@samba.org> Date: Sat Sep 20 01:53:28 2014 +0200 WHATSNEW: mention overhauled "net idmap" command Signed-off-by: Michael Adam <ob...@samba.org> Reviewed-by: Stefan Metzmacher <me...@samba.org> Autobuild-User(master): Stefan Metzmacher <me...@samba.org> Autobuild-Date(master): Sat Sep 20 11:37:51 CEST 2014 on sn-devel-104 commit 6efb366796a4e0e1a327ddf552fa663d858aecdb Author: Stefan Metzmacher <me...@samba.org> Date: Sat Sep 20 01:29:19 2014 +0200 WHATSNEW: Improved DCERPC man in the middle detection Signed-off-by: Stefan Metzmacher <me...@samba.org> Reviewed-by: Michael Adam <ob...@samba.org> commit e28b087fb94f282bb930aac557e6e36481c1a26f Author: Stefan Metzmacher <me...@samba.org> Date: Sat Sep 20 01:18:53 2014 +0200 WHATSNEW: Larger IO sizes for SMB2/3 per default Signed-off-by: Stefan Metzmacher <me...@samba.org> Reviewed-by: Michael Adam <ob...@samba.org> commit fc70caaf186d51c58d9699e4dc11f6645baad156 Author: Stefan Metzmacher <me...@samba.org> Date: Sat Sep 20 01:14:11 2014 +0200 WHATSNEW: Winbindd/Netlogon improvements Signed-off-by: Stefan Metzmacher <me...@samba.org> Reviewed-by: Michael Adam <ob...@samba.org> ----------------------------------------------------------------------- Summary of changes: WHATSNEW.txt | 72 +++++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 files changed, 69 insertions(+), 3 deletions(-) Changeset truncated at 500 lines: diff --git a/WHATSNEW.txt b/WHATSNEW.txt index 617dca1..e9a5627 100644 --- a/WHATSNEW.txt +++ b/WHATSNEW.txt @@ -12,6 +12,7 @@ Samba 4.2 will be the next version of the Samba suite. UPGRADING ========= +Read the "Winbindd/Netlogon improvements" section (below) carefully! NEW FEATURES @@ -35,6 +36,65 @@ Snapper for use by Samba. This provides the ability for remote clients to access shadow-copies via Windows Explorer using the "previous versions" dialog. +Winbindd/Netlogon improvements +============================== + +The whole concept of maintaining the netlogon secure channel +to (other) domain controllers is rewritten in order to maintain +global state in a netlogon_creds_cli.tdb. This is the proper fix +for a large number of bugs: + + https://bugzilla.samba.org/show_bug.cgi?id=6563 + https://bugzilla.samba.org/show_bug.cgi?id=7944 + https://bugzilla.samba.org/show_bug.cgi?id=7945 + https://bugzilla.samba.org/show_bug.cgi?id=7568 + https://bugzilla.samba.org/show_bug.cgi?id=8599 + +In addition a strong session key is required by default now, +which means that communication to older servers or clients +might be rejected by default. + +For the client side we the following new options: +"require strong key" (yes by default), "reject md5 servers" (no by default). +E.g. for Samba 3.0.37 you need "require strong key = no" and +for NT4 DCs you need "require strong key = no" and "client NTLMv2 auth = no", + +On the server side (as domain controller) we have the following new options: +"allow nt4 crypto" (no by default), "reject md5 client" (no by default). +E.g. in order to allow Samba < 3.0.27 or NT4 members to work +you need "allow nt4 crypto = yes" + +winbindd does not list group memberships for display purposes +(e.g. getent group <domain\<group>) anymore by default. +The new default is "winbind expand groups = 0" now, +the reason for this is the same as for "winbind enum users = no" +and "winbind enum groups = no". Providing this information is not always +reliably possible, e.g. if there're trusted domains. + +Please consult the smb.conf manpage for more details of this new options. + +Larger IO sizes for SMB2/3 by default +===================================== + +The default values for "smb2 max read", "smb2 max write" and "smb2 max trans" +have been changed to 8388608 (8MiB) in order to match the default of +Windows 2012R2. + +Improved DCERPC man in the middle detection +=========================================== + +The DCERPC header signing has been implemented +in addition to the dcerpc_sec_verification_trailer +protection. + +Overhauled "net idmap" command +============================== + +The command line interface of the "net idmap" command has been +systematized and subcommands for reading and writing the autorid idmap +database have been added. Note that the writing commands should be +used with great care. See the net(8) manual page for details. + ###################################################################### Changes @@ -46,9 +106,15 @@ smb.conf changes Parameter Name Description Default -------------- ----------- ------- - - - + allow nt4 crypto New no + neutralize nt4 emulation New no + reject md5 client New no + reject md5 servers New no + require strong key New yes + smb2 max read Changed default 8388608 + smb2 max write Changed default 8388608 + smb2 max trans Changed default 8388608 + winbind expand groups Changed default 0 KNOWN ISSUES ============ -- Samba Shared Repository