- Timestamp:
- May 23, 2008, 6:56:41 AM (17 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.0/docs/htmldocs/Samba3-HOWTO/ChangeNotes.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 9. Important Samba-3.0.23 Change Notes</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="The Official Samba-3 HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="optional.html" title="Part III. Advanced Configuration"><link rel="next" href="NetworkBrowsing.html" title="Chapter 10. Network Browsing"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 9. Important Samba-3.0.23 Change Notes</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="optional.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="NetworkBrowsing.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ChangeNotes"></a>Chapter 9. Important Samba-3.0.23 Change Notes</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a href="mailto:jerry@samba.org">jerry@samba.org</a>></code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ChangeNotes.html#id343765">User and Group Changes</a></span></dt><dt><span class="sect1"><a href="ChangeNotes.html#id344054">Passdb Changes</a></span></dt><dt><span class="sect1"><a href="ChangeNotes.html#id344106">Group Mapping Changes in Samba-3.0.23</a></span></dt><dt><span class="sect1"><a href="ChangeNotes.html#id344223">LDAP Changes in Samba-3.0.23</a></span></dt></dl></div><p> 2 Samba is a fluid and ever changing project. Sometimes it is difficult to figure out which part, 3 or parts, of the HOWTO documentation should be updated tio reflect the impact of new or modified 4 features. At other times it becomes clear that the documentation is in need of being restructured. 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 9. Important and Critical Change Notes for the Samba 3.x Series</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="optional.html" title="Part III. Advanced Configuration"><link rel="next" href="NetworkBrowsing.html" title="Chapter 10. Network Browsing"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 9. Important and Critical Change Notes for the Samba 3.x Series</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="optional.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="NetworkBrowsing.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ChangeNotes"></a>Chapter 9. Important and Critical Change Notes for the Samba 3.x Series</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jerry@samba.org">jerry@samba.org</a>></code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ChangeNotes.html#id366427">Important Samba-3.2.x Change Notes</a></span></dt><dt><span class="sect1"><a href="ChangeNotes.html#id366438">Important Samba-3.0.x Change Notes</a></span></dt><dd><dl><dt><span class="sect2"><a href="ChangeNotes.html#id366486">User and Group Changes</a></span></dt><dt><span class="sect2"><a href="ChangeNotes.html#id366776">Essential Group Mappings</a></span></dt><dt><span class="sect2"><a href="ChangeNotes.html#id366887">Passdb Changes</a></span></dt><dt><span class="sect2"><a href="ChangeNotes.html#id366943">Group Mapping Changes in Samba-3.0.23</a></span></dt><dt><span class="sect2"><a href="ChangeNotes.html#id367059">LDAP Changes in Samba-3.0.23</a></span></dt></dl></dd></dl></div><p> 2 Please read this chapter carefully before update or upgrading Samba. You should expect to find only critical 3 or very important information here. Comprehensive change notes and guidance information can be found in the 4 section <a class="link" href="upgrading-to-3.0.html" title="Chapter 35. Updating and Upgrading Samba">Updating and Upgrading Samba</a>. 5 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id366427"></a>Important Samba-3.2.x Change Notes</h2></div></div></div><p> 6 !!!!!!!!!!!!Add all critical update notes here!!!!!!!!!!!!! 7 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id366438"></a>Important Samba-3.0.x Change Notes</h2></div></div></div><p> 8 These following notes pertain in particular to Samba 3.0.23 through Samba 3.0.25c (or more recent 3.0.25 9 update). Samba is a fluid and ever changing project. Changes throughout the 3.0.x series release are 10 documented in this documention - See <a class="link" href="upgrading-to-3.0.html#oldupdatenotes" title="Upgrading from Samba-2.x to Samba-3.0.25">Upgrading from Samba-2.x to Samba-3.0.25</a>. 