WHATS NEW IN Samba 2.2.1a: 11th July 2001
==========================================
This is the latest stable release of Samba. This is the version that all
production Samba servers should be running for all current bug-fixes.
This is a minor bugfix release for 2.2.1, *NOT* security related.
1). 2.2.1 had a bug where using smbpasswd -m to add a Windows NT or
Windows2000 machine into a Samba hosted PDC would fail due to our
stricter user name checking. We were disallowing user names
containing '$', which is needed when using smbpasswd to add a
machine into a domain. Automatically adding machines (using the
native Windows tools) into a Samba domain worked correctly.
2.2.1a fixes this single problem.
New/Changed parameters in 2.2.1
-------------------------------
Added parameters.
-----------------
obey pam restrictions
When Samba is configured to use PAM, turns on or off Samba checking
the PAM account restrictions. Defaults to off.
pam password change
When Samba is configured to use PAM, turns on or off Samba passing
the password changes to PAM. Defaults to off.
large readwrite
New option to allow new Windows 2000 large file (64k) streaming
read/write options. Needs a 64 bit underlying operating system
(for Linux use kernel 2.4 with glibc 2.2 or above). Can improve performance
by 10% with Windows 2000 clients. Defaults to off. Not as tested
as some other Samba code paths.
hide unreadable
Prevents clients from seeing the existance of files that cannot
be read. Off by default.
enhanced browsing
Turn on/off the enhanced Samba browing functionality (*1B names).
Default is "on". Can prevent eternal machines in workgroups when
WINS servers are not synchronised.
Removed parameters.
-------------------
domain groups
domain admin users
domain guest users
Changes in 2.2.1
-----------------
1). "find" command removed for smbclient. Internal code now used.
2). smbspool updates to retry connections from Michael Sweet.
3). Fix for mapping 8859-15 characters to UNICODE.
4). Changed "security=server" to try with invalid username to prevent
account lockouts.
5). Fixes to allow Windows 2000 SP2 clients to join a Samba PDC.
6). Support for Windows 9x Nexus tools to allow security changes from Win9x.
7). Two locking fixes added. Samba 2.2.1 now passes the Clarion network
lock tester tool for distributed databases.
8). Preliminary support added for Windows 2000 large file read/write SMBs.
9). Changed random number generator in Samba to prevent guess attacks.
10). Fixes for tdb corruption in connections.tdb and file locking brlock.tdb.
smbd's clean the tdb files on startup and shutdown.
11). Fixes for default ACLs on Solaris.
12). Tidyup of password entry caching code.
13). Correct shutdowns added for send fails. Helps tdb cleanup code.
14). Prevent invalid '/' characters in workgroup names.
15). Removed more static arrays in SAMR code.
16). Client code is now UNICODE on the wire.
17). Fix 2 second timstamp resolution everywhere if dos timestamp set to yes.
18). All tdb opens now going through logging function.
19). Add pam password changing and pam restrictions code.
20). Printer driver management improvements (delete driver).
21). Fix difference between NULL security descriptors and empty
security descriptors.
22). Fix SID returns for server roles.
23). Allow Windows 2000 mmc to view and set Samba share security descriptors.
24). Allow smbcontrol to forcibly disconnect a share.
25). tdb fixes for HPUX, OpenBSD and other OS's that don't have a coherent
mmap/file read/write cache.
26). Fix race condition in returning create disposition for file create/open.
27). Fix NT rewriting of security descriptors to their canonical form for
ACLs.
28). Fix for Samba running on top of Linux VFAT ftruncate bug.
29). Swat fixes for being run with xinetd that doesn't set the umask.
30). Fix for slow writes with Win9x Explorer clients. Emulates Microsoft
TCP stack early ack specification error.
31). Changed lock & persistant tdb directory to /var/cache/samba by default on
RedHat and Mandrake as they clear the /var/lock/samba directory on reboot.
refinements since 4.0.99k, a new feature -- an experimental
"huff-n-puff" filter (optionally enabled in /etc/ntp.conf) -- which
discards samples with the highest delays, and new drivers for:
Forum Graphic GPS, WWV/H, Heath GC-100 II, HOPF serial and PCI,
ONCORE, ulink331.
Drop the packages's requirement for GNU readline. It turns out
that command line editing in "ntpq" is not all that useful, as
you can alway let your shell recall "ntpq -c <command>".
Changes:
o several new options in config file revelant when sending messages to Plus phones;
now supports ICQ gateway, too
o yet another change in Era handling code
o improved way to parse email address from both environment variables and config file
o improved hostname detection code
* converted to use buildlink.mk files
* simplified patch-aa
--- 9.1.3 released ---
--- 9.1.3rc3 released ---
911. [bug] Fail gracefully with multiple hint zones. [RT #1433]
910. [port] Some pre-RFC2133 IPv6 implementations do not define
IN6ADDR_ANY_INIT. [RT #1416]
--- 9.1.3rc2 released ---
904. [bug] The server would leak memory if attempting to use
an expired TSIG key. [RT #1406]
903. [bug] dig should not crash when receiving a TCP packet
of length 0.
902. [bug] The -d option was ignored if both -t and -g were also
specified.
901. [cleanup] The man pages no longer have empty lines outside of
literal blocks.
898. [bug] "dig" failed to set a nonzero exit status
on UDP query timeout. [RT #1323]
894. [bug] When using the DNSSEC tools, a message intended to warn
when the keyboard was being used because of the lack
of a suitable random device was not being printed.
892. [bug] The server could attempt to refresh a zone that
was being loaded, causing an assertion failure.