5 11 </p><p> 6 In recent times a group of Samba users has joined the thrust to create a new <a href="http://wiki.samba.org/" target="_top">Samba Wiki</a> that is slated to become the all-singing and all-dancing 12 Sometimes it is difficult to figure out which part, or parts, of the HOWTO documentation should be updated to 13 reflect the impact of new or modified features. At other times it becomes clear that the documentation is in 14 need of being restructured. 15 </p><p> 16 In recent times a group of Samba users has joined the thrust to create a new <a class="ulink" href="http://wiki.samba.org/" target="_top">Samba Wiki</a> that is slated to become the all-singing and all-dancing 7 17 new face of Samba documentation. Hopefully, the Wiki will benefit from greater community input and 8 18 thus may be kept more up to date. Until that golden dream materializes and matures it is necessary to … … 12 22 This chapter is new to the release of the HOWTO for Samba 3.0.23. It includes much of the notes provided 13 23 in the <code class="filename">WHATSNEW.txt</code> file that is included with the Samba source code release tarball. 14 </p><div class="sect 1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id343765"></a>User and Group Changes</h2></div></div></div><p>24 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id366486"></a>User and Group Changes</h3></div></div></div><p> 15 25 The change documented here affects unmapped user and group accounts only. 16 26 </p><p> 17 <a class="indexterm" name="id3 43777"></a>18 <a class="indexterm" name="id3 43784"></a>19 <a class="indexterm" name="id3 43790"></a>20 <a class="indexterm" name="id3 43799"></a>21 <a class="indexterm" name="id3 43808"></a>27 <a class="indexterm" name="id366498"></a> 28 <a class="indexterm" name="id366505"></a> 29 <a class="indexterm" name="id366512"></a> 30 <a class="indexterm" name="id366520"></a> 31 <a class="indexterm" name="id366529"></a> 22 32 The user and group internal management routines have been rewritten to prevent overlaps of 23 33 assigned Relative Identifiers (RIDs). In the past the has been a potential problem when … … 26 36 <code class="literal">net rpc vampire</code>. 27 37 </p><p> 28 <a class="indexterm" name="id3 43837"></a>29 <a class="indexterm" name="id3 43843"></a>30 <a class="indexterm" name="id3 43850"></a>31 <a class="indexterm" name="id3 43856"></a>38 <a class="indexterm" name="id366558"></a> 39 <a class="indexterm" name="id366564"></a> 40 <a class="indexterm" name="id366571"></a> 41 <a class="indexterm" name="id366578"></a> 32 42 Unmapped users are now assigned a SID in the <code class="literal">S-1-22-1</code> domain and unmapped 33 43 groups are assigned a SID in the <code class="literal">S-1-22-2</code> domain. Previously they were 34 assign a RID within the SAM on the Samba server. For a domain controller this would have been under the44 assigned a RID within the SAM on the Samba server. For a domain controller this would have been under the 35 45 authority of the domain SID where as on a member server or standalone server, this would have 36 46 been under the authority of the local SAM (see the man page for <code class="literal">net getlocalsid</code>). 37 47 </p><p> 38 <a class="indexterm" name="id3 43889"></a>39 <a class="indexterm" name="id3 43896"></a>40 <a class="indexterm" name="id3 43903"></a>41 <a class="indexterm" name="id3 43909"></a>42 <a class="indexterm" name="id3 43916"></a>48 <a class="indexterm" name="id366611"></a> 49 <a class="indexterm" name="id366617"></a> 50 <a class="indexterm" name="id366624"></a> 51 <a class="indexterm" name="id366631"></a> 52 <a class="indexterm" name="id366638"></a> 43 53 The result is that any unmapped users or groups on an upgraded Samba domain controller may 44 54 be assigned a new SID. Because the SID rather than a name is stored in Windows security … … 50 60 An example helps to illustrate the change: 51 61 </p><p> 52 <a class="indexterm" name="id3 43934"></a>53 <a class="indexterm" name="id3 43941"></a>54 <a class="indexterm" name="id3 43947"></a>55 <a class="indexterm" name="id3 43954"></a>62 <a class="indexterm" name="id366655"></a> 63 <a class="indexterm" name="id366662"></a> 64 <a class="indexterm" name="id366669"></a> 65 <a class="indexterm" name="id366675"></a> 56 66 Assume that a group named <span class="emphasis"><em>developers</em></span> exists with a UNIX GID of 782. In this 57 67 case this user does not exist in Samba's group mapping table. It would be perfectly normal for 58 68 this group to be appear in an ACL editor. Prior to Samba-3.0.23, the group SID might appear as 59 <code class="literal">S-1-5-21-647511796-4126122067-3123570092-2565</code>. 69 <code class="literal">S-1-5-21-647511796-4126122067-3123570092-2565</code>. 60 70 </p><p> 61 <a class="indexterm" name="id343976"></a> 62 <a class="indexterm" name="id343982"></a> 63 <a class="indexterm" name="id343989"></a> 64 <a class="indexterm" name="id343996"></a> 65 With the release of Samba-3.0.23, the group SID would be reported as <code class="literal">S-1-22-2-782</code>. 66 Any security descriptors associated with files stored on a Windows NTFS disk partition will not allow 67 access based on the group permissions if the user was not a member of the 68 <code class="literal">S-1-5-21-647511796-4126122067-3123570092-2565</code> group. 69 Because this group SID is <code class="literal">S-1-22-2-782</code> and not reported in a user's token, 70 Windows would fail the authorization check even though both SIDs in some respect refer to the 71 same UNIX group. 71 <a class="indexterm" name="id366697"></a> 72 <a class="indexterm" name="id366703"></a> 73 <a class="indexterm" name="id366710"></a> 74 <a class="indexterm" name="id366717"></a> 75 With the release of Samba-3.0.23, the group SID would be reported as <code class="literal">S-1-22-2-782</code>. Any 76 security descriptors associated with files stored on a Windows NTFS disk partition will not allow access based 77 on the group permissions if the user was not a member of the 78 <code class="literal">S-1-5-21-647511796-4126122067-3123570092-2565</code> group. Because this group SID is 79 <code class="literal">S-1-22-2-782</code> and not reported in a user's token, Windows would fail the authorization check 80 even though both SIDs in some respect refer to the same UNIX group. 72 81 </p><p> 73 <a class="indexterm" name="id3 44027"></a>74 <a class="indexterm" name="id3 44034"></a>82 <a class="indexterm" name="id366748"></a> 83 <a class="indexterm" name="id366755"></a> 75 84 The workaround for versions of Samba prior to 3.0.23, is to create a manual domain group mapping 76 85 entry for the group <span class="emphasis"><em>developers</em></span> to point at the 77 86 <code class="literal">S-1-5-21-647511796-4126122067-3123570092-2565</code> SID. With the release of Samba-3.0.23 this 78 87 workaround is no longer needed. 79 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id344054"></a>Passdb Changes</h2></div></div></div><p> 80 <a class="indexterm" name="id344062"></a> 81 <a class="indexterm" name="id344069"></a> 82 <a class="indexterm" name="id344075"></a> 83 <a class="indexterm" name="id344082"></a> 84 The <a class="indexterm" name="id344089"></a>passdb backend parameter no long accepts multiple passdb backends in a 88 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id366776"></a>Essential Group Mappings</h3></div></div></div><p> 89 Samba 3.0.x series releases before 3.0.23 automatically created group mappings for the essential Windows 90 domain groups <code class="literal">Domain Admins, Domain Users, Domain Guests</code>. Commencing with Samba 3.0.23 91 these mappings need to be created by the Samba administrator. Failure to do this may result in a failure to 92 correctly authenticate and recoognize valid domain users. When this happens users will not be able to log onto 93 the Windows client. 94 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 95 Group mappings are essentail only if the Samba servers is running as a PDC/BDC. Stand-alone servers do not 96 require these group mappings. 97 </p></div><p> 98 The following mappings are required: 99 </p><div class="table"><a name="TOSH-domgroups"></a><p class="title"><b>Table 9.1. Essential Domain Group Mappings</b></p><div class="table-contents"><table summary="Essential Domain Group Mappings" border="1"><colgroup><col><col><col></colgroup><thead><tr><th align="center">Domain Group</th><th align="center">RID</th><th align="center">Example UNIX Group</th></tr></thead><tbody><tr><td align="center">Domain Admins</td><td align="center">512</td><td align="center">root</td></tr><tr><td align="center">Domain Users</td><td align="center">513</td><td align="center">users</td></tr><tr><td align="center">Domain Guests</td><td align="center">514</td><td align="center">nobody</td></tr></tbody></table></div></div><br class="table-break"><p> 100 When the POSIX (UNIX) groups are stored in LDAP, it may be desirable to call these <code class="literal">domadmins, domusers, 101 domguests</code> respectively. 102 </p><p> 103 For further information regarding group mappings see <a class="link" href="groupmapping.html" title="Chapter 12. Group Mapping: MS Windows and UNIX">Group Mapping: MS Windows 104 and UNIX</a>. 