[RT #1335]
891. [bug] Return an error when a SIG(0) signed response to
an unsigned query is seen. This should actually
do the verification, but it's not currently
possible. [RT #1391]
888. [bug] Don't die when using TKEY to delete a nonexistent
TSIG key. [RT #1392]
860. [interop] Drop cross class glue in zone transfers.
852. [bug] Handle responses from servers which do not
now about IXFR.
850. [bug] dns_rbt_findnode() would not find nodes that were
split on a bitstring label somewhere other than in
the last label of the node. [RT #1351]
705. [port] Work out resource limit type for use where rlim_t is
not available. [RT #695]
704. [port] RLIMIT_NOFILE is not available on all platforms.
703. [port] sys/select.h is needed on older platforms. [RT #695]
--- 9.1.3rc1 released ---
831. [bug] The configure script tried to determine
endianness before making its final decision on
which C compiler to use, causing Solaris/x86
systems with gcc to be incorrectly identified
as big-endian. [RT #1315]
827. [bug] When an IXFR protocol error occurs, the slave
should retry with AXFR.
826. [bug] Some IXFR protocol errors were not detected.
825. [bug] zone.c:ns_query() detached from the wrong zone
reference. [RT #1264]
824. [bug] Correct line numbers reported by dns_master_load().
[RT #1263]
822. [bug] Sending nxrrset prerequisites would crash nsupdate.
[RT #1248]
806. [bug] DNS_R_SEENINCLUDE was failing to propagate back up
the calling stack to the zone maintence level, causing
zones to not reload when an included file was touched
but the top-level zone file was not.
771. [cleanup] TSIG errors related to unsynchronized clocks
are logged better. [RT #919]
734. [bug] An attempt to re-lock the zone lock could occur if
the server was shutdown during a zone tranfer.
[RT #830]
712. [bug] Sending a large signed update message caused an
assertion failure. [RT #718]
669. [bug] dnssec-keygen now makes the public key file
non-world-readable for symmetric keys. [RT #403]
big enough, resulting into overwriting of stack variables making wmnet
core dump because of segfault. Increase buffer size to avoid that.
Bump to 1.06nb2.
so remove it from package Makefiles. Also move the inclusion of the
buildlink.mk files to the end of the Makefile to just before bsd.pkg.mk
to ensure that any Makefile settings occur before the buildlink.mk files.
This is quite a different package from pkgsrc/devel/p5-LDAP; this one
doesn't require the mozilla ldapsdk, and also seems to be the 'standard'
LDAP interface these days.
WHATS NEW IN Samba 2.2.0a: 23rd June 2001
==========================================
SECURITY FIX
============
This is a security bugfix release for Samba 2.2.0. This release provides the
following two changes *ONLY* from the 2.2.0 release.
1). Fix for the security hole discovered by Michal Zalewski (lcamtuf@bos.bindview.com)
and described in the security advisory below.
2). Fix for the hosts allow/hosts deny parameters not being honoured.
No other changes are being made for this release to ensure a security fix only.
For new functionality (including these security fixes) download Samba 2.2.1
when it is available.
The security advisory follows :
IMPORTANT: Security bugfix for Samba
------------------------------------
June 23rd 2001
Summary
-------
A serious security hole has been discovered in all versions of Samba
that allows an attacker to gain root access on the target machine for
certain types of common Samba configuration.
The immediate fix is to edit your smb.conf configuration file and
remove all occurances of the macro "%m". Replacing occurances of %m
with %I is probably the best solution for most sites.
Details
-------
A remote attacker can use a netbios name containing unix path
characters which will then be substituted into the %m macro wherever
it occurs in smb.conf. This can be used to cause Samba to create a log
file on top of an important system file, which in turn can be used to
compromise security on the server.
The most commonly used configuration option that can be vulnerable to
this attack is the "log file" option. The default value for this
option is VARDIR/log.smbd. If the default is used then Samba is not
vulnerable to this attack.
The security hole occurs when a log file option like the following is
used:
log file = /var/log/samba/%m.log
In that case the attacker can use a locally created symbolic link to
overwrite any file on the system. This requires local access to the
server.
If your Samba configuration has something like the following:
log file = /var/log/samba/%m
Then the attacker could successfully compromise your server remotely
as no symbolic link is required. This type of configuration is very
rare.
The most commonly used log file configuration containing %m is the
distributed in the sample configuration file that comes with Samba:
log file = /var/log/samba/log.%m
in that case your machine is not vulnerable to this attack unless you
happen to have a subdirectory in /var/log/samba/ which starts with the
prefix "log."
Credit
------
Thanks to Michal Zalewski (lcamtuf@bos.bindview.com) for finding this
vulnerability.
New Release
-----------
While we recommend that vulnerable sites immediately change their
smb.conf configuration file to prevent the attack we will also be
making new releases of Samba within the next 24 hours to properly fix
the problem. Please see http://www.samba.org/ for the new releases.
Please report any attacks to the appropriate authority.
The Samba Team
security@samba.org
This is pconsole, the parallel console tool. pconsole was meant as an
interactive administrative shell tool for clusters.
pconsole allows you to connect to each node of your cluster simultaneously,
and you can type your administrative commands in a specialized window that
'multiplies' the input to each of the connections you have opened.
pconsole is best run from within X Windows, although it is possible to
employ it without X (in console mode) as well.
You need to install pconsole on only 1 machine in the cluster, this would
usually be your central administrative node.
pconsole makes use of ssh if possible.
FOO_REQD=1.0 being converted to foo>=1.0, one can now directly specify
the dependency pattern as FOO_DEPENDS=foo>=1.0. This allows things like
JPEG_DEPENDS=jpeg-6b, or fancier expressions like for postgresql-lib.
Change existing FOO_REQD definitions in Makefiles to FOO_DEPENDS.