105 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id366887"></a>Passdb Changes</h3></div></div></div><p> 106 <a class="indexterm" name="id366895"></a> 107 <a class="indexterm" name="id366902"></a> 108 <a class="indexterm" name="id366908"></a> 109 <a class="indexterm" name="id366915"></a> 110 The <a class="link" href="smb.conf.5.html#PASSDBBACKEND">passdb backend</a> parameter no long accepts multiple passdb backends in a 85 111 chained configuration. Also be aware that the SQL and XML based passdb modules have been 86 112 removed in the Samba-3.0.23 release. More information regarding external support for a SQL 87 passdb module can be found on the <a href="http://pdbsql.sourceforge.net/" target="_top">pdbsql</a> web site.88 </p></div><div class="sect 1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id344106"></a>Group Mapping Changes in Samba-3.0.23</h2></div></div></div><p>89 <a class="indexterm" name="id3 44114"></a>90 <a class="indexterm" name="id3 44121"></a>91 <a class="indexterm" name="id3 44128"></a>92 <a class="indexterm" name="id3 44135"></a>93 <a class="indexterm" name="id3 44142"></a>94 <a class="indexterm" name="id3 44148"></a>95 <a class="indexterm" name="id3 44155"></a>96 <a class="indexterm" name="id3 44162"></a>97 <a class="indexterm" name="id3 44168"></a>98 <a class="indexterm" name="id3 44175"></a>99 <a class="indexterm" name="id3 44182"></a>113 passdb module can be found on the <a class="ulink" href="http://pdbsql.sourceforge.net/" target="_top">pdbsql</a> web site. 114 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id366943"></a>Group Mapping Changes in Samba-3.0.23</h3></div></div></div><p> 115 <a class="indexterm" name="id366950"></a> 116 <a class="indexterm" name="id366957"></a> 117 <a class="indexterm" name="id366964"></a> 118 <a class="indexterm" name="id366971"></a> 119 <a class="indexterm" name="id366978"></a> 120 <a class="indexterm" name="id366984"></a> 121 <a class="indexterm" name="id366991"></a> 122 <a class="indexterm" name="id366998"></a> 123 <a class="indexterm" name="id367004"></a> 124 <a class="indexterm" name="id367011"></a> 125 <a class="indexterm" name="id367018"></a> 100 126 The default mapping entries for groups such as <code class="literal">Domain Admins</code> are no longer 101 127 created when using an <code class="literal">smbpasswd</code> file or a <code class="literal">tdbsam</code> passdb … … 104 130 Windows group SID to UNIX GID mappings. This change has no effect on winbindd's IDMAP functionality 105 131 for domain groups. 106 </p></div><div class="sect 1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id344223"></a>LDAP Changes in Samba-3.0.23</h2></div></div></div><p>107 <a class="indexterm" name="id3 44231"></a>108 <a class="indexterm" name="id3 44238"></a>109 <a class="indexterm" name="id3 44245"></a>110 <a class="indexterm" name="id3 44252"></a>111 <a class="indexterm" name="id3 44258"></a>132 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id367059"></a>LDAP Changes in Samba-3.0.23</h3></div></div></div><p> 133 <a class="indexterm" name="id367067"></a> 134 <a class="indexterm" name="id367074"></a> 135 <a class="indexterm" name="id367081"></a> 136 <a class="indexterm" name="id367088"></a> 137 <a class="indexterm" name="id367094"></a> 112 138 There has been a minor update the Samba LDAP schema file. A substring matching rule has been 113 139 added to the <code class="literal">sambaSID</code> attribute definition. For OpenLDAP servers, this 114 140 will require the addition of <code class="literal">index sambaSID sub</code> to the 115 <code class="filename">slapd.conf</code> configuration file. It will be necessary to execute the 141 <code class="filename">slapd.conf</code> configuration file. It will be necessary to execute the 116 142 <code class="literal">slapindex</code> command after making this change. There has been no change to the 117 143 actual data storage schema. 118 </p></div></div>< div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="optional.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="NetworkBrowsing.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Part III. Advanced Configuration </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 10. Network Browsing</td></tr></table></div></body></html>144 </p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="optional.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="NetworkBrowsing.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Part III. Advanced Configuration </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 10. Network Browsing</td></tr></table></div></body></html>
Note:
See TracChangeset
for help on using the changeset viewer.